@wardby/cli 0.6.0 → 0.8.0

package/dist/mcp/tools/stop-run.js

@@ -0,0 +1,82 @@
+/**
+ * stop_run: stops a run that is still pending (including a coding run queued for a slot) or
+ * running, and the delegated child runs it has in flight (src/core/stop-run.ts). A run that already
+ * finished is returned unchanged, so calling it again is harmless.
+ *
+ * Access mirrors trigger_agent: stopping a run needs execute on its agent. Runs are visible only to
+ * the agent's owner and to the run's triggerer (get_run's rule), so anyone else gets the same 404 as
+ * for a missing run; a triggerer whose access to the agent has dropped below execute gets a 403.
+ */
+import { z } from "zod";
+import { atLeast } from "../../core/grants.js";
+import { stopRun } from "../../core/stop-run.js";
+import { agentAccess, insufficientAgentAccess } from "../auth/access.js";
+import { McpError } from "../errors.js";
+import { textResult } from "./text-result.js";
+const StopRunSchema = z
+    .object({
+    runId: z.string().trim().min(1).max(128),
+    reason: z.string().trim().max(500).optional(),
+})
+    .strict();
+export function registerStopRunTool(mcp) {
+    mcp.registerTool({
+        name: "stop_run",
+        scope: "runs:trigger",
+        description: "Stop a run that is pending, queued, or running, and the sub-agent runs it delegated that are still in " +
+            "flight. The run ends as `cancelled`; a coding run's worker is stopped and opens or updates no pull " +
+            "request. A run that already finished is returned unchanged. Needs execute access to the run's agent.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                runId: { type: "string" },
+                reason: {
+                    type: "string",
+                    description: "Why the run is being stopped; recorded on the run (up to 500 characters).",
+                },
+            },
+            required: ["runId"],
+        },
+        handler: async (raw, ctx) => {
+            const parsed = StopRunSchema.safeParse(raw);
+            if (!parsed.success) {
+                const details = parsed.error.issues.map((i) => `${i.path.join(".") || "input"}: ${i.message}`).join("; ");
+                throw new McpError(400, `Invalid stop_run arguments: ${details}`);
+            }
+            const { runId, reason } = parsed.data;
+            const notFound = new McpError(404, `Run "${runId}" not found.`);
+            const run = await ctx.db.run.findUnique({
+                where: { id: runId },
+                select: { id: true, agentId: true, triggeredById: true },
+            });
+            if (!run)
+                throw notFound;
+            const agent = await ctx.db.agent.findUnique({ where: { id: run.agentId }, select: { id: true, ownerId: true } });
+            if (!agent)
+                throw notFound;
+            const access = await agentAccess(ctx, agent);
+            const isTriggerer = run.triggeredById !== null && run.triggeredById === ctx.principal.id;
+            // Visible to the agent's owner and the run's triggerer only, exactly as get_run.
+            if (access !== "owner" && !isTriggerer)
+                throw notFound;
+            if (!atLeast("agent", access, "execute"))
+                throw insufficientAgentAccess(agent.id, "execute", access);
+            const result = await stopRun({
+                db: ctx.db,
+                executor: ctx.providers.executor,
+                runId,
+                stoppedBy: ctx.principal.id,
+                reason,
+            });
+            const message = !result.stopRequested
+                ? `Run already finished as ${result.status}; nothing was changed.`
+                : result.status === "cancelled"
+                    ? "Run stopped."
+                    : result.status === "pending" || result.status === "running"
+                        ? `Stop requested; the run is still ${result.status}. Check it again with get_run.`
+                        : `The run finished as ${result.status} before the stop took effect.`;
+            return textResult({ ...result, message });
+        },
+    });
+}

package/dist/mcp/tools/subagents.js

@@ -14,7 +14,7 @@
  */
 import { Prisma } from "#prisma";
 import { atLeast, canDelegate } from "../../core/grants.js";
-import { agentAccess, agentAccessResolver, agentNotFound, requireAgentAccess, requireBindingOwner, } from "../auth/access.js";
+import { agentAccess, agentAccessResolver, agentNotFound, requireAgentAccess, requireBindable, } from "../auth/access.js";
 import { McpError } from "../errors.js";
 import { textResult } from "./text-result.js";
 /**
@@ -68,7 +68,7 @@ export function registerSubAgentTools(mcp) {
                 throw new McpError(400, "An agent cannot be its own sub-agent.");
             }
             const { agent: parent } = await requireAgentAccess(ctx, args.parentAgentId, "read");
-            requireBindingOwner(ctx, parent);
+            await requireBindable(ctx, parent);
             // The caller could trigger the child anyway; the edge must not widen that.
             const { agent: child } = await requireAgentAccess(ctx, args.childAgentId, "execute");
             if (parent.ownerId === null) {

package/dist/mcp/tools/tools.d.ts

@@ -19,25 +19,27 @@ import type { WardbyMcpServer } from "../server.js";
  */
 export declare function projectTool(tool: Tool, principalId: string): {
     name: string;
+    updatedAt: Date;
     code: string;
+    timeoutMs: number | null;
     createdAt: Date;
-    updatedAt: Date;
     id: string;
     ownerId: string | null;
     description: string;
     jsonSchema: import("@prisma/client/runtime/client").JsonValue;
     paramsZod: string;
 } | {
+    public: boolean;
     id: string;
     name: string;
     description: string;
-    public: boolean;
-    ownerIsCaller?: undefined;
+    timeoutMs: number | null;
 } | {
+    public: boolean;
+    ownerIsCaller: boolean;
     id: string;
     name: string;
     description: string;
-    public: boolean;
-    ownerIsCaller: boolean;
+    timeoutMs: number | null;
 };
 export declare function registerToolAuthoringTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/tools.js

@@ -11,15 +11,18 @@
  */
 import { Prisma } from "#prisma";
 import { deriveJsonSchema, validateParams } from "../../sandbox/zod-params.js";
+import { cachedZod4Compatibility, toolSubject, withZod3ToolWarnings, zod3SampleArgsWarning, zod3ToolWarnings, zod3WindowWarning, } from "../../core/zod3-window.js";
 import { runInSandbox } from "../../sandbox/run-in-sandbox.js";
+import { effectiveToolTimeoutMs, toolTimeoutProblem } from "../../sandbox/tool-timeout.js";
+import { loadToolMaxTimeoutMs } from "../../config/tool-timeout.js";
 import { ToolCapabilitiesPatchSchema } from "../../sandbox/tool-capabilities.js";
 import { buildSharedDatastoreAccessor } from "../../core/datastores.js";
-import { findSameNamedAttachedTool, reservedToolNameReason } from "../../core/tool-names.js";
+import { findSameNamedAttachedTool, findSameNamedMcpTool, reservedToolNameReason, sameNamedMcpToolMessage, } from "../../core/tool-names.js";
 import { ToolAttachedError, deleteToolGuarded, hasToolChanges, prepareToolUpdate, updateToolGuarded, } from "../../core/tool-admin.js";
 import { McpError } from "../errors.js";
 import { requireOwnedTool, requireStrictlyOwnedTool, assertStrictlyOwnedTool, visibleToPrincipal, canRead, } from "../auth/ownership.js";
 import { agentAccessResolver, assertAgentAccess, requireAgentAccess } from "../auth/access.js";
-import { atLeast } from "../../core/grants.js";
+import { atLeast, isPublicWritable } from "../../core/grants.js";
 import { textResult } from "./text-result.js";
 import { brokerCompatibilityWarnings } from "./secret-broker-compat.js";
 /**
@@ -45,9 +48,16 @@ async function describeAgents(agents, ctx) {
 export function projectTool(tool, principalId) {
     if (tool.ownerId !== null && tool.ownerId === principalId)
         return tool;
-    return tool.ownerId === null
-        ? { id: tool.id, name: tool.name, description: tool.description, public: true }
-        : { id: tool.id, name: tool.name, description: tool.description, public: false, ownerIsCaller: false };
+    // timeoutMs is not code: anyone who sees the tool sees how long its calls may take.
+    const shown = { id: tool.id, name: tool.name, description: tool.description, timeoutMs: tool.timeoutMs };
+    return tool.ownerId === null ? { ...shown, public: true } : { ...shown, public: false, ownerIsCaller: false };
+}
+const TIMEOUT_MS_DESCRIPTION = "The tool's time limit per call, in milliseconds (at least 1000). Omitted: the default of 10000. Capped by the server's WARDBY_TOOL_MAX_TIMEOUT_MS (default 300000); a larger value is refused. Each fetch times out just before it, and sleep() is capped at it.";
+/** Refuses (400) a timeoutMs this server can't store, naming its ceiling. */
+function assertToolTimeout(timeoutMs) {
+    const problem = toolTimeoutProblem(timeoutMs, loadToolMaxTimeoutMs());
+    if (problem)
+        throw new McpError(400, problem);
 }
 /**
  * Non-blocking: which of the secrets just granted to this attachment are
@@ -82,11 +92,14 @@ export function registerToolAuthoringTools(mcp) {
                 description: { type: "string" },
                 paramsZod: { type: "string" },
                 code: { type: "string" },
+                timeoutMs: { type: "integer", description: TIMEOUT_MS_DESCRIPTION },
             },
             required: ["name", "description", "paramsZod", "code"],
         },
         handler: async (args, ctx) => {
             assertToolNameAllowed(args.name);
+            if (args.timeoutMs !== undefined)
+                assertToolTimeout(args.timeoutMs);
             const schemaResult = await deriveJsonSchema(args.paramsZod);
             if (!schemaResult.ok) {
                 return textResult({ ok: false, errorKind: schemaResult.errorKind, errorMessage: schemaResult.errorMessage });
@@ -100,9 +113,11 @@ export function registerToolAuthoringTools(mcp) {
                         code: args.code,
                         jsonSchema: schemaResult.value,
                         ownerId: ctx.principal.id,
+                        ...(args.timeoutMs !== undefined ? { timeoutMs: args.timeoutMs } : {}),
                     },
                 });
-                return textResult(tool);
+                const warnings = await zod3ToolWarnings(toolSubject(tool.name), args.paramsZod);
+                return textResult(warnings.length ? { ...tool, warnings } : tool);
             }
             catch (err) {
                 if (err instanceof Prisma.PrismaClientKnownRequestError && err.code === "P2002") {
@@ -115,7 +130,7 @@ export function registerToolAuthoringTools(mcp) {
     mcp.registerTool({
         name: "update_tool",
         scope: "tools:write",
-        description: "Replaces a tool's description, paramsZod and/or code in place (its name can't change: agents' prompts call it by name). Owner-only: public tools can't be changed over MCP. Refused while the tool is attached to any agent you don't own, including owner-less ones and agents shared with you, since the change would reach another owner's agent; detach it there first or create a new tool. Runs already started keep the version they loaded for their whole lifetime; the next run picks up the new one.",
+        description: "Replaces a tool's description, paramsZod, code and/or timeoutMs (null: back to the default limit) in place (its name can't change: agents' prompts call it by name). Owner-only: public tools can't be changed over MCP. Refused while the tool is attached to any agent you don't own, including owner-less ones and agents shared with you, since the change would reach another owner's agent; detach it there first or create a new tool. Runs already started keep the version they loaded for their whole lifetime; the next run picks up the new one.",
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -124,14 +139,25 @@ export function registerToolAuthoringTools(mcp) {
                 description: { type: "string" },
                 paramsZod: { type: "string" },
                 code: { type: "string" },
+                timeoutMs: {
+                    type: ["integer", "null"],
+                    description: `${TIMEOUT_MS_DESCRIPTION} Pass null to go back to the default.`,
+                },
             },
             required: ["toolId"],
         },
         handler: async (args, ctx) => {
-            const changes = { description: args.description, paramsZod: args.paramsZod, code: args.code };
+            const changes = {
+                description: args.description,
+                paramsZod: args.paramsZod,
+                code: args.code,
+                timeoutMs: args.timeoutMs,
+            };
             if (!hasToolChanges(changes)) {
-                throw new McpError(400, "update_tool needs at least one of description, paramsZod or code.");
+                throw new McpError(400, "update_tool needs at least one of description, paramsZod, code or timeoutMs.");
             }
+            if (args.timeoutMs !== undefined && args.timeoutMs !== null)
+                assertToolTimeout(args.timeoutMs);
             // Checked once up front so a non-owner never gets as far as a sandbox
             // compile, and again (with the attachments) inside the transaction.
             await requireStrictlyOwnedTool(ctx.db, args.toolId, ctx.principal.id);
@@ -145,7 +171,8 @@ export function registerToolAuthoringTools(mcp) {
             // landing between the check and the write.
             try {
                 const tool = await updateToolGuarded(ctx.db, args.toolId, prepared.data, (row) => assertStrictlyOwnedTool(row, args.toolId, ctx.principal.id));
-                return textResult(tool);
+                const warnings = args.paramsZod === undefined ? [] : await zod3ToolWarnings(toolSubject(tool.name), args.paramsZod);
+                return textResult(warnings.length ? { ...tool, warnings } : tool);
             }
             catch (err) {
                 if (err instanceof ToolAttachedError) {
@@ -193,7 +220,7 @@ export function registerToolAuthoringTools(mcp) {
     mcp.registerTool({
         name: "dry_run_tool",
         scope: "tools:write",
-        description: "Test-runs tool code against sample args without persisting it. Fetch is denied by default, same as a freshly attached tool — pass allowedHosts to test code that calls fetch().",
+        description: "Test-runs tool code against sample args without persisting it, with the same time limit a run would give it (timeoutMs, as on create_tool). Fetch is denied by default, same as a freshly attached tool — pass allowedHosts to test code that calls fetch(). For this release a paramsZod is still compiled with Zod 3; a `warnings` list in the result means the next release, which compiles it with Zod 4 only, will reject it or treat the sample args differently.",
         inputSchema: {
             type: "object",
             properties: {
@@ -201,10 +228,13 @@ export function registerToolAuthoringTools(mcp) {
                 code: { type: "string" },
                 sampleArgs: { type: "object" },
                 allowedHosts: { type: "array", items: { type: "string" } },
+                timeoutMs: { type: "integer", description: TIMEOUT_MS_DESCRIPTION },
             },
             required: ["paramsZod", "code", "sampleArgs"],
         },
         handler: async (args, ctx) => {
+            if (args.timeoutMs !== undefined)
+                assertToolTimeout(args.timeoutMs);
             const hosts = ToolCapabilitiesPatchSchema.pick({ allowedHosts: true }).safeParse({
                 allowedHosts: args.allowedHosts,
             });
@@ -217,10 +247,19 @@ export function registerToolAuthoringTools(mcp) {
             }
             const jsonSchema = schemaResult.value;
             const validated = await validateParams(args.paramsZod, args.sampleArgs);
+            // Zod 3 compatibility window: would the next release (Zod 4 only) compile
+            // this schema, and treat the sample arguments the same way?
+            const subject = "This paramsZod";
+            const compatibility = await cachedZod4Compatibility(args.paramsZod);
+            const compatWarning = compatibility.compatible === true
+                ? zod3SampleArgsWarning(subject, validated, await validateParams(args.paramsZod, args.sampleArgs, ["v4"]))
+                : zod3WindowWarning(subject, compatibility);
+            const warnings = compatWarning ? { warnings: [compatWarning] } : {};
             if (!validated.ok) {
                 return textResult({
                     jsonSchema,
                     result: { ok: false, errorKind: validated.errorKind, errorMessage: validated.errorMessage },
+                    ...warnings,
                 });
             }
             // No real agent exists for a dry run — the caller's own principal
@@ -242,8 +281,9 @@ export function registerToolAuthoringTools(mcp) {
                 sharedDatastore: buildSharedDatastoreAccessor(ctx.principal.id, ctx.providers.datastore, ctx.db),
                 toolName: "dry_run_tool",
                 allowedFetchHosts: hosts.data.allowedHosts ?? [],
+                timeoutMs: effectiveToolTimeoutMs(args.timeoutMs, loadToolMaxTimeoutMs()),
             });
-            return textResult({ jsonSchema, result: sandboxResult });
+            return textResult({ jsonSchema, result: sandboxResult, ...warnings });
         },
     });
     mcp.registerTool({
@@ -294,6 +334,9 @@ export function registerToolAuthoringTools(mcp) {
                 if (capabilitiesPassed && !isOwner) {
                     throw new McpError(403, "Only the agent's owner can grant capabilities to an attachment; ask them to re-run attach_tool with the capabilities.");
                 }
+                if (capabilitiesPassed && (await isPublicWritable(tx, agent.id))) {
+                    throw new McpError(409, `Agent "${agent.id}" is writable by everyone, so tool capabilities cannot be granted on it; revoke or lower the everyone grant first.`);
+                }
                 const existing = await tx.agentTool.findUnique({
                     where: { agentId_toolId: { agentId: args.agentId, toolId: args.toolId } },
                 });
@@ -319,6 +362,10 @@ export function registerToolAuthoringTools(mcp) {
                         : " (a tool owned by another principal)";
                     throw new McpError(409, `Agent "${args.agentId}" already has a different tool named "${tool.name}" attached${which}; detach it first.`);
                 }
+                // Nor a name one of the agent's MCP servers already gives the model.
+                const mcpClash = await findSameNamedMcpTool(tx, args.agentId, tool.name);
+                if (mcpClash)
+                    throw new McpError(409, sameNamedMcpToolMessage(args.agentId, tool.name, mcpClash.serverName));
                 // Re-granting an attachment this owner never vouched for: what is
                 // not restated is reset, never silently adopted.
                 const keepUnstated = existing?.capabilitiesGrantedById === agent.ownerId;
@@ -374,19 +421,20 @@ export function registerToolAuthoringTools(mcp) {
         scope: "tools:write",
         inputSchema: { type: "object", properties: { agentId: { type: "string" } } },
         handler: async (args, ctx) => {
-            const project = (tool) => projectTool(tool, ctx.principal.id);
+            // Zod 3 window: the caller's own tools carry their warnings (cached per paramsZod text).
+            const project = (tool) => withZod3ToolWarnings(projectTool(tool, ctx.principal.id));
             if (args.agentId) {
                 const { access } = await requireAgentAccess(ctx, args.agentId, "read");
                 const rows = await ctx.db.agentTool.findMany({ where: { agentId: args.agentId }, include: { tool: true } });
                 // The agent's owner sees every tool on it (projected: code only for
                 // the tool's own owner); anyone else only tools they could see anyway.
-                return textResult(rows
+                return textResult(await Promise.all(rows
                     .map((r) => r.tool)
                     .filter((tool) => access === "owner" || canRead(tool.ownerId, ctx.principal.id))
-                    .map(project));
+                    .map(project)));
             }
             const tools = await ctx.db.tool.findMany({ where: visibleToPrincipal(ctx.principal.id) });
-            return textResult(tools.filter((tool) => canRead(tool.ownerId, ctx.principal.id)).map(project));
+            return textResult(await Promise.all(tools.filter((tool) => canRead(tool.ownerId, ctx.principal.id)).map(project)));
         },
     });
 }

package/dist/mcp/tools/trigger.js

@@ -29,6 +29,7 @@
  * gets 404, not another principal's final text/cost.
  */
 import { dispatchRun } from "../../core/dispatch.js";
+import { RepositoryChoiceRefusedError, resolveCodingRepository } from "../../core/coding-repository.js";
 import { AttributionError, explicitAttribution, RESPONSE_PATH_SNAPSHOT_BUDGET, } from "../../core/attribution.js";
 import { CodingBaseRefSchema, CodingTaskOverrideSchema, isLocalRepository } from "../../coding/protocol.js";
 import { loadLocalRepoRoots, resolveLocalRepository, LocalRepoError } from "../../coding/local-repo.js";
@@ -46,6 +47,7 @@ const TriggerAgentSchema = z
     agentId: z.string().trim().min(1).max(128),
     task: CodingTaskOverrideSchema.optional(),
     baseRef: CodingBaseRefSchema.optional(),
+    repository: z.string().min(1).max(300).optional(),
     issue: z.unknown().optional(),
     review: z
         .object({
@@ -127,10 +129,10 @@ function assertOverrideAllowed(principalId, agent, args) {
     // Strictly the owner: the stdio operator's owner-level access doesn't make
     // it the owner whose repository authority the task steers (review M8).
     const isOwner = agent.ownerId !== null && agent.ownerId === principalId;
-    if (isOwner || (args.task === undefined && args.baseRef === undefined))
+    if (isOwner || (args.task === undefined && args.baseRef === undefined && args.repository === undefined))
         return;
     if (!agent.codingProfile?.allowWebhookTaskOverride) {
-        throw new McpError(403, `Agent "${agent.id}": only its owner can pass a task or baseRef, unless the owner allows it (codingProfile.allowWebhookTaskOverride).`);
+        throw new McpError(403, `Agent "${agent.id}": only its owner can pass a task, baseRef or repository, unless the owner allows it (codingProfile.allowWebhookTaskOverride).`);
     }
 }
 /** execute on the agent, plus the override rule; `db` is the transaction when re-checking. */
@@ -150,6 +152,10 @@ export function registerTriggerTool(mcp) {
                 agentId: { type: "string" },
                 task: { type: "string" },
                 baseRef: { type: "string" },
+                repository: {
+                    type: "string",
+                    description: "Coding agents only: a repository on the agent's list (see get_agent). Omit to use codingProfile.repository.",
+                },
                 review: {
                     type: "object",
                     additionalProperties: false,
@@ -189,13 +195,28 @@ export function registerTriggerTool(mcp) {
                 }
                 review = await resolveLocalReview(ctx, agent.id, args.review);
             }
-            if (agent.kind !== "coding" && (args.task !== undefined || args.baseRef !== undefined)) {
-                throw new McpError(400, "Task and baseRef overrides are only valid for coding agents.");
+            if (agent.kind !== "coding" &&
+                (args.task !== undefined || args.baseRef !== undefined || args.repository !== undefined)) {
+                throw new McpError(400, "Task, baseRef and repository overrides are only valid for coding agents.");
             }
             // A local repository is re-checked against the roots as they are now
             // (they can narrow after the agent was saved), before any run exists.
             let warnings = [];
-            const repository = agent.kind === "coding" ? agent.codingProfile?.repository : undefined;
+            // The resolver's refusal lists the agent's repositories, so it runs only
+            // after requireTriggerable (execute on the agent) and never echoes the
+            // requested value.
+            const refused = (err) => {
+                if (err instanceof RepositoryChoiceRefusedError)
+                    throw new McpError(400, `${err.code}: ${err.message}`);
+                throw err;
+            };
+            const repository = agent.kind === "coding" && agent.codingProfile
+                ? (await resolveCodingRepository(ctx.db, {
+                    agentId: agent.id,
+                    profile: agent.codingProfile,
+                    requested: args.repository,
+                }).catch(refused)).repository
+                : undefined;
             if (repository !== undefined && isLocalRepository(repository)) {
                 try {
                     const resolved = await resolveLocalRepository(repository, loadLocalRepoRoots(process.env).roots);
@@ -238,6 +259,7 @@ export function registerTriggerTool(mcp) {
                     trigger: "manual",
                     codingTask: args.task,
                     codingBaseRef: args.baseRef,
+                    codingRepository: args.repository,
                     attribution,
                     task: ctx.clientSupportsTasks ? { principalId: ctx.principal.id, ttlMs: DEFAULT_TASK_TTL_MS } : undefined,
                     triggeredById: ctx.principal.id,
@@ -262,7 +284,7 @@ export function registerTriggerTool(mcp) {
             catch (err) {
                 if (pullRequest)
                     await ctx.db.localPullRequest.deleteMany({ where: { id: pullRequest.id } }).catch(() => { });
-                throw err;
+                return refused(err);
             }
             if (ctx.clientSupportsTasks) {
                 if (!dispatched.task)

package/dist/mcp/transport/http-limits.d.ts

@@ -14,4 +14,6 @@ export declare class PayloadTooLargeError extends HttpBoundaryError {
 }
 export declare function canonicalUrl(value: string): URL;
 export declare function readBody(req: IncomingMessage, maxBytes: number, signal: AbortSignal): Promise<string>;
+/** readBody's bytes, undecoded (for a route that forwards the body unchanged). */
+export declare function readBodyBytes(req: IncomingMessage, maxBytes: number, signal: AbortSignal): Promise<Buffer>;
 export declare function parseBody(raw: string, contentType: string | undefined): unknown;

package/dist/mcp/transport/http-limits.js

@@ -23,7 +23,11 @@ export function canonicalUrl(value) {
     }
     return url;
 }
-export function readBody(req, maxBytes, signal) {
+export async function readBody(req, maxBytes, signal) {
+    return (await readBodyBytes(req, maxBytes, signal)).toString("utf8");
+}
+/** readBody's bytes, undecoded (for a route that forwards the body unchanged). */
+export function readBodyBytes(req, maxBytes, signal) {
     const length = req.headers["content-length"];
     if (length && (!/^\d+$/.test(length) || Number(length) > maxBytes))
         return Promise.reject(new PayloadTooLargeError());
@@ -55,7 +59,7 @@ export function readBody(req, maxBytes, signal) {
         };
         const end = () => {
             clean();
-            resolve(Buffer.concat(chunks, size).toString("utf8"));
+            resolve(Buffer.concat(chunks, size));
         };
         req.on("data", data);
         req.once("end", end);

package/dist/mcp/transport/stdio-link-host.d.ts

@@ -0,0 +1,20 @@
+/**
+ * stdio-only host for the signed links some tools hand out (the secret-entry
+ * form, a run transcript download): an ephemeral, loopback-only HTTP server,
+ * started lazily on the first link and closed after a period of inactivity.
+ * stdio's MCP process has no other listener (see stdio.ts); this one exists
+ * only while a link may be in use, consistent with stdio's "no token; the
+ * operator is trusted" model: reachable only from this same machine, and
+ * only a holder of a signed link can do anything with it.
+ *
+ * Request logging: none. A link's token travels in its `t` query parameter
+ * and must never be logged.
+ */
+import { type IncomingMessage, type ServerResponse } from "node:http";
+/** Handles one request for a path; receives the `t` query parameter. Must not log the token. */
+export type StdioLinkHandler = (req: IncomingMessage, res: ServerResponse, token: string | null) => Promise<void>;
+export interface StdioLinkHost {
+    /** The loopback URL for `path` carrying `token`; starts the server if it is not running. */
+    urlFor(path: string, token: string): Promise<string>;
+}
+export declare function createStdioLinkHost(routes: Record<string, StdioLinkHandler>): StdioLinkHost;

package/dist/mcp/transport/stdio-link-host.js

@@ -0,0 +1,67 @@
+/**
+ * stdio-only host for the signed links some tools hand out (the secret-entry
+ * form, a run transcript download): an ephemeral, loopback-only HTTP server,
+ * started lazily on the first link and closed after a period of inactivity.
+ * stdio's MCP process has no other listener (see stdio.ts); this one exists
+ * only while a link may be in use, consistent with stdio's "no token; the
+ * operator is trusted" model: reachable only from this same machine, and
+ * only a holder of a signed link can do anything with it.
+ *
+ * Request logging: none. A link's token travels in its `t` query parameter
+ * and must never be logged.
+ */
+import { createServer } from "node:http";
+/** Matches the requestState codec's own TTL (server.ts): no point outliving the tokens it serves. */
+const IDLE_SHUTDOWN_MS = 10 * 60_000;
+export function createStdioLinkHost(routes) {
+    let server;
+    let port = 0;
+    let idleTimer;
+    function scheduleIdleShutdown() {
+        if (idleTimer)
+            clearTimeout(idleTimer);
+        idleTimer = setTimeout(() => {
+            server?.close();
+            server = undefined;
+        }, IDLE_SHUTDOWN_MS);
+        idleTimer.unref();
+    }
+    async function ensureServer() {
+        if (server) {
+            scheduleIdleShutdown();
+            return port;
+        }
+        const s = createServer((req, res) => {
+            scheduleIdleShutdown();
+            const url = new URL(req.url ?? "/", "http://127.0.0.1");
+            const handler = Object.hasOwn(routes, url.pathname) ? routes[url.pathname] : undefined;
+            if (!handler) {
+                res.writeHead(404).end();
+                return;
+            }
+            // A failure here must never become an unhandled rejection: that would take
+            // down the whole stdio MCP process, not just this request.
+            handler(req, res, url.searchParams.get("t")).catch(() => {
+                if (!res.headersSent)
+                    res.writeHead(500, { "content-type": "text/plain; charset=utf-8" });
+                if (!res.writableEnded)
+                    res.end("Internal error");
+            });
+        });
+        server = s;
+        await new Promise((resolve, reject) => {
+            s.once("error", reject);
+            s.listen(0, "127.0.0.1", resolve);
+        });
+        const address = s.address();
+        port = typeof address === "object" && address ? address.port : 0;
+        scheduleIdleShutdown();
+        return port;
+    }
+    return {
+        async urlFor(path, token) {
+            const p = await ensureServer();
+            return `http://127.0.0.1:${p}${path}?t=${encodeURIComponent(token)}`;
+        },
+    };
+}

package/dist/mcp/transport/streamable-http.d.ts

@@ -8,7 +8,16 @@ import type { McpProviders } from "../context.js";
 import { type GitHubIngressDeps } from "../host-events/github-ingress.js";
 import { type JiraIngressDeps } from "../host-events/jira-ingress.js";
 import { type HostUserCallbackDeps } from "../host-events/github-user-callback.js";
+import type { BlobStore } from "../../providers/storage/types.js";
 import { type ViewerApi } from "../../viewer/http.js";
+/**
+ * close() waits this long for open requests to finish, then cuts them. A
+ * connected MCP client's event stream never ends on its own, so without a
+ * limit close() would hold shutdown until the pod is killed. On Kubernetes
+ * the load balancer has already moved traffic away by then (preStop), and
+ * clients reconnect to another instance.
+ */
+export declare const CLOSE_GRACE_MS = 10000;
 export interface HttpServerConfig {
     canonicalUri: string;
     httpBind: {
@@ -40,6 +49,10 @@ export interface StartHttpServerOptions {
     };
     /** The admin viewer API (/admin/api/*); absent = those paths answer 404. */
     viewer?: ViewerApi;
+    /** The blob store run transcripts are served from (get_run_transcript links); absent = they answer 503. */
+    blobs?: BlobStore;
+    /** How long close() lets open requests finish before cutting them (default CLOSE_GRACE_MS). */
+    closeGraceMs?: number;
 }
 export interface HttpServerHandle {
     port: number;