@wardby/cli 0.6.0 → 0.8.0

package/dist/core/budget-topup.js

@@ -0,0 +1,156 @@
+import { codingTopUpRoom, MIN_RESERVATION_USD } from "./budget-groups.js";
+import { GROUP_DISPATCH_LOCK_SQL, isSerializationConflict, isTransactionUnavailable } from "./dispatch.js";
+import { logger } from "./logger.js";
+const topUpLog = logger.child({ module: "budget-topup" });
+/** Share of the base one step adds, unless one maximum request hold is more. */
+export const TOP_UP_STEP_SHARE = 0.1;
+/** Headroom: the share of the base, or this many of the run's largest request holds if more. */
+export const TOP_UP_HEADROOM_SHARE = 0.2;
+export const TOP_UP_HEADROOM_HOLDS = 2;
+const roundMicro = (usd) => Math.round(usd / MIN_RESERVATION_USD) * MIN_RESERVATION_USD;
+const floorMicro = (usd) => Math.floor(usd / MIN_RESERVATION_USD + 1e-6) * MIN_RESERVATION_USD;
+/** The run's grant, limit and proxy-session totals, or the outcome when there is nothing to ask for. */
+async function readState(db, runId) {
+    const coding = await db.codingRun.findUnique({
+        where: { runId },
+        select: {
+            budgetReservedUsd: true,
+            budgetBaseUsd: true,
+            budgetLimitUsd: true,
+            run: { select: { status: true } },
+            proxySession: { select: { id: true, status: true, budgetExhaustedAt: true } },
+        },
+    });
+    if (!coding || coding.budgetLimitUsd == null)
+        return { outcome: "closed" };
+    const grantedUsd = Number(coding.budgetReservedUsd);
+    const limitUsd = Number(coding.budgetLimitUsd);
+    const result = { outcome: "closed", grantedUsd };
+    if (grantedUsd + MIN_RESERVATION_USD > limitUsd)
+        return result;
+    if (coding.run.status !== "running" && coding.run.status !== "pending")
+        return result;
+    // Already refused by the proxy: the worker is stopping, a grant now would only be held for nothing.
+    const session = coding.proxySession;
+    if (!session || session.status !== "active" || session.budgetExhaustedAt)
+        return result;
+    const refused = await db.runBudgetEvent.findFirst({
+        where: { runId, kind: "overrun_unavailable" },
+        select: { id: true },
+    });
+    if (refused)
+        return result;
+    // Totals as the proxy ledger counts them (prisma-ledger.ts reserve).
+    const totals = await db.$queryRaw `
+    SELECT
+      COALESCE(SUM(CASE
+        WHEN "status" = 'completed' THEN "actualCostUsd"
+        WHEN "status" = 'uncertain' AND "costEstimated" THEN "actualCostUsd"
+        ELSE 0
+      END), 0) AS "spent",
+      COALESCE(SUM(CASE
+        WHEN "status" = 'reserved' THEN "reservationUsd"
+        WHEN "status" = 'uncertain' AND NOT "costEstimated" THEN "reservationUsd"
+        ELSE 0
+      END), 0) AS "held",
+      COALESCE(MAX(COALESCE("ceilingUsd", "reservationUsd")), 0) AS "maxHold"
+    FROM "CodingProxyRequest" WHERE "sessionId" = ${session.id}
+  `;
+    return {
+        baseUsd: coding.budgetBaseUsd == null ? grantedUsd : Number(coding.budgetBaseUsd),
+        grantedUsd,
+        limitUsd,
+        sessionId: session.id,
+        spentUsd: Number(totals[0]?.spent ?? 0),
+        heldUsd: Number(totals[0]?.held ?? 0),
+        maxHoldUsd: Number(totals[0]?.maxHold ?? 0),
+    };
+}
+/**
+ * How far below its grant a run asks for its next step. Agent loops grow their
+ * context, so the next request usually holds more than any before it, and the
+ * top-up has to land before it is sent.
+ */
+function headroomUsd(state) {
+    return Math.max(TOP_UP_HEADROOM_HOLDS * state.maxHoldUsd, TOP_UP_HEADROOM_SHARE * state.baseUsd);
+}
+/** Close to its grant: within its headroom. */
+function isClose(state) {
+    return state.spentUsd + state.heldUsd >= state.grantedUsd - headroomUsd(state);
+}
+/** Near enough to its grant that the next poll should come soon. */
+function isNear(state) {
+    return state.spentUsd + state.heldUsd >= state.grantedUsd - 2 * headroomUsd(state);
+}
+async function grantOnce(tx, runId, now) {
+    // First statement: serializes with dispatch and every other top-up (see GROUP_DISPATCH_LOCK_SQL).
+    await tx.$executeRawUnsafe(GROUP_DISPATCH_LOCK_SQL);
+    const state = await readState(tx, runId);
+    if ("outcome" in state)
+        return state;
+    if (!isClose(state))
+        return { outcome: "not_needed", grantedUsd: state.grantedUsd, near: isNear(state) };
+    const room = await codingTopUpRoom(tx, runId, now);
+    const step = Math.max(TOP_UP_STEP_SHARE * state.baseUsd, state.maxHoldUsd);
+    const grant = floorMicro(Math.min(step, state.limitUsd - state.grantedUsd, room.roomUsd));
+    if (grant < MIN_RESERVATION_USD) {
+        const details = {
+            source: "top-up",
+            capUsd: room.detail?.capUsd ?? 0,
+            spentUsd: room.detail?.spentUsd ?? 0,
+            heldUsd: room.detail?.heldUsd ?? 0,
+            leftUsd: room.roomUsd,
+            baseBudgetUsd: state.baseUsd,
+            grantedUsd: state.grantedUsd,
+            limitUsd: state.limitUsd,
+            ...(room.groupName ? { groupName: room.groupName } : {}),
+        };
+        await tx.runBudgetEvent.create({
+            data: {
+                runId,
+                kind: "overrun_unavailable",
+                limit: room.limitedBy ?? "run",
+                details: details,
+            },
+        });
+        return { outcome: "unavailable", grantedUsd: state.grantedUsd };
+    }
+    const grantedUsd = Math.min(state.limitUsd, roundMicro(state.grantedUsd + grant));
+    await tx.codingRun.update({ where: { runId }, data: { budgetReservedUsd: grantedUsd } });
+    await tx.codingProxySession.updateMany({
+        where: { id: state.sessionId, status: "active" },
+        data: { budgetUsd: grantedUsd },
+    });
+    return { outcome: "granted", grantedUsd, near: true };
+}
+/**
+ * Grants the run one overrun step when it is close to its grant and its
+ * budget group and run tree have room. Cheap when it is not close: that is
+ * read without the lock. One attempt per call, so a poll never blocks on
+ * retries: a serialization conflict (or a lock not had in time) answers
+ * not_needed and near, and the caller's next poll, soon, asks again.
+ */
+export async function topUpCodingBudget(db, runId, now = new Date()) {
+    const state = await readState(db, runId);
+    if ("outcome" in state)
+        return state;
+    if (!isClose(state))
+        return { outcome: "not_needed", grantedUsd: state.grantedUsd, near: isNear(state) };
+    try {
+        const result = await db.$transaction((tx) => grantOnce(tx, runId, now), {
+            isolationLevel: "Serializable",
+            maxWait: TOP_UP_TX_MAX_WAIT_MS,
+        });
+        if (result.outcome === "granted" || result.outcome === "unavailable") {
+            topUpLog.info({ runId, outcome: result.outcome, grantedUsd: result.grantedUsd }, "coding run overrun top-up");
+        }
+        return result;
+    }
+    catch (err) {
+        if (!isSerializationConflict(err) && !isTransactionUnavailable(err))
+            throw err;
+        return { outcome: "not_needed", grantedUsd: state.grantedUsd, near: true };
+    }
+}
+/** How long one top-up waits to start its transaction: short, so a poll (and its heartbeat) is never held long. */
+export const TOP_UP_TX_MAX_WAIT_MS = 2_000;

package/dist/core/budget-wording.d.ts

@@ -6,17 +6,31 @@
  */
 import type { PrismaClient } from "#prisma";
 export interface BudgetFacts {
-    /** The run's own budget (a coding run's reservation); falls back to the agent's. */
+    /** The run's own budget (a coding run's reservation: its grant); falls back to the agent's. */
     runBudgetUsd?: number | null;
     agentBudgetUsd: number;
+    /** The run's budget before the agent's allowed overrun; absent for runs from before the setting. */
+    baseBudgetUsd?: number | null;
+    /** The most the run could have been topped up to (CodingRun.budgetLimitUsd); absent = its reservation. */
+    limitUsd?: number | null;
     budgetGroupName?: string | null;
     /** The run was refused before it started. */
     refused?: boolean;
 }
+/** A group name is operator-chosen text; keep it to one short, quote-free line. */
+export declare function groupName(name: string | null | undefined): string | null;
+/** The allowed overrun as a whole percent, or null when the run had none (no base, or it rounds to 0%). */
+export declare function overrunPercent(baseUsd: number | null | undefined, limitUsd: number): number | null;
 export declare function budgetSentence(facts: BudgetFacts): string;
+/**
+ * For a run that finished over its base budget: what it spent and by how much
+ * it went over, and whether that stayed inside the allowed overrun. Undefined
+ * when the spend is within the base budget.
+ */
+export declare function overrunSentence(costUsd: number, baseUsd: number, limitUsd: number): string | undefined;
 /**
  * The sentence for a finished run, read from the database: a coding run's
  * reserved budget, otherwise the agent's. Falls back to a sentence without
  * amounts when they cannot be read. Never throws.
  */
-export declare function loadBudgetSentence(db: Pick<PrismaClient, "run">, runId: string, status: string): Promise<string>;
+export declare function loadBudgetSentence(db: Pick<PrismaClient, "run" | "runBudgetEvent">, runId: string, status: string): Promise<string>;

package/dist/core/budget-wording.js

@@ -1,10 +1,18 @@
+import { hostBudgetSentence, loadBudgetEvent } from "./budget-events.js";
 const MAX_GROUP_NAME_CHARS = 64;
 const usd = (amount) => `$${amount.toFixed(2)}`;
 /** A group name is operator-chosen text; keep it to one short, quote-free line. */
-function groupName(name) {
+export function groupName(name) {
     const cleaned = (name ?? "").replace(/["`]/g, "").replace(/\s+/g, " ").trim().slice(0, MAX_GROUP_NAME_CHARS);
     return cleaned || null;
 }
+/** The allowed overrun as a whole percent, or null when the run had none (no base, or it rounds to 0%). */
+export function overrunPercent(baseUsd, limitUsd) {
+    if (baseUsd == null || !(baseUsd > 0) || !(baseUsd < limitUsd))
+        return null;
+    const percent = Math.round((limitUsd / baseUsd - 1) * 100);
+    return percent > 0 ? percent : null;
+}
 export function budgetSentence(facts) {
     const group = groupName(facts.budgetGroupName);
     if (facts.refused) {
@@ -14,6 +22,16 @@ export function budgetSentence(facts) {
             : `Out of budget: ${within}.`;
     }
     const runBudget = facts.runBudgetUsd ?? facts.agentBudgetUsd;
+    const base = facts.baseBudgetUsd;
+    const limit = facts.limitUsd ?? runBudget;
+    const percent = overrunPercent(base, limit);
+    if (base != null && percent !== null && runBudget > base) {
+        // Topped up only partly: what of the overrun its group and run tree had room for.
+        const overrun = runBudget < limit
+            ? `${usd(runBudget - base)} of its ${percent}% allowed overrun`
+            : `its ${percent}% allowed overrun`;
+        return `Out of budget: this run's ${usd(base)} budget and ${overrun} (${usd(runBudget)} in all) were used up.`;
+    }
     const used = `Out of budget: this run's ${usd(runBudget)} budget was used up`;
     // A run reserved less than the agent's own budget: its group had only that much left.
     if (group && runBudget < facts.agentBudgetUsd) {
@@ -21,27 +39,47 @@ export function budgetSentence(facts) {
     }
     return `${used}.`;
 }
+/**
+ * For a run that finished over its base budget: what it spent and by how much
+ * it went over, and whether that stayed inside the allowed overrun. Undefined
+ * when the spend is within the base budget.
+ */
+export function overrunSentence(costUsd, baseUsd, limitUsd) {
+    if (!(baseUsd > 0) || !(costUsd > baseUsd))
+        return undefined;
+    const over = costUsd - baseUsd;
+    const percent = Math.round((over / baseUsd) * 100);
+    const within = costUsd <= limitUsd ? ", within its allowed overrun" : "";
+    return `Spent ${usd(costUsd)}, ${usd(over)} (${percent}%) over its ${usd(baseUsd)} budget${within}.`;
+}
 /**
  * The sentence for a finished run, read from the database: a coding run's
  * reserved budget, otherwise the agent's. Falls back to a sentence without
  * amounts when they cannot be read. Never throws.
  */
 export async function loadBudgetSentence(db, runId, status) {
+    const loaded = await loadBudgetEvent(db, runId);
+    if (loaded)
+        return hostBudgetSentence(loaded.event);
     const refused = status === "refused";
     try {
         const row = await db.run.findUnique({
             where: { id: runId },
             select: {
                 agent: { select: { budgetUsd: true, budgetGroup: { select: { name: true } } } },
-                codingRun: { select: { budgetReservedUsd: true } },
+                codingRun: { select: { budgetReservedUsd: true, budgetBaseUsd: true, budgetLimitUsd: true } },
             },
         });
         const agentBudgetUsd = Number(row?.agent?.budgetUsd);
         if (!row?.agent || !Number.isFinite(agentBudgetUsd))
             throw new Error("budget_facts_unavailable");
         const reserved = row.codingRun ? Number(row.codingRun.budgetReservedUsd) : NaN;
+        const base = row.codingRun?.budgetBaseUsd == null ? NaN : Number(row.codingRun.budgetBaseUsd);
+        const limit = row.codingRun?.budgetLimitUsd == null ? NaN : Number(row.codingRun.budgetLimitUsd);
         return budgetSentence({
             runBudgetUsd: Number.isFinite(reserved) ? reserved : null,
+            baseBudgetUsd: Number.isFinite(base) ? base : null,
+            limitUsd: Number.isFinite(limit) ? limit : null,
             agentBudgetUsd,
             budgetGroupName: row.agent.budgetGroup?.name ?? null,
             refused,

package/dist/core/coding-mcp.d.ts

@@ -0,0 +1,36 @@
+import type { PrismaClient } from "#prisma";
+import type { SecretCipher } from "../providers/secrets/types.js";
+import type { safeFetch } from "../sandbox/safe-fetch.js";
+import type { Logger } from "./logger.js";
+import { type McpToolPin } from "./mcp-tools.js";
+export declare const CODING_MCP_PATH = "/coding-mcp";
+/** What initialize answers when the client names no protocol version. */
+export declare const CODING_MCP_DEFAULT_PROTOCOL_VERSION = "2025-06-18";
+export interface CodingMcpDeps {
+    db: PrismaClient;
+    cipher: SecretCipher;
+    fetchImpl?: typeof safeFetch;
+    log: Logger;
+    now?: () => Date;
+    /** How often a call in flight checks for stop_run; tests shorten it. */
+    stopPollMs?: number;
+}
+export interface CodingMcpResponse {
+    status: number;
+    body: string;
+    contentType: string;
+}
+/**
+ * True for handleMcpTool's error shape: exactly `{ error: <code>, message }`. A server result that
+ * happens to have that very shape is flagged too; the model sees the same text either way.
+ */
+export declare function isMcpErrorText(text: string): boolean;
+/** One stored pin, checked field by field: a malformed entry is left out, never served. */
+export declare function isMcpToolPin(value: unknown): value is McpToolPin;
+/** The session's well-formed pins, first of each exposed name only. */
+export declare function storedPins(stored: unknown): McpToolPin[];
+/**
+ * Handles one JSON-RPC request body for /coding-mcp. Never throws. `signal` is the request's own: the
+ * listener aborts it when the proxy's connection closes before the answer, which stops a call in flight.
+ */
+export declare function handleCodingMcpRequest(authorization: string | undefined, body: string, deps: CodingMcpDeps, signal?: AbortSignal): Promise<CodingMcpResponse>;

package/dist/core/coding-mcp.js

@@ -0,0 +1,253 @@
+/**
+ * The native gateway's /coding-mcp route (remote MCP servers, phase 2): a stateless Streamable HTTP
+ * MCP server that runs a coding run's MCP tool calls. The worker reaches it only through the coding
+ * proxy's /mcp route, which forwards the request and the run's MCP token (`rmt_…`) unchanged; the
+ * proxy is not trusted, so the token is checked here again: its hash must name a proxy session that
+ * is active and before its deadline, whose run is still drivable (not stopped or cancelled).
+ *
+ * A Codex run (by the provider it was dispatched with, CodingRun.provider) may call only tools the
+ * live tool list marks read-only: its shell commands can read the token.
+ *
+ * tools/list serves the session's pins (no URLs or secrets); tools/call counts the call against the
+ * run's limit (WARDBY_MCP_MAX_CALLS_PER_RUN) and runs it through phase 1's handleMcpTool, which
+ * re-checks the live attachment and redacts the result against the server's secrets before it gets
+ * here. Secrets: this route's own log line carries the method, status and session id only (never the
+ * body, arguments, results or token), and every body it sends is either fixed text, the pins, or
+ * handleMcpTool's already-redacted string.
+ */
+import { readFileSync } from "node:fs";
+import { loadMcpMaxCallsPerRun } from "../config/mcp-call-limit.js";
+import { MCP_TOKEN_REQUIRED_MESSAGE, mcpTokenHash, isMcpToken } from "../coding/mcp-token.js";
+import { HTTP_LIMITS } from "../mcp/transport/http-limits.js";
+import { handleMcpTool, isCodexCoding, mcpToolDefs } from "./mcp-tools.js";
+import { runDrivability, TOOL_STOP_POLL_MS, watchRunStop } from "./runner.js";
+export const CODING_MCP_PATH = "/coding-mcp";
+/** What initialize answers when the client names no protocol version. */
+export const CODING_MCP_DEFAULT_PROTOCOL_VERSION = "2025-06-18";
+/** The package version, reported in server info (package.json sits two levels up from src/core and dist/core). */
+const SERVER_VERSION = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8")).version;
+const LOGGED_METHODS = new Set([
+    "initialize",
+    "ping",
+    "tools/list",
+    "tools/call",
+    "notifications/initialized",
+    "notifications/cancelled",
+]);
+const JSON_TYPE = "application/json";
+const reply = (status, payload) => ({
+    status,
+    body: payload === undefined ? "" : JSON.stringify(payload),
+    contentType: JSON_TYPE,
+});
+const rpcResult = (id, result) => reply(200, { jsonrpc: "2.0", id, result });
+const rpcError = (status, id, code, message) => reply(status, { jsonrpc: "2.0", id, error: { code, message } });
+/** An MCP tool result: the text handleMcpTool returned, flagged when it is one of its JSON errors. */
+const toolResult = (text, isError) => ({
+    content: [{ type: "text", text }],
+    ...(isError ? { isError: true } : {}),
+});
+const toolError = (code, message) => toolResult(JSON.stringify({ error: code, message }), true);
+/**
+ * True for handleMcpTool's error shape: exactly `{ error: <code>, message }`. A server result that
+ * happens to have that very shape is flagged too; the model sees the same text either way.
+ */
+export function isMcpErrorText(text) {
+    if (!text.startsWith("{"))
+        return false;
+    try {
+        const value = JSON.parse(text);
+        if (value === null || typeof value !== "object" || Array.isArray(value))
+            return false;
+        const keys = Object.keys(value);
+        const v = value;
+        return (keys.length === 2 &&
+            typeof v.error === "string" &&
+            /^[a-z][a-z0-9_]*$/.test(v.error) &&
+            typeof v.message === "string");
+    }
+    catch {
+        return false;
+    }
+}
+/** One stored pin, checked field by field: a malformed entry is left out, never served. */
+export function isMcpToolPin(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const p = value;
+    const definition = p.definition;
+    return (typeof p.exposedName === "string" &&
+        p.exposedName !== "" &&
+        typeof p.toolName === "string" &&
+        p.toolName !== "" &&
+        typeof p.serverId === "string" &&
+        p.serverId !== "" &&
+        typeof p.serverName === "string" &&
+        (p.callTimeoutMs === undefined ||
+            (typeof p.callTimeoutMs === "number" && Number.isSafeInteger(p.callTimeoutMs) && p.callTimeoutMs > 0)) &&
+        definition !== null &&
+        typeof definition === "object" &&
+        !Array.isArray(definition) &&
+        typeof definition.description === "string" &&
+        definition.inputSchema !== null &&
+        typeof definition.inputSchema === "object" &&
+        !Array.isArray(definition.inputSchema));
+}
+/** The session's well-formed pins, first of each exposed name only. */
+export function storedPins(stored) {
+    if (!Array.isArray(stored))
+        return [];
+    const seen = new Set();
+    const pins = [];
+    for (const entry of stored) {
+        if (!isMcpToolPin(entry) || seen.has(entry.exposedName))
+            continue;
+        seen.add(entry.exposedName);
+        pins.push(entry);
+    }
+    return pins;
+}
+/**
+ * Handles one JSON-RPC request body for /coding-mcp. Never throws. `signal` is the request's own: the
+ * listener aborts it when the proxy's connection closes before the answer, which stops a call in flight.
+ */
+export async function handleCodingMcpRequest(authorization, body, deps, signal) {
+    const seen = {};
+    let response;
+    try {
+        response = await handle(authorization, body, deps, seen, signal);
+    }
+    catch {
+        // Nothing of the error leaves: its message could carry anything the call touched.
+        response = rpcError(500, null, -32603, "Internal error.");
+    }
+    // Method, status and session id only: never the body, the arguments, the result, or the token.
+    deps.log.info({ method: seen.method, status: response.status, sessionId: seen.sessionId }, "coding mcp request");
+    return response;
+}
+async function handle(authorization, body, deps, seen, signal) {
+    if (Buffer.byteLength(body, "utf8") > HTTP_LIMITS.json) {
+        return rpcError(413, null, -32600, "The request body is too large.");
+    }
+    const session = await authenticate(authorization, deps);
+    // No WWW-Authenticate: a client must not start OAuth discovery against this route.
+    if (!session)
+        return rpcError(401, null, -32001, MCP_TOKEN_REQUIRED_MESSAGE);
+    seen.sessionId = session.id;
+    let message;
+    try {
+        message = JSON.parse(body);
+    }
+    catch {
+        return rpcError(400, null, -32700, "Parse error.");
+    }
+    if (message === null || typeof message !== "object" || Array.isArray(message)) {
+        return rpcError(400, null, -32600, "Invalid request: one JSON-RPC message per request.");
+    }
+    const m = message;
+    const id = typeof m.id === "string" || typeof m.id === "number" ? m.id : null;
+    if (m.jsonrpc !== "2.0" || typeof m.method !== "string") {
+        return rpcError(400, id, -32600, "Invalid request.");
+    }
+    // The method is the client's own text: only a known one is logged, anything else as "other".
+    seen.method = LOGGED_METHODS.has(m.method) ? m.method : "other";
+    // A notification (no id) has no reply.
+    if (m.id === undefined)
+        return reply(202, undefined);
+    if (id === null)
+        return rpcError(400, null, -32600, "Invalid request: id must be a string or number.");
+    switch (m.method) {
+        case "initialize":
+            return rpcResult(id, {
+                protocolVersion: protocolVersionOf(m.params),
+                capabilities: { tools: {} },
+                serverInfo: { name: "wardby", version: SERVER_VERSION },
+            });
+        case "ping":
+            return rpcResult(id, {});
+        case "tools/list":
+            return rpcResult(id, {
+                tools: mcpToolDefs(storedPins(session.mcpTools)).map((def) => ({
+                    name: def.name,
+                    description: def.description,
+                    inputSchema: def.jsonSchema,
+                })),
+            });
+        case "tools/call":
+            return rpcResult(id, await callTool(session, m.params, deps, signal));
+        default:
+            return rpcError(200, id, -32601, "Method not found.");
+    }
+}
+function protocolVersionOf(params) {
+    const requested = params?.protocolVersion;
+    return typeof requested === "string" && /^\d{4}-\d{2}-\d{2}$/.test(requested)
+        ? requested
+        : CODING_MCP_DEFAULT_PROTOCOL_VERSION;
+}
+async function authenticate(authorization, deps) {
+    const token = /^Bearer (\S+)$/.exec(authorization ?? "")?.[1];
+    if (!isMcpToken(token))
+        return undefined;
+    const session = await deps.db.codingProxySession.findUnique({
+        where: { mcpTokenHash: mcpTokenHash(token) },
+        select: {
+            id: true,
+            runId: true,
+            status: true,
+            deadlineAt: true,
+            mcpTools: true,
+            run: { select: { provider: true } },
+        },
+    });
+    if (!session || session.status !== "active")
+        return undefined;
+    if ((deps.now?.() ?? new Date()).getTime() >= session.deadlineAt.getTime())
+        return undefined;
+    // A stopped or cancelled run's session can still read active for a moment: its token ends with the
+    // run, as an ended session's does (401, so no call starts and no tool is listed).
+    if ((await runDrivability(deps.db, session.runId)) !== "drivable")
+        return undefined;
+    return session;
+}
+async function callTool(session, params, deps, requestSignal) {
+    const p = (params ?? {});
+    const name = typeof p.name === "string" ? p.name : "";
+    const pin = storedPins(session.mcpTools).find((candidate) => candidate.exposedName === name);
+    if (!pin) {
+        return toolError("mcp_tool_not_allowed", `The tool "${name.slice(0, 128)}" is not one of this run's MCP tools.`);
+    }
+    const limit = loadMcpMaxCallsPerRun();
+    const counted = await deps.db.$queryRaw `
+    UPDATE "CodingProxySession" SET "mcpCallCount" = "mcpCallCount" + 1
+    WHERE "id" = ${session.id} AND "mcpCallCount" < ${limit}
+    RETURNING "mcpCallCount"
+  `;
+    if (counted.length === 0) {
+        return toolError("mcp_call_limit", `This run reached its limit of ${limit} MCP tool calls.`);
+    }
+    const run = await deps.db.run.findUnique({ where: { id: session.runId }, select: { agentId: true } });
+    if (!run)
+        return toolError("mcp_tool_not_allowed", "This run no longer exists.");
+    // As for a native run's call: a stop_run aborts the call in flight.
+    // The proxy closing its request (its forward limit, or the worker gone) aborts it too.
+    const stop = watchRunStop(deps.db, session.runId, deps.stopPollMs ?? TOOL_STOP_POLL_MS);
+    const signal = requestSignal ? AbortSignal.any([stop.signal, requestSignal]) : stop.signal;
+    try {
+        const text = await handleMcpTool(pin, p.arguments === undefined ? "" : JSON.stringify(p.arguments), {
+            db: deps.db,
+            cipher: deps.cipher,
+            agentId: run.agentId,
+            runId: session.runId,
+            signal,
+            deadlineAt: session.deadlineAt,
+            readOnlyOnly: isCodexCoding(session.run.provider),
+            fetchImpl: deps.fetchImpl,
+            log: deps.log,
+        });
+        return toolResult(text, isMcpErrorText(text));
+    }
+    finally {
+        stop.done();
+    }
+}

package/dist/core/coding-queue.d.ts

@@ -5,7 +5,8 @@
  *
  *  1. fails queued runs that waited longer than CODING_QUEUE_TIMEOUT_SEC
  *     (coding_queue_timeout), with a conditional update so concurrent
- *     drains never double-fail a run;
+ *     drains never double-fail a run, then lets the executor clean up after
+ *     each (Executor.cleanupQueueTimeout);
  *  2. starts the oldest queued runs, at most as many as there are free
  *     slots, so order stays FIFO in practice. Starting is fire-and-forget,
  *     like dispatchRun: Executor.start resolves only when the run ends.

package/dist/core/coding-queue.js

@@ -30,6 +30,13 @@ export async function drainCodingQueue(options) {
             timedOut += 1;
             // Only this drain made the row failed (a concurrent drain matched zero rows); bounded, never throws.
             await fileSelfDefectForRun(options.selfDefects, runId);
+            // What a launch the cluster refused left behind (a continuation's in-progress check, its input).
+            try {
+                await executor.cleanupQueueTimeout?.(runId);
+            }
+            catch (err) {
+                queueLog.warn({ err, runId }, "queue-timeout cleanup failed");
+            }
         }
     }
     const active = await db.codingRun.count({

package/dist/core/coding-repository.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Which repository a coding run works in: the agent's default
+ * (codingProfile.repository) or one of its write links without triggers.
+ * Every entry point goes through here. Errors never carry the requested value:
+ * it is caller- or model-written text and could hold a secret.
+ */
+import type { Prisma } from "#prisma";
+export type CodingRepositoryReader = Pick<Prisma.TransactionClient, "agentRepository" | "codingRun">;
+export interface CodingRepositoryTarget {
+    repository: string;
+    baseRef: string;
+    viaRepositoryLink: boolean;
+}
+export type RepositoryRefusalCode = "repository_required" | "repository_not_listed";
+export declare class RepositoryChoiceRefusedError extends Error {
+    readonly code: RepositoryRefusalCode;
+    readonly allowed: readonly string[];
+    constructor(code: RepositoryRefusalCode, allowed: readonly string[]);
+}
+/** Which of an agent's links are repositories on a coding agent's list. */
+export declare const CODING_REPOSITORY_LINK_FILTER: {
+    readonly access: "write";
+    readonly triggers: {
+        readonly isEmpty: true;
+    };
+};
+/**
+ * The repositories a list adds to its default. A link can come to equal the default when
+ * update_agent moves the default onto it; that link adds nothing, and a run there is on the default.
+ */
+export declare function extraCodingRepositoryLinks<Link extends {
+    repository: string;
+}>(links: readonly Link[], defaultRepository: string): Link[];
+/** Whether the agent has more than its default, for wording only: authorization is resolveCodingRepository's. */
+export declare function hasCodingRepositoryList(reader: Pick<CodingRepositoryReader, "agentRepository">, agentId: string, defaultRepository: string): Promise<boolean>;
+export declare function resolveCodingRepository(reader: CodingRepositoryReader, input: {
+    agentId: string;
+    profile: {
+        repository: string;
+        baseRef: string;
+    };
+    requested?: string;
+    continuesCodingRunId?: string;
+    /** A delegation must name its repository when the agent has more than its default. */
+    requireExplicit?: boolean;
+}): Promise<CodingRepositoryTarget>;