@wardby/cli 0.6.0 → 0.8.0

package/dist/providers/host-tools/self-test.js

@@ -0,0 +1,142 @@
+import { codeProviderOf, normalizeHostedRepository } from "../../coding/code-host.js";
+import { loadTestSimulators, simulatorHostFetch } from "../../config/test-simulators.js";
+import { parseSecretBrokerConfig } from "../../core/secret-broker-config.js";
+import { safeFetch } from "../../sandbox/safe-fetch.js";
+import { invokeHostTool } from "./invoke.js";
+import { HOST_OPERATIONS, isHostOperation } from "./operations.js";
+import { findCredential } from "./registry.js";
+import { effectiveToolTimeoutMs } from "../../sandbox/tool-timeout.js";
+import { loadToolMaxTimeoutMs } from "../../config/tool-timeout.js";
+/**
+ * The fetch for bound tools: the real one, or under WARDBY_TEST_SIMULATORS the simulator's. Under
+ * the switch only `sim-` credentials are sent, as the switch refuses every other real credential.
+ */
+export function hostToolFetch(env = process.env) {
+    const simulators = loadTestSimulators(env);
+    return simulators ? { fetchImpl: simulatorHostFetch(simulators, safeFetch), simulated: true } : { simulated: false };
+}
+export async function loadProviderForCalls(db, name) {
+    const row = await db.hostProvider.findUnique({
+        where: { name },
+        include: { permissionSecret: true, credentials: { include: { secret: true } }, operations: true },
+    });
+    if (!row)
+        return null;
+    return {
+        name: row.name,
+        apiHosts: row.apiHosts,
+        repositoryApiPath: row.repositoryApiPath,
+        permissionApiPath: row.permissionApiPath,
+        permissionSecret: row.permissionSecret,
+        credentials: row.credentials,
+        operations: row.operations,
+    };
+}
+// No URL-encoding: callHostOperation only takes a repository in its normalized form, which admits only [A-Za-z0-9._-], and the request guard compares a raw prefix.
+function encodePath(template, fields) {
+    return template.replace(/\{([a-z]+)\}/g, (_m, field) => fields[field]);
+}
+/** The repository is compared in its normalized form, so callers must pass one. */
+export async function callHostOperation(provider, cipher, repository, operation, fields, options = {}) {
+    let ours = false;
+    try {
+        ours = normalizeHostedRepository(repository) === repository && codeProviderOf(repository) === provider.name;
+    }
+    catch {
+        // Not a repository we can name: denied below.
+    }
+    if (!ours)
+        return { ok: false, code: "host_tool_request_denied" };
+    const snapshot = provider.operations.find((o) => o.operation === operation);
+    if (!snapshot)
+        return { ok: false, code: "host_tool_failed" };
+    const path = repository.slice(`${provider.name}:`.length);
+    const [workspace, repo] = path.split("/");
+    const permission = HOST_OPERATIONS[operation].credential === "permission";
+    const stored = permission ? provider.permissionSecret : (findCredential(provider.credentials, path)?.secret ?? null);
+    const template = permission ? provider.permissionApiPath : provider.repositoryApiPath;
+    if (!stored || !template)
+        return { ok: false, code: "host_tool_no_credential" };
+    const credential = async () => {
+        const value = await cipher.decrypt(stored.ciphertext);
+        if (options.simulated && !value.startsWith("sim-"))
+            return undefined;
+        return { value, broker: parseSecretBrokerConfig(stored.broker) };
+    };
+    return invokeHostTool({
+        provider: provider.name,
+        operation,
+        snapshot,
+        params: { ...fields, workspace, repo, repository: path },
+        apiHosts: provider.apiHosts,
+        pathPrefix: encodePath(template, { repository: path, workspace, repo }),
+        credential,
+        fetchImpl: options.fetchImpl,
+        timeoutMs: effectiveToolTimeoutMs(snapshot.timeoutMs, loadToolMaxTimeoutMs()),
+    });
+}
+export async function selfTestHostProvider(provider, cipher, input, options = {}) {
+    const repository = normalizeHostedRepository(input.repository);
+    if (codeProviderOf(repository) !== provider.name)
+        throw new Error("host_provider_repository_mismatch");
+    const results = [];
+    const skip = (operation, code) => results.push({ operation, outcome: "skipped", code });
+    const check = async (operation, fields) => {
+        const result = await callHostOperation(provider, cipher, repository, operation, fields, options);
+        results.push(result.ok ? { operation, outcome: "pass" } : { operation, outcome: "fail", code: result.code });
+        return result;
+    };
+    const bound = (name) => provider.operations.some((o) => o.operation === name);
+    // The pull request comes first: its head is the ref for the checks that need one.
+    let ref = input.ref;
+    const number = input.pullRequest;
+    if (!bound("getPullRequest"))
+        skip("getPullRequest", "not_bound");
+    else if (number === undefined)
+        skip("getPullRequest", "needs_pull_request");
+    else {
+        const pr = await check("getPullRequest", { number });
+        if (pr.ok)
+            ref ??= pr.value.headSha;
+    }
+    for (const operation of ["listPullRequestFiles", "getDiff", "listComments"]) {
+        if (!bound(operation))
+            skip(operation, "not_bound");
+        else if (number === undefined)
+            skip(operation, "needs_pull_request");
+        else
+            await check(operation, { number });
+    }
+    if (!bound("findPullRequest"))
+        skip("findPullRequest", "not_bound");
+    else if (input.headRef === undefined)
+        skip("findPullRequest", "needs_head_ref");
+    else
+        await check("findPullRequest", { headRef: input.headRef });
+    for (const [operation, fields] of [
+        ["readFile", { path: "README.md" }],
+        ["listFiles", { path: "" }],
+        ["listCommitStatuses", {}],
+    ]) {
+        if (!bound(operation))
+            skip(operation, "not_bound");
+        else if (ref === undefined)
+            skip(operation, "needs_ref");
+        else
+            await check(operation, { ref, ...fields });
+    }
+    const mode = provider.permissionSecret ? "permission" : "allowlist";
+    if (mode === "allowlist")
+        skip("getRepositoryPermission", "allowlist_mode");
+    else if (!bound("getRepositoryPermission"))
+        skip("getRepositoryPermission", "not_bound");
+    else if (input.accountId === undefined)
+        skip("getRepositoryPermission", "needs_account");
+    else
+        await check("getRepositoryPermission", { accountId: input.accountId });
+    for (const { operation } of provider.operations) {
+        if (isHostOperation(operation) && !HOST_OPERATIONS[operation].readOnly)
+            skip(operation, "not_read_only");
+    }
+    return { provider: provider.name, repository, mode, results };
+}

package/dist/providers/index.d.ts

@@ -34,7 +34,8 @@ export interface ProviderRegistry {
     llm: LlmProvider;
     secrets: SecretCipher;
     auth: AuthProvider;
-    storage: BlobStore;
+    /** Absent unless BLOB_STORE is configured. */
+    storage?: BlobStore;
     executor: Executor;
     datastore: Datastore;
     memory: AgentMemoryStore;

package/dist/providers/issue-tracker/types.d.ts

@@ -264,6 +264,23 @@ export interface IssueEvent {
 }
 /** Shared by the ingress and the tools: a Jira issue key, e.g. PROJ-123. */
 export declare const ISSUE_KEY: RegExp;
+/** A GitHub issue's recorded key (githubIssueKey): "<owner>/<repo>#<number>", the repository normalised to lowercase. */
+export declare const GITHUB_ISSUE_KEY: RegExp;
+/** The product name of each system an issue can be recorded from (CodingRun / IssuePullRequest issueProvider). */
+export declare const ISSUE_SOURCE_NAMES: Readonly<Record<string, string>>;
+/**
+ * A recorded issue (CodingRun / IssuePullRequest issueProvider + issueKey) as
+ * people see it: the key re-validated for its provider, the system's name and
+ * the issue's page. A GitHub issue's page comes from its key; a tracker
+ * issue's from `trackerUrl` (the tracker's issueUrl), dropped when it throws
+ * or is not https. Undefined for an unknown provider or a malformed key.
+ */
+export declare function issueReference(provider: string, key: string, trackerUrl?: (key: string) => string | undefined): {
+    key: string;
+    url?: string;
+    trackerName: string;
+} | undefined;
 /** A Jira project key. */
 export declare const PROJECT_KEY: RegExp;
+/** An issue key's project: a Jira key's project key ("PROJ-123" → "PROJ"); a GitHub issue key's repository ("owner/repo#5" → "owner/repo"). */
 export declare const projectOf: (issueKey: string) => string;

package/dist/providers/issue-tracker/types.js

@@ -11,6 +11,44 @@ export class IssueTrackerError extends Error {
 }
 /** Shared by the ingress and the tools: a Jira issue key, e.g. PROJ-123. */
 export const ISSUE_KEY = /^[A-Z][A-Z0-9_]{0,254}-[1-9]\d{0,9}$/;
+/** A GitHub issue's recorded key (githubIssueKey): "<owner>/<repo>#<number>", the repository normalised to lowercase. */
+export const GITHUB_ISSUE_KEY = /^[a-z0-9](?:[a-z0-9-]{0,37}[a-z0-9])?\/[a-z0-9._-]{1,100}#[1-9]\d{0,9}$/;
+/** The product name of each system an issue can be recorded from (CodingRun / IssuePullRequest issueProvider). */
+export const ISSUE_SOURCE_NAMES = { ...ISSUE_TRACKER_NAMES, github: "GitHub" };
+/**
+ * A recorded issue (CodingRun / IssuePullRequest issueProvider + issueKey) as
+ * people see it: the key re-validated for its provider, the system's name and
+ * the issue's page. A GitHub issue's page comes from its key; a tracker
+ * issue's from `trackerUrl` (the tracker's issueUrl), dropped when it throws
+ * or is not https. Undefined for an unknown provider or a malformed key.
+ */
+export function issueReference(provider, key, trackerUrl) {
+    let url;
+    if (provider === "github") {
+        if (!GITHUB_ISSUE_KEY.test(key))
+            return undefined;
+        const hash = key.lastIndexOf("#");
+        url = `https://github.com/${key.slice(0, hash)}/issues/${key.slice(hash + 1)}`;
+    }
+    else if (provider === "jira") {
+        if (!ISSUE_KEY.test(key))
+            return undefined;
+        try {
+            url = trackerUrl?.(key);
+        }
+        catch {
+            url = undefined;
+        }
+    }
+    else {
+        return undefined;
+    }
+    return { key, ...(url?.startsWith("https://") ? { url } : {}), trackerName: ISSUE_SOURCE_NAMES[provider] };
+}
 /** A Jira project key. */
 export const PROJECT_KEY = /^[A-Z][A-Z0-9_]{0,254}$/;
-export const projectOf = (issueKey) => issueKey.slice(0, issueKey.lastIndexOf("-"));
+/** An issue key's project: a Jira key's project key ("PROJ-123" → "PROJ"); a GitHub issue key's repository ("owner/repo#5" → "owner/repo"). */
+export const projectOf = (issueKey) => {
+    const hash = issueKey.lastIndexOf("#");
+    return issueKey.slice(0, hash >= 0 ? hash : issueKey.lastIndexOf("-"));
+};

package/dist/providers/jobs/claude-tool-setup.d.ts

@@ -19,5 +19,9 @@ export interface ClaudeToolSetup {
         content: string;
         mode: number;
     }[];
+    /** Present only when the run's dependency cache is on, so older tool runners see an unchanged setup. */
+    dependencyCache?: true;
+    /** With dependencyCache only: the workspace volume size (limits.diskMb) the cache must stay inside. */
+    diskMb?: number;
 }
 export declare function claudeToolSetup(spec: JobSpec, capability: string): string;

package/dist/providers/jobs/claude-tool-setup.js

@@ -2,8 +2,10 @@
  * What Claude Code's tool runner (the credential-free container that runs commands in the
  * repository) needs from the trusted launcher: the package-registry settings every Codex shell
  * gets, built from the run's registry-only token (deriveRegistryToken, never the capability), and
- * the run's service test variables. Delivered as CLAUDE_TOOL_SETUP_ENV: a Kubernetes Secret key, or
- * `docker create --env NAME` with the value in the CLI's own environment.
+ * the run's service test variables, and whether the run's dependency cache is on. Delivered as the
+ * WARDBY_TOOL_SETUP environment variable (CLAUDE_TOOL_SETUP_ENV, docker-isolation.ts; a test keeps it
+ * equal to the tool runner's TOOL_SETUP_ENV): a Kubernetes Secret key, or `docker create --env NAME`
+ * with the value in the CLI's own environment.
  */
 import { serviceEnvironment } from "../../coding-worker/driver.js";
 import { registryWorkerSetup } from "../../coding/registry/worker-config.js";
@@ -35,6 +37,7 @@ export function claudeToolSetup(spec, capability) {
         // Same precedence as the Codex driver: the registry's own settings win over a service's.
         env: { ...serviceEnvironment(spec.services), ...registry.env },
         files: registry.files,
+        ...(spec.dependencyCache ? { dependencyCache: true, diskMb: spec.limits.diskMb } : {}),
     };
     const raw = JSON.stringify(setup);
     const limits = CLAUDE_TOOL_SETUP_LIMITS;

package/dist/providers/jobs/docker-isolation.d.ts

@@ -25,6 +25,14 @@ export declare const CLAUDE_TOOL_SETUP_ENV = "WARDBY_TOOL_SETUP";
 export declare const CODING_PROXY_DENY_PORT = 8788;
 export declare const DOCKER_ISOLATION_ERROR = "docker_isolation_unsupported";
 export declare const WORKER_STOP_GRACE_SECONDS = 10;
+/** The Claude worker's SDK config dir (claude-coding-worker/driver.ts CLAUDE_CONFIG_DIR). */
+export declare const CLAUDE_CONFIG_PATH = "/tmp/claude-config";
+/**
+ * Its own memory-backed scratch on a session-resume run: room for a session file up to the largest the
+ * control plane reads (coding/protocol.ts MAX_RAW_TRANSCRIPT_BYTES, 64 MiB) plus the SDK's small config
+ * files. Past it the SDK's writes there fail with ENOSPC, as /tmp's would; /tmp itself keeps its room.
+ */
+export declare const CLAUDE_CONFIG_SCRATCH_MIB = 80;
 export declare const WORKER_PATHS: {
     readonly workspace: "/workspace";
     readonly git: "/workspace/.git";
@@ -206,6 +214,6 @@ export declare function assertStorageVolumeInspection(volume: DockerVolumeInspec
 export declare function assertKeeperContainerInspection(container: DockerContainerInspection, spec: JobSpec): void;
 export declare function assertNetworkKeeperContainerInspection(container: DockerContainerInspection, spec: JobSpec): void;
 export declare function assertProxyContainerInspection(container: DockerContainerInspection, runId: string): void;
-export declare function assertWorkerContainerInspection(container: DockerContainerInspection, spec: JobSpec, expectedCapability: string, networkKeeperId?: string): void;
-export declare function assertClaudeAgentContainerInspection(container: DockerContainerInspection, spec: JobSpec, expectedCapability: string): void;
+export declare function assertWorkerContainerInspection(container: DockerContainerInspection, spec: JobSpec, expectedCapability: string, networkKeeperId?: string, expectedMcpToken?: string): void;
+export declare function assertClaudeAgentContainerInspection(container: DockerContainerInspection, spec: JobSpec, expectedCapability: string, expectedMcpToken?: string): void;
 export declare function assertClaudeToolRunnerContainerInspection(container: DockerContainerInspection, spec: JobSpec, expectedSetup: string, networkKeeperId?: string): void;

package/dist/providers/jobs/docker-isolation.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { MCP_TOKEN_ENV } from "../../coding/mcp-token.js";
 export const CODING_WORKER_UID = 10001;
 export const CODING_WORKER_GID = 10001;
 // The keeper needs headroom for runc's short-lived exec process plus Node's threads.
@@ -28,6 +29,14 @@ export const CLAUDE_TOOL_SETUP_ENV = "WARDBY_TOOL_SETUP";
 export const CODING_PROXY_DENY_PORT = 8788;
 export const DOCKER_ISOLATION_ERROR = "docker_isolation_unsupported";
 export const WORKER_STOP_GRACE_SECONDS = 10;
+/** The Claude worker's SDK config dir (claude-coding-worker/driver.ts CLAUDE_CONFIG_DIR). */
+export const CLAUDE_CONFIG_PATH = "/tmp/claude-config";
+/**
+ * Its own memory-backed scratch on a session-resume run: room for a session file up to the largest the
+ * control plane reads (coding/protocol.ts MAX_RAW_TRANSCRIPT_BYTES, 64 MiB) plus the SDK's small config
+ * files. Past it the SDK's writes there fail with ENOSPC, as /tmp's would; /tmp itself keeps its room.
+ */
+export const CLAUDE_CONFIG_SCRATCH_MIB = 80;
 export const WORKER_PATHS = {
     workspace: "/workspace",
     git: "/workspace/.git",
@@ -90,6 +99,11 @@ function validateSpec(spec) {
     else if (spec.toolImage !== undefined) {
         throw isolationError();
     }
+    if (spec.sessionResume !== undefined && (spec.sessionResume !== true || spec.provider !== "claude-code")) {
+        throw isolationError();
+    }
+    if (spec.mcpTools !== undefined && spec.mcpTools !== true)
+        throw isolationError();
     if (spec.services !== undefined) {
         // docker-services.ts re-validates every entry against the catalog schema. Both providers' shells
         // share the network keeper's namespace: Codex's worker, and Claude Code's tool runner.
@@ -295,6 +309,27 @@ function workerNetworkMode(spec) {
     const names = isolationNames(spec.runId);
     return spec.services === undefined ? names.network : `container:${names.networkKeeperContainer}`;
 }
+/**
+ * A run with MCP tools only: the agent's MCP token, by name. Like the capability, its value comes
+ * from the docker process's own environment (DockerCommandOptions.env), never the command line.
+ */
+function mcpTokenEnvArgs(spec) {
+    return spec.mcpTools ? ["--env", MCP_TOKEN_ENV] : [];
+}
+/**
+ * The agent container's exact WARDBY_ environment: the proxy URL, the capability, and for a run with
+ * MCP tools its MCP token. Anything missing, changed or extra fails the attestation.
+ */
+function agentEnvironmentMatches(environment, spec, expectedCapability, expectedMcpToken) {
+    if (spec.mcpTools && expectedMcpToken === undefined)
+        return false;
+    const expected = [
+        `WARDBY_PROXY_URL=http://${CODING_PROXY_ALIAS}:${CODING_PROXY_PORT}`,
+        `WARDBY_RUN_CAPABILITY=${expectedCapability}`,
+        ...(spec.mcpTools ? [`${MCP_TOKEN_ENV}=${expectedMcpToken}`] : []),
+    ];
+    return environment.length === expected.length && expected.every((value) => environment.includes(value));
+}
 export function buildWorkerCreateArgs(spec, proxyPort = CODING_PROXY_PORT) {
     validateSpec(spec);
     assertIntegerRange(proxyPort, 1, 65_535);
@@ -349,6 +384,7 @@ export function buildWorkerCreateArgs(spec, proxyPort = CODING_PROXY_PORT) {
         `WARDBY_PROXY_URL=http://${CODING_PROXY_ALIAS}:${proxyPort}`,
         "--env",
         "WARDBY_RUN_CAPABILITY",
+        ...mcpTokenEnvArgs(spec),
         "--restart",
         "no",
         "--stop-signal",
@@ -432,6 +468,12 @@ export function buildClaudeAgentCreateArgs(spec, proxyPort = CODING_PROXY_PORT)
         `/tmp:rw,noexec,nosuid,nodev,size=${scratchMb}m,mode=1777`,
         "--tmpfs",
         `/home/wardby:rw,noexec,nosuid,nodev,size=${scratchMb}m,uid=${CODING_WORKER_UID},gid=${CODING_WORKER_GID},mode=0700`,
+        ...(spec.sessionResume
+            ? [
+                "--tmpfs",
+                `${CLAUDE_CONFIG_PATH}:rw,noexec,nosuid,nodev,size=${CLAUDE_CONFIG_SCRATCH_MIB}m,uid=${CODING_WORKER_UID},gid=${CODING_WORKER_GID},mode=0700`,
+            ]
+            : []),
         "--mount",
         `type=volume,src=${names.storageVolume},dst=${WORKER_PATHS.input},volume-subpath=input,volume-nocopy,readonly`,
         "--mount",
@@ -442,6 +484,7 @@ export function buildClaudeAgentCreateArgs(spec, proxyPort = CODING_PROXY_PORT)
         `WARDBY_PROXY_URL=http://${CODING_PROXY_ALIAS}:${proxyPort}`,
         "--env",
         "WARDBY_RUN_CAPABILITY",
+        ...mcpTokenEnvArgs(spec),
         "--restart",
         "no",
         "--stop-signal",
@@ -763,7 +806,7 @@ function assertExactWorkerMounts(container, names) {
         }
     }
 }
-export function assertWorkerContainerInspection(container, spec, expectedCapability, networkKeeperId) {
+export function assertWorkerContainerInspection(container, spec, expectedCapability, networkKeeperId, expectedMcpToken) {
     validateSpec(spec);
     const names = isolationNames(spec.runId);
     const host = container.HostConfig;
@@ -805,9 +848,7 @@ export function assertWorkerContainerInspection(container, spec, expectedCapabil
         Object.keys(container.NetworkSettings?.Ports ?? {}).length !== 0) {
         throw isolationError();
     }
-    if (wardbyEnvironment.length !== 2 ||
-        !wardbyEnvironment.includes(`WARDBY_PROXY_URL=http://${CODING_PROXY_ALIAS}:${CODING_PROXY_PORT}`) ||
-        !wardbyEnvironment.includes(`WARDBY_RUN_CAPABILITY=${expectedCapability}`)) {
+    if (!agentEnvironmentMatches(wardbyEnvironment, spec, expectedCapability, expectedMcpToken)) {
         throw isolationError();
     }
     const tmpfs = host.Tmpfs ?? {};
@@ -876,16 +917,14 @@ function assertClaudeContainerBaseline(container, image, spec, limits) {
         !host.Tmpfs?.["/home/wardby"]?.includes("noexec"))
         throw isolationError();
 }
-export function assertClaudeAgentContainerInspection(container, spec, expectedCapability) {
+export function assertClaudeAgentContainerInspection(container, spec, expectedCapability, expectedMcpToken) {
     validateSpec(spec);
     if (spec.provider !== "claude-code")
         throw isolationError();
     const names = isolationNames(spec.runId);
     assertClaudeContainerBaseline(container, spec.image, spec, claudeAgentLimits(spec));
     const environment = (container.Config?.Env ?? []).filter((value) => value.startsWith("WARDBY_"));
-    if (environment.length !== 2 ||
-        !environment.includes(`WARDBY_PROXY_URL=http://${CODING_PROXY_ALIAS}:${CODING_PROXY_PORT}`) ||
-        !environment.includes(`WARDBY_RUN_CAPABILITY=${expectedCapability}`))
+    if (!agentEnvironmentMatches(environment, spec, expectedCapability, expectedMcpToken))
         throw isolationError();
     assertExactMountSet(container, names, [
         { path: WORKER_PATHS.input, writable: false, subpath: "input" },

package/dist/providers/jobs/docker.d.ts

@@ -88,6 +88,12 @@ export interface DockerJobLauncherOptions {
     workspaceRoot: string;
     proxyContainer: string;
     resolveCapability: (runId: string) => Promise<string>;
+    /**
+     * The run's MCP token (the capability vault), asked for only when the spec has mcpTools; the agent
+     * container gets it as WARDBY_MCP_TOKEN, through the docker process's environment like the
+     * capability. Absent = a run with MCP tools can't be launched.
+     */
+    resolveMcpToken?: (runId: string) => Promise<string | undefined>;
     /** Consult the durable application state before a startup sweep deletes resources. */
     isRunActive: (runId: string, handle: JobHandle) => Promise<boolean>;
     docker?: DockerCommandRunner;
@@ -131,6 +137,8 @@ export declare class DockerJobLauncher implements WorkspaceJobLauncher {
     remove(handle: JobHandle): Promise<void>;
     private initialize;
     private launchLocked;
+    /** The run's MCP token for a spec with mcpTools (refused unless well formed); undefined otherwise, unasked. */
+    private mcpTokenFor;
     private provision;
     /**
      * A run with services (docs/coding-services.md). The network keeper joins the run's internal
@@ -164,6 +172,7 @@ export declare class DockerJobLauncher implements WorkspaceJobLauncher {
     private removeNetworkIfAttested;
     private removeVolumeIfAttested;
     private seedRun;
+    readTranscript(handle: JobHandle, maxBytes: number): Promise<string | undefined>;
     private readResultArtifact;
     private readWorkerFailureDiagnostic;
     private keeperName;

package/dist/providers/jobs/docker.js

@@ -7,11 +7,12 @@ import { dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { logger } from "../../core/logger.js";
 import { ensurePrivateDirectory } from "../../core/private-directory.js";
 import { readBoundedRegularFile } from "../../coding-worker/artifact.js";
-import { parseCodingAgentOutputJson, redactAndTruncate, MAX_CODING_ARTIFACT_BYTES, MAX_CODING_INPUT_BYTES, MAX_CODING_OUTPUT_ISSUES, SAFE_CODING_OUTPUT_ISSUE, } from "../../coding/protocol.js";
+import { parseCodingWorkerOutputJson, redactAndTruncate, MAX_CODING_ARTIFACT_BYTES, MAX_CODING_INPUT_BYTES, MAX_CODING_OUTPUT_ISSUES, SAFE_CODING_OUTPUT_ISSUE, } from "../../coding/protocol.js";
 import { assertDockerHostSupportsIsolation, assertClaudeAgentContainerInspection, assertClaudeToolRunnerContainerInspection, assertIsolationNetworkInspection, assertKeeperContainerInspection, assertNetworkKeeperContainerInspection, assertProxyContainerInspection, assertStorageVolumeInspection, assertWorkerContainerInspection, buildDockerIsolationPlan, CLAUDE_TOOL_SETUP_ENV, dockerSupportsServicesFor, } from "./docker-isolation.js";
 import { serviceUnreadyError } from "../../coding/services/wording.js";
 import { assertServiceContainerInspection, buildDockerServicePlan, dockerServiceContainerNames, } from "./docker-services.js";
 import { claudeToolSetup } from "./claude-tool-setup.js";
+import { isMcpToken, MCP_TOKEN_ENV } from "../../coding/mcp-token.js";
 import { reportServiceState, } from "./service-state.js";
 import { replaceDirectoryFromStaging } from "./workspace-swap.js";
 const BACKEND = "docker";
@@ -95,7 +96,7 @@ export class NodeDockerCommandRunner {
         if (args.some((argument) => argument.includes("\0")))
             throw new Error("docker_argument_invalid");
         const extraEnv = options.env ?? {};
-        if (Object.keys(extraEnv).some((key) => key !== "WARDBY_RUN_CAPABILITY" && key !== CLAUDE_TOOL_SETUP_ENV))
+        if (Object.keys(extraEnv).some((key) => key !== "WARDBY_RUN_CAPABILITY" && key !== MCP_TOKEN_ENV && key !== CLAUDE_TOOL_SETUP_ENV))
             throw new Error("docker_environment_invalid");
         const env = {
             PATH: this.path,
@@ -447,6 +448,10 @@ function serviceUnready(name, cause) {
 function capabilityFromInspection(container) {
     return container.Config?.Env?.find((value) => value.startsWith("WARDBY_RUN_CAPABILITY="))?.slice("WARDBY_RUN_CAPABILITY=".length);
 }
+function mcpTokenFromInspection(container) {
+    const prefix = `${MCP_TOKEN_ENV}=`;
+    return container.Config?.Env?.find((value) => value.startsWith(prefix))?.slice(prefix.length);
+}
 function dockerState(inspection) {
     const state = inspection.State;
     if (!state)
@@ -655,14 +660,19 @@ export class DockerJobLauncher {
             const capability = ensureCapability(await this.options.resolveCapability(spec.runId));
             if (hash(capability) !== existing.capabilityHash)
                 throw new Error("docker_capability_changed");
+            const mcpToken = await this.mcpTokenFor(spec);
+            if ((mcpToken === undefined ? undefined : hash(mcpToken)) !== existing.mcpTokenHash) {
+                throw new Error("docker_mcp_token_changed");
+            }
             if (existing.phase === "active") {
                 await this.refresh(existing);
                 return clone(existing.handle);
             }
-            return this.provision(existing, plan, services, capability);
+            return this.provision(existing, plan, services, capability, mcpToken);
         }
         await this.validateInputArtifact(spec.inputArtifact);
         const capability = ensureCapability(await this.options.resolveCapability(spec.runId));
+        const mcpToken = await this.mcpTokenFor(spec);
         const record = {
             schemaVersion: STATE_SCHEMA_VERSION,
             runId: spec.runId,
@@ -673,12 +683,13 @@ export class DockerJobLauncher {
             createdAt: this.now(),
             deadlineAt: this.now() + plan.deadlineMs,
             capabilityHash: hash(capability),
+            ...(mcpToken !== undefined ? { mcpTokenHash: hash(mcpToken) } : {}),
             phase: "provisioning",
         };
         // This durable record is the idempotency fence before any Docker side effect.
         await this.writeRecord(record);
         try {
-            return await this.provision(record, plan, services, capability);
+            return await this.provision(record, plan, services, capability, mcpToken);
         }
         catch (error) {
             await this.options
@@ -691,7 +702,16 @@ export class DockerJobLauncher {
             throw error;
         }
     }
-    async provision(record, plan, services, capability) {
+    /** The run's MCP token for a spec with mcpTools (refused unless well formed); undefined otherwise, unasked. */
+    async mcpTokenFor(spec) {
+        if (!spec.mcpTools)
+            return undefined;
+        const token = await this.options.resolveMcpToken?.(spec.runId);
+        if (!isMcpToken(token))
+            throw new Error("docker_mcp_token_invalid");
+        return token;
+    }
+    async provision(record, plan, services, capability, mcpToken) {
         await this.assertHost();
         const labels = resourceLabels(record);
         await this.createAndAssert(appendLabels(plan.networkCreateArgs, labels), ["network", "inspect", plan.names.network], (value) => {
@@ -740,14 +760,14 @@ export class DockerJobLauncher {
         await this.createAndAssert(workerArgs, ["container", "inspect", plan.names.workerContainer], (value) => {
             const inspected = value;
             if (record.spec.provider === "claude-code") {
-                assertClaudeAgentContainerInspection(inspected, record.spec, capability);
+                assertClaudeAgentContainerInspection(inspected, record.spec, capability, mcpToken);
             }
             else {
-                assertWorkerContainerInspection(inspected, record.spec, capability, networkKeeperId);
+                assertWorkerContainerInspection(inspected, record.spec, capability, networkKeeperId, mcpToken);
             }
             if (!labelsMatch(inspected.Config?.Labels, labels))
                 throw new Error("docker_resource_attestation_failed");
-        }, { env: { WARDBY_RUN_CAPABILITY: capability } });
+        }, { env: { WARDBY_RUN_CAPABILITY: capability, ...(mcpToken !== undefined ? { [MCP_TOKEN_ENV]: mcpToken } : {}) } });
         await this.startContainer(plan.names.workerContainer);
         record.phase = "active";
         await this.writeRecord(record);
@@ -939,8 +959,12 @@ export class DockerJobLauncher {
         const capability = capabilityFromInspection(inspection);
         if (!capability || hash(capability) !== record.capabilityHash)
             throw new Error("docker_resource_attestation_failed");
+        // Only a run with MCP tools carries a token, and only the one its record hashed.
+        const mcpToken = record.spec.mcpTools ? mcpTokenFromInspection(inspection) : undefined;
+        if (record.spec.mcpTools && (!mcpToken || hash(mcpToken) !== record.mcpTokenHash))
+            throw new Error("docker_resource_attestation_failed");
         if (record.spec.provider === "claude-code") {
-            assertClaudeAgentContainerInspection(inspection, record.spec, capability);
+            assertClaudeAgentContainerInspection(inspection, record.spec, capability, mcpToken);
             const tool = await this.inspect([
                 "container",
                 "inspect",
@@ -956,7 +980,7 @@ export class DockerJobLauncher {
             }
         }
         else {
-            assertWorkerContainerInspection(inspection, record.spec, capability, await this.attestedNetworkKeeperId(record));
+            assertWorkerContainerInspection(inspection, record.spec, capability, await this.attestedNetworkKeeperId(record), mcpToken);
         }
         const phase = dockerState(inspection);
         if (!phase || phase === "provisioning" || phase === "active")
@@ -1067,13 +1091,38 @@ export class DockerJobLauncher {
         await this.transfer.seedDirectory(resolve(runRoot, "git"), keeper, "/run/wardby/storage/git");
         await this.transfer.seedInput(record.spec.inputArtifact, keeper);
     }
+    async readTranscript(handle, maxBytes) {
+        await this.ready;
+        const record = await this.findRecord(handle);
+        if (!record)
+            return undefined;
+        const staging = await mkdtemp(join(this.stateRoot, ".wardby-transcript-"));
+        const target = join(staging, "session.jsonl");
+        try {
+            try {
+                await this.run([
+                    "container",
+                    "cp",
+                    `${this.keeperName(record)}:/run/wardby/storage/output/session.jsonl`,
+                    target,
+                ]);
+            }
+            catch {
+                return undefined;
+            }
+            return await readBoundedRegularFile(target, maxBytes, "transcript_too_large");
+        }
+        finally {
+            await rm(staging, { recursive: true, force: true });
+        }
+    }
     async readResultArtifact(record) {
         const staging = await mkdtemp(join(this.stateRoot, ".wardby-result-"));
         const target = join(staging, "result.json");
         try {
             await this.run(["container", "cp", `${this.keeperName(record)}:/run/wardby/storage/output/result.json`, target]);
             const raw = await readBoundedRegularFile(target, MAX_CODING_ARTIFACT_BYTES, "docker_result_artifact_invalid");
-            const output = parseCodingAgentOutputJson(raw);
+            const output = parseCodingWorkerOutputJson(raw);
             if (output.runId !== record.runId)
                 throw new Error("docker_result_run_mismatch");
             return JSON.stringify(output);

package/dist/providers/jobs/fake-kubernetes-api.d.ts

@@ -31,6 +31,8 @@ export declare class FakeKubernetesApi implements KubernetesApi {
     onExec: (call: FakeExecCall) => Promise<number>;
     /** The admission chain a dry-run create runs through. Default: echo the pod back unchanged. */
     onDryRunCreatePod: (namespace: string, body: V1Pod) => Promise<V1Pod>;
+    /** Runs at the start of every pod create; tests throw KubernetesQuotaExceededError (or anything) from it. */
+    onCreatePod: (namespace: string, body: V1Pod) => Promise<void>;
     readonly deploymentPatches: Array<{
         name: string;
         replicas?: number;

package/dist/providers/jobs/fake-kubernetes-api.js

@@ -13,6 +13,8 @@ export class FakeKubernetesApi {
     };
     /** The admission chain a dry-run create runs through. Default: echo the pod back unchanged. */
     onDryRunCreatePod = async (_namespace, body) => body;
+    /** Runs at the start of every pod create; tests throw KubernetesQuotaExceededError (or anything) from it. */
+    onCreatePod = async () => { };
     deploymentPatches = [];
     /** Deployment names whose patch throws KubernetesForbiddenError. */
     forbidden = new Set();
@@ -83,6 +85,7 @@ export class FakeKubernetesApi {
         this.delete("secret", namespace, name);
     }
     async createPod(namespace, body) {
+        await this.onCreatePod(namespace, body);
         return this.create("pod", namespace, body);
     }
     /**

package/dist/providers/jobs/kubernetes-api.d.ts

@@ -12,6 +12,14 @@ export declare class KubernetesNotFoundError extends Error {
 export declare class KubernetesForbiddenError extends Error {
     constructor(message?: string, options?: ErrorOptions);
 }
+/** A create the namespace ResourceQuota refused (HTTP 403 "exceeded quota"). */
+export declare class KubernetesQuotaExceededError extends Error {
+    /** The refusing quota's name as the API server worded it; unvalidated, and nothing else of the refusal is kept. */
+    readonly quotaName?: string;
+    constructor(message?: string, options?: ErrorOptions & {
+        quotaName?: string;
+    });
+}
 /** Stale resourceVersion on replace. */
 export declare class KubernetesConflictError extends Error {
     constructor(message?: string);