@wardby/cli 0.5.3 → 0.7.0

package/dist/knowledge/location.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Where a repository's knowledge bundle lives (docs/knowledge.md, "Where the
+ * bundle lives"): the folder `.wardby/knowledge.yaml` names, else
+ * DEFAULT_KNOWLEDGE_BUNDLE_PATH. A missing, unreadable, or invalid file never
+ * fails anything: it degrades to the default, with a warning when the file
+ * exists but cannot be used.
+ */
+export declare const KNOWLEDGE_CONFIG_PATH = ".wardby/knowledge.yaml";
+export declare const KNOWLEDGE_CONFIG_MAX_BYTES: number;
+export interface KnowledgeLocation {
+    bundlePath: string;
+    /** Set when `.wardby/knowledge.yaml` exists but was ignored, saying why. */
+    warning?: string;
+}
+export type KnowledgeConfigParse = {
+    ok: true;
+    bundlePath: string;
+} | {
+    ok: false;
+    error: string;
+};
+/** `path: <repo-relative folder>`, the file's only key. */
+export declare function parseKnowledgeConfig(text: string): KnowledgeConfigParse;
+/** A repo-relative POSIX folder, without `./` or trailing slashes, outside `.wardby/` and `.git/`. */
+export declare function normalizeBundlePath(raw: string): KnowledgeConfigParse;
+/**
+ * The bundle location, given a reader for `.wardby/knowledge.yaml` that
+ * returns null when the file does not exist. A reader that throws, like an
+ * invalid file, yields the default with a warning.
+ */
+export declare function resolveKnowledgeLocation(readConfig: () => Promise<string | null | undefined>): Promise<KnowledgeLocation>;

package/dist/knowledge/location.js

@@ -0,0 +1,78 @@
+import { parse as parseYaml } from "yaml";
+import { DEFAULT_KNOWLEDGE_BUNDLE_PATH } from "./concept.js";
+/**
+ * Where a repository's knowledge bundle lives (docs/knowledge.md, "Where the
+ * bundle lives"): the folder `.wardby/knowledge.yaml` names, else
+ * DEFAULT_KNOWLEDGE_BUNDLE_PATH. A missing, unreadable, or invalid file never
+ * fails anything: it degrades to the default, with a warning when the file
+ * exists but cannot be used.
+ */
+export const KNOWLEDGE_CONFIG_PATH = ".wardby/knowledge.yaml";
+export const KNOWLEDGE_CONFIG_MAX_BYTES = 4 * 1024;
+const MAX_BUNDLE_PATH_LENGTH = 200;
+/** `path: <repo-relative folder>`, the file's only key. */
+export function parseKnowledgeConfig(text) {
+    let doc;
+    try {
+        doc = parseYaml(text);
+    }
+    catch {
+        return { ok: false, error: "it is not valid YAML" };
+    }
+    if (typeof doc !== "object" || doc === null || Array.isArray(doc))
+        return { ok: false, error: "it must be a mapping with a `path` key" };
+    const keys = Object.keys(doc);
+    const unknown = keys.filter((k) => k !== "path");
+    if (unknown.length > 0)
+        return { ok: false, error: `unknown key ${unknown.map((k) => `\`${k}\``).join(", ")}` };
+    const { path } = doc;
+    if (typeof path !== "string")
+        return { ok: false, error: "`path` must be a string" };
+    return normalizeBundlePath(path);
+}
+/** A repo-relative POSIX folder, without `./` or trailing slashes, outside `.wardby/` and `.git/`. */
+export function normalizeBundlePath(raw) {
+    let path = raw.trim();
+    while (path.startsWith("./"))
+        path = path.slice(2);
+    path = path.replace(/\/+$/, "");
+    if (path === "" || path === ".")
+        return { ok: false, error: "`path` must name a folder inside the repository" };
+    if (path.length > MAX_BUNDLE_PATH_LENGTH)
+        return { ok: false, error: `\`path\` must be at most ${MAX_BUNDLE_PATH_LENGTH} characters` };
+    // eslint-disable-next-line no-control-regex
+    if (/[\u0000-\u001f\u007f\\]/.test(path))
+        return { ok: false, error: "`path` must be a plain POSIX path" };
+    if (path.startsWith("/"))
+        return { ok: false, error: "`path` must be relative to the repository root" };
+    const segments = path.split("/");
+    if (segments.some((s) => s === "" || s === "." || s === ".."))
+        return { ok: false, error: "`path` must not contain empty, `.` or `..` segments" };
+    if (segments[0] === ".wardby" || segments[0] === ".git")
+        return { ok: false, error: "`path` must not be inside `.wardby/` or `.git/`" };
+    return { ok: true, bundlePath: path };
+}
+/**
+ * The bundle location, given a reader for `.wardby/knowledge.yaml` that
+ * returns null when the file does not exist. A reader that throws, like an
+ * invalid file, yields the default with a warning.
+ */
+export async function resolveKnowledgeLocation(readConfig) {
+    let text;
+    try {
+        text = await readConfig();
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        return { bundlePath: DEFAULT_KNOWLEDGE_BUNDLE_PATH, warning: ignoredWarning(`it could not be read (${reason})`) };
+    }
+    if (text === null || text === undefined)
+        return { bundlePath: DEFAULT_KNOWLEDGE_BUNDLE_PATH };
+    const parsed = parseKnowledgeConfig(text);
+    if (!parsed.ok)
+        return { bundlePath: DEFAULT_KNOWLEDGE_BUNDLE_PATH, warning: ignoredWarning(parsed.error) };
+    return { bundlePath: parsed.bundlePath };
+}
+function ignoredWarning(reason) {
+    return `${KNOWLEDGE_CONFIG_PATH} was ignored because ${reason}; using ${DEFAULT_KNOWLEDGE_BUNDLE_PATH}/.`;
+}

package/dist/mcp/auth/access.d.ts

@@ -38,15 +38,17 @@ export declare function assertAgentAccess<A extends AgentRef>(ctx: McpRequestCon
 export declare function requireAgentAccess(ctx: McpRequestContext, id: string, required: AgentLevel | "owner", db?: Pick<PrismaClient, "agent" | "resourceGrant">): Promise<{
     agent: {
         name: string;
+        updatedAt: Date;
         model: string;
         budgetUsd: import("@prisma/client-runtime-utils").Decimal;
         maxTurns: number;
-        createdAt: Date;
-        updatedAt: Date;
         kind: import("#prisma").AgentKind;
+        createdAt: Date;
         id: string;
         ownerId: string | null;
+        nativeExecutionMode: import("#prisma").NativeExecutionMode;
         systemPrompt: string;
+        allowedOverrunPercent: number;
         schedule: string | null;
         timezone: string;
         scheduleEnabled: boolean;
@@ -67,6 +69,13 @@ export declare function requireAgentAccess(ctx: McpRequestContext, id: string, r
  * it can adopt the agent first (make_owner / grants adopt-public).
  */
 export declare function requireBindingOwner(ctx: McpRequestContext, agent: AgentRef): void;
+/**
+ * requireBindingOwner, plus: nothing owner-held may be bound to an agent
+ * everyone can write (anyone could then rewrite it to use the binding).
+ */
+export declare function requireBindable(ctx: McpRequestContext, agent: AgentRef, db?: GrantDb): Promise<void>;
+/** The public-write half of requireBindable, for paths that skip the owner check (an admin's adminOverride). */
+export declare function requireNotPublicWritable(agent: AgentRef, db: GrantDb): Promise<void>;
 /** Prisma where for agent listings: own rows plus rows granted >= read; the operator sees all. */
 export declare function readableAgentsWhere(ctx: McpRequestContext, db?: GrantDb): Promise<Prisma.AgentWhereInput>;
 /** One grant lookup for a whole listing: returns agent -> the caller's access. */

package/dist/mcp/auth/access.js

@@ -1,4 +1,4 @@
-import { atLeast, effectiveAccess, grantedAccessMap, grantedIds } from "../../core/grants.js";
+import { atLeast, effectiveAccess, grantedAccessMap, grantedIds, isPublicWritable, } from "../../core/grants.js";
 import { McpError } from "../errors.js";
 export function agentNotFound(id) {
     return new McpError(404, `Agent "${id}" not found.`);
@@ -42,6 +42,20 @@ export function requireBindingOwner(ctx, agent) {
         throw new McpError(403, `Only the owner of agent "${agent.id}" can change its bindings.`);
     }
 }
+/**
+ * requireBindingOwner, plus: nothing owner-held may be bound to an agent
+ * everyone can write (anyone could then rewrite it to use the binding).
+ */
+export async function requireBindable(ctx, agent, db = ctx.db) {
+    requireBindingOwner(ctx, agent);
+    await requireNotPublicWritable(agent, db);
+}
+/** The public-write half of requireBindable, for paths that skip the owner check (an admin's adminOverride). */
+export async function requireNotPublicWritable(agent, db) {
+    if (await isPublicWritable(db, agent.id)) {
+        throw new McpError(409, `Agent "${agent.id}" is writable by everyone, so nothing can be bound to it; revoke or lower the everyone grant first.`);
+    }
+}
 /** Prisma where for agent listings: own rows plus rows granted >= read; the operator sees all. */
 export async function readableAgentsWhere(ctx, db = ctx.db) {
     if (ctx.operator)

package/dist/mcp/auth/ownership.d.ts

@@ -26,8 +26,8 @@ export declare function visibleToPrincipal(principalId: string): {
 };
 export declare function requireOwnedBudgetGroup(db: PrismaClient, id: string, principalId: string): Promise<{
     name: string;
-    createdAt: Date;
     updatedAt: Date;
+    createdAt: Date;
     id: string;
     ownerId: string | null;
     dailyBudgetUsd: import("@prisma/client-runtime-utils").Decimal | null;
@@ -37,8 +37,8 @@ export declare function requireOwnedBudgetGroup(db: PrismaClient, id: string, pr
 }>;
 export declare function requireReadableBudgetGroup(db: Pick<PrismaClient, "budgetGroup">, id: string, principalId: string): Promise<{
     name: string;
-    createdAt: Date;
     updatedAt: Date;
+    createdAt: Date;
     id: string;
     ownerId: string | null;
     dailyBudgetUsd: import("@prisma/client-runtime-utils").Decimal | null;
@@ -50,8 +50,8 @@ export declare function requireOwnedSecret(db: PrismaClient, id: string, princip
 export declare function requireOwnedWebhook(db: PrismaClient, id: string, principalId: string): Promise<void>;
 export declare function requireOwnedDatastore(db: PrismaClient, id: string, principalId: string): Promise<{
     name: string;
-    createdAt: Date;
     updatedAt: Date;
+    createdAt: Date;
     id: string;
     ownerId: string | null;
 }>;
@@ -72,14 +72,14 @@ export declare function assertStrictlyOwnedTool(tool: Tool | null, id: string, p
  * triggered them. No canRead/null=public path exists here on purpose.
  */
 export declare function requireOwnedTask(db: PrismaClient, taskId: string, principalId: string): Promise<{
+    updatedAt: Date;
     error: import("@prisma/client/runtime/client").JsonValue | null;
-    status: import("#prisma").TaskStatus;
     runId: string | null;
-    createdAt: Date;
-    updatedAt: Date;
-    kind: import("#prisma").TaskKind;
     result: import("@prisma/client/runtime/client").JsonValue | null;
+    kind: import("#prisma").TaskKind;
+    createdAt: Date;
     id: string;
+    status: import("#prisma").TaskStatus;
     principalId: string | null;
     inputRequests: import("@prisma/client/runtime/client").JsonValue | null;
     inputResponses: import("@prisma/client/runtime/client").JsonValue | null;

package/dist/mcp/auth/repo-authorization.js

@@ -6,6 +6,7 @@
  * side and the rules; the host call happens here, before any transaction.
  */
 import { LocalRepoError, isLocalRepository, loadLocalRepoRoots, resolveLocalRepository, } from "../../coding/local-repo.js";
+import { GITHUB_ACCOUNT_NOT_ALLOWED } from "../../config/github-allowed-accounts.js";
 import { requiredLevel } from "../../core/repo-access.js";
 import { McpError } from "../errors.js";
 import { requireScope } from "./resource-server.js";
@@ -39,6 +40,13 @@ export async function authorizeRepositoryForSet(ctx, input) {
         await canonicalLocalRepository(input.repository);
         return stamp("local_root");
     }
+    // A server-wide boundary: no admin approval reaches past it.
+    const accountDenied = await ctx.providers.repoAccess?.checkAccount?.(input.provider, input.repository);
+    if (accountDenied && !accountDenied.ok) {
+        if (accountDenied.reason === "github_account_not_allowed")
+            throw accountNotAllowed(input.repository);
+        throw new McpError(503, `Could not check whether ${input.repository}'s GitHub account is served right now; try again later.`);
+    }
     if (input.adminOverride) {
         // Role-gated: the scope alone never suffices (resource-server.ts).
         requireScope(ctx, ctx.canonicalUri, "agents:admin");
@@ -66,7 +74,13 @@ export async function authorizeRepositoryForSet(ctx, input) {
         case "insufficient_permission":
             throw new McpError(403, `Your linked GitHub account has ${decision.level ?? "no"} access to ${input.repository}; ` +
                 `this needs ${required}. Ask a repository admin for access, or a wardby admin to approve it (adminOverride).`);
+        case "github_account_not_allowed":
+            throw accountNotAllowed(input.repository);
         default:
             throw new McpError(503, `Could not verify your GitHub access to ${input.repository} right now (is the GitHub App installed on it?). Try again.`);
     }
 }
+function accountNotAllowed(repository) {
+    return new McpError(403, `${GITHUB_ACCOUNT_NOT_ALLOWED}: ${repository} belongs to a GitHub account this server does not serve. ` +
+        "An operator can add the account to WARDBY_GITHUB_ALLOWED_ACCOUNTS.");
+}

package/dist/mcp/auth/resource-server.d.ts

@@ -18,7 +18,8 @@ export declare const SCOPES_SUPPORTED: string[];
  * services:manage changes the coding-run service catalog, which decides what
  * runs next to every coding run that names an entry; admin:view reads every
  * owner's runs (the admin viewer API); models:admin changes the model catalog,
- * which prices every principal's runs.
+ * which prices every principal's runs; power:manage scales the shared coding
+ * proxy and native gateway to zero (power_sleep) and reads their state.
  * A token scope only DELEGATES — it never authorizes on its own:
  * requireScope/requireAnyScope honour one only when one of the caller's
  * roles (McpRequestContext.roles, resolved live per request) grants it.

package/dist/mcp/auth/resource-server.js

@@ -27,6 +27,9 @@ export const SCOPES_SUPPORTED = [
     // Add, override, disable and reset model catalog entries (see docs/models.md).
     // Reading the catalog (list_models, get_model) is agents:read.
     "models:admin",
+    // Scale the coding proxy and native gateway to zero now (power_sleep) and
+    // read their state (power_status); low-power mode only (docs/getting-started-gke.md).
+    "power:manage",
 ];
 /**
  * Scopes whose operations reach beyond the caller's own (or public)
@@ -36,7 +39,8 @@ export const SCOPES_SUPPORTED = [
  * services:manage changes the coding-run service catalog, which decides what
  * runs next to every coding run that names an entry; admin:view reads every
  * owner's runs (the admin viewer API); models:admin changes the model catalog,
- * which prices every principal's runs.
+ * which prices every principal's runs; power:manage scales the shared coding
+ * proxy and native gateway to zero (power_sleep) and reads their state.
  * A token scope only DELEGATES — it never authorizes on its own:
  * requireScope/requireAnyScope honour one only when one of the caller's
  * roles (McpRequestContext.roles, resolved live per request) grants it.
@@ -47,13 +51,14 @@ export const PRIVILEGED_SCOPES = [
     "services:manage",
     "admin:view",
     "models:admin",
+    "power:manage",
 ];
 /**
  * The built-in roles and the permissions (privileged scope names) each
  * grants. No roles = member: every non-privileged scope, nothing privileged.
  */
 export const ROLE_PERMISSIONS = {
-    admin: ["agents:admin", "packages:approve", "services:manage", "admin:view", "models:admin"],
+    admin: ["agents:admin", "packages:approve", "services:manage", "admin:view", "models:admin", "power:manage"],
     "package-approver": ["packages:approve"],
     "service-manager": ["services:manage"],
     "model-manager": ["models:admin"],

package/dist/mcp/auth/self-hosted/browser.d.ts

@@ -1,3 +1,3 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
-import type { SelfHostedAuthProvider } from "../../../providers/auth/self-hosted.js";
+import { type SelfHostedAuthProvider } from "../../../providers/auth/self-hosted.js";
 export declare function browserHandler(provider: SelfHostedAuthProvider): (req: IncomingMessage, res: ServerResponse, url: URL, body: unknown) => Promise<boolean>;

package/dist/mcp/auth/self-hosted/browser.js

@@ -1,4 +1,5 @@
 import { randomUUID, randomBytes } from "node:crypto";
+import { MobileDisabledError } from "../../../providers/auth/self-hosted.js";
 import { PostgresRateLimiter, RateLimitError } from "./rate-limit.js";
 import { logger } from "../../../core/logger.js";
 import { PAGE_STYLE } from "../../shared/page-style.js";
@@ -120,12 +121,24 @@ export function browserHandler(provider) {
                 // here is already a public PKCE client with validated redirect URIs.
                 if (p.application_type !== undefined && p.application_type !== "native" && p.application_type !== "web")
                     throw new Error("unsupported application_type");
-                const registered = await provider.registerClient({
-                    redirectUris: p.redirect_uris,
-                    clientName: p.client_name,
-                    grantTypes: p.grant_types,
-                    tokenEndpointAuthMethod: p.token_endpoint_auth_method,
-                });
+                let registered;
+                try {
+                    registered = await provider.registerClient({
+                        redirectUris: p.redirect_uris,
+                        clientName: p.client_name,
+                        grantTypes: p.grant_types,
+                        tokenEndpointAuthMethod: p.token_endpoint_auth_method,
+                    });
+                }
+                catch (err) {
+                    // The one registration error that names its reason: the operator
+                    // must turn mobile sign-in on. Everything else stays generic below.
+                    if (err instanceof MobileDisabledError) {
+                        json(res, 400, { error: "invalid_redirect_uri", error_description: err.message });
+                        return true;
+                    }
+                    throw err;
+                }
                 json(res, 201, {
                     client_id: registered.clientId,
                     token_endpoint_auth_method: "none",

package/dist/mcp/auth/self-hosted/credentials.d.ts

@@ -23,10 +23,10 @@ export declare function lockUser(tx: AuthDb, id: string): Promise<{
         subject: string;
     };
 } & {
-    status: string;
-    createdAt: Date;
     updatedAt: Date;
+    createdAt: Date;
     id: string;
+    status: string;
     roles: string[];
     displayName: string | null;
     principalId: string;
@@ -58,11 +58,11 @@ export declare class IdentityService {
     }>;
     revokeKey(keyId: string): Promise<void>;
     listUsers(): Prisma.PrismaPromise<{
+        id: string;
         status: string;
         principal: {
             subject: string;
         };
-        id: string;
         roles: string[];
         displayName: string | null;
     }[]>;

package/dist/mcp/auth/self-hosted/session.d.ts

@@ -16,10 +16,10 @@ export declare class Sessions {
                 subject: string;
             };
         } & {
-            status: string;
-            createdAt: Date;
             updatedAt: Date;
+            createdAt: Date;
             id: string;
+            status: string;
             roles: string[];
             displayName: string | null;
             principalId: string;

package/dist/mcp/context.d.ts

@@ -13,10 +13,14 @@ import type { ProviderRegistry } from "../providers/index.js";
 import type { RepoAccessGate } from "../core/repo-access.js";
 import type { IssueTrackerRegistry } from "../providers/issue-tracker/types.js";
 import type { HostUserAuthorizerRegistry, ReviewHostRegistry } from "../providers/review-host/types.js";
+import type { Power } from "../core/power.js";
+import type { ChatProviderRegistry } from "../providers/chat/types.js";
 export type McpProviders = Pick<ProviderRegistry, "llm" | "engine" | "datastore" | "secrets" | "executor" | "memory"> & {
     reviewHosts?: ReviewHostRegistry;
     /** Issue trackers (Jira); empty or absent = no issue-tracker integration. */
     issueTrackers?: IssueTrackerRegistry;
+    /** Chat providers for workflow notifications (Slack); empty or absent = notifications off. */
+    chat?: ChatProviderRegistry;
     /** Identity linking (link_host_account); empty or absent = linking disabled. */
     hostUserAuthorizers?: HostUserAuthorizerRegistry;
     /**
@@ -25,6 +29,8 @@ export type McpProviders = Pick<ProviderRegistry, "llm" | "engine" | "datastore"
      * only admin approvals still work.
      */
     repoAccess?: RepoAccessGate;
+    /** Low-power mode (scale idle proxy/gateway to zero); absent = DISABLED_POWER. */
+    power?: Power;
 };
 export interface McpRequestContext {
     principal: Principal;

package/dist/mcp/host-events/github-ingress.d.ts

@@ -19,10 +19,24 @@ export interface GitHubIngressDeps {
     /** For a merged/closed PR's linked issue; absent → closed PRs are ignored. */
     issueTrackers?: IssueTrackerRegistry;
     webhookSecret: string | undefined;
-    appIdentity: () => Promise<{
+    /**
+     * The App's id, slug, and owner (the owner is always served). Throwing fails
+     * the request closed. `fresh` bypasses any cache; it is used before an
+     * uninstall, since the owner can change while the server runs.
+     */
+    appIdentity: (opts?: {
+        fresh?: boolean;
+    }) => Promise<{
         id: number;
         slug: string;
+        ownerLogin: string;
     }>;
+    /** Accounts served in addition to the App's owner (WARDBY_GITHUB_ALLOWED_ACCOUNTS). */
+    allowedAccounts: () => ReadonlySet<string>;
+    /** False = no reply explaining why a mention started nothing (WARDBY_MENTION_EXPLANATIONS). */
+    mentionExplanations?: boolean;
+    /** Removes the App from an installation on an account that isn't served; absent = ignore only. */
+    uninstallInstallation?: (installationId: number) => Promise<void>;
     now?: () => Date;
 }
 export interface GitHubIngressResult {
@@ -31,6 +45,16 @@ export interface GitHubIngressResult {
     /** Cosmetic follow-ups (reactions) to run after the response is sent. */
     afterResponse?: () => Promise<void>;
 }
+/**
+ * Which GitHub account an event belongs to. Installation events name it on
+ * the installation; repository events carry only installation.id, so the
+ * repository's owner stands in.
+ */
+export declare function eventAccount(eventName: string, payload: unknown): {
+    login: string;
+    installationId?: number;
+    uninstall: boolean;
+} | undefined;
 export declare function handleGitHubEventIngress(req: {
     headers: Record<string, string | undefined>;
     rawBody: string;

package/dist/mcp/host-events/github-ingress.js

@@ -9,8 +9,38 @@ import { maybePruneHostEventDeliveries } from "./deliveries.js";
 import { routeHostEvent } from "../../core/host-events.js";
 import { logger } from "../../core/logger.js";
 import { normalizeGitHubEvent, verifyGitHubSignature } from "../../providers/review-host/github-events.js";
+import { isGitHubAccountAllowed, trustedAccounts } from "../../config/github-allowed-accounts.js";
 const log = logger.child({ module: "github-ingress" });
 const SAFE_DELIVERY = /^[A-Za-z0-9-]{1,100}$/;
+const INSTALLATION_EVENTS = new Set(["installation", "installation_repositories"]);
+function field(value, key) {
+    return value !== null && typeof value === "object" ? value[key] : undefined;
+}
+/**
+ * Which GitHub account an event belongs to. Installation events name it on
+ * the installation; repository events carry only installation.id, so the
+ * repository's owner stands in.
+ */
+export function eventAccount(eventName, payload) {
+    if (INSTALLATION_EVENTS.has(eventName)) {
+        const installation = field(payload, "installation");
+        const login = field(field(installation, "account"), "login");
+        const id = field(installation, "id");
+        if (typeof login !== "string" || login === "")
+            return undefined;
+        return {
+            login,
+            ...(typeof id === "number" && Number.isSafeInteger(id) && id > 0 ? { installationId: id } : {}),
+            uninstall: field(payload, "action") !== "deleted",
+        };
+    }
+    const repository = field(payload, "repository");
+    const fullName = field(repository, "full_name");
+    const owner = typeof fullName === "string" && fullName.includes("/")
+        ? fullName.split("/", 1)[0]
+        : field(field(repository, "owner"), "login");
+    return typeof owner === "string" && owner !== "" ? { login: owner, uninstall: false } : undefined;
+}
 export async function handleGitHubEventIngress(req, deps) {
     if (!deps.webhookSecret)
         return { status: 404, body: { error: "not_found" } };
@@ -31,7 +61,45 @@ export async function handleGitHubEventIngress(req, deps) {
         return { status: 400, body: { error: "invalid_json" } };
     }
     const app = await deps.appIdentity();
-    const event = normalizeGitHubEvent(eventName, payload, app);
+    const account = eventAccount(eventName, payload);
+    if (account && !isGitHubAccountAllowed(trustedAccounts(app.ownerLogin, deps.allowedAccounts()), account.login)) {
+        // Never the body: only the account and what we do about it.
+        log.warn({ event: eventName, account: account.login, installationId: account.installationId, deliveryId }, "GitHub event from an account this server does not serve ignored");
+        const uninstall = deps.uninstallInstallation;
+        const installationId = account.installationId;
+        return {
+            status: 202,
+            body: { ignored: "account_not_allowed" },
+            ...(account.uninstall && uninstall && installationId !== undefined
+                ? {
+                    afterResponse: async () => {
+                        // Destructive, so re-check against a fresh owner read: the cached
+                        // owner may be stale after an ownership transfer or rename.
+                        let fresh;
+                        try {
+                            fresh = await deps.appIdentity({ fresh: true });
+                        }
+                        catch (err) {
+                            log.warn({ err, account: account.login, installationId }, "could not re-read the App owner; not removing the App from the installation");
+                            return;
+                        }
+                        if (isGitHubAccountAllowed(trustedAccounts(fresh.ownerLogin, deps.allowedAccounts()), account.login)) {
+                            log.info({ account: account.login, installationId }, "account is served after re-reading the App owner; not removing the App from the installation");
+                            return;
+                        }
+                        try {
+                            await uninstall(installationId);
+                            log.warn({ account: account.login, installationId }, "removed the App from an installation on an account this server does not serve");
+                        }
+                        catch (err) {
+                            log.warn({ err, account: account.login, installationId }, "could not remove the App from a foreign installation");
+                        }
+                    },
+                }
+                : {}),
+        };
+    }
+    const event = normalizeGitHubEvent(eventName, payload, app, (dropped) => log.info({ ...dropped, deliveryId }, "mention ignored: its author did not pass the pre-filter"));
     // An event we don't act on must never claim the delivery id: recording it
     // here would let a later, real delivery of the same id (GitHub does reuse
     // ids across distinct redeliveries of what it considers the same event)
@@ -62,6 +130,7 @@ export async function handleGitHubEventIngress(req, deps) {
             repoAccess: deps.repoAccess,
             ...(deps.issueTrackers ? { issueTrackers: deps.issueTrackers } : {}),
             mentionHandle: app.slug,
+            ...(deps.mentionExplanations === false ? { mentionExplanations: false } : {}),
         });
         log.info({ event: event.kind, repository: event.repository, deliveryId, runIds: routed.runIds }, "host event routed");
         return {

package/dist/mcp/index.d.ts

@@ -12,6 +12,12 @@ export declare function localOperatorContext(principal: Principal, providers: Mc
 export declare function registerAllTools(mcp: WardbyMcpServer, opts: {
     secretElicitationUrl: SecretElicitationUrlBuilder;
     secretElicitationProtocol: boolean;
+    /** Builds a get_run_transcript download URL for a minted token; absent = transcripts are not served. */
+    runTranscriptUrl?: (token: string) => Promise<string>;
+    /** Whether a blob store is configured to serve run transcripts from. */
+    blobStoreConfigured?: boolean;
+    /** Which host serves those links (default http). */
+    runTranscriptAudience?: "stdio" | "http";
     /** Rebuilds the process's installed model CatalogStore after set_model/disable_model/reset_model. */
     refreshModelCatalog?: () => Promise<void>;
 }): void;
@@ -37,5 +43,18 @@ export interface StartMcpOptions {
      */
     schedulerAttached?: boolean;
 }
+/**
+ * Fire-and-forget: starts the executor's start-up warm-up (e.g. KubernetesJobLauncher's memoized
+ * cluster preflight, via RoutingExecutor -> ContainerExecutor -> the job launcher's own `warmUp`)
+ * right when a long-running server process starts, so its first coding run doesn't pay for it.
+ * Never awaited by its caller and never throws: `warmUp()` on every implementation already swallows
+ * its own failure (logging it instead), but this still guards the call site against a surprise
+ * rejection, since nothing here may block or fail server start-up. Called from `startMcp` below —
+ * i.e. from `wardby mcp` (stdio and HTTP) and from `wardby serve`, which shares this same start-up
+ * path — and, separately, from `cli.ts`'s `scheduler()` (`wardby scheduler`), which dispatches
+ * scheduled coding runs through its own Kubernetes executor but never starts an MCP server. Never
+ * called from a one-shot CLI command (`wardby run`, `coding preflight`, migrations, imports).
+ */
+export declare function warmUpExecutor(executor: Pick<McpProviders["executor"], "warmUp">): void;
 /** The real CLI entry point: `wardby mcp`. Reads config from the environment, starts stdio or HTTP per MCP_TRANSPORT. */
 export declare function startMcp(options?: StartMcpOptions): Promise<McpServerHandle>;