@wardby/cli 0.5.3 → 0.7.0

package/dist/viewer/api-schema.js

@@ -6,6 +6,7 @@
  * `npm run build:viewer-schemas`, and commit the regenerated files.
  */
 import { z } from "zod";
+import { legacyJsonSchema } from "../core/zod-json-schema.js";
 export const RunStatusSchema = z.enum([
     "pending",
     "running",
@@ -88,6 +89,10 @@ export const GraphRunSchema = z.object({
     model: z.string(),
     /** The coding worker (e.g. `codex`, `claude-code`); null for native runs. */
     codingProvider: z.string().nullable(),
+    /** Where a native run executed, snapshotted at start; null for coding runs and runs from before the field existed. */
+    nativeExecutionMode: z.enum(["control-plane", "sandbox"]).nullable(),
+    /** The warm pool worker (container or pod name) a sandbox run claimed, while its record lasts; null otherwise. */
+    warmWorkerName: z.string().nullable(),
     status: RunStatusSchema,
     trigger: RunTriggerSchema,
     turns: z.number().int(),
@@ -181,6 +186,24 @@ export const InfraInfoSchema = z.object({
         managedByLabel: z.record(z.string(), z.string()),
     })
         .nullable(),
+    /** How sandbox-mode native agents run; null when NATIVE_SANDBOX_LAUNCHER is unset. */
+    native: z
+        .object({
+        launcher: z.enum(["docker", "kubernetes"]),
+        /** Idle workers kept ready for runs to claim (0 = no pool). */
+        warmPoolSize: z.number().int(),
+        kubernetes: z
+            .object({
+            namespace: z.string(),
+            runtimeClass: z.string().nullable(),
+            runLabel: z.string(),
+            componentLabel: z.record(z.string(), z.string()),
+            warmPoolLabel: z.record(z.string(), z.string()),
+            warmWorkerLabel: z.string(),
+        })
+            .nullable(),
+    })
+        .nullable(),
 });
 export const VIEWER_SCHEMAS = {
     "graph-snapshot": GraphSnapshotSchema,
@@ -188,3 +211,9 @@ export const VIEWER_SCHEMAS = {
     "viewer-event": ViewerEventSchema,
     "infra-info": InfraInfoSchema,
 };
+/** A viewer schema's JSON Schema (draft-07 keywords, no `$schema`), as the published files spell it. */
+export function viewerJsonSchema(schema) {
+    const json = legacyJsonSchema(z.toJSONSchema(schema, { target: "draft-07", io: "output" }));
+    delete json.$schema;
+    return json;
+}

package/dist/viewer/build-schemas.js

@@ -1,18 +1,25 @@
 /** Writes src/viewer/schemas/<name>.schema.json from VIEWER_SCHEMAS (npm run build:viewer-schemas). */
-import { mkdir, writeFile } from "node:fs/promises";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { zodToJsonSchema } from "zod-to-json-schema";
 import { VIEWER_SCHEMAS } from "./api-schema.js";
+import { viewerJsonSchema } from "./api-schema.js";
+import { OPENAPI_PATH, renderViewerOpenApi } from "./openapi.js";
 export const SCHEMA_DIR = join(dirname(fileURLToPath(import.meta.url)), "schemas");
 export function renderSchemas() {
     return Object.fromEntries(Object.entries(VIEWER_SCHEMAS).map(([name, schema]) => [
         `${name}.schema.json`,
-        `${JSON.stringify(zodToJsonSchema(schema, { name, $refStrategy: "none" }), null, 2)}\n`,
+        `${JSON.stringify({
+            $ref: `#/definitions/${name}`,
+            definitions: { [name]: viewerJsonSchema(schema) },
+            $schema: "http://json-schema.org/draft-07/schema#",
+        }, null, 2)}\n`,
     ]));
 }
 if (process.argv[1] === fileURLToPath(import.meta.url)) {
     await mkdir(SCHEMA_DIR, { recursive: true });
     for (const [file, text] of Object.entries(renderSchemas()))
         await writeFile(join(SCHEMA_DIR, file), text);
+    const pkg = JSON.parse(await readFile(new URL("../../package.json", import.meta.url), "utf8"));
+    await writeFile(OPENAPI_PATH, renderViewerOpenApi(pkg.version));
 }

package/dist/viewer/event-bus.d.ts

@@ -14,6 +14,7 @@
  *   layer can tell its clients to refetch whatever they may have missed.
  */
 import pg from "pg";
+import { type DatabaseAuth, type PgAuthOptions } from "../core/pg-auth.js";
 import { type ViewerEvent } from "./api-schema.js";
 export declare const VIEWER_CHANNEL = "wardby_viewer";
 export interface ViewerEventBus {
@@ -29,8 +30,13 @@ export interface ViewerEventBus {
     onState(listener: (live: boolean) => void): () => void;
     close(): Promise<void>;
 }
+/** The LISTEN client's config: auth (pg-auth.ts) plus keepAlive and the pool's connect timeout. */
+export declare function eventBusClientConfig(connectionString: string, auth: DatabaseAuth, pgAuth?: PgAuthOptions): pg.ClientConfig;
 export declare function createViewerEventBus(options: {
     connectionString: string;
+    /** Defaults to DATABASE_AUTH. */
+    auth?: DatabaseAuth;
+    pgAuth?: PgAuthOptions;
     connect?: (connectionString: string) => pg.Client;
     reconnectDelaysMs?: readonly number[];
     healthCheckIntervalMs?: number;

package/dist/viewer/event-bus.js

@@ -16,6 +16,7 @@
 import pg from "pg";
 import { poolSettings } from "../core/db.js";
 import { logger } from "../core/logger.js";
+import { databaseAuthFromEnv, pgConnectionConfig } from "../core/pg-auth.js";
 import { ViewerEventSchema } from "./api-schema.js";
 export const VIEWER_CHANNEL = "wardby_viewer";
 const DEFAULT_RECONNECT_DELAYS_MS = [500, 1000, 2000, 5000, 10_000];
@@ -25,17 +26,25 @@ const DEFAULT_HEALTH_CHECK_INTERVAL_MS = 60_000;
 const DEFAULT_HEALTH_CHECK_TIMEOUT_MS = 10_000;
 /** Upper bound on waiting for a graceful disconnect (a half-open socket never answers). */
 const END_TIMEOUT_MS = 2_000;
+/** The LISTEN client's config: auth (pg-auth.ts) plus keepAlive and the pool's connect timeout. */
+export function eventBusClientConfig(connectionString, auth, pgAuth) {
+    return {
+        ...pgConnectionConfig(connectionString, auth, pgAuth),
+        keepAlive: true,
+        keepAliveInitialDelayMillis: KEEPALIVE_INITIAL_DELAY_MS,
+        connectionTimeoutMillis: poolSettings(connectionString).connectionTimeoutMillis,
+    };
+}
 export function createViewerEventBus(options) {
     const healthIntervalMs = options.healthCheckIntervalMs ?? DEFAULT_HEALTH_CHECK_INTERVAL_MS;
     const healthTimeoutMs = options.healthCheckTimeoutMs ?? DEFAULT_HEALTH_CHECK_TIMEOUT_MS;
     const delays = options.reconnectDelaysMs?.length ? options.reconnectDelaysMs : DEFAULT_RECONNECT_DELAYS_MS;
-    const makeClient = options.connect ??
-        ((connectionString) => new pg.Client({
-            connectionString,
-            keepAlive: true,
-            keepAliveInitialDelayMillis: KEEPALIVE_INITIAL_DELAY_MS,
-            connectionTimeoutMillis: poolSettings(connectionString).connectionTimeoutMillis,
-        }));
+    // Built once, up front: a misconfigured DATABASE_AUTH fails here rather than on every reconnect,
+    // and under rds-iam every reconnect shares one token cache.
+    const clientConfig = options.connect
+        ? undefined
+        : eventBusClientConfig(options.connectionString, options.auth ?? databaseAuthFromEnv(), options.pgAuth);
+    const makeClient = options.connect ?? (() => new pg.Client({ ...clientConfig }));
     const listeners = new Set();
     const stateListeners = new Set();
     let client = null; // the current attempt/connection

package/dist/viewer/graph.d.ts

@@ -1,8 +1,6 @@
 /** The graph snapshot read model behind GET /admin/api/graph (docs/viewer-api.md). */
 import type { Prisma, PrismaClient } from "#prisma";
 import type { GraphRun, GraphSnapshot } from "./api-schema.js";
-export declare const DEFAULT_GRAPH_LIMIT = 500;
-export declare const MAX_GRAPH_LIMIT = 2000;
 /** Accepts "15m" | "1h" | "6h" | "24h" | "7d" or an ISO-8601 timestamp; null defaults to 1h. Throws otherwise. */
 export declare function parseSince(value: string | null, now: Date): Date;
 declare const runInclude: {
@@ -23,6 +21,11 @@ declare const runInclude: {
             createdAt: "asc";
         };
     };
+    nativeWarmWorker: {
+        select: {
+            name: true;
+        };
+    };
 };
 type RunRow = Prisma.RunGetPayload<{
     include: typeof runInclude;

package/dist/viewer/graph.js

@@ -1,7 +1,5 @@
 import { periodStart } from "../core/budget-groups.js";
 import { publicCodingRunResult } from "../coding/protocol.js";
-export const DEFAULT_GRAPH_LIMIT = 500;
-export const MAX_GRAPH_LIMIT = 2000;
 const DEFAULT_SINCE_MS = 60 * 60 * 1000;
 const RELATIVE_SINCE_MS = {
     "15m": 15 * 60 * 1000,
@@ -30,6 +28,7 @@ const runInclude = {
     hostStatus: true,
     issueStatus: true,
     serviceStatuses: { orderBy: { createdAt: "asc" } },
+    nativeWarmWorker: { select: { name: true } },
 };
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /** Name and version of each service in a coding run's resolved services snapshot. */
@@ -151,6 +150,12 @@ export function toGraphRun(row, pullRequests, sites = {}) {
         agentKind: row.agent.kind,
         model: row.codingRun?.model ?? row.agent.model,
         codingProvider: row.codingRun?.provider ?? null,
+        nativeExecutionMode: row.nativeExecutionMode === "sandbox"
+            ? "sandbox"
+            : row.nativeExecutionMode === "control_plane"
+                ? "control-plane"
+                : null,
+        warmWorkerName: row.nativeWarmWorker?.name ?? null,
         status: row.status,
         trigger: triggerFor(row, sites),
         turns: row.turns,

package/dist/viewer/http.d.ts

@@ -12,7 +12,6 @@ import type { InfraInfo } from "./api-schema.js";
 import { type IssueSites } from "./graph.js";
 import type { ViewerEventBus } from "./event-bus.js";
 export declare const VIEWER_API_PREFIX = "/admin/api/";
-export declare const SSE_HEARTBEAT_MS = 15000;
 /** A stream whose unsent backlog exceeds this is ended; the client reconnects and resyncs. */
 export declare const SSE_MAX_BUFFERED_BYTES: number;
 export interface ViewerApiDeps {

package/dist/viewer/http.js

@@ -1,9 +1,9 @@
 import { requireScope } from "../mcp/auth/resource-server.js";
 import { sendJson } from "../mcp/transport/streamable-http.js";
-import { DEFAULT_GRAPH_LIMIT, MAX_GRAPH_LIMIT, loadGraph, parseSince } from "./graph.js";
+import { loadGraph, parseSince } from "./graph.js";
+import { DEFAULT_GRAPH_LIMIT, MAX_GRAPH_LIMIT, SSE_HEARTBEAT_MS } from "./limits.js";
 import { loadRunDetail } from "./run-detail.js";
 export const VIEWER_API_PREFIX = "/admin/api/";
-export const SSE_HEARTBEAT_MS = 15_000;
 /** A stream whose unsent backlog exceeds this is ended; the client reconnects and resyncs. */
 export const SSE_MAX_BUFFERED_BYTES = 1024 * 1024;
 const RUN_ID = /^[A-Za-z0-9_-]{1,64}$/;

package/dist/viewer/infra.js

@@ -1,14 +1,17 @@
 /** The read model behind GET /admin/api/infra (docs/viewer-api.md): built once at startup, no cluster reads. */
-import { loadKubernetesJobConfig, loadProviderConfig } from "../config/providers.js";
+import { loadKubernetesJobConfig, loadNativeSandboxConfig, loadProviderConfig } from "../config/providers.js";
+import { NATIVE_RUN_COMPONENT_LABEL, NATIVE_RUN_SHA_LABEL, NATIVE_WARM_POOL_LABEL, NATIVE_WARM_TOKEN_LABEL, } from "../native-worker/kubernetes-isolation.js";
 import { RUN_COMPONENT_LABEL, RUN_MANAGED_BY_LABEL, RUN_SHA_CHARS, RUN_SHA_LABEL, } from "../providers/jobs/kubernetes-isolation.js";
 export function buildInfraInfo(env = process.env) {
     const raw = loadProviderConfig(env).jobs;
     const launcher = raw === "docker" || raw === "kubernetes" ? raw : "local";
+    const native = buildNativeInfo(env);
     if (launcher !== "kubernetes")
-        return { launcher, kubernetes: null };
+        return { launcher, kubernetes: null, native };
     const k8s = loadKubernetesJobConfig(env);
     return {
         launcher,
+        native,
         kubernetes: {
             namespace: k8s.namespace,
             platform: k8s.platform,
@@ -21,3 +24,23 @@ export function buildInfraInfo(env = process.env) {
         },
     };
 }
+/** Where sandbox-mode native agents run (NATIVE_SANDBOX_*); null when no sandbox launcher is configured. */
+function buildNativeInfo(env) {
+    const config = loadNativeSandboxConfig(env);
+    if (!config)
+        return null;
+    return {
+        launcher: config.launcher,
+        warmPoolSize: config.warmPoolSize,
+        kubernetes: config.launcher === "kubernetes"
+            ? {
+                namespace: config.namespace,
+                runtimeClass: config.runtimeClassName ?? null,
+                runLabel: NATIVE_RUN_SHA_LABEL,
+                componentLabel: { ...NATIVE_RUN_COMPONENT_LABEL },
+                warmPoolLabel: { ...NATIVE_WARM_POOL_LABEL },
+                warmWorkerLabel: NATIVE_WARM_TOKEN_LABEL,
+            }
+            : null,
+    };
+}

package/dist/viewer/limits.d.ts

@@ -0,0 +1,4 @@
+/** Viewer API constants shared by the server and the OpenAPI generator (no runtime imports). */
+export declare const DEFAULT_GRAPH_LIMIT = 500;
+export declare const MAX_GRAPH_LIMIT = 2000;
+export declare const SSE_HEARTBEAT_MS = 15000;

package/dist/viewer/limits.js

@@ -0,0 +1,4 @@
+/** Viewer API constants shared by the server and the OpenAPI generator (no runtime imports). */
+export const DEFAULT_GRAPH_LIMIT = 500;
+export const MAX_GRAPH_LIMIT = 2000;
+export const SSE_HEARTBEAT_MS = 15_000;

package/dist/viewer/openapi.d.ts

@@ -0,0 +1,15 @@
+export declare const OPENAPI_PATH: string;
+type Json = Record<string, unknown>;
+export interface ViewerRoute {
+    path: string;
+    operationId: string;
+    summary: string;
+    description: string;
+    parameters?: readonly Json[];
+    responses: Readonly<Record<string, Json>>;
+}
+export declare const VIEWER_ROUTES: readonly ViewerRoute[];
+export declare function buildViewerOpenApi(version: string): Json;
+export declare const HEADER = "# Generated by npm run build:viewer-schemas from src/viewer/api-schema.ts and src/viewer/openapi.ts. Do not edit.";
+export declare function renderViewerOpenApi(version: string): string;
+export {};

package/dist/viewer/openapi.js

@@ -0,0 +1,170 @@
+/**
+ * Builds the published OpenAPI 3.1 document for the admin viewer API
+ * (docs/viewer-api.openapi.yml) from the zod schemas and a route table.
+ * Generated by `npm run build:viewer-schemas`; never edit the YAML by hand.
+ */
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { stringify } from "yaml";
+import { VIEWER_SCHEMAS } from "./api-schema.js";
+import { viewerJsonSchema } from "./api-schema.js";
+import { DEFAULT_GRAPH_LIMIT, MAX_GRAPH_LIMIT, SSE_HEARTBEAT_MS } from "./limits.js";
+export const OPENAPI_PATH = join(dirname(fileURLToPath(import.meta.url)), "../../docs/viewer-api.openapi.yml");
+const AUTH_NOTE = "Requires a bearer token with the `admin:view` scope, held by a caller with the admin role.";
+const ref = (name) => ({ $ref: `#/components/schemas/${name}` });
+const errorBody = (codes, description) => {
+    const list = codes.split(", ");
+    return {
+        description,
+        content: {
+            "application/json": {
+                schema: { allOf: [ref("ViewerError"), { properties: { error: { enum: list } } }] },
+            },
+        },
+        "x-error-codes": list,
+    };
+};
+const wwwAuthenticate = { "WWW-Authenticate": { $ref: "#/components/headers/WWWAuthenticate" } };
+export const VIEWER_ROUTES = [
+    {
+        path: "/admin/api/graph",
+        operationId: "getGraph",
+        summary: "Graph snapshot",
+        description: "Agents, runs, coding-run services and outcomes for a time window, as a graph.",
+        parameters: [
+            {
+                name: "since",
+                in: "query",
+                required: false,
+                description: "Window start: `15m`, `1h`, `6h`, `24h`, `7d`, or an ISO-8601 timestamp. Default `1h`.",
+                schema: { type: "string", default: "1h" },
+            },
+            {
+                name: "limit",
+                in: "query",
+                required: false,
+                description: `Maximum number of runs, 1 to ${MAX_GRAPH_LIMIT}. Default ${DEFAULT_GRAPH_LIMIT}.`,
+                schema: { type: "integer", minimum: 1, maximum: MAX_GRAPH_LIMIT, default: DEFAULT_GRAPH_LIMIT },
+            },
+        ],
+        responses: {
+            "200": {
+                description: "The graph snapshot.",
+                content: { "application/json": { schema: ref("graph-snapshot") } },
+            },
+            "400": errorBody("invalid_since, invalid_limit", "A query parameter is invalid."),
+        },
+    },
+    {
+        path: "/admin/api/runs/{id}",
+        operationId: "getRun",
+        summary: "Run detail",
+        description: "Full detail for one run, including final text.",
+        parameters: [{ name: "id", in: "path", required: true, description: "Run id.", schema: { type: "string" } }],
+        responses: {
+            "200": { description: "The run.", content: { "application/json": { schema: ref("run-detail") } } },
+            "404": errorBody("not_found", "No run with that id."),
+        },
+    },
+    {
+        path: "/admin/api/infra",
+        operationId: "getInfra",
+        summary: "Infrastructure info",
+        description: "Where and how this wardby deployment runs its workloads.",
+        responses: {
+            "200": { description: "Infrastructure info.", content: { "application/json": { schema: ref("infra-info") } } },
+        },
+    },
+    {
+        path: "/admin/api/events",
+        operationId: "getEvents",
+        summary: "Live event stream",
+        description: [
+            "A Server-Sent Events stream (`text/event-stream`) of live changes. Frames:",
+            "",
+            "- `retry: 3000`: suggested client reconnect delay in milliseconds.",
+            '- `event: hello`: sent first. Data is `{"connected": <bool>}`, whether the server\'s live-event connection is up.',
+            "- `event: run`, `event: service`, `event: outcome`: a run, coding-run service, or outcome changed. Each carries an `id:` line. Payloads match the `viewer-event` schema (see `x-event-schema`).",
+            '- `event: status`: the server\'s live-event connection changed. Data is `{"connected": <bool>}`.',
+            "- `event: resync`: the live-event connection is up (again). Events may have been missed: refetch the graph.",
+            `- \`: ping\`: comment sent every ${SSE_HEARTBEAT_MS / 1000} seconds to keep the connection open.`,
+            "",
+            "There is no replay. Open the event stream first, then load `/admin/api/graph` and apply events on top of it. Refetch the graph on every `resync` and after every reconnect rather than trying to resume.",
+        ].join("\n"),
+        responses: {
+            "200": {
+                description: "The event stream.",
+                content: { "text/event-stream": { schema: { type: "string" } } },
+                "x-event-schema": ref("viewer-event"),
+            },
+        },
+    },
+];
+function componentSchemas() {
+    const schemas = {};
+    for (const [name, schema] of Object.entries(VIEWER_SCHEMAS)) {
+        schemas[name] = viewerJsonSchema(schema);
+    }
+    schemas.ViewerError = {
+        type: "object",
+        required: ["error"],
+        properties: { error: { type: "string" } },
+        additionalProperties: false,
+    };
+    schemas.ViewerInternalError = {
+        type: "object",
+        required: ["error", "id"],
+        properties: { error: { type: "string", enum: ["internal_error"] }, id: { type: "string" } },
+        additionalProperties: false,
+    };
+    return schemas;
+}
+function operation(route) {
+    return {
+        operationId: route.operationId,
+        summary: route.summary,
+        description: `${route.description}\n\n${AUTH_NOTE}`,
+        security: [{ bearer: [] }],
+        ...(route.parameters ? { parameters: route.parameters } : {}),
+        responses: {
+            ...route.responses,
+            "401": { ...errorBody("invalid_token", "No valid bearer token."), headers: wwwAuthenticate },
+            "403": {
+                ...errorBody("invalid_token", "Token lacks the `admin:view` scope (the `WWW-Authenticate` header is present), or the caller lacks the admin role (no `WWW-Authenticate` header)."),
+                headers: wwwAuthenticate,
+            },
+            "405": {
+                ...errorBody("method_not_allowed", "Only GET is allowed."),
+                headers: { Allow: { description: "Allowed methods: GET.", schema: { type: "string", enum: ["GET"] } } },
+            },
+            default: {
+                description: "Unexpected server error (HTTP 500). `id` identifies the failure in the server log.",
+                content: { "application/json": { schema: ref("ViewerInternalError") } },
+            },
+        },
+    };
+}
+export function buildViewerOpenApi(version) {
+    const paths = {};
+    for (const route of VIEWER_ROUTES)
+        paths[route.path] = { get: operation(route) };
+    return {
+        openapi: "3.1.0",
+        info: {
+            title: "wardby admin viewer API",
+            version,
+            description: "Read-only admin API behind the wardby viewer: graph, run detail, infrastructure info and a live event stream. Response objects may gain new fields in later releases; clients should ignore unknown fields. See docs/viewer-api.md for the prose contract.",
+        },
+        servers: [{ url: "https://{host}", variables: { host: { default: "wardby.example.com" } } }],
+        paths,
+        components: {
+            securitySchemes: { bearer: { type: "http", scheme: "bearer" } },
+            headers: { WWWAuthenticate: { description: "Bearer challenge.", schema: { type: "string" } } },
+            schemas: componentSchemas(),
+        },
+    };
+}
+export const HEADER = "# Generated by npm run build:viewer-schemas from src/viewer/api-schema.ts and src/viewer/openapi.ts. Do not edit.";
+export function renderViewerOpenApi(version) {
+    return `${HEADER}\n${stringify(buildViewerOpenApi(version), { lineWidth: 0, aliasDuplicateObjects: false })}`;
+}

package/dist/wardby-bin.js

@@ -42,6 +42,16 @@ async function main() {
         const { helpCommand } = await import("./help/cli.js");
         await helpCommand(process.argv.slice(3));
     }
+    else if (command === "resume") {
+        // Runs on a developer's machine: no environment, database, or server runtime.
+        const { resumeCommand } = await import("./coding/transcript/resume/command.js");
+        process.exitCode = await resumeCommand(process.argv.slice(3));
+    }
+    else if (command === "resume-tools") {
+        // Hidden: the stand-in tool server `wardby resume` configures Claude Code to start.
+        const { resumeToolsCommand } = await import("./coding/transcript/resume/stand-in.js");
+        await resumeToolsCommand(process.argv.slice(3));
+    }
     else if (command === "knowledge") {
         // Offline bundle validation: no environment, database, or HTTP runtime.
         const { knowledgeCommand } = await import("./knowledge/cli.js");

package/docs/README.md

@@ -18,6 +18,11 @@
 - [Architecture knowledge bundles](knowledge.md) covers `docs/knowledge/`: the
   concept format, how coding runs and reviewers use it, `wardby knowledge check`,
   and the scheduled architecture agent.
+- [Native sandbox](native-sandbox.md) (0.5.4+) runs a native agent's turn loop and user
+  tools in a single-use, credential-free container behind a native gateway.
+- [Secrets and tools](tool-secrets.md) covers readable and brokered secrets
+  (brokered secrets require 0.6.0+):
+  attaching secrets to tools, `set_secret_broker`, placements, and errors.
 - [Coding-worker isolation](coding-worker-isolation.md) documents the threat
   model and enforced worker boundary.
 - [Bring-your-own worker images](coding-worker-byo-images.md) explains how to
@@ -29,6 +34,8 @@
   the catalog, per-agent permission, variables, and errors.
 - [Jira agents](jira-agents.md) connects wardby to Jira Cloud with a service
   account and webhook, and links agents to projects.
+- [Send workflow updates to Slack](slack-notifications.md) (0.6.0+) links a Slack
+  channel to a Jira project or an agent to follow cards from pickup to merge.
 - [Observability](observability.md) covers Prometheus metrics, Grafana, cloud
   collectors, retention, and production ownership.
 - [Release verification](release-verification.md) lists the automated and live