@wardby/cli 0.5.3 → 0.7.0

package/dist/cli.js

@@ -2,12 +2,14 @@
 /**
  * Minimal CLI.
  *
- *   wardby agent create --name <n> --model <m> --prompt <p> --budget <usd> [--schedule "<cron>"] [--timezone <tz>] [--memory-enabled] [--effort <level>]
+ *   wardby agent create --name <n> --model <m> --prompt <p> --budget <usd> [--schedule "<cron>"] [--timezone <tz>] [--memory-enabled] [--effort <level>] [--native-execution-mode control-plane|sandbox]
  *   wardby agent list
+ *   wardby agent mode <name> control-plane|sandbox
  *   wardby agent schedule <name> --cron "<expr>" [--timezone <tz>] [--disable]
  *   wardby run <name>
  *   wardby runs [--agent <name>] [--limit N] [--status <s>]
  *   wardby scheduler [--scope default]
+ *   wardby native-gateway   (the native sandbox gateway only; NATIVE_GATEWAY_LISTEN)
  *   wardby mcp   (MCP_TRANSPORT=stdio|http selects the transport; authoring/
  *                control is MCP-first from here — this floor keeps working
  *                before/without an MCP client)
@@ -28,26 +30,40 @@ import { describePreflightFailure, kubernetesPreflight, preflightCanaryImage, }
 import { RoutingLlmProvider, isLlmEffort, modelSupportedEfforts, resolveLlmRegistrations, } from "./providers/llm/index.js";
 import { startModelCatalog } from "./providers/llm/catalog-store.js";
 import { buildConfiguredExecutor, buildExecutor } from "./providers/executor/index.js";
+import { DeferredExecutor, drainDeferredRuns } from "./providers/executor/deferred.js";
+import { resolveDeferredCodingRun } from "./core/deferred-coding.js";
+import { parseGatewayListen, startGatewayServer } from "./native-worker/http-server.js";
+import { NATIVE_GATEWAY_DENY_PORT } from "./native-worker/docker-isolation.js";
+import { startDenyPortListener } from "./providers/coding-proxy/deny-port.js";
+import { buildNativeSandboxExecutor } from "./native-worker/composition.js";
 import { PostgresDatastore } from "./providers/datastore/index.js";
 import { PostgresAgentMemory } from "./providers/memory/index.js";
 import { buildSecretCipher } from "./providers/secrets/index.js";
 import { prisma } from "./core/db.js";
+import { guardDatastore, guardAgentMemory } from "./core/secret-guarded-stores.js";
+import { createDbSecretWriteGuard } from "./core/secret-guard.js";
 import { runAgent } from "./core/runner.js";
 import { cancelRunOnSignal } from "./core/run-heartbeat.js";
 import { buildIssueTrackers } from "./providers/issue-tracker/index.js";
+import { buildChatProviders } from "./providers/chat/index.js";
 import { buildReviewHosts } from "./providers/review-host/index.js";
 import { createRepoAccessGate } from "./core/repo-access.js";
 import { validateCronExpression } from "./core/cron.js";
+import { scheduleStartFields } from "./core/schedule-start.js";
 import { assertAgentModelAvailable } from "./core/run-pricing.js";
+import { markRunFailedFromExecutorError } from "./core/dispatch.js";
 import { startScheduler } from "./core/scheduler.js";
 import { startReconciler } from "./core/reconciler.js";
+import { startNotifications } from "./core/notifications.js";
 import { NativeEngine } from "./core/engine-native.js";
 import { logger } from "./core/logger.js";
+import { buildPower } from "./core/power-composition.js";
 import { deriveJsonSchema } from "./sandbox/zod-params.js";
+import { toolSubject, zod3ToolWarnings } from "./core/zod3-window.js";
 import { findSameNamedAttachedTool, reservedToolNameReason, resolveToolRef } from "./core/tool-names.js";
 import { ToolAttachedError, deleteToolGuarded, formatAttachedAgents, formatToolLine, hasToolChanges, prepareToolUpdate, updateToolGuarded, } from "./core/tool-admin.js";
 import { ToolCapabilitiesPatchSchema } from "./sandbox/tool-capabilities.js";
-import { startMcp } from "./mcp/index.js";
+import { startMcp, warmUpExecutor } from "./mcp/index.js";
 import { startServe } from "./serve.js";
 import { authCommand } from "./mcp/auth/self-hosted/cli.js";
 import { hostAccountCommand } from "./mcp/auth/host-account-cli.js";
@@ -56,6 +72,7 @@ import { everyoneGrantData } from "./core/grants.js";
 import { parseImportArgs } from "./import/cli-args.js";
 import { runImport } from "./import/index.js";
 import { CLI_USAGE } from "./cli-help.js";
+import { parseCliNativeExecutionMode } from "./cli-native-mode.js";
 import { helpCommand } from "./help/cli.js";
 const cliLog = logger.child({ module: "cli" });
 const RUN_STATUSES = [
@@ -92,10 +109,10 @@ function buildDatastore(cipher) {
     if (config.datastore !== "postgres") {
         fail(`DATASTORE "${String(config.datastore)}" has no adapter yet (only "postgres").`);
     }
-    return new PostgresDatastore(prisma, cipher);
+    return guardDatastore(new PostgresDatastore(prisma, cipher), createDbSecretWriteGuard(prisma, cipher));
 }
-function buildMemory() {
-    return new PostgresAgentMemory(prisma);
+function buildMemory(cipher) {
+    return guardAgentMemory(new PostgresAgentMemory(prisma), createDbSecretWriteGuard(prisma, cipher));
 }
 function buildSecrets() {
     const config = loadProviderConfig();
@@ -121,6 +138,7 @@ async function agentCreate(args) {
             effort: { type: "string" },
             owner: { type: "string" },
             public: { type: "boolean" },
+            "native-execution-mode": { type: "string" },
         },
     });
     if (!values.name || !values.model || !values.prompt || !values.budget) {
@@ -134,6 +152,15 @@ async function agentCreate(args) {
     if (!Number.isInteger(maxTurns) || maxTurns <= 0) {
         fail(`--max-turns must be a positive integer, got "${values["max-turns"]}".`);
     }
+    let nativeExecutionMode;
+    if (values["native-execution-mode"] !== undefined) {
+        try {
+            nativeExecutionMode = parseCliNativeExecutionMode(values["native-execution-mode"]);
+        }
+        catch (err) {
+            fail(err instanceof Error ? err.message : String(err));
+        }
+    }
     const timezone = values.timezone ?? "UTC";
     if (values.schedule) {
         try {
@@ -188,6 +215,7 @@ async function agentCreate(args) {
                 maxTurns,
                 memoryEnabled: values["memory-enabled"] ?? false,
                 effort: values.effort ?? null,
+                ...(nativeExecutionMode ? { nativeExecutionMode } : {}),
                 ownerId: ownerId,
             },
         });
@@ -251,6 +279,8 @@ async function toolCreate(args) {
             code: code,
         },
     });
+    for (const warning of await zod3ToolWarnings(toolSubject(tool.name), paramsZod))
+        console.error(`warning: ${warning}`);
     console.log(tool.id);
 }
 async function toolAttach(args, detach) {
@@ -500,12 +530,36 @@ async function agentSchedule(args) {
     catch (err) {
         fail(`invalid --cron/--timezone: ${err instanceof Error ? err.message : String(err)}`);
     }
+    const next = { schedule, timezone, scheduleEnabled: true };
     await prisma.agent.update({
         where: { name: name },
-        data: { schedule, timezone, scheduleEnabled: true },
+        data: { ...next, ...(await scheduleStartFields(prisma, agent, next)) },
     });
     console.log(`schedule set for "${name}": "${schedule}" (${timezone}).`);
 }
+/** Where a native agent's later runs execute; runs already created keep their mode. */
+async function agentMode(args) {
+    const [name, value, ...extra] = args;
+    if (!name || !value || extra.length > 0) {
+        fail("agent mode requires an agent name and a mode: wardby agent mode <name> control-plane|sandbox");
+    }
+    let nativeExecutionMode;
+    try {
+        nativeExecutionMode = parseCliNativeExecutionMode(value);
+    }
+    catch (err) {
+        fail(err instanceof Error ? err.message : String(err));
+    }
+    const agent = await prisma.agent.findUnique({ where: { name } });
+    if (!agent) {
+        fail(`unknown agent "${name}".`);
+    }
+    if (agent.kind !== "native") {
+        fail(`"${name}" is a coding agent; the native execution mode only applies to native agents.`);
+    }
+    await prisma.agent.update({ where: { id: agent.id }, data: { nativeExecutionMode } });
+    console.log(`native execution mode for "${name}": ${value}.`);
+}
 async function agentList() {
     const agents = await prisma.agent.findMany({ orderBy: { name: "asc" } });
     if (agents.length === 0) {
@@ -517,7 +571,8 @@ async function agentList() {
             ? `${agent.scheduleEnabled ? "enabled" : "disabled"}: ${agent.schedule} (${agent.timezone})`
             : "manual";
         console.log(`${agent.name}  ${agent.kind.padEnd(6)}  ${agent.model}  ` +
-            `$${Number(agent.budgetUsd).toFixed(4)}  ${agent.maxTurns} turns  memory ${agent.memoryEnabled ? "on" : "off"}  ${schedule}`);
+            `$${Number(agent.budgetUsd).toFixed(4)}  ${agent.maxTurns} turns  memory ${agent.memoryEnabled ? "on" : "off"}  ${schedule}` +
+            (agent.kind === "native" && agent.nativeExecutionMode === "sandbox" ? "  sandbox" : ""));
     }
 }
 async function run(name) {
@@ -541,7 +596,7 @@ async function run(name) {
     const engine = buildEngine();
     const secrets = buildSecrets();
     const datastore = buildDatastore(secrets);
-    const memory = buildMemory();
+    const memory = buildMemory(secrets);
     let run;
     // Ctrl-C (or a SIGTERM) records the run as cancelled rather than leaving a
     // `running` row behind.
@@ -710,14 +765,46 @@ async function scheduler(args) {
     const engine = buildEngine();
     const secrets = buildSecrets();
     const datastore = buildDatastore(secrets);
-    const memory = buildMemory();
+    const memory = buildMemory(secrets);
     const reviewHosts = buildReviewHosts(process.env, prisma);
     const issueTrackers = buildIssueTrackers();
+    const chat = buildChatProviders();
     // One repository-access gate (and cache) for native repo_* calls and coding runs.
     const repoAccess = createRepoAccessGate({ db: prisma, hosts: reviewHosts });
-    const nativeExecutor = buildExecutor(config, { llm, engine, datastore, secrets, memory, reviewHosts, issueTrackers, repoAccess }, prisma);
-    const executor = buildConfiguredExecutor({ native: nativeExecutor, db: prisma, providerConfig: config, repoAccess });
+    // Patched with the composed executor below, as startMcp does: native runs read
+    // `providers.executor` at call time, so their delegate_to_* calls can dispatch coding and
+    // sandbox-mode sub-agents through the same RoutingExecutor.
+    const nativeProviders = {
+        llm,
+        engine,
+        datastore,
+        secrets,
+        memory,
+        reviewHosts,
+        issueTrackers,
+        repoAccess,
+    };
+    const nativeExecutor = buildExecutor(config, nativeProviders, prisma);
+    const power = buildPower({ env: process.env, db: prisma });
+    if (power.enabled) {
+        void power.checkAccess().then((missing) => {
+            if (missing.length)
+                cliLog.warn(`low_power_scale_forbidden: missing ${missing.join(", ")}`);
+        }, (err) => cliLog.warn({ err }, "low_power_access_check_failed"));
+    }
+    const executor = buildConfiguredExecutor({
+        native: nativeExecutor,
+        db: prisma,
+        providerConfig: config,
+        repoAccess,
+        power,
+        secretCipher: nativeProviders.secrets,
+        // Sandbox-mode native runs (docs/native-sandbox.md); undefined when NATIVE_SANDBOX_LAUNCHER is unset.
+        nativeSandbox: buildNativeSandboxExecutor({ db: prisma, providers: nativeProviders, power }),
+    });
+    nativeProviders.executor = executor;
     await executor.launch?.();
+    warmUpExecutor(executor);
     const reconciler = startReconciler({
         db: prisma,
         executor,
@@ -725,6 +812,7 @@ async function scheduler(args) {
         issueTrackers,
         deferredReviews: { db: prisma, executor, hosts: reviewHosts, repoAccess, issueTrackers },
     });
+    const notifications = await startNotifications({ db: prisma, chat });
     const selfDefects = { db: prisma, issueTrackers };
     const sched = startScheduler({
         executor,
@@ -733,6 +821,14 @@ async function scheduler(args) {
         selfDefects,
         onLeaderTick: async () => {
             await drainCodingQueue({ db: prisma, executor, ...concurrency, selfDefects });
+            // Runs the native sandbox gateway dispatched (or asked to stop): it holds no executor of its own.
+            await drainDeferredRuns({
+                db: prisma,
+                executor,
+                beforeStart: (runId) => resolveDeferredCodingRun({ db: prisma, executor, runId }),
+                onStartFailed: (runId, err) => markRunFailedFromExecutorError(prisma, runId, err, selfDefects),
+            });
+            await power.sleepIfIdle().catch((err) => cliLog.warn({ err }, "power_sleep_failed"));
         },
     });
     console.log(`wardby scheduler started (scope "${scope}"). Press Ctrl+C to stop.`);
@@ -741,6 +837,7 @@ async function scheduler(args) {
             console.log("\nwardby scheduler shutting down...");
             sched.stop();
             reconciler.stop();
+            notifications.stop();
             void Promise.resolve(executor.close?.())
                 .catch((err) => cliLog.warn({ err }, "executor close failed during scheduler shutdown"))
                 .finally(() => {
@@ -752,6 +849,53 @@ async function scheduler(args) {
         process.once("SIGTERM", shutdown);
     });
 }
+/**
+ * The native sandbox gateway on its own (docs/native-sandbox.md): only the internal listener
+ * sandbox workers call, on NATIVE_GATEWAY_LISTEN (default 0.0.0.0:8790). It never starts or
+ * stops a run itself — workers can reach it, so it holds no Docker socket or cluster
+ * credential: a delegation it makes is started by the scheduler leader (DeferredExecutor).
+ * It needs the server's database and LLM/integration settings, nothing more.
+ */
+async function nativeGateway() {
+    const listen = parseGatewayListen(process.env.NATIVE_GATEWAY_LISTEN) ?? { host: "0.0.0.0", port: 8790 };
+    let modelCatalog;
+    try {
+        modelCatalog = await startModelCatalog(prisma);
+    }
+    catch (err) {
+        fail(err instanceof Error ? err.message : String(err));
+    }
+    const secrets = buildSecrets();
+    const reviewHosts = buildReviewHosts(process.env, prisma);
+    const providers = {
+        llm: buildLlmProvider(),
+        engine: buildEngine(),
+        datastore: buildDatastore(secrets),
+        secrets,
+        memory: buildMemory(secrets),
+        reviewHosts,
+        issueTrackers: buildIssueTrackers(),
+        repoAccess: createRepoAccessGate({ db: prisma, hosts: reviewHosts }),
+        executor: new DeferredExecutor(prisma),
+    };
+    const server = await startGatewayServer(listen, { db: prisma, providers });
+    // The deny port (NATIVE_GATEWAY_DENY_PORT, default 8791) serves nothing: a worker that can reach the
+    // gateway port but not this one proves its NetworkPolicy is programmed and port-scoped.
+    const denyPort = Number(process.env.NATIVE_GATEWAY_DENY_PORT ?? NATIVE_GATEWAY_DENY_PORT);
+    const deny = await startDenyPortListener(listen.host, denyPort);
+    console.error(`wardby native-gateway listening on ${listen.host}:${listen.port}. Press Ctrl+C to stop.`);
+    await new Promise((resolve) => {
+        const shutdown = () => {
+            server.close(() => {
+                modelCatalog.close();
+                void deny.close().finally(resolve);
+            });
+            server.closeIdleConnections();
+        };
+        process.once("SIGINT", shutdown);
+        process.once("SIGTERM", shutdown);
+    });
+}
 async function mcp() {
     const handle = await startMcp();
     // startMcp() resolves once the transport is up (bound/listening), not
@@ -843,6 +987,9 @@ async function main() {
         else if (command === "agent" && rest[0] === "schedule") {
             await agentSchedule(rest.slice(1));
         }
+        else if (command === "agent" && rest[0] === "mode") {
+            await agentMode(rest.slice(1));
+        }
         else if (command === "tool" && rest[0] === "create") {
             await toolCreate(rest.slice(1));
         }
@@ -873,6 +1020,9 @@ async function main() {
         else if (command === "scheduler") {
             await scheduler(rest);
         }
+        else if (command === "native-gateway") {
+            await nativeGateway();
+        }
         else if (command === "mcp") {
             await mcp();
         }

package/dist/coding/claude-context.d.ts

@@ -0,0 +1,45 @@
+import { type ClaudeContextFile } from "./protocol.js";
+export interface ClaudeContextSkip {
+    path: string;
+    reason: "symlink" | "not_file" | "too_large" | "not_utf8" | "limit" | "outside_repo" | "not_allowed";
+}
+export interface ClaudeContext {
+    files: ClaudeContextFile[];
+    /** Files left out and why, at most `MAX_RECORDED_SKIPS` entries. */
+    skipped: ClaudeContextSkip[];
+    /**
+     * How many further files were left out without an entry in `skipped`: skips
+     * beyond `MAX_RECORDED_SKIPS`, plus `@imports` beyond `MAX_IMPORTS_PER_FILE`
+     * in a single file, which are not followed at all, plus 1 when `.claude/skills` has more than
+     * `MAX_SKILL_ENTRIES` entries. 0 when nothing overflowed.
+     */
+    skippedOverflow: number;
+}
+/** Content of the `CLAUDE.md` synthesized for a repository that only has `AGENTS.md`. */
+export declare const AGENTS_BRIDGE = "@AGENTS.md\n";
+/** At most this many `skipped` entries are recorded; the rest are only counted in `skippedOverflow`. */
+export declare const MAX_RECORDED_SKIPS = 50;
+/** Only the first this-many distinct `@imports` of each file are followed; the rest are counted in `skippedOverflow`. */
+export declare const MAX_IMPORTS_PER_FILE = 100;
+/**
+ * At most this many `.claude/skills` entries are considered (matching the Codex worker's scan cap);
+ * if there are more, the rest are neither read nor counted beyond adding one to `skippedOverflow`.
+ */
+export declare const MAX_SKILL_ENTRIES = 2000;
+/**
+ * Returns the `@path` imports in a Markdown instruction file, in order and
+ * de-duplicated. Imports inside fenced code blocks and inline code spans are
+ * ignored, as is an `@` not preceded by whitespace (an e-mail address). Runs
+ * in time linear in the input, whatever the repository puts in it.
+ */
+export declare function importsOf(markdown: string): string[];
+/**
+ * Builds the Claude Code context for the checkout at `workspace`. Files are
+ * ordered roots first, then imports breadth-first, then skills by directory
+ * name. A file reached more than once is read once. Once the next file would
+ * exceed the file-count or total-size limit, it and every later candidate are
+ * reported as `limit` without being read.
+ */
+export declare function buildClaudeContext(workspace: string, options: {
+    skills: boolean;
+}): Promise<ClaudeContext>;