@wardby/cli 0.6.0 → 0.8.0

package/dist/mcp/tools/agents.js

@@ -7,25 +7,42 @@
  */
 import { Prisma } from "#prisma";
 import { z } from "zod";
+import { codeProviderOf } from "../../coding/code-host.js";
 import { CodingProfilePatchSchema, CodingProfileSchema } from "../../coding/profile.js";
-import { DEFAULT_CLAUDE_MAX_TURNS, MAX_CODING_TURNS, isLocalRepository } from "../../coding/protocol.js";
+import { DEFAULT_CLAUDE_MAX_OUTPUT_TOKENS, DEFAULT_CLAUDE_MAX_TURNS, MAX_CLAUDE_MAX_OUTPUT_TOKENS, MIN_CLAUDE_MAX_OUTPUT_TOKENS, DEFAULT_DEBUG_TRACE_MAX_MB, MAX_CODING_TURNS, MAX_DEBUG_TRACE_MAX_MB, isLocalRepository, } from "../../coding/protocol.js";
+import { loadBlobStoreConfig, loadContainerExecutorConfig } from "../../config/providers.js";
 import { codingProviderSupportsModel } from "../../coding/provider.js";
+import { ACCEPTED_ADVISORY_ID, MAX_ACCEPTED_ADVISORIES } from "../../coding/registry/allowlist.js";
+import { DEFAULT_PACKAGE_AUDIT_MINUTES, isPackageAuditActive, isPackageAuditMode, MAX_PACKAGE_AUDIT_MINUTES, PACKAGE_AUDIT_MODES, PackageAuditPatchError, packageAuditActiveWarning, resolvePackageAuditPatch, } from "../../coding/registry/audit-mode.js";
 import { assertAgentModelAvailable } from "../../core/run-pricing.js";
 import { ModelUnavailableError } from "../../providers/llm/catalog-types.js";
 import { currentModelCatalog } from "../../providers/llm/catalog-store.js";
 import { validateCronExpression } from "../../core/cron.js";
+import { scheduleStartFields } from "../../core/schedule-start.js";
+import { preferIndexScans, withSerializableRetry } from "../../core/serializable-retry.js";
 import { modelSupportedEfforts } from "../../providers/llm/routing.js";
+import { agentMcpServerViews, codexUnavailableMcpTools, codexWriteToolsWarning } from "./mcp-servers.js";
+import { isCodexCoding } from "../../core/mcp-tools.js";
 import { PROJECT_KEY } from "../../providers/issue-tracker/types.js";
 import { LLM_EFFORT_LEVELS, isLlmEffort } from "../../providers/llm/types.js";
 import { requireReadableBudgetGroup } from "../auth/ownership.js";
 import { agentAccessResolver, agentNotFound, assertAgentAccess, readableAgentsWhere, requireAgentAccess, } from "../auth/access.js";
-import { EVERYONE_KEY, atLeast, canDelegate, deleteGrantsFor, effectiveAccess } from "../../core/grants.js";
+import { EVERYONE_KEY, atLeast, canDelegate, deleteGrantsFor, effectiveAccess, isPublicWritable, filterUnusableMcpServers, } from "../../core/grants.js";
 import { projectTool } from "./tools.js";
+import { withZod3ToolWarnings } from "../../core/zod3-window.js";
 import { requireAnyScope, requireScope } from "../auth/resource-server.js";
 import { logger } from "../../core/logger.js";
 import { authorizeRepositoryForSet, canonicalLocalRepository, } from "../auth/repo-authorization.js";
 import { McpError } from "../errors.js";
 import { textResult } from "./text-result.js";
+function validateWorkspaceDiskMb(workspaceDiskMb) {
+    if (workspaceDiskMb == null)
+        return;
+    const { maxDiskMb } = loadContainerExecutorConfig();
+    if (workspaceDiskMb > maxDiskMb) {
+        throw new McpError(400, `workspaceDiskMb (${workspaceDiskMb} MiB) exceeds the deployment cap (${maxDiskMb} MiB). Raise CODING_MAX_DISK_MB to allow this size.`);
+    }
+}
 // workerImageRef is the BYO-arbitrary-image escape hatch (see
 // resolveCodingWorkerImage/resolveCodingToolImage in container.ts). For a Codex agent it
 // replaces the one container that runs the whole agent; for a Claude Code agent it replaces
@@ -67,12 +84,53 @@ function withOperatorMode(agent) {
         nativeExecutionMode: agent.kind !== "native" ? null : agent.nativeExecutionMode === "sandbox" ? "sandbox" : "control-plane",
     };
 }
+/** The warning create_agent / update_agent return (not a refusal): wardby can't tell how old a custom image is. */
+export const DEPENDENCY_CACHE_IMAGE_WARNING = "dependencyCache is on and this agent runs its own worker image (workerImageRef): rebuild that image FROM the wardby release that includes the dependency cache before its next run, or the run fails at input (worker_input_failed). See the dependency-cache help article.";
+export const SESSION_RESUME_IMAGE_WARNING = "sessionResume is on and this agent runs its own worker image (workerImageRef): rebuild that image FROM the wardby release that includes session resume before its next run, or the run fails at input (worker_input_failed).";
+export const SESSION_RESUME_NO_STORE_WARNING = "sessionResume is on but this server has no blob store (BLOB_STORE), so transcripts are not kept. See the resume-runs-locally help article.";
+/** For a warning only: a half-set BLOB_STORE (which throws) counts as none, and never fails the tool call. */
+function blobStoreConfigured() {
+    try {
+        return loadBlobStoreConfig(process.env) !== undefined;
+    }
+    catch {
+        return false;
+    }
+}
+/** Non-blocking warnings about an agent's coding profile as stored. */
+function profileWarnings(profile, now) {
+    const warnings = profile?.dependencyCache && profile.workerImageRef ? [DEPENDENCY_CACHE_IMAGE_WARNING] : [];
+    if (profile?.sessionResume && profile.workerImageRef)
+        warnings.push(SESSION_RESUME_IMAGE_WARNING);
+    if (profile?.sessionResume && !blobStoreConfigured())
+        warnings.push(SESSION_RESUME_NO_STORE_WARNING);
+    if (profile && isPackageAuditActive(profile.packageAuditMode, profile.packageAuditUntil, now))
+        warnings.push(packageAuditActiveWarning(profile.packageAuditMode, profile.packageAuditUntil));
+    return warnings;
+}
+/** An agent as returned to operators: profile warnings, and whether package audit mode is in force now. */
+function withProfileWarnings(agent) {
+    const now = new Date();
+    const profile = agent.codingProfile;
+    const shown = profile
+        ? {
+            ...agent,
+            codingProfile: {
+                ...profile,
+                packageAuditActive: isPackageAuditActive(profile.packageAuditMode, profile.packageAuditUntil, now),
+            },
+        }
+        : agent;
+    const warnings = profileWarnings(profile, now);
+    return warnings.length ? { ...shown, warnings } : shown;
+}
 const agentFields = {
     name: z.string().trim().min(1).max(MAX_AGENT_NAME_CHARS),
     systemPrompt: z.string().min(1).max(MAX_SYSTEM_PROMPT_CHARS),
     model: z.string().trim().min(1).max(MAX_MODEL_CHARS),
     budgetUsd: z.number().finite().positive().max(MAX_BUDGET_USD),
     maxTurns: z.number().int().min(1).max(100),
+    allowedOverrunPercent: z.number().int().min(0).max(100),
     maxDelegationsPerRun: z.number().int().min(1).max(MAX_DELEGATIONS_PER_RUN),
     parallelDelegations: z.boolean(),
     schedule: z.string().trim().min(1).max(256),
@@ -107,6 +165,7 @@ const CreateAgentSchema = z
     model: agentFields.model,
     budgetUsd: agentFields.budgetUsd,
     maxTurns: agentFields.maxTurns.optional(),
+    allowedOverrunPercent: agentFields.allowedOverrunPercent.optional(),
     maxDelegationsPerRun: agentFields.maxDelegationsPerRun.optional(),
     parallelDelegations: agentFields.parallelDelegations.optional(),
     schedule: agentFields.schedule.optional(),
@@ -164,6 +223,7 @@ const UpdateAgentSchema = z
     model: agentFields.model.optional(),
     budgetUsd: agentFields.budgetUsd.optional(),
     maxTurns: agentFields.maxTurns.optional(),
+    allowedOverrunPercent: agentFields.allowedOverrunPercent.optional(),
     maxDelegationsPerRun: agentFields.maxDelegationsPerRun.optional(),
     parallelDelegations: agentFields.parallelDelegations.optional(),
     schedule: agentFields.schedule.nullable().optional(),
@@ -179,6 +239,12 @@ const UpdateAgentSchema = z
     codingProfile: CodingProfilePatchSchema.extend({
         /** Not a stored profile field: sets CodingAgentProfile.debugTraceUntil = now + minutes (null clears). */
         debugTraceMinutes: z.number().int().min(1).max(MAX_DEBUG_TRACE_MINUTES).nullable().optional(),
+        /** Admin-only like debugTraceMinutes: CodingAgentProfile.debugTraceMaxMb (null = the default). */
+        debugTraceMaxMb: z.number().int().min(1).max(MAX_DEBUG_TRACE_MAX_MB).nullable().optional(),
+        /** Not stored as given: sets CodingAgentProfile.packageAuditMode and packageAuditUntil (null clears both). */
+        packageAuditMode: z.enum(PACKAGE_AUDIT_MODES).nullable().optional(),
+        /** Not a stored field: the audit window, in minutes from now (default 24 hours). */
+        packageAuditMinutes: z.number().int().min(1).max(MAX_PACKAGE_AUDIT_MINUTES).optional(),
     }).optional(),
     repositoryAdminOverride: z.boolean().optional(),
 })
@@ -242,6 +308,12 @@ const profileJsonSchema = {
             maximum: MAX_CODING_TURNS,
             description: `Claude Code runs only: the most agent turns (model calls) a run may take before it stops with coding_turn_limit. Null uses the worker default (${DEFAULT_CLAUDE_MAX_TURNS}). The run's budget and timeout still apply. Codex runs have no turn limit.`,
         },
+        maxOutputTokens: {
+            type: ["integer", "null"],
+            minimum: MIN_CLAUDE_MAX_OUTPUT_TOKENS,
+            maximum: MAX_CLAUDE_MAX_OUTPUT_TOKENS,
+            description: `Claude Code runs only: the most output tokens per model reply (default ${DEFAULT_CLAUDE_MAX_OUTPUT_TOKENS}, up to ${MAX_CLAUDE_MAX_OUTPUT_TOKENS}). The coding proxy reserves this × the model's output price per request against the run budget, so higher values need a larger budgetUsd. Refused on a Codex agent. Null uses the default.`,
+        },
         repoSkills: {
             type: "boolean",
             description: "Load the repository's agent skills into runs (Codex: .agents/skills and .codex/skills; Claude Code: .claude/skills). Default true. Repository instructions (AGENTS.md for Codex, CLAUDE.md for Claude Code) load either way.",
@@ -250,6 +322,14 @@ const profileJsonSchema = {
             type: "boolean",
             description: "Claude Code runs only. Default true: Claude Code runs in bare mode and wardby adds the repository's CLAUDE.md and its skill list to the system prompt; the model reads a skill's SKILL.md with run_command. False: bare mode is off and Claude Code loads CLAUDE.md and skills itself (native Skill tool). Repository settings, hooks, and MCP config are never loaded either way.",
         },
+        dependencyCache: {
+            type: "boolean",
+            description: "Restore npm node_modules from a snapshot the proxy re-approves; needs package approval (packages:approve or agents:admin). Default false. The worker images must be a release that includes the cache; with a workerImageRef the result carries a warning to rebuild that image from it.",
+        },
+        sessionResume: {
+            type: "boolean",
+            description: "Claude Code runs only. Keep each run's session transcript (redacted) on the server so the session can later be continued in a local Claude Code CLI. Once transcripts are served, anyone who can read a run can read everything its agent saw. Needs a blob store (BLOB_STORE) on the server. Default false.",
+        },
         packageAllowlist: {
             type: "object",
             description: "Approved top-level packages per ecosystem (npm, pypi). A PyPI entry may name extras, e.g. psycopg[binary]. Needs packages:approve or agents:admin.",
@@ -257,7 +337,16 @@ const profileJsonSchema = {
         },
         packagePolicy: {
             type: "object",
-            properties: { minReleaseAgeDays: { type: "integer", minimum: 0, maximum: 30 } },
+            description: "minReleaseAgeDays: days a release must have been public before it can be installed (0-30, default 3). acceptedAdvisories: advisory ids (GHSA-…, CVE-…) this agent's runs may install despite; malware never; every waiver is reported in the PR. Needs packages:approve or agents:admin.",
+            properties: {
+                minReleaseAgeDays: { type: "integer", minimum: 0, maximum: 30 },
+                acceptedAdvisories: {
+                    type: "array",
+                    maxItems: MAX_ACCEPTED_ADVISORIES,
+                    uniqueItems: true,
+                    items: { type: "string", pattern: ACCEPTED_ADVISORY_ID.source },
+                },
+            },
             additionalProperties: false,
         },
         services: {
@@ -363,11 +452,14 @@ function storedProfile(profile) {
         workerImageRef: profile.workerImageRef,
         workspaceDiskMb: profile.workspaceDiskMb,
         maxTurns: profile.maxTurns,
+        maxOutputTokens: profile.maxOutputTokens,
         packageAllowlist: profile.packageAllowlist,
         packagePolicy: profile.packagePolicy,
         services: profile.services,
         repoSkills: profile.repoSkills,
         claudeBareMode: profile.claudeBareMode,
+        dependencyCache: profile.dependencyCache,
+        sessionResume: profile.sessionResume,
     });
 }
 /** A service name an agent is allowed must exist in the catalog (any version); typos fail here, not at a run. */
@@ -393,11 +485,17 @@ export function registerAgentTools(mcp) {
                 model: { type: "string" },
                 budgetUsd: { type: "number" },
                 maxTurns: { type: "integer" },
+                allowedOverrunPercent: {
+                    type: "integer",
+                    minimum: 0,
+                    maximum: 100,
+                    description: "Percent above budgetUsd a run may spend before it is stopped. On a coding agent it raises each of its runs' limit; on a lead agent that delegates, it raises its run tree's ceiling for coding sub-agents. Native runs' own model calls are not affected. Budget group caps still apply. 0 = stop at budgetUsd.",
+                },
                 maxDelegationsPerRun: {
                     type: "integer",
                     minimum: 1,
                     maximum: MAX_DELEGATIONS_PER_RUN,
-                    description: "Native agents with sub-agents: how many delegate_to_* calls one run may make, each to a different sub-agent " +
+                    description: "Native agents with sub-agents: how many delegate_to_* calls one run may make, to each sub-agent and repository at most once " +
                         "(one after another, or together with parallelDelegations). Default 1: route to exactly one.",
                 },
                 parallelDelegations: { type: "boolean", description: PARALLEL_DELEGATIONS_DESCRIPTION },
@@ -431,12 +529,14 @@ export function registerAgentTools(mcp) {
             const packages = args.codingProfile;
             if (packages &&
                 (Object.keys(packages.packageAllowlist ?? {}).length > 0 ||
-                    Object.keys(packages.packagePolicy ?? {}).length > 0))
+                    Object.keys(packages.packagePolicy ?? {}).length > 0 ||
+                    packages.dependencyCache === true))
                 requirePackageApproval(ctx);
             validateSchedule(args.schedule, args.timezone ?? "UTC");
             requireModelAvailable(ctx, args.model, args.kind);
             validateEffort(args.kind, args.model, args.effort);
             validateNativeExecutionMode(ctx, args.kind, args.nativeExecutionMode);
+            validateWorkspaceDiskMb(args.codingProfile?.workspaceDiskMb);
             if (args.codingProfile)
                 await requireCatalogServiceNames(ctx.db, args.codingProfile.services);
             if (args.budgetGroupId) {
@@ -454,7 +554,7 @@ export function registerAgentTools(mcp) {
             const authorization = codingProfile
                 ? await authorizeRepositoryForSet(ctx, {
                     ownerId: ctx.principal.id,
-                    provider: "github",
+                    provider: codeProviderOf(codingProfile.repository),
                     repository: codingProfile.repository,
                     kind: "coding",
                     adminOverride: repositoryAdminOverride === true,
@@ -463,6 +563,11 @@ export function registerAgentTools(mcp) {
             const agent = await ctx.db.agent.create({
                 data: {
                     ...agentData,
+                    ...(await scheduleStartFields(ctx.db, null, {
+                        schedule: agentData.schedule ?? null,
+                        timezone: agentData.timezone ?? "UTC",
+                        scheduleEnabled: agentData.scheduleEnabled ?? true,
+                    })),
                     ownerId: ctx.principal.id,
                     ...(codingProfile && authorization
                         ? { codingProfile: { create: { ...codingProfile, ...profileStamp(authorization) } } }
@@ -470,7 +575,7 @@ export function registerAgentTools(mcp) {
                 },
                 include: { codingProfile: true },
             });
-            return textResult(withOperatorMode(agent));
+            return textResult(withProfileWarnings(withOperatorMode(agent)));
         },
     });
     mcp.registerTool({
@@ -486,11 +591,17 @@ export function registerAgentTools(mcp) {
                 model: { type: "string" },
                 budgetUsd: { type: "number" },
                 maxTurns: { type: "integer" },
+                allowedOverrunPercent: {
+                    type: "integer",
+                    minimum: 0,
+                    maximum: 100,
+                    description: "Percent above budgetUsd a run may spend before it is stopped. On a coding agent it raises each of its runs' limit; on a lead agent that delegates, it raises its run tree's ceiling for coding sub-agents. Native runs' own model calls are not affected. Budget group caps still apply. 0 = stop at budgetUsd.",
+                },
                 maxDelegationsPerRun: {
                     type: "integer",
                     minimum: 1,
                     maximum: MAX_DELEGATIONS_PER_RUN,
-                    description: "Native agents with sub-agents: how many delegate_to_* calls one run may make, each to a different sub-agent " +
+                    description: "Native agents with sub-agents: how many delegate_to_* calls one run may make, to each sub-agent and repository at most once " +
                         "(one after another, or together with parallelDelegations). Default 1: route to exactly one.",
                 },
                 parallelDelegations: { type: "boolean", description: PARALLEL_DELEGATIONS_DESCRIPTION },
@@ -531,6 +642,27 @@ export function registerAgentTools(mcp) {
                             maximum: MAX_DEBUG_TRACE_MINUTES,
                             description: "Admins only (agents:admin): trace every coding run of this agent for this many minutes from now; the worker writes its full stream trace, which can include prompts and repository content, to the run pod's log. Null turns it off.",
                         },
+                        debugTraceMaxMb: {
+                            type: ["integer", "null"],
+                            minimum: 1,
+                            maximum: MAX_DEBUG_TRACE_MAX_MB,
+                            description: `Admins only (agents:admin): cap on one traced run's trace output, in MiB (default ${DEFAULT_DEBUG_TRACE_MAX_MB}); the trace stops with a limit_reached line once it is reached. Null restores the default.`,
+                        },
+                        packageAuditMode: {
+                            type: ["string", "null"],
+                            enum: [...PACKAGE_AUDIT_MODES, null],
+                            description: "Package audit mode, for a limited time (packageAuditMinutes). Needs packages:approve or agents:admin, and only the agent's owner may set it. " +
+                                '"audit": the registry installs packages outside this agent\'s allowlist instead of refusing them, and records each one; ' +
+                                '"full": also installs versions withheld only by high or critical advisories. Malware is refused and the release-age limit enforced in every mode. ' +
+                                "This weakens the supply-chain guard while it is on: use it to find out which packages a task needs, then add them to packageAllowlist. " +
+                                "Fixed per run when the run is dispatched. Null turns it off.",
+                        },
+                        packageAuditMinutes: {
+                            type: "integer",
+                            minimum: 1,
+                            maximum: MAX_PACKAGE_AUDIT_MINUTES,
+                            description: `How long package audit mode stays on, in minutes from now (default ${DEFAULT_PACKAGE_AUDIT_MINUTES}, at most ${MAX_PACKAGE_AUDIT_MINUTES}: 7 days). Given alone, it re-arms the stored mode. Needs packages:approve or agents:admin.`,
+                        },
                     },
                 },
                 repositoryAdminOverride: REPOSITORY_ADMIN_OVERRIDE,
@@ -542,9 +674,18 @@ export function registerAgentTools(mcp) {
             if (args.codingProfile?.workerImageRef !== undefined)
                 requireWorkerImageRefScope(ctx);
             const debugTraceMinutes = args.codingProfile?.debugTraceMinutes;
-            if (debugTraceMinutes !== undefined)
+            const debugTraceMaxMb = args.codingProfile?.debugTraceMaxMb;
+            if (debugTraceMinutes !== undefined || debugTraceMaxMb !== undefined)
                 requireDebugTraceScope(ctx);
-            if (args.codingProfile?.packageAllowlist !== undefined || args.codingProfile?.packagePolicy !== undefined)
+            const auditPatch = {
+                packageAuditMode: args.codingProfile?.packageAuditMode,
+                packageAuditMinutes: args.codingProfile?.packageAuditMinutes,
+            };
+            if (args.codingProfile?.packageAllowlist !== undefined ||
+                args.codingProfile?.packagePolicy !== undefined ||
+                args.codingProfile?.dependencyCache !== undefined ||
+                auditPatch.packageAuditMode !== undefined ||
+                auditPatch.packageAuditMinutes !== undefined)
                 requirePackageApproval(ctx);
             // Repository authorization calls GitHub, so it runs before (outside) the
             // serializable transaction, on a pre-read; the transaction then verifies
@@ -601,7 +742,7 @@ export function registerAgentTools(mcp) {
             const authorization = plannedRepository !== null && repositoryChanges(before)
                 ? await authorizeRepositoryForSet(ctx, {
                     ownerId: before.ownerId,
-                    provider: "github",
+                    provider: codeProviderOf(plannedRepository),
                     repository: plannedRepository,
                     kind: "coding",
                     adminOverride: args.repositoryAdminOverride === true,
@@ -615,6 +756,7 @@ export function registerAgentTools(mcp) {
                 : debugTraceMinutes === null
                     ? null
                     : new Date(Date.now() + debugTraceMinutes * 60_000);
+            let auditSet;
             const agent = await ctx.db.$transaction(async (tx) => {
                 const existing = await tx.agent.findUnique({ where: { id: args.id }, include: { codingProfile: true } });
                 if (!existing)
@@ -636,6 +778,23 @@ export function registerAgentTools(mcp) {
                     await requireReadableBudgetGroup(tx, args.budgetGroupId, ctx.principal.id);
                 }
                 const nextKind = args.kind ?? existing.kind;
+                if (nextKind !== existing.kind) {
+                    // A write link without triggers is a coding agent's extra repository
+                    // and a native agent's plain write access; changing kind would
+                    // silently reinterpret it.
+                    const reinterpreted = await tx.agentRepository.count({
+                        where: { agentId: args.id, access: "write", triggers: { isEmpty: true } },
+                    });
+                    if (reinterpreted > 0) {
+                        throw new McpError(400, `Agent "${args.id}" has write repository links without triggers, which mean different things on native and coding agents; unlink them before changing its kind.`);
+                    }
+                }
+                // A coding repository is an owner binding (agentOwnerBindings): an
+                // agent everyone can write never gets one, as attach_* refuse theirs.
+                if (((nextKind === "coding" && existing.kind !== "coding") || repositoryChanges(existing)) &&
+                    (await isPublicWritable(tx, existing.id))) {
+                    throw new McpError(409, `Agent "${args.id}" is writable by everyone, so it can't become a coding agent or get a repository; revoke or lower the everyone grant first.`);
+                }
                 if (nextKind === "native" && args.codingProfile) {
                     throw new McpError(400, "A coding profile is only valid for coding agents.");
                 }
@@ -659,11 +818,14 @@ export function registerAgentTools(mcp) {
                         throw new McpError(400, "Detach all native sandbox tools before changing an agent to coding.");
                     }
                     const currentProfile = existing.codingProfile ? storedProfile(existing.codingProfile) : undefined;
-                    const { debugTraceMinutes: _minutes, ...profilePatch } = args.codingProfile ?? {};
+                    const { debugTraceMinutes: _minutes, debugTraceMaxMb: _maxMb, packageAuditMode: _auditMode, packageAuditMinutes: _auditMinutes, ...profilePatch } = args.codingProfile ?? {};
                     const profileResult = CodingProfileSchema.safeParse({ ...currentProfile, ...profilePatch });
                     if (!profileResult.success)
                         throw invalidArguments("coding profile", profileResult.error);
                     nextProfile = profileResult.data;
+                    if (typeof args.codingProfile?.workspaceDiskMb === "number" || nextKind !== existing.kind) {
+                        validateWorkspaceDiskMb(nextProfile.workspaceDiskMb);
+                    }
                     if (args.codingProfile?.services !== undefined)
                         await requireCatalogServiceNames(tx, nextProfile.services);
                     const nextModel = args.model ?? existing.model;
@@ -674,6 +836,19 @@ export function registerAgentTools(mcp) {
                         throw new McpError(400, `Model "${nextModel}" is not supported by coding provider "${nextProfile.provider}".`);
                     }
                 }
+                // Package audit mode: resolved against the stored mode inside the
+                // transaction, so minutes alone re-arm what is stored now.
+                let audit;
+                try {
+                    const storedMode = existing.codingProfile?.packageAuditMode;
+                    audit = resolvePackageAuditPatch({ mode: isPackageAuditMode(storedMode) ? storedMode : null }, auditPatch, new Date());
+                }
+                catch (error) {
+                    if (error instanceof PackageAuditPatchError)
+                        throw new McpError(400, error.message);
+                    throw error;
+                }
+                auditSet = audit;
                 const nextSchedule = args.schedule !== undefined ? args.schedule : existing.schedule;
                 const nextTimezone = args.timezone ?? existing.timezone;
                 const nextScheduleEnabled = args.scheduleEnabled ?? existing.scheduleEnabled;
@@ -687,7 +862,11 @@ export function registerAgentTools(mcp) {
                     ...(modeArg ? { nativeExecutionMode: toStoredMode(modeArg) } : {}),
                 };
                 const stamp = authorization ? profileStamp(authorization) : {};
-                const trace = debugTraceUntil === undefined ? {} : { debugTraceUntil };
+                const trace = {
+                    ...(debugTraceUntil === undefined ? {} : { debugTraceUntil }),
+                    ...(debugTraceMaxMb === undefined ? {} : { debugTraceMaxMb }),
+                    ...(audit === undefined ? {} : { packageAuditMode: audit.mode, packageAuditUntil: audit.until }),
+                };
                 const profileMutation = nextKind === "native"
                     ? existing.codingProfile
                         ? { delete: true }
@@ -695,32 +874,91 @@ export function registerAgentTools(mcp) {
                     : existing.codingProfile
                         ? { update: { ...nextProfile, ...stamp, ...trace } }
                         : { create: { ...nextProfile, ...stamp, ...trace } };
+                const scheduleStart = await scheduleStartFields(tx, existing, {
+                    schedule: nextSchedule,
+                    timezone: nextTimezone,
+                    scheduleEnabled: nextScheduleEnabled,
+                });
                 return tx.agent.update({
                     where: { id },
                     data: {
                         ...updates,
+                        ...scheduleStart,
                         ...(profileMutation ? { codingProfile: profileMutation } : {}),
                     },
                     include: { codingProfile: true },
                 });
             }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });
-            if (debugTraceUntil !== undefined) {
+            if (debugTraceUntil !== undefined || debugTraceMaxMb !== undefined) {
                 agentsLog.info({
                     event: "coding.debug_trace.set",
                     agentId: agent.id,
-                    until: debugTraceUntil?.toISOString() ?? null,
+                    ...(debugTraceUntil !== undefined ? { until: debugTraceUntil?.toISOString() ?? null } : {}),
+                    ...(debugTraceMaxMb !== undefined ? { maxMb: debugTraceMaxMb } : {}),
                     by: ctx.principal.id,
                 }, "coding debug trace set");
             }
-            return textResult(withOperatorMode(agent));
+            if (auditSet !== undefined) {
+                agentsLog.info({
+                    event: "coding.package_audit.set",
+                    agentId: agent.id,
+                    mode: auditSet.mode,
+                    until: auditSet.until?.toISOString() ?? null,
+                    by: ctx.principal.id,
+                }, "coding package audit mode set");
+            }
+            const shown = withProfileWarnings(withOperatorMode(agent));
+            // Becoming Codex (a provider switch, or a native agent becoming coding) leaves out every attached
+            // MCP tool the server doesn't mark read-only: say which, so the owner isn't surprised by a run.
+            const wasCodex = before.kind === "coding" && isCodexCoding(before.codingProfile?.provider);
+            if (agent.kind === "coding" && isCodexCoding(agent.codingProfile?.provider) && !wasCodex) {
+                const writers = await codexUnavailableMcpTools(ctx.db, agent.id);
+                if (writers.length > 0) {
+                    return textResult({ ...shown, warnings: [...(shown.warnings ?? []), codexWriteToolsWarning(writers)] });
+                }
+            }
+            return textResult(shown);
         },
     });
     mcp.registerTool({
         name: "list_agents",
         scope: "agents:read",
-        inputSchema: { type: "object", properties: {}, additionalProperties: false },
-        handler: async (_args, ctx) => {
-            const [where, accessOf] = await Promise.all([readableAgentsWhere(ctx), agentAccessResolver(ctx)]);
+        description: "Lists the agents you can see. Each row has an `access` field, your level on that agent: owner > write > execute > read. When showing the agents as a table, include `access` as a column. " +
+            "summary: true returns only id, name, kind, model, codingProvider, budgetUsd, ownerId and access per agent, for listings that don't need the full configuration. " +
+            "all: true lists every agent in the deployment (admins only, admin:view); an agent you have no grant on shows access `none`.",
+        inputSchema: {
+            type: "object",
+            properties: { summary: { type: "boolean" }, all: { type: "boolean" } },
+            additionalProperties: false,
+        },
+        handler: async (args, ctx) => {
+            if (args.all === true && !ctx.operator)
+                requireScope(ctx, ctx.canonicalUri, "admin:view");
+            const [where, accessOf] = await Promise.all([
+                args.all === true ? Promise.resolve({}) : readableAgentsWhere(ctx),
+                agentAccessResolver(ctx),
+            ]);
+            if (args.summary === true) {
+                const agents = await ctx.db.agent.findMany({
+                    where,
+                    select: {
+                        id: true,
+                        name: true,
+                        kind: true,
+                        model: true,
+                        budgetUsd: true,
+                        ownerId: true,
+                        codingProfile: { select: { provider: true } },
+                    },
+                    orderBy: { name: "asc" },
+                });
+                return textResult(agents.map(({ codingProfile, budgetUsd, ...agent }) => ({
+                    ...agent,
+                    codingProvider: codingProfile?.provider ?? null,
+                    budgetUsd: Number(budgetUsd),
+                    access: accessOf(agent),
+                })));
+            }
             const agents = await ctx.db.agent.findMany({ where, include: { codingProfile: true } });
             return textResult(agents.map((agent) => ({ ...withOperatorMode(agent), access: accessOf(agent) })));
         },
@@ -742,12 +980,14 @@ export function registerAgentTools(mcp) {
             // A7: a tool's code and schema are its owner's, whoever can read the
             // agent (the agent's owner included). Capabilities stay visible: config.
             return textResult({
-                ...withOperatorMode(agent),
+                ...withProfileWarnings(withOperatorMode(agent)),
                 access,
-                tools: agent.tools.map((attachment) => ({
+                mcpServers: await agentMcpServerViews(ctx.db, agent.id),
+                // Zod 3 window: the caller's own tools carry their warnings (see core/zod3-window.ts).
+                tools: await Promise.all(agent.tools.map(async (attachment) => ({
                     ...attachment,
-                    tool: projectTool(attachment.tool, ctx.principal.id),
-                })),
+                    tool: await withZod3ToolWarnings(projectTool(attachment.tool, ctx.principal.id)),
+                }))),
             });
         },
     });
@@ -792,7 +1032,7 @@ export function registerAgentTools(mcp) {
     mcp.registerTool({
         name: "make_owner",
         scope: "agents:admin",
-        description: "Admins: gives an agent a new owner (an existing principal id). Secret and datastore bindings the new owner doesn't own are removed; tool capabilities the new owner never granted are suspended until they re-run attach_tool; sub-agent edges the new owner can't delegate are removed; between two owners every grant on the agent is reset (adopting an owner-less agent keeps them). Returns what changed.",
+        description: "Admins: gives an agent a new owner (an existing principal id). Secret, datastore and MCP server bindings the new owner doesn't own are removed; tool capabilities the new owner never granted are suspended until they re-run attach_tool; sub-agent edges the new owner can't delegate are removed; between two owners every grant on the agent is reset (adopting an owner-less agent keeps them). Returns what changed.",
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -814,7 +1054,9 @@ export function registerAgentTools(mcp) {
             const principal = await ctx.db.principal.findUnique({ where: { id: newOwner } });
             if (!principal)
                 throw new McpError(400, `Principal "${newOwner}" not found.`);
-            const result = await ctx.db.$transaction(async (tx) => {
+            // Bounded retry: a concurrent grant or attach on the same rows aborts one side (Serializable).
+            const result = await withSerializableRetry(() => ctx.db.$transaction(async (tx) => {
+                await preferIndexScans(tx);
                 const agent = await tx.agent.findUnique({ where: { id: args.agentId }, include: { codingProfile: true } });
                 if (!agent)
                     throw agentNotFound(args.agentId);
@@ -833,7 +1075,10 @@ export function registerAgentTools(mcp) {
                         where: { agentId: agent.id, authorizedVia: approved },
                         orderBy: { repository: "asc" },
                     });
-                    await tx.agentRepository.updateMany({ where: { agentId: agent.id, authorizedVia: approved }, data: reset });
+                    await tx.agentRepository.updateMany({
+                        where: { agentId: agent.id, authorizedVia: approved },
+                        data: reset,
+                    });
                     revoked.push(...links.map((l) => l.repository));
                     const profile = await tx.codingAgentProfile.updateMany({
                         where: { agentId: agent.id, repositoryAuthorizedVia: approved },
@@ -890,9 +1135,31 @@ export function registerAgentTools(mcp) {
                         where: { agentId: agent.id, datastoreId: { in: foreignDatastores.map((b) => b.datastoreId) } },
                     });
                 }
+                // MCP server attachments: the server's brokered secrets act for its
+                // owner, so a server the new owner neither owns nor holds use on is detached.
+                const mcpServers = await tx.agentMcpServer.findMany({
+                    where: { agentId: agent.id },
+                    include: { server: { select: { id: true, name: true, ownerId: true } } },
+                    orderBy: { serverId: "asc" },
+                });
+                const foreignMcpServers = await filterUnusableMcpServers(tx, () => newOwner, mcpServers);
+                if (foreignMcpServers.length > 0) {
+                    await tx.agentMcpServer.deleteMany({
+                        where: { agentId: agent.id, serverId: { in: foreignMcpServers.map((b) => b.serverId) } },
+                    });
+                }
                 const bindingsRemoved = [
                     ...foreignSecrets.map((b) => ({ kind: "secret", boundName: b.boundName, resourceId: b.secretId })),
-                    ...foreignDatastores.map((b) => ({ kind: "datastore", boundName: b.boundName, resourceId: b.datastoreId })),
+                    ...foreignDatastores.map((b) => ({
+                        kind: "datastore",
+                        boundName: b.boundName,
+                        resourceId: b.datastoreId,
+                    })),
+                    ...foreignMcpServers.map((b) => ({
+                        kind: "mcp_server",
+                        boundName: b.server.name,
+                        resourceId: b.serverId,
+                    })),
                 ];
                 // Tool capabilities: rows aren't rewritten; the runner ignores any
                 // the new owner never stamped (capabilitiesGrantedById).
@@ -950,7 +1217,7 @@ export function registerAgentTools(mcp) {
                     everyoneGrant,
                     webhooksInactive,
                 };
-            }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });
+            }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable }));
             return textResult(result);
         },
     });

package/dist/mcp/tools/datastore.js

@@ -1,9 +1,10 @@
 import { Prisma } from "#prisma";
 import { requireOwnedDatastore, canRead, assertCanMutate } from "../auth/ownership.js";
-import { requireAgentAccess, requireBindingOwner } from "../auth/access.js";
+import { requireAgentAccess, requireBindable, requireBindingOwner } from "../auth/access.js";
 import { createDatastore, listDatastores, deleteDatastore, attachDatastore, detachDatastore, buildSharedDatastoreAccessor, } from "../../core/datastores.js";
 import { McpError } from "../errors.js";
 import { textResult } from "./text-result.js";
+import { SecretInValueError, SecretCheckUnavailableError } from "../../core/secret-guard.js";
 /**
  * A `boundName` names an *attachment* (agentId, boundName) -> Datastore.
  * Agent data (the private store and bound stores) is owner-only (resource-
@@ -99,7 +100,7 @@ export function registerDatastoreTools(mcp) {
             // read it: strictly the agent owner's own datastore on the owner's
             // own agent (A2/S2-2). Not even the stdio operator crosses owners.
             const { agent } = await requireAgentAccess(ctx, args.agentId, "read");
-            requireBindingOwner(ctx, agent);
+            await requireBindable(ctx, agent);
             const datastore = await requireOwnedDatastore(ctx.db, args.datastoreId, ctx.principal.id);
             if (datastore.ownerId !== agent.ownerId) {
                 throw new McpError(403, "Only a datastore owned by the agent's owner can be attached to it.");
@@ -191,14 +192,22 @@ export function registerDatastoreTools(mcp) {
         },
         handler: async (args, ctx) => {
             await requireAgentAccess(ctx, args.agentId, "owner");
-            if (args.boundName) {
-                await requireMutableSharedDatastore(ctx.db, args.agentId, args.boundName, ctx.principal.id);
-                const accessor = buildSharedDatastoreAccessor(args.agentId, ctx.providers.datastore, ctx.db);
-                await accessor.set(args.boundName, args.key, args.value, { pii: args.pii });
+            try {
+                if (args.boundName) {
+                    await requireMutableSharedDatastore(ctx.db, args.agentId, args.boundName, ctx.principal.id);
+                    const accessor = buildSharedDatastoreAccessor(args.agentId, ctx.providers.datastore, ctx.db);
+                    await accessor.set(args.boundName, args.key, args.value, { pii: args.pii });
+                    return textResult({ ok: true });
+                }
+                await ctx.providers.datastore.set(args.agentId, args.key, args.value, { pii: args.pii });
                 return textResult({ ok: true });
             }
-            await ctx.providers.datastore.set(args.agentId, args.key, args.value, { pii: args.pii });
-            return textResult({ ok: true });
+            catch (err) {
+                if (err instanceof SecretInValueError || err instanceof SecretCheckUnavailableError) {
+                    throw new McpError(400, err.message);
+                }
+                throw err;
+            }
         },
     });
     mcp.registerTool({