@wardby/cli 0.7.0 → 0.9.0

package/dist/providers/executor/container.js

@@ -3,6 +3,10 @@ import { isPackageAuditMode, mergePackageAuditReports, } from "../../coding/regi
 import { mkdir, realpath, rename, rm, writeFile } from "node:fs/promises";
 import { join, resolve, sep } from "node:path";
 import { withBaseCommit } from "../../coding/base-commit.js";
+import { mcpTokenHash, mintMcpToken } from "../../coding/mcp-token.js";
+import { isCodexCoding } from "../../core/mcp-tools.js";
+import { CODING_MCP_GATEWAY_UNAVAILABLE } from "../../core/power.js";
+import { codeProviderOf } from "../../coding/code-host.js";
 import { withPullRequestDescription } from "../../coding/pr-description-note.js";
 import { withLinkedIssue } from "../../coding/linked-issue-note.js";
 import { buildClaudeContext, MAX_RECORDED_SKIPS } from "../../coding/claude-context.js";
@@ -169,8 +173,20 @@ export class PrismaContainerExecutionStore {
         });
         if (!row?.codingRun)
             return null;
+        const link = row.codingRun.viaRepositoryLink
+            ? await this.db.agentRepository.findFirst({
+                where: {
+                    agentId: row.agentId,
+                    repository: row.codingRun.repository,
+                    access: "write",
+                    triggers: { isEmpty: true },
+                },
+                select: { authorizedVia: true },
+            })
+            : null;
         return {
             runId: row.id,
+            runStepsLevel: row.runStepsLevel,
             agentId: row.agentId,
             status: row.status,
             agentKind: row.agent.kind,
@@ -219,6 +235,9 @@ export class PrismaContainerExecutionStore {
             failureCategory: row.codingRun.failureCategory,
             profileRepository: row.agent.codingProfile?.repository ?? null,
             repositoryAuthorizedVia: row.agent.codingProfile?.repositoryAuthorizedVia ?? null,
+            viaRepositoryLink: row.codingRun.viaRepositoryLink,
+            repositoryLinkExists: link !== null,
+            repositoryLinkAuthorizedVia: link?.authorizedVia ?? null,
             pricingVersion: row.pricingVersion,
             pricingSnapshot: row.pricingSnapshot,
         };
@@ -596,9 +615,14 @@ export class PrismaContainerExecutionStore {
         return changed;
     }
 }
-/** Plain capabilities live only for the short provisioning window. */
+/**
+ * Plain capabilities live only for the short provisioning window. A run with MCP tools keeps its
+ * MCP token here too, next to the capability, so the launcher delivers it the same way; both are
+ * deleted together.
+ */
 export class RunCapabilityVault {
     values = new Map();
+    mcpTokens = new Map();
     set(runId, capability) {
         if (this.values.has(runId))
             throw new Error("coding_capability_exists");
@@ -610,8 +634,18 @@ export class RunCapabilityVault {
             throw new Error("coding_capability_unavailable");
         return capability;
     }
+    setMcpToken(runId, token) {
+        if (this.mcpTokens.has(runId))
+            throw new Error("coding_mcp_token_exists");
+        this.mcpTokens.set(runId, token);
+    }
+    /** The run's MCP token; undefined for a run without MCP tools (and once the launch is over). */
+    async mcpToken(runId) {
+        return this.mcpTokens.get(runId);
+    }
     delete(runId) {
         this.values.delete(runId);
+        this.mcpTokens.delete(runId);
     }
 }
 /** A run's deduplicated served packages and refusals (see summarizeRegistryFetches), and its package audit. */
@@ -827,6 +861,20 @@ export class ContainerExecutor {
                 if (TERMINAL_STATUSES.has(beforeSession.status))
                     throw new Error("coding_run_no_longer_active");
                 const deadlineAt = new Date(this.now().getTime() + run.timeoutSec * 1_000);
+                // The agent's MCP tools, pinned for the run; only a run with some gets a token. The token is
+                // never logged: only its hash goes to the session, the value only into the vault.
+                // A Codex run's shell commands can read the token, so it gets read-only tools only; decided by
+                // the provider the run was dispatched with, which is what jobSpec launches. A failed read fails
+                // the run with a fixed code (the cause goes to the operator log only, redacted).
+                let mcpTools;
+                try {
+                    mcpTools =
+                        (await this.options.mcpToolPins?.(run.agentId, { readOnlyOnly: isCodexCoding(run.provider) })) ?? [];
+                }
+                catch (error) {
+                    throw new Error(MCP_PINS_UNAVAILABLE_ERROR, { cause: error });
+                }
+                const mcpToken = mcpTools.length > 0 ? mintMcpToken() : undefined;
                 const session = await this.options.sessions.createSession({
                     runId,
                     credentialRef: this.credentialRef(run.provider),
@@ -835,15 +883,19 @@ export class ContainerExecutor {
                     deadlineAt,
                     budgetUsd: run.budgetUsd,
                     terms: this.modelTerms(run),
+                    ...(mcpToken ? { mcpTools, mcpTokenHash: mcpTokenHash(mcpToken) } : {}),
+                    ...(run.runStepsLevel ? { runStepsLevel: run.runStepsLevel } : {}),
                 });
                 spendEnabled = true;
                 sessionId = session.id;
                 this.options.capabilities.set(runId, session.capability);
+                if (mcpToken)
+                    this.options.capabilities.setMcpToken(runId, mcpToken);
                 const inputArtifact = await this.writeInput(run, deadlineAt, workspace);
                 const beforeLaunch = await this.requireCurrent(runId);
                 if (TERMINAL_STATUSES.has(beforeLaunch.status))
                     throw new Error("coding_run_no_longer_active");
-                const spec = this.jobSpec(run, inputArtifact);
+                const spec = this.jobSpec(run, inputArtifact, { mcpTools: Boolean(mcpToken) });
                 // Backends whose handle is derivable (Kubernetes) persist it first, so a crash between the
                 // launch and the write still leaves a handle `abandon()` can stop and remove the run with.
                 planned = this.options.jobs.plannedHandle?.(spec);
@@ -1005,13 +1057,21 @@ export class ContainerExecutor {
      * access. Throws RepoAccessError (refused before anything is cloned).
      */
     async authorizeRepository(run, opts) {
+        // Checked first: a local repository is otherwise authorized by the trusted roots alone.
+        if (run.viaRepositoryLink && !run.repositoryLinkExists)
+            throw new RepoAccessError("repo_access_not_authorized");
         const sameRepository = run.profileRepository !== null && run.profileRepository === run.repository;
+        const authorizedVia = run.viaRepositoryLink
+            ? run.repositoryLinkAuthorizedVia
+            : sameRepository
+                ? run.repositoryAuthorizedVia
+                : "host_permission";
         const decision = await this.options.repoAccess.authorizeUse({
             ownerId: run.ownerId,
-            provider: "github",
+            provider: codeProviderOf(run.repository),
             repository: run.repository,
             required: requiredLevel("coding"),
-            authorizedVia: sameRepository ? run.repositoryAuthorizedVia : "host_permission",
+            authorizedVia,
             retryTransient: opts.inFlight,
         });
         if (!decision.ok)
@@ -1510,7 +1570,8 @@ export class ContainerExecutor {
             status.number > 0) {
             candidates.push({ provider: "github", repository: run.repository, number: status.number });
         }
-        const closed = closingIssueNumber(description, run.repository);
+        // The closing keyword names a GitHub issue: no other host's repository has one to read.
+        const closed = codeProviderOf(run.repository) === "github" ? closingIssueNumber(description, run.repository) : undefined;
         if (closed !== undefined && !candidates.some((ref) => ref.provider === "github" && ref.number === closed)) {
             candidates.push({ provider: "github", repository: run.repository, number: closed });
         }
@@ -1724,7 +1785,8 @@ export class ContainerExecutor {
             if (!workspace)
                 throw new Error("coding_workspace_lost");
             // The same in-flight access check a push gets: a revoked owner's run edits nothing.
-            await this.authorizeRepository(run, { inFlight: true });
+            // Reloaded: the snapshot passed in predates the description reads above, and a link removed since then counts.
+            await this.authorizeRepository(await this.requireCurrent(run.runId), { inFlight: true });
             const details = {
                 summary: output.summary,
                 tests: output.tests,
@@ -1990,7 +2052,7 @@ export class ContainerExecutor {
         this.emit({ stage: "queued", runId: run.runId });
         return false;
     }
-    jobSpec(run, inputArtifact) {
+    jobSpec(run, inputArtifact, options = {}) {
         const provider = run.provider === "claude-code" ? "claude-code" : "codex";
         if (provider === "claude-code" && (!run.workerImage || !this.options.claudeToolRunnerImage)) {
             throw new Error("coding_provider_not_configured:claude-code");
@@ -2019,6 +2081,8 @@ export class ContainerExecutor {
             ...(run.dependencyCache ? { dependencyCache: true } : {}),
             // Claude Code only: the launcher gives the SDK's config dir, where the session grows, its own scratch.
             ...(run.sessionResume && provider === "claude-code" ? { sessionResume: true } : {}),
+            // Only for a run with MCP tools: the launcher then delivers WARDBY_MCP_TOKEN from the vault.
+            ...(options.mcpTools ? { mcpTools: true } : {}),
             timeoutSec: run.timeoutSec,
             limits: { ...this.options.limits, ...(run.workspaceDiskMb ? { diskMb: run.workspaceDiskMb } : {}) },
             labels: {},
@@ -2420,13 +2484,19 @@ function safeError(error) {
     const message = error instanceof Error ? error.message : "unknown";
     return `coding_executor:${redactAndTruncate(message, 200).replace(/[^A-Za-z0-9_.:-]/g, "_")}`;
 }
+/** The agent's MCP tool pins could not be read at launch (a database error): the run fails, nothing launched. */
+export const MCP_PINS_UNAVAILABLE_ERROR = "coding_mcp_pins_unavailable";
+/** Its category: the run's error is coding_failure_mcp_pins_unavailable:<diagnostic id>. */
+export const MCP_PINS_UNAVAILABLE_CATEGORY = "mcp_pins_unavailable";
+/** Low-power mode: the native gateway serving a run's MCP tools did not wake; nothing launched. */
+export const MCP_GATEWAY_UNAVAILABLE_CATEGORY = "mcp_gateway_unavailable";
 /**
  * Error-code prefixes that name their category outright, checked before the
  * substring heuristics below. Those heuristics filed every `github_*` error
  * (a failed PR lookup or create after the push, a token mint) under
  * "workspace" because "github" contains "git".
  */
-const CATEGORY_BY_PREFIX = [
+export const CATEGORY_BY_PREFIX = [
     // Claude Code reached the agent's turn limit (codingProfile.maxTurns) before finishing.
     ["job_coding_turn_limit", "turn_limit"],
     // A service sidecar never became ready (src/providers/jobs/kubernetes.ts).
@@ -2453,7 +2523,13 @@ const CATEGORY_BY_PREFIX = [
     ["coding_provider_not_configured", "preflight"],
     // A GitHub repository on a server with no GitHub App: configuration, like an unsupported service.
     ["vcs_github_not_configured", "preflight"],
+    // The same for any other host: a repository whose provider this server has not registered.
+    ["vcs_host_provider_not_configured", "preflight"],
     ["vcs_", "workspace"],
+    // The agent's MCP tool pins could not be read at launch: nothing was launched.
+    [MCP_PINS_UNAVAILABLE_ERROR, MCP_PINS_UNAVAILABLE_CATEGORY],
+    // Low-power mode: the native gateway serving the run's MCP tools did not wake (jobs/kubernetes.ts).
+    [CODING_MCP_GATEWAY_UNAVAILABLE, MCP_GATEWAY_UNAVAILABLE_CATEGORY],
     // Local repositories (LocalRepoError codes): the same family as the vcs_ errors.
     ["local_", "workspace"],
     ["git_", "workspace"],

package/dist/providers/host-tools/invoke.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Runs one approved snapshot of a bound tool with a restricted privileged host: fetch
+ * reaches the provider's API hosts inside this call's repository, using the operation's
+ * methods, with no redirects followed and only plain content headers, and the only secret alias is `host`. Datastores and readable secrets are
+ * absent, and console output is dropped. Never throws: every failure is a fixed code,
+ * so no tool text reaches a model, a run record or a published comment.
+ */
+import type { SandboxLimits } from "../../sandbox/eval-core.js";
+import { safeFetch } from "../../sandbox/safe-fetch.js";
+import type { SecretEntry } from "../../core/secrets.js";
+import { type HostOperation, type HostToolDeclineCode } from "./operations.js";
+export declare const HOST_SECRET_ALIAS = "host";
+export type HostToolErrorCode = "host_tool_failed" | "host_tool_timeout" | "host_tool_invalid_result" | "host_tool_invalid_params" | "host_tool_request_denied" | "host_tool_no_credential" | `host_${HostToolDeclineCode}`;
+export type HostToolResult = {
+    ok: true;
+    value: unknown;
+} | {
+    ok: false;
+    code: HostToolErrorCode;
+};
+export interface HostToolInvocation {
+    provider: string;
+    operation: HostOperation;
+    snapshot: {
+        code: string;
+        paramsZod: string;
+    };
+    params: Record<string, unknown>;
+    apiHosts: readonly string[];
+    pathPrefix: string;
+    credential: () => Promise<SecretEntry | undefined>;
+    fetchImpl?: typeof safeFetch;
+    limits?: Partial<SandboxLimits>;
+    /** The approved snapshot's time limit (effectiveToolTimeoutMs); absent = the default. */
+    timeoutMs?: number;
+}
+export declare function invokeHostTool(input: HostToolInvocation): Promise<HostToolResult>;

package/dist/providers/host-tools/invoke.js

@@ -0,0 +1,117 @@
+import { createPrivilegedHost } from "../../sandbox/host-functions.js";
+import { runToolCode, toolLimits } from "../../sandbox/run-in-sandbox.js";
+import { fetchTimeoutFor } from "../../sandbox/tool-timeout.js";
+import { WALL_TIME_LIMIT_MS } from "../../sandbox/limits.js";
+import { safeFetch } from "../../sandbox/safe-fetch.js";
+import { validateParams } from "../../sandbox/zod-params.js";
+import { HOST_OPERATIONS, HOST_TOOL_DECLINE_CODES, } from "./operations.js";
+import { assertHostToolHeaders, assertHostToolRequest, HostToolRequestDenied, MAX_HOST_TOOL_FETCHES, } from "./request-guard.js";
+export const HOST_SECRET_ALIAS = "host";
+const absent = async () => {
+    throw new Error("host_tool_capability_absent");
+};
+export async function invokeHostTool(input) {
+    const definition = HOST_OPERATIONS[input.operation];
+    const failures = { denied: false, noCredential: false };
+    const validated = await validateParams(input.snapshot.paramsZod, input.params);
+    if (!validated.ok)
+        return { ok: false, code: "host_tool_invalid_params" };
+    const privileged = (signal) => {
+        const inner = createPrivilegedHost({
+            agentId: `host-provider:${input.provider}`,
+            // Never reached: every bridge that would use them is `absent` below.
+            datastore: {},
+            sharedDatastore: {},
+            logTag: `host-tool:${input.operation}`,
+            allowedFetchHosts: [...input.apiHosts],
+            // Redirects are never followed here: a later hop would skip the guard, so the tool re-fetches through it.
+            fetchImpl: (u, i, o) => (input.fetchImpl ?? safeFetch)(u, i, { ...o, followRedirects: false }),
+            signal,
+            fetchTimeoutMs: fetchTimeoutFor(input.timeoutMs ?? input.limits?.wallTimeLimitMs ?? WALL_TIME_LIMIT_MS),
+            secrets: {
+                get: async () => undefined,
+                resolve: async (name) => {
+                    if (name !== HOST_SECRET_ALIAS)
+                        return undefined;
+                    let entry;
+                    try {
+                        entry = await input.credential();
+                    }
+                    catch {
+                        entry = undefined;
+                    }
+                    // A thrown or partial credential must not carry its text into tool code. Registering
+                    // checks the hosts, but a broker config can be narrowed afterwards.
+                    if (!entry || !entry.broker || input.apiHosts.some((h) => !entry.broker.hosts.includes(h))) {
+                        failures.noCredential = true;
+                        throw new Error("host_tool_no_credential");
+                    }
+                    return entry;
+                },
+            },
+        });
+        let fetches = 0;
+        return {
+            __bridge_console: async () => null,
+            __bridge_fetch: async (argsJson) => {
+                try {
+                    const [url, init, secretNames] = JSON.parse(argsJson);
+                    if (++fetches > MAX_HOST_TOOL_FETCHES)
+                        throw new HostToolRequestDenied();
+                    if (secretNames !== undefined &&
+                        !(Array.isArray(secretNames) && secretNames.every((n) => n === HOST_SECRET_ALIAS))) {
+                        throw new HostToolRequestDenied();
+                    }
+                    assertHostToolHeaders(init?.headers);
+                    assertHostToolRequest(url, init?.method ?? "GET", {
+                        apiHosts: input.apiHosts,
+                        pathPrefix: input.pathPrefix,
+                        methods: definition.methods,
+                    });
+                }
+                catch (err) {
+                    failures.denied = true;
+                    throw err;
+                }
+                return inner.__bridge_fetch(argsJson);
+            },
+            __bridge_datastoreGet: absent,
+            __bridge_datastoreSet: absent,
+            __bridge_datastoreDelete: absent,
+            __bridge_datastoreList: absent,
+            __bridge_sharedDatastoreGet: absent,
+            __bridge_sharedDatastoreSet: absent,
+            __bridge_sharedDatastoreDelete: absent,
+            __bridge_sharedDatastoreList: absent,
+            __bridge_secretsGet: absent,
+        };
+    };
+    const result = await runToolCode({
+        code: input.snapshot.code,
+        params: validated.value,
+        limits: toolLimits(input.timeoutMs, input.limits),
+        privileged,
+    });
+    // Checked first: a tool that catches a refusal must not turn it into a success.
+    if (failures.denied)
+        return { ok: false, code: "host_tool_request_denied" };
+    if (failures.noCredential)
+        return { ok: false, code: "host_tool_no_credential" };
+    if (!result.ok) {
+        return {
+            ok: false,
+            code: result.errorKind === "timeout" || result.errorKind === "cpu" ? "host_tool_timeout" : "host_tool_failed",
+        };
+    }
+    const decline = declineOf(result.value);
+    if (decline)
+        return { ok: false, code: `host_${decline}` };
+    const parsed = definition.result.safeParse(result.value);
+    return parsed.success ? { ok: true, value: parsed.data } : { ok: false, code: "host_tool_invalid_result" };
+}
+function declineOf(value) {
+    if (typeof value !== "object" || value === null || !("error" in value))
+        return null;
+    const { error } = value;
+    return HOST_TOOL_DECLINE_CODES.includes(error) ? error : null;
+}

package/dist/providers/host-tools/operations.d.ts

@@ -0,0 +1,65 @@
+/**
+ * The contract between Wardby and a host provider's bound tools. A bound tool makes
+ * one host operation; paging, markers, safeguards and wording stay in Wardby. Wardby
+ * calls each tool with `{ workspace, repo, repository, ...operation fields }`.
+ *
+ * A tool answers with its operation's result, or `{ error: <decline code> }` when the
+ * host refused. Results are untrusted and validated here, and a tool's own text never
+ * reaches a model, a run record or a comment.
+ */
+import { z } from "zod";
+export declare const HOST_TOOL_CONTRACT_VERSION = 1;
+/** What a tool may say about a host refusal: fixed words, so no tool text passes through. */
+export declare const HOST_TOOL_DECLINE_CODES: readonly ["unauthorized", "forbidden", "not_found", "conflict", "rate_limited", "unavailable"];
+export type HostToolDeclineCode = (typeof HOST_TOOL_DECLINE_CODES)[number];
+type OperationDef = {
+    /** The HTTP methods this operation's requests may use. */
+    methods: readonly string[];
+    /** Changes nothing on the host: test_host_provider may call it. */
+    readOnly: boolean;
+    /** Which credential its `host` alias resolves to. */
+    credential: "repository" | "permission" | "none";
+    result: z.ZodType;
+};
+export declare const HOST_OPERATIONS: {
+    readonly getPullRequest: OperationDef;
+    readonly listPullRequestFiles: OperationDef;
+    readonly getDiff: OperationDef;
+    readonly findPullRequest: OperationDef;
+    readonly readFile: OperationDef;
+    readonly listFiles: OperationDef;
+    readonly listComments: OperationDef;
+    readonly listCommitStatuses: OperationDef;
+    readonly getRepositoryPermission: {
+        readonly methods: readonly ["GET"];
+        readonly readOnly: true;
+        readonly credential: "permission";
+        readonly result: z.ZodObject<{
+            permission: z.ZodEnum<{
+                read: "read";
+                write: "write";
+                none: "none";
+                triage: "triage";
+                maintain: "maintain";
+                admin: "admin";
+            }>;
+        }, z.core.$strict>;
+    };
+    readonly openPullRequest: OperationDef;
+    readonly updatePullRequest: OperationDef;
+    readonly createComment: OperationDef;
+    readonly editComment: OperationDef;
+    readonly resolveThread: OperationDef;
+    readonly submitVerdict: OperationDef;
+    readonly setCommitStatus: OperationDef;
+    readonly normalizeEvent: {
+        readonly methods: readonly [];
+        readonly readOnly: false;
+        readonly credential: "none";
+        readonly result: z.ZodUnknown;
+    };
+};
+export type HostOperation = keyof typeof HOST_OPERATIONS;
+export declare const REQUIRED_OPERATIONS: readonly HostOperation[];
+export declare function isHostOperation(name: string): name is HostOperation;
+export {};

package/dist/providers/host-tools/operations.js

@@ -0,0 +1,149 @@
+/**
+ * The contract between Wardby and a host provider's bound tools. A bound tool makes
+ * one host operation; paging, markers, safeguards and wording stay in Wardby. Wardby
+ * calls each tool with `{ workspace, repo, repository, ...operation fields }`.
+ *
+ * A tool answers with its operation's result, or `{ error: <decline code> }` when the
+ * host refused. Results are untrusted and validated here, and a tool's own text never
+ * reaches a model, a run record or a comment.
+ */
+import { z } from "zod";
+export const HOST_TOOL_CONTRACT_VERSION = 1;
+/** What a tool may say about a host refusal: fixed words, so no tool text passes through. */
+export const HOST_TOOL_DECLINE_CODES = [
+    "unauthorized",
+    "forbidden",
+    "not_found",
+    "conflict",
+    "rate_limited",
+    "unavailable",
+];
+// What a paged operation returns; its tool takes the last one back as the optional `page` input.
+const page = z.string().nullable();
+const pullRequest = z
+    .object({
+    number: z.number().int().positive(),
+    title: z.string(),
+    body: z.string(),
+    author: z.string().nullable(),
+    // A merged pull request is "closed" with `merged` set: consumers compare state to "open".
+    state: z.enum(["open", "closed"]),
+    merged: z.boolean(),
+    draft: z.boolean(),
+    baseRef: z.string(),
+    headRef: z.string(),
+    headSha: z.string().min(1),
+    isFork: z.boolean(),
+    htmlUrl: z.string().url(),
+})
+    .strict();
+const written = z.object({ id: z.string().min(1) }).strict();
+const read = (result) => ({
+    methods: ["GET"],
+    readOnly: true,
+    credential: "repository",
+    result,
+});
+const write = (methods, result) => ({
+    methods,
+    readOnly: false,
+    credential: "repository",
+    result,
+});
+export const HOST_OPERATIONS = {
+    getPullRequest: read(pullRequest),
+    listPullRequestFiles: read(z
+        .object({
+        files: z.array(z
+            .object({
+            filename: z.string(),
+            status: z.string(),
+            additions: z.number().int().nonnegative(),
+            deletions: z.number().int().nonnegative(),
+            previousFilename: z.string().optional(),
+        })
+            .strict()),
+        nextPage: page,
+    })
+        .strict()),
+    getDiff: read(z.object({ diff: z.string() }).strict()),
+    findPullRequest: read(z.object({ pullRequest: pullRequest.nullable() }).strict()),
+    readFile: read(z.discriminatedUnion("kind", [
+        z.object({ kind: z.literal("file"), content: z.string() }).strict(),
+        z.object({ kind: z.literal("directory") }).strict(),
+        z.object({ kind: z.literal("not_found") }).strict(),
+    ])),
+    listFiles: read(z
+        .object({
+        entries: z.array(z
+            .object({
+            path: z.string(),
+            type: z.enum(["file", "directory"]),
+            size: z.number().int().nonnegative().optional(),
+        })
+            .strict()),
+        nextPage: page,
+    })
+        .strict()),
+    listComments: read(z
+        .object({
+        comments: z.array(z
+            .object({
+            id: z.string().min(1),
+            author: z.string().nullable(),
+            authorId: z.string().nullable(),
+            body: z.string(),
+            createdAt: z.string(),
+            path: z.string().nullable(),
+            line: z.number().int().positive().nullable(),
+            parentId: z.string().nullable(),
+            resolved: z.boolean(),
+        })
+            .strict()),
+        nextPage: page,
+    })
+        .strict()),
+    listCommitStatuses: read(z
+        .object({
+        statuses: z.array(z
+            .object({
+            key: z.string(),
+            state: z.enum(["pending", "success", "failure", "stopped"]),
+            url: z.string().nullable(),
+        })
+            .strict()),
+        nextPage: page,
+    })
+        .strict()),
+    getRepositoryPermission: {
+        methods: ["GET"],
+        readOnly: true,
+        credential: "permission",
+        result: z.object({ permission: z.enum(["none", "read", "triage", "write", "maintain", "admin"]) }).strict(),
+    },
+    openPullRequest: write(["POST"], pullRequest),
+    updatePullRequest: write(["PUT"], pullRequest),
+    createComment: write(["POST"], written),
+    editComment: write(["PUT"], written),
+    resolveThread: write(["POST"], z.object({}).strict()),
+    submitVerdict: write(["POST"], z.object({}).strict()),
+    setCommitStatus: write(["POST"], z.object({}).strict()),
+    // PR 5 gives this its HostEvent schema. Nothing calls it before then.
+    normalizeEvent: { methods: [], readOnly: false, credential: "none", result: z.unknown() },
+};
+export const REQUIRED_OPERATIONS = [
+    "getPullRequest",
+    "listPullRequestFiles",
+    "getDiff",
+    "readFile",
+    "listFiles",
+    "listComments",
+    "createComment",
+    "submitVerdict",
+    "findPullRequest",
+    "openPullRequest",
+    "updatePullRequest",
+];
+export function isHostOperation(name) {
+    return Object.hasOwn(HOST_OPERATIONS, name);
+}

package/dist/providers/host-tools/registry.d.ts

@@ -0,0 +1,79 @@
+import { z } from "zod";
+import type { PrismaClient } from "#prisma";
+import type { SecretCipher } from "../secrets/types.js";
+export type HostProviderErrorCode = "host_provider_not_found" | "host_provider_missing_operation" | "host_provider_tool_not_found" | "host_provider_secret_not_found" | "host_provider_secret_not_brokered" | "host_provider_secret_hosts" | "host_provider_secret_placement" | "host_provider_webhook_secret_shared" | "host_provider_webhook_secret_short" | "host_provider_permission_secret_shared" | "host_provider_username_is_secret" | "host_provider_in_use" | "host_provider_operation_not_bound" | "host_provider_tool_deleted";
+export declare class HostProviderError extends Error {
+    readonly code: HostProviderErrorCode;
+    readonly detail: string;
+    constructor(code: HostProviderErrorCode, detail: string);
+}
+export declare const RegisterHostProviderSchema: z.ZodObject<{
+    provider: z.ZodString;
+    gitHost: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    apiHosts: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+    gitUsername: z.ZodString;
+    pullRequestUrlTemplate: z.ZodString;
+    repositoryApiPath: z.ZodString;
+    permissionApiPath: z.ZodOptional<z.ZodString>;
+    webhook: z.ZodObject<{
+        header: z.ZodString;
+        algorithm: z.ZodLiteral<"sha256">;
+        deliveryHeader: z.ZodString;
+        eventHeader: z.ZodString;
+        secret: z.ZodString;
+    }, z.core.$strict>;
+    credentials: z.ZodArray<z.ZodObject<{
+        repositories: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+        secret: z.ZodString;
+    }, z.core.$strict>>;
+    permissionCredential: z.ZodOptional<z.ZodString>;
+    trustedAccounts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    tools: z.ZodRecord<z.ZodString, z.ZodString>;
+}, z.core.$strict>;
+export type RegisterHostProviderInput = z.infer<typeof RegisterHostProviderSchema>;
+export declare function findCredential<T extends {
+    repositoryPattern: string;
+}>(credentials: readonly T[], repositoryPath: string): T | null;
+export interface OperationView {
+    operation: string;
+    toolName: string | null;
+    status: "approved" | "changed" | "tool_deleted";
+    approvedAt: Date;
+    approvedById: string;
+    approvedSha256: string;
+    currentSha256: string | null;
+    /** The approved snapshot's time limit (null: the default), and the tool's now; a change waits for approval. */
+    approvedTimeoutMs: number | null;
+    currentTimeoutMs: number | null;
+    approvedCode?: string;
+    approvedParamsZod?: string;
+    currentCode?: string;
+    currentParamsZod?: string;
+}
+export interface HostProviderView {
+    provider: string;
+    contractVersion: number;
+    gitHost: string;
+    apiHosts: string[];
+    gitUsername: string;
+    pullRequestUrlTemplate: string;
+    repositoryApiPath: string;
+    permissionApiPath: string | null;
+    mode: "permission" | "allowlist";
+    webhook: unknown;
+    webhookSecret: string;
+    permissionSecret: string | null;
+    credentials: {
+        repositories: string;
+        secret: string;
+        kind: string;
+    }[];
+    trustedAccounts: string[];
+    operations: OperationView[];
+}
+export declare function registerHostProvider(db: PrismaClient, cipher: SecretCipher, principalId: string, input: RegisterHostProviderInput): Promise<HostProviderView>;
+export declare function approveHostProviderTools(db: PrismaClient, principalId: string, provider: string, operations: readonly string[]): Promise<HostProviderView>;
+export declare function getHostProviderView(db: PrismaClient, provider: string, options?: {
+    includeCode?: boolean;
+}): Promise<HostProviderView | null>;
+export declare function deleteHostProvider(db: PrismaClient, provider: string): Promise<void>;