@wardby/cli 0.5.3 → 0.7.0

package/dist/mcp/tools/agents.js

@@ -8,28 +8,44 @@
 import { Prisma } from "#prisma";
 import { z } from "zod";
 import { CodingProfilePatchSchema, CodingProfileSchema } from "../../coding/profile.js";
-import { DEFAULT_CLAUDE_MAX_TURNS, MAX_CODING_TURNS, isLocalRepository } from "../../coding/protocol.js";
+import { DEFAULT_CLAUDE_MAX_OUTPUT_TOKENS, DEFAULT_CLAUDE_MAX_TURNS, MAX_CLAUDE_MAX_OUTPUT_TOKENS, MIN_CLAUDE_MAX_OUTPUT_TOKENS, DEFAULT_DEBUG_TRACE_MAX_MB, MAX_CODING_TURNS, MAX_DEBUG_TRACE_MAX_MB, isLocalRepository, } from "../../coding/protocol.js";
+import { loadBlobStoreConfig, loadContainerExecutorConfig } from "../../config/providers.js";
 import { codingProviderSupportsModel } from "../../coding/provider.js";
+import { ACCEPTED_ADVISORY_ID, MAX_ACCEPTED_ADVISORIES } from "../../coding/registry/allowlist.js";
+import { DEFAULT_PACKAGE_AUDIT_MINUTES, isPackageAuditActive, isPackageAuditMode, MAX_PACKAGE_AUDIT_MINUTES, PACKAGE_AUDIT_MODES, PackageAuditPatchError, packageAuditActiveWarning, resolvePackageAuditPatch, } from "../../coding/registry/audit-mode.js";
 import { assertAgentModelAvailable } from "../../core/run-pricing.js";
 import { ModelUnavailableError } from "../../providers/llm/catalog-types.js";
 import { currentModelCatalog } from "../../providers/llm/catalog-store.js";
 import { validateCronExpression } from "../../core/cron.js";
+import { scheduleStartFields } from "../../core/schedule-start.js";
 import { modelSupportedEfforts } from "../../providers/llm/routing.js";
 import { PROJECT_KEY } from "../../providers/issue-tracker/types.js";
 import { LLM_EFFORT_LEVELS, isLlmEffort } from "../../providers/llm/types.js";
 import { requireReadableBudgetGroup } from "../auth/ownership.js";
 import { agentAccessResolver, agentNotFound, assertAgentAccess, readableAgentsWhere, requireAgentAccess, } from "../auth/access.js";
-import { EVERYONE_KEY, atLeast, canDelegate, deleteGrantsFor, effectiveAccess } from "../../core/grants.js";
+import { EVERYONE_KEY, atLeast, canDelegate, deleteGrantsFor, effectiveAccess, isPublicWritable, } from "../../core/grants.js";
 import { projectTool } from "./tools.js";
+import { withZod3ToolWarnings } from "../../core/zod3-window.js";
 import { requireAnyScope, requireScope } from "../auth/resource-server.js";
 import { logger } from "../../core/logger.js";
 import { authorizeRepositoryForSet, canonicalLocalRepository, } from "../auth/repo-authorization.js";
 import { McpError } from "../errors.js";
 import { textResult } from "./text-result.js";
+function validateWorkspaceDiskMb(workspaceDiskMb) {
+    if (workspaceDiskMb == null)
+        return;
+    const { maxDiskMb } = loadContainerExecutorConfig();
+    if (workspaceDiskMb > maxDiskMb) {
+        throw new McpError(400, `workspaceDiskMb (${workspaceDiskMb} MiB) exceeds the deployment cap (${maxDiskMb} MiB). Raise CODING_MAX_DISK_MB to allow this size.`);
+    }
+}
 // workerImageRef is the BYO-arbitrary-image escape hatch (see
-// resolveCodingWorkerImage in container.ts) — setting or changing it
-// requires a step-up beyond agents:write, the same pattern make_owner below
-// uses for its own sensitive, ownership-bypassing mutation.
+// resolveCodingWorkerImage/resolveCodingToolImage in container.ts). For a Codex agent it
+// replaces the one container that runs the whole agent; for a Claude Code agent it replaces
+// only the tool-runner container that runs the agent's commands, never the agent container
+// (which always stays the deployment's standard Claude Code image). Either way, setting or
+// changing it requires a step-up beyond agents:write, the same pattern make_owner below uses
+// for its own sensitive, ownership-bypassing mutation.
 function requireWorkerImageRefScope(ctx) {
     requireScope(ctx, ctx.canonicalUri, "agents:admin");
 }
@@ -54,12 +70,63 @@ const MAX_DELEGATIONS_PER_RUN = 20;
 const PARALLEL_DELEGATIONS_DESCRIPTION = "Native agents with sub-agents: when true, the delegate_to_* calls the agent makes in one model turn run at the same time " +
     "instead of one after another (other tool calls still run in order). The run tree still shares one budget, so later " +
     "sub-agents get what earlier ones leave. Coding sub-agents still queue for CODING_MAX_CONCURRENT slots. Default false.";
+/** Operator-facing spellings of Agent.nativeExecutionMode (the Prisma enum is `control_plane` | `sandbox`). */
+const NATIVE_EXECUTION_MODES = ["control-plane", "sandbox"];
+const toStoredMode = (mode) => mode === "sandbox" ? "sandbox" : "control_plane";
+/** An agent row as returned to operators: the mode in its hyphenated spelling, null for coding agents. */
+function withOperatorMode(agent) {
+    return {
+        ...agent,
+        nativeExecutionMode: agent.kind !== "native" ? null : agent.nativeExecutionMode === "sandbox" ? "sandbox" : "control-plane",
+    };
+}
+/** The warning create_agent / update_agent return (not a refusal): wardby can't tell how old a custom image is. */
+export const DEPENDENCY_CACHE_IMAGE_WARNING = "dependencyCache is on and this agent runs its own worker image (workerImageRef): rebuild that image FROM the wardby release that includes the dependency cache before its next run, or the run fails at input (worker_input_failed). See the dependency-cache help article.";
+export const SESSION_RESUME_IMAGE_WARNING = "sessionResume is on and this agent runs its own worker image (workerImageRef): rebuild that image FROM the wardby release that includes session resume before its next run, or the run fails at input (worker_input_failed).";
+export const SESSION_RESUME_NO_STORE_WARNING = "sessionResume is on but this server has no blob store (BLOB_STORE), so transcripts are not kept. See the resume-runs-locally help article.";
+/** For a warning only: a half-set BLOB_STORE (which throws) counts as none, and never fails the tool call. */
+function blobStoreConfigured() {
+    try {
+        return loadBlobStoreConfig(process.env) !== undefined;
+    }
+    catch {
+        return false;
+    }
+}
+/** Non-blocking warnings about an agent's coding profile as stored. */
+function profileWarnings(profile, now) {
+    const warnings = profile?.dependencyCache && profile.workerImageRef ? [DEPENDENCY_CACHE_IMAGE_WARNING] : [];
+    if (profile?.sessionResume && profile.workerImageRef)
+        warnings.push(SESSION_RESUME_IMAGE_WARNING);
+    if (profile?.sessionResume && !blobStoreConfigured())
+        warnings.push(SESSION_RESUME_NO_STORE_WARNING);
+    if (profile && isPackageAuditActive(profile.packageAuditMode, profile.packageAuditUntil, now))
+        warnings.push(packageAuditActiveWarning(profile.packageAuditMode, profile.packageAuditUntil));
+    return warnings;
+}
+/** An agent as returned to operators: profile warnings, and whether package audit mode is in force now. */
+function withProfileWarnings(agent) {
+    const now = new Date();
+    const profile = agent.codingProfile;
+    const shown = profile
+        ? {
+            ...agent,
+            codingProfile: {
+                ...profile,
+                packageAuditActive: isPackageAuditActive(profile.packageAuditMode, profile.packageAuditUntil, now),
+            },
+        }
+        : agent;
+    const warnings = profileWarnings(profile, now);
+    return warnings.length ? { ...shown, warnings } : shown;
+}
 const agentFields = {
     name: z.string().trim().min(1).max(MAX_AGENT_NAME_CHARS),
     systemPrompt: z.string().min(1).max(MAX_SYSTEM_PROMPT_CHARS),
     model: z.string().trim().min(1).max(MAX_MODEL_CHARS),
     budgetUsd: z.number().finite().positive().max(MAX_BUDGET_USD),
     maxTurns: z.number().int().min(1).max(100),
+    allowedOverrunPercent: z.number().int().min(0).max(100),
     maxDelegationsPerRun: z.number().int().min(1).max(MAX_DELEGATIONS_PER_RUN),
     parallelDelegations: z.boolean(),
     schedule: z.string().trim().min(1).max(256),
@@ -69,6 +136,7 @@ const agentFields = {
     budgetGroupId: z.string().min(1).max(128),
     memoryEnabled: z.boolean(),
     effort: z.enum(LLM_EFFORT_LEVELS),
+    nativeExecutionMode: z.enum(NATIVE_EXECUTION_MODES),
     defectProjectKey: z.string().regex(PROJECT_KEY, "must be an upper-case Jira project key"),
     defectIssueType: z.string().trim().min(1).max(100),
 };
@@ -93,6 +161,7 @@ const CreateAgentSchema = z
     model: agentFields.model,
     budgetUsd: agentFields.budgetUsd,
     maxTurns: agentFields.maxTurns.optional(),
+    allowedOverrunPercent: agentFields.allowedOverrunPercent.optional(),
     maxDelegationsPerRun: agentFields.maxDelegationsPerRun.optional(),
     parallelDelegations: agentFields.parallelDelegations.optional(),
     schedule: agentFields.schedule.optional(),
@@ -102,6 +171,7 @@ const CreateAgentSchema = z
     budgetGroupId: agentFields.budgetGroupId.optional(),
     memoryEnabled: agentFields.memoryEnabled.default(false),
     effort: agentFields.effort.optional(),
+    nativeExecutionMode: agentFields.nativeExecutionMode.optional(),
     defectProjectKey: agentFields.defectProjectKey.optional(),
     defectIssueType: agentFields.defectIssueType.optional(),
     codingProfile: CodingProfileSchema.optional(),
@@ -149,6 +219,7 @@ const UpdateAgentSchema = z
     model: agentFields.model.optional(),
     budgetUsd: agentFields.budgetUsd.optional(),
     maxTurns: agentFields.maxTurns.optional(),
+    allowedOverrunPercent: agentFields.allowedOverrunPercent.optional(),
     maxDelegationsPerRun: agentFields.maxDelegationsPerRun.optional(),
     parallelDelegations: agentFields.parallelDelegations.optional(),
     schedule: agentFields.schedule.nullable().optional(),
@@ -158,11 +229,18 @@ const UpdateAgentSchema = z
     budgetGroupId: agentFields.budgetGroupId.nullable().optional(),
     memoryEnabled: agentFields.memoryEnabled.optional(),
     effort: agentFields.effort.nullable().optional(),
+    nativeExecutionMode: agentFields.nativeExecutionMode.optional(),
     defectProjectKey: agentFields.defectProjectKey.nullable().optional(),
     defectIssueType: agentFields.defectIssueType.nullable().optional(),
     codingProfile: CodingProfilePatchSchema.extend({
         /** Not a stored profile field: sets CodingAgentProfile.debugTraceUntil = now + minutes (null clears). */
         debugTraceMinutes: z.number().int().min(1).max(MAX_DEBUG_TRACE_MINUTES).nullable().optional(),
+        /** Admin-only like debugTraceMinutes: CodingAgentProfile.debugTraceMaxMb (null = the default). */
+        debugTraceMaxMb: z.number().int().min(1).max(MAX_DEBUG_TRACE_MAX_MB).nullable().optional(),
+        /** Not stored as given: sets CodingAgentProfile.packageAuditMode and packageAuditUntil (null clears both). */
+        packageAuditMode: z.enum(PACKAGE_AUDIT_MODES).nullable().optional(),
+        /** Not a stored field: the audit window, in minutes from now (default 24 hours). */
+        packageAuditMinutes: z.number().int().min(1).max(MAX_PACKAGE_AUDIT_MINUTES).optional(),
     }).optional(),
     repositoryAdminOverride: z.boolean().optional(),
 })
@@ -210,7 +288,10 @@ const profileJsonSchema = {
         collectExclude: { type: "array", maxItems: 64, items: { type: "string" } },
         toolchain: { type: "string", enum: ["node", "node-python"] },
         toolchainVersion: { type: ["string", "null"] },
-        workerImageRef: { type: ["string", "null"] },
+        workerImageRef: {
+            type: ["string", "null"],
+            description: "A digest-pinned custom image that this agent's commands run in, for your own languages and tools. Codex: build it FROM the coding-worker driver image; it runs the whole agent. Claude Code: build it FROM this release's wardby-claude-tool-runner image; it runs the agent's commands, while Claude Code itself stays on the standard image. Needs agents:admin. Null uses the toolchain's standard image.",
+        },
         workspaceDiskMb: {
             type: ["integer", "null"],
             minimum: 64,
@@ -223,6 +304,28 @@ const profileJsonSchema = {
             maximum: MAX_CODING_TURNS,
             description: `Claude Code runs only: the most agent turns (model calls) a run may take before it stops with coding_turn_limit. Null uses the worker default (${DEFAULT_CLAUDE_MAX_TURNS}). The run's budget and timeout still apply. Codex runs have no turn limit.`,
         },
+        maxOutputTokens: {
+            type: ["integer", "null"],
+            minimum: MIN_CLAUDE_MAX_OUTPUT_TOKENS,
+            maximum: MAX_CLAUDE_MAX_OUTPUT_TOKENS,
+            description: `Claude Code runs only: the most output tokens per model reply (default ${DEFAULT_CLAUDE_MAX_OUTPUT_TOKENS}, up to ${MAX_CLAUDE_MAX_OUTPUT_TOKENS}). The coding proxy reserves this × the model's output price per request against the run budget, so higher values need a larger budgetUsd. Refused on a Codex agent. Null uses the default.`,
+        },
+        repoSkills: {
+            type: "boolean",
+            description: "Load the repository's agent skills into runs (Codex: .agents/skills and .codex/skills; Claude Code: .claude/skills). Default true. Repository instructions (AGENTS.md for Codex, CLAUDE.md for Claude Code) load either way.",
+        },
+        claudeBareMode: {
+            type: "boolean",
+            description: "Claude Code runs only. Default true: Claude Code runs in bare mode and wardby adds the repository's CLAUDE.md and its skill list to the system prompt; the model reads a skill's SKILL.md with run_command. False: bare mode is off and Claude Code loads CLAUDE.md and skills itself (native Skill tool). Repository settings, hooks, and MCP config are never loaded either way.",
+        },
+        dependencyCache: {
+            type: "boolean",
+            description: "Restore npm node_modules from a snapshot the proxy re-approves; needs package approval (packages:approve or agents:admin). Default false. The worker images must be a release that includes the cache; with a workerImageRef the result carries a warning to rebuild that image from it.",
+        },
+        sessionResume: {
+            type: "boolean",
+            description: "Claude Code runs only. Keep each run's session transcript (redacted) on the server so the session can later be continued in a local Claude Code CLI. Once transcripts are served, anyone who can read a run can read everything its agent saw. Needs a blob store (BLOB_STORE) on the server. Default false.",
+        },
         packageAllowlist: {
             type: "object",
             description: "Approved top-level packages per ecosystem (npm, pypi). A PyPI entry may name extras, e.g. psycopg[binary]. Needs packages:approve or agents:admin.",
@@ -230,7 +333,16 @@ const profileJsonSchema = {
         },
         packagePolicy: {
             type: "object",
-            properties: { minReleaseAgeDays: { type: "integer", minimum: 0, maximum: 30 } },
+            description: "minReleaseAgeDays: days a release must have been public before it can be installed (0-30, default 3). acceptedAdvisories: advisory ids (GHSA-…, CVE-…) this agent's runs may install despite; malware never; every waiver is reported in the PR. Needs packages:approve or agents:admin.",
+            properties: {
+                minReleaseAgeDays: { type: "integer", minimum: 0, maximum: 30 },
+                acceptedAdvisories: {
+                    type: "array",
+                    maxItems: MAX_ACCEPTED_ADVISORIES,
+                    uniqueItems: true,
+                    items: { type: "string", pattern: ACCEPTED_ADVISORY_ID.source },
+                },
+            },
             additionalProperties: false,
         },
         services: {
@@ -285,6 +397,23 @@ function validateEffort(kind, model, effort) {
                 : "It accepts no effort setting; leave effort unset (or null)."));
     }
 }
+const NATIVE_SANDBOX_MODE_DESCRIPTION = "Where a native agent's runs execute: control-plane (default, in the server process) or sandbox (an isolated container; needs the server's native sandbox configured).";
+/**
+ * The mode only applies to native agents, and `sandbox` only works where the
+ * server composed a native sandbox executor; refuse it otherwise rather than
+ * store a mode whose every run would fail closed.
+ */
+function validateNativeExecutionMode(ctx, kind, mode) {
+    if (mode == null)
+        return;
+    if (kind !== "native") {
+        throw new McpError(400, "nativeExecutionMode is only valid for native agents; coding agents do not use it.");
+    }
+    if (mode === "sandbox" && ctx.providers.executor.supportsNativeSandbox?.() !== true) {
+        throw new McpError(400, "native_sandbox_unavailable: this server has no native sandbox configured (set NATIVE_SANDBOX_LAUNCHER), " +
+            'so an agent cannot use nativeExecutionMode "sandbox".');
+    }
+}
 /**
  * A model being set (create, or update with `model`) must be runnable here:
  * in the catalog and enabled; for a native agent, its provider must also be
@@ -319,9 +448,14 @@ function storedProfile(profile) {
         workerImageRef: profile.workerImageRef,
         workspaceDiskMb: profile.workspaceDiskMb,
         maxTurns: profile.maxTurns,
+        maxOutputTokens: profile.maxOutputTokens,
         packageAllowlist: profile.packageAllowlist,
         packagePolicy: profile.packagePolicy,
         services: profile.services,
+        repoSkills: profile.repoSkills,
+        claudeBareMode: profile.claudeBareMode,
+        dependencyCache: profile.dependencyCache,
+        sessionResume: profile.sessionResume,
     });
 }
 /** A service name an agent is allowed must exist in the catalog (any version); typos fail here, not at a run. */
@@ -347,6 +481,12 @@ export function registerAgentTools(mcp) {
                 model: { type: "string" },
                 budgetUsd: { type: "number" },
                 maxTurns: { type: "integer" },
+                allowedOverrunPercent: {
+                    type: "integer",
+                    minimum: 0,
+                    maximum: 100,
+                    description: "Percent above budgetUsd a run may spend before it is stopped. On a coding agent it raises each of its runs' limit; on a lead agent that delegates, it raises its run tree's ceiling for coding sub-agents. Native runs' own model calls are not affected. Budget group caps still apply. 0 = stop at budgetUsd.",
+                },
                 maxDelegationsPerRun: {
                     type: "integer",
                     minimum: 1,
@@ -366,6 +506,11 @@ export function registerAgentTools(mcp) {
                     enum: [...LLM_EFFORT_LEVELS],
                     description: "Reasoning effort for native agents. Unset uses the provider default.",
                 },
+                nativeExecutionMode: {
+                    type: "string",
+                    enum: [...NATIVE_EXECUTION_MODES],
+                    description: NATIVE_SANDBOX_MODE_DESCRIPTION,
+                },
                 defectProjectKey: { type: "string", pattern: PROJECT_KEY.source, description: DEFECT_DESCRIPTION },
                 defectIssueType: { type: "string", minLength: 1, maxLength: 100, description: DEFECT_DESCRIPTION },
                 codingProfile: { ...profileJsonSchema, required: ["repository"] },
@@ -380,17 +525,24 @@ export function registerAgentTools(mcp) {
             const packages = args.codingProfile;
             if (packages &&
                 (Object.keys(packages.packageAllowlist ?? {}).length > 0 ||
-                    Object.keys(packages.packagePolicy ?? {}).length > 0))
+                    Object.keys(packages.packagePolicy ?? {}).length > 0 ||
+                    packages.dependencyCache === true))
                 requirePackageApproval(ctx);
             validateSchedule(args.schedule, args.timezone ?? "UTC");
             requireModelAvailable(ctx, args.model, args.kind);
             validateEffort(args.kind, args.model, args.effort);
+            validateNativeExecutionMode(ctx, args.kind, args.nativeExecutionMode);
+            validateWorkspaceDiskMb(args.codingProfile?.workspaceDiskMb);
             if (args.codingProfile)
                 await requireCatalogServiceNames(ctx.db, args.codingProfile.services);
             if (args.budgetGroupId) {
                 await requireReadableBudgetGroup(ctx.db, args.budgetGroupId, ctx.principal.id);
             }
-            const { codingProfile, repositoryAdminOverride, ...agentData } = args;
+            const { codingProfile, repositoryAdminOverride, nativeExecutionMode, ...agentFieldsData } = args;
+            const agentData = {
+                ...agentFieldsData,
+                ...(nativeExecutionMode ? { nativeExecutionMode: toStoredMode(nativeExecutionMode) } : {}),
+            };
             if (repositoryAdminOverride === true && !codingProfile) {
                 throw new McpError(400, "repositoryAdminOverride only applies with a codingProfile repository.");
             }
@@ -407,6 +559,11 @@ export function registerAgentTools(mcp) {
             const agent = await ctx.db.agent.create({
                 data: {
                     ...agentData,
+                    ...(await scheduleStartFields(ctx.db, null, {
+                        schedule: agentData.schedule ?? null,
+                        timezone: agentData.timezone ?? "UTC",
+                        scheduleEnabled: agentData.scheduleEnabled ?? true,
+                    })),
                     ownerId: ctx.principal.id,
                     ...(codingProfile && authorization
                         ? { codingProfile: { create: { ...codingProfile, ...profileStamp(authorization) } } }
@@ -414,7 +571,7 @@ export function registerAgentTools(mcp) {
                 },
                 include: { codingProfile: true },
             });
-            return textResult(agent);
+            return textResult(withProfileWarnings(withOperatorMode(agent)));
         },
     });
     mcp.registerTool({
@@ -430,6 +587,12 @@ export function registerAgentTools(mcp) {
                 model: { type: "string" },
                 budgetUsd: { type: "number" },
                 maxTurns: { type: "integer" },
+                allowedOverrunPercent: {
+                    type: "integer",
+                    minimum: 0,
+                    maximum: 100,
+                    description: "Percent above budgetUsd a run may spend before it is stopped. On a coding agent it raises each of its runs' limit; on a lead agent that delegates, it raises its run tree's ceiling for coding sub-agents. Native runs' own model calls are not affected. Budget group caps still apply. 0 = stop at budgetUsd.",
+                },
                 maxDelegationsPerRun: {
                     type: "integer",
                     minimum: 1,
@@ -449,6 +612,11 @@ export function registerAgentTools(mcp) {
                     enum: [...LLM_EFFORT_LEVELS, null],
                     description: "Reasoning effort for native agents. Null clears it back to the provider default.",
                 },
+                nativeExecutionMode: {
+                    type: "string",
+                    enum: [...NATIVE_EXECUTION_MODES],
+                    description: NATIVE_SANDBOX_MODE_DESCRIPTION,
+                },
                 defectProjectKey: {
                     type: ["string", "null"],
                     pattern: PROJECT_KEY.source,
@@ -470,6 +638,27 @@ export function registerAgentTools(mcp) {
                             maximum: MAX_DEBUG_TRACE_MINUTES,
                             description: "Admins only (agents:admin): trace every coding run of this agent for this many minutes from now; the worker writes its full stream trace, which can include prompts and repository content, to the run pod's log. Null turns it off.",
                         },
+                        debugTraceMaxMb: {
+                            type: ["integer", "null"],
+                            minimum: 1,
+                            maximum: MAX_DEBUG_TRACE_MAX_MB,
+                            description: `Admins only (agents:admin): cap on one traced run's trace output, in MiB (default ${DEFAULT_DEBUG_TRACE_MAX_MB}); the trace stops with a limit_reached line once it is reached. Null restores the default.`,
+                        },
+                        packageAuditMode: {
+                            type: ["string", "null"],
+                            enum: [...PACKAGE_AUDIT_MODES, null],
+                            description: "Package audit mode, for a limited time (packageAuditMinutes). Needs packages:approve or agents:admin, and only the agent's owner may set it. " +
+                                '"audit": the registry installs packages outside this agent\'s allowlist instead of refusing them, and records each one; ' +
+                                '"full": also installs versions withheld only by high or critical advisories. Malware is refused and the release-age limit enforced in every mode. ' +
+                                "This weakens the supply-chain guard while it is on: use it to find out which packages a task needs, then add them to packageAllowlist. " +
+                                "Fixed per run when the run is dispatched. Null turns it off.",
+                        },
+                        packageAuditMinutes: {
+                            type: "integer",
+                            minimum: 1,
+                            maximum: MAX_PACKAGE_AUDIT_MINUTES,
+                            description: `How long package audit mode stays on, in minutes from now (default ${DEFAULT_PACKAGE_AUDIT_MINUTES}, at most ${MAX_PACKAGE_AUDIT_MINUTES}: 7 days). Given alone, it re-arms the stored mode. Needs packages:approve or agents:admin.`,
+                        },
                     },
                 },
                 repositoryAdminOverride: REPOSITORY_ADMIN_OVERRIDE,
@@ -481,9 +670,18 @@ export function registerAgentTools(mcp) {
             if (args.codingProfile?.workerImageRef !== undefined)
                 requireWorkerImageRefScope(ctx);
             const debugTraceMinutes = args.codingProfile?.debugTraceMinutes;
-            if (debugTraceMinutes !== undefined)
+            const debugTraceMaxMb = args.codingProfile?.debugTraceMaxMb;
+            if (debugTraceMinutes !== undefined || debugTraceMaxMb !== undefined)
                 requireDebugTraceScope(ctx);
-            if (args.codingProfile?.packageAllowlist !== undefined || args.codingProfile?.packagePolicy !== undefined)
+            const auditPatch = {
+                packageAuditMode: args.codingProfile?.packageAuditMode,
+                packageAuditMinutes: args.codingProfile?.packageAuditMinutes,
+            };
+            if (args.codingProfile?.packageAllowlist !== undefined ||
+                args.codingProfile?.packagePolicy !== undefined ||
+                args.codingProfile?.dependencyCache !== undefined ||
+                auditPatch.packageAuditMode !== undefined ||
+                auditPatch.packageAuditMinutes !== undefined)
                 requirePackageApproval(ctx);
             // Repository authorization calls GitHub, so it runs before (outside) the
             // serializable transaction, on a pre-read; the transaction then verifies
@@ -554,6 +752,7 @@ export function registerAgentTools(mcp) {
                 : debugTraceMinutes === null
                     ? null
                     : new Date(Date.now() + debugTraceMinutes * 60_000);
+            let auditSet;
             const agent = await ctx.db.$transaction(async (tx) => {
                 const existing = await tx.agent.findUnique({ where: { id: args.id }, include: { codingProfile: true } });
                 if (!existing)
@@ -575,6 +774,12 @@ export function registerAgentTools(mcp) {
                     await requireReadableBudgetGroup(tx, args.budgetGroupId, ctx.principal.id);
                 }
                 const nextKind = args.kind ?? existing.kind;
+                // A coding repository is an owner binding (agentOwnerBindings): an
+                // agent everyone can write never gets one, as attach_* refuse theirs.
+                if (((nextKind === "coding" && existing.kind !== "coding") || repositoryChanges(existing)) &&
+                    (await isPublicWritable(tx, existing.id))) {
+                    throw new McpError(409, `Agent "${args.id}" is writable by everyone, so it can't become a coding agent or get a repository; revoke or lower the everyone grant first.`);
+                }
                 if (nextKind === "native" && args.codingProfile) {
                     throw new McpError(400, "A coding profile is only valid for coding agents.");
                 }
@@ -585,6 +790,12 @@ export function registerAgentTools(mcp) {
                 if (args.model !== undefined || args.effort !== undefined || nextKind !== existing.kind) {
                     validateEffort(nextKind, args.model ?? existing.model, args.effort !== undefined ? args.effort : existing.effort);
                 }
+                if (args.nativeExecutionMode !== undefined) {
+                    validateNativeExecutionMode(ctx, nextKind, args.nativeExecutionMode);
+                }
+                else if (nextKind === "coding" && existing.nativeExecutionMode === "sandbox") {
+                    throw new McpError(400, 'nativeExecutionMode is only valid for native agents; set nativeExecutionMode to "control-plane" before changing this agent to coding.');
+                }
                 let nextProfile = null;
                 if (nextKind === "coding") {
                     const attachedTools = await tx.agentTool.count({ where: { agentId: args.id } });
@@ -592,11 +803,14 @@ export function registerAgentTools(mcp) {
                         throw new McpError(400, "Detach all native sandbox tools before changing an agent to coding.");
                     }
                     const currentProfile = existing.codingProfile ? storedProfile(existing.codingProfile) : undefined;
-                    const { debugTraceMinutes: _minutes, ...profilePatch } = args.codingProfile ?? {};
+                    const { debugTraceMinutes: _minutes, debugTraceMaxMb: _maxMb, packageAuditMode: _auditMode, packageAuditMinutes: _auditMinutes, ...profilePatch } = args.codingProfile ?? {};
                     const profileResult = CodingProfileSchema.safeParse({ ...currentProfile, ...profilePatch });
                     if (!profileResult.success)
                         throw invalidArguments("coding profile", profileResult.error);
                     nextProfile = profileResult.data;
+                    if (typeof args.codingProfile?.workspaceDiskMb === "number" || nextKind !== existing.kind) {
+                        validateWorkspaceDiskMb(nextProfile.workspaceDiskMb);
+                    }
                     if (args.codingProfile?.services !== undefined)
                         await requireCatalogServiceNames(tx, nextProfile.services);
                     const nextModel = args.model ?? existing.model;
@@ -607,6 +821,19 @@ export function registerAgentTools(mcp) {
                         throw new McpError(400, `Model "${nextModel}" is not supported by coding provider "${nextProfile.provider}".`);
                     }
                 }
+                // Package audit mode: resolved against the stored mode inside the
+                // transaction, so minutes alone re-arm what is stored now.
+                let audit;
+                try {
+                    const storedMode = existing.codingProfile?.packageAuditMode;
+                    audit = resolvePackageAuditPatch({ mode: isPackageAuditMode(storedMode) ? storedMode : null }, auditPatch, new Date());
+                }
+                catch (error) {
+                    if (error instanceof PackageAuditPatchError)
+                        throw new McpError(400, error.message);
+                    throw error;
+                }
+                auditSet = audit;
                 const nextSchedule = args.schedule !== undefined ? args.schedule : existing.schedule;
                 const nextTimezone = args.timezone ?? existing.timezone;
                 const nextScheduleEnabled = args.scheduleEnabled ?? existing.scheduleEnabled;
@@ -614,9 +841,17 @@ export function registerAgentTools(mcp) {
                 if (nextKind === "coding" && nextSchedule && nextScheduleEnabled && !nextProfile?.defaultTask) {
                     throw new McpError(400, "A default task is required for an enabled coding-agent schedule.");
                 }
-                const { id, codingProfile: _profilePatch, repositoryAdminOverride: _override, ...updates } = args;
+                const { id, codingProfile: _profilePatch, repositoryAdminOverride: _override, nativeExecutionMode: modeArg, ...fieldUpdates } = args;
+                const updates = {
+                    ...fieldUpdates,
+                    ...(modeArg ? { nativeExecutionMode: toStoredMode(modeArg) } : {}),
+                };
                 const stamp = authorization ? profileStamp(authorization) : {};
-                const trace = debugTraceUntil === undefined ? {} : { debugTraceUntil };
+                const trace = {
+                    ...(debugTraceUntil === undefined ? {} : { debugTraceUntil }),
+                    ...(debugTraceMaxMb === undefined ? {} : { debugTraceMaxMb }),
+                    ...(audit === undefined ? {} : { packageAuditMode: audit.mode, packageAuditUntil: audit.until }),
+                };
                 const profileMutation = nextKind === "native"
                     ? existing.codingProfile
                         ? { delete: true }
@@ -624,34 +859,51 @@ export function registerAgentTools(mcp) {
                     : existing.codingProfile
                         ? { update: { ...nextProfile, ...stamp, ...trace } }
                         : { create: { ...nextProfile, ...stamp, ...trace } };
+                const scheduleStart = await scheduleStartFields(tx, existing, {
+                    schedule: nextSchedule,
+                    timezone: nextTimezone,
+                    scheduleEnabled: nextScheduleEnabled,
+                });
                 return tx.agent.update({
                     where: { id },
                     data: {
                         ...updates,
+                        ...scheduleStart,
                         ...(profileMutation ? { codingProfile: profileMutation } : {}),
                     },
                     include: { codingProfile: true },
                 });
             }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });
-            if (debugTraceUntil !== undefined) {
+            if (debugTraceUntil !== undefined || debugTraceMaxMb !== undefined) {
                 agentsLog.info({
                     event: "coding.debug_trace.set",
                     agentId: agent.id,
-                    until: debugTraceUntil?.toISOString() ?? null,
+                    ...(debugTraceUntil !== undefined ? { until: debugTraceUntil?.toISOString() ?? null } : {}),
+                    ...(debugTraceMaxMb !== undefined ? { maxMb: debugTraceMaxMb } : {}),
                     by: ctx.principal.id,
                 }, "coding debug trace set");
             }
-            return textResult(agent);
+            if (auditSet !== undefined) {
+                agentsLog.info({
+                    event: "coding.package_audit.set",
+                    agentId: agent.id,
+                    mode: auditSet.mode,
+                    until: auditSet.until?.toISOString() ?? null,
+                    by: ctx.principal.id,
+                }, "coding package audit mode set");
+            }
+            return textResult(withProfileWarnings(withOperatorMode(agent)));
         },
     });
     mcp.registerTool({
         name: "list_agents",
         scope: "agents:read",
+        description: "Lists the agents you can see. Each row has an `access` field, your level on that agent: owner > write > execute > read. When showing the agents as a table, include `access` as a column.",
         inputSchema: { type: "object", properties: {}, additionalProperties: false },
         handler: async (_args, ctx) => {
             const [where, accessOf] = await Promise.all([readableAgentsWhere(ctx), agentAccessResolver(ctx)]);
             const agents = await ctx.db.agent.findMany({ where, include: { codingProfile: true } });
-            return textResult(agents.map((agent) => ({ ...agent, access: accessOf(agent) })));
+            return textResult(agents.map((agent) => ({ ...withOperatorMode(agent), access: accessOf(agent) })));
         },
     });
     mcp.registerTool({
@@ -671,12 +923,13 @@ export function registerAgentTools(mcp) {
             // A7: a tool's code and schema are its owner's, whoever can read the
             // agent (the agent's owner included). Capabilities stay visible: config.
             return textResult({
-                ...agent,
+                ...withProfileWarnings(withOperatorMode(agent)),
                 access,
-                tools: agent.tools.map((attachment) => ({
+                // Zod 3 window: the caller's own tools carry their warnings (see core/zod3-window.ts).
+                tools: await Promise.all(agent.tools.map(async (attachment) => ({
                     ...attachment,
-                    tool: projectTool(attachment.tool, ctx.principal.id),
-                })),
+                    tool: await withZod3ToolWarnings(projectTool(attachment.tool, ctx.principal.id)),
+                }))),
             });
         },
     });
@@ -870,7 +1123,7 @@ export function registerAgentTools(mcp) {
                     }
                 }
                 return {
-                    ...updated,
+                    ...withOperatorMode(updated),
                     repositoryApprovalsRevoked: revoked,
                     bindingsRemoved,
                     toolCapabilitiesSuspended,

package/dist/mcp/tools/datastore.js

@@ -1,9 +1,10 @@
 import { Prisma } from "#prisma";
 import { requireOwnedDatastore, canRead, assertCanMutate } from "../auth/ownership.js";
-import { requireAgentAccess, requireBindingOwner } from "../auth/access.js";
+import { requireAgentAccess, requireBindable, requireBindingOwner } from "../auth/access.js";
 import { createDatastore, listDatastores, deleteDatastore, attachDatastore, detachDatastore, buildSharedDatastoreAccessor, } from "../../core/datastores.js";
 import { McpError } from "../errors.js";
 import { textResult } from "./text-result.js";
+import { SecretInValueError, SecretCheckUnavailableError } from "../../core/secret-guard.js";
 /**
  * A `boundName` names an *attachment* (agentId, boundName) -> Datastore.
  * Agent data (the private store and bound stores) is owner-only (resource-
@@ -99,7 +100,7 @@ export function registerDatastoreTools(mcp) {
             // read it: strictly the agent owner's own datastore on the owner's
             // own agent (A2/S2-2). Not even the stdio operator crosses owners.
             const { agent } = await requireAgentAccess(ctx, args.agentId, "read");
-            requireBindingOwner(ctx, agent);
+            await requireBindable(ctx, agent);
             const datastore = await requireOwnedDatastore(ctx.db, args.datastoreId, ctx.principal.id);
             if (datastore.ownerId !== agent.ownerId) {
                 throw new McpError(403, "Only a datastore owned by the agent's owner can be attached to it.");
@@ -191,14 +192,22 @@ export function registerDatastoreTools(mcp) {
         },
         handler: async (args, ctx) => {
             await requireAgentAccess(ctx, args.agentId, "owner");
-            if (args.boundName) {
-                await requireMutableSharedDatastore(ctx.db, args.agentId, args.boundName, ctx.principal.id);
-                const accessor = buildSharedDatastoreAccessor(args.agentId, ctx.providers.datastore, ctx.db);
-                await accessor.set(args.boundName, args.key, args.value, { pii: args.pii });
+            try {
+                if (args.boundName) {
+                    await requireMutableSharedDatastore(ctx.db, args.agentId, args.boundName, ctx.principal.id);
+                    const accessor = buildSharedDatastoreAccessor(args.agentId, ctx.providers.datastore, ctx.db);
+                    await accessor.set(args.boundName, args.key, args.value, { pii: args.pii });
+                    return textResult({ ok: true });
+                }
+                await ctx.providers.datastore.set(args.agentId, args.key, args.value, { pii: args.pii });
                 return textResult({ ok: true });
             }
-            await ctx.providers.datastore.set(args.agentId, args.key, args.value, { pii: args.pii });
-            return textResult({ ok: true });
+            catch (err) {
+                if (err instanceof SecretInValueError || err instanceof SecretCheckUnavailableError) {
+                    throw new McpError(400, err.message);
+                }
+                throw err;
+            }
         },
     });
     mcp.registerTool({