@wardby/cli 0.5.3 → 0.7.0

package/dist/mcp/tools/grants.js

@@ -12,7 +12,7 @@
  */
 import { z } from "zod";
 import { Prisma } from "#prisma";
-import { EVERYONE_KEY, EVERYONE_MAX, LEVELS, SHAREABLE_TYPES, accessRank, atLeast, isLevel, isResourceType, principalGranteeKey, } from "../../core/grants.js";
+import { EVERYONE_KEY, EVERYONE_MAX, LEVELS, agentOwnerBindings, SHAREABLE_TYPES, accessRank, atLeast, isLevel, isResourceType, principalGranteeKey, } from "../../core/grants.js";
 import { agentNotFound, assertAgentAccess, agentAccess } from "../auth/access.js";
 import { permissionsOf } from "../auth/resource-server.js";
 import { McpError } from "../errors.js";
@@ -107,7 +107,7 @@ export function registerGrantTools(mcp) {
             "Owner-only whatever the level: the coding profile (task, base ref, protected paths, task-override opt-in, image, packages, limits), kind, budget group, sub-agents, secret/datastore/repository bindings, tool capabilities, memory and datastore contents, grants, delete. " +
             "Consequences: execute lets them run your agent with your tools, secrets, datastores and repository, and every run shares the agent's memory; they supply no task text unless it's a coding agent with allowWebhookTaskOverride. " +
             "Write lets them rewrite what those runs do: the prompt can make a run use everything the agent can already reach (the capabilities you granted, its memory, its linked repositories), and on a coding agent the prompt is part of every coding task, so write directs work done with your GitHub access. " +
-            "Granting again replaces the level. Everyone is capped at execute. The grantee must have signed in once.",
+            "Granting again replaces the level. Everyone may get write only on a native agent with no secrets, datastores, repositories, sub-agents or tool capabilities. The grantee must have signed in once.",
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -131,7 +131,13 @@ export function registerGrantTools(mcp) {
                     throw new McpError(400, "The owner already has full access; a grant to yourself or the owner changes nothing.");
                 }
                 if (!principal && accessRank(type, args.level) > accessRank(type, EVERYONE_MAX[type])) {
-                    throw new McpError(400, `An everyone grant can be at most ${EVERYONE_MAX[type]}: write for everyone would let anyone rewrite an agent that holds your tools and secrets.`);
+                    throw new McpError(400, `An everyone grant can be at most ${EVERYONE_MAX[type]}.`);
+                }
+                if (!principal && atLeast(type, args.level, "write")) {
+                    const bindings = await agentOwnerBindings(tx, resource.id);
+                    if (bindings.length) {
+                        throw new McpError(409, `Agent "${resource.id}" holds ${bindings.join(", ")}: write for everyone would let anyone rewrite an agent that uses them. Detach them first, or grant everyone execute.`);
+                    }
                 }
                 const granteeKey = principal ? principalGranteeKey(principal.id) : EVERYONE_KEY;
                 const grant = await tx.resourceGrant.upsert({

package/dist/mcp/tools/memory.js

@@ -1,5 +1,7 @@
 import { requireAgentAccess } from "../auth/access.js";
 import { textResult } from "./text-result.js";
+import { SecretInValueError, SecretCheckUnavailableError } from "../../core/secret-guard.js";
+import { McpError } from "../errors.js";
 export function registerMemoryTools(mcp) {
     mcp.registerTool({
         name: "get_agent_memory",
@@ -39,7 +41,15 @@ export function registerMemoryTools(mcp) {
         },
         handler: async (args, ctx) => {
             await requireAgentAccess(ctx, args.agentId, "owner");
-            await ctx.providers.memory.set(args.agentId, args.key, args.content);
+            try {
+                await ctx.providers.memory.set(args.agentId, args.key, args.content);
+            }
+            catch (err) {
+                if (err instanceof SecretInValueError || err instanceof SecretCheckUnavailableError) {
+                    throw new McpError(400, err.message);
+                }
+                throw err;
+            }
             return textResult({ ok: true });
         },
     });

package/dist/mcp/tools/notification-channels.d.ts

@@ -0,0 +1,2 @@
+import type { WardbyMcpServer } from "../server.js";
+export declare function registerNotificationChannelTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/notification-channels.js

@@ -0,0 +1,293 @@
+/**
+ * NotificationChannel CRUD — admin-approved links from a Slack channel to a
+ * Jira project or to an agent (native or coding), so wardby's workflow dispatcher
+ * (core/notification-dispatcher.ts) knows where to post a card's lifecycle:
+ * picked up, PR opened, review verdict, fix rounds, merge. Outbound only —
+ * wardby never reads a channel's history, and linking posts nothing.
+ *
+ * Same trust model as link_issue_project (src/mcp/tools/issue-projects.ts):
+ * wardby cannot verify a caller's own Slack workspace access (one bot token
+ * for the whole deployment, no per-user OAuth), so link/unlink/test need
+ * agents:admin with the admin role, and the approver is stamped on the
+ * link. Exactly one of projectKey/agentId is the link's subject (enforced
+ * again by a DB CHECK constraint); `events` narrows which of the
+ * workflow event kinds post to it (empty/omitted = all); private Slack
+ * channels always need /invite @<app> before the bot can see or post to
+ * them. See docs/private/2026-10-08-slack-workflow-notifications-design.md §8.
+ */
+import { Prisma } from "#prisma";
+import { requireAgentAccess } from "../auth/access.js";
+import { requireScope } from "../auth/resource-server.js";
+import { McpError } from "../errors.js";
+import { PROJECT_KEY } from "../../providers/issue-tracker/types.js";
+import { ChatError } from "../../providers/chat/types.js";
+import { WORKFLOW_EVENT_KINDS } from "../../core/workflow-events.js";
+import { textResult } from "./text-result.js";
+const CHAT_PROVIDERS = ["slack"];
+/** Slack channel id: C… (public) or G… (private), case-insensitive, normalized upper-case. */
+const CHANNEL_ID = /^[CG][A-Z0-9]{2,20}$/i;
+function normalizeProjectKey(projectKey) {
+    const key = projectKey.trim().toUpperCase();
+    if (!PROJECT_KEY.test(key))
+        throw new McpError(400, `invalid projectKey "${projectKey}"`);
+    return key;
+}
+function normalizeChannelId(channel) {
+    const id = channel.trim().toUpperCase();
+    if (!CHANNEL_ID.test(id)) {
+        throw new McpError(400, "Pass the channel id (C…); find it in the channel's details in Slack.");
+    }
+    return id;
+}
+export function registerNotificationChannelTools(mcp) {
+    mcp.registerTool({
+        name: "link_notification_channel",
+        scope: "agents:write",
+        description: "Links a Slack channel to a Jira project or to an agent (native or coding), so wardby posts that project's or " +
+            "agent's workflow updates there: a card picked up, a PR opened, a review verdict, fix rounds, and the merge (one thread per card). " +
+            "Outbound only — wardby never reads the channel's history, and nothing in Slack starts work. Admin-approved " +
+            "(agents:admin with the admin role), the same trust model as link_issue_project: wardby cannot verify a caller's " +
+            "own Slack workspace access, so an admin approves every link and is stamped as its authorizer. " +
+            "Exactly one of projectKey or agentId is the link's subject: a project link (with issueProvider, default jira) " +
+            "matches events for issues in that project; an agent link matches events for that agent's runs. " +
+            "channel is the Slack channel id (C… for public, G… for private), never a #name — find it in the channel's " +
+            "details in Slack. Private channels always need /invite @<app> before the bot can see or post to them. " +
+            "events narrows which of the workflow event kinds post to this link; empty or omitted means all. " +
+            "includeCost appends the run's spend line to messages. Re-linking the same channel + subject replaces events and " +
+            "includeCost and clears any previously recorded delivery error — always send the full desired state.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                provider: { type: "string", enum: [...CHAT_PROVIDERS] },
+                channel: { type: "string", minLength: 1, maxLength: 64 },
+                projectKey: { type: "string", minLength: 1, maxLength: 255 },
+                issueProvider: { type: "string", enum: ["jira"] },
+                agentId: { type: "string" },
+                events: { type: "array", items: { type: "string", enum: [...WORKFLOW_EVENT_KINDS] }, uniqueItems: true },
+                includeCost: { type: "boolean" },
+            },
+            required: ["channel"],
+        },
+        handler: async (args, ctx) => {
+            requireScope(ctx, ctx.canonicalUri, "agents:admin");
+            const provider = args.provider ?? "slack";
+            const chat = ctx.providers.chat?.[provider];
+            if (!chat) {
+                throw new McpError(400, "Slack is not configured (WARDBY_SLACK_BOT_TOKEN). See help article errors/slack-not-configured.");
+            }
+            const hasProject = args.projectKey !== undefined;
+            const hasAgent = args.agentId !== undefined;
+            if (hasProject === hasAgent) {
+                throw new McpError(400, "Give exactly one of projectKey or agentId.");
+            }
+            let issueProvider = null;
+            let projectKey = null;
+            let agentId = null;
+            if (hasProject) {
+                issueProvider = args.issueProvider ?? "jira";
+                projectKey = normalizeProjectKey(args.projectKey);
+            }
+            else {
+                agentId = args.agentId;
+                const agent = await ctx.db.agent.findUnique({ where: { id: agentId } });
+                if (!agent)
+                    throw new McpError(404, `Agent "${agentId}" not found.`);
+            }
+            const channelId = normalizeChannelId(args.channel);
+            // `info` is undefined when channelInfo can't be validated at all
+            // (missing_scope: no channels:read/groups:read — accept the id
+            // unvalidated); any other auth failure (revoked or invalid token) is a
+            // real error the operator must fix before linking. `info` is
+            // null when the bot genuinely cannot see the channel (an error, not a
+            // validation gap) — kept out of the try/catch below so the 400 for
+            // "bot cannot see this channel" isn't routed through ChatError handling.
+            let info;
+            try {
+                info = await chat.channelInfo(channelId);
+            }
+            catch (err) {
+                if (!(err instanceof ChatError && err.code === "auth_failed"))
+                    throw err;
+                if (err.slackError !== "missing_scope") {
+                    throw new McpError(400, `Slack rejected the bot token (${err.slackError}). See help article errors/slack-auth-failed.`);
+                }
+                info = undefined;
+            }
+            if (info === null) {
+                throw new McpError(400, `The bot cannot see channel ${channelId}: invite it with /invite @<app> (private channels always need ` +
+                    "this). See errors/slack-channel-unreachable.");
+            }
+            const channelName = info ? info.name : null;
+            const events = [...new Set(args.events ?? [])];
+            const includeCost = args.includeCost ?? false;
+            const fields = {
+                channelName,
+                events,
+                includeCost,
+                lastError: null,
+                lastErrorAt: null,
+                authorizedById: ctx.principal.id,
+                authorizedAt: new Date(),
+            };
+            // Can't use Prisma `upsert` here: Postgres treats NULLs as distinct
+            // within a unique index, and this link's unique keys
+            // (provider, channelId, issueProvider, projectKey) / (provider,
+            // channelId, agentId) each have two columns that are null for the
+            // other subject kind — so the where-unique input Prisma generates for
+            // this compound key never matches an existing row the way a fully
+            // non-null key would. Find the existing row explicitly instead, then
+            // update it by id or create.
+            const subjectWhere = hasProject
+                ? { provider, channelId, issueProvider, projectKey }
+                : { provider, channelId, agentId };
+            const existing = await ctx.db.notificationChannel.findFirst({ where: subjectWhere });
+            let link;
+            if (existing) {
+                link = await ctx.db.notificationChannel.update({ where: { id: existing.id }, data: fields });
+            }
+            else {
+                try {
+                    link = await ctx.db.notificationChannel.create({
+                        data: { provider, channelId, issueProvider, projectKey, agentId, ...fields },
+                    });
+                }
+                catch (err) {
+                    if (!(err instanceof Prisma.PrismaClientKnownRequestError) || err.code !== "P2002")
+                        throw err;
+                    // Lost a create race: another concurrent link_notification_channel
+                    // call for the same channel + subject committed first. Re-linking
+                    // an existing link is normal, documented behavior (it replaces
+                    // events/includeCost and clears lastError) — so re-query and
+                    // update that row instead of surfacing the race as an error.
+                    const raced = await ctx.db.notificationChannel.findFirst({ where: subjectWhere });
+                    if (!raced)
+                        throw err;
+                    link = await ctx.db.notificationChannel.update({ where: { id: raced.id }, data: fields });
+                }
+            }
+            return textResult({ link });
+        },
+    });
+    mcp.registerTool({
+        name: "unlink_notification_channel",
+        scope: "agents:write",
+        description: "Removes a notification channel link. Admin only (agents:admin with the admin role).",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: { id: { type: "string" } },
+            required: ["id"],
+        },
+        handler: async (args, ctx) => {
+            requireScope(ctx, ctx.canonicalUri, "agents:admin");
+            const { count } = await ctx.db.notificationChannel.deleteMany({ where: { id: args.id } });
+            return textResult({ unlinked: count > 0 });
+        },
+    });
+    mcp.registerTool({
+        name: "list_notification_channels",
+        scope: "agents:read",
+        description: "Lists notification channel links, each with its pending and failed delivery counts. Filter by projectKey, " +
+            "agentId, or channel (the Slack channel id). Listing an agent's own links needs read access to that agent; " +
+            "listing without agentId (every link, including project links) needs agents:admin with the admin role.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                projectKey: { type: "string", minLength: 1, maxLength: 255 },
+                agentId: { type: "string" },
+                channel: { type: "string", minLength: 1, maxLength: 64 },
+            },
+        },
+        handler: async (args, ctx) => {
+            if (args.agentId !== undefined) {
+                await requireAgentAccess(ctx, args.agentId, "read");
+            }
+            else {
+                requireScope(ctx, ctx.canonicalUri, "agents:admin");
+            }
+            const where = {};
+            if (args.agentId !== undefined)
+                where.agentId = args.agentId;
+            if (args.projectKey !== undefined)
+                where.projectKey = normalizeProjectKey(args.projectKey);
+            if (args.channel !== undefined)
+                where.channelId = normalizeChannelId(args.channel);
+            const links = await ctx.db.notificationChannel.findMany({ where, orderBy: { createdAt: "asc" } });
+            // Counts only for the listed links' own (provider, channel) pairs, so a
+            // caller never learns about deliveries to channels it cannot list.
+            const pairKey = (r) => `${r.provider}\u0000${r.channelId}`;
+            const pairs = [
+                ...new Map(links.map((l) => [pairKey(l), { provider: l.provider, channelId: l.channelId }])).values(),
+            ];
+            const counts = pairs.length === 0
+                ? []
+                : await ctx.db.notificationDelivery.groupBy({
+                    by: ["provider", "channelId", "state"],
+                    where: { state: { in: ["pending", "failed"] }, OR: pairs },
+                    _count: true,
+                });
+            const byChannel = new Map();
+            for (const row of counts) {
+                const entry = byChannel.get(pairKey(row)) ?? { pending: 0, failed: 0 };
+                if (row.state === "pending")
+                    entry.pending = row._count;
+                else if (row.state === "failed")
+                    entry.failed = row._count;
+                byChannel.set(pairKey(row), entry);
+            }
+            const channels = links.map((l) => ({
+                ...l,
+                pending: byChannel.get(pairKey(l))?.pending ?? 0,
+                failed: byChannel.get(pairKey(l))?.failed ?? 0,
+            }));
+            return textResult({ channels });
+        },
+    });
+    mcp.registerTool({
+        name: "test_notification_channel",
+        scope: "agents:write",
+        description: "Posts a one-off confirmation message to a linked channel, to prove the bot can write there before relying on it " +
+            "for workflow notifications (a private channel needs /invite @<app> first; a channel the bot can't reach " +
+            "surfaces its error immediately instead of silently queueing). Admin only (agents:admin with the admin role).",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: { id: { type: "string" } },
+            required: ["id"],
+        },
+        handler: async (args, ctx) => {
+            requireScope(ctx, ctx.canonicalUri, "agents:admin");
+            const link = await ctx.db.notificationChannel.findUnique({ where: { id: args.id } });
+            if (!link)
+                throw new McpError(404, `Notification channel link "${args.id}" not found.`);
+            const chat = ctx.providers.chat?.[link.provider];
+            if (!chat) {
+                throw new McpError(400, "Slack is not configured (WARDBY_SLACK_BOT_TOKEN). See help article errors/slack-not-configured.");
+            }
+            try {
+                await chat.postMessage(link.channelId, { text: "✅ wardby is connected to this channel." });
+            }
+            catch (err) {
+                if (!(err instanceof ChatError))
+                    throw err;
+                if (err.code === "channel_unreachable") {
+                    await ctx.db.notificationChannel.update({
+                        where: { id: link.id },
+                        data: { lastError: err.slackError, lastErrorAt: new Date() },
+                    });
+                }
+                throw new McpError(400, `${err.code}: ${err.slackError}`);
+            }
+            // The bot can post here again: clear any recorded delivery error.
+            if (link.lastError !== null || link.lastErrorAt !== null) {
+                await ctx.db.notificationChannel.update({
+                    where: { id: link.id },
+                    data: { lastError: null, lastErrorAt: null },
+                });
+            }
+            return textResult({ tested: true });
+        },
+    });
+}

package/dist/mcp/tools/packages.d.ts

@@ -0,0 +1,2 @@
+import type { WardbyMcpServer } from "../server.js";
+export declare function registerPackageTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/packages.js

@@ -0,0 +1,195 @@
+/**
+ * approve_audited_packages: promotes what package audit mode recorded on a
+ * run (docs/coding-packages.md#package-audit-mode) into the agent's package
+ * allowlist, as bare names. Only `top-level` records are promoted by
+ * default; an `unknown` one (a direct download, or after a plan fallback)
+ * may really be a dependency of an allowlisted package, so it is promoted
+ * only when `names` lists it. A `transitive` one follows its parent once that is allowlisted,
+ * and an `allowed` one is already on the allowlist graph (it was recorded
+ * only for the advisories full mode served past, which approving cannot
+ * waive). For a parent run, each coding sub-run's names go to that sub-run's
+ * own agent. Same gate as packageAllowlist: packages:approve or agents:admin,
+ * and only the agent's owner. Every agent is checked before any is written,
+ * and all are written in one transaction, so a refusal changes nothing.
+ * Package audit mode itself is left as it is.
+ */
+import { Prisma } from "#prisma";
+import { z } from "zod";
+import { matchRoot, parseAllowlist } from "../../coding/registry/allowlist.js";
+import { UNKNOWN_RELATION_LABEL } from "../../coding/registry/audit-mode.js";
+import { REGISTRY_ADAPTERS } from "../../coding/registry/adapters.js";
+import { logger } from "../../core/logger.js";
+import { agentAccess } from "../auth/access.js";
+import { requireAnyScope } from "../auth/resource-server.js";
+import { McpError } from "../errors.js";
+import { textResult } from "./text-result.js";
+const packagesLog = logger.child({ module: "mcp-packages" });
+/** codingProfile.packageAllowlist's own cap per ecosystem (coding/profile.ts). */
+const MAX_ALLOWLIST_ENTRIES = 256;
+const ApproveSchema = z
+    .object({
+    runId: z.string().trim().min(1).max(128),
+    names: z.array(z.string().min(1).max(256)).min(1).max(MAX_ALLOWLIST_ENTRIES).optional(),
+})
+    .strict();
+export function registerPackageTools(mcp) {
+    mcp.registerTool({
+        name: "approve_audited_packages",
+        scope: "agents:write",
+        description: "Add the packages a run installed under package audit mode to its agent's codingProfile.packageAllowlist, as " +
+            "bare names (the top-level records in get_run's packageAudit; their dependencies then follow through the " +
+            "allowlist graph). Records with relation unknown may be dependencies of allowlisted packages: they are added only " +
+            "when `names` lists them, and are returned as `unknown` otherwise. For a parent run, each coding sub-run's " +
+            "packages go to that sub-run's agent; nothing is changed unless every agent can be. `names` limits it to those " +
+            "names. Needs packages:approve or agents:admin, and only the agent's owner may use it. Does not turn package " +
+            "audit mode off.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                runId: { type: "string", description: "The run whose package audit to approve (get_run's packageAudit)." },
+                names: {
+                    type: "array",
+                    items: { type: "string" },
+                    description: "Only these package names (as get_run lists them), including any with relation unknown to add; omitted means every top-level one.",
+                },
+            },
+            required: ["runId"],
+        },
+        handler: async (raw, ctx) => {
+            const parsed = ApproveSchema.safeParse(raw);
+            if (!parsed.success) {
+                const details = parsed.error.issues.map((i) => `${i.path.join(".") || "input"}: ${i.message}`).join("; ");
+                throw new McpError(400, `Invalid approve_audited_packages arguments: ${details}`);
+            }
+            const { runId, names } = parsed.data;
+            // The same gate as changing packageAllowlist through update_agent.
+            requireAnyScope(ctx, ctx.canonicalUri, "packages:approve", "agents:admin");
+            // Visible to the agent's owner and the run's triggerer only, exactly as get_run.
+            const notFound = new McpError(404, `Run "${runId}" not found.`);
+            const run = await ctx.db.run.findUnique({
+                where: { id: runId },
+                select: { id: true, agentId: true, triggeredById: true },
+            });
+            if (!run)
+                throw notFound;
+            if (run.triggeredById !== ctx.principal.id) {
+                const agent = await ctx.db.agent.findUnique({ where: { id: run.agentId } });
+                if (!agent || (await agentAccess(ctx, agent)) !== "owner")
+                    throw notFound;
+            }
+            // The coding runs whose records count, with the agent each one belongs to.
+            const coding = await ctx.db.codingRun.findUnique({ where: { runId }, select: { runId: true } });
+            const targets = coding
+                ? [{ runId, agentId: run.agentId }]
+                : (await ctx.db.run.findMany({
+                    where: { parentRunId: runId },
+                    select: { id: true, agentId: true, codingRun: { select: { runId: true } } },
+                }))
+                    .filter((child) => child.codingRun)
+                    .map((child) => ({ runId: child.id, agentId: child.agentId }));
+            const agentOf = new Map(targets.map((target) => [target.runId, target.agentId]));
+            const records = targets.length > 0
+                ? await ctx.db.registryAuditRecord.findMany({
+                    where: { runId: { in: targets.map((target) => target.runId) } },
+                    select: { runId: true, ecosystem: true, name: true, relation: true },
+                    orderBy: { createdAt: "asc" },
+                })
+                : [];
+            const wanted = names ? new Set(names) : null;
+            /** agentId -> ecosystem -> names to add, first-seen order. */
+            const byAgent = new Map();
+            /** Unknown-relation names left out (not named), per ecosystem + name. */
+            const skippedUnknown = new Map();
+            const topLevel = new Set(records.filter((r) => r.relation === "top-level").map((r) => `${r.runId}\0${r.ecosystem}\0${r.name}`));
+            for (const record of records) {
+                if (record.relation !== "top-level" && record.relation !== "unknown")
+                    continue;
+                if (wanted ? !wanted.has(record.name) : record.relation !== "top-level") {
+                    if (!wanted && !topLevel.has(`${record.runId}\0${record.ecosystem}\0${record.name}`))
+                        skippedUnknown.set(`${record.ecosystem}\0${record.name}`, {
+                            ecosystem: record.ecosystem,
+                            name: record.name,
+                        });
+                    continue;
+                }
+                const agentId = agentOf.get(record.runId);
+                const ecosystems = byAgent.get(agentId) ?? new Map();
+                byAgent.set(agentId, ecosystems);
+                ecosystems.set(record.ecosystem, (ecosystems.get(record.ecosystem) ?? new Set()).add(record.name));
+            }
+            // One transaction: every agent is checked (owner, coding, the cap) before any is written.
+            const results = await ctx.db.$transaction(async (tx) => {
+                const planned = [];
+                for (const [agentId, ecosystems] of byAgent) {
+                    const agent = await tx.agent.findUnique({ where: { id: agentId }, include: { codingProfile: true } });
+                    if (!agent?.codingProfile || agent.kind !== "coding") {
+                        throw new McpError(400, `Agent "${agentId}" is not a coding agent.`);
+                    }
+                    // Strict, like update_agent's coding profile: the owner only.
+                    if (agent.ownerId === null || agent.ownerId !== ctx.principal.id) {
+                        throw new McpError(403, `Agent "${agentId}": only its owner can change its package allowlist.`);
+                    }
+                    const current = (agent.codingProfile.packageAllowlist ?? {});
+                    const parsedCurrent = parseAllowlist(current, REGISTRY_ADAPTERS);
+                    const next = Object.fromEntries(Object.entries(current).map(([ecosystem, entries]) => [ecosystem, [...entries]]));
+                    const added = {};
+                    for (const [ecosystem, candidates] of ecosystems) {
+                        const adapter = REGISTRY_ADAPTERS.get(ecosystem);
+                        if (!adapter)
+                            continue;
+                        const entries = parsedCurrent.get(ecosystem) ?? [];
+                        const list = next[ecosystem] ?? [];
+                        for (const name of candidates) {
+                            // Already allowed (exactly, by a ranged entry, or a wildcard): an entry's range is the owner's.
+                            if (list.includes(name) || matchRoot(entries, adapter.normalizeName(name)))
+                                continue;
+                            list.push(name);
+                            (added[ecosystem] ??= []).push(name);
+                        }
+                        if (list.length > MAX_ALLOWLIST_ENTRIES) {
+                            throw new McpError(400, `Agent "${agentId}": approving these would put ${list.length} ${ecosystem} entries on its allowlist; the limit is ${MAX_ALLOWLIST_ENTRIES}. Approve fewer with \`names\`, or replace some entries with a scope wildcard. Nothing was changed.`);
+                        }
+                        if (list.length > 0)
+                            next[ecosystem] = list;
+                    }
+                    // Every added name is a registry name the proxy normalized: still parsed, so the stored allowlist stays valid.
+                    parseAllowlist(next, REGISTRY_ADAPTERS);
+                    planned.push({ agentId, added, packageAllowlist: next });
+                }
+                for (const result of planned) {
+                    if (Object.keys(result.added).length === 0)
+                        continue;
+                    await tx.codingAgentProfile.update({
+                        where: { agentId: result.agentId },
+                        data: { packageAllowlist: result.packageAllowlist },
+                    });
+                }
+                return planned;
+            }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });
+            for (const result of results) {
+                const count = Object.values(result.added).reduce((sum, list) => sum + list.length, 0);
+                if (count > 0) {
+                    packagesLog.info({
+                        event: "coding.package_audit.promoted",
+                        agentId: result.agentId,
+                        runId,
+                        added: count,
+                        by: ctx.principal.id,
+                    }, "audited packages added to the allowlist");
+                }
+            }
+            const unknown = [...skippedUnknown.values()];
+            return textResult({
+                runId,
+                agents: results,
+                ...(unknown.length > 0
+                    ? {
+                        unknown,
+                        unknownNote: `${UNKNOWN_RELATION_LABEL.toLowerCase()}. List one in \`names\` to add it.`,
+                    }
+                    : {}),
+            });
+        },
+    });
+}

package/dist/mcp/tools/power.d.ts

@@ -0,0 +1,2 @@
+import type { WardbyMcpServer } from "../server.js";
+export declare function registerPowerTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/power.js

@@ -0,0 +1,77 @@
+/**
+ * Low-power mode over MCP: power_status reads the coding proxy's and native
+ * gateway's state, power_sleep scales them to zero now instead of waiting out
+ * the idle window. Both need power:manage, a privileged scope honoured only
+ * for the admin role (resource-server.ts). power_sleep never stops a run: a
+ * target with active or queued runs (or, for the gateway, an active gateway
+ * session) is refused and its run ids returned. Each power_sleep is audited
+ * (event power.sleep, outcome ok or error, naming the principal), including a
+ * failed or refused call, since a failure can follow a target already slept.
+ */
+import { z } from "zod";
+import { logger } from "../../core/logger.js";
+import { DISABLED_POWER, LOW_POWER_DISABLED } from "../../core/power.js";
+import { McpError } from "../errors.js";
+import { textResult } from "./text-result.js";
+const powerToolLog = logger.child({ module: "mcp-power" });
+const TARGETS = ["proxy", "gateway"];
+const SleepSchema = z.object({ target: z.enum(TARGETS).optional() }).strict();
+const StatusSchema = z.object({}).strict();
+function parse(schema, label, value) {
+    const result = schema.safeParse(value ?? {});
+    if (!result.success) {
+        const details = result.error.issues
+            .map((issue) => `${issue.path.join(".") || "input"}: ${issue.message}`)
+            .join("; ");
+        throw new McpError(400, `Invalid ${label}: ${details}`);
+    }
+    return result.data;
+}
+export function registerPowerTools(mcp) {
+    mcp.registerTool({
+        name: "power_status",
+        scope: "power:manage",
+        description: "Admins (power:manage): low-power mode state. For the coding proxy and the native gateway: replicas, whether a ready endpoint exists, when it last woke (wokeAt), and blockers (run ids keeping it busy). Returns { enabled: false } when low-power mode is off.",
+        inputSchema: { type: "object", additionalProperties: false, properties: {} },
+        handler: async (rawArgs, ctx) => {
+            parse(StatusSchema, "power_status arguments", rawArgs);
+            return textResult(await (ctx.providers.power ?? DISABLED_POWER).status());
+        },
+    });
+    mcp.registerTool({
+        name: "power_sleep",
+        scope: "power:manage",
+        description: "Admins (power:manage): scale the coding proxy and/or native gateway to zero now, skipping low-power mode's idle window. It never stops a run: a target is refused while it has active or queued runs (for the gateway, also an active gateway session), and those run ids are returned under blocked. Recently finished runs do not block it. The next run wakes the target again. Fails (409 low_power_disabled) when low-power mode is off.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                target: {
+                    type: "string",
+                    enum: [...TARGETS],
+                    description: "Sleep only this target. Omit to sleep both.",
+                },
+            },
+        },
+        handler: async (rawArgs, ctx) => {
+            const { target } = parse(SleepSchema, "power_sleep arguments", rawArgs);
+            const targets = target ? [target] : [...TARGETS];
+            const power = ctx.providers.power ?? DISABLED_POWER;
+            const audit = { event: "power.sleep", principal: ctx.principal.id, targets };
+            let result;
+            try {
+                result = await power.sleepNow(targets);
+            }
+            catch (err) {
+                // Audited before rethrowing: sleepNow may already have slept an earlier target.
+                const error = err instanceof Error ? err.message : String(err);
+                powerToolLog.warn({ ...audit, outcome: "error", error }, "power_sleep");
+                if (err instanceof Error && err.message.startsWith(`${LOW_POWER_DISABLED}:`))
+                    throw new McpError(409, err.message);
+                throw err;
+            }
+            powerToolLog.info({ ...audit, outcome: "ok", slept: result.slept, blocked: result.blocked }, "power_sleep");
+            return textResult(result);
+        },
+    });
+}