@wardby/cli 0.6.0 → 0.7.0

package/dist/mcp/tools/agents.js

@@ -8,24 +8,37 @@
 import { Prisma } from "#prisma";
 import { z } from "zod";
 import { CodingProfilePatchSchema, CodingProfileSchema } from "../../coding/profile.js";
-import { DEFAULT_CLAUDE_MAX_TURNS, MAX_CODING_TURNS, isLocalRepository } from "../../coding/protocol.js";
+import { DEFAULT_CLAUDE_MAX_OUTPUT_TOKENS, DEFAULT_CLAUDE_MAX_TURNS, MAX_CLAUDE_MAX_OUTPUT_TOKENS, MIN_CLAUDE_MAX_OUTPUT_TOKENS, DEFAULT_DEBUG_TRACE_MAX_MB, MAX_CODING_TURNS, MAX_DEBUG_TRACE_MAX_MB, isLocalRepository, } from "../../coding/protocol.js";
+import { loadBlobStoreConfig, loadContainerExecutorConfig } from "../../config/providers.js";
 import { codingProviderSupportsModel } from "../../coding/provider.js";
+import { ACCEPTED_ADVISORY_ID, MAX_ACCEPTED_ADVISORIES } from "../../coding/registry/allowlist.js";
+import { DEFAULT_PACKAGE_AUDIT_MINUTES, isPackageAuditActive, isPackageAuditMode, MAX_PACKAGE_AUDIT_MINUTES, PACKAGE_AUDIT_MODES, PackageAuditPatchError, packageAuditActiveWarning, resolvePackageAuditPatch, } from "../../coding/registry/audit-mode.js";
 import { assertAgentModelAvailable } from "../../core/run-pricing.js";
 import { ModelUnavailableError } from "../../providers/llm/catalog-types.js";
 import { currentModelCatalog } from "../../providers/llm/catalog-store.js";
 import { validateCronExpression } from "../../core/cron.js";
+import { scheduleStartFields } from "../../core/schedule-start.js";
 import { modelSupportedEfforts } from "../../providers/llm/routing.js";
 import { PROJECT_KEY } from "../../providers/issue-tracker/types.js";
 import { LLM_EFFORT_LEVELS, isLlmEffort } from "../../providers/llm/types.js";
 import { requireReadableBudgetGroup } from "../auth/ownership.js";
 import { agentAccessResolver, agentNotFound, assertAgentAccess, readableAgentsWhere, requireAgentAccess, } from "../auth/access.js";
-import { EVERYONE_KEY, atLeast, canDelegate, deleteGrantsFor, effectiveAccess } from "../../core/grants.js";
+import { EVERYONE_KEY, atLeast, canDelegate, deleteGrantsFor, effectiveAccess, isPublicWritable, } from "../../core/grants.js";
 import { projectTool } from "./tools.js";
+import { withZod3ToolWarnings } from "../../core/zod3-window.js";
 import { requireAnyScope, requireScope } from "../auth/resource-server.js";
 import { logger } from "../../core/logger.js";
 import { authorizeRepositoryForSet, canonicalLocalRepository, } from "../auth/repo-authorization.js";
 import { McpError } from "../errors.js";
 import { textResult } from "./text-result.js";
+function validateWorkspaceDiskMb(workspaceDiskMb) {
+    if (workspaceDiskMb == null)
+        return;
+    const { maxDiskMb } = loadContainerExecutorConfig();
+    if (workspaceDiskMb > maxDiskMb) {
+        throw new McpError(400, `workspaceDiskMb (${workspaceDiskMb} MiB) exceeds the deployment cap (${maxDiskMb} MiB). Raise CODING_MAX_DISK_MB to allow this size.`);
+    }
+}
 // workerImageRef is the BYO-arbitrary-image escape hatch (see
 // resolveCodingWorkerImage/resolveCodingToolImage in container.ts). For a Codex agent it
 // replaces the one container that runs the whole agent; for a Claude Code agent it replaces
@@ -67,12 +80,53 @@ function withOperatorMode(agent) {
         nativeExecutionMode: agent.kind !== "native" ? null : agent.nativeExecutionMode === "sandbox" ? "sandbox" : "control-plane",
     };
 }
+/** The warning create_agent / update_agent return (not a refusal): wardby can't tell how old a custom image is. */
+export const DEPENDENCY_CACHE_IMAGE_WARNING = "dependencyCache is on and this agent runs its own worker image (workerImageRef): rebuild that image FROM the wardby release that includes the dependency cache before its next run, or the run fails at input (worker_input_failed). See the dependency-cache help article.";
+export const SESSION_RESUME_IMAGE_WARNING = "sessionResume is on and this agent runs its own worker image (workerImageRef): rebuild that image FROM the wardby release that includes session resume before its next run, or the run fails at input (worker_input_failed).";
+export const SESSION_RESUME_NO_STORE_WARNING = "sessionResume is on but this server has no blob store (BLOB_STORE), so transcripts are not kept. See the resume-runs-locally help article.";
+/** For a warning only: a half-set BLOB_STORE (which throws) counts as none, and never fails the tool call. */
+function blobStoreConfigured() {
+    try {
+        return loadBlobStoreConfig(process.env) !== undefined;
+    }
+    catch {
+        return false;
+    }
+}
+/** Non-blocking warnings about an agent's coding profile as stored. */
+function profileWarnings(profile, now) {
+    const warnings = profile?.dependencyCache && profile.workerImageRef ? [DEPENDENCY_CACHE_IMAGE_WARNING] : [];
+    if (profile?.sessionResume && profile.workerImageRef)
+        warnings.push(SESSION_RESUME_IMAGE_WARNING);
+    if (profile?.sessionResume && !blobStoreConfigured())
+        warnings.push(SESSION_RESUME_NO_STORE_WARNING);
+    if (profile && isPackageAuditActive(profile.packageAuditMode, profile.packageAuditUntil, now))
+        warnings.push(packageAuditActiveWarning(profile.packageAuditMode, profile.packageAuditUntil));
+    return warnings;
+}
+/** An agent as returned to operators: profile warnings, and whether package audit mode is in force now. */
+function withProfileWarnings(agent) {
+    const now = new Date();
+    const profile = agent.codingProfile;
+    const shown = profile
+        ? {
+            ...agent,
+            codingProfile: {
+                ...profile,
+                packageAuditActive: isPackageAuditActive(profile.packageAuditMode, profile.packageAuditUntil, now),
+            },
+        }
+        : agent;
+    const warnings = profileWarnings(profile, now);
+    return warnings.length ? { ...shown, warnings } : shown;
+}
 const agentFields = {
     name: z.string().trim().min(1).max(MAX_AGENT_NAME_CHARS),
     systemPrompt: z.string().min(1).max(MAX_SYSTEM_PROMPT_CHARS),
     model: z.string().trim().min(1).max(MAX_MODEL_CHARS),
     budgetUsd: z.number().finite().positive().max(MAX_BUDGET_USD),
     maxTurns: z.number().int().min(1).max(100),
+    allowedOverrunPercent: z.number().int().min(0).max(100),
     maxDelegationsPerRun: z.number().int().min(1).max(MAX_DELEGATIONS_PER_RUN),
     parallelDelegations: z.boolean(),
     schedule: z.string().trim().min(1).max(256),
@@ -107,6 +161,7 @@ const CreateAgentSchema = z
     model: agentFields.model,
     budgetUsd: agentFields.budgetUsd,
     maxTurns: agentFields.maxTurns.optional(),
+    allowedOverrunPercent: agentFields.allowedOverrunPercent.optional(),
     maxDelegationsPerRun: agentFields.maxDelegationsPerRun.optional(),
     parallelDelegations: agentFields.parallelDelegations.optional(),
     schedule: agentFields.schedule.optional(),
@@ -164,6 +219,7 @@ const UpdateAgentSchema = z
     model: agentFields.model.optional(),
     budgetUsd: agentFields.budgetUsd.optional(),
     maxTurns: agentFields.maxTurns.optional(),
+    allowedOverrunPercent: agentFields.allowedOverrunPercent.optional(),
     maxDelegationsPerRun: agentFields.maxDelegationsPerRun.optional(),
     parallelDelegations: agentFields.parallelDelegations.optional(),
     schedule: agentFields.schedule.nullable().optional(),
@@ -179,6 +235,12 @@ const UpdateAgentSchema = z
     codingProfile: CodingProfilePatchSchema.extend({
         /** Not a stored profile field: sets CodingAgentProfile.debugTraceUntil = now + minutes (null clears). */
         debugTraceMinutes: z.number().int().min(1).max(MAX_DEBUG_TRACE_MINUTES).nullable().optional(),
+        /** Admin-only like debugTraceMinutes: CodingAgentProfile.debugTraceMaxMb (null = the default). */
+        debugTraceMaxMb: z.number().int().min(1).max(MAX_DEBUG_TRACE_MAX_MB).nullable().optional(),
+        /** Not stored as given: sets CodingAgentProfile.packageAuditMode and packageAuditUntil (null clears both). */
+        packageAuditMode: z.enum(PACKAGE_AUDIT_MODES).nullable().optional(),
+        /** Not a stored field: the audit window, in minutes from now (default 24 hours). */
+        packageAuditMinutes: z.number().int().min(1).max(MAX_PACKAGE_AUDIT_MINUTES).optional(),
     }).optional(),
     repositoryAdminOverride: z.boolean().optional(),
 })
@@ -242,6 +304,12 @@ const profileJsonSchema = {
             maximum: MAX_CODING_TURNS,
             description: `Claude Code runs only: the most agent turns (model calls) a run may take before it stops with coding_turn_limit. Null uses the worker default (${DEFAULT_CLAUDE_MAX_TURNS}). The run's budget and timeout still apply. Codex runs have no turn limit.`,
         },
+        maxOutputTokens: {
+            type: ["integer", "null"],
+            minimum: MIN_CLAUDE_MAX_OUTPUT_TOKENS,
+            maximum: MAX_CLAUDE_MAX_OUTPUT_TOKENS,
+            description: `Claude Code runs only: the most output tokens per model reply (default ${DEFAULT_CLAUDE_MAX_OUTPUT_TOKENS}, up to ${MAX_CLAUDE_MAX_OUTPUT_TOKENS}). The coding proxy reserves this × the model's output price per request against the run budget, so higher values need a larger budgetUsd. Refused on a Codex agent. Null uses the default.`,
+        },
         repoSkills: {
             type: "boolean",
             description: "Load the repository's agent skills into runs (Codex: .agents/skills and .codex/skills; Claude Code: .claude/skills). Default true. Repository instructions (AGENTS.md for Codex, CLAUDE.md for Claude Code) load either way.",
@@ -250,6 +318,14 @@ const profileJsonSchema = {
             type: "boolean",
             description: "Claude Code runs only. Default true: Claude Code runs in bare mode and wardby adds the repository's CLAUDE.md and its skill list to the system prompt; the model reads a skill's SKILL.md with run_command. False: bare mode is off and Claude Code loads CLAUDE.md and skills itself (native Skill tool). Repository settings, hooks, and MCP config are never loaded either way.",
         },
+        dependencyCache: {
+            type: "boolean",
+            description: "Restore npm node_modules from a snapshot the proxy re-approves; needs package approval (packages:approve or agents:admin). Default false. The worker images must be a release that includes the cache; with a workerImageRef the result carries a warning to rebuild that image from it.",
+        },
+        sessionResume: {
+            type: "boolean",
+            description: "Claude Code runs only. Keep each run's session transcript (redacted) on the server so the session can later be continued in a local Claude Code CLI. Once transcripts are served, anyone who can read a run can read everything its agent saw. Needs a blob store (BLOB_STORE) on the server. Default false.",
+        },
         packageAllowlist: {
             type: "object",
             description: "Approved top-level packages per ecosystem (npm, pypi). A PyPI entry may name extras, e.g. psycopg[binary]. Needs packages:approve or agents:admin.",
@@ -257,7 +333,16 @@ const profileJsonSchema = {
         },
         packagePolicy: {
             type: "object",
-            properties: { minReleaseAgeDays: { type: "integer", minimum: 0, maximum: 30 } },
+            description: "minReleaseAgeDays: days a release must have been public before it can be installed (0-30, default 3). acceptedAdvisories: advisory ids (GHSA-…, CVE-…) this agent's runs may install despite; malware never; every waiver is reported in the PR. Needs packages:approve or agents:admin.",
+            properties: {
+                minReleaseAgeDays: { type: "integer", minimum: 0, maximum: 30 },
+                acceptedAdvisories: {
+                    type: "array",
+                    maxItems: MAX_ACCEPTED_ADVISORIES,
+                    uniqueItems: true,
+                    items: { type: "string", pattern: ACCEPTED_ADVISORY_ID.source },
+                },
+            },
             additionalProperties: false,
         },
         services: {
@@ -363,11 +448,14 @@ function storedProfile(profile) {
         workerImageRef: profile.workerImageRef,
         workspaceDiskMb: profile.workspaceDiskMb,
         maxTurns: profile.maxTurns,
+        maxOutputTokens: profile.maxOutputTokens,
         packageAllowlist: profile.packageAllowlist,
         packagePolicy: profile.packagePolicy,
         services: profile.services,
         repoSkills: profile.repoSkills,
         claudeBareMode: profile.claudeBareMode,
+        dependencyCache: profile.dependencyCache,
+        sessionResume: profile.sessionResume,
     });
 }
 /** A service name an agent is allowed must exist in the catalog (any version); typos fail here, not at a run. */
@@ -393,6 +481,12 @@ export function registerAgentTools(mcp) {
                 model: { type: "string" },
                 budgetUsd: { type: "number" },
                 maxTurns: { type: "integer" },
+                allowedOverrunPercent: {
+                    type: "integer",
+                    minimum: 0,
+                    maximum: 100,
+                    description: "Percent above budgetUsd a run may spend before it is stopped. On a coding agent it raises each of its runs' limit; on a lead agent that delegates, it raises its run tree's ceiling for coding sub-agents. Native runs' own model calls are not affected. Budget group caps still apply. 0 = stop at budgetUsd.",
+                },
                 maxDelegationsPerRun: {
                     type: "integer",
                     minimum: 1,
@@ -431,12 +525,14 @@ export function registerAgentTools(mcp) {
             const packages = args.codingProfile;
             if (packages &&
                 (Object.keys(packages.packageAllowlist ?? {}).length > 0 ||
-                    Object.keys(packages.packagePolicy ?? {}).length > 0))
+                    Object.keys(packages.packagePolicy ?? {}).length > 0 ||
+                    packages.dependencyCache === true))
                 requirePackageApproval(ctx);
             validateSchedule(args.schedule, args.timezone ?? "UTC");
             requireModelAvailable(ctx, args.model, args.kind);
             validateEffort(args.kind, args.model, args.effort);
             validateNativeExecutionMode(ctx, args.kind, args.nativeExecutionMode);
+            validateWorkspaceDiskMb(args.codingProfile?.workspaceDiskMb);
             if (args.codingProfile)
                 await requireCatalogServiceNames(ctx.db, args.codingProfile.services);
             if (args.budgetGroupId) {
@@ -463,6 +559,11 @@ export function registerAgentTools(mcp) {
             const agent = await ctx.db.agent.create({
                 data: {
                     ...agentData,
+                    ...(await scheduleStartFields(ctx.db, null, {
+                        schedule: agentData.schedule ?? null,
+                        timezone: agentData.timezone ?? "UTC",
+                        scheduleEnabled: agentData.scheduleEnabled ?? true,
+                    })),
                     ownerId: ctx.principal.id,
                     ...(codingProfile && authorization
                         ? { codingProfile: { create: { ...codingProfile, ...profileStamp(authorization) } } }
@@ -470,7 +571,7 @@ export function registerAgentTools(mcp) {
                 },
                 include: { codingProfile: true },
             });
-            return textResult(withOperatorMode(agent));
+            return textResult(withProfileWarnings(withOperatorMode(agent)));
         },
     });
     mcp.registerTool({
@@ -486,6 +587,12 @@ export function registerAgentTools(mcp) {
                 model: { type: "string" },
                 budgetUsd: { type: "number" },
                 maxTurns: { type: "integer" },
+                allowedOverrunPercent: {
+                    type: "integer",
+                    minimum: 0,
+                    maximum: 100,
+                    description: "Percent above budgetUsd a run may spend before it is stopped. On a coding agent it raises each of its runs' limit; on a lead agent that delegates, it raises its run tree's ceiling for coding sub-agents. Native runs' own model calls are not affected. Budget group caps still apply. 0 = stop at budgetUsd.",
+                },
                 maxDelegationsPerRun: {
                     type: "integer",
                     minimum: 1,
@@ -531,6 +638,27 @@ export function registerAgentTools(mcp) {
                             maximum: MAX_DEBUG_TRACE_MINUTES,
                             description: "Admins only (agents:admin): trace every coding run of this agent for this many minutes from now; the worker writes its full stream trace, which can include prompts and repository content, to the run pod's log. Null turns it off.",
                         },
+                        debugTraceMaxMb: {
+                            type: ["integer", "null"],
+                            minimum: 1,
+                            maximum: MAX_DEBUG_TRACE_MAX_MB,
+                            description: `Admins only (agents:admin): cap on one traced run's trace output, in MiB (default ${DEFAULT_DEBUG_TRACE_MAX_MB}); the trace stops with a limit_reached line once it is reached. Null restores the default.`,
+                        },
+                        packageAuditMode: {
+                            type: ["string", "null"],
+                            enum: [...PACKAGE_AUDIT_MODES, null],
+                            description: "Package audit mode, for a limited time (packageAuditMinutes). Needs packages:approve or agents:admin, and only the agent's owner may set it. " +
+                                '"audit": the registry installs packages outside this agent\'s allowlist instead of refusing them, and records each one; ' +
+                                '"full": also installs versions withheld only by high or critical advisories. Malware is refused and the release-age limit enforced in every mode. ' +
+                                "This weakens the supply-chain guard while it is on: use it to find out which packages a task needs, then add them to packageAllowlist. " +
+                                "Fixed per run when the run is dispatched. Null turns it off.",
+                        },
+                        packageAuditMinutes: {
+                            type: "integer",
+                            minimum: 1,
+                            maximum: MAX_PACKAGE_AUDIT_MINUTES,
+                            description: `How long package audit mode stays on, in minutes from now (default ${DEFAULT_PACKAGE_AUDIT_MINUTES}, at most ${MAX_PACKAGE_AUDIT_MINUTES}: 7 days). Given alone, it re-arms the stored mode. Needs packages:approve or agents:admin.`,
+                        },
                     },
                 },
                 repositoryAdminOverride: REPOSITORY_ADMIN_OVERRIDE,
@@ -542,9 +670,18 @@ export function registerAgentTools(mcp) {
             if (args.codingProfile?.workerImageRef !== undefined)
                 requireWorkerImageRefScope(ctx);
             const debugTraceMinutes = args.codingProfile?.debugTraceMinutes;
-            if (debugTraceMinutes !== undefined)
+            const debugTraceMaxMb = args.codingProfile?.debugTraceMaxMb;
+            if (debugTraceMinutes !== undefined || debugTraceMaxMb !== undefined)
                 requireDebugTraceScope(ctx);
-            if (args.codingProfile?.packageAllowlist !== undefined || args.codingProfile?.packagePolicy !== undefined)
+            const auditPatch = {
+                packageAuditMode: args.codingProfile?.packageAuditMode,
+                packageAuditMinutes: args.codingProfile?.packageAuditMinutes,
+            };
+            if (args.codingProfile?.packageAllowlist !== undefined ||
+                args.codingProfile?.packagePolicy !== undefined ||
+                args.codingProfile?.dependencyCache !== undefined ||
+                auditPatch.packageAuditMode !== undefined ||
+                auditPatch.packageAuditMinutes !== undefined)
                 requirePackageApproval(ctx);
             // Repository authorization calls GitHub, so it runs before (outside) the
             // serializable transaction, on a pre-read; the transaction then verifies
@@ -615,6 +752,7 @@ export function registerAgentTools(mcp) {
                 : debugTraceMinutes === null
                     ? null
                     : new Date(Date.now() + debugTraceMinutes * 60_000);
+            let auditSet;
             const agent = await ctx.db.$transaction(async (tx) => {
                 const existing = await tx.agent.findUnique({ where: { id: args.id }, include: { codingProfile: true } });
                 if (!existing)
@@ -636,6 +774,12 @@ export function registerAgentTools(mcp) {
                     await requireReadableBudgetGroup(tx, args.budgetGroupId, ctx.principal.id);
                 }
                 const nextKind = args.kind ?? existing.kind;
+                // A coding repository is an owner binding (agentOwnerBindings): an
+                // agent everyone can write never gets one, as attach_* refuse theirs.
+                if (((nextKind === "coding" && existing.kind !== "coding") || repositoryChanges(existing)) &&
+                    (await isPublicWritable(tx, existing.id))) {
+                    throw new McpError(409, `Agent "${args.id}" is writable by everyone, so it can't become a coding agent or get a repository; revoke or lower the everyone grant first.`);
+                }
                 if (nextKind === "native" && args.codingProfile) {
                     throw new McpError(400, "A coding profile is only valid for coding agents.");
                 }
@@ -659,11 +803,14 @@ export function registerAgentTools(mcp) {
                         throw new McpError(400, "Detach all native sandbox tools before changing an agent to coding.");
                     }
                     const currentProfile = existing.codingProfile ? storedProfile(existing.codingProfile) : undefined;
-                    const { debugTraceMinutes: _minutes, ...profilePatch } = args.codingProfile ?? {};
+                    const { debugTraceMinutes: _minutes, debugTraceMaxMb: _maxMb, packageAuditMode: _auditMode, packageAuditMinutes: _auditMinutes, ...profilePatch } = args.codingProfile ?? {};
                     const profileResult = CodingProfileSchema.safeParse({ ...currentProfile, ...profilePatch });
                     if (!profileResult.success)
                         throw invalidArguments("coding profile", profileResult.error);
                     nextProfile = profileResult.data;
+                    if (typeof args.codingProfile?.workspaceDiskMb === "number" || nextKind !== existing.kind) {
+                        validateWorkspaceDiskMb(nextProfile.workspaceDiskMb);
+                    }
                     if (args.codingProfile?.services !== undefined)
                         await requireCatalogServiceNames(tx, nextProfile.services);
                     const nextModel = args.model ?? existing.model;
@@ -674,6 +821,19 @@ export function registerAgentTools(mcp) {
                         throw new McpError(400, `Model "${nextModel}" is not supported by coding provider "${nextProfile.provider}".`);
                     }
                 }
+                // Package audit mode: resolved against the stored mode inside the
+                // transaction, so minutes alone re-arm what is stored now.
+                let audit;
+                try {
+                    const storedMode = existing.codingProfile?.packageAuditMode;
+                    audit = resolvePackageAuditPatch({ mode: isPackageAuditMode(storedMode) ? storedMode : null }, auditPatch, new Date());
+                }
+                catch (error) {
+                    if (error instanceof PackageAuditPatchError)
+                        throw new McpError(400, error.message);
+                    throw error;
+                }
+                auditSet = audit;
                 const nextSchedule = args.schedule !== undefined ? args.schedule : existing.schedule;
                 const nextTimezone = args.timezone ?? existing.timezone;
                 const nextScheduleEnabled = args.scheduleEnabled ?? existing.scheduleEnabled;
@@ -687,7 +847,11 @@ export function registerAgentTools(mcp) {
                     ...(modeArg ? { nativeExecutionMode: toStoredMode(modeArg) } : {}),
                 };
                 const stamp = authorization ? profileStamp(authorization) : {};
-                const trace = debugTraceUntil === undefined ? {} : { debugTraceUntil };
+                const trace = {
+                    ...(debugTraceUntil === undefined ? {} : { debugTraceUntil }),
+                    ...(debugTraceMaxMb === undefined ? {} : { debugTraceMaxMb }),
+                    ...(audit === undefined ? {} : { packageAuditMode: audit.mode, packageAuditUntil: audit.until }),
+                };
                 const profileMutation = nextKind === "native"
                     ? existing.codingProfile
                         ? { delete: true }
@@ -695,29 +859,46 @@ export function registerAgentTools(mcp) {
                     : existing.codingProfile
                         ? { update: { ...nextProfile, ...stamp, ...trace } }
                         : { create: { ...nextProfile, ...stamp, ...trace } };
+                const scheduleStart = await scheduleStartFields(tx, existing, {
+                    schedule: nextSchedule,
+                    timezone: nextTimezone,
+                    scheduleEnabled: nextScheduleEnabled,
+                });
                 return tx.agent.update({
                     where: { id },
                     data: {
                         ...updates,
+                        ...scheduleStart,
                         ...(profileMutation ? { codingProfile: profileMutation } : {}),
                     },
                     include: { codingProfile: true },
                 });
             }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });
-            if (debugTraceUntil !== undefined) {
+            if (debugTraceUntil !== undefined || debugTraceMaxMb !== undefined) {
                 agentsLog.info({
                     event: "coding.debug_trace.set",
                     agentId: agent.id,
-                    until: debugTraceUntil?.toISOString() ?? null,
+                    ...(debugTraceUntil !== undefined ? { until: debugTraceUntil?.toISOString() ?? null } : {}),
+                    ...(debugTraceMaxMb !== undefined ? { maxMb: debugTraceMaxMb } : {}),
                     by: ctx.principal.id,
                 }, "coding debug trace set");
             }
-            return textResult(withOperatorMode(agent));
+            if (auditSet !== undefined) {
+                agentsLog.info({
+                    event: "coding.package_audit.set",
+                    agentId: agent.id,
+                    mode: auditSet.mode,
+                    until: auditSet.until?.toISOString() ?? null,
+                    by: ctx.principal.id,
+                }, "coding package audit mode set");
+            }
+            return textResult(withProfileWarnings(withOperatorMode(agent)));
         },
     });
     mcp.registerTool({
         name: "list_agents",
         scope: "agents:read",
+        description: "Lists the agents you can see. Each row has an `access` field, your level on that agent: owner > write > execute > read. When showing the agents as a table, include `access` as a column.",
         inputSchema: { type: "object", properties: {}, additionalProperties: false },
         handler: async (_args, ctx) => {
             const [where, accessOf] = await Promise.all([readableAgentsWhere(ctx), agentAccessResolver(ctx)]);
@@ -742,12 +923,13 @@ export function registerAgentTools(mcp) {
             // A7: a tool's code and schema are its owner's, whoever can read the
             // agent (the agent's owner included). Capabilities stay visible: config.
             return textResult({
-                ...withOperatorMode(agent),
+                ...withProfileWarnings(withOperatorMode(agent)),
                 access,
-                tools: agent.tools.map((attachment) => ({
+                // Zod 3 window: the caller's own tools carry their warnings (see core/zod3-window.ts).
+                tools: await Promise.all(agent.tools.map(async (attachment) => ({
                     ...attachment,
-                    tool: projectTool(attachment.tool, ctx.principal.id),
-                })),
+                    tool: await withZod3ToolWarnings(projectTool(attachment.tool, ctx.principal.id)),
+                }))),
             });
         },
     });

package/dist/mcp/tools/datastore.js

@@ -1,9 +1,10 @@
 import { Prisma } from "#prisma";
 import { requireOwnedDatastore, canRead, assertCanMutate } from "../auth/ownership.js";
-import { requireAgentAccess, requireBindingOwner } from "../auth/access.js";
+import { requireAgentAccess, requireBindable, requireBindingOwner } from "../auth/access.js";
 import { createDatastore, listDatastores, deleteDatastore, attachDatastore, detachDatastore, buildSharedDatastoreAccessor, } from "../../core/datastores.js";
 import { McpError } from "../errors.js";
 import { textResult } from "./text-result.js";
+import { SecretInValueError, SecretCheckUnavailableError } from "../../core/secret-guard.js";
 /**
  * A `boundName` names an *attachment* (agentId, boundName) -> Datastore.
  * Agent data (the private store and bound stores) is owner-only (resource-
@@ -99,7 +100,7 @@ export function registerDatastoreTools(mcp) {
             // read it: strictly the agent owner's own datastore on the owner's
             // own agent (A2/S2-2). Not even the stdio operator crosses owners.
             const { agent } = await requireAgentAccess(ctx, args.agentId, "read");
-            requireBindingOwner(ctx, agent);
+            await requireBindable(ctx, agent);
             const datastore = await requireOwnedDatastore(ctx.db, args.datastoreId, ctx.principal.id);
             if (datastore.ownerId !== agent.ownerId) {
                 throw new McpError(403, "Only a datastore owned by the agent's owner can be attached to it.");
@@ -191,14 +192,22 @@ export function registerDatastoreTools(mcp) {
         },
         handler: async (args, ctx) => {
             await requireAgentAccess(ctx, args.agentId, "owner");
-            if (args.boundName) {
-                await requireMutableSharedDatastore(ctx.db, args.agentId, args.boundName, ctx.principal.id);
-                const accessor = buildSharedDatastoreAccessor(args.agentId, ctx.providers.datastore, ctx.db);
-                await accessor.set(args.boundName, args.key, args.value, { pii: args.pii });
+            try {
+                if (args.boundName) {
+                    await requireMutableSharedDatastore(ctx.db, args.agentId, args.boundName, ctx.principal.id);
+                    const accessor = buildSharedDatastoreAccessor(args.agentId, ctx.providers.datastore, ctx.db);
+                    await accessor.set(args.boundName, args.key, args.value, { pii: args.pii });
+                    return textResult({ ok: true });
+                }
+                await ctx.providers.datastore.set(args.agentId, args.key, args.value, { pii: args.pii });
                 return textResult({ ok: true });
             }
-            await ctx.providers.datastore.set(args.agentId, args.key, args.value, { pii: args.pii });
-            return textResult({ ok: true });
+            catch (err) {
+                if (err instanceof SecretInValueError || err instanceof SecretCheckUnavailableError) {
+                    throw new McpError(400, err.message);
+                }
+                throw err;
+            }
         },
     });
     mcp.registerTool({

package/dist/mcp/tools/grants.js

@@ -12,7 +12,7 @@
  */
 import { z } from "zod";
 import { Prisma } from "#prisma";
-import { EVERYONE_KEY, EVERYONE_MAX, LEVELS, SHAREABLE_TYPES, accessRank, atLeast, isLevel, isResourceType, principalGranteeKey, } from "../../core/grants.js";
+import { EVERYONE_KEY, EVERYONE_MAX, LEVELS, agentOwnerBindings, SHAREABLE_TYPES, accessRank, atLeast, isLevel, isResourceType, principalGranteeKey, } from "../../core/grants.js";
 import { agentNotFound, assertAgentAccess, agentAccess } from "../auth/access.js";
 import { permissionsOf } from "../auth/resource-server.js";
 import { McpError } from "../errors.js";
@@ -107,7 +107,7 @@ export function registerGrantTools(mcp) {
             "Owner-only whatever the level: the coding profile (task, base ref, protected paths, task-override opt-in, image, packages, limits), kind, budget group, sub-agents, secret/datastore/repository bindings, tool capabilities, memory and datastore contents, grants, delete. " +
             "Consequences: execute lets them run your agent with your tools, secrets, datastores and repository, and every run shares the agent's memory; they supply no task text unless it's a coding agent with allowWebhookTaskOverride. " +
             "Write lets them rewrite what those runs do: the prompt can make a run use everything the agent can already reach (the capabilities you granted, its memory, its linked repositories), and on a coding agent the prompt is part of every coding task, so write directs work done with your GitHub access. " +
-            "Granting again replaces the level. Everyone is capped at execute. The grantee must have signed in once.",
+            "Granting again replaces the level. Everyone may get write only on a native agent with no secrets, datastores, repositories, sub-agents or tool capabilities. The grantee must have signed in once.",
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -131,7 +131,13 @@ export function registerGrantTools(mcp) {
                     throw new McpError(400, "The owner already has full access; a grant to yourself or the owner changes nothing.");
                 }
                 if (!principal && accessRank(type, args.level) > accessRank(type, EVERYONE_MAX[type])) {
-                    throw new McpError(400, `An everyone grant can be at most ${EVERYONE_MAX[type]}: write for everyone would let anyone rewrite an agent that holds your tools and secrets.`);
+                    throw new McpError(400, `An everyone grant can be at most ${EVERYONE_MAX[type]}.`);
+                }
+                if (!principal && atLeast(type, args.level, "write")) {
+                    const bindings = await agentOwnerBindings(tx, resource.id);
+                    if (bindings.length) {
+                        throw new McpError(409, `Agent "${resource.id}" holds ${bindings.join(", ")}: write for everyone would let anyone rewrite an agent that uses them. Detach them first, or grant everyone execute.`);
+                    }
                 }
                 const granteeKey = principal ? principalGranteeKey(principal.id) : EVERYONE_KEY;
                 const grant = await tx.resourceGrant.upsert({

package/dist/mcp/tools/memory.js

@@ -1,5 +1,7 @@
 import { requireAgentAccess } from "../auth/access.js";
 import { textResult } from "./text-result.js";
+import { SecretInValueError, SecretCheckUnavailableError } from "../../core/secret-guard.js";
+import { McpError } from "../errors.js";
 export function registerMemoryTools(mcp) {
     mcp.registerTool({
         name: "get_agent_memory",
@@ -39,7 +41,15 @@ export function registerMemoryTools(mcp) {
         },
         handler: async (args, ctx) => {
             await requireAgentAccess(ctx, args.agentId, "owner");
-            await ctx.providers.memory.set(args.agentId, args.key, args.content);
+            try {
+                await ctx.providers.memory.set(args.agentId, args.key, args.content);
+            }
+            catch (err) {
+                if (err instanceof SecretInValueError || err instanceof SecretCheckUnavailableError) {
+                    throw new McpError(400, err.message);
+                }
+                throw err;
+            }
             return textResult({ ok: true });
         },
     });

package/dist/mcp/tools/notification-channels.js

@@ -10,7 +10,7 @@
  * for the whole deployment, no per-user OAuth), so link/unlink/test need
  * agents:admin with the admin role, and the approver is stamped on the
  * link. Exactly one of projectKey/agentId is the link's subject (enforced
- * again by a DB CHECK constraint); `events` narrows which of the six
+ * again by a DB CHECK constraint); `events` narrows which of the
  * workflow event kinds post to it (empty/omitted = all); private Slack
  * channels always need /invite @<app> before the bot can see or post to
  * them. See docs/private/2026-10-08-slack-workflow-notifications-design.md §8.
@@ -52,7 +52,7 @@ export function registerNotificationChannelTools(mcp) {
             "matches events for issues in that project; an agent link matches events for that agent's runs. " +
             "channel is the Slack channel id (C… for public, G… for private), never a #name — find it in the channel's " +
             "details in Slack. Private channels always need /invite @<app> before the bot can see or post to them. " +
-            "events narrows which of the six workflow event kinds post to this link; empty or omitted means all. " +
+            "events narrows which of the workflow event kinds post to this link; empty or omitted means all. " +
             "includeCost appends the run's spend line to messages. Re-linking the same channel + subject replaces events and " +
             "includeCost and clears any previously recorded delivery error — always send the full desired state.",
         inputSchema: {

package/dist/mcp/tools/packages.d.ts

@@ -0,0 +1,2 @@
+import type { WardbyMcpServer } from "../server.js";
+export declare function registerPackageTools(mcp: WardbyMcpServer): void;