@wardby/cli 0.7.0 → 0.8.0

package/dist/core/secret-guard.js

@@ -1,16 +1,22 @@
 import { MIN_REDACTABLE_SECRET_LENGTH, redactExactSecretValues, withEscapedForms } from "./secret-spans.js";
 import { buildSecretsAccessor } from "./secrets.js";
 import { consoleRedactionValues } from "../sandbox/secret-broker.js";
-/** Every secret attached to the agent (readable and brokered), with every form to look for. Rejects if any read fails. */
+import { mcpNamedSecretValues } from "./mcp-tools.js";
+/**
+ * Every secret attached to the agent (readable and brokered), and every secret of an MCP server
+ * attached to it (named `mcp:<server>/<secret>`), with every form to look for. Rejects if any read fails.
+ */
 export async function loadAgentSecretValues(db, cipher, agentId) {
-    const rows = await db.agentSecret.findMany({ where: { agentId }, select: { boundName: true } });
-    if (rows.length === 0)
-        return [];
+    const [rows, mcp] = await Promise.all([
+        db.agentSecret.findMany({ where: { agentId }, select: { boundName: true } }),
+        mcpNamedSecretValues(db, cipher, agentId),
+    ]);
     const accessor = buildSecretsAccessor(agentId, cipher, db);
-    return Promise.all(rows.map(async ({ boundName }) => {
+    const own = await Promise.all(rows.map(async ({ boundName }) => {
         const entry = await accessor.resolve(boundName);
         return { name: boundName, values: entry ? withEscapedForms(consoleRedactionValues(entry)) : [] };
     }));
+    return [...own, ...mcp];
 }
 function textOf(value) {
     return typeof value === "string" ? value : (JSON.stringify(value) ?? "");
@@ -26,13 +32,22 @@ export function secretNamesIn(value, named) {
     return [...hits].sort();
 }
 const MAX_MESSAGE_LENGTH = 1000;
+const MCP_SECRET_PREFIX = "mcp:";
 function refusal(names, listed) {
     const shown = names.slice(0, listed).map((n) => JSON.stringify(n));
     const more = names.length - listed;
     const list = shown.join(", ") + (more > 0 ? `, and ${more} more` : "");
     const noun = names.length > 1 ? "secrets" : "secret";
-    const first = JSON.stringify(names[0]);
-    return `secret_in_value: not stored. The value contains the value of ${noun} ${list} attached to this agent, and secret values are never stored. Store the secret's name instead and read it when you need it: secrets.get(${first}), or fetch(url, { secrets: [${first}] }) if it is brokered.`;
+    const head = `secret_in_value: not stored. The value contains the value of ${noun} ${list} attached to this agent, and secret values are never stored.`;
+    // An MCP server's secret (`mcp:<server>/<secret>`) is not readable by the agent, so it gets no secrets.get hint.
+    const readable = names.find((n) => !n.startsWith(MCP_SECRET_PREFIX));
+    const mcpNote = names.some((n) => n.startsWith(MCP_SECRET_PREFIX))
+        ? " A name starting with mcp: is an MCP server's secret: it is used only by that server's tools and can't be stored or read."
+        : "";
+    if (readable === undefined)
+        return head + mcpNote;
+    const first = JSON.stringify(readable);
+    return `${head} Store the secret's name instead and read it when you need it: secrets.get(${first}), or fetch(url, { secrets: [${first}] }) if it is brokered.${mcpNote}`;
 }
 /** The agent-visible refusal: names the secrets, never a value. At most 1000 characters. */
 export function secretInValueMessage(names) {

package/dist/core/secrets.d.ts

@@ -23,6 +23,15 @@ export interface SecretsAccessor {
     /** Host-internal: value and broker config, brokered or not. Never exposed to tool code. */
     resolve?(name: string): Promise<SecretEntry | undefined>;
 }
+/** A webhook secret signs what a host sends us, so a short one is refused at registration and at rotation. */
+export declare const MIN_WEBHOOK_SECRET_LENGTH = 16;
+export declare const WEBHOOK_SECRET_SHORT = "host_provider_webhook_secret_short: a host provider's webhook secret needs at least 16 characters";
+export declare const WEBHOOK_SECRET_ATTACHED = "host_provider_webhook_secret_attached: this secret is a host provider's webhook secret and can't be attached to an agent";
+/** The host providers using a secret, by name, and whether it's the webhook secret of any. */
+export declare function hostProvidersUsingSecret(db: Pick<PrismaClient, "hostProvider" | "hostProviderCredential">, secretId: string): Promise<{
+    providers: string[];
+    webhook: boolean;
+}>;
 /**
  * Encrypts and stores a secret value. Upserts on (ownerId, name) — calling
  * this again for a name the owner already has rotates its value in place
@@ -56,7 +65,8 @@ export declare function setSecretBroker(db: PrismaClient, cipher: SecretCipher,
 export declare function listSecrets(ownerId: string, db: PrismaClient): Promise<SecretMetadata[]>;
 /** Attaches one of the owner's own secrets (by canonical name) to an agent,
  *  under `boundName` — the point-of-use name the agent's tools resolve
- *  (`secrets.get(boundName)`). Defaults to the secret's own name. */
+ *  (`secrets.get(boundName)`). Defaults to the secret's own name. A host
+ *  provider's webhook secret is kept off every agent, so no tool can read it. */
 export declare function attachSecret(agentId: string, name: string, ownerId: string, db: PrismaClient, boundName?: string): Promise<void>;
 /** Detaches by point-of-use name — the pair (agentId, boundName) uniquely
  *  identifies the edge — falling back to the secret's own name when no edge

package/dist/core/secrets.js

@@ -13,6 +13,22 @@ function brokerOf(secret) {
     return secret.broker === null || secret.broker === undefined ? null : parseSecretBrokerConfig(secret.broker);
 }
 const BROKERED_GET_MESSAGE = 'secret_brokered: this secret is brokered; send it with fetch(url, { secrets: ["NAME"] }) instead of reading it';
+/** A webhook secret signs what a host sends us, so a short one is refused at registration and at rotation. */
+export const MIN_WEBHOOK_SECRET_LENGTH = 16;
+export const WEBHOOK_SECRET_SHORT = `host_provider_webhook_secret_short: a host provider's webhook secret needs at least ${MIN_WEBHOOK_SECRET_LENGTH} characters`;
+export const WEBHOOK_SECRET_ATTACHED = "host_provider_webhook_secret_attached: this secret is a host provider's webhook secret and can't be attached to an agent";
+/** The host providers using a secret, by name, and whether it's the webhook secret of any. */
+export async function hostProvidersUsingSecret(db, secretId) {
+    const credentials = await db.hostProviderCredential.findMany({ where: { secretId }, select: { provider: true } });
+    const rows = await db.hostProvider.findMany({
+        where: { OR: [{ webhookSecretId: secretId }, { permissionSecretId: secretId }] },
+        select: { name: true, webhookSecretId: true },
+    });
+    return {
+        providers: [...new Set([...credentials.map((c) => c.provider), ...rows.map((r) => r.name)])].sort(),
+        webhook: rows.some((r) => r.webhookSecretId === secretId),
+    };
+}
 /**
  * Encrypts and stores a secret value. Upserts on (ownerId, name) — calling
  * this again for a name the owner already has rotates its value in place
@@ -23,6 +39,12 @@ const BROKERED_GET_MESSAGE = 'secret_brokered: this secret is brokered; send it
 export async function createSecret(name, value, ownerId, cipher, db, options = {}) {
     boundedString(name, 1024);
     boundedString(value, 65_536);
+    if (value.length < MIN_WEBHOOK_SECRET_LENGTH) {
+        const current = await db.secret.findUnique({ where: { ownerId_name: { ownerId, name } }, select: { id: true } });
+        if (current && (await db.hostProvider.count({ where: { webhookSecretId: current.id } })) > 0) {
+            throw new Error(WEBHOOK_SECRET_SHORT);
+        }
+    }
     const broker = options.broker ? parseSecretBrokerConfig(options.broker) : undefined;
     if (broker)
         assertBrokerableValue(broker, value);
@@ -122,11 +144,15 @@ async function findOwnedSecretByName(db, ownerId, name) {
 }
 /** Attaches one of the owner's own secrets (by canonical name) to an agent,
  *  under `boundName` — the point-of-use name the agent's tools resolve
- *  (`secrets.get(boundName)`). Defaults to the secret's own name. */
+ *  (`secrets.get(boundName)`). Defaults to the secret's own name. A host
+ *  provider's webhook secret is kept off every agent, so no tool can read it. */
 export async function attachSecret(agentId, name, ownerId, db, boundName = name) {
     const secret = await findOwnedSecretByName(db, ownerId, name);
     if (!secret)
         throw new Error(`No secret named "${name}" owned by this caller.`);
+    if ((await db.hostProvider.count({ where: { webhookSecretId: secret.id } })) > 0) {
+        throw new Error(WEBHOOK_SECRET_ATTACHED);
+    }
     await db.agentSecret.create({ data: { agentId, secretId: secret.id, boundName } });
 }
 /** Detaches by point-of-use name — the pair (agentId, boundName) uniquely

package/dist/core/serializable-retry.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Run first inside each of those transactions (make_owner, attach_mcp_server, grant/revoke). Postgres's Serializable mode takes a predicate (SIREAD)
+ * lock on everything a statement reads, and a sequential scan locks the whole relation and checks every
+ * row in it for conflicts. On small tables (a fresh deployment, or a test database) the planner picks a
+ * sequential scan even for a primary-key lookup, so two admin actions on unrelated agents read each
+ * other's rows and abort one another, retry after retry, while either keeps running. The Postgres manual
+ * ("Serializable Isolation Level") recommends steering these transactions to index scans; their queries
+ * are keyed by indexed agent, server or resource ids, so turning sequential scans off for this
+ * transaction only (SET LOCAL) narrows the locks to the rows and index pages actually read. It changes
+ * plans, never results: a query with no usable index still scans.
+ */
+export declare function preferIndexScans(tx: {
+    $executeRawUnsafe(query: string): Promise<number>;
+}): Promise<void>;
+export declare function withSerializableRetry<T>(fn: () => Promise<T>, options?: {
+    attempts?: number;
+    sleep?: (ms: number) => Promise<void>;
+}): Promise<T>;

package/dist/core/serializable-retry.js

@@ -0,0 +1,43 @@
+/**
+ * A bounded retry for short Serializable transactions on admin and owner actions (make_owner,
+ * attach_mcp_server, grant/revoke that prune attachments). Postgres aborts one side of a conflicting
+ * pair; nothing of the aborted attempt was committed, so running it again is safe. Only serialization
+ * conflicts (isSerializationConflict: P2034, a raw-statement 40001/40P01, or one at COMMIT) are
+ * retried; anything else, and the last attempt's conflict, is rethrown for mapPrismaError (409).
+ */
+import { isSerializationConflict } from "./dispatch.js";
+const BASE_DELAY_MS = 20;
+const MAX_DELAY_MS = 250;
+/** Jittered exponential backoff: half the ceiling plus up to half again. */
+function delayMs(attempt) {
+    const ceiling = Math.min(MAX_DELAY_MS, BASE_DELAY_MS * 2 ** attempt);
+    return Math.floor(ceiling / 2 + Math.random() * (ceiling / 2));
+}
+/**
+ * Run first inside each of those transactions (make_owner, attach_mcp_server, grant/revoke). Postgres's Serializable mode takes a predicate (SIREAD)
+ * lock on everything a statement reads, and a sequential scan locks the whole relation and checks every
+ * row in it for conflicts. On small tables (a fresh deployment, or a test database) the planner picks a
+ * sequential scan even for a primary-key lookup, so two admin actions on unrelated agents read each
+ * other's rows and abort one another, retry after retry, while either keeps running. The Postgres manual
+ * ("Serializable Isolation Level") recommends steering these transactions to index scans; their queries
+ * are keyed by indexed agent, server or resource ids, so turning sequential scans off for this
+ * transaction only (SET LOCAL) narrows the locks to the rows and index pages actually read. It changes
+ * plans, never results: a query with no usable index still scans.
+ */
+export async function preferIndexScans(tx) {
+    await tx.$executeRawUnsafe("SET LOCAL enable_seqscan = off");
+}
+export async function withSerializableRetry(fn, options = {}) {
+    const attempts = Math.max(1, options.attempts ?? 3);
+    const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    for (let attempt = 0;; attempt += 1) {
+        try {
+            return await fn();
+        }
+        catch (err) {
+            if (!isSerializationConflict(err) || attempt >= attempts - 1)
+                throw err;
+            await sleep(delayMs(attempt));
+        }
+    }
+}

package/dist/core/tool-admin.d.ts

@@ -33,6 +33,8 @@ export interface ToolChanges {
     description?: string;
     paramsZod?: string;
     code?: string;
+    /** null clears it (back to the default limit). Checked against the ceiling by the caller (toolTimeoutProblem). */
+    timeoutMs?: number | null;
 }
 /**
  * Why a tool change was refused because of its attachments:
@@ -76,6 +78,8 @@ export declare function deleteToolGuarded(db: Pick<PrismaClient, "$transaction">
     authorize: AuthorizeTool;
 }): Promise<string[]>;
 /** One `wardby tool list` line: names are only unique per owner, so the id and owner disambiguate. */
-export declare function formatToolLine(tool: Pick<Tool, "id" | "name" | "description" | "ownerId">): string;
+export declare function formatToolLine(tool: Pick<Tool, "id" | "name" | "description" | "ownerId"> & {
+    timeoutMs?: number | null;
+}): string;
 /** Attached agents for an operator-facing refusal: unlike MCP's, nothing is redacted. */
 export declare function formatAttachedAgents(agents: AttachedAgent[]): string;

package/dist/core/tool-admin.js

@@ -46,7 +46,10 @@ export class ToolAttachedError extends Error {
 }
 /** Whether `changes` names at least one field to change. */
 export function hasToolChanges(changes) {
-    return changes.description !== undefined || changes.paramsZod !== undefined || changes.code !== undefined;
+    return (changes.description !== undefined ||
+        changes.paramsZod !== undefined ||
+        changes.code !== undefined ||
+        changes.timeoutMs !== undefined);
 }
 /**
  * The row update for `changes`, with jsonSchema re-derived exactly as tool
@@ -59,6 +62,7 @@ export async function prepareToolUpdate(changes) {
     const data = {
         ...(changes.description !== undefined ? { description: changes.description } : {}),
         ...(changes.code !== undefined ? { code: changes.code } : {}),
+        ...(changes.timeoutMs !== undefined ? { timeoutMs: changes.timeoutMs } : {}),
     };
     if (changes.paramsZod !== undefined) {
         const schemaResult = await deriveJsonSchema(changes.paramsZod);
@@ -119,7 +123,8 @@ export async function deleteToolGuarded(db, toolId, options) {
 }
 /** One `wardby tool list` line: names are only unique per owner, so the id and owner disambiguate. */
 export function formatToolLine(tool) {
-    return `${tool.id}  ${tool.name}  owner:${tool.ownerId ?? "public"}  ${tool.description}`;
+    const timeout = tool.timeoutMs === null || tool.timeoutMs === undefined ? "" : `  timeoutMs:${tool.timeoutMs}`;
+    return `${tool.id}  ${tool.name}  owner:${tool.ownerId ?? "public"}${timeout}  ${tool.description}`;
 }
 /** Attached agents for an operator-facing refusal: unlike MCP's, nothing is redacted. */
 export function formatAttachedAgents(agents) {

package/dist/core/tool-names.d.ts

@@ -9,6 +9,8 @@
  * the model would see a duplicate tool name and one tool would silently
  * shadow the other; every attach path refuses that instead
  * (findSameNamedAttachedTool), and the runner asserts it at load time.
+ * The same holds against an attached MCP server's exposed tool names
+ * (findSameNamedMcpTool); the runner leaves a clashing MCP tool out.
  */
 import type { Prisma, PrismaClient, Tool } from "#prisma";
 /** The runner's synthesized sub-agent tools are `delegate_to_<boundName>`. */
@@ -28,6 +30,17 @@ export type ToolLookupDb = Pick<PrismaClient | Prisma.TransactionClient, "tool"
  * is Serializable) so a concurrent attach can't slip in between.
  */
 export declare function findSameNamedAttachedTool(db: Pick<ToolLookupDb, "agentTool">, agentId: string, tool: Pick<Tool, "id" | "name">): Promise<Pick<Tool, "id" | "name" | "ownerId"> | null>;
+/**
+ * An MCP attachment of `agentId` whose exposed tool name (`<server>__<tool>`) equals `toolName`,
+ * or null: the other direction of attach_mcp_server's clash check, for every path that attaches a
+ * Tool. Every exposed name contains "__", so any other name needs no lookup.
+ */
+export declare function findSameNamedMcpTool(db: Pick<PrismaClient | Prisma.TransactionClient, "agentMcpServer">, agentId: string, toolName: string): Promise<{
+    serverId: string;
+    serverName: string;
+} | null>;
+/** The refusal for a Tool whose name is an exposed MCP tool name on the agent (findSameNamedMcpTool). */
+export declare function sameNamedMcpToolMessage(agentRef: string, toolName: string, serverName: string): string;
 /**
  * Resolves a CLI tool reference: an id, else a name. A name is no longer
  * unique across owners, so more than one match is refused -- with the

package/dist/core/tool-names.js

@@ -1,6 +1,7 @@
 import { MEMORY_TOOL_NAMES } from "./memory-tools.js";
 import { SUBAGENT_MEMORY_TOOL_NAMES } from "./subagent-memory-tools.js";
 import { ISSUE_TRACKER_TOOL_NAMES } from "./issue-tracker-tools.js";
+import { exposedNames } from "./mcp-servers.js";
 /** The runner's synthesized sub-agent tools are `delegate_to_<boundName>`. */
 export const DELEGATE_TOOL_PREFIX = "delegate_to_";
 /**
@@ -44,6 +45,25 @@ export async function findSameNamedAttachedTool(db, agentId, tool) {
     });
     return clash?.tool ?? null;
 }
+/**
+ * An MCP attachment of `agentId` whose exposed tool name (`<server>__<tool>`) equals `toolName`,
+ * or null: the other direction of attach_mcp_server's clash check, for every path that attaches a
+ * Tool. Every exposed name contains "__", so any other name needs no lookup.
+ */
+export async function findSameNamedMcpTool(db, agentId, toolName) {
+    if (!toolName.includes("__"))
+        return null;
+    const rows = await db.agentMcpServer.findMany({
+        where: { agentId },
+        select: { allowedTools: true, server: { select: { id: true, name: true } } },
+    });
+    const hit = rows.find((row) => exposedNames(row.server.name, row.allowedTools).includes(toolName));
+    return hit ? { serverId: hit.server.id, serverName: hit.server.name } : null;
+}
+/** The refusal for a Tool whose name is an exposed MCP tool name on the agent (findSameNamedMcpTool). */
+export function sameNamedMcpToolMessage(agentRef, toolName, serverName) {
+    return `Agent "${agentRef}" already has the tool "${toolName}" from MCP server "${serverName}"; detach it or allow a different tool first.`;
+}
 /**
  * Resolves a CLI tool reference: an id, else a name. A name is no longer
  * unique across owners, so more than one match is refused -- with the

package/dist/core/webhooks.d.ts

@@ -22,6 +22,9 @@ export type ResolveWebhookRunResult = {
 } | {
     ok: false;
     reason: "not_found" | "invalid_secret" | "disabled";
+} | {
+    ok: false;
+    reason: "invalid_repository";
 } | {
     ok: false;
     reason: "invalid_issue";
@@ -35,4 +38,5 @@ export type ResolveWebhookRunResult = {
 export declare function resolveWebhookRun(id: string, presentedSecret: string, db: PrismaClient, executor: Executor, codingTask?: string, opts?: {
     issue?: unknown;
     issueTrackers?: IssueTrackerRegistry;
+    repository?: string;
 }): Promise<ResolveWebhookRunResult>;

package/dist/core/webhooks.js

@@ -10,6 +10,7 @@
  */
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { AttributionError, explicitAttribution, RESPONSE_PATH_SNAPSHOT_BUDGET, } from "./attribution.js";
+import { RepositoryChoiceRefusedError } from "./coding-repository.js";
 import { dispatchRun } from "./dispatch.js";
 import { atLeast, effectiveAccess } from "./grants.js";
 function hashSecret(secret) {
@@ -81,6 +82,13 @@ export async function resolveWebhookRun(id, presentedSecret, db, executor, codin
     if (codingTask !== undefined && !taskAllowed(agent.kind, agent.codingProfile)) {
         return { ok: false, reason: "disabled" };
     }
+    // Choosing a repository takes the same opt-in as a task, and only a coding agent has one.
+    if (opts.repository !== undefined) {
+        if (agent.kind !== "coding")
+            return { ok: false, reason: "invalid_repository" };
+        if (!taskAllowed(agent.kind, agent.codingProfile))
+            return { ok: false, reason: "disabled" };
+    }
     // An invalid or unlinked issue refuses the call before any run exists.
     let attribution;
     if (opts.issue !== undefined) {
@@ -97,55 +105,66 @@ export async function resolveWebhookRun(id, presentedSecret, db, executor, codin
         }
     }
     let rejected = "disabled";
-    const dispatched = await dispatchRun({
-        db,
-        executor,
-        selfDefects: { db, issueTrackers: opts.issueTrackers },
-        agentId: agent.id,
-        trigger: "webhook",
-        attribution,
-        // Coding agents keep the existing per-agent opt-in (allowWebhookTaskOverride);
-        // a native agent's system prompt has no per-run input at all otherwise, so
-        // accepting task text over an authenticated webhook call needs no separate
-        // opt-in — it's a much lower-risk capability than a coding agent being told
-        // to modify a real repository.
-        codingTask: agent.kind === "coding" ? codingTask : undefined,
-        taskOverride: agent.kind === "native" ? codingTask : undefined,
-        // The webhook is its creator's standing trigger: its runs are visible to
-        // the creator (and the agent owner), like a trigger_agent call.
-        triggeredById: webhook.ownerId,
-        beforePersist: async (tx, currentAgent) => {
-            const current = await tx.webhook.findUnique({ where: { id } });
-            if (!current) {
-                rejected = "not_found";
-                return false;
-            }
-            if (!secretMatches(presentedSecret, current.secretHash)) {
-                rejected = "invalid_secret";
-                return false;
-            }
-            if (current.status !== "enabled") {
-                rejected = "disabled";
-                return false;
-            }
-            if (codingTask !== undefined && !taskAllowed(currentAgent.kind, currentAgent.codingProfile)) {
-                rejected = "disabled";
-                return false;
-            }
-            // The creator must still be allowed to trigger the agent (resource-
-            // sharing grants spec §3.10): its owner, or a holder of execute. Read
-            // through tx, so a revoke or make_owner takes effect on the next fire.
-            // A webhook on a formerly public agent keeps firing through the
-            // migration's everyone-execute grant.
-            const creatorAccess = await effectiveAccess(tx, "agent", currentAgent, current.ownerId);
-            if (!atLeast("agent", creatorAccess, "execute")) {
-                rejected = "disabled";
-                return false;
-            }
-            await tx.webhook.update({ where: { id }, data: { lastFiredAt: new Date() } });
-            return true;
-        },
-    });
+    let dispatched;
+    try {
+        dispatched = await dispatchRun({
+            db,
+            executor,
+            selfDefects: { db, issueTrackers: opts.issueTrackers },
+            agentId: agent.id,
+            trigger: "webhook",
+            attribution,
+            // Coding agents keep the existing per-agent opt-in (allowWebhookTaskOverride);
+            // a native agent's system prompt has no per-run input at all otherwise, so
+            // accepting task text over an authenticated webhook call needs no separate
+            // opt-in — it's a much lower-risk capability than a coding agent being told
+            // to modify a real repository.
+            codingTask: agent.kind === "coding" ? codingTask : undefined,
+            taskOverride: agent.kind === "native" ? codingTask : undefined,
+            codingRepository: agent.kind === "coding" ? opts.repository : undefined,
+            // The webhook is its creator's standing trigger: its runs are visible to
+            // the creator (and the agent owner), like a trigger_agent call.
+            triggeredById: webhook.ownerId,
+            beforePersist: async (tx, currentAgent) => {
+                const current = await tx.webhook.findUnique({ where: { id } });
+                if (!current) {
+                    rejected = "not_found";
+                    return false;
+                }
+                if (!secretMatches(presentedSecret, current.secretHash)) {
+                    rejected = "invalid_secret";
+                    return false;
+                }
+                if (current.status !== "enabled") {
+                    rejected = "disabled";
+                    return false;
+                }
+                if ((codingTask !== undefined || opts.repository !== undefined) &&
+                    !taskAllowed(currentAgent.kind, currentAgent.codingProfile)) {
+                    rejected = "disabled";
+                    return false;
+                }
+                // The creator must still be allowed to trigger the agent (resource-
+                // sharing grants spec §3.10): its owner, or a holder of execute. Read
+                // through tx, so a revoke or make_owner takes effect on the next fire.
+                // A webhook on a formerly public agent keeps firing through the
+                // migration's everyone-execute grant.
+                const creatorAccess = await effectiveAccess(tx, "agent", currentAgent, current.ownerId);
+                if (!atLeast("agent", creatorAccess, "execute")) {
+                    rejected = "disabled";
+                    return false;
+                }
+                await tx.webhook.update({ where: { id }, data: { lastFiredAt: new Date() } });
+                return true;
+            },
+        });
+    }
+    catch (err) {
+        // The refusal's message lists the agent's repositories; the caller gets only the code.
+        if (err instanceof RepositoryChoiceRefusedError)
+            return { ok: false, reason: "invalid_repository" };
+        throw err;
+    }
     if (!dispatched)
         return { ok: false, reason: rejected };
     return { ok: true, runId: dispatched.run.id };

package/dist/core/workflow-run-events.js

@@ -1,3 +1,4 @@
+import { pullRequestWebUrl } from "../coding/code-host.js";
 import { packageAuditDigest } from "../coding/registry/audit-mode.js";
 import { blockingRefusals, collectPackageAudit, collectRunOutcome, isBlockedByRefusals } from "./host-status.js";
 import { logger } from "./logger.js";
@@ -63,7 +64,7 @@ export async function emitRunFinishedEvents(db, run) {
                     agentName,
                     verdict: check.verdict,
                     prLabel,
-                    prUrl: check.provider === "github" ? `https://github.com/${check.repository}/pull/${check.prNumber}` : null,
+                    prUrl: pullRequestWebUrl(check.provider, check.repository, check.prNumber),
                     ciPending: check.ciPendingAtReview === true,
                 },
             });

package/dist/generated/prisma/browser.d.ts

@@ -421,6 +421,16 @@ export type HostIdentityLinkRequest = Prisma.HostIdentityLinkRequestModel;
  * docs/private/2026-09-30-jira-issue-tracker-design.md §3.
  */
 export type AgentIssueProject = Prisma.AgentIssueProjectModel;
+/**
+ * Model McpServer
+ * A remote MCP server an owner registered (Streamable HTTP, HTTPS only).
+ */
+export type McpServer = Prisma.McpServerModel;
+/**
+ * Model AgentMcpServer
+ * An MCP server attached to an agent, with the server tools it may call.
+ */
+export type AgentMcpServer = Prisma.AgentMcpServerModel;
 /**
  * Model IssueFingerprint
  * Dedupe record: an issue wardby created for a fingerprint (several over time — regressions).
@@ -504,3 +514,24 @@ export type NotificationDelivery = Prisma.NotificationDeliveryModel;
  * The parent message of a work item's (or PR's) thread in one channel.
  */
 export type NotificationThread = Prisma.NotificationThreadModel;
+/**
+ * Model HostProvider
+ * A code host implemented by operator-approved custom tools (docs/host-providers.md).
+ * `name` is the prefix of its repository ids: `<name>:<workspace>/<repo>`. Holds no secret values.
+ */
+export type HostProvider = Prisma.HostProviderModel;
+/**
+ * Model HostProviderOperation
+ * One approved snapshot: the code Wardby runs. `update_tool` changes nothing here until approved again.
+ */
+export type HostProviderOperation = Prisma.HostProviderOperationModel;
+/**
+ * Model HostProviderCredential
+ * Which brokered secret serves which repositories. `credentialKind` is `static` only in v1.
+ */
+export type HostProviderCredential = Prisma.HostProviderCredentialModel;
+/**
+ * Model HostProviderTrustedAccount
+ * Host accounts allowed to start runs when the provider has no permission secret.
+ */
+export type HostProviderTrustedAccount = Prisma.HostProviderTrustedAccountModel;

package/dist/generated/prisma/client.d.ts

@@ -440,6 +440,16 @@ export type HostIdentityLinkRequest = Prisma.HostIdentityLinkRequestModel;
  * docs/private/2026-09-30-jira-issue-tracker-design.md §3.
  */
 export type AgentIssueProject = Prisma.AgentIssueProjectModel;
+/**
+ * Model McpServer
+ * A remote MCP server an owner registered (Streamable HTTP, HTTPS only).
+ */
+export type McpServer = Prisma.McpServerModel;
+/**
+ * Model AgentMcpServer
+ * An MCP server attached to an agent, with the server tools it may call.
+ */
+export type AgentMcpServer = Prisma.AgentMcpServerModel;
 /**
  * Model IssueFingerprint
  * Dedupe record: an issue wardby created for a fingerprint (several over time — regressions).
@@ -523,3 +533,24 @@ export type NotificationDelivery = Prisma.NotificationDeliveryModel;
  * The parent message of a work item's (or PR's) thread in one channel.
  */
 export type NotificationThread = Prisma.NotificationThreadModel;
+/**
+ * Model HostProvider
+ * A code host implemented by operator-approved custom tools (docs/host-providers.md).
+ * `name` is the prefix of its repository ids: `<name>:<workspace>/<repo>`. Holds no secret values.
+ */
+export type HostProvider = Prisma.HostProviderModel;
+/**
+ * Model HostProviderOperation
+ * One approved snapshot: the code Wardby runs. `update_tool` changes nothing here until approved again.
+ */
+export type HostProviderOperation = Prisma.HostProviderOperationModel;
+/**
+ * Model HostProviderCredential
+ * Which brokered secret serves which repositories. `credentialKind` is `static` only in v1.
+ */
+export type HostProviderCredential = Prisma.HostProviderCredentialModel;
+/**
+ * Model HostProviderTrustedAccount
+ * Host accounts allowed to start runs when the provider has no permission secret.
+ */
+export type HostProviderTrustedAccount = Prisma.HostProviderTrustedAccountModel;