@wardby/cli 0.6.0 → 0.8.0

package/dist/core/grants.d.ts

@@ -14,23 +14,25 @@ export declare const LEVELS: {
     readonly agent: readonly ["read", "execute", "write"];
     readonly tool: readonly ["read", "use", "write"];
     readonly budget_group: readonly ["read", "use", "write"];
+    readonly mcp_server: readonly ["read", "use", "write"];
 };
 export type ResourceType = keyof typeof LEVELS;
 export type Level<T extends ResourceType = ResourceType> = (typeof LEVELS)[T][number];
 export type Access<T extends ResourceType = ResourceType> = "none" | Level<T> | "owner";
 /**
- * Highest level an "everyone" grant may carry: never write. Everyone-write
- * on an agent would bring back the old public-mutable model (anyone
- * rewriting the prompt of an agent that holds its owner's tools and
- * secrets). Also applied when a stored everyone row is read, so a row
- * written around grant_access can't exceed it either.
+ * Highest level an "everyone" grant may carry. Agents may be public-write
+ * (anyone signed in can edit them) but only while they hold none of their
+ * owner's bindings: see agentOwnerBindings and the guard in grant_access and
+ * the binding tools. Otherwise anyone could rewrite the prompt of an agent
+ * that holds its owner's secrets.
  */
 export declare const EVERYONE_MAX: {
-    readonly agent: "execute";
+    readonly agent: "write";
     readonly tool: "use";
     readonly budget_group: "use";
+    readonly mcp_server: "use";
 };
-/** Types grant_access/revoke_access accept today (Phase 1: agents only). */
+/** Types grant_access/revoke_access accept today: agents and MCP servers. */
 export declare const SHAREABLE_TYPES: readonly ResourceType[];
 export declare const EVERYONE_KEY = "everyone";
 export declare function principalGranteeKey(principalId: string): string;
@@ -74,7 +76,7 @@ export declare function canDelegate(db: GrantDb, parent: {
 }): Promise<boolean>;
 /** The create-data for an everyone grant (migration, import, CLI --public). */
 export declare function everyoneGrantData(type: ResourceType, resourceId: string, level: string, source: string): {
-    resourceType: "tool" | "agent" | "budget_group";
+    resourceType: "tool" | "agent" | "budget_group" | "mcp_server";
     resourceId: string;
     granteeKind: string;
     granteePrincipalId: null;
@@ -82,5 +84,41 @@ export declare function everyoneGrantData(type: ResourceType, resourceId: string
     level: string;
     source: string;
 };
+/**
+ * True when `ownerId` owns the MCP server or holds use (or higher) on it through a grant. An agent's MCP
+ * attachment is legitimate only while its owner can use the server: runs check it on load and on every
+ * call, and the cleanup paths (make_owner, adopt-public, prune-bindings, revoke_access and grant_access
+ * lowering a level) drop the attachments that fail it.
+ */
+export declare function ownerCanUseMcpServer(db: GrantDb, ownerId: string | null, server: {
+    id: string;
+    ownerId: string | null;
+}): Promise<boolean>;
+/** Keeps the items whose server the owner cannot use (see ownerCanUseMcpServer). */
+export declare function filterUnusableMcpServers<T extends {
+    server: {
+        id: string;
+        ownerId: string | null;
+    };
+}>(db: GrantDb, ownerOf: (item: T) => string | null, items: T[]): Promise<T[]>;
+/**
+ * After a grant on an MCP server is revoked or lowered: deletes the server's attachments whose agent owner
+ * can no longer use it (see ownerCanUseMcpServer), in the caller's transaction. The server owner's own
+ * agents are never touched. Returns how many were removed.
+ */
+export declare function pruneUnusableMcpAttachments(db: GrantDb & Pick<PrismaClient, "agentMcpServer">, serverId: string): Promise<number>;
 /** Every resource delete path calls this in the same transaction (no FK on resourceId). */
 export declare function deleteGrantsFor(db: GrantDb, type: ResourceType, resourceId: string): Promise<number>;
+type BindingDb = Pick<PrismaClient, "agentSecret" | "agentDatastore" | "agentRepository" | "agentSubAgent" | "agentTool" | "codingAgentProfile" | "agentMcpServer">;
+/**
+ * The owner-only bindings an agent holds, by kind (empty = none). An agent
+ * may be public-write only while this is empty; binding a secret, datastore,
+ * repository, sub-agent or owner-granted tool capability to a public-write
+ * agent is refused for the same reason. A coding profile counts: its
+ * repository is the owner's GitHub access, and the prompt is part of every
+ * coding task.
+ */
+export declare function agentOwnerBindings(db: BindingDb, agentId: string): Promise<string[]>;
+/** True when everyone holds write on the agent. */
+export declare function isPublicWritable(db: GrantDb, agentId: string): Promise<boolean>;
+export {};

package/dist/core/grants.js

@@ -2,17 +2,18 @@ export const LEVELS = {
     agent: ["read", "execute", "write"],
     tool: ["read", "use", "write"],
     budget_group: ["read", "use", "write"],
+    mcp_server: ["read", "use", "write"],
 };
 /**
- * Highest level an "everyone" grant may carry: never write. Everyone-write
- * on an agent would bring back the old public-mutable model (anyone
- * rewriting the prompt of an agent that holds its owner's tools and
- * secrets). Also applied when a stored everyone row is read, so a row
- * written around grant_access can't exceed it either.
+ * Highest level an "everyone" grant may carry. Agents may be public-write
+ * (anyone signed in can edit them) but only while they hold none of their
+ * owner's bindings: see agentOwnerBindings and the guard in grant_access and
+ * the binding tools. Otherwise anyone could rewrite the prompt of an agent
+ * that holds its owner's secrets.
  */
-export const EVERYONE_MAX = { agent: "execute", tool: "use", budget_group: "use" };
-/** Types grant_access/revoke_access accept today (Phase 1: agents only). */
-export const SHAREABLE_TYPES = ["agent"];
+export const EVERYONE_MAX = { agent: "write", tool: "use", budget_group: "use", mcp_server: "use" };
+/** Types grant_access/revoke_access accept today: agents and MCP servers. */
+export const SHAREABLE_TYPES = ["agent", "mcp_server"];
 export const EVERYONE_KEY = "everyone";
 export function principalGranteeKey(principalId) {
     return `principal:${principalId}`;
@@ -119,8 +120,98 @@ export function everyoneGrantData(type, resourceId, level, source) {
         source,
     };
 }
+/**
+ * True when `ownerId` owns the MCP server or holds use (or higher) on it through a grant. An agent's MCP
+ * attachment is legitimate only while its owner can use the server: runs check it on load and on every
+ * call, and the cleanup paths (make_owner, adopt-public, prune-bindings, revoke_access and grant_access
+ * lowering a level) drop the attachments that fail it.
+ */
+export async function ownerCanUseMcpServer(db, ownerId, server) {
+    if (ownerId === null)
+        return false;
+    return atLeast("mcp_server", await effectiveAccess(db, "mcp_server", server, ownerId), "use");
+}
+/** Keeps the items whose server the owner cannot use (see ownerCanUseMcpServer). */
+export async function filterUnusableMcpServers(db, ownerOf, items) {
+    const unusable = [];
+    for (const item of items) {
+        if (!(await ownerCanUseMcpServer(db, ownerOf(item), item.server)))
+            unusable.push(item);
+    }
+    return unusable;
+}
+/**
+ * After a grant on an MCP server is revoked or lowered: deletes the server's attachments whose agent owner
+ * can no longer use it (see ownerCanUseMcpServer), in the caller's transaction. The server owner's own
+ * agents are never touched. Returns how many were removed.
+ */
+export async function pruneUnusableMcpAttachments(db, serverId) {
+    const rows = await db.agentMcpServer.findMany({
+        where: { serverId },
+        include: { server: { select: { id: true, ownerId: true } }, agent: { select: { ownerId: true } } },
+    });
+    const unusable = await filterUnusableMcpServers(db, (row) => row.agent.ownerId, rows);
+    if (unusable.length === 0)
+        return 0;
+    const { count } = await db.agentMcpServer.deleteMany({
+        where: { serverId, agentId: { in: unusable.map((row) => row.agentId) } },
+    });
+    return count;
+}
 /** Every resource delete path calls this in the same transaction (no FK on resourceId). */
 export async function deleteGrantsFor(db, type, resourceId) {
     const { count } = await db.resourceGrant.deleteMany({ where: { resourceType: type, resourceId } });
     return count;
 }
+/**
+ * The owner-only bindings an agent holds, by kind (empty = none). An agent
+ * may be public-write only while this is empty; binding a secret, datastore,
+ * repository, sub-agent or owner-granted tool capability to a public-write
+ * agent is refused for the same reason. A coding profile counts: its
+ * repository is the owner's GitHub access, and the prompt is part of every
+ * coding task.
+ */
+export async function agentOwnerBindings(db, agentId) {
+    const [secrets, datastores, repositories, subagents, capabilityTools, codingProfiles, mcpServers] = await Promise.all([
+        db.agentSecret.count({ where: { agentId } }),
+        db.agentDatastore.count({ where: { agentId } }),
+        db.agentRepository.count({ where: { agentId } }),
+        db.agentSubAgent.count({ where: { parentAgentId: agentId } }),
+        // The owner's attach_tool stamps its consent even when it grants nothing:
+        // only an attachment that carries a capability counts.
+        db.agentTool.count({
+            where: {
+                agentId,
+                capabilitiesGrantedById: { not: null },
+                NOT: {
+                    allowedSecrets: { equals: [] },
+                    allowedDatastorePrefixes: { equals: [] },
+                    allowedHosts: { equals: [] },
+                    allowedSharedDatastorePrefixes: { equals: {} },
+                },
+            },
+        }),
+        db.codingAgentProfile.count({ where: { agentId } }),
+        // A server's brokered secrets act for its owner on every call.
+        db.agentMcpServer.count({ where: { agentId } }),
+    ]);
+    return Object.entries({
+        secrets,
+        datastores,
+        repositories,
+        "sub-agents": subagents,
+        "tool capabilities": capabilityTools,
+        "a coding repository": codingProfiles,
+        "MCP servers": mcpServers,
+    })
+        .filter(([, count]) => count > 0)
+        .map(([kind]) => kind);
+}
+/** True when everyone holds write on the agent. */
+export async function isPublicWritable(db, agentId) {
+    const row = await db.resourceGrant.findFirst({
+        where: { resourceType: "agent", resourceId: agentId, granteeKey: EVERYONE_KEY },
+        select: { level: true },
+    });
+    return row !== null && atLeast("agent", row.level, "write");
+}

package/dist/core/host-events.d.ts

@@ -13,7 +13,7 @@ import { type OpenSibling } from "./related-pull-requests.js";
 import { type RepoAccessGate } from "./repo-access.js";
 import { type DriftScope } from "../knowledge/relevance.js";
 export type { HostEvent };
-export type HostEventDb = Pick<PrismaClient, "agentRepository" | "deferredReview" | "agent" | "run" | "runHostCheck" | "runHostStatus" | "codingRun" | "task" | "webhook" | "budgetGroup" | "issuePullRequest" | "workItem" | "runAttribution" | "agentIssueProject" | "$transaction" | "$queryRaw">;
+export type HostEventDb = Pick<PrismaClient, "runBudgetEvent" | "agentRepository" | "deferredReview" | "agent" | "run" | "runHostCheck" | "runHostStatus" | "codingRun" | "registryFetch" | "registryAuditRecord" | "task" | "webhook" | "budgetGroup" | "issuePullRequest" | "workItem" | "runAttribution" | "agentIssueProject" | "$transaction" | "$queryRaw">;
 export interface RouteHostEventDeps {
     db: HostEventDb;
     executor: Executor;
@@ -24,6 +24,12 @@ export interface RouteHostEventDeps {
     repoAccess: RepoAccessGate;
     /** Issue trackers for moving/commenting on the issue a closed PR was opened for; absent → pr_closed is ignored. */
     issueTrackers?: IssueTrackerRegistry;
+    /**
+     * False (WARDBY_MENTION_EXPLANATIONS=false): a mention that starts nothing gets no
+     * reply saying why. The reply is a comment anyone who can see the repository reads,
+     * so a deployment may keep what is linked there to itself. Absent = true.
+     */
+    mentionExplanations?: boolean;
 }
 /** What starting a review needs: everything routing needs except the mention handle. */
 export type ReviewStartDeps = Omit<RouteHostEventDeps, "mentionHandle">;
@@ -38,6 +44,7 @@ export interface RouteResult {
     /** Cosmetic work to do after the webhook response is sent (reactions, status comments). */
     followUps: Array<() => Promise<void>>;
 }
+/** A `@app review` outside code: quoting the command in code documents it. */
 export declare function isReviewCommand(body: string, mentionHandle: string): boolean;
 type PushEvent = Extract<HostEvent, {
     kind: "push";
@@ -56,7 +63,7 @@ type ConceptCitationStatus = {
  * commits, so they and the affected concept paths travel as untrusted context.
  * Commit messages and author names are never included.
  */
-export declare function mergeTaskText(event: PushEvent, scope: DriftScope | null, bundleComplete?: boolean, citations?: ReadonlyMap<string, ConceptCitationStatus>): string;
+export declare function mergeTaskText(event: PushEvent, scope: DriftScope | null, bundleComplete?: boolean, citations?: ReadonlyMap<string, ConceptCitationStatus>, bundlePath?: string): string;
 type MentionEvent = Extract<HostEvent, {
     kind: "mention";
 }>;
@@ -83,7 +90,16 @@ export declare function siblingContinuationHints(siblings: readonly OpenSibling[
  * taskOverride column.
  */
 export declare function mentionTaskText(event: MentionEvent, siblings?: readonly OpenSibling[]): string;
+/** The reply to a mention whose author can see the repository but cannot push to it. */
+export declare const NO_WRITE_ACCESS_BODY: string;
 export declare function unknownPriorRunBody(priorRunId: string): string;
+/** Why a mention from someone allowed to use wardby started nothing; posted so they are not left guessing. */
+export type MentionDeclineReason = "no_responder" | "no_reviewer" | "agent_not_authorized" | "pull_request_not_reviewable";
+/**
+ * Never names the App's handle: this comment is posted by the App, and a
+ * body that mentioned it could be matched as a mention of itself.
+ */
+export declare function mentionDeclinedBody(reason: MentionDeclineReason): string;
 export interface ReviewTarget {
     agentId: string;
     checkName: string;