@wardby/cli 0.7.0 → 0.9.0

package/dist/core/coding-mcp.js

@@ -0,0 +1,253 @@
+/**
+ * The native gateway's /coding-mcp route (remote MCP servers, phase 2): a stateless Streamable HTTP
+ * MCP server that runs a coding run's MCP tool calls. The worker reaches it only through the coding
+ * proxy's /mcp route, which forwards the request and the run's MCP token (`rmt_…`) unchanged; the
+ * proxy is not trusted, so the token is checked here again: its hash must name a proxy session that
+ * is active and before its deadline, whose run is still drivable (not stopped or cancelled).
+ *
+ * A Codex run (by the provider it was dispatched with, CodingRun.provider) may call only tools the
+ * live tool list marks read-only: its shell commands can read the token.
+ *
+ * tools/list serves the session's pins (no URLs or secrets); tools/call counts the call against the
+ * run's limit (WARDBY_MCP_MAX_CALLS_PER_RUN) and runs it through phase 1's handleMcpTool, which
+ * re-checks the live attachment and redacts the result against the server's secrets before it gets
+ * here. Secrets: this route's own log line carries the method, status and session id only (never the
+ * body, arguments, results or token), and every body it sends is either fixed text, the pins, or
+ * handleMcpTool's already-redacted string.
+ */
+import { readFileSync } from "node:fs";
+import { loadMcpMaxCallsPerRun } from "../config/mcp-call-limit.js";
+import { MCP_TOKEN_REQUIRED_MESSAGE, mcpTokenHash, isMcpToken } from "../coding/mcp-token.js";
+import { HTTP_LIMITS } from "../mcp/transport/http-limits.js";
+import { handleMcpTool, isCodexCoding, mcpToolDefs } from "./mcp-tools.js";
+import { runDrivability, TOOL_STOP_POLL_MS, watchRunStop } from "./runner.js";
+export const CODING_MCP_PATH = "/coding-mcp";
+/** What initialize answers when the client names no protocol version. */
+export const CODING_MCP_DEFAULT_PROTOCOL_VERSION = "2025-06-18";
+/** The package version, reported in server info (package.json sits two levels up from src/core and dist/core). */
+const SERVER_VERSION = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8")).version;
+const LOGGED_METHODS = new Set([
+    "initialize",
+    "ping",
+    "tools/list",
+    "tools/call",
+    "notifications/initialized",
+    "notifications/cancelled",
+]);
+const JSON_TYPE = "application/json";
+const reply = (status, payload) => ({
+    status,
+    body: payload === undefined ? "" : JSON.stringify(payload),
+    contentType: JSON_TYPE,
+});
+const rpcResult = (id, result) => reply(200, { jsonrpc: "2.0", id, result });
+const rpcError = (status, id, code, message) => reply(status, { jsonrpc: "2.0", id, error: { code, message } });
+/** An MCP tool result: the text handleMcpTool returned, flagged when it is one of its JSON errors. */
+const toolResult = (text, isError) => ({
+    content: [{ type: "text", text }],
+    ...(isError ? { isError: true } : {}),
+});
+const toolError = (code, message) => toolResult(JSON.stringify({ error: code, message }), true);
+/**
+ * True for handleMcpTool's error shape: exactly `{ error: <code>, message }`. A server result that
+ * happens to have that very shape is flagged too; the model sees the same text either way.
+ */
+export function isMcpErrorText(text) {
+    if (!text.startsWith("{"))
+        return false;
+    try {
+        const value = JSON.parse(text);
+        if (value === null || typeof value !== "object" || Array.isArray(value))
+            return false;
+        const keys = Object.keys(value);
+        const v = value;
+        return (keys.length === 2 &&
+            typeof v.error === "string" &&
+            /^[a-z][a-z0-9_]*$/.test(v.error) &&
+            typeof v.message === "string");
+    }
+    catch {
+        return false;
+    }
+}
+/** One stored pin, checked field by field: a malformed entry is left out, never served. */
+export function isMcpToolPin(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const p = value;
+    const definition = p.definition;
+    return (typeof p.exposedName === "string" &&
+        p.exposedName !== "" &&
+        typeof p.toolName === "string" &&
+        p.toolName !== "" &&
+        typeof p.serverId === "string" &&
+        p.serverId !== "" &&
+        typeof p.serverName === "string" &&
+        (p.callTimeoutMs === undefined ||
+            (typeof p.callTimeoutMs === "number" && Number.isSafeInteger(p.callTimeoutMs) && p.callTimeoutMs > 0)) &&
+        definition !== null &&
+        typeof definition === "object" &&
+        !Array.isArray(definition) &&
+        typeof definition.description === "string" &&
+        definition.inputSchema !== null &&
+        typeof definition.inputSchema === "object" &&
+        !Array.isArray(definition.inputSchema));
+}
+/** The session's well-formed pins, first of each exposed name only. */
+export function storedPins(stored) {
+    if (!Array.isArray(stored))
+        return [];
+    const seen = new Set();
+    const pins = [];
+    for (const entry of stored) {
+        if (!isMcpToolPin(entry) || seen.has(entry.exposedName))
+            continue;
+        seen.add(entry.exposedName);
+        pins.push(entry);
+    }
+    return pins;
+}
+/**
+ * Handles one JSON-RPC request body for /coding-mcp. Never throws. `signal` is the request's own: the
+ * listener aborts it when the proxy's connection closes before the answer, which stops a call in flight.
+ */
+export async function handleCodingMcpRequest(authorization, body, deps, signal) {
+    const seen = {};
+    let response;
+    try {
+        response = await handle(authorization, body, deps, seen, signal);
+    }
+    catch {
+        // Nothing of the error leaves: its message could carry anything the call touched.
+        response = rpcError(500, null, -32603, "Internal error.");
+    }
+    // Method, status and session id only: never the body, the arguments, the result, or the token.
+    deps.log.info({ method: seen.method, status: response.status, sessionId: seen.sessionId }, "coding mcp request");
+    return response;
+}
+async function handle(authorization, body, deps, seen, signal) {
+    if (Buffer.byteLength(body, "utf8") > HTTP_LIMITS.json) {
+        return rpcError(413, null, -32600, "The request body is too large.");
+    }
+    const session = await authenticate(authorization, deps);
+    // No WWW-Authenticate: a client must not start OAuth discovery against this route.
+    if (!session)
+        return rpcError(401, null, -32001, MCP_TOKEN_REQUIRED_MESSAGE);
+    seen.sessionId = session.id;
+    let message;
+    try {
+        message = JSON.parse(body);
+    }
+    catch {
+        return rpcError(400, null, -32700, "Parse error.");
+    }
+    if (message === null || typeof message !== "object" || Array.isArray(message)) {
+        return rpcError(400, null, -32600, "Invalid request: one JSON-RPC message per request.");
+    }
+    const m = message;
+    const id = typeof m.id === "string" || typeof m.id === "number" ? m.id : null;
+    if (m.jsonrpc !== "2.0" || typeof m.method !== "string") {
+        return rpcError(400, id, -32600, "Invalid request.");
+    }
+    // The method is the client's own text: only a known one is logged, anything else as "other".
+    seen.method = LOGGED_METHODS.has(m.method) ? m.method : "other";
+    // A notification (no id) has no reply.
+    if (m.id === undefined)
+        return reply(202, undefined);
+    if (id === null)
+        return rpcError(400, null, -32600, "Invalid request: id must be a string or number.");
+    switch (m.method) {
+        case "initialize":
+            return rpcResult(id, {
+                protocolVersion: protocolVersionOf(m.params),
+                capabilities: { tools: {} },
+                serverInfo: { name: "wardby", version: SERVER_VERSION },
+            });
+        case "ping":
+            return rpcResult(id, {});
+        case "tools/list":
+            return rpcResult(id, {
+                tools: mcpToolDefs(storedPins(session.mcpTools)).map((def) => ({
+                    name: def.name,
+                    description: def.description,
+                    inputSchema: def.jsonSchema,
+                })),
+            });
+        case "tools/call":
+            return rpcResult(id, await callTool(session, m.params, deps, signal));
+        default:
+            return rpcError(200, id, -32601, "Method not found.");
+    }
+}
+function protocolVersionOf(params) {
+    const requested = params?.protocolVersion;
+    return typeof requested === "string" && /^\d{4}-\d{2}-\d{2}$/.test(requested)
+        ? requested
+        : CODING_MCP_DEFAULT_PROTOCOL_VERSION;
+}
+async function authenticate(authorization, deps) {
+    const token = /^Bearer (\S+)$/.exec(authorization ?? "")?.[1];
+    if (!isMcpToken(token))
+        return undefined;
+    const session = await deps.db.codingProxySession.findUnique({
+        where: { mcpTokenHash: mcpTokenHash(token) },
+        select: {
+            id: true,
+            runId: true,
+            status: true,
+            deadlineAt: true,
+            mcpTools: true,
+            run: { select: { provider: true } },
+        },
+    });
+    if (!session || session.status !== "active")
+        return undefined;
+    if ((deps.now?.() ?? new Date()).getTime() >= session.deadlineAt.getTime())
+        return undefined;
+    // A stopped or cancelled run's session can still read active for a moment: its token ends with the
+    // run, as an ended session's does (401, so no call starts and no tool is listed).
+    if ((await runDrivability(deps.db, session.runId)) !== "drivable")
+        return undefined;
+    return session;
+}
+async function callTool(session, params, deps, requestSignal) {
+    const p = (params ?? {});
+    const name = typeof p.name === "string" ? p.name : "";
+    const pin = storedPins(session.mcpTools).find((candidate) => candidate.exposedName === name);
+    if (!pin) {
+        return toolError("mcp_tool_not_allowed", `The tool "${name.slice(0, 128)}" is not one of this run's MCP tools.`);
+    }
+    const limit = loadMcpMaxCallsPerRun();
+    const counted = await deps.db.$queryRaw `
+    UPDATE "CodingProxySession" SET "mcpCallCount" = "mcpCallCount" + 1
+    WHERE "id" = ${session.id} AND "mcpCallCount" < ${limit}
+    RETURNING "mcpCallCount"
+  `;
+    if (counted.length === 0) {
+        return toolError("mcp_call_limit", `This run reached its limit of ${limit} MCP tool calls.`);
+    }
+    const run = await deps.db.run.findUnique({ where: { id: session.runId }, select: { agentId: true } });
+    if (!run)
+        return toolError("mcp_tool_not_allowed", "This run no longer exists.");
+    // As for a native run's call: a stop_run aborts the call in flight.
+    // The proxy closing its request (its forward limit, or the worker gone) aborts it too.
+    const stop = watchRunStop(deps.db, session.runId, deps.stopPollMs ?? TOOL_STOP_POLL_MS);
+    const signal = requestSignal ? AbortSignal.any([stop.signal, requestSignal]) : stop.signal;
+    try {
+        const text = await handleMcpTool(pin, p.arguments === undefined ? "" : JSON.stringify(p.arguments), {
+            db: deps.db,
+            cipher: deps.cipher,
+            agentId: run.agentId,
+            runId: session.runId,
+            signal,
+            deadlineAt: session.deadlineAt,
+            readOnlyOnly: isCodexCoding(session.run.provider),
+            fetchImpl: deps.fetchImpl,
+            log: deps.log,
+        });
+        return toolResult(text, isMcpErrorText(text));
+    }
+    finally {
+        stop.done();
+    }
+}

package/dist/core/coding-repository.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Which repository a coding run works in: the agent's default
+ * (codingProfile.repository) or one of its write links without triggers.
+ * Every entry point goes through here. Errors never carry the requested value:
+ * it is caller- or model-written text and could hold a secret.
+ */
+import type { Prisma } from "#prisma";
+export type CodingRepositoryReader = Pick<Prisma.TransactionClient, "agentRepository" | "codingRun">;
+export interface CodingRepositoryTarget {
+    repository: string;
+    baseRef: string;
+    viaRepositoryLink: boolean;
+}
+export type RepositoryRefusalCode = "repository_required" | "repository_not_listed";
+export declare class RepositoryChoiceRefusedError extends Error {
+    readonly code: RepositoryRefusalCode;
+    readonly allowed: readonly string[];
+    constructor(code: RepositoryRefusalCode, allowed: readonly string[]);
+}
+/** Which of an agent's links are repositories on a coding agent's list. */
+export declare const CODING_REPOSITORY_LINK_FILTER: {
+    readonly access: "write";
+    readonly triggers: {
+        readonly isEmpty: true;
+    };
+};
+/**
+ * The repositories a list adds to its default. A link can come to equal the default when
+ * update_agent moves the default onto it; that link adds nothing, and a run there is on the default.
+ */
+export declare function extraCodingRepositoryLinks<Link extends {
+    repository: string;
+}>(links: readonly Link[], defaultRepository: string): Link[];
+/** Whether the agent has more than its default, for wording only: authorization is resolveCodingRepository's. */
+export declare function hasCodingRepositoryList(reader: Pick<CodingRepositoryReader, "agentRepository">, agentId: string, defaultRepository: string): Promise<boolean>;
+export declare function resolveCodingRepository(reader: CodingRepositoryReader, input: {
+    agentId: string;
+    profile: {
+        repository: string;
+        baseRef: string;
+    };
+    requested?: string;
+    continuesCodingRunId?: string;
+    /** A delegation must name its repository when the agent has more than its default. */
+    requireExplicit?: boolean;
+}): Promise<CodingRepositoryTarget>;

package/dist/core/coding-repository.js

@@ -0,0 +1,92 @@
+import { codeProviderOf, normalizeHostedRepository } from "../coding/code-host.js";
+import { isLocalRepository, normalizeGitHubRepository, normalizeLocalRepository } from "../coding/protocol.js";
+export class RepositoryChoiceRefusedError extends Error {
+    code;
+    allowed;
+    constructor(code, allowed) {
+        super(code === "repository_required"
+            ? `This coding agent works in several repositories: pass repository, one of ${allowed.join(", ")}.`
+            : `That repository is not on this coding agent's list: ${allowed.join(", ")}.`);
+        this.code = code;
+        this.allowed = allowed;
+        this.name = "RepositoryChoiceRefusedError";
+    }
+}
+function canonical(value) {
+    try {
+        if (isLocalRepository(value))
+            return normalizeLocalRepository(value);
+        if (codeProviderOf(value) === "github")
+            return normalizeGitHubRepository(value);
+        return normalizeHostedRepository(value);
+    }
+    catch {
+        return null;
+    }
+}
+function same(a, b) {
+    const left = canonical(a);
+    return left !== null && left === canonical(b);
+}
+/** Which of an agent's links are repositories on a coding agent's list. */
+export const CODING_REPOSITORY_LINK_FILTER = { access: "write", triggers: { isEmpty: true } };
+/**
+ * The repositories a list adds to its default. A link can come to equal the default when
+ * update_agent moves the default onto it; that link adds nothing, and a run there is on the default.
+ */
+export function extraCodingRepositoryLinks(links, defaultRepository) {
+    return links.filter((link) => !same(link.repository, defaultRepository));
+}
+async function listExtraRepositoryLinks(reader, agentId, defaultRepository) {
+    const links = await reader.agentRepository.findMany({
+        where: { agentId, ...CODING_REPOSITORY_LINK_FILTER },
+        select: { repository: true, baseRef: true },
+        orderBy: { repository: "asc" },
+    });
+    return extraCodingRepositoryLinks(links, defaultRepository);
+}
+/** Whether the agent has more than its default, for wording only: authorization is resolveCodingRepository's. */
+export async function hasCodingRepositoryList(reader, agentId, defaultRepository) {
+    return (await listExtraRepositoryLinks(reader, agentId, defaultRepository)).length > 0;
+}
+export async function resolveCodingRepository(reader, input) {
+    const { profile, requested, continuesCodingRunId } = input;
+    const defaultTarget = { repository: profile.repository, baseRef: profile.baseRef, viaRepositoryLink: false };
+    if (requested !== undefined && same(requested, profile.repository))
+        return defaultTarget;
+    if (requested === undefined && continuesCodingRunId === undefined && !input.requireExplicit)
+        return defaultTarget;
+    const links = await listExtraRepositoryLinks(reader, input.agentId, profile.repository);
+    const onList = (name) => links.find((link) => same(link.repository, name));
+    const target = (link) => ({
+        repository: link.repository,
+        baseRef: link.baseRef ?? profile.baseRef,
+        viaRepositoryLink: true,
+    });
+    const allowed = [profile.repository, ...links.map((link) => link.repository)];
+    if (requested !== undefined) {
+        const link = onList(requested);
+        if (!link)
+            throw new RepositoryChoiceRefusedError("repository_not_listed", allowed);
+        return target(link);
+    }
+    if (continuesCodingRunId !== undefined) {
+        const repository = await continuationRepository(reader, continuesCodingRunId);
+        const link = repository === null ? undefined : onList(repository);
+        // Anything else stays on the default, where checkContinuation gives its own refusal.
+        return link ? target(link) : defaultTarget;
+    }
+    if (links.length > 0)
+        throw new RepositoryChoiceRefusedError("repository_required", allowed);
+    return defaultTarget;
+}
+async function continuationRepository(reader, runId) {
+    const select = { repository: true, rootCodingRunId: true };
+    const run = await reader.codingRun.findUnique({ where: { runId }, select });
+    if (!run)
+        return null;
+    if (!run.rootCodingRunId)
+        return run.repository;
+    const root = await reader.codingRun.findUnique({ where: { runId: run.rootCodingRunId }, select });
+    return root?.repository ?? null;
+}

package/dist/core/delegation-slots.d.ts

@@ -0,0 +1,27 @@
+/** What the once-per-run rule counts: a sub-agent, and for a coding sub-agent, the repository. */
+export declare function delegationSlot(childAgentId: string, repository: string | null): string;
+/**
+ * Slots for runs already delegated. A run refused at dispatch has no CodingRun, so its
+ * repository is unknown; for this child that counts as its default. Retrying a refused
+ * non-default repository is allowed, and still counts toward the delegation limit.
+ */
+export declare function priorDelegationSlots(rows: readonly {
+    agentId: string;
+    codingRun?: {
+        repository: string;
+    } | null;
+}[], childAgentId: string, defaultRepository: string | null): string[];
+/**
+ * At most `limit` dispatches per run (default one: a classifier deciding plan-vs-implement
+ * commits to exactly one child), and never the same slot twice, so a retry can't leave two
+ * children racing on the same task. A delegation waiting for budget holds its place.
+ */
+export declare function delegationLimitRefusal(input: {
+    priorSlots: readonly string[];
+    waitingSlots: readonly string[];
+    slot: string;
+    boundName: string;
+    limit: number;
+    /** Whether "the same slot" means the same repository; otherwise it means the same sub-agent. */
+    childHasRepositoryList: boolean;
+}): string | null;

package/dist/core/delegation-slots.js

@@ -0,0 +1,44 @@
+/** What the once-per-run rule counts: a sub-agent, and for a coding sub-agent, the repository. */
+export function delegationSlot(childAgentId, repository) {
+    return repository === null ? childAgentId : `${childAgentId}\n${repository.toLowerCase()}`;
+}
+/**
+ * Slots for runs already delegated. A run refused at dispatch has no CodingRun, so its
+ * repository is unknown; for this child that counts as its default. Retrying a refused
+ * non-default repository is allowed, and still counts toward the delegation limit.
+ */
+export function priorDelegationSlots(rows, childAgentId, defaultRepository) {
+    return rows.map((row) => delegationSlot(row.agentId, row.codingRun?.repository ?? (row.agentId === childAgentId ? defaultRepository : null)));
+}
+/**
+ * At most `limit` dispatches per run (default one: a classifier deciding plan-vs-implement
+ * commits to exactly one child), and never the same slot twice, so a retry can't leave two
+ * children racing on the same task. A delegation waiting for budget holds its place.
+ */
+export function delegationLimitRefusal(input) {
+    const { priorSlots, waitingSlots, slot, boundName, limit, childHasRepositoryList } = input;
+    if (priorSlots.includes(slot) || waitingSlots.includes(slot)) {
+        return JSON.stringify({
+            error: "already_dispatched",
+            message: childHasRepositoryList
+                ? `This run already delegated to "${boundName}" for this repository; a run delegates to each sub-agent and repository at most once.`
+                : `This run already delegated to "${boundName}"; a run delegates to each sub-agent at most once.`,
+        });
+    }
+    if (priorSlots.length < limit && priorSlots.length + waitingSlots.length >= limit) {
+        // Only a waiting delegation (parallelDelegations) holds the remaining place.
+        return JSON.stringify({
+            error: "already_dispatched",
+            message: `This run reached its limit of ${limit} delegations: ${priorSlots.length} made and ${waitingSlots.length} waiting for budget.`,
+        });
+    }
+    if (priorSlots.length >= limit) {
+        return JSON.stringify({
+            error: "already_dispatched",
+            message: limit === 1
+                ? "This run already delegated to a sub-agent; only one delegation is allowed per run."
+                : `This run already made ${limit} delegations, the most this agent allows per run.`,
+        });
+    }
+    return null;
+}

package/dist/core/dispatch.d.ts

@@ -7,8 +7,8 @@ import { type AttributionIntent } from "./attribution.js";
 import { type BudgetConstraint } from "./budget-groups.js";
 import { type KnowledgeNoteInput } from "../knowledge/note.js";
 import { type SelfDefectSink } from "./self-defects.js";
-export type DispatchDb = Pick<PrismaClient, "agent" | "run" | "runHostCheck" | "codingRun" | "task" | "webhook" | "budgetGroup" | "$transaction" | "$queryRaw">;
-export type DispatchTx = Pick<Prisma.TransactionClient, "agent" | "run" | "runHostCheck" | "runHostStatus" | "runIssueStatus" | "codingRun" | "codingService" | "task" | "webhook" | "budgetGroup" | "resourceGrant" | "workItem" | "localPullRequest" | "runAttribution" | "$queryRaw" | "$executeRawUnsafe">;
+export type DispatchDb = Pick<PrismaClient, "agent" | "agentRepository" | "run" | "runHostCheck" | "codingRun" | "task" | "webhook" | "budgetGroup" | "$transaction" | "$queryRaw">;
+export type DispatchTx = Pick<Prisma.TransactionClient, "agent" | "agentRepository" | "run" | "runHostCheck" | "runHostStatus" | "runIssueStatus" | "codingRun" | "codingService" | "task" | "webhook" | "budgetGroup" | "resourceGrant" | "workItem" | "localPullRequest" | "runAttribution" | "$queryRaw" | "$executeRawUnsafe">;
 type DispatchAgent = Prisma.AgentGetPayload<{
     include: {
         codingProfile: true;
@@ -87,6 +87,10 @@ export interface DispatchRunOptions {
      * mutually exclusive with it, since a native run has no CodingRun.
      */
     taskOverride?: string;
+    /** The repository for a coding run; must be on the agent's list. Default: codingProfile.repository. */
+    codingRepository?: string;
+    /** Refuse with repository_required when the agent has links and nothing names a repository. */
+    requireExplicitRepository?: boolean;
     /**
      * Replaces `agent.budgetUsd` as the requested ceiling for this run's coding
      * budget reservation. The reservation is still tightened by the agent's

package/dist/core/dispatch.js

@@ -1,4 +1,5 @@
-import { CODING_PROTOCOL_VERSION, CodingTaskInputSchema, normalizeGitHubRepository, normalizeGitRef, publicCodingRunResult, composeCodingTask, } from "../coding/protocol.js";
+import { normalizeHostedRepository } from "../coding/code-host.js";
+import { CODING_PROTOCOL_VERSION, CodingTaskInputSchema, normalizeGitRef, publicCodingRunResult, composeCodingTask, } from "../coding/protocol.js";
 import { assertCodingProvider, assertCodingProviderModel } from "../coding/provider.js";
 import { isPackageAuditActive } from "../coding/registry/audit-mode.js";
 import { ModelUnavailableError, entryOf } from "../providers/llm/catalog-types.js";
@@ -13,7 +14,9 @@ import { KNOWLEDGE_CONFIG_MAX_BYTES, KNOWLEDGE_CONFIG_PATH, resolveKnowledgeLoca
 import { KNOWLEDGE_INDEX_READ_MAX_BYTES, knowledgeSection } from "../knowledge/note.js";
 import { logger } from "./logger.js";
 import { CodingModelProviderMismatchError, resolveCodingEntry } from "./run-pricing.js";
+import { resolveCodingRepository, } from "./coding-repository.js";
 import { CONTENDED_TX_MAX_WAIT_MS } from "./timing.js";
+import { dispatchRunStepsLevel } from "./run-steps/config.js";
 import { fileSelfDefectForRun } from "./self-defects.js";
 const dispatchLog = logger.child({ module: "dispatch" });
 /** SQLSTATEs worth retrying the persist transaction for: serialization failure, deadlock. */
@@ -205,7 +208,7 @@ export async function checkContinuation(reader, runId, repository, dispatchingOw
         : candidate;
     if (!root)
         return { ok: false, reason: "unknown_run" };
-    if (normalizeGitHubRepository(root.repository) !== normalizeGitHubRepository(repository)) {
+    if (normalizeHostedRepository(root.repository) !== normalizeHostedRepository(repository)) {
         return { ok: false, reason: "other_repository" };
     }
     const rootResult = publicCodingRunResult(root.result);
@@ -231,6 +234,15 @@ export async function checkContinuation(reader, runId, repository, dispatchingOw
         },
     };
 }
+function codingTarget(reader, options, profile) {
+    return resolveCodingRepository(reader, {
+        agentId: options.agentId,
+        profile,
+        requested: options.codingRepository,
+        continuesCodingRunId: options.continuesCodingRunId,
+        requireExplicit: options.requireExplicitRepository,
+    });
+}
 /**
  * Resolves a coding run's branch: an override, else a continuation root's
  * (see checkContinuation), else the profile's base.
@@ -430,17 +442,27 @@ export async function dispatchRun(options) {
     // The native gateway's executor has no coding configuration: the run is recorded
     // unresolved and the process that starts it reads and resolves (resolveDeferredCodingRun).
     const deferCoding = options.executor.defersCodingResolution === true;
+    // The repository this run works in, resolved from the agent's list before any network read. A
+    // refusal propagates: nothing has been written, and it is not a retryable conflict.
+    const previewTarget = !deferCoding && preview?.kind === "coding" && preview.codingProfile
+        ? await codingTarget(options.db, options, preview.codingProfile)
+        : undefined;
     // Only an agent allowed some service reads the repository's declaration; any
     // other coding agent never calls the host for it and gets no services.
     const declarationRead = !deferCoding &&
         preview?.kind === "coding" &&
         preview.codingProfile &&
+        previewTarget &&
         parseAllowedServiceNames(preview.codingProfile.services).length > 0
-        ? await readServiceDeclaration(options, preview.codingProfile, preview.ownerId ?? null)
+        ? await readServiceDeclaration(options, previewTarget, preview.ownerId ?? null)
         : undefined;
     // The knowledge note's input: the repository's bundle index at the run's base (a network call).
-    const knowledgeIndex = !deferCoding && preview?.kind === "coding" && preview.codingProfile && options.executor.readCodingRepositoryFile
-        ? await readKnowledgeIndex(options, preview.codingProfile, declarationRead?.branch, preview.ownerId ?? null)
+    const knowledgeIndex = !deferCoding &&
+        preview?.kind === "coding" &&
+        preview.codingProfile &&
+        previewTarget &&
+        options.executor.readCodingRepositoryFile
+        ? await readKnowledgeIndex(options, previewTarget, declarationRead?.branch, preview.ownerId ?? null)
         : undefined;
     const persistOnce = () => options.db.$transaction(async (tx) => {
         if (lockGroups)
@@ -472,11 +494,14 @@ export async function dispatchRun(options) {
         let modelFailure;
         let services = [];
         let servicesRefusal;
+        let target;
         if (agent.kind === "coding") {
             if (!agent.codingProfile)
                 throw new Error(`Coding agent "${agent.id}" has no coding profile.`);
             // An unknown coding provider is a broken profile, not a catalog state: still thrown.
             assertCodingProvider(agent.codingProfile.provider);
+            // Resolved again inside the transaction: an unlink since the preview refuses the run here.
+            target = await codingTarget(tx, options, agent.codingProfile);
             // Recorded on the run row below: the run is billed at this entry for its whole life.
             // A model the catalog cannot run (missing, disabled, or another provider's) fails
             // the run here instead of throwing: the run row commits with the reason, so the
@@ -492,8 +517,7 @@ export async function dispatchRun(options) {
                 modelFailure = err.message;
             }
             if (!modelFailure && declarationRead) {
-                if (declarationRead.repository !== agent.codingProfile.repository ||
-                    declarationRead.profileBaseRef !== agent.codingProfile.baseRef) {
+                if (declarationRead.repository !== target.repository || declarationRead.profileBaseRef !== target.baseRef) {
                     // The declaration was read for a profile that changed before this transaction.
                     throw new Error("The coding agent's repository or base branch changed during dispatch; try again.");
                 }
@@ -516,6 +540,8 @@ export async function dispatchRun(options) {
                 executionManaged: true,
                 // Fixed for the run's life: the executor routes on this, never on the agent's current setting.
                 nativeExecutionMode: agent.kind === "native" ? agent.nativeExecutionMode : null,
+                // Fixed for the run's life, like nativeExecutionMode: a later runSteps change reaches only later runs.
+                runStepsLevel: dispatchRunStepsLevel(agent),
                 parentRunId: options.parentRunId,
                 parentCallId: options.parentCallId,
                 grantedParentMemoryKeys: options.grantedParentMemoryKeys ?? [],
@@ -551,7 +577,7 @@ export async function dispatchRun(options) {
             continuesCodingRunId: options.continuesCodingRunId,
             intent: options.attribution,
         }, now);
-        if (agent.kind === "coding" && agent.codingProfile && codingBudget && !refusal) {
+        if (agent.kind === "coding" && agent.codingProfile && target && codingBudget && !refusal) {
             // Checked above too; repeated so the provider type narrows here.
             assertCodingProviderModel(agent.codingProfile.provider, agent.model);
             const request = options.codingTask ?? agent.codingProfile.defaultTask;
@@ -567,14 +593,14 @@ export async function dispatchRun(options) {
                 : composeCodingTask(agent.systemPrompt, request, servicesInstructionNote(services), knowledgeIndex ? knowledgeSection(knowledgeIndex) : undefined);
             const budgetUsd = codingBudget.budgetUsd;
             // Resolved once: before the transaction when the declaration was read from it.
-            const branch = declarationRead?.branch ?? (await resolveCodingBranch(tx, options, agent.codingProfile, agent.ownerId));
+            const branch = declarationRead?.branch ?? (await resolveCodingBranch(tx, options, target, agent.ownerId));
             const { baseRef, continuationOf, rootCodingRunId, mergeOrder: inheritedMergeOrder } = branch;
             const headRef = branch.headRef ?? `wardby/run-${run.id}`;
             const mergeOrder = resolveMergeOrder(options, inheritedMergeOrder);
             const input = CodingTaskInputSchema.parse({
                 schemaVersion: CODING_PROTOCOL_VERSION,
                 runId: run.id,
-                repository: agent.codingProfile.repository,
+                repository: target.repository,
                 baseRef,
                 headRef,
                 task,
@@ -608,6 +634,7 @@ export async function dispatchRun(options) {
                     request,
                     repository: input.repository,
                     baseRef: input.baseRef,
+                    viaRepositoryLink: target.viaRepositoryLink,
                     headRef: input.headRef,
                     provider: agent.codingProfile.provider,
                     model: input.model,
@@ -645,7 +672,8 @@ export async function dispatchRun(options) {
         else if (agent.kind !== "coding" &&
             (options.codingTask !== undefined ||
                 options.codingBaseRef !== undefined ||
-                options.continuesCodingRunId !== undefined)) {
+                options.continuesCodingRunId !== undefined ||
+                options.codingRepository !== undefined)) {
             throw new Error("Coding overrides cannot be supplied for a native agent.");
         }
         const task = options.task

package/dist/core/engine-native.d.ts

@@ -16,6 +16,8 @@ export declare class NativeEngine implements Engine {
      * without it — either way the terminal status is `budget_exhausted`.
      */
     private windDown;
+    /** Builds an event (only when ctx.onTurn is set) and hands it to ctx.onTurn. A failing hook is logged by name and never affects the run. */
+    private emitTurn;
     private finish;
     /**
      * One turn's tool calls, results in call order. The calls are split into