@wardby/cli 0.5.3 → 0.7.0

package/dist/mcp/tools/repositories.js

@@ -13,7 +13,7 @@
  */
 import { Prisma } from "#prisma";
 import { isLocalRepository, normalizeGitHubRepository, normalizeLocalRepository } from "../../coding/protocol.js";
-import { requireAgentAccess, requireBindingOwner } from "../auth/access.js";
+import { requireAgentAccess, requireBindable, requireBindingOwner, requireNotPublicWritable } from "../auth/access.js";
 import { authorizeRepositoryForSet, canonicalLocalRepository } from "../auth/repo-authorization.js";
 import { requireScope } from "../auth/resource-server.js";
 import { McpError } from "../errors.js";
@@ -68,9 +68,9 @@ export function registerRepositoryTools(mcp) {
             "pull_request trigger, and is unique per repository. waitForCi (only with the pull_request trigger) holds this agent's " +
             "review on a pushed head until that head's own CI finishes, instead of racing it; APPROVE is refused while CI on the " +
             "head is failing or still running. Re-linking an already-linked repository replaces its access, triggers, checkName, " +
-            "reviewFixMaxRounds, and waitForCi (an omitted field is cleared, not kept) and re-checks access — always send the full " +
-            "desired state. A local repository (local:/abs/path, inside the server's trusted roots) takes no triggers or checkName: " +
-            "it supports manual reviews only (trigger_agent with review).",
+            "reviewFixMaxRounds, waitForCi, and markReadyWhenPassing (an omitted field is cleared, not kept) and re-checks access " +
+            "— always send the full desired state. A local repository (local:/abs/path, inside the server's trusted roots) takes " +
+            "no triggers or checkName: it supports manual reviews only (trigger_agent with review).",
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -92,6 +92,13 @@ export function registerRepositoryTools(mcp) {
                     description: "Only with the pull_request trigger: hold this agent's review on a pushed head until that head's own CI " +
                         "finishes, instead of racing it (default false).",
                 },
+                markReadyWhenPassing: {
+                    type: "boolean",
+                    description: "Only on a write link: mark the draft pull requests this agent, or a coding agent it delegated to " +
+                        "(directly or through sub-agents), opens here ready for review, once, " +
+                        "after every Wardby review check passed, CI is green and the wardby merge order check (if any) " +
+                        "is success (default false).",
+                },
                 adminOverride: {
                     type: "boolean",
                     description: "Admins only (agents:admin with the admin role): approve this link without checking GitHub access, recorded as an admin approval. Allowed on any agent that has an owner, not only the admin's own.",
@@ -109,10 +116,11 @@ export function registerRepositoryTools(mcp) {
                 agent = await ctx.db.agent.findUnique({ where: { id: args.agentId } });
                 if (!agent)
                     throw new McpError(404, `Agent "${args.agentId}" not found.`);
+                await requireNotPublicWritable(agent, ctx.db);
             }
             else {
                 agent = (await requireAgentAccess(ctx, args.agentId, "read")).agent;
-                requireBindingOwner(ctx, agent);
+                await requireBindable(ctx, agent);
             }
             if (agent.kind !== "native") {
                 throw new McpError(400, "Repository links are for native agents only; coding agents use codingProfile.repository.");
@@ -154,6 +162,10 @@ export function registerRepositoryTools(mcp) {
             if (waitForCi && !triggers.includes("pull_request")) {
                 throw new McpError(400, "waitForCi needs the pull_request trigger.");
             }
+            const markReadyWhenPassing = args.markReadyWhenPassing ?? false;
+            if (markReadyWhenPassing && args.access !== "write") {
+                throw new McpError(400, "markReadyWhenPassing needs write access.");
+            }
             // The host call happens before, and outside, the serializable transaction.
             const authorization = await authorizeRepositoryForSet(ctx, {
                 ownerId: agent.ownerId,
@@ -172,6 +184,7 @@ export function registerRepositoryTools(mcp) {
                         checkName,
                         reviewFixMaxRounds,
                         waitForCi,
+                        markReadyWhenPassing,
                         ...authorization,
                     };
                     return tx.agentRepository.upsert({

package/dist/mcp/tools/run-access.d.ts

@@ -0,0 +1,16 @@
+import type { PrismaClient, Run } from "#prisma";
+import type { McpRequestContext } from "../context.js";
+import { type GrantDb } from "../../core/grants.js";
+/** Who is asking to read a run: a principal, and whether it is the stdio local operator. */
+export interface RunReader {
+    principalId: string;
+    operator?: boolean;
+}
+/**
+ * Run visibility (resource-sharing grants spec §3.5, A6): a run's triggerer
+ * keeps seeing it even after losing access to the agent; otherwise only the
+ * agent's owner (or the stdio operator). Read on the agent is not enough.
+ */
+export declare function canReadRun(db: GrantDb & Pick<PrismaClient, "agent">, run: Pick<Run, "agentId" | "triggeredById">, reader: RunReader): Promise<boolean>;
+/** The run, when the caller may read it (canReadRun); otherwise the same 404 a missing run gets. */
+export declare function findReadableRun(ctx: McpRequestContext, runId: string): Promise<Run>;

package/dist/mcp/tools/run-access.js

@@ -0,0 +1,25 @@
+import { McpError } from "../errors.js";
+import { effectiveAccess } from "../../core/grants.js";
+/**
+ * Run visibility (resource-sharing grants spec §3.5, A6): a run's triggerer
+ * keeps seeing it even after losing access to the agent; otherwise only the
+ * agent's owner (or the stdio operator). Read on the agent is not enough.
+ */
+export async function canReadRun(db, run, reader) {
+    if (run.triggeredById !== null && run.triggeredById === reader.principalId)
+        return true;
+    const agent = await db.agent.findUnique({ where: { id: run.agentId }, select: { id: true, ownerId: true } });
+    if (!agent)
+        return false;
+    return ((await effectiveAccess(db, "agent", agent, reader.principalId, { operator: reader.operator === true })) === "owner");
+}
+/** The run, when the caller may read it (canReadRun); otherwise the same 404 a missing run gets. */
+export async function findReadableRun(ctx, runId) {
+    const run = await ctx.db.run.findUnique({ where: { id: runId } });
+    const notFound = new McpError(404, `Run "${runId}" not found.`);
+    if (!run)
+        throw notFound;
+    if (!(await canReadRun(ctx.db, run, { principalId: ctx.principal.id, operator: ctx.operator })))
+        throw notFound;
+    return run;
+}

package/dist/mcp/tools/run-transcript-download.d.ts

@@ -0,0 +1,30 @@
+import type { ServerResponse } from "node:http";
+import type { PrismaClient } from "#prisma";
+import type { BlobStore } from "../../providers/storage/types.js";
+import { RUN_TRANSCRIPT_DOWNLOAD_PATH, RUN_TRANSCRIPT_LINK_TTL_MS, TRANSCRIPT_META_HEADER, TRANSCRIPT_SESSION_HEADER, TRANSCRIPT_SHA256_HEADER } from "../../coding/transcript/download-protocol.js";
+export { RUN_TRANSCRIPT_DOWNLOAD_PATH, RUN_TRANSCRIPT_LINK_TTL_MS, TRANSCRIPT_META_HEADER, TRANSCRIPT_SESSION_HEADER, TRANSCRIPT_SHA256_HEADER, };
+/**
+ * Which host serves a link. A stdio link (which may carry the operator flag) is never accepted by
+ * the HTTP route, even when REQUEST_STATE_KEY is shared and its signature verifies there.
+ */
+export type RunTranscriptLinkAudience = "stdio" | "http";
+export interface RunTranscriptLinkPayload {
+    kind: "run-transcript";
+    runId: string;
+    principalId: string;
+    /** The host that minted the link, and the only one that serves it. */
+    aud: RunTranscriptLinkAudience;
+    /** The stdio local operator: owner of every run for access checks. Only ever on a stdio link. */
+    operator?: boolean;
+    /** Epoch ms after which the link is refused. */
+    exp: number;
+}
+export interface RunTranscriptDownloadDeps {
+    verify: (token: string) => Promise<unknown>;
+    /** The host serving this route: only links minted for it are accepted. */
+    audience: RunTranscriptLinkAudience;
+    db: Pick<PrismaClient, "run" | "agent" | "resourceGrant" | "codingRun" | "runTranscript">;
+    blobs: BlobStore | undefined;
+    now?: () => Date;
+}
+export declare function handleRunTranscriptDownload(method: string | undefined, token: string | null, res: ServerResponse, deps: RunTranscriptDownloadDeps): Promise<void>;

package/dist/mcp/tools/run-transcript-download.js

@@ -0,0 +1,129 @@
+/**
+ * The download behind `get_run_transcript`'s link: a short-lived signed token
+ * (the MCP server's requestState codec, so HMAC + expiry) that names one run
+ * and the principal it was minted for. Served by both hosts: the HTTP
+ * transport's mounted route (streamable-http.ts) and, on stdio, the
+ * ephemeral loopback server (stdio-link-host.ts).
+ *
+ * The token is a bearer capability. It travels only in the `t` query
+ * parameter; nothing here logs it, and no response or error echoes it.
+ * Every refusal is a fixed code. On download, access is checked again
+ * (canReadRun, as get_run) for the principal in the token, so a link stops
+ * working when that principal loses access.
+ */
+import { createHash } from "node:crypto";
+import { canReadRun } from "./run-access.js";
+import { RUN_TRANSCRIPT_DOWNLOAD_PATH, RUN_TRANSCRIPT_LINK_TTL_MS, TRANSCRIPT_META_HEADER, TRANSCRIPT_SESSION_HEADER, TRANSCRIPT_SHA256_HEADER, } from "../../coding/transcript/download-protocol.js";
+// The route path and headers are shared with `wardby resume` (download-protocol.ts).
+export { RUN_TRANSCRIPT_DOWNLOAD_PATH, RUN_TRANSCRIPT_LINK_TTL_MS, TRANSCRIPT_META_HEADER, TRANSCRIPT_SESSION_HEADER, TRANSCRIPT_SHA256_HEADER, };
+const STATUS = {
+    link_invalid: 403,
+    not_found: 404,
+    transcript_expired: 410,
+    transcript_unavailable: 503,
+    transcript_corrupt: 500,
+};
+function refuse(res, code) {
+    res
+        .writeHead(STATUS[code], {
+        "content-type": "application/json",
+        "cache-control": "no-store",
+        "referrer-policy": "no-referrer",
+    })
+        .end(JSON.stringify({ error: code }));
+}
+function isPayload(value) {
+    const v = value;
+    return (!!v &&
+        v.kind === "run-transcript" &&
+        typeof v.runId === "string" &&
+        typeof v.principalId === "string" &&
+        typeof v.exp === "number" &&
+        (v.aud === "stdio" || v.aud === "http") &&
+        (v.operator === undefined || typeof v.operator === "boolean") &&
+        // The operator flag belongs to stdio only.
+        !(v.aud === "http" && v.operator !== undefined));
+}
+export async function handleRunTranscriptDownload(method, token, res, deps) {
+    if (method !== "GET") {
+        res.writeHead(405, { allow: "GET", "cache-control": "no-store" }).end();
+        return;
+    }
+    const now = (deps.now ?? (() => new Date()))();
+    let payload;
+    try {
+        if (!token)
+            throw new Error("missing");
+        payload = await deps.verify(token);
+    }
+    catch {
+        refuse(res, "link_invalid");
+        return;
+    }
+    if (!isPayload(payload) || payload.aud !== deps.audience || payload.exp <= now.getTime()) {
+        refuse(res, "link_invalid");
+        return;
+    }
+    const run = await deps.db.run.findUnique({
+        where: { id: payload.runId },
+        select: { id: true, agentId: true, triggeredById: true },
+    });
+    if (!run || !(await canReadRun(deps.db, run, { principalId: payload.principalId, operator: payload.operator }))) {
+        refuse(res, "not_found");
+        return;
+    }
+    const [row, codingRun] = await Promise.all([
+        deps.db.runTranscript.findUnique({ where: { runId: run.id } }),
+        deps.db.codingRun.findUnique({
+            where: { runId: run.id },
+            select: { repository: true, headRef: true, resultBranch: true, baseSha: true, provider: true },
+        }),
+    ]);
+    if (!row || !codingRun || row.status !== "stored" || !row.blobKey || !row.sha256 || !row.sessionId) {
+        refuse(res, "not_found");
+        return;
+    }
+    if (row.expiresAt.getTime() <= now.getTime()) {
+        refuse(res, "transcript_expired");
+        return;
+    }
+    if (!deps.blobs) {
+        refuse(res, "transcript_unavailable");
+        return;
+    }
+    let bytes;
+    try {
+        bytes = await deps.blobs.get(row.blobKey);
+    }
+    catch {
+        refuse(res, "transcript_unavailable");
+        return;
+    }
+    // The stored object must still be what was recorded.
+    if (createHash("sha256").update(bytes).digest("hex") !== row.sha256) {
+        refuse(res, "transcript_corrupt");
+        return;
+    }
+    const meta = {
+        runId: run.id,
+        sessionId: row.sessionId,
+        provider: row.provider,
+        repository: codingRun.repository,
+        headRef: codingRun.headRef,
+        resultBranch: codingRun.resultBranch,
+        baseSha: codingRun.baseSha,
+        sha256: row.sha256,
+    };
+    res
+        .writeHead(200, {
+        "content-type": "application/gzip",
+        "content-length": String(bytes.byteLength),
+        "cache-control": "no-store",
+        "referrer-policy": "no-referrer",
+        "x-content-type-options": "nosniff",
+        [TRANSCRIPT_SHA256_HEADER]: row.sha256,
+        [TRANSCRIPT_SESSION_HEADER]: row.sessionId,
+        [TRANSCRIPT_META_HEADER]: Buffer.from(JSON.stringify(meta)).toString("base64url"),
+    })
+        .end(bytes);
+}

package/dist/mcp/tools/run-transcript.d.ts

@@ -0,0 +1,19 @@
+/**
+ * get_run_transcript: the way to continue a coding run's session locally.
+ * The transcript itself never enters the caller's context: the tool returns
+ * a short-lived signed download link and the command that imports it
+ * (`npx @wardby/cli@latest resume -`, which reads the link from standard input). Same access as get_run.
+ */
+import type { WardbyMcpServer } from "../server.js";
+import { type RunTranscriptLinkAudience } from "./run-transcript-download.js";
+/** Builds the download URL for a minted token (HTTP: the canonical origin; stdio: the loopback server). */
+export type RunTranscriptUrlBuilder = (token: string) => Promise<string>;
+export interface RunTranscriptToolOptions {
+    downloadUrl: RunTranscriptUrlBuilder;
+    /** Whether the server has a blob store to serve transcripts from. */
+    blobStoreConfigured: boolean;
+    /** The host that serves the links this server mints (stdio's loopback server, or the HTTP route). */
+    audience: RunTranscriptLinkAudience;
+    now?: () => Date;
+}
+export declare function registerRunTranscriptTool(mcp: WardbyMcpServer, opts: RunTranscriptToolOptions): void;

package/dist/mcp/tools/run-transcript.js

@@ -0,0 +1,70 @@
+import { textResult } from "./text-result.js";
+import { findReadableRun } from "./run-access.js";
+import { RUN_TRANSCRIPT_LINK_TTL_MS, } from "./run-transcript-download.js";
+/** What each status other than `stored` means, for the caller. */
+const MEANINGS = {
+    none: "No transcript was recorded for this run. Turn on codingProfile.sessionResume for the agent; it applies to runs started after that.",
+    too_large: "The run's transcript was larger than RUN_TRANSCRIPT_MAX_BYTES, so it was not stored.",
+    not_captured: "No transcript was stored for this run (see reason): for example the server had no blob store, the run was stopped or timed out, or it never finished a turn.",
+    failed: "Storing this run's transcript failed (see reason). Nothing was stored.",
+    expired: "The transcript was deleted after RUN_TRANSCRIPT_RETENTION_DAYS.",
+    unavailable: "The transcript was stored, but this server has no blob store configured to serve it from.",
+    unsupported: "Resuming this kind of run locally is not supported yet: only Claude Code coding runs can be resumed.",
+};
+function notStored(runId, status, reason) {
+    return textResult({ runId, status, ...(reason ? { reason } : {}), meaning: MEANINGS[status] });
+}
+export function registerRunTranscriptTool(mcp, opts) {
+    mcp.registerTool({
+        name: "get_run_transcript",
+        description: "Get a short-lived download link for a Claude Code coding run's session transcript, and the command that continues the session locally (npx @wardby/cli@latest resume -, which asks for the link). Give the user the command and the link to run in a terminal inside a clone of the run's repository; do not fetch the link yourself. Same access as get_run. The link works for 10 minutes.",
+        scope: "agents:read",
+        inputSchema: { type: "object", properties: { runId: { type: "string" } }, required: ["runId"] },
+        handler: async (args, ctx) => {
+            const run = await findReadableRun(ctx, args.runId);
+            const codingRun = await ctx.db.codingRun.findUnique({
+                where: { runId: run.id },
+                select: { provider: true, repository: true, headRef: true, resultBranch: true, baseSha: true },
+            });
+            if (!codingRun)
+                return notStored(run.id, "unsupported", "not_a_coding_run");
+            if (codingRun.provider !== "claude-code")
+                return notStored(run.id, "unsupported", "provider_unsupported");
+            const row = await ctx.db.runTranscript.findUnique({ where: { runId: run.id } });
+            if (!row)
+                return notStored(run.id, "none");
+            if (row.status !== "stored" || !row.sessionId)
+                return notStored(run.id, row.status, row.reason);
+            const now = (opts.now ?? (() => new Date()))();
+            if (row.expiresAt.getTime() <= now.getTime())
+                return notStored(run.id, "expired");
+            if (!opts.blobStoreConfigured)
+                return notStored(run.id, "unavailable", "no_blob_store");
+            const exp = now.getTime() + RUN_TRANSCRIPT_LINK_TTL_MS;
+            const payload = {
+                kind: "run-transcript",
+                runId: run.id,
+                principalId: ctx.principal.id,
+                aud: opts.audience,
+                ...(ctx.operator && opts.audience === "stdio" ? { operator: true } : {}),
+                exp,
+            };
+            const url = await opts.downloadUrl(await mcp.mintRequestState(payload));
+            const linkExpiresAt = new Date(exp).toISOString();
+            return textResult({
+                runId: run.id,
+                status: "stored",
+                sessionId: row.sessionId,
+                provider: codingRun.provider,
+                repository: codingRun.repository,
+                branch: codingRun.resultBranch ?? codingRun.headRef,
+                baseSha: codingRun.baseSha,
+                sizeBytes: row.sizeBytes,
+                expiresAt: row.expiresAt.toISOString(),
+                download: { url, expiresAt: linkExpiresAt },
+                command: "npx @wardby/cli@latest resume -",
+                note: "Run the command in a terminal, inside a clone of the repository (not needed for a local: repository), and paste download.url when it asks. Reading the link this way keeps it out of shell history and the process list. The link is a credential for this transcript until it expires: do not share it.",
+            });
+        },
+    });
+}

package/dist/mcp/tools/runs.d.ts

@@ -1,8 +1,2 @@
 import type { WardbyMcpServer } from "../server.js";
-/**
- * Run visibility (resource-sharing grants spec §3.5, A6): a run's output is
- * the triggerer's and the agent owner's, never every reader's. The owner
- * (and the stdio operator) sees every run; anyone else only runs with
- * Run.triggeredById equal to themselves.
- */
 export declare function registerRunTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/runs.js

@@ -1,15 +1,22 @@
-import { McpError } from "../errors.js";
-import { agentAccess, requireAgentAccess } from "../auth/access.js";
-import { publicCodingRunResult } from "../../coding/protocol.js";
+import { requireAgentAccess } from "../auth/access.js";
+import { findReadableRun } from "./run-access.js";
+import { publicCodingRunResult, sanitizeDependencyCacheReport } from "../../coding/protocol.js";
 import { countPlanRefusals, summarizeRegistryFetches } from "../../coding/registry/report.js";
+import { summarizePackageAudit } from "../../coding/registry/audit-mode.js";
 import { storedServiceLabels } from "../../coding/services/catalog.js";
 import { textResult } from "./text-result.js";
+import { loadBudgetEvents } from "../../core/budget-events.js";
 /**
  * Run visibility (resource-sharing grants spec §3.5, A6): a run's output is
  * the triggerer's and the agent owner's, never every reader's. The owner
  * (and the stdio operator) sees every run; anyone else only runs with
  * Run.triggeredById equal to themselves.
  */
+/** A run row with its execution mode in the operator spelling agent tools use; null for coding runs. */
+function withOperatorMode(run) {
+    const mode = run.nativeExecutionMode;
+    return { ...run, nativeExecutionMode: mode == null ? null : mode === "sandbox" ? "sandbox" : "control-plane" };
+}
 export function registerRunTools(mcp) {
     mcp.registerTool({
         name: "list_runs",
@@ -42,7 +49,7 @@ export function registerRunTools(mcp) {
             const queuedAtByRun = new Map(queued.map((row) => [row.runId, row.queuedAt?.toISOString()]));
             return textResult(runs.map((run) => {
                 const codingQueuedAt = queuedAtByRun.get(run.id);
-                return codingQueuedAt ? { ...run, codingQueuedAt } : run;
+                return codingQueuedAt ? { ...withOperatorMode(run), codingQueuedAt } : withOperatorMode(run);
             }));
         },
     });
@@ -51,17 +58,9 @@ export function registerRunTools(mcp) {
         scope: "agents:read",
         inputSchema: { type: "object", properties: { runId: { type: "string" } }, required: ["runId"] },
         handler: async (args, ctx) => {
-            const run = await ctx.db.run.findUnique({ where: { id: args.runId } });
-            const notFound = new McpError(404, `Run "${args.runId}" not found.`);
-            if (!run)
-                throw notFound;
             // Its triggerer keeps seeing it even after losing access to the agent;
             // otherwise only the agent's owner. read on the agent is not enough.
-            if (run.triggeredById !== ctx.principal.id) {
-                const agent = await ctx.db.agent.findUnique({ where: { id: run.agentId } });
-                if (!agent || (await agentAccess(ctx, agent)) !== "owner")
-                    throw notFound;
-            }
+            const run = await findReadableRun(ctx, args.runId);
             const codingRun = await ctx.db.codingRun.findUnique({
                 where: { runId: run.id },
                 select: {
@@ -70,9 +69,16 @@ export function registerRunTools(mcp) {
                     failureCategory: true,
                     diagnosticId: true,
                     debugTrace: true,
+                    debugTraceMaxMb: true,
                     services: true,
                     resultBranch: true,
                     baseSha: true,
+                    dependencyCacheResult: true,
+                    prDescriptionOutcome: true,
+                    packageAuditMode: true,
+                    budgetBaseUsd: true,
+                    budgetReservedUsd: true,
+                    budgetLimitUsd: true,
                 },
             });
             const localPr = await ctx.db.localPullRequest.findUnique({
@@ -97,6 +103,12 @@ export function registerRunTools(mcp) {
                     refused: countPlanRefusals(registryFetches),
                 }
                 : undefined;
+            // Package audit mode, fixed at dispatch: what the registry served only
+            // because of it (empty when nothing was), read only for a run that had it.
+            const packageAuditMode = codingRun?.packageAuditMode ?? null;
+            const packageAudit = packageAuditMode
+                ? summarizePackageAudit(await ctx.db.registryAuditRecord.findMany({ where: { runId: run.id }, orderBy: { createdAt: "asc" } })).entries
+                : undefined;
             // A failed coding run's error is only an opaque id; these two say which
             // stage failed and are the key an operator searches the control-plane
             // log for (the real reason is logged there, never persisted). Both are
@@ -105,17 +117,31 @@ export function registerRunTools(mcp) {
             const diagnosticId = codingRun?.diagnosticId ?? undefined;
             // Which services the run started with ("postgres 16"); never their images or environments.
             const services = codingRun ? storedServiceLabels(codingRun.services) : [];
+            // The worker's dependency cache report (stable codes, folder names and numbers only), re-bounded on read.
+            const dependencyCache = codingRun?.dependencyCacheResult !== null && codingRun?.dependencyCacheResult !== undefined
+                ? sanitizeDependencyCacheReport(codingRun.dependencyCacheResult)
+                : undefined;
+            // Well-formed refusals only, with group, lead and agent budget filled as the run error's are.
+            const budgetEvents = await loadBudgetEvents(ctx.db, run.id);
             return textResult({
-                ...run,
+                ...withOperatorMode(run),
+                ...(budgetEvents.length > 0 ? { budgetEvents } : {}),
+                ...(codingRun?.budgetReservedUsd != null ? { budgetReservedUsd: Number(codingRun.budgetReservedUsd) } : {}),
+                ...(codingRun?.budgetBaseUsd != null ? { budgetBaseUsd: Number(codingRun.budgetBaseUsd) } : {}),
+                // The most overrun top-ups may raise budgetReservedUsd to; absent = the reservation is the limit.
+                ...(codingRun?.budgetLimitUsd != null ? { budgetLimitUsd: Number(codingRun.budgetLimitUsd) } : {}),
                 ...(codingResult ? { codingResult } : {}),
                 ...(failureCategory ? { failureCategory } : {}),
                 ...(diagnosticId ? { diagnosticId } : {}),
                 ...(codingQueuedAt ? { codingQueuedAt } : {}),
                 // An admin turned on the debug trace: the worker's full trace is in its pod log.
                 ...(codingRun?.debugTrace ? { debugTrace: true } : {}),
+                ...(codingRun?.debugTrace && codingRun.debugTraceMaxMb ? { debugTraceMaxMb: codingRun.debugTraceMaxMb } : {}),
                 ...(services.length > 0 ? { services } : {}),
                 ...(codingRun?.resultBranch ? { resultBranch: codingRun.resultBranch } : {}),
                 ...(codingRun?.baseSha ? { baseSha: codingRun.baseSha } : {}),
+                ...(dependencyCache ? { dependencyCache } : {}),
+                ...(codingRun?.prDescriptionOutcome ? { prDescriptionOutcome: codingRun.prDescriptionOutcome } : {}),
                 ...(localPr
                     ? {
                         review: {
@@ -132,6 +158,7 @@ export function registerRunTools(mcp) {
                     }
                     : {}),
                 ...(codingRun ? { packages, packageRefusals, packagePlan } : {}),
+                ...(packageAuditMode ? { packageAuditMode, packageAudit } : {}),
             });
         },
     });

package/dist/mcp/tools/scheduling.js

@@ -1,5 +1,6 @@
 import { Prisma } from "#prisma";
 import { validateCronExpression } from "../../core/cron.js";
+import { scheduleStartFields } from "../../core/schedule-start.js";
 import { McpError } from "../errors.js";
 import { assertAgentAccess, requireAgentAccess } from "../auth/access.js";
 import { textResult } from "./text-result.js";
@@ -24,9 +25,10 @@ export function registerSchedulingTools(mcp) {
                 if (existing.kind === "coding" && !existing.codingProfile?.defaultTask) {
                     throw new McpError(400, "A default task is required before enabling a coding-agent schedule.");
                 }
+                const next = { schedule: args.schedule, timezone: args.timezone, scheduleEnabled: true };
                 return tx.agent.update({
                     where: { id: args.agentId },
-                    data: { schedule: args.schedule, timezone: args.timezone, scheduleEnabled: true },
+                    data: { ...next, ...(await scheduleStartFields(tx, existing, next)) },
                 });
             }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });
             return textResult(agent);

package/dist/mcp/tools/secret-broker-compat.d.ts

@@ -0,0 +1,12 @@
+/**
+ * A static, best-effort check: a tool granted a brokered secret that still reads secrets with
+ * secrets.get() will fail at run time. Warns; never blocks (the scan can't see dynamic code).
+ */
+export declare function toolCallsSecretsGet(code: string): boolean;
+export declare function brokerCompatibilityWarnings(tools: readonly {
+    name: string;
+    code: string;
+    allowedSecrets: readonly string[];
+}[], brokeredNames: ReadonlySet<string>): string[];
+/** An attachment's `allowedSecrets` JSON column as names (anything else is ignored). */
+export declare function allowedSecretNames(json: unknown): string[];

package/dist/mcp/tools/secret-broker-compat.js

@@ -0,0 +1,23 @@
+/**
+ * A static, best-effort check: a tool granted a brokered secret that still reads secrets with
+ * secrets.get() will fail at run time. Warns; never blocks (the scan can't see dynamic code).
+ */
+export function toolCallsSecretsGet(code) {
+    return /\bsecrets\s*\.\s*get\s*\(/.test(code);
+}
+export function brokerCompatibilityWarnings(tools, brokeredNames) {
+    const warnings = [];
+    for (const tool of tools) {
+        const brokered = tool.allowedSecrets.filter((s) => brokeredNames.has(s));
+        if (!brokered.length || !toolCallsSecretsGet(tool.code))
+            continue;
+        const list = brokered.map((s) => `"${s}"`).join(", ");
+        const example = JSON.stringify(brokered);
+        warnings.push(`Tool "${tool.name}" reads secrets with secrets.get(), but ${list} ${brokered.length > 1 ? "are" : "is"} brokered: that call will fail with secret_brokered. Update the tool to send it with fetch(url, { secrets: ${example} }).`);
+    }
+    return warnings;
+}
+/** An attachment's `allowedSecrets` JSON column as names (anything else is ignored). */
+export function allowedSecretNames(json) {
+    return Array.isArray(json) ? json.filter((s) => typeof s === "string") : [];
+}

package/dist/mcp/tools/secret-elicitation-form.d.ts

@@ -2,15 +2,26 @@
  * The one-time browser form a secret-elicitation URL points to — shared by
  * both hosts: stdio's ephemeral loopback server (secret-elicitation-server.ts)
  * and the HTTP transport's mounted route (wired in streamable-http.ts). No
- * JavaScript: a plain HTML form POST is enough for one password field, so
+ * JavaScript: a plain HTML form POST is enough for one password field (plus
+ * the optional broker fields, shown and hidden by a CSS `:checked` rule), so
  * CSP can forbid scripts outright rather than needing a nonce.
+ *
+ * Two pages share the route, chosen by the signed payload's `kind`: "create"
+ * (enter a value, optionally brokered) and "unbroker" (a person confirms
+ * removing a secret's broker config by typing its name). An unbroker link
+ * never shows or accepts a value.
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { PrismaClient } from "#prisma";
 import type { SecretCipher } from "../../providers/secrets/types.js";
 import { type SecretElicitationPayload } from "./secret-elicitation.js";
+import { type SecretBrokerConfig } from "../../core/secret-broker-config.js";
 /** The HTTP-transport route path this form is mounted at (see streamable-http.ts). */
 export declare const SECRET_ELICITATION_PATH = "/elicit/secret";
+/** The "Brokered (recommended)" checkbox, warning, compatibility note, and broker fields, pre-filled from `prefill`. */
+export declare function brokerFieldset(prefill?: SecretBrokerConfig): string;
+/** The form's broker config: null when the box is unchecked; throws secret_broker_config_invalid when it doesn't validate. */
+export declare function brokerConfigFromForm(body: URLSearchParams): SecretBrokerConfig | null;
 export interface SecretFormDeps {
     verify: (token: string) => Promise<SecretElicitationPayload>;
     secrets: SecretCipher;
@@ -18,5 +29,14 @@ export interface SecretFormDeps {
 }
 /** Handles one GET (render) or POST (submit) for the secret-entry form at the given token. */
 export declare function handleSecretElicitationForm(method: string | undefined, token: string | null, readFormBody: () => Promise<URLSearchParams>, res: ServerResponse, deps: SecretFormDeps): Promise<void>;
-/** Reads a small `application/x-www-form-urlencoded` body (8 KiB cap — a secret value, nothing more). */
+/**
+ * The largest form body accepted: room for the largest valid AWS SigV4 value
+ * (an 8 KiB session token, up to 3x after URL encoding) plus the broker fields.
+ */
+export declare const FORM_BODY_LIMIT: number;
+/**
+ * Reads a small `application/x-www-form-urlencoded` body. Over FORM_BODY_LIMIT it
+ * rejects with `body_too_large` and discards the rest of the upload, so the
+ * handler can still answer 413 on the same connection.
+ */
 export declare function readFormBody(req: IncomingMessage): Promise<URLSearchParams>;