@wardby/cli 0.6.0 → 0.8.0

package/dist/mcp/transport/streamable-http.js

@@ -11,9 +11,18 @@ import { handleHostUserCallback } from "../host-events/github-user-callback.js";
 import { canonicalUrl, HTTP_LIMITS, HttpBoundaryError, parseBody, readBody } from "./http-limits.js";
 import { browserHandler } from "../auth/self-hosted/browser.js";
 import { handleSecretElicitationForm, SECRET_ELICITATION_PATH } from "../tools/secret-elicitation-form.js";
+import { handleRunTranscriptDownload, RUN_TRANSCRIPT_DOWNLOAD_PATH } from "../tools/run-transcript-download.js";
 import { logger } from "../../core/logger.js";
 import { VIEWER_API_PREFIX } from "../../viewer/http.js";
 const httpLog = logger.child({ module: "streamable-http" });
+/**
+ * close() waits this long for open requests to finish, then cuts them. A
+ * connected MCP client's event stream never ends on its own, so without a
+ * limit close() would hold shutdown until the pod is killed. On Kubernetes
+ * the load balancer has already moved traffic away by then (preStop), and
+ * clients reconnect to another instance.
+ */
+export const CLOSE_GRACE_MS = 10_000;
 export function sendJson(res, status, body, headers = {}) {
     res
         .writeHead(status, { "content-type": "application/json", "cache-control": "no-store", ...headers })
@@ -35,7 +44,11 @@ export async function startHttpServer(opts) {
     ]);
     const validateHost = hostHeaderValidation([canonical.hostname]);
     const nodeHandler = toNodeHandler(createMcpHandler(opts.mcp.factory, { responseMode: opts.config.responseMode }));
+    // Requests still being answered, so a close that has to cut them can say which they were.
+    const open = new Map();
     const server = createServer({ maxHeaderSize: 16 * 1024, requireHostHeader: false }, (req, res) => {
+        open.set(res, { method: req.method ?? "", path: (req.url ?? "").split("?")[0], startedAt: Date.now() });
+        res.once("close", () => open.delete(res));
         void route(req, res).catch((err) => {
             if (res.headersSent) {
                 res.destroy();
@@ -114,6 +127,17 @@ export async function startHttpServer(opts) {
             });
             return;
         }
+        if (url.pathname === RUN_TRANSCRIPT_DOWNLOAD_PATH) {
+            // The signed link is the credential (no Authorization header); the
+            // token is never logged (open-request tracking keeps the path only).
+            await handleRunTranscriptDownload(req.method, url.searchParams.get("t"), res, {
+                verify: (token) => opts.mcp.verifyRequestState(token),
+                audience: "http",
+                db: opts.auth.db,
+                blobs: opts.blobs,
+            });
+            return;
+        }
         if (oauth && (await oauth(req, res, url, body)))
             return;
         const webhook = /^\/webhooks\/([^/]+)$/.exec(url.pathname);
@@ -203,7 +227,23 @@ export async function startHttpServer(opts) {
         port: typeof address === "object" && address ? address.port : opts.config.httpBind.port,
         close: () => new Promise((resolve, reject) => {
             opts.viewer?.closeStreams();
-            server.close((err) => (err ? reject(err) : resolve()));
+            const cut = setTimeout(() => {
+                const now = Date.now();
+                const requests = [...open.values()].map((r) => ({
+                    method: r.method,
+                    path: r.path,
+                    openSeconds: Math.round((now - r.startedAt) / 1000),
+                }));
+                httpLog.info({ requests }, "HTTP connections still open after the close grace; closing them");
+                server.closeAllConnections();
+            }, opts.closeGraceMs ?? CLOSE_GRACE_MS);
+            server.close((err) => {
+                clearTimeout(cut);
+                if (err)
+                    reject(err);
+                else
+                    resolve();
+            });
             server.closeIdleConnections();
         }),
     };

package/dist/mcp/webhooks/ingress.js

@@ -18,11 +18,19 @@ export async function handleWebhookIngress(webhookId, req, db, executor, issueTr
     if (req.body.task !== undefined && codingTask === undefined) {
         return { status: 400, body: { error: "invalid_task" } };
     }
+    // `wardbyRepository`, not `repository`, for the same reason: a forwarded GitHub
+    // payload carries its own top-level `repository` object.
+    const repository = req.body.wardbyRepository;
+    if (repository !== undefined &&
+        (typeof repository !== "string" || repository.length === 0 || repository.length > 300)) {
+        return { status: 400, body: { error: "invalid_repository" } };
+    }
     // `wardbyIssue`, not `issue`: forwarded third-party payloads (GitHub, Jira)
     // carry their own top-level `issue` object, which is not ours to read.
     const result = await resolveWebhookRun(webhookId, secret, db, executor, codingTask, {
         issue: req.body.wardbyIssue,
         issueTrackers,
+        repository,
     });
     if (result.ok) {
         return { status: 202, body: { runId: result.runId } };
@@ -30,6 +38,8 @@ export async function handleWebhookIngress(webhookId, req, db, executor, issueTr
     switch (result.reason) {
         case "invalid_issue":
             return { status: 400, body: { error: "invalid_issue", error_description: result.message } };
+        case "invalid_repository":
+            return { status: 400, body: { error: "invalid_repository" } };
         case "not_found":
             return { status: 404, body: { error: "not_found" } };
         case "invalid_secret":

package/dist/native-worker/docker-launcher.d.ts

@@ -6,9 +6,45 @@
  * twice, and a restarted server re-finds a running worker by name.
  */
 import { type NativeWorkerLimits } from "./docker-isolation.js";
-import type { DetachedWorkerLauncher, WorkerHandle } from "./launch.js";
+import type { DetachedWorkerLauncher, WorkerHandle, WorkerLaunchOptions } from "./launch.js";
 import type { WorkerInput } from "./protocol.js";
 import { type WarmWorkerLauncher } from "./warm-pool.js";
+/**
+ * Bounded, so a noisy worker cannot flood the log. The worker holds no long-lived credentials (only
+ * its run's gateway capability), and it redacts the secret values it received (every `secrets.get`
+ * result, and the capability) from everything it writes to stderr, its failure line and logger lines
+ * included (stderr-redaction.ts), with the console bridge's redactor and its minimum length. The
+ * worker is untrusted, so the launcher masks the tail again itself (workerTailFields).
+ */
+export declare const WORKER_STDERR_TAIL_CHARS = 2000;
+/** How long a failed worker's diagnostic (its log read and its secret values read) may take in all. */
+export declare const WORKER_TAIL_TIMEOUT_MS = 10000;
+/**
+ * Log fields for a failed worker's output. `stderrTailOmitted` says why there is no tail although
+ * there may be output: its secret values could not be read (so it could not be redacted), or its
+ * log could not be read (Kubernetes).
+ */
+export interface WorkerTailFields {
+    stderrTail?: string;
+    stderrTailOmitted?: "secrets_unavailable" | "log_read_failed";
+}
+/** `promise`, or a rejection once `ms` pass first. */
+export declare function withTimeout<T>(promise: Promise<T>, ms: number): Promise<T>;
+/**
+ * A failed worker's output tail as log fields: `stderrTail`, masked by exact value through the
+ * shared redactor against every secret value delivered to that worker (its gateway capability,
+ * from its input, and each value its tools may read, from `secretValues`, with their JSON-escaped
+ * forms). When those values are not given, cannot be read, or are not read within `timeoutMs`, no
+ * tail: `stderrTailOmitted: "secrets_unavailable"` (fail closed). No fields when the output is empty.
+ *
+ * `cut`: `output` is a slice of a longer output (a log read bounded by lines or bytes), so it may
+ * begin (`start`) or end (`end`) inside a value, which no exact match finds; as many characters as
+ * the longest value less one are masked at each cut end too.
+ */
+export declare function workerTailFields(output: string, input: WorkerInput, secretValues: (() => Promise<readonly string[]>) | undefined, cut?: {
+    start?: boolean;
+    end?: boolean;
+}, timeoutMs?: number): Promise<WorkerTailFields>;
 export interface DockerResult {
     code: number | null;
     stdout: string;
@@ -44,7 +80,7 @@ export declare class DockerNativeWorkerLauncher implements DetachedWorkerLaunche
     private must;
     /** The image must be present and pinned; a digest is pulled once, a local id must already exist. */
     private ensureImage;
-    launch(input: WorkerInput): Promise<WorkerHandle>;
+    launch(input: WorkerInput, launchOptions?: WorkerLaunchOptions): Promise<WorkerHandle>;
     /** Waits for (and reports) the worker's exit; usable after a server restart. */
     handle(runId: string): WorkerHandle;
     private handleByName;

package/dist/native-worker/docker-launcher.js

@@ -8,10 +8,65 @@
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { logger } from "../core/logger.js";
+import { maskSpans, mergeSpans, secretSpans, withEscapedForms } from "../core/secret-spans.js";
 import { buildGatewayConnectArgs, buildGatewayDisconnectArgs, buildNativeNetworkCreateArgs, buildNativeWarmNetworkCreateArgs, buildNativeWarmWorkerRunArgs, buildNativeWorkerRunArgs, gatewayConnectArgs, gatewayDisconnectArgs, nativeIsolationNames, nativeWarmIsolationNames, NATIVE_WARM_LABEL_FILTER, NATIVE_WARM_TOKEN_LABEL, NATIVE_WORKER_LABEL_FILTER, } from "./docker-isolation.js";
 import { warmDeliveryCommand } from "./warm-delivery.js";
 import { NATIVE_SANDBOX_WARM_DELIVERY_FAILED } from "./warm-pool.js";
 const launcherLog = logger.child({ module: "native-docker-launcher" });
+/**
+ * Bounded, so a noisy worker cannot flood the log. The worker holds no long-lived credentials (only
+ * its run's gateway capability), and it redacts the secret values it received (every `secrets.get`
+ * result, and the capability) from everything it writes to stderr, its failure line and logger lines
+ * included (stderr-redaction.ts), with the console bridge's redactor and its minimum length. The
+ * worker is untrusted, so the launcher masks the tail again itself (workerTailFields).
+ */
+export const WORKER_STDERR_TAIL_CHARS = 2000;
+/** How long a failed worker's diagnostic (its log read and its secret values read) may take in all. */
+export const WORKER_TAIL_TIMEOUT_MS = 10_000;
+/** `promise`, or a rejection once `ms` pass first. */
+export function withTimeout(promise, ms) {
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error("worker_diagnostic_timeout")), Math.max(0, ms));
+    });
+    return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+}
+/**
+ * A failed worker's output tail as log fields: `stderrTail`, masked by exact value through the
+ * shared redactor against every secret value delivered to that worker (its gateway capability,
+ * from its input, and each value its tools may read, from `secretValues`, with their JSON-escaped
+ * forms). When those values are not given, cannot be read, or are not read within `timeoutMs`, no
+ * tail: `stderrTailOmitted: "secrets_unavailable"` (fail closed). No fields when the output is empty.
+ *
+ * `cut`: `output` is a slice of a longer output (a log read bounded by lines or bytes), so it may
+ * begin (`start`) or end (`end`) inside a value, which no exact match finds; as many characters as
+ * the longest value less one are masked at each cut end too.
+ */
+export async function workerTailFields(output, input, secretValues, cut = {}, timeoutMs = WORKER_TAIL_TIMEOUT_MS) {
+    if (!output.trim())
+        return {};
+    let delivered;
+    try {
+        if (!secretValues)
+            return { stderrTailOmitted: "secrets_unavailable" };
+        delivered = await withTimeout(secretValues(), timeoutMs);
+    }
+    catch {
+        return { stderrTailOmitted: "secrets_unavailable" };
+    }
+    const values = withEscapedForms([...(input.gateway ? [input.gateway.capability] : []), ...delivered]);
+    const spans = secretSpans(output, values);
+    const longest = Math.max(0, ...values.map((value) => value.length));
+    if (longest > 1) {
+        if (cut.start)
+            spans.push([0, Math.min(output.length, longest - 1)]);
+        if (cut.end)
+            spans.push([Math.max(0, output.length - (longest - 1)), output.length]);
+    }
+    // Masked whole, then cut: a cut can then split only a marker or plain text, never a value.
+    const stderrTail = maskSpans(output, mergeSpans(spans)).trim().slice(-WORKER_STDERR_TAIL_CHARS);
+    return stderrTail ? { stderrTail } : {};
+}
 export function processDockerCli(binary = "docker") {
     return {
         run(args, options = {}) {
@@ -20,8 +75,12 @@ export function processDockerCli(binary = "docker") {
                 let stdout = "";
                 let stderr = "";
                 const timer = options.timeoutMs ? setTimeout(() => child.kill("SIGKILL"), options.timeoutMs) : undefined;
-                child.stdout.on("data", (chunk) => (stdout += chunk.toString()));
-                child.stderr.on("data", (chunk) => (stderr += chunk.toString()));
+                // One decoder per stream, so a multi-byte character split across chunks still decodes (and a
+                // secret holding it still matches the redactor exactly).
+                child.stdout.setEncoding("utf8");
+                child.stderr.setEncoding("utf8");
+                child.stdout.on("data", (chunk) => (stdout += chunk));
+                child.stderr.on("data", (chunk) => (stderr += chunk));
                 child.on("error", (err) => resolve({ code: null, stdout, stderr: err.message }));
                 child.on("close", (code) => {
                     if (timer)
@@ -55,7 +114,7 @@ export class DockerNativeWorkerLauncher {
             return;
         await this.must(["image", "pull", "--quiet", this.options.image], "pull the worker image");
     }
-    async launch(input) {
+    async launch(input, launchOptions = {}) {
         const runId = input.runId;
         const names = nativeIsolationNames(runId);
         const existing = await this.inspect(runId);
@@ -66,9 +125,10 @@ export class DockerNativeWorkerLauncher {
             const args = buildNativeWorkerRunArgs({ runId, image: this.options.image, limits: this.options.limits });
             // Attached so the input (capability included) goes in on stdin; the exit is read with
             // `docker wait`, which a restarted server can call again.
-            void this.docker.run(args, { input: `${JSON.stringify(input)}\n` }).then((result) => {
+            void this.docker.run(args, { input: `${JSON.stringify(input)}\n` }).then(async (result) => {
                 if (result.code !== 0 && result.code !== null && !/Conflict/.test(result.stderr)) {
-                    launcherLog.warn({ container: names.worker, code: result.code }, "native worker exited non-zero");
+                    const tail = await workerTailFields(result.stderr, input, launchOptions.secretValues);
+                    launcherLog.warn({ container: names.worker, code: result.code, ...tail }, "native worker exited non-zero");
                 }
             });
         }

package/dist/native-worker/gateway-server.d.ts

@@ -10,9 +10,12 @@
  * session budget before the provider is called and settles at the provider's
  * reported usage; the worker's own usage numbers are never read.
  */
-import { type NativeRunProviders, type RunnerDb } from "../core/runner.js";
-import type { LlmStreamEvent } from "../providers/llm/types.js";
-import { PrismaGatewayLedger } from "./ledger.js";
+import { createNativeRunTools, durableDelegate, type NativeRunFinishContext, type NativeRunProviders, type RunnerDb, type SandboxSessionSnapshot } from "../core/runner.js";
+import type { CodingMcpDeps } from "../core/coding-mcp.js";
+import { ReviewReadLedger } from "../core/review-reads.js";
+import type { LlmProvider, LlmStreamEvent } from "../providers/llm/types.js";
+import { PrismaGatewayLedger, type GatewaySessionRecord } from "./ledger.js";
+import { type GatewayParams } from "./protocol.js";
 /** Output tokens reserved for a model call that names no maxTokens (as the coding proxy does). */
 export declare const GATEWAY_DEFAULT_RESERVE_OUTPUT_TOKENS = 4096;
 /** The most output tokens one call may reserve for. */
@@ -24,6 +27,8 @@ export interface GatewayServerDeps {
     providers: NativeRunProviders;
     /** Delegation long-poll window; tests shorten it. */
     pollWindowMs?: number;
+    /** Serves POST /coding-mcp on the same listener (remote MCP servers for coding runs); unset → 404. */
+    codingMcp?: CodingMcpDeps;
 }
 /** What a request gets back: one JSON value, or a stream of model events. */
 export type GatewayResponse = {
@@ -37,3 +42,50 @@ export type GatewayResponse = {
 };
 /** Serves one gateway request. Never throws: every failure is a response. */
 export declare function serveGatewayRequest(deps: GatewayServerDeps, authorization: string | undefined, body: unknown): Promise<GatewayResponse>;
+/**
+ * Every secret value the rebuilt run can read (each user tool's readable or brokered values), and
+ * the request's own capability: what a cause code is checked against before it leaves the gateway.
+ */
+export declare function runSecretValues(ctx: Pick<RebuiltRun, "snapshot" | "tools">, capability: string): () => Promise<string[]>;
+/**
+ * A failure as its response. Only a checked cause code leaves the gateway (workerGatewayError),
+ * never the rest of an unexpected error's message; the server's own log line is redacted by the
+ * same values.
+ */
+export declare function failureResponse(err: unknown, secretValues: (() => Promise<string[]>) | undefined): Promise<GatewayResponse>;
+/** A model stream whose failure reaches the worker as the same checked error a JSON response carries. */
+export declare function checkedEvents(events: AsyncIterable<LlmStreamEvent>, secretValues: (() => Promise<string[]>) | undefined): AsyncIterable<LlmStreamEvent>;
+interface RebuiltRun {
+    session: GatewaySessionRecord;
+    snapshot: SandboxSessionSnapshot;
+    llm: LlmProvider;
+    tools: ReturnType<typeof createNativeRunTools>;
+    /** The run's review reads, restored from the session; saved back after each read (see builtin). */
+    reviewReads: ReviewReadLedger;
+    finishContext: NativeRunFinishContext;
+    delegation: Omit<Parameters<typeof durableDelegate>[0], "ledger" | "sessionId">;
+}
+/** Exported for its unit test; the HTTP handler is its only production caller. */
+export declare function streamModel(ctx: RebuiltRun, ledger: PrismaGatewayLedger, callId: string, params: GatewayParams<"llm.stream">): AsyncIterable<LlmStreamEvent>;
+/**
+ * Logged (at warn) in place of a user tool's console line when that tool's redaction list cannot
+ * be read: without the complete list the line cannot be shown to be free of its secret values, so
+ * none of it is logged. The tool's call still succeeds, as a console write does in-process.
+ */
+export declare const CONSOLE_WITHHELD_MESSAGE = "sandbox tool console line withheld: the tool's secret values could not be read";
+/** Serves one privileged bridge call for a worker (exported for tests). */
+export declare function hostCall(ctx: RebuiltRun, ledger: PrismaGatewayLedger, callId: string, params: GatewayParams<"host.call">): Promise<unknown>;
+/** Added to a tool's limit for one host call: the worker's own wall time ends the call first. */
+export declare const GATEWAY_HOST_CALL_MARGIN_MS = 20000;
+/** How long one host call of `tool` may take: its limit plus the margin, cut to the run's deadline. */
+export declare function hostCallTimeoutMs(ctx: {
+    session: {
+        deadlineAt: Date;
+    };
+    tools: {
+        toolTimeoutMs: (name: string) => number | undefined;
+    };
+}, tool: string, now?: number): number;
+/** The worker's terminal call: the run's one terminal write (masked by finishNativeRun), then the session ends. */
+export declare function finish(ctx: RebuiltRun, ledger: PrismaGatewayLedger, callId: string, params: GatewayParams<"finish">): Promise<null>;
+export {};