@wardby/cli 0.6.0 → 0.8.0

package/dist/knowledge/concept.d.ts

@@ -4,28 +4,12 @@ export declare const RESERVED_BUNDLE_FILES: Set<string>;
 declare const CitationSchema: z.ZodObject<{
     id: z.ZodOptional<z.ZodString>;
     repo: z.ZodString;
-    path: z.ZodEffects<z.ZodString, string, string>;
-    lines: z.ZodOptional<z.ZodEffects<z.ZodTuple<[z.ZodNumber, z.ZodNumber], null>, [number, number], [number, number]>>;
+    path: z.ZodString;
+    lines: z.ZodOptional<z.ZodTuple<[z.ZodNumber, z.ZodNumber], null>>;
     symbol: z.ZodOptional<z.ZodString>;
     sha: z.ZodString;
     spanHash: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    path: string;
-    repo: string;
-    sha: string;
-    spanHash: string;
-    symbol?: string | undefined;
-    id?: string | undefined;
-    lines?: [number, number] | undefined;
-}, {
-    path: string;
-    repo: string;
-    sha: string;
-    spanHash: string;
-    symbol?: string | undefined;
-    id?: string | undefined;
-    lines?: [number, number] | undefined;
-}>;
+}, z.core.$strip>;
 export type KnowledgeCitation = z.infer<typeof CitationSchema>;
 export interface ParsedConcept {
     path: string;

package/dist/knowledge/location.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Where a repository's knowledge bundle lives (docs/knowledge.md, "Where the
+ * bundle lives"): the folder `.wardby/knowledge.yaml` names, else
+ * DEFAULT_KNOWLEDGE_BUNDLE_PATH. A missing, unreadable, or invalid file never
+ * fails anything: it degrades to the default, with a warning when the file
+ * exists but cannot be used.
+ */
+export declare const KNOWLEDGE_CONFIG_PATH = ".wardby/knowledge.yaml";
+export declare const KNOWLEDGE_CONFIG_MAX_BYTES: number;
+export interface KnowledgeLocation {
+    bundlePath: string;
+    /** Set when `.wardby/knowledge.yaml` exists but was ignored, saying why. */
+    warning?: string;
+}
+export type KnowledgeConfigParse = {
+    ok: true;
+    bundlePath: string;
+} | {
+    ok: false;
+    error: string;
+};
+/** `path: <repo-relative folder>`, the file's only key. */
+export declare function parseKnowledgeConfig(text: string): KnowledgeConfigParse;
+/** A repo-relative POSIX folder, without `./` or trailing slashes, outside `.wardby/` and `.git/`. */
+export declare function normalizeBundlePath(raw: string): KnowledgeConfigParse;
+/**
+ * The bundle location, given a reader for `.wardby/knowledge.yaml` that
+ * returns null when the file does not exist. A reader that throws, like an
+ * invalid file, yields the default with a warning.
+ */
+export declare function resolveKnowledgeLocation(readConfig: () => Promise<string | null | undefined>): Promise<KnowledgeLocation>;

package/dist/knowledge/location.js

@@ -0,0 +1,78 @@
+import { parse as parseYaml } from "yaml";
+import { DEFAULT_KNOWLEDGE_BUNDLE_PATH } from "./concept.js";
+/**
+ * Where a repository's knowledge bundle lives (docs/knowledge.md, "Where the
+ * bundle lives"): the folder `.wardby/knowledge.yaml` names, else
+ * DEFAULT_KNOWLEDGE_BUNDLE_PATH. A missing, unreadable, or invalid file never
+ * fails anything: it degrades to the default, with a warning when the file
+ * exists but cannot be used.
+ */
+export const KNOWLEDGE_CONFIG_PATH = ".wardby/knowledge.yaml";
+export const KNOWLEDGE_CONFIG_MAX_BYTES = 4 * 1024;
+const MAX_BUNDLE_PATH_LENGTH = 200;
+/** `path: <repo-relative folder>`, the file's only key. */
+export function parseKnowledgeConfig(text) {
+    let doc;
+    try {
+        doc = parseYaml(text);
+    }
+    catch {
+        return { ok: false, error: "it is not valid YAML" };
+    }
+    if (typeof doc !== "object" || doc === null || Array.isArray(doc))
+        return { ok: false, error: "it must be a mapping with a `path` key" };
+    const keys = Object.keys(doc);
+    const unknown = keys.filter((k) => k !== "path");
+    if (unknown.length > 0)
+        return { ok: false, error: `unknown key ${unknown.map((k) => `\`${k}\``).join(", ")}` };
+    const { path } = doc;
+    if (typeof path !== "string")
+        return { ok: false, error: "`path` must be a string" };
+    return normalizeBundlePath(path);
+}
+/** A repo-relative POSIX folder, without `./` or trailing slashes, outside `.wardby/` and `.git/`. */
+export function normalizeBundlePath(raw) {
+    let path = raw.trim();
+    while (path.startsWith("./"))
+        path = path.slice(2);
+    path = path.replace(/\/+$/, "");
+    if (path === "" || path === ".")
+        return { ok: false, error: "`path` must name a folder inside the repository" };
+    if (path.length > MAX_BUNDLE_PATH_LENGTH)
+        return { ok: false, error: `\`path\` must be at most ${MAX_BUNDLE_PATH_LENGTH} characters` };
+    // eslint-disable-next-line no-control-regex
+    if (/[\u0000-\u001f\u007f\\]/.test(path))
+        return { ok: false, error: "`path` must be a plain POSIX path" };
+    if (path.startsWith("/"))
+        return { ok: false, error: "`path` must be relative to the repository root" };
+    const segments = path.split("/");
+    if (segments.some((s) => s === "" || s === "." || s === ".."))
+        return { ok: false, error: "`path` must not contain empty, `.` or `..` segments" };
+    if (segments[0] === ".wardby" || segments[0] === ".git")
+        return { ok: false, error: "`path` must not be inside `.wardby/` or `.git/`" };
+    return { ok: true, bundlePath: path };
+}
+/**
+ * The bundle location, given a reader for `.wardby/knowledge.yaml` that
+ * returns null when the file does not exist. A reader that throws, like an
+ * invalid file, yields the default with a warning.
+ */
+export async function resolveKnowledgeLocation(readConfig) {
+    let text;
+    try {
+        text = await readConfig();
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        return { bundlePath: DEFAULT_KNOWLEDGE_BUNDLE_PATH, warning: ignoredWarning(`it could not be read (${reason})`) };
+    }
+    if (text === null || text === undefined)
+        return { bundlePath: DEFAULT_KNOWLEDGE_BUNDLE_PATH };
+    const parsed = parseKnowledgeConfig(text);
+    if (!parsed.ok)
+        return { bundlePath: DEFAULT_KNOWLEDGE_BUNDLE_PATH, warning: ignoredWarning(parsed.error) };
+    return { bundlePath: parsed.bundlePath };
+}
+function ignoredWarning(reason) {
+    return `${KNOWLEDGE_CONFIG_PATH} was ignored because ${reason}; using ${DEFAULT_KNOWLEDGE_BUNDLE_PATH}/.`;
+}

package/dist/mcp/auth/access.d.ts

@@ -38,16 +38,17 @@ export declare function assertAgentAccess<A extends AgentRef>(ctx: McpRequestCon
 export declare function requireAgentAccess(ctx: McpRequestContext, id: string, required: AgentLevel | "owner", db?: Pick<PrismaClient, "agent" | "resourceGrant">): Promise<{
     agent: {
         name: string;
+        updatedAt: Date;
         model: string;
         budgetUsd: import("@prisma/client-runtime-utils").Decimal;
         maxTurns: number;
-        createdAt: Date;
-        updatedAt: Date;
         kind: import("#prisma").AgentKind;
+        createdAt: Date;
         id: string;
         ownerId: string | null;
         nativeExecutionMode: import("#prisma").NativeExecutionMode;
         systemPrompt: string;
+        allowedOverrunPercent: number;
         schedule: string | null;
         timezone: string;
         scheduleEnabled: boolean;
@@ -68,6 +69,13 @@ export declare function requireAgentAccess(ctx: McpRequestContext, id: string, r
  * it can adopt the agent first (make_owner / grants adopt-public).
  */
 export declare function requireBindingOwner(ctx: McpRequestContext, agent: AgentRef): void;
+/**
+ * requireBindingOwner, plus: nothing owner-held may be bound to an agent
+ * everyone can write (anyone could then rewrite it to use the binding).
+ */
+export declare function requireBindable(ctx: McpRequestContext, agent: AgentRef, db?: GrantDb): Promise<void>;
+/** The public-write half of requireBindable, for paths that skip the owner check (an admin's adminOverride). */
+export declare function requireNotPublicWritable(agent: AgentRef, db: GrantDb): Promise<void>;
 /** Prisma where for agent listings: own rows plus rows granted >= read; the operator sees all. */
 export declare function readableAgentsWhere(ctx: McpRequestContext, db?: GrantDb): Promise<Prisma.AgentWhereInput>;
 /** One grant lookup for a whole listing: returns agent -> the caller's access. */

package/dist/mcp/auth/access.js

@@ -1,4 +1,4 @@
-import { atLeast, effectiveAccess, grantedAccessMap, grantedIds } from "../../core/grants.js";
+import { atLeast, effectiveAccess, grantedAccessMap, grantedIds, isPublicWritable, } from "../../core/grants.js";
 import { McpError } from "../errors.js";
 export function agentNotFound(id) {
     return new McpError(404, `Agent "${id}" not found.`);
@@ -42,6 +42,20 @@ export function requireBindingOwner(ctx, agent) {
         throw new McpError(403, `Only the owner of agent "${agent.id}" can change its bindings.`);
     }
 }
+/**
+ * requireBindingOwner, plus: nothing owner-held may be bound to an agent
+ * everyone can write (anyone could then rewrite it to use the binding).
+ */
+export async function requireBindable(ctx, agent, db = ctx.db) {
+    requireBindingOwner(ctx, agent);
+    await requireNotPublicWritable(agent, db);
+}
+/** The public-write half of requireBindable, for paths that skip the owner check (an admin's adminOverride). */
+export async function requireNotPublicWritable(agent, db) {
+    if (await isPublicWritable(db, agent.id)) {
+        throw new McpError(409, `Agent "${agent.id}" is writable by everyone, so nothing can be bound to it; revoke or lower the everyone grant first.`);
+    }
+}
 /** Prisma where for agent listings: own rows plus rows granted >= read; the operator sees all. */
 export async function readableAgentsWhere(ctx, db = ctx.db) {
     if (ctx.operator)

package/dist/mcp/auth/grants-cli.d.ts

@@ -77,16 +77,18 @@ export interface MigrationReport {
 }
 export declare function migrationReport(db: ReportDb): Promise<MigrationReport>;
 export declare function formatMigrationReport(report: MigrationReport): string;
+/** A binding that belongs to its resource's owner; for an MCP server, boundName is the server name. */
+export type BindingKind = "secret" | "datastore" | "mcp_server";
 export interface AdoptedAgent {
     agentId: string;
     name: string;
     bindingsRemoved: {
-        kind: "secret" | "datastore";
+        kind: BindingKind;
         boundName: string;
         resourceId: string;
     }[];
     bindingsKept: {
-        kind: "secret" | "datastore";
+        kind: BindingKind;
         boundName: string;
     }[];
     capabilitiesStamped: string[];
@@ -126,7 +128,7 @@ export declare function formatAdoptResult(result: AdoptResult): string;
 export interface PruneResult {
     dryRun: boolean;
     removed: {
-        kind: "secret" | "datastore";
+        kind: BindingKind;
         agentId: string;
         agentName: string;
         boundName: string;
@@ -134,7 +136,7 @@ export interface PruneResult {
         resourceOwnerId: string | null;
     }[];
 }
-/** Deletes cross-owner secret/datastore bindings on owned agents, in one transaction. */
+/** Deletes cross-owner secret/datastore/MCP server bindings on owned agents, in one transaction. */
 export declare function pruneBindings(db: PrismaClient, opts: {
     dryRun: boolean;
 }): Promise<PruneResult>;

package/dist/mcp/auth/grants-cli.js

@@ -14,13 +14,13 @@
  *   owner's own bindings, deleting the rest, and stamping the new owner's
  *   consent on attachments of its own tools. Other attachments stay inert
  *   and are printed with the attach_tool call that re-grants them.
- * - prune-bindings deletes the secret/datastore bindings on owned agents
+ * - prune-bindings deletes the secret/datastore/MCP server bindings on owned agents
  *   whose resource another principal owns (inert at run time since the
  *   grants release) and prints each one: the "removed and listed" record.
  */
 import { parseArgs } from "node:util";
 import { Prisma } from "#prisma";
-import { canDelegate } from "../../core/grants.js";
+import { canDelegate, filterUnusableMcpServers } from "../../core/grants.js";
 import { resolvePrincipal } from "./principal.js";
 const USAGE = "Use grants migration-report [--json] | grants adopt-public --owner <subject> [--dry-run] [--keep-everyone-execute] | grants prune-bindings [--dry-run].";
 /** The attach_tool call (MCP) that re-grants an attachment's capabilities, for its owner to review and run. */
@@ -276,8 +276,14 @@ export async function adoptPublic(db, opts) {
                     include: { datastore: { select: { ownerId: true } } },
                     orderBy: { boundName: "asc" },
                 });
+                const mcpServers = await tx.agentMcpServer.findMany({
+                    where: { agentId: id },
+                    include: { server: { select: { id: true, name: true, ownerId: true } } },
+                    orderBy: { serverId: "asc" },
+                });
                 const foreignSecrets = secrets.filter((b) => b.secret.ownerId !== owner.id);
                 const foreignDatastores = datastores.filter((b) => b.datastore.ownerId !== owner.id);
+                const foreignMcpServers = await filterUnusableMcpServers(tx, () => owner.id, mcpServers);
                 for (const b of foreignSecrets) {
                     await tx.agentSecret.delete({ where: { agentId_secretId: { agentId: id, secretId: b.secretId } } });
                 }
@@ -286,6 +292,9 @@ export async function adoptPublic(db, opts) {
                         where: { agentId_datastoreId: { agentId: id, datastoreId: b.datastoreId } },
                     });
                 }
+                for (const b of foreignMcpServers) {
+                    await tx.agentMcpServer.delete({ where: { agentId_serverId: { agentId: id, serverId: b.serverId } } });
+                }
                 // Only the tool's owner could attach its private tool to a public
                 // agent or change that attachment's capabilities, so those carry
                 // the new owner's consent. Everything else stays inert.
@@ -350,6 +359,11 @@ export async function adoptPublic(db, opts) {
                             boundName: b.boundName,
                             resourceId: b.datastoreId,
                         })),
+                        ...foreignMcpServers.map((b) => ({
+                            kind: "mcp_server",
+                            boundName: b.server.name,
+                            resourceId: b.serverId,
+                        })),
                     ],
                     bindingsKept: [
                         ...secrets
@@ -358,6 +372,9 @@ export async function adoptPublic(db, opts) {
                         ...datastores
                             .filter((b) => b.datastore.ownerId === owner.id)
                             .map((b) => ({ kind: "datastore", boundName: b.boundName })),
+                        ...mcpServers
+                            .filter((b) => !foreignMcpServers.includes(b))
+                            .map((b) => ({ kind: "mcp_server", boundName: b.server.name })),
                     ],
                     capabilitiesStamped: own.map((at) => at.tool.name),
                     foreignTools: attachments
@@ -411,7 +428,7 @@ export function formatAdoptResult(result) {
     }
     return lines.join("\n");
 }
-/** Deletes cross-owner secret/datastore bindings on owned agents, in one transaction. */
+/** Deletes cross-owner secret/datastore/MCP server bindings on owned agents, in one transaction. */
 export async function pruneBindings(db, opts) {
     return db.$transaction(async (tx) => {
         const secrets = await tx.agentSecret.findMany({
@@ -424,8 +441,17 @@ export async function pruneBindings(db, opts) {
             include: { agent: { select: { name: true, ownerId: true } }, datastore: { select: { ownerId: true } } },
             orderBy: [{ agentId: "asc" }, { boundName: "asc" }],
         });
+        const mcpServers = await tx.agentMcpServer.findMany({
+            where: { agent: { ownerId: { not: null } } },
+            include: {
+                agent: { select: { name: true, ownerId: true } },
+                server: { select: { id: true, name: true, ownerId: true } },
+            },
+            orderBy: [{ agentId: "asc" }, { serverId: "asc" }],
+        });
         const foreignSecrets = secrets.filter((b) => b.secret.ownerId !== b.agent.ownerId);
         const foreignDatastores = datastores.filter((b) => b.datastore.ownerId !== b.agent.ownerId);
+        const foreignMcpServers = await filterUnusableMcpServers(tx, (b) => b.agent.ownerId, mcpServers);
         if (!opts.dryRun) {
             for (const b of foreignSecrets) {
                 await tx.agentSecret.delete({ where: { agentId_secretId: { agentId: b.agentId, secretId: b.secretId } } });
@@ -435,6 +461,11 @@ export async function pruneBindings(db, opts) {
                     where: { agentId_datastoreId: { agentId: b.agentId, datastoreId: b.datastoreId } },
                 });
             }
+            for (const b of foreignMcpServers) {
+                await tx.agentMcpServer.delete({
+                    where: { agentId_serverId: { agentId: b.agentId, serverId: b.serverId } },
+                });
+            }
         }
         return {
             dryRun: opts.dryRun,
@@ -455,6 +486,14 @@ export async function pruneBindings(db, opts) {
                     resourceId: b.datastoreId,
                     resourceOwnerId: b.datastore.ownerId,
                 })),
+                ...foreignMcpServers.map((b) => ({
+                    kind: "mcp_server",
+                    agentId: b.agentId,
+                    agentName: b.agent.name,
+                    boundName: b.server.name,
+                    resourceId: b.serverId,
+                    resourceOwnerId: b.server.ownerId,
+                })),
             ],
         };
     }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });

package/dist/mcp/auth/ownership.d.ts

@@ -26,8 +26,8 @@ export declare function visibleToPrincipal(principalId: string): {
 };
 export declare function requireOwnedBudgetGroup(db: PrismaClient, id: string, principalId: string): Promise<{
     name: string;
-    createdAt: Date;
     updatedAt: Date;
+    createdAt: Date;
     id: string;
     ownerId: string | null;
     dailyBudgetUsd: import("@prisma/client-runtime-utils").Decimal | null;
@@ -37,8 +37,8 @@ export declare function requireOwnedBudgetGroup(db: PrismaClient, id: string, pr
 }>;
 export declare function requireReadableBudgetGroup(db: Pick<PrismaClient, "budgetGroup">, id: string, principalId: string): Promise<{
     name: string;
-    createdAt: Date;
     updatedAt: Date;
+    createdAt: Date;
     id: string;
     ownerId: string | null;
     dailyBudgetUsd: import("@prisma/client-runtime-utils").Decimal | null;
@@ -50,8 +50,8 @@ export declare function requireOwnedSecret(db: PrismaClient, id: string, princip
 export declare function requireOwnedWebhook(db: PrismaClient, id: string, principalId: string): Promise<void>;
 export declare function requireOwnedDatastore(db: PrismaClient, id: string, principalId: string): Promise<{
     name: string;
-    createdAt: Date;
     updatedAt: Date;
+    createdAt: Date;
     id: string;
     ownerId: string | null;
 }>;
@@ -72,14 +72,14 @@ export declare function assertStrictlyOwnedTool(tool: Tool | null, id: string, p
  * triggered them. No canRead/null=public path exists here on purpose.
  */
 export declare function requireOwnedTask(db: PrismaClient, taskId: string, principalId: string): Promise<{
+    updatedAt: Date;
     error: import("@prisma/client/runtime/client").JsonValue | null;
-    status: import("#prisma").TaskStatus;
     runId: string | null;
-    createdAt: Date;
-    updatedAt: Date;
-    kind: import("#prisma").TaskKind;
     result: import("@prisma/client/runtime/client").JsonValue | null;
+    kind: import("#prisma").TaskKind;
+    createdAt: Date;
     id: string;
+    status: import("#prisma").TaskStatus;
     principalId: string | null;
     inputRequests: import("@prisma/client/runtime/client").JsonValue | null;
     inputResponses: import("@prisma/client/runtime/client").JsonValue | null;

package/dist/mcp/auth/resource-server.d.ts

@@ -19,7 +19,9 @@ export declare const SCOPES_SUPPORTED: string[];
  * runs next to every coding run that names an entry; admin:view reads every
  * owner's runs (the admin viewer API); models:admin changes the model catalog,
  * which prices every principal's runs; power:manage scales the shared coding
- * proxy and native gateway to zero (power_sleep) and reads their state.
+ * proxy and native gateway to zero (power_sleep) and reads their state;
+ * hosts:admin registers host providers, whose approved tools run in the push
+ * and pull request flow.
  * A token scope only DELEGATES — it never authorizes on its own:
  * requireScope/requireAnyScope honour one only when one of the caller's
  * roles (McpRequestContext.roles, resolved live per request) grants it.

package/dist/mcp/auth/resource-server.js

@@ -30,6 +30,9 @@ export const SCOPES_SUPPORTED = [
     // Scale the coding proxy and native gateway to zero now (power_sleep) and
     // read their state (power_status); low-power mode only (docs/getting-started-gke.md).
     "power:manage",
+    // Register host providers and approve their tools (docs/host-providers.md).
+    // Bound tools decide who has permission and who wrote a comment.
+    "hosts:admin",
 ];
 /**
  * Scopes whose operations reach beyond the caller's own (or public)
@@ -40,7 +43,9 @@ export const SCOPES_SUPPORTED = [
  * runs next to every coding run that names an entry; admin:view reads every
  * owner's runs (the admin viewer API); models:admin changes the model catalog,
  * which prices every principal's runs; power:manage scales the shared coding
- * proxy and native gateway to zero (power_sleep) and reads their state.
+ * proxy and native gateway to zero (power_sleep) and reads their state;
+ * hosts:admin registers host providers, whose approved tools run in the push
+ * and pull request flow.
  * A token scope only DELEGATES — it never authorizes on its own:
  * requireScope/requireAnyScope honour one only when one of the caller's
  * roles (McpRequestContext.roles, resolved live per request) grants it.
@@ -52,16 +57,26 @@ export const PRIVILEGED_SCOPES = [
     "admin:view",
     "models:admin",
     "power:manage",
+    "hosts:admin",
 ];
 /**
  * The built-in roles and the permissions (privileged scope names) each
  * grants. No roles = member: every non-privileged scope, nothing privileged.
  */
 export const ROLE_PERMISSIONS = {
-    admin: ["agents:admin", "packages:approve", "services:manage", "admin:view", "models:admin", "power:manage"],
+    admin: [
+        "agents:admin",
+        "packages:approve",
+        "services:manage",
+        "admin:view",
+        "models:admin",
+        "power:manage",
+        "hosts:admin",
+    ],
     "package-approver": ["packages:approve"],
     "service-manager": ["services:manage"],
     "model-manager": ["models:admin"],
+    "host-manager": ["hosts:admin"],
 };
 export const ROLE_NAMES = Object.keys(ROLE_PERMISSIONS);
 export function isRoleName(name) {

package/dist/mcp/auth/self-hosted/credentials.d.ts

@@ -23,10 +23,10 @@ export declare function lockUser(tx: AuthDb, id: string): Promise<{
         subject: string;
     };
 } & {
-    status: string;
-    createdAt: Date;
     updatedAt: Date;
+    createdAt: Date;
     id: string;
+    status: string;
     roles: string[];
     displayName: string | null;
     principalId: string;
@@ -58,11 +58,11 @@ export declare class IdentityService {
     }>;
     revokeKey(keyId: string): Promise<void>;
     listUsers(): Prisma.PrismaPromise<{
+        id: string;
         status: string;
         principal: {
             subject: string;
         };
-        id: string;
         roles: string[];
         displayName: string | null;
     }[]>;

package/dist/mcp/auth/self-hosted/session.d.ts

@@ -16,10 +16,10 @@ export declare class Sessions {
                 subject: string;
             };
         } & {
-            status: string;
-            createdAt: Date;
             updatedAt: Date;
+            createdAt: Date;
             id: string;
+            status: string;
             roles: string[];
             displayName: string | null;
             principalId: string;

package/dist/mcp/context.d.ts

@@ -15,6 +15,7 @@ import type { IssueTrackerRegistry } from "../providers/issue-tracker/types.js";
 import type { HostUserAuthorizerRegistry, ReviewHostRegistry } from "../providers/review-host/types.js";
 import type { Power } from "../core/power.js";
 import type { ChatProviderRegistry } from "../providers/chat/types.js";
+import type { safeFetch } from "../sandbox/safe-fetch.js";
 export type McpProviders = Pick<ProviderRegistry, "llm" | "engine" | "datastore" | "secrets" | "executor" | "memory"> & {
     reviewHosts?: ReviewHostRegistry;
     /** Issue trackers (Jira); empty or absent = no issue-tracker integration. */
@@ -31,6 +32,8 @@ export type McpProviders = Pick<ProviderRegistry, "llm" | "engine" | "datastore"
     repoAccess?: RepoAccessGate;
     /** Low-power mode (scale idle proxy/gateway to zero); absent = DISABLED_POWER. */
     power?: Power;
+    /** Overrides the outbound call to remote MCP servers (register/update/refresh_mcp_server) — tests only. */
+    sandboxFetch?: typeof safeFetch;
 };
 export interface McpRequestContext {
     principal: Principal;

package/dist/mcp/host-events/github-ingress.d.ts

@@ -33,6 +33,8 @@ export interface GitHubIngressDeps {
     }>;
     /** Accounts served in addition to the App's owner (WARDBY_GITHUB_ALLOWED_ACCOUNTS). */
     allowedAccounts: () => ReadonlySet<string>;
+    /** False = no reply explaining why a mention started nothing (WARDBY_MENTION_EXPLANATIONS). */
+    mentionExplanations?: boolean;
     /** Removes the App from an installation on an account that isn't served; absent = ignore only. */
     uninstallInstallation?: (installationId: number) => Promise<void>;
     now?: () => Date;

package/dist/mcp/host-events/github-ingress.js

@@ -99,7 +99,7 @@ export async function handleGitHubEventIngress(req, deps) {
                 : {}),
         };
     }
-    const event = normalizeGitHubEvent(eventName, payload, app);
+    const event = normalizeGitHubEvent(eventName, payload, app, (dropped) => log.info({ ...dropped, deliveryId }, "mention ignored: its author did not pass the pre-filter"));
     // An event we don't act on must never claim the delivery id: recording it
     // here would let a later, real delivery of the same id (GitHub does reuse
     // ids across distinct redeliveries of what it considers the same event)
@@ -130,6 +130,7 @@ export async function handleGitHubEventIngress(req, deps) {
             repoAccess: deps.repoAccess,
             ...(deps.issueTrackers ? { issueTrackers: deps.issueTrackers } : {}),
             mentionHandle: app.slug,
+            ...(deps.mentionExplanations === false ? { mentionExplanations: false } : {}),
         });
         log.info({ event: event.kind, repository: event.repository, deliveryId, runIds: routed.runIds }, "host event routed");
         return {

package/dist/mcp/index.d.ts

@@ -12,6 +12,12 @@ export declare function localOperatorContext(principal: Principal, providers: Mc
 export declare function registerAllTools(mcp: WardbyMcpServer, opts: {
     secretElicitationUrl: SecretElicitationUrlBuilder;
     secretElicitationProtocol: boolean;
+    /** Builds a get_run_transcript download URL for a minted token; absent = transcripts are not served. */
+    runTranscriptUrl?: (token: string) => Promise<string>;
+    /** Whether a blob store is configured to serve run transcripts from. */
+    blobStoreConfigured?: boolean;
+    /** Which host serves those links (default http). */
+    runTranscriptAudience?: "stdio" | "http";
     /** Rebuilds the process's installed model CatalogStore after set_model/disable_model/reset_model. */
     refreshModelCatalog?: () => Promise<void>;
 }): void;