@wardby/cli 0.7.0 → 0.8.0

package/dist/sandbox/eval-core.d.ts

@@ -6,7 +6,7 @@
  * compilation/validation is pure computation, no host I/O at all).
  */
 import type { QuickJSContext, QuickJSRuntime } from "quickjs-emscripten";
-export type SandboxErrorKind = "thrown" | "timeout" | "memory" | "cpu" | "non_serializable";
+export type SandboxErrorKind = "thrown" | "timeout" | "memory" | "cpu" | "non_serializable" | "cancelled";
 export type SandboxResult = {
     ok: true;
     value: unknown;
@@ -34,4 +34,14 @@ export declare function classifyEvalError(dumped: {
     name?: string;
     message?: string;
 }): SandboxResult;
-export declare function evalToJson(code: string, limitsOverride: Partial<SandboxLimits> | undefined, installExtras: (context: QuickJSContext, runtime: QuickJSRuntime, signal: AbortSignal) => void): Promise<SandboxResult>;
+export interface EvalOptions {
+    /**
+     * Ends the evaluation early when it aborts (a stopped run): the result is `aborted(reason)`,
+     * and every host call still in flight is aborted with it.
+     */
+    signal?: AbortSignal;
+    aborted?: (reason: unknown) => SandboxResult;
+    /** The wall-time error's text; defaults to naming the limit. */
+    timeoutMessage?: (limitMs: number) => string;
+}
+export declare function evalToJson(code: string, limitsOverride: Partial<SandboxLimits> | undefined, installExtras: (context: QuickJSContext, runtime: QuickJSRuntime, signal: AbortSignal) => void, options?: EvalOptions): Promise<SandboxResult>;

package/dist/sandbox/eval-core.js

@@ -56,9 +56,14 @@ export function classifyEvalError(dumped) {
         errorMessage: dumped.message ? `${dumped.name ?? "Error"}: ${dumped.message}` : JSON.stringify(dumped),
     };
 }
-export async function evalToJson(code, limitsOverride, installExtras) {
+const defaultAborted = () => ({ ok: false, errorKind: "cancelled", errorMessage: "Cancelled." });
+export async function evalToJson(code, limitsOverride, installExtras, options = {}) {
     const limits = { ...DEFAULT_SANDBOX_LIMITS, ...limitsOverride };
+    const aborted = options.aborted ?? defaultAborted;
+    if (options.signal?.aborted)
+        return aborted(options.signal.reason);
     const controller = new AbortController();
+    let onAbort;
     let timer;
     const deadline = Date.now() + limits.wallTimeLimitMs;
     const qjsModule = await getQuickJsModule();
@@ -68,7 +73,7 @@ export async function evalToJson(code, limitsOverride, installExtras) {
     let steps = 0;
     runtime.setInterruptHandler(() => {
         steps += 1;
-        return steps > limits.maxInterruptChecks || Date.now() >= deadline;
+        return steps > limits.maxInterruptChecks || Date.now() >= deadline || options.signal?.aborted === true;
     });
     const context = runtime.newContext();
     let disposed = false;
@@ -139,10 +144,19 @@ export async function evalToJson(code, limitsOverride, installExtras) {
             timer = setTimeout(() => resolve({
                 ok: false,
                 errorKind: "timeout",
-                errorMessage: `Exceeded the ${limits.wallTimeLimitMs}ms wall-time limit.`,
+                errorMessage: options.timeoutMessage
+                    ? options.timeoutMessage(limits.wallTimeLimitMs)
+                    : `Exceeded the ${limits.wallTimeLimitMs}ms wall-time limit.`,
             }), limits.wallTimeLimitMs);
         });
-        return await Promise.race([runPromise, timeoutPromise]);
+        const external = options.signal;
+        const abortPromise = new Promise((resolve) => {
+            if (!external)
+                return;
+            onAbort = () => resolve(aborted(external.reason));
+            external.addEventListener("abort", onAbort, { once: true });
+        });
+        return await Promise.race([runPromise, timeoutPromise, abortPromise]);
     }
     catch (err) {
         return {
@@ -153,6 +167,8 @@ export async function evalToJson(code, limitsOverride, installExtras) {
     }
     finally {
         clearTimeout(timer);
+        if (onAbort)
+            options.signal?.removeEventListener("abort", onAbort);
         controller.abort();
         disposeAll();
     }

package/dist/sandbox/host-functions.d.ts

@@ -43,6 +43,8 @@ export interface HostFunctionOptions {
     redactSecretValues?: readonly string[];
     /** Overrides the network call — tests only. */
     fetchImpl?: typeof safeFetch;
+    /** Each fetch's timeout (fetchTimeoutFor the tool's limit); the default fetch timeout when absent. */
+    fetchTimeoutMs?: number;
 }
 /** One host bridge: JSON-string arguments in, a JSON-serializable value out (bridge.ts). */
 export type HostBridge = (argsJson: string) => Promise<unknown>;
@@ -63,6 +65,8 @@ export declare function createPrivilegedHost(options: PrivilegedHostOptions): Pr
 export interface SandboxApiOptions {
     privileged: PrivilegedHost;
     signal?: AbortSignal;
+    /** The tool's time limit, which also caps sleep(); the default wall-time cap when absent. */
+    wallTimeLimitMs?: number;
     /** Overrides the shared default parser-worker pool — mainly for tests. */
     parserPool?: ParserWorkerPool;
 }

package/dist/sandbox/host-functions.js

@@ -95,7 +95,11 @@ export function createPrivilegedHost(options) {
         },
         async __bridge_fetch(argsJson) {
             const [url, init = {}, secretNames] = args(argsJson);
-            const policy = { ...sandboxFetchPolicy(allowedFetchHosts ?? []), signal };
+            const policy = {
+                ...sandboxFetchPolicy(allowedFetchHosts ?? []),
+                signal,
+                ...(options.fetchTimeoutMs !== undefined ? { timeoutMs: options.fetchTimeoutMs } : {}),
+            };
             if (secretNames === undefined || (Array.isArray(secretNames) && secretNames.length === 0)) {
                 return fetchImpl(url, init, policy);
             }
@@ -177,13 +181,14 @@ export function createPrivilegedHost(options) {
 /** Registers the whole sandbox API: the local bridges directly, the privileged ones through `privileged`. */
 export function installSandboxApi(context, runtime, options) {
     const { privileged, signal } = options;
+    const sleepLimitMs = options.wallTimeLimitMs ?? WALL_TIME_LIMIT_MS;
     const register = (name, fn) => registerJsonAsyncFunction(context, runtime, name, fn, signal);
     const parserPool = options.parserPool ?? (sharedParserPool ??= createParserWorkerPool());
     for (const name of PRIVILEGED_BRIDGE_NAMES)
         register(name, (argsJson) => privileged[name](argsJson));
     register("__bridge_sleep", async (argsJson) => {
         const [ms] = args(argsJson);
-        if (!Number.isFinite(ms) || ms < 0 || ms > WALL_TIME_LIMIT_MS)
+        if (!Number.isFinite(ms) || ms < 0 || ms > sleepLimitMs)
             throw new Error("sleep_limit");
         await sleep(ms, undefined, { signal });
         return null;

package/dist/sandbox/limits.d.ts

@@ -15,7 +15,10 @@ export declare const MAX_INTERRUPT_CHECKS = 20000000;
  * awaiting a host async call (e.g. a slow `fetch`) — this does.
  */
 export declare const WALL_TIME_LIMIT_MS = 10000;
-/** Timeout for the sandbox's `fetch` host bridge, independent of the wall-time cap. */
+/**
+ * safeFetch's timeout when its caller gives none. A sandboxed tool's fetches get
+ * fetchTimeoutFor(the tool's limit) instead (tool-timeout.ts), just past its wall time.
+ */
 export declare const FETCH_TIMEOUT_MS = 8000;
 /** QuickJS interpreter stack size cap (bytes). */
 export declare const MAX_STACK_SIZE_BYTES: number;

package/dist/sandbox/limits.js

@@ -15,7 +15,10 @@ export const MAX_INTERRUPT_CHECKS = 20_000_000;
  * awaiting a host async call (e.g. a slow `fetch`) — this does.
  */
 export const WALL_TIME_LIMIT_MS = 10_000;
-/** Timeout for the sandbox's `fetch` host bridge, independent of the wall-time cap. */
+/**
+ * safeFetch's timeout when its caller gives none. A sandboxed tool's fetches get
+ * fetchTimeoutFor(the tool's limit) instead (tool-timeout.ts), just past its wall time.
+ */
 export const FETCH_TIMEOUT_MS = 8_000;
 /** QuickJS interpreter stack size cap (bytes). */
 export const MAX_STACK_SIZE_BYTES = 1024 * 1024; // 1 MiB

package/dist/sandbox/run-in-sandbox.d.ts

@@ -27,6 +27,8 @@ export interface SandboxInvocation {
     toolName: string;
     /** Overrides the default limits (limits.ts) — mainly for fast, deterministic tests. */
     limits?: Partial<SandboxLimits>;
+    /** The tool's time limit (effectiveToolTimeoutMs); its fetches time out just before it. Overrides limits.wallTimeLimitMs. */
+    timeoutMs?: number;
     /** Omitted for a dry run (no real agent) — secrets.get always resolves undefined. */
     secrets?: SecretsAccessor;
     /** Overrides the default shared logger — mainly for tests that need to capture forwarded console output. */
@@ -42,12 +44,16 @@ export interface ToolCodeInvocation {
     code: string;
     params: unknown;
     limits?: Partial<SandboxLimits>;
+    /** Stops the call early (its run was stopped): it fails as `cancelled`, and its host calls are aborted. */
+    signal?: AbortSignal;
     /** Built once per invocation, with that invocation's abort signal (fetch needs it). */
     privileged: (signal: AbortSignal) => PrivilegedHost;
     parserPool?: ParserWorkerPool;
 }
 /** Evaluates one tool body in a fresh QuickJS context against the given privileged host. */
 export declare function runToolCode(invocation: ToolCodeInvocation): Promise<SandboxResult>;
+/** The sandbox limits for a tool whose time limit is `timeoutMs` (absent: the defaults). */
+export declare function toolLimits(timeoutMs: number | undefined, base?: Partial<SandboxLimits>): Partial<SandboxLimits>;
 /** The in-process privileged host for a sandbox invocation. */
 export declare function privilegedHostFor(invocation: SandboxInvocation, signal: AbortSignal): PrivilegedHost;
 export declare function runInSandbox(invocation: SandboxInvocation): Promise<SandboxResult>;

package/dist/sandbox/run-in-sandbox.js

@@ -9,7 +9,8 @@
  */
 import { createPrivilegedHost, installSandboxApi } from "./host-functions.js";
 import { SANDBOX_PRELUDE } from "./prelude.js";
-import { evalToJson, NON_SERIALIZABLE_MARKER } from "./eval-core.js";
+import { DEFAULT_SANDBOX_LIMITS, evalToJson, NON_SERIALIZABLE_MARKER, } from "./eval-core.js";
+import { fetchTimeoutFor, TOOL_RUN_STOPPED_MESSAGE, toolTimeoutMessage } from "./tool-timeout.js";
 import { boundedJson, boundedString } from "./bounded-json.js";
 import { BRIDGE_INPUT_BYTES } from "./limits.js";
 /** Evaluates one tool body in a fresh QuickJS context against the given privileged host. */
@@ -39,14 +40,24 @@ export async function runToolCode(invocation) {
     throw new Error("${NON_SERIALIZABLE_MARKER}" + (__serializeErr && __serializeErr.message));
   }
 })()`;
+    const wallTimeLimitMs = invocation.limits?.wallTimeLimitMs ?? DEFAULT_SANDBOX_LIMITS.wallTimeLimitMs;
     return evalToJson(code, invocation.limits, (context, runtime, signal) => {
         installSandboxApi(context, runtime, {
             privileged: invocation.privileged(signal),
             signal,
             parserPool: invocation.parserPool,
+            wallTimeLimitMs,
         });
+    }, {
+        signal: invocation.signal,
+        aborted: () => ({ ok: false, errorKind: "cancelled", errorMessage: TOOL_RUN_STOPPED_MESSAGE }),
+        timeoutMessage: toolTimeoutMessage,
     });
 }
+/** The sandbox limits for a tool whose time limit is `timeoutMs` (absent: the defaults). */
+export function toolLimits(timeoutMs, base) {
+    return timeoutMs === undefined ? { ...base } : { ...base, wallTimeLimitMs: timeoutMs };
+}
 /** The in-process privileged host for a sandbox invocation. */
 export function privilegedHostFor(invocation, signal) {
     return createPrivilegedHost({
@@ -59,13 +70,14 @@ export function privilegedHostFor(invocation, signal) {
         allowedFetchHosts: invocation.allowedFetchHosts,
         fetchImpl: invocation.fetchImpl,
         signal,
+        fetchTimeoutMs: fetchTimeoutFor(invocation.timeoutMs ?? invocation.limits?.wallTimeLimitMs ?? DEFAULT_SANDBOX_LIMITS.wallTimeLimitMs),
     });
 }
 export async function runInSandbox(invocation) {
     return runToolCode({
         code: invocation.code,
         params: invocation.params,
-        limits: invocation.limits,
+        limits: toolLimits(invocation.timeoutMs, invocation.limits),
         privileged: (signal) => privilegedHostFor(invocation, signal),
     });
 }

package/dist/sandbox/safe-fetch.d.ts

@@ -11,6 +11,8 @@ export declare function pinnedLookup(destination: Destination): LookupFunction;
 export declare function requestPinned(destination: Destination, init: SafeFetchInit, signal: AbortSignal): Promise<IncomingMessage>;
 export interface SafeFetchOptions extends FetchPolicyOptions {
     signal?: AbortSignal;
+    /** This fetch's own timeout; FETCH_TIMEOUT_MS when absent. */
+    timeoutMs?: number;
     connect?: typeof requestPinned;
     /** False: a 3xx is returned to the caller as-is (brokered requests re-check every hop themselves). */
     followRedirects?: boolean;

package/dist/sandbox/safe-fetch.js

@@ -39,7 +39,7 @@ async function untilAbort(promise, signal) {
 }
 export async function safeFetch(input, init = {}, options = {}) {
     const abort = new AbortController();
-    const timer = setTimeout(() => abort.abort(new Error("fetch_timeout")), FETCH_TIMEOUT_MS);
+    const timer = setTimeout(() => abort.abort(new Error("fetch_timeout")), options.timeoutMs ?? FETCH_TIMEOUT_MS);
     const signal = options.signal ? AbortSignal.any([options.signal, abort.signal]) : abort.signal;
     let url = input;
     let method = init.method ?? "GET";

package/dist/sandbox/secret-broker.d.ts

@@ -26,6 +26,7 @@ export declare function consoleRedactionValues(entry: {
     value: string;
     broker: SecretBrokerConfig | null;
 }): string[];
+export declare function encodedForms(value: string): string[];
 export declare function scrubBrokeredResponse<T extends {
     headers: Record<string, string>;
     bodyBase64: string;

package/dist/sandbox/secret-broker.js

@@ -121,7 +121,7 @@ export function consoleRedactionValues(entry) {
         return [entry.value];
     }
 }
-function encodedForms(value) {
+export function encodedForms(value) {
     const buf = Buffer.from(value, "utf8");
     // Query placement goes through URLSearchParams, which encodes ~ ! ' ( ) differently and space as "+",
     // so both percent-encodings are scrubbed, each also in lowercase-hex form (a response may echo either).

package/dist/sandbox/tool-timeout.d.ts

@@ -0,0 +1,32 @@
+/**
+ * A sandboxed tool's time limit. A tool may ask for its own `timeoutMs`; the operator's
+ * WARDBY_TOOL_MAX_TIMEOUT_MS (config/tool-timeout.ts) caps it. Without one a tool keeps the
+ * default wall-time cap (limits.ts). Pure and worker-safe: no configuration is read here.
+ */
+/** A tool that sets no `timeoutMs`. */
+export declare const DEFAULT_TOOL_TIMEOUT_MS = 10000;
+/** The shortest `timeoutMs` a tool may ask for. */
+export declare const MIN_TOOL_TIMEOUT_MS = 1000;
+/** WARDBY_TOOL_MAX_TIMEOUT_MS when unset: five minutes. */
+export declare const DEFAULT_TOOL_MAX_TIMEOUT_MS = 300000;
+/**
+ * How far past the tool's limit each fetch's own timeout lies. The wall time ends the call (and
+ * aborts its fetches) first, so a slow request fails with the wall-time error that names the
+ * limit, not a fetch error.
+ */
+export declare const FETCH_TIMEOUT_MARGIN_MS = 1000;
+/** The fetch timeout for a tool limit of `wallTimeLimitMs`. */
+export declare function fetchTimeoutFor(wallTimeLimitMs: number): number;
+/**
+ * The limit a run uses for a tool: its own `timeoutMs` (or the default when it has none), never
+ * above the current ceiling, so lowering the ceiling also covers tools that already exist.
+ */
+export declare function effectiveToolTimeoutMs(timeoutMs: number | null | undefined, ceilingMs: number): number;
+/** Why `timeoutMs` can't be stored on a tool under `ceilingMs`, or undefined when it can. */
+export declare function toolTimeoutProblem(timeoutMs: unknown, ceilingMs: number): string | undefined;
+/** The model-facing text for a tool that ran out of time. */
+export declare function toolTimeoutMessage(limitMs: number): string;
+/** The model-facing text for a tool call cut off at its run's deadline. */
+export declare const TOOL_RUN_DEADLINE_MESSAGE = "Stopped at the run's deadline while this tool call was still running.";
+/** The model-facing text for a tool call aborted because its run was stopped. */
+export declare const TOOL_RUN_STOPPED_MESSAGE = "The run was stopped while this tool call was running.";

package/dist/sandbox/tool-timeout.js

@@ -0,0 +1,52 @@
+/**
+ * A sandboxed tool's time limit. A tool may ask for its own `timeoutMs`; the operator's
+ * WARDBY_TOOL_MAX_TIMEOUT_MS (config/tool-timeout.ts) caps it. Without one a tool keeps the
+ * default wall-time cap (limits.ts). Pure and worker-safe: no configuration is read here.
+ */
+import { WALL_TIME_LIMIT_MS } from "./limits.js";
+/** A tool that sets no `timeoutMs`. */
+export const DEFAULT_TOOL_TIMEOUT_MS = WALL_TIME_LIMIT_MS;
+/** The shortest `timeoutMs` a tool may ask for. */
+export const MIN_TOOL_TIMEOUT_MS = 1_000;
+/** WARDBY_TOOL_MAX_TIMEOUT_MS when unset: five minutes. */
+export const DEFAULT_TOOL_MAX_TIMEOUT_MS = 300_000;
+/**
+ * How far past the tool's limit each fetch's own timeout lies. The wall time ends the call (and
+ * aborts its fetches) first, so a slow request fails with the wall-time error that names the
+ * limit, not a fetch error.
+ */
+export const FETCH_TIMEOUT_MARGIN_MS = 1_000;
+/** The fetch timeout for a tool limit of `wallTimeLimitMs`. */
+export function fetchTimeoutFor(wallTimeLimitMs) {
+    return wallTimeLimitMs + FETCH_TIMEOUT_MARGIN_MS;
+}
+/**
+ * The limit a run uses for a tool: its own `timeoutMs` (or the default when it has none), never
+ * above the current ceiling, so lowering the ceiling also covers tools that already exist.
+ */
+export function effectiveToolTimeoutMs(timeoutMs, ceilingMs) {
+    if (timeoutMs === null || timeoutMs === undefined)
+        return DEFAULT_TOOL_TIMEOUT_MS;
+    return Math.min(timeoutMs, ceilingMs);
+}
+/** Why `timeoutMs` can't be stored on a tool under `ceilingMs`, or undefined when it can. */
+export function toolTimeoutProblem(timeoutMs, ceilingMs) {
+    if (typeof timeoutMs !== "number" || !Number.isSafeInteger(timeoutMs)) {
+        return "timeoutMs must be a whole number of milliseconds.";
+    }
+    if (timeoutMs < MIN_TOOL_TIMEOUT_MS)
+        return `timeoutMs must be at least ${MIN_TOOL_TIMEOUT_MS} ms.`;
+    if (timeoutMs > ceilingMs) {
+        return `timeoutMs ${timeoutMs} is above this server's ceiling of ${ceilingMs} ms (WARDBY_TOOL_MAX_TIMEOUT_MS).`;
+    }
+    return undefined;
+}
+/** The model-facing text for a tool that ran out of time. */
+export function toolTimeoutMessage(limitMs) {
+    return (`Exceeded the ${limitMs}ms wall-time limit. A tool that needs longer can set timeoutMs ` +
+        "(create_tool or update_tool), up to the server's WARDBY_TOOL_MAX_TIMEOUT_MS.");
+}
+/** The model-facing text for a tool call cut off at its run's deadline. */
+export const TOOL_RUN_DEADLINE_MESSAGE = "Stopped at the run's deadline while this tool call was still running.";
+/** The model-facing text for a tool call aborted because its run was stopped. */
+export const TOOL_RUN_STOPPED_MESSAGE = "The run was stopped while this tool call was running.";

package/dist/sandbox/user-tool.d.ts

@@ -10,5 +10,12 @@ import type { SandboxLimits } from "./eval-core.js";
 export interface UserToolDefinition {
     code: string;
     paramsZod: string;
+    /** The time limit this run gives the tool (effectiveToolTimeoutMs); absent = the default. */
+    timeoutMs?: number;
 }
-export declare function runUserToolCall(tool: UserToolDefinition, argsJson: string, privileged: (signal: AbortSignal) => PrivilegedHost, limits?: Partial<SandboxLimits>): Promise<string>;
+export interface UserToolCallOptions {
+    limits?: Partial<SandboxLimits>;
+    /** Aborts the call when its run is stopped. */
+    signal?: AbortSignal;
+}
+export declare function runUserToolCall(tool: UserToolDefinition, argsJson: string, privileged: (signal: AbortSignal) => PrivilegedHost, options?: UserToolCallOptions): Promise<string>;

package/dist/sandbox/user-tool.js

@@ -5,9 +5,9 @@
  * JSON error result. Worker-safe: it touches no database or provider, only the
  * privileged host it is given, so the native sandbox worker runs it as is.
  */
-import { runToolCode } from "./run-in-sandbox.js";
+import { runToolCode, toolLimits } from "./run-in-sandbox.js";
 import { validateParams } from "./zod-params.js";
-export async function runUserToolCall(tool, argsJson, privileged, limits) {
+export async function runUserToolCall(tool, argsJson, privileged, options = {}) {
     let parsedArgs;
     try {
         // Some providers stream no JSON delta at all for a zero-parameter
@@ -24,7 +24,13 @@ export async function runUserToolCall(tool, argsJson, privileged, limits) {
     if (!validation.ok) {
         return JSON.stringify({ error: "validation_failed", message: validation.errorMessage });
     }
-    const result = await runToolCode({ code: tool.code, params: validation.value, limits, privileged });
+    const result = await runToolCode({
+        code: tool.code,
+        params: validation.value,
+        limits: toolLimits(tool.timeoutMs, options.limits),
+        signal: options.signal,
+        privileged,
+    });
     if (!result.ok) {
         return JSON.stringify({ error: result.errorKind, message: result.errorMessage });
     }

package/dist/viewer/graph.js

@@ -1,4 +1,5 @@
 import { periodStart } from "../core/budget-groups.js";
+import { codeProviderOf } from "../coding/code-host.js";
 import { publicCodingRunResult } from "../coding/protocol.js";
 const DEFAULT_SINCE_MS = 60 * 60 * 1000;
 const RELATIVE_SINCE_MS = {
@@ -102,7 +103,7 @@ function outcomesFor(row, pullRequests, sites) {
         !pullRequests.some((pr) => pr.url === result.pullRequestUrl)) {
         outcomes.push({
             kind: "pull_request",
-            provider: "github",
+            provider: codeProviderOf(result.repository),
             repository: result.repository,
             number: result.pullRequestNumber,
             url: result.pullRequestUrl,

package/dist/wardby-bin.js

@@ -52,6 +52,11 @@ async function main() {
         const { resumeToolsCommand } = await import("./coding/transcript/resume/stand-in.js");
         await resumeToolsCommand(process.argv.slice(3));
     }
+    else if (command === "claude-plugin") {
+        // Sets up the Claude Code plugin on this machine: no environment, database, or server runtime.
+        const { claudePluginCommand } = await import("./claude-plugin/command.js");
+        process.exitCode = await claudePluginCommand(process.argv.slice(3));
+    }
     else if (command === "knowledge") {
         // Offline bundle validation: no environment, database, or HTTP runtime.
         const { knowledgeCommand } = await import("./knowledge/cli.js");

package/docs/README.md

@@ -13,16 +13,26 @@
   runs are billed.
 - [Agent recipes](agent-recipes.md) gives two copyable setups, an architecture
   keeper and a per-language builder, with the prerequisites each needs.
+- [Debugging an agent run](debugging-agent-runs.md) triages a run that failed,
+  opened no pull request, or missed what you expected.
 - [Coding-agent setup](coding-agent-setup.md) configures the local trusted proxy
   and isolated Codex or Claude Code workers.
+- [Claude Code plugin](claude-code-plugin.md) (0.8.0+) installs the `wardby-runs`
+  pane: your runs beside the chat, grouped by pull request, with run details and
+  Continue locally.
 - [Architecture knowledge bundles](knowledge.md) covers `docs/knowledge/`: the
   concept format, how coding runs and reviewers use it, `wardby knowledge check`,
   and the scheduled architecture agent.
-- [Native sandbox](native-sandbox.md) (0.5.4+) runs a native agent's turn loop and user
+- [Native sandbox](native-sandbox.md) (0.6.0+) runs a native agent's turn loop and user
   tools in a single-use, credential-free container behind a native gateway.
 - [Secrets and tools](tool-secrets.md) covers readable and brokered secrets
   (brokered secrets require 0.6.0+):
   attaching secrets to tools, `set_secret_broker`, placements, and errors.
+- [Remote MCP servers](mcp-servers.md) (0.8.0+) registers a remote MCP server and
+  attaches an allowlist of its tools to a native agent.
+- [Host providers](host-providers.md) (0.8.0+) covers adding a code host with
+  your own custom tools: registering, approving, testing and removing a
+  provider.
 - [Coding-worker isolation](coding-worker-isolation.md) documents the threat
   model and enforced worker boundary.
 - [Bring-your-own worker images](coding-worker-byo-images.md) explains how to

package/docs/agent-recipes.md

@@ -383,8 +383,9 @@ the lead's `maxDelegationsPerRun` (1 to 20) with `create_agent` or
 { "id": "<lead agent id>", "maxDelegationsPerRun": 6 }
 ```
 
-- Each `delegate_to_<name>` call still goes to a different sub-agent; a second
-  call to the same one in the same run is refused with `already_dispatched`.
+- A run delegates to each sub-agent and repository at most once: a second call
+  to the same sub-agent in the same run (for a coding sub-agent with a list of
+  repositories, in the same repository) is refused with `already_dispatched`.
   A delegation waiting for budget (see below) also holds its place against
   `maxDelegationsPerRun`: a call beyond the limit is refused with
   `already_dispatched` and a message naming both counts, e.g. "This run
@@ -507,6 +508,37 @@ the lead's `maxDelegationsPerRun` (1 to 20) with `create_agent` or
   repositories, keep that work in separate requests (separate Jira issues, or
   separate lead agents).
 
+#### One coding agent, several repositories
+
+Instead of one builder per repository, give one coding builder a list: its default in
+`codingProfile.repository`, and each other repository with `link_repository`
+(`access: "write"`, no triggers). The lead then names the repository on each
+call, and may delegate to the same builder once per repository:
+
+```json
+{ "task": "Add the /quotes endpoint the client will call.", "repository": "your-org/api", "mergeOrder": 1 }
+```
+
+```json
+{ "task": "Add the quotes page that calls /quotes.", "repository": "your-org/web", "mergeOrder": 2 }
+```
+
+Set `maxDelegationsPerRun` (up to 20) for the number of calls, and use
+`mergeOrder` where the pull requests must land in order. A call without
+`repository` is refused with `repository_required` when the builder has extra
+repositories (unless it continues a prior run with `continuePriorRun`), and a
+repository not on the list with `repository_not_listed`. A native sub-agent
+refuses `repository` with `repository_requires_coding_agent`. The lead sees the
+list in the tool definition only when it has the same owner as the builder, or
+another owner with execute access to a builder that sets
+`allowWebhookTaskOverride`. All repositories share the builder's toolchain,
+budget and prompt.
+
+Being on the list lets a run work in a repository; it starts nothing there. Link
+the lead and the reviewer on each listed GitHub repository with the triggers
+they need, or a pull request opened there gets no review, mention follow-up, fix
+round or mark-ready.
+
 #### Follow-ups across the set
 
 A human-triggered follow-up task (an `@<app-slug>` mention, or a Jira issue
@@ -520,8 +552,9 @@ too:
     repository that already has an open sibling for this request.
 
 The usual delegation rails still apply on top of this: `maxDelegationsPerRun`
-caps calls per run; a second `delegate_to_<name>` call to the same sub-agent
-in one run is refused with `already_dispatched`; dispatch re-checks every
+caps calls per run; a run delegates to each sub-agent and repository at most
+once, and a second such call is refused with `already_dispatched`; dispatch
+re-checks every
 `continuePriorRun` id (refusing with `continuation_refused` when this
 deployment can't continue the run it names — for example it belongs to a
 different owner's agent); every push to a sibling pull request still gets its

package/docs/architecture-runtime.md

@@ -95,7 +95,7 @@ and GKE Autopilot overlays.
 
 ### Native agents in a sandbox
 
-Native sandbox requires Wardby 0.5.4 or later.
+Native sandbox requires Wardby 0.6.0 or later.
 
 Native agents run in the server process by default. A native agent set to
 `nativeExecutionMode=sandbox` instead runs its turn loop and user tools in a