@wardby/cli 0.5.3 → 0.7.0

package/dist/mcp/index.js

@@ -13,8 +13,11 @@
  * missing `AUTH_JWKS_URI`/`AUTH_SIGNING_KEY` a deployment running stdio-only
  * never needed to set.
  */
-import { loadProviderConfig, loadMcpConfig, loadShutdownDrainSeconds, loadAuthConfig, loadGitHubEventConfig, loadJiraConfig, loadGitHubVcsConfig, } from "../config/providers.js";
+import { startupTestSimulators } from "../config/test-simulators.js";
+import { loadProviderConfig, loadMcpConfig, loadShutdownDrainSeconds, loadAuthConfig, loadGitHubEventConfig, loadJiraConfig, loadGitHubVcsConfig, loadBlobStoreConfig, } from "../config/providers.js";
 import { prisma } from "../core/db.js";
+import { guardDatastore, guardAgentMemory } from "../core/secret-guarded-stores.js";
+import { createDbSecretWriteGuard } from "../core/secret-guard.js";
 import { waitForInFlightRuns } from "../core/in-flight-runs.js";
 import { NativeEngine } from "../core/engine-native.js";
 import { resolveLlmRegistrations, RoutingLlmProvider } from "../providers/llm/index.js";
@@ -22,15 +25,20 @@ import { startModelCatalog } from "../providers/llm/catalog-store.js";
 import { PostgresDatastore } from "../providers/datastore/index.js";
 import { PostgresAgentMemory } from "../providers/memory/index.js";
 import { buildConfiguredExecutor, buildExecutor } from "../providers/executor/index.js";
+import { buildNativeSandboxExecutor } from "../native-worker/composition.js";
 import { buildSecretCipher } from "../providers/secrets/index.js";
 import { buildIssueTrackers } from "../providers/issue-tracker/index.js";
 import { buildHostUserAuthorizers, buildReviewHosts } from "../providers/review-host/index.js";
+import { buildChatProviders } from "../providers/chat/index.js";
 import { createRepoAccessGate } from "../core/repo-access.js";
 import { userCallbackPath } from "../core/host-identity-links.js";
 import { buildAuthProvider } from "../providers/auth/index.js";
 import { GitHubAppClient } from "../providers/vcs/github.js";
+import { loadGitHubAllowedAccounts } from "../config/github-allowed-accounts.js";
 import { buildMcpServer } from "./server.js";
+import { buildPower } from "../core/power-composition.js";
 import { countUnattendedSchedules, unattendedSchedulesWarning } from "./unattended-schedules.js";
+import { logZod3ToolWarnings } from "../core/zod3-window.js";
 import { runStdioServer } from "./transport/stdio.js";
 import { startHttpServer } from "./transport/streamable-http.js";
 import { resolvePrincipal } from "./auth/principal.js";
@@ -43,23 +51,32 @@ import { registerAgentTools } from "./tools/agents.js";
 import { registerServiceTools } from "./tools/services.js";
 import { registerBudgetGroupTools } from "./tools/budget-groups.js";
 import { registerModelCatalogTools } from "./tools/model-catalog.js";
+import { registerPowerTools } from "./tools/power.js";
 import { registerHelpTools } from "./tools/help.js";
 import { registerTriggerTool } from "./tools/trigger.js";
 import { registerToolAuthoringTools } from "./tools/tools.js";
 import { registerSchedulingTools } from "./tools/scheduling.js";
 import { registerRunTools } from "./tools/runs.js";
+import { registerStopRunTool } from "./tools/stop-run.js";
 import { registerCostReportTools } from "./tools/cost-report.js";
 import { registerDatastoreTools } from "./tools/datastore.js";
 import { registerSubAgentTools } from "./tools/subagents.js";
 import { registerGrantTools } from "./tools/grants.js";
 import { registerRepositoryTools } from "./tools/repositories.js";
 import { registerIssueProjectTools } from "./tools/issue-projects.js";
+import { registerNotificationChannelTools } from "./tools/notification-channels.js";
 import { registerHostAccountTools } from "./tools/host-accounts.js";
 import { registerMemoryTools } from "./tools/memory.js";
+import { registerPackageTools } from "./tools/packages.js";
 import { registerSecretsTools } from "./tools/secrets.js";
 import { registerWebhookTools } from "./tools/webhooks.js";
-import { createStdioSecretElicitationHost } from "./tools/secret-elicitation-server.js";
+import { STDIO_SECRET_PATH, secretFormRoute } from "./tools/secret-elicitation-server.js";
+import { createStdioLinkHost } from "./transport/stdio-link-host.js";
+import { registerRunTranscriptTool } from "./tools/run-transcript.js";
+import { handleRunTranscriptDownload, RUN_TRANSCRIPT_DOWNLOAD_PATH } from "./tools/run-transcript-download.js";
+import { createBlobStore } from "../providers/storage/index.js";
 import { SECRET_ELICITATION_PATH } from "./tools/secret-elicitation-form.js";
+import { installWorkflowEventRecorder } from "../core/notifications.js";
 import { logger } from "../core/logger.js";
 const mcpLog = logger.child({ module: "mcp-index" });
 const SELF_HOSTED_CLEANUP_INTERVAL_MS = 60 * 60 * 1000; // hourly
@@ -105,19 +122,29 @@ export function registerAllTools(mcp, opts) {
     registerServiceTools(mcp);
     registerBudgetGroupTools(mcp);
     registerModelCatalogTools(mcp, { refresh: opts.refreshModelCatalog });
+    registerPowerTools(mcp);
     registerHelpTools(mcp);
     registerTriggerTool(mcp);
     registerToolAuthoringTools(mcp);
     registerSchedulingTools(mcp);
     registerRunTools(mcp);
+    const runTranscriptUrl = opts.runTranscriptUrl;
+    registerRunTranscriptTool(mcp, {
+        downloadUrl: runTranscriptUrl ?? (() => Promise.reject(new Error("run transcripts are not served here"))),
+        blobStoreConfigured: runTranscriptUrl !== undefined && opts.blobStoreConfigured === true,
+        audience: opts.runTranscriptAudience ?? "http",
+    });
+    registerStopRunTool(mcp);
     registerCostReportTools(mcp);
     registerDatastoreTools(mcp);
     registerSubAgentTools(mcp);
     registerGrantTools(mcp);
     registerRepositoryTools(mcp);
     registerIssueProjectTools(mcp);
+    registerNotificationChannelTools(mcp);
     registerHostAccountTools(mcp);
     registerMemoryTools(mcp);
+    registerPackageTools(mcp);
     registerSecretsTools(mcp, {
         buildElicitationUrl: opts.secretElicitationUrl,
         protocolElicitation: opts.secretElicitationProtocol,
@@ -134,11 +161,17 @@ export function buildMcpProviders() {
     const llm = new RoutingLlmProvider(llmResult.registrations);
     const engine = new NativeEngine();
     const secrets = buildSecretCipher(providerConfig);
-    const datastore = new PostgresDatastore(prisma, secrets);
-    const memory = new PostgresAgentMemory(prisma);
+    const secretGuard = createDbSecretWriteGuard(prisma, secrets);
+    const datastore = guardDatastore(new PostgresDatastore(prisma, secrets), secretGuard);
+    const memory = guardAgentMemory(new PostgresAgentMemory(prisma), secretGuard);
     const reviewHosts = buildReviewHosts(process.env, prisma);
     const issueTrackers = buildIssueTrackers();
     const hostUserAuthorizers = buildHostUserAuthorizers();
+    // Installed here (not just serve/scheduler) so `wardby mcp`, which handles
+    // webhooks, records events too; only serve and the scheduler command start
+    // the dispatcher.
+    const chat = buildChatProviders();
+    installWorkflowEventRecorder(prisma, chat);
     // One gate (and one cache) for the whole process: set-time checks in the
     // MCP tools, repo_* calls in native runs, coding runs, and host events.
     const repoAccess = createRepoAccessGate({ db: prisma, hosts: reviewHosts });
@@ -161,7 +194,18 @@ export function buildMcpProviders() {
         repoAccess,
     };
     const nativeExecutor = buildExecutor(providerConfig, nativeProviders, prisma);
-    const executor = buildConfiguredExecutor({ native: nativeExecutor, db: prisma, providerConfig, repoAccess });
+    // One Power for the process, shared by both executors (wake) and the scheduler leader (sleep).
+    const power = buildPower({ env: process.env, db: prisma });
+    const executor = buildConfiguredExecutor({
+        native: nativeExecutor,
+        db: prisma,
+        providerConfig,
+        repoAccess,
+        power,
+        secretCipher: secrets,
+        // Sandbox-mode native runs (docs/native-sandbox.md); undefined when NATIVE_SANDBOX_LAUNCHER is unset.
+        nativeSandbox: buildNativeSandboxExecutor({ db: prisma, providers: nativeProviders, power }),
+    });
     nativeProviders.executor = executor;
     return {
         providers: {
@@ -175,6 +219,8 @@ export function buildMcpProviders() {
             issueTrackers,
             hostUserAuthorizers,
             repoAccess,
+            chat,
+            power,
         },
     };
 }
@@ -187,11 +233,33 @@ async function closeQuietly(promise, what) {
         mcpLog.warn({ err }, `${what} failed during MCP shutdown`);
     }
 }
+/**
+ * Fire-and-forget: starts the executor's start-up warm-up (e.g. KubernetesJobLauncher's memoized
+ * cluster preflight, via RoutingExecutor -> ContainerExecutor -> the job launcher's own `warmUp`)
+ * right when a long-running server process starts, so its first coding run doesn't pay for it.
+ * Never awaited by its caller and never throws: `warmUp()` on every implementation already swallows
+ * its own failure (logging it instead), but this still guards the call site against a surprise
+ * rejection, since nothing here may block or fail server start-up. Called from `startMcp` below —
+ * i.e. from `wardby mcp` (stdio and HTTP) and from `wardby serve`, which shares this same start-up
+ * path — and, separately, from `cli.ts`'s `scheduler()` (`wardby scheduler`), which dispatches
+ * scheduled coding runs through its own Kubernetes executor but never starts an MCP server. Never
+ * called from a one-shot CLI command (`wardby run`, `coding preflight`, migrations, imports).
+ */
+export function warmUpExecutor(executor) {
+    void executor.warmUp?.()?.catch((err) => {
+        mcpLog.warn({ err }, "executor warm-up failed unexpectedly");
+    });
+}
 /** The real CLI entry point: `wardby mcp`. Reads config from the environment, starts stdio or HTTP per MCP_TRANSPORT. */
 export async function startMcp(options = {}) {
     const mcpConfig = loadMcpConfig();
+    // WARDBY_TEST_SIMULATORS (test only): refuses to start beside production configuration.
+    startupTestSimulators("server");
     // Parsed up front so a malformed value fails at startup, not at shutdown.
     const drainSeconds = loadShutdownDrainSeconds();
+    // Parsed now so a malformed list stops startup instead of failing every event.
+    const allowedAccounts = loadGitHubAllowedAccounts();
+    mcpLog.info({ additionalAccounts: [...allowedAccounts] }, "GitHub App serves its owner plus WARDBY_GITHUB_ALLOWED_ACCOUNTS");
     // Loads the model catalog before anything else: running on the shipped
     // catalog alone (the fallback currentModelCatalog() uses before a store
     // is installed) would quietly re-enable models an admin turned off.
@@ -202,17 +270,35 @@ export async function startMcp(options = {}) {
     const modelCatalog = await startModelCatalog(prisma);
     const providers = options.providers ?? buildMcpProviders().providers;
     await providers.executor.launch?.();
+    warmUpExecutor(providers.executor);
     if (!options.schedulerAttached)
         await warnIfNothingWillFireSchedules();
+    // Zod 3 compatibility window: one warning per custom tool the next release breaks. In the background.
+    void logZod3ToolWarnings(prisma, mcpLog);
+    // Run transcripts (get_run_transcript) are served from the blob store they were stored in.
+    const blobStoreConfig = loadBlobStoreConfig();
+    const blobs = blobStoreConfig ? createBlobStore(blobStoreConfig) : undefined;
     if (mcpConfig.transport === "stdio") {
         const mcp = buildMcpServer({ providers, db: prisma, config: { canonicalUri: STDIO_PLACEHOLDER_URI } });
-        const secretElicitationHost = createStdioSecretElicitationHost({
-            verify: (token) => mcp.verifyRequestState(token),
-            secrets: providers.secrets,
-            db: prisma,
+        // One loopback server for every signed link a stdio tool hands out.
+        const linkHost = createStdioLinkHost({
+            [STDIO_SECRET_PATH]: secretFormRoute({
+                verify: (token) => mcp.verifyRequestState(token),
+                secrets: providers.secrets,
+                db: prisma,
+            }),
+            [RUN_TRANSCRIPT_DOWNLOAD_PATH]: (req, res, token) => handleRunTranscriptDownload(req.method, token, res, {
+                verify: (t) => mcp.verifyRequestState(t),
+                audience: "stdio",
+                db: prisma,
+                blobs,
+            }),
         });
         registerAllTools(mcp, {
-            secretElicitationUrl: (token) => secretElicitationHost.urlFor(token),
+            secretElicitationUrl: (token) => linkHost.urlFor(STDIO_SECRET_PATH, token),
+            runTranscriptUrl: (token) => linkHost.urlFor(RUN_TRANSCRIPT_DOWNLOAD_PATH, token),
+            runTranscriptAudience: "stdio",
+            blobStoreConfigured: blobs !== undefined,
             secretElicitationProtocol: mcpConfig.secretElicitationProtocol,
             refreshModelCatalog: () => modelCatalog.refreshNow(),
         });
@@ -244,17 +330,31 @@ export async function startMcp(options = {}) {
     const authProviderKind = providerConfig.auth === "self-hosted" ? "self-hosted" : "delegating";
     const authProvider = buildAuthProvider(providerConfig.auth, authConfig, prisma);
     const selfHosted = authProviderKind === "self-hosted" ? authProvider : undefined;
-    const mcp = buildMcpServer({ providers, db: prisma, config: { canonicalUri: mcpConfig.canonicalUri } });
+    const mcp = buildMcpServer({
+        providers,
+        db: prisma,
+        config: { canonicalUri: mcpConfig.canonicalUri },
+        deriveRequestStateKey: true,
+    });
     const httpOrigin = canonicalUrl(mcpConfig.canonicalUri).origin;
     registerAllTools(mcp, {
         secretElicitationUrl: (token) => Promise.resolve(`${httpOrigin}${SECRET_ELICITATION_PATH}?t=${encodeURIComponent(token)}`),
+        runTranscriptUrl: (token) => Promise.resolve(`${httpOrigin}${RUN_TRANSCRIPT_DOWNLOAD_PATH}?t=${encodeURIComponent(token)}`),
+        blobStoreConfigured: blobs !== undefined,
         secretElicitationProtocol: mcpConfig.secretElicitationProtocol,
         refreshModelCatalog: () => modelCatalog.refreshNow(),
     });
     const eventConfig = loadGitHubEventConfig();
     const githubConfig = loadGitHubVcsConfig();
     const reviewHosts = providers.reviewHosts;
-    const githubEvents = eventConfig.webhookSecret && reviewHosts?.github && githubConfig.appId && githubConfig.privateKey
+    const githubApp = githubConfig.appId && githubConfig.privateKey
+        ? new GitHubAppClient({
+            appId: githubConfig.appId,
+            privateKey: githubConfig.privateKey,
+            apiVersion: githubConfig.apiVersion,
+        })
+        : undefined;
+    const githubEvents = eventConfig.webhookSecret && reviewHosts?.github && githubApp
         ? {
             github: {
                 db: prisma,
@@ -263,14 +363,10 @@ export async function startMcp(options = {}) {
                 repoAccess: providers.repoAccess ?? createRepoAccessGate({ db: prisma, hosts: reviewHosts }),
                 ...(providers.issueTrackers ? { issueTrackers: providers.issueTrackers } : {}),
                 webhookSecret: eventConfig.webhookSecret,
-                appIdentity: (() => {
-                    const client = new GitHubAppClient({
-                        appId: githubConfig.appId,
-                        privateKey: githubConfig.privateKey,
-                        apiVersion: githubConfig.apiVersion,
-                    });
-                    return () => client.appIdentity();
-                })(),
+                appIdentity: (opts) => githubApp.appIdentity(opts),
+                allowedAccounts: () => allowedAccounts,
+                mentionExplanations: eventConfig.mentionExplanations,
+                uninstallInstallation: (id) => githubApp.deleteInstallation(id),
             },
         }
         : undefined;
@@ -336,6 +432,7 @@ export async function startMcp(options = {}) {
         hostEvents,
         hostUserAuth,
         viewer,
+        blobs,
     });
     const cleanupTimer = selfHosted
         ? setInterval(() => {

package/dist/mcp/server.d.ts

@@ -25,6 +25,14 @@
 import { type McpServerFactory, type InputRequiredResult } from "@modelcontextprotocol/server";
 import type { PrismaClient } from "#prisma";
 import type { McpRequestContext, McpProviders } from "./context.js";
+/**
+ * Most array elements plus object members one `tools/call` may carry
+ * (GHSA-46jr-4wx8-v453). Validating an argument tree costs memory per node, so
+ * without a bound one request inside the 1 MiB body limit could hold a very
+ * large tree. The largest legitimate input is a datastore value, itself capped
+ * at 1 MiB; 100,000 nodes leaves ample room for any realistic value.
+ */
+export declare const MAX_TOOL_INPUT_ELEMENTS = 100000;
 export interface ToolSpec<Args = Record<string, unknown>> {
     name: string;
     description?: string;
@@ -58,6 +66,11 @@ export interface BuildMcpServerOptions {
     config: McpServerConfig;
     /** Testability hook for REQUEST_STATE_KEY — defaults to process.env, matching buildSecretCipher's convention. */
     env?: NodeJS.ProcessEnv;
+    /**
+     * HTTP transport: with REQUEST_STATE_KEY unset, derive the requestState key from SECRET_APP_KEY so
+     * every instance sharing that key verifies every other instance's tokens. stdio leaves it off.
+     */
+    deriveRequestStateKey?: boolean;
 }
 export interface DiscoverResultLike {
     capabilities: {

package/dist/mcp/server.js

@@ -23,7 +23,7 @@
  * whole connection.
  */
 import { McpServer, fromJsonSchema, createRequestStateCodec, CLIENT_CAPABILITIES_META_KEY, } from "@modelcontextprotocol/server";
-import { randomBytes } from "node:crypto";
+import { hkdfSync, randomBytes } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { requireScope } from "./auth/resource-server.js";
 import { McpError, mapPrismaError } from "./errors.js";
@@ -33,17 +33,35 @@ import { grantedIds } from "../core/grants.js";
 import { logger } from "../core/logger.js";
 /** The package version, reported in MCP server info (package.json sits two levels up from src/mcp and dist/mcp). */
 const SERVER_VERSION = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8")).version;
+/**
+ * Most array elements plus object members one `tools/call` may carry
+ * (GHSA-46jr-4wx8-v453). Validating an argument tree costs memory per node, so
+ * without a bound one request inside the 1 MiB body limit could hold a very
+ * large tree. The largest legitimate input is a datastore value, itself capped
+ * at 1 MiB; 100,000 nodes leaves ample room for any realistic value.
+ */
+export const MAX_TOOL_INPUT_ELEMENTS = 100_000;
 const REQUEST_STATE_KEY_BYTES = 32;
+/** HKDF info for the requestState key derived from SECRET_APP_KEY; never reused for another key. */
+const REQUEST_STATE_KEY_INFO = "wardby/mcp/request-state/http/v1";
 /**
  * REQUEST_STATE_KEY (hex, 32 bytes) shares the requestState HMAC key across
- * instances — see the requestStateCodec construction below. Unset falls back
- * to a fresh random key, which is correct for stdio and single-instance HTTP
- * and is NOT an error: only a multi-instance HTTP deployment needs this set.
+ * instances — see the requestStateCodec construction below. Unset, the HTTP
+ * transport derives it from SECRET_APP_KEY (HKDF-SHA256, a label of its own),
+ * which every instance of one deployment already shares, so a multi-instance
+ * deployment needs no extra setting; the derived key reveals nothing about
+ * SECRET_APP_KEY. Without either, or on stdio, it is a fresh random key per
+ * process, which is correct when nothing outside that process verifies its
+ * tokens (and keeps stdio tokens from verifying on the HTTP server).
  */
-function loadRequestStateKey(env) {
+function loadRequestStateKey(env, derive) {
     const hex = env.REQUEST_STATE_KEY;
-    if (!hex)
-        return randomBytes(REQUEST_STATE_KEY_BYTES);
+    if (!hex) {
+        const appKey = derive && env.SECRET_APP_KEY ? Buffer.from(env.SECRET_APP_KEY, "hex") : undefined;
+        if (appKey?.length !== REQUEST_STATE_KEY_BYTES)
+            return randomBytes(REQUEST_STATE_KEY_BYTES);
+        return new Uint8Array(hkdfSync("sha256", appKey, Buffer.alloc(0), REQUEST_STATE_KEY_INFO, REQUEST_STATE_KEY_BYTES));
+    }
     const key = Buffer.from(hex, "hex");
     if (key.length !== REQUEST_STATE_KEY_BYTES) {
         throw new Error(`REQUEST_STATE_KEY must be ${REQUEST_STATE_KEY_BYTES} bytes of hex (${REQUEST_STATE_KEY_BYTES * 2} hex chars); got ${key.length} bytes.`);
@@ -76,16 +94,16 @@ export function buildMcpServer(opts) {
     // against the codec's implementation) — safe to call verifyRequestState()
     // from outside a real MCP request (the secret-elicitation browser form).
     //
-    // REQUEST_STATE_KEY, when set, lets a token minted by one process verify
-    // on another — required for the secret-elicitation round trip (mint,
-    // browser-form POST, polling retry) to work under a multi-instance HTTP
+    // REQUEST_STATE_KEY (or, over HTTP, the key derived from SECRET_APP_KEY)
+    // lets a token minted by one process verify on another — required for the
+    // secret-elicitation round trip (mint, browser-form POST, polling retry)
+    // and the run-transcript download to work under a multi-instance HTTP
     // deployment, where those three legs can land on three different
     // processes (see secret-elicitation.ts's matching Postgres-backed outcome
-    // store). stdio and single-instance HTTP need no configuration: with the
-    // env var unset, a fresh random key per process is fine, since nothing
-    // outside this same running server ever needs to verify a token it minted.
+    // store). stdio needs no configuration: a fresh random key per process is
+    // fine, since nothing outside that running server verifies its tokens.
     const requestStateCodec = createRequestStateCodec({
-        key: loadRequestStateKey(opts.env ?? process.env),
+        key: loadRequestStateKey(opts.env ?? process.env, opts.deriveRequestStateKey ?? false),
         ttlSeconds: 600,
     });
     function mcpReqOf(sdkCtx) {
@@ -125,6 +143,7 @@ export function buildMcpServer(opts) {
         const mcpServer = new McpServer({ name: "wardby", version: SERVER_VERSION }, {
             requestState: { verify: (state, ctx) => requestStateCodec.verify(state, ctx) },
             instructions: SERVER_INSTRUCTIONS,
+            maxToolInputElements: MAX_TOOL_INPUT_ELEMENTS,
         });
         mcpServer.server.registerCapabilities({ extensions: { [TASKS_EXTENSION_ID]: {} } });
         for (const spec of specs) {

package/dist/mcp/tools/agents.d.ts

@@ -1,2 +1,6 @@
 import type { WardbyMcpServer } from "../server.js";
+/** The warning create_agent / update_agent return (not a refusal): wardby can't tell how old a custom image is. */
+export declare const DEPENDENCY_CACHE_IMAGE_WARNING = "dependencyCache is on and this agent runs its own worker image (workerImageRef): rebuild that image FROM the wardby release that includes the dependency cache before its next run, or the run fails at input (worker_input_failed). See the dependency-cache help article.";
+export declare const SESSION_RESUME_IMAGE_WARNING = "sessionResume is on and this agent runs its own worker image (workerImageRef): rebuild that image FROM the wardby release that includes session resume before its next run, or the run fails at input (worker_input_failed).";
+export declare const SESSION_RESUME_NO_STORE_WARNING = "sessionResume is on but this server has no blob store (BLOB_STORE), so transcripts are not kept. See the resume-runs-locally help article.";
 export declare function registerAgentTools(mcp: WardbyMcpServer): void;