@wardby/cli 0.7.0 → 0.8.0

package/dist/mcp/tools/mcp-servers.js

@@ -0,0 +1,481 @@
+/**
+ * Remote MCP servers over Wardby's own MCP (docs/mcp-servers.md): register a server (HTTPS URL plus the
+ * owner's brokered secrets), keep its saved tool list fresh, and attach an allowlisted subset of its tools
+ * to an agent. Gated by WARDBY_MCP_SERVERS (off | admins | owners). Results carry secret names, never
+ * values: snapshots and errors arrive from fetchSnapshot already redacted. Audit lines carry the URL's host
+ * only, never the full URL (a query string can carry a token).
+ */
+import { z } from "zod";
+import { Prisma } from "#prisma";
+import { loadMcpServersMode, MCP_SERVERS_OFF_MESSAGE } from "../../config/mcp-servers.js";
+import { loadToolMaxTimeoutMs } from "../../config/tool-timeout.js";
+import { atLeast, deleteGrantsFor, effectiveAccess, grantedIds } from "../../core/grants.js";
+import { logger } from "../../core/logger.js";
+import { McpClientError } from "../../core/mcp-client/client.js";
+import { assertServerName, diffSnapshots, exposedNames, exposedToolName, fetchSnapshot, logCredentialsUnavailable, McpCredentialsUnavailableError, McpServerInputError, normaliseServerUrl, snapshotOf, } from "../../core/mcp-servers.js";
+import { isCodexCoding, isMarkedReadOnly } from "../../core/mcp-tools.js";
+import { REVIEW_HOST_TOOL_NAMES } from "../../core/review-host-tools.js";
+import { preferIndexScans, withSerializableRetry } from "../../core/serializable-retry.js";
+import { reservedToolNameReason } from "../../core/tool-names.js";
+import { agentAccessResolver, assertAgentAccess, requireAgentAccess, requireBindable } from "../auth/access.js";
+import { requireScope } from "../auth/resource-server.js";
+import { McpError } from "../errors.js";
+import { textResult } from "./text-result.js";
+const serversLog = logger.child({ module: "mcp-servers" });
+export { MCP_SERVERS_OFF_MESSAGE };
+const DESCRIPTION_PREVIEW_CHARS = 300;
+const MIN_CALL_TIMEOUT_MS = 1000;
+/**
+ * Refuses when the mode is off, except for cleanup (delete and detach stay possible so an operator who
+ * turns the feature off can still remove servers and attachments); in admins mode, register/update/refresh
+ * also need hosts:admin.
+ */
+function gate(ctx, kind) {
+    const mode = loadMcpServersMode();
+    if (mode === "off" && kind !== "cleanup")
+        throw new McpError(403, MCP_SERVERS_OFF_MESSAGE);
+    if (kind === "configure" && mode === "admins")
+        requireScope(ctx, ctx.canonicalUri, "hosts:admin");
+}
+function audit(ctx, action, server) {
+    serversLog.info({
+        event: `mcp.server.${action}`,
+        serverId: server.id,
+        name: server.name,
+        host: new URL(server.url).hostname,
+        by: ctx.principal.id,
+    }, "MCP server changed");
+}
+function parse(schema, label, value) {
+    const result = schema.safeParse(value);
+    if (result.success)
+        return result.data;
+    const details = result.error.issues.map((i) => `${i.path.join(".") || "input"}: ${i.message}`).join("; ");
+    throw new McpError(400, `Invalid ${label}: ${details}`);
+}
+/**
+ * Input errors → 400; MCP client errors (already redacted) → 502 with their code. Undecryptable
+ * credentials → 500 with their code: the fault is this Wardby server's key setup, not the remote
+ * server (502 would point at it) or the caller's input (400).
+ */
+async function mapped(work) {
+    try {
+        return await work();
+    }
+    catch (err) {
+        if (err instanceof McpServerInputError)
+            throw new McpError(400, err.message);
+        if (err instanceof McpCredentialsUnavailableError) {
+            logCredentialsUnavailable(serversLog, err);
+            throw new McpError(500, `${err.code}: ${err.message}`);
+        }
+        if (err instanceof McpClientError)
+            throw new McpError(502, `${err.code}: ${err.message}`);
+        throw err;
+    }
+}
+function serverNotFound(id) {
+    return new McpError(404, `MCP server "${id}" not found.`);
+}
+/** The caller's own server, or 404 (whether it is missing or someone else's). */
+async function requireOwnedServer(ctx, id, db = ctx.db) {
+    const server = await db.mcpServer.findUnique({ where: { id } });
+    if (!server || server.ownerId !== ctx.principal.id)
+        throw serverNotFound(id);
+    return server;
+}
+/**
+ * A server the caller owns or holds at least `min` on through a grant. Missing and no-access look the same
+ * (404); a grant that is too low says what it lacks (403).
+ */
+async function requireServerAccess(ctx, id, min, db = ctx.db) {
+    const server = await db.mcpServer.findUnique({ where: { id } });
+    if (!server)
+        throw serverNotFound(id);
+    const access = await effectiveAccess(db, "mcp_server", server, ctx.principal.id);
+    if (access === "none")
+        throw serverNotFound(id);
+    if (!atLeast("mcp_server", access, min)) {
+        throw new McpError(403, `MCP server "${server.name}": attaching it needs use access (you have ${access}).`);
+    }
+    return server;
+}
+function takeSnapshot(ctx, server) {
+    return mapped(() => fetchSnapshot(server, { db: ctx.db, cipher: ctx.providers.secrets, fetchImpl: ctx.providers.sandboxFetch }));
+}
+function snapshotData(snapshot) {
+    return {
+        toolSnapshot: snapshot.tools,
+        serverInfo: snapshot.serverInfo,
+        snapshotAt: new Date(),
+    };
+}
+function serverView(server) {
+    return {
+        id: server.id,
+        name: server.name,
+        url: server.url,
+        secretNames: server.secretNames,
+        serverInfo: server.serverInfo,
+        snapshotAt: server.snapshotAt,
+        tools: snapshotOf(server).map((t) => ({
+            name: t.name,
+            description: t.description.slice(0, DESCRIPTION_PREVIEW_CHARS),
+            annotations: t.annotations,
+        })),
+    };
+}
+/** get_agent's mcpServers field: each attachment with its exposed names and allowed tools gone from the snapshot. */
+export async function agentMcpServerViews(db, agentId) {
+    const rows = await db.agentMcpServer.findMany({
+        where: { agentId },
+        include: { server: { select: { id: true, name: true, toolSnapshot: true } } },
+        orderBy: { createdAt: "asc" },
+    });
+    return rows.map((row) => {
+        const present = new Set(snapshotOf(row.server).map((t) => t.name));
+        return {
+            serverId: row.server.id,
+            serverName: row.server.name,
+            allowedTools: row.allowedTools,
+            exposedNames: exposedNames(row.server.name, row.allowedTools),
+            callTimeoutMs: row.callTimeoutMs,
+            missingTools: row.allowedTools.filter((name) => !present.has(name)),
+        };
+    });
+}
+/** The update_agent warning when an agent becomes Codex with attached tools the server doesn't mark read-only. */
+export function codexWriteToolsWarning(names) {
+    return `These MCP tools aren't read-only and won't be available to Codex runs: ${names.join(", ")}.`;
+}
+/**
+ * The exposed names of an agent's attached, allowed tools that the saved tool list doesn't mark read-only:
+ * a Codex run never gets them (loadMcpToolPins with readOnlyOnly). Tools no longer listed are left out.
+ */
+export async function codexUnavailableMcpTools(db, agentId) {
+    const rows = await db.agentMcpServer.findMany({
+        where: { agentId },
+        include: { server: { select: { name: true, toolSnapshot: true } } },
+        orderBy: [{ createdAt: "asc" }, { serverId: "asc" }],
+    });
+    return rows.flatMap((row) => {
+        const byName = new Map(snapshotOf(row.server).map((t) => [t.name, t]));
+        const writers = row.allowedTools.filter((name) => byName.has(name) && !isMarkedReadOnly(byName.get(name)));
+        return exposedNames(row.server.name, writers);
+    });
+}
+const SecretNames = z.array(z.string().min(1).max(1024)).max(8);
+const RegisterSchema = z
+    .object({ name: z.string().max(64), url: z.string().max(2048), secretNames: SecretNames.default([]) })
+    .strict();
+const UpdateSchema = z
+    .object({ id: z.string().min(1).max(64), url: z.string().max(2048).optional(), secretNames: SecretNames.optional() })
+    .strict();
+const IdSchema = z.object({ id: z.string().min(1).max(64) }).strict();
+const AttachSchema = z
+    .object({
+    agentId: z.string().min(1).max(64),
+    serverId: z.string().min(1).max(64),
+    allowedTools: z.array(z.string().min(1).max(200)).min(1).max(500),
+    callTimeoutMs: z.number().int().optional(),
+})
+    .strict();
+const DetachSchema = z.object({ agentId: z.string().min(1).max(64), serverId: z.string().min(1).max(64) }).strict();
+const ID_ONLY = {
+    type: "object",
+    additionalProperties: false,
+    required: ["id"],
+    properties: { id: { type: "string" } },
+};
+export function registerMcpServerTools(mcp) {
+    mcp.registerTool({
+        name: "register_mcp_server",
+        scope: "tools:write",
+        description: "Register a remote MCP server (Streamable HTTP, https only) so its tools can be attached to your agents. secretNames are your brokered secrets, each brokered to the URL's host; they are sent on every request and never readable. Wardby calls the server's tools/list and saves the result. With WARDBY_MCP_SERVERS=admins this needs hosts:admin.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["name", "url"],
+            properties: {
+                name: {
+                    type: "string",
+                    description: "Lower-case letters, digits, _ or -; prefixes the tool names agents see.",
+                },
+                url: { type: "string", description: "The server's https endpoint, e.g. https://mcp.example.com/mcp." },
+                secretNames: { type: "array", items: { type: "string" } },
+            },
+        },
+        handler: async (rawArgs, ctx) => {
+            gate(ctx, "configure");
+            const input = parse(RegisterSchema, "register_mcp_server arguments", rawArgs);
+            const url = await mapped(async () => {
+                assertServerName(input.name);
+                return normaliseServerUrl(input.url);
+            });
+            const ownerId = ctx.principal.id;
+            const taken = () => new McpError(409, `You already have an MCP server named "${input.name}".`);
+            if (await ctx.db.mcpServer.findUnique({ where: { ownerId_name: { ownerId, name: input.name } } }))
+                throw taken();
+            const draft = { id: "", ownerId, name: input.name, url, secretNames: input.secretNames };
+            const snapshot = await takeSnapshot(ctx, draft);
+            let server;
+            try {
+                server = await ctx.db.mcpServer.create({
+                    data: { ownerId, name: input.name, url, secretNames: input.secretNames, ...snapshotData(snapshot) },
+                });
+            }
+            catch (err) {
+                if (err instanceof Prisma.PrismaClientKnownRequestError && err.code === "P2002")
+                    throw taken();
+                throw err;
+            }
+            audit(ctx, "register", server);
+            return textResult(serverView(server));
+        },
+    });
+    mcp.registerTool({
+        name: "update_mcp_server",
+        scope: "tools:write",
+        description: "Owner only: change a server's URL or secretNames. Wardby re-checks the secrets, saves a fresh tool list straight away and returns what changed (diff). With WARDBY_MCP_SERVERS=admins this needs hosts:admin.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["id"],
+            properties: {
+                id: { type: "string" },
+                url: { type: "string" },
+                secretNames: { type: "array", items: { type: "string" } },
+            },
+        },
+        handler: async (rawArgs, ctx) => {
+            gate(ctx, "configure");
+            const input = parse(UpdateSchema, "update_mcp_server arguments", rawArgs);
+            const current = await requireOwnedServer(ctx, input.id);
+            const url = input.url === undefined ? current.url : await mapped(async () => normaliseServerUrl(input.url));
+            const secretNames = input.secretNames ?? current.secretNames;
+            const snapshot = await takeSnapshot(ctx, { ...current, url, secretNames });
+            const server = await ctx.db.mcpServer.update({
+                where: { id: current.id },
+                data: { url, secretNames, ...snapshotData(snapshot) },
+            });
+            audit(ctx, "update", server);
+            return textResult({ ...serverView(server), diff: diffSnapshots(snapshotOf(current), snapshot.tools) });
+        },
+    });
+    mcp.registerTool({
+        name: "refresh_mcp_server",
+        scope: "tools:write",
+        description: "Owner only: fetch the server's tools/list again and save it. Changes apply straight away: an allowed tool the server no longer lists is left out of runs and shown under missingTools by get_agent. Returns the diff (added, removed, changed) and the agents left with missing tools. With WARDBY_MCP_SERVERS=admins this needs hosts:admin.",
+        inputSchema: ID_ONLY,
+        handler: async (rawArgs, ctx) => {
+            gate(ctx, "configure");
+            const { id } = parse(IdSchema, "refresh_mcp_server arguments", rawArgs);
+            const current = await requireOwnedServer(ctx, id);
+            const snapshot = await takeSnapshot(ctx, current);
+            const server = await ctx.db.mcpServer.update({ where: { id }, data: snapshotData(snapshot) });
+            audit(ctx, "refresh", server);
+            const present = new Set(snapshot.tools.map((t) => t.name));
+            const attachments = await ctx.db.agentMcpServer.findMany({
+                where: { serverId: id },
+                include: { agent: { select: { id: true, ownerId: true } } },
+                orderBy: { createdAt: "asc" },
+            });
+            // Name only agents the caller can read; count the rest, so a refresh never reveals others' agent ids.
+            const accessOf = await agentAccessResolver(ctx);
+            const affected = attachments
+                .map((a) => ({ agent: a.agent, missingTools: a.allowedTools.filter((t) => !present.has(t)) }))
+                .filter((a) => a.missingTools.length > 0);
+            const readable = affected.filter((a) => accessOf(a.agent) !== "none");
+            const hidden = affected.length - readable.length;
+            return textResult({
+                diff: diffSnapshots(snapshotOf(current), snapshot.tools),
+                affectedAgents: readable.map((a) => ({ agentId: a.agent.id, missingTools: a.missingTools })),
+                ...(hidden > 0 ? { otherAffectedAgents: hidden } : {}),
+            });
+        },
+    });
+    mcp.registerTool({
+        name: "list_mcp_servers",
+        scope: "agents:read",
+        description: "Your registered MCP servers and the ones shared with you: id, name, host, tool count, when the tool list was saved and yours (false for shared ones, which show no secret names).",
+        inputSchema: { type: "object", additionalProperties: false, properties: {} },
+        handler: async (_rawArgs, ctx) => {
+            gate(ctx, "other");
+            const sharedIds = await grantedIds(ctx.db, "mcp_server", ctx.principal.id, "read");
+            const rows = await ctx.db.mcpServer.findMany({
+                where: { OR: [{ ownerId: ctx.principal.id }, { id: { in: sharedIds } }] },
+                orderBy: [{ name: "asc" }, { id: "asc" }],
+            });
+            return textResult({
+                servers: rows.map((s) => ({
+                    id: s.id,
+                    name: s.name,
+                    host: new URL(s.url).hostname,
+                    ownerId: s.ownerId,
+                    toolCount: snapshotOf(s).length,
+                    snapshotAt: s.snapshotAt,
+                    yours: s.ownerId === ctx.principal.id,
+                    // Secret names stay with the owner.
+                    ...(s.ownerId === ctx.principal.id ? { secretNames: s.secretNames } : {}),
+                })),
+            });
+        },
+    });
+    mcp.registerTool({
+        name: "get_mcp_server",
+        scope: "agents:read",
+        description: "One of your MCP servers, or one shared with you (read or higher), with its full saved tool list (name, description, inputSchema, annotations). Secret names show for the owner only.",
+        inputSchema: ID_ONLY,
+        handler: async (rawArgs, ctx) => {
+            gate(ctx, "other");
+            const { id } = parse(IdSchema, "get_mcp_server arguments", rawArgs);
+            const server = await requireServerAccess(ctx, id, "read");
+            const view = serverView(server);
+            const yours = server.ownerId === ctx.principal.id;
+            // Secret names and the full URL (a query string can carry a token) stay with the owner.
+            const { secretNames: _secretNames, url: _url, ...shared } = view;
+            void _secretNames;
+            void _url;
+            return textResult({
+                ...(yours ? view : { ...shared, host: new URL(server.url).hostname }),
+                yours,
+                ownerId: server.ownerId,
+                tools: snapshotOf(server),
+            });
+        },
+    });
+    mcp.registerTool({
+        name: "delete_mcp_server",
+        scope: "tools:write",
+        description: "Owner only: delete an MCP server. It is detached from every agent, including agents others attached it to through a grant. Allowed even when WARDBY_MCP_SERVERS=off, so cleanup stays possible.",
+        inputSchema: ID_ONLY,
+        handler: async (rawArgs, ctx) => {
+            gate(ctx, "cleanup");
+            const { id } = parse(IdSchema, "delete_mcp_server arguments", rawArgs);
+            const server = await requireOwnedServer(ctx, id);
+            await ctx.db.$transaction(async (tx) => {
+                await tx.mcpServer.delete({ where: { id } });
+                // Grants have no foreign key to the server.
+                await deleteGrantsFor(tx, "mcp_server", id);
+            });
+            audit(ctx, "delete", server);
+            return textResult({ deleted: id });
+        },
+    });
+    mcp.registerTool({
+        name: "attach_mcp_server",
+        scope: "tools:write",
+        description: "Agent owner only: let an agent (native or coding) call the named tools of one of your MCP servers, or of one shared with you at use or higher (its tools then run with the owner's credentials). allowedTools are exact names from the saved tool list (no wildcards); the agent sees each as <server name>__<tool name>. callTimeoutMs (per call, default 30000) is capped by WARDBY_TOOL_MAX_TIMEOUT_MS. Re-attaching replaces the allowlist and time limit. Coding agents get the tools as mcp__wardby_mcp__<name>; Codex agents can use only tools the server marks read-only (readOnlyHint) in the saved tool list.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["agentId", "serverId", "allowedTools"],
+            properties: {
+                agentId: { type: "string" },
+                serverId: { type: "string" },
+                allowedTools: { type: "array", items: { type: "string" } },
+                callTimeoutMs: { type: "integer" },
+            },
+        },
+        handler: async (rawArgs, ctx) => {
+            gate(ctx, "other");
+            const input = parse(AttachSchema, "attach_mcp_server arguments", rawArgs);
+            const ceiling = loadToolMaxTimeoutMs();
+            if (input.callTimeoutMs !== undefined &&
+                (input.callTimeoutMs < MIN_CALL_TIMEOUT_MS || input.callTimeoutMs > ceiling)) {
+                throw new McpError(400, `callTimeoutMs must be at least ${MIN_CALL_TIMEOUT_MS} and at most ${ceiling} (WARDBY_TOOL_MAX_TIMEOUT_MS).`);
+            }
+            const duplicates = input.allowedTools.filter((t, i) => input.allowedTools.indexOf(t) !== i);
+            if (duplicates.length > 0)
+                throw new McpError(400, `allowedTools lists "${duplicates[0]}" more than once.`);
+            // Bounded retry: a concurrent grant change or make_owner on the same rows aborts one side.
+            await withSerializableRetry(() => ctx.db.$transaction(async (tx) => {
+                await preferIndexScans(tx);
+                const { agent } = await assertAgentAccess(ctx, await tx.agent.findUnique({ where: { id: input.agentId } }), input.agentId, "read", tx);
+                // An attachment grants capabilities (the server's secrets act for the agent): strict owner only.
+                await requireBindable(ctx, agent, tx);
+                const server = await requireServerAccess(ctx, input.serverId, "use", tx);
+                const known = new Set(snapshotOf(server).map((t) => t.name));
+                const unknown = input.allowedTools.filter((t) => !known.has(t));
+                if (unknown.length > 0) {
+                    throw new McpError(400, `Not in MCP server "${server.name}"'s saved tool list: ${unknown.join(", ")}. Run refresh_mcp_server if the server added them.`);
+                }
+                if (agent.kind === "coding") {
+                    const profile = await tx.codingAgentProfile.findUnique({
+                        where: { agentId: agent.id },
+                        select: { provider: true },
+                    });
+                    // Fails closed: a coding agent with no profile, or any provider but claude-code, is Codex here.
+                    if (isCodexCoding(profile?.provider)) {
+                        const byName = new Map(snapshotOf(server).map((t) => [t.name, t]));
+                        const writer = input.allowedTools.find((t) => !isMarkedReadOnly(byName.get(t)));
+                        if (writer !== undefined) {
+                            throw new McpError(400, `Codex agents can use only tools the server marks read-only (${writer} isn't).`);
+                        }
+                    }
+                }
+                const exposed = await mapped(async () => input.allowedTools.map((t) => exposedToolName(server.name, t)));
+                await assertNoClash(tx, agent.id, server.id, exposed);
+                const fields = { allowedTools: input.allowedTools, callTimeoutMs: input.callTimeoutMs ?? null };
+                await tx.agentMcpServer.upsert({
+                    where: { agentId_serverId: { agentId: agent.id, serverId: server.id } },
+                    create: { agentId: agent.id, serverId: server.id, attachedById: ctx.principal.id, ...fields },
+                    update: { attachedById: ctx.principal.id, ...fields },
+                });
+            }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable }));
+            return textResult({ attached: true });
+        },
+    });
+    mcp.registerTool({
+        name: "detach_mcp_server",
+        scope: "tools:write",
+        description: "Agent owner only: remove an MCP server's tools from an agent. Allowed even when WARDBY_MCP_SERVERS=off, so cleanup stays possible.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["agentId", "serverId"],
+            properties: { agentId: { type: "string" }, serverId: { type: "string" } },
+        },
+        handler: async (rawArgs, ctx) => {
+            gate(ctx, "cleanup");
+            const input = parse(DetachSchema, "detach_mcp_server arguments", rawArgs);
+            await requireAgentAccess(ctx, input.agentId, "owner");
+            const { count } = await ctx.db.agentMcpServer.deleteMany({
+                where: { agentId: input.agentId, serverId: input.serverId },
+            });
+            return textResult({ detached: count > 0 });
+        },
+    });
+}
+/**
+ * 409 naming the first exposed name that clashes with a built-in, an attached tool or another MCP attachment.
+ * Exported for tests: no valid server and tool name maps to a built-in repository tool name.
+ */
+export async function assertNoClash(tx, agentId, serverId, exposed) {
+    const clash = (name, why) => new McpError(409, `The tool name "${name}" clashes with ${why} on agent "${agentId}".`);
+    const seen = new Set();
+    for (const name of exposed) {
+        if (seen.has(name))
+            throw clash(name, "another of the allowed tools (both map to this name)");
+        seen.add(name);
+        const reserved = reservedToolNameReason(name);
+        if (reserved)
+            throw new McpError(409, `The tool name "${name}" clashes with a built-in: ${reserved}`);
+        if (REVIEW_HOST_TOOL_NAMES.has(name))
+            throw clash(name, "a built-in repository tool");
+    }
+    const attached = await tx.agentTool.findMany({ where: { agentId }, select: { tool: { select: { name: true } } } });
+    for (const { tool } of attached)
+        if (seen.has(tool.name))
+            throw clash(tool.name, "an attached tool");
+    const others = await tx.agentMcpServer.findMany({
+        where: { agentId, serverId: { not: serverId } },
+        include: { server: { select: { name: true } } },
+    });
+    for (const other of others) {
+        for (const name of exposedNames(other.server.name, other.allowedTools)) {
+            if (seen.has(name))
+                throw clash(name, `a tool of MCP server "${other.server.name}"`);
+        }
+    }
+}

package/dist/mcp/tools/repositories.js

@@ -12,8 +12,9 @@
  * See docs/private/2026-09-26-repo-access-authorization-spec-and-plan.md.
  */
 import { Prisma } from "#prisma";
-import { isLocalRepository, normalizeGitHubRepository, normalizeLocalRepository } from "../../coding/protocol.js";
-import { requireAgentAccess, requireBindable, requireBindingOwner, requireNotPublicWritable } from "../auth/access.js";
+import { CodingBaseRefSchema, isLocalRepository, normalizeGitHubRepository, normalizeLocalRepository, } from "../../coding/protocol.js";
+import { codeProviderOf, normalizeHostedRepository } from "../../coding/code-host.js";
+import { assertAgentAccess, requireAgentAccess, requireBindable, requireBindingOwner, requireNotPublicWritable, } from "../auth/access.js";
 import { authorizeRepositoryForSet, canonicalLocalRepository } from "../auth/repo-authorization.js";
 import { requireScope } from "../auth/resource-server.js";
 import { McpError } from "../errors.js";
@@ -27,6 +28,9 @@ function normalizeRepository(provider, repository) {
             return normalizeLocalRepository(repository);
         if (provider === "github")
             return normalizeGitHubRepository(repository);
+        const normalized = normalizeHostedRepository(repository);
+        if (codeProviderOf(normalized) === provider)
+            return normalized;
     }
     catch {
         // fall through
@@ -58,7 +62,7 @@ export function registerRepositoryTools(mcp) {
     mcp.registerTool({
         name: "link_repository",
         scope: "agents:write",
-        description: "Links a native agent you own to a repository on a code-review host, with its access, event triggers, and checkName. " +
+        description: "Links an agent you own to a repository on a code-review host, with its access, event triggers, and checkName. " +
             "Triggers: pull_request (review each PR push), mention (answer @mentions), push (start on merges to the default branch), " +
             "review_fix (automatic review fix rounds). The review_fix trigger makes this agent the one wardby starts, automatically " +
             "and without a human comment, when wardby's own review check requests changes on a pull request a wardby coding run " +
@@ -68,9 +72,10 @@ export function registerRepositoryTools(mcp) {
             "pull_request trigger, and is unique per repository. waitForCi (only with the pull_request trigger) holds this agent's " +
             "review on a pushed head until that head's own CI finishes, instead of racing it; APPROVE is refused while CI on the " +
             "head is failing or still running. Re-linking an already-linked repository replaces its access, triggers, checkName, " +
-            "reviewFixMaxRounds, waitForCi, and markReadyWhenPassing (an omitted field is cleared, not kept) and re-checks access " +
+            "reviewFixMaxRounds, waitForCi, markReadyWhenPassing, and baseRef (an omitted field is cleared, not kept) and re-checks access " +
             "— always send the full desired state. A local repository (local:/abs/path, inside the server's trusted roots) takes " +
-            "no triggers or checkName: it supports manual reviews only (trigger_agent with review).",
+            "no triggers or checkName: it supports manual reviews only (trigger_agent with review). " +
+            "On a coding agent, adds a repository its runs may work in, with write access and no triggers: a GitHub repository or a local one.",
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -99,6 +104,10 @@ export function registerRepositoryTools(mcp) {
                         "after every Wardby review check passed, CI is green and the wardby merge order check (if any) " +
                         "is success (default false).",
                 },
+                baseRef: {
+                    type: "string",
+                    description: "Coding agents only: the base branch for runs in this repository. Default: the coding profile's baseRef.",
+                },
                 adminOverride: {
                     type: "boolean",
                     description: "Admins only (agents:admin with the admin role): approve this link without checking GitHub access, recorded as an admin approval. Allowed on any agent that has an owner, not only the admin's own.",
@@ -113,18 +122,22 @@ export function registerRepositoryTools(mcp) {
             let agent;
             if (args.adminOverride === true) {
                 requireScope(ctx, ctx.canonicalUri, "agents:admin");
-                agent = await ctx.db.agent.findUnique({ where: { id: args.agentId } });
+                agent = await ctx.db.agent.findUnique({
+                    where: { id: args.agentId },
+                    include: { codingProfile: { select: { repository: true } } },
+                });
                 if (!agent)
                     throw new McpError(404, `Agent "${args.agentId}" not found.`);
                 await requireNotPublicWritable(agent, ctx.db);
             }
             else {
-                agent = (await requireAgentAccess(ctx, args.agentId, "read")).agent;
+                const row = await ctx.db.agent.findUnique({
+                    where: { id: args.agentId },
+                    include: { codingProfile: { select: { repository: true } } },
+                });
+                agent = (await assertAgentAccess(ctx, row, args.agentId, "read")).agent;
                 await requireBindable(ctx, agent);
             }
-            if (agent.kind !== "native") {
-                throw new McpError(400, "Repository links are for native agents only; coding agents use codingProfile.repository.");
-            }
             const provider = args.provider ?? (isLocalRepository(args.repository) ? "local" : "github");
             if ((provider === "local") !== isLocalRepository(args.repository)) {
                 throw new McpError(400, `invalid repository "${args.repository}" for provider ${provider}`);
@@ -133,6 +146,32 @@ export function registerRepositoryTools(mcp) {
                 ? await canonicalLocalRepository(args.repository)
                 : normalizeRepository(provider, args.repository);
             const triggers = [...new Set(args.triggers ?? [])];
+            if (agent.kind === "coding") {
+                if (args.access !== "write")
+                    throw new McpError(400, "A coding agent's repository link needs write access.");
+                // As codingProfile.repository: anything else would pass here and fail every run at dispatch.
+                // What a coding run can work in, matching the coding profile.
+                if (provider !== "github" && provider !== "local") {
+                    throw new McpError(400, "A coding agent's repository link must be a GitHub repository or a local: path.");
+                }
+                if (triggers.length > 0 ||
+                    args.checkName !== undefined ||
+                    args.reviewFixMaxRounds !== undefined ||
+                    args.waitForCi !== undefined ||
+                    args.markReadyWhenPassing !== undefined) {
+                    throw new McpError(400, "A coding agent's repository link takes no triggers, checkName, reviewFixMaxRounds, waitForCi or markReadyWhenPassing.");
+                }
+                if (agent.codingProfile?.repository === repository) {
+                    throw new McpError(400, `${repository} is already its default repository (codingProfile.repository).`);
+                }
+            }
+            else if (args.baseRef !== undefined) {
+                throw new McpError(400, "baseRef applies only to a coding agent's repository link.");
+            }
+            const parsedBaseRef = args.baseRef === undefined ? null : CodingBaseRefSchema.safeParse(args.baseRef);
+            if (parsedBaseRef && !parsedBaseRef.success)
+                throw new McpError(400, "baseRef must be a safe branch ref.");
+            const baseRef = parsedBaseRef ? parsedBaseRef.data : null;
             if (provider === "local") {
                 if (triggers.length > 0)
                     throw new McpError(400, "local repositories support manual review only");
@@ -185,6 +224,7 @@ export function registerRepositoryTools(mcp) {
                         reviewFixMaxRounds,
                         waitForCi,
                         markReadyWhenPassing,
+                        baseRef,
                         ...authorization,
                     };
                     return tx.agentRepository.upsert({