@wardby/cli 0.7.0 → 0.8.0

package/prisma/schema.prisma

@@ -20,18 +20,18 @@ datasource db {
 }
 
 model Agent {
-  id            String              @id @default(cuid())
-  name          String              @unique
-  systemPrompt  String
-  model         String
-  budgetUsd     Decimal             @db.Decimal(10, 4)
+  id                    String              @id @default(cuid())
+  name                  String              @unique
+  systemPrompt          String
+  model                 String
+  budgetUsd             Decimal             @db.Decimal(10, 4)
   /// Percent above budgetUsd a run may spend: each coding run's limit, or (on a lead agent) its run tree's ceiling for coding sub-agents; native model calls are unaffected; group caps still apply.
-  allowedOverrunPercent Int @default(0)
-  createdAt     DateTime            @default(now())
-  updatedAt     DateTime            @updatedAt
-  runs          Run[]
-  kind          AgentKind           @default(native)
-  codingProfile CodingAgentProfile?
+  allowedOverrunPercent Int                 @default(0)
+  createdAt             DateTime            @default(now())
+  updatedAt             DateTime            @updatedAt
+  runs                  Run[]
+  kind                  AgentKind           @default(native)
+  codingProfile         CodingAgentProfile?
 
   // Phase 2: scheduling. `schedule` is a cron expression; null = manual-only.
   schedule        String?
@@ -60,6 +60,7 @@ model Agent {
   repositories         AgentRepository[]
   deferredReviews      DeferredReview[]
   issueProjects        AgentIssueProject[]
+  mcpServers           AgentMcpServer[]
   notificationChannels NotificationChannel[]
 
   /// Self-defects opt-in: the Jira project and issue type wardby files the agent's own failures into. Both or neither.
@@ -186,6 +187,10 @@ model Tool {
   jsonSchema  Json
   /// Tool body source; run inside the sandbox with the validated params.
   code        String
+  /// The tool's own time limit per call (ms). Null = the default (10 s). A
+  /// run uses the lower of this and WARDBY_TOOL_MAX_TIMEOUT_MS, and pins the
+  /// value its load step read, like the code.
+  timeoutMs   Int?
   createdAt   DateTime    @default(now())
   updatedAt   DateTime    @updatedAt
   agents      AgentTool[]
@@ -195,6 +200,8 @@ model Tool {
   ownerId String?
   owner   Principal? @relation(fields: [ownerId], references: [id])
 
+  hostProviderOperations HostProviderOperation[]
+
   @@unique([ownerId, name])
 }
 
@@ -425,6 +432,7 @@ model Run {
   /// text, no FK.
   triggeredById           String?
 
+  @@unique([parentRunId, parentCallId])
   @@index([agentId, triggeredById])
   /// The admin viewer's graph window (runs started since a time, or still
   /// pending/running) and its ancestor/children walks (docs/viewer-api.md).
@@ -433,7 +441,6 @@ model Run {
   @@index([parentRunId])
   @@index([startDeferredAt])
   @@index([stopRequestedAt])
-  @@unique([parentRunId, parentCallId])
 }
 
 /// Phase 5: owner-configured coding behavior. Runtime credentials and opaque
@@ -572,6 +579,9 @@ model CodingRun {
   baseSha               String?
   /// Step in the request's merge order set by the delegating agent (1 = first); null = no order.
   mergeOrder            Int?
+  /// Fixed at dispatch: this run's repository came from an AgentRepository link, not the
+  /// profile, so that link must still exist whenever the run uses the repository.
+  viaRepositoryLink     Boolean             @default(false)
   /// When Wardby marked this run's pull request ready for review (at most once;
   /// a person moving it back to draft is final). Only set on a root coding run.
   markedReadyAt         DateTime?
@@ -846,6 +856,8 @@ model NativeGatewayCall {
   childRunId        String?
   /// A delegation's sub-agent, recorded at admission (it holds a place while waiting for budget).
   childAgentId      String?
+  /// A coding delegation's repository, recorded with childAgentId. Null = the child's default.
+  childRepository   String?
   createdAt         DateTime                @default(now())
   updatedAt         DateTime                @updatedAt
   completedAt       DateTime?
@@ -893,6 +905,12 @@ model CodingProxySession {
   dependencyCacheLockHashes String[]                 @default([])
   /// Set when the run's dependency step is over; after it the cache refuses this session.
   dependencyCacheSealedAt   DateTime?
+  /// Phase 2 of remote MCP servers: the run's pinned MCP tools (no URLs or secrets), or null.
+  mcpTools                  Json?
+  /// SHA-256 (base64url) of the run's MCP token; null when the run has no MCP tools.
+  mcpTokenHash              String?                  @unique
+  /// MCP tools/call count for this run (capped by WARDBY_MCP_MAX_CALLS_PER_RUN).
+  mcpCallCount              Int                      @default(0)
 
   @@index([deadlineAt])
 }
@@ -1121,6 +1139,7 @@ model Principal {
   webhooks     Webhook[]
   authUser     AuthUser?
   budgetGroups BudgetGroup[]
+  mcpServers   McpServer[]
 
   hostIdentities           HostIdentity[]
   hostIdentityLinkRequests HostIdentityLinkRequest[]
@@ -1135,7 +1154,7 @@ model Principal {
 /// AgentRepository.provider, so a new type or level needs no enum migration.
 model ResourceGrant {
   id                 String     @id @default(cuid())
-  /// "agent" | "tool" | "budget_group" (later "secret" | "datastore").
+  /// "agent" | "tool" | "budget_group" | "mcp_server" (later "secret" | "datastore").
   resourceType       String
   resourceId         String
   /// "principal" | "everyone" (later "group").
@@ -1193,6 +1212,9 @@ model Task {
   ttlAt          DateTime
   createdAt      DateTime   @default(now())
   updatedAt      DateTime   @updatedAt
+
+  /// The run-drivability and cancelled-task lookups: findFirst({ runId, status: "cancelled" }).
+  @@index([runId, status])
 }
 
 /// Phase 4: a secret value, encrypted at rest via the SecretCipher seam.
@@ -1211,6 +1233,10 @@ model Secret {
   updatedAt  DateTime      @updatedAt
   agents     AgentSecret[]
 
+  hostProviderWebhooks    HostProvider[]           @relation("HostProviderWebhookSecret")
+  hostProviderPermissions HostProvider[]           @relation("HostProviderPermissionSecret")
+  hostProviderCredentials HostProviderCredential[] @relation("HostProviderCredentialSecret")
+
   @@unique([ownerId, name])
 }
 
@@ -1320,7 +1346,7 @@ model AuthUser {
   displayName String?
   status      String                   @default("enabled")
   /// wardby roles (src/mcp/auth/resource-server.ts ROLE_PERMISSIONS: admin,
-  /// package-approver, service-manager, model-manager), set with `wardby auth user grant`. Empty = member.
+  /// package-approver, service-manager, model-manager, host-manager), set with `wardby auth user grant`. Empty = member.
   /// A privileged operation needs its scope on the token AND a role here
   /// that grants it; unknown values grant nothing.
   roles       String[]                 @default([])
@@ -1466,6 +1492,9 @@ model AgentRepository {
   /// review check passed, CI is green and the merge order check (if any) is
   /// success. Default off.
   markReadyWhenPassing Boolean  @default(false)
+  /// Only on a coding agent's link: the base branch for runs in this repository.
+  /// Null = the coding profile's baseRef.
+  baseRef              String?
   createdAt            DateTime @default(now())
 
   /// How this link was authorized: "host_permission" (the agent owner's
@@ -1671,6 +1700,48 @@ model AgentIssueProject {
   @@index([provider, projectKey])
 }
 
+/// A remote MCP server an owner registered (Streamable HTTP, HTTPS only).
+model McpServer {
+  id           String           @id @default(cuid())
+  ownerId      String
+  owner        Principal        @relation(fields: [ownerId], references: [id], onDelete: Cascade)
+  /// Unique per owner; the prefix of the tool names the model sees.
+  name         String
+  /// https only; no userinfo, no fragment; the query string is kept.
+  url          String
+  /// The owner's brokered secrets sent on every request (each brokered to the URL's host).
+  secretNames  String[]         @default([])
+  /// Last tools/list result, redacted: [{ name, description, inputSchema, annotations? }].
+  toolSnapshot Json             @default("[]")
+  snapshotAt   DateTime?
+  /// From initialize: { name?, version?, protocolVersion }.
+  serverInfo   Json?
+  createdAt    DateTime         @default(now())
+  updatedAt    DateTime         @updatedAt
+  agents       AgentMcpServer[]
+
+  @@unique([ownerId, name])
+  @@index([ownerId])
+}
+
+/// An MCP server attached to an agent, with the server tools it may call.
+model AgentMcpServer {
+  agentId       String
+  agent         Agent     @relation(fields: [agentId], references: [id], onDelete: Cascade)
+  serverId      String
+  server        McpServer @relation(fields: [serverId], references: [id], onDelete: Cascade)
+  /// Exact tool names from the server's saved list. Never empty.
+  allowedTools  String[]
+  /// Per call; null = 30000. Capped by WARDBY_TOOL_MAX_TIMEOUT_MS at call time.
+  callTimeoutMs Int?
+  attachedById  String
+  createdAt     DateTime  @default(now())
+  updatedAt     DateTime  @updatedAt
+
+  @@id([agentId, serverId])
+  @@index([serverId])
+}
+
 /// Dedupe record: an issue wardby created for a fingerprint (several over time — regressions).
 model IssueFingerprint {
   id              String   @id @default(cuid())
@@ -1953,3 +2024,77 @@ model NotificationThread {
 
   @@unique([provider, channelId, threadKey])
 }
+
+/// A code host implemented by operator-approved custom tools (docs/host-providers.md).
+/// `name` is the prefix of its repository ids: `<name>:<workspace>/<repo>`. Holds no secret values.
+model HostProvider {
+  name                   String   @id
+  contractVersion        Int
+  gitHost                String
+  apiHosts               String[]
+  gitUsername            String
+  pullRequestUrlTemplate String
+  /// Where one repository lives on the API, with `{repository}`: a repository-scoped tool's requests stay under it.
+  repositoryApiPath      String
+  /// The effective-permission endpoint, with `{workspace}` and `{repo}`. Set with a permission secret.
+  permissionApiPath      String?
+  /// How to verify and read a webhook: header names and algorithm, never the secret.
+  webhook                Json
+  webhookSecretId        String
+  webhookSecret          Secret   @relation("HostProviderWebhookSecret", fields: [webhookSecretId], references: [id], onDelete: Restrict)
+  /// Set: ask the host who has access. Unset: trustedAccounts decides.
+  permissionSecretId     String?
+  permissionSecret       Secret?  @relation("HostProviderPermissionSecret", fields: [permissionSecretId], references: [id], onDelete: Restrict)
+  createdById            String
+  createdAt              DateTime @default(now())
+  updatedAt              DateTime @updatedAt
+
+  operations      HostProviderOperation[]
+  credentials     HostProviderCredential[]
+  trustedAccounts HostProviderTrustedAccount[]
+}
+
+/// One approved snapshot: the code Wardby runs. `update_tool` changes nothing here until approved again.
+model HostProviderOperation {
+  provider     String
+  operation    String
+  /// The tool it was copied from. Null once that tool is deleted; the snapshot keeps working.
+  toolId       String?
+  code         String
+  paramsZod    String
+  /// The tool's timeoutMs when it was approved; null = the default limit.
+  timeoutMs    Int?
+  approvedById String
+  approvedAt   DateTime @default(now())
+
+  hostProvider HostProvider @relation(fields: [provider], references: [name], onDelete: Cascade)
+  tool         Tool?        @relation(fields: [toolId], references: [id], onDelete: SetNull)
+
+  @@id([provider, operation])
+}
+
+/// Which brokered secret serves which repositories. `credentialKind` is `static` only in v1.
+model HostProviderCredential {
+  id                String @id @default(cuid())
+  provider          String
+  repositoryPattern String
+  secretId          String
+  credentialKind    String @default("static")
+
+  hostProvider HostProvider @relation(fields: [provider], references: [name], onDelete: Cascade)
+  secret       Secret       @relation("HostProviderCredentialSecret", fields: [secretId], references: [id], onDelete: Restrict)
+
+  @@unique([provider, repositoryPattern])
+}
+
+/// Host accounts allowed to start runs when the provider has no permission secret.
+model HostProviderTrustedAccount {
+  provider  String
+  accountId String
+  addedById String
+  addedAt   DateTime @default(now())
+
+  hostProvider HostProvider @relation(fields: [provider], references: [name], onDelete: Cascade)
+
+  @@id([provider, accountId])
+}

package/scripts/git-askpass.sh

@@ -2,7 +2,7 @@
 
 case "$1" in
   *Username*)
-    printf '%s\n' 'x-access-token'
+    printf '%s\n' "${WARDBY_GIT_USERNAME:-x-access-token}"
     ;;
   *)
     IFS= read -r token <&3