@wardby/cli 0.7.0 → 0.9.0

package/dist/providers/host-tools/self-test.js

@@ -0,0 +1,142 @@
+import { codeProviderOf, normalizeHostedRepository } from "../../coding/code-host.js";
+import { loadTestSimulators, simulatorHostFetch } from "../../config/test-simulators.js";
+import { parseSecretBrokerConfig } from "../../core/secret-broker-config.js";
+import { safeFetch } from "../../sandbox/safe-fetch.js";
+import { invokeHostTool } from "./invoke.js";
+import { HOST_OPERATIONS, isHostOperation } from "./operations.js";
+import { findCredential } from "./registry.js";
+import { effectiveToolTimeoutMs } from "../../sandbox/tool-timeout.js";
+import { loadToolMaxTimeoutMs } from "../../config/tool-timeout.js";
+/**
+ * The fetch for bound tools: the real one, or under WARDBY_TEST_SIMULATORS the simulator's. Under
+ * the switch only `sim-` credentials are sent, as the switch refuses every other real credential.
+ */
+export function hostToolFetch(env = process.env) {
+    const simulators = loadTestSimulators(env);
+    return simulators ? { fetchImpl: simulatorHostFetch(simulators, safeFetch), simulated: true } : { simulated: false };
+}
+export async function loadProviderForCalls(db, name) {
+    const row = await db.hostProvider.findUnique({
+        where: { name },
+        include: { permissionSecret: true, credentials: { include: { secret: true } }, operations: true },
+    });
+    if (!row)
+        return null;
+    return {
+        name: row.name,
+        apiHosts: row.apiHosts,
+        repositoryApiPath: row.repositoryApiPath,
+        permissionApiPath: row.permissionApiPath,
+        permissionSecret: row.permissionSecret,
+        credentials: row.credentials,
+        operations: row.operations,
+    };
+}
+// No URL-encoding: callHostOperation only takes a repository in its normalized form, which admits only [A-Za-z0-9._-], and the request guard compares a raw prefix.
+function encodePath(template, fields) {
+    return template.replace(/\{([a-z]+)\}/g, (_m, field) => fields[field]);
+}
+/** The repository is compared in its normalized form, so callers must pass one. */
+export async function callHostOperation(provider, cipher, repository, operation, fields, options = {}) {
+    let ours = false;
+    try {
+        ours = normalizeHostedRepository(repository) === repository && codeProviderOf(repository) === provider.name;
+    }
+    catch {
+        // Not a repository we can name: denied below.
+    }
+    if (!ours)
+        return { ok: false, code: "host_tool_request_denied" };
+    const snapshot = provider.operations.find((o) => o.operation === operation);
+    if (!snapshot)
+        return { ok: false, code: "host_tool_failed" };
+    const path = repository.slice(`${provider.name}:`.length);
+    const [workspace, repo] = path.split("/");
+    const permission = HOST_OPERATIONS[operation].credential === "permission";
+    const stored = permission ? provider.permissionSecret : (findCredential(provider.credentials, path)?.secret ?? null);
+    const template = permission ? provider.permissionApiPath : provider.repositoryApiPath;
+    if (!stored || !template)
+        return { ok: false, code: "host_tool_no_credential" };
+    const credential = async () => {
+        const value = await cipher.decrypt(stored.ciphertext);
+        if (options.simulated && !value.startsWith("sim-"))
+            return undefined;
+        return { value, broker: parseSecretBrokerConfig(stored.broker) };
+    };
+    return invokeHostTool({
+        provider: provider.name,
+        operation,
+        snapshot,
+        params: { ...fields, workspace, repo, repository: path },
+        apiHosts: provider.apiHosts,
+        pathPrefix: encodePath(template, { repository: path, workspace, repo }),
+        credential,
+        fetchImpl: options.fetchImpl,
+        timeoutMs: effectiveToolTimeoutMs(snapshot.timeoutMs, loadToolMaxTimeoutMs()),
+    });
+}
+export async function selfTestHostProvider(provider, cipher, input, options = {}) {
+    const repository = normalizeHostedRepository(input.repository);
+    if (codeProviderOf(repository) !== provider.name)
+        throw new Error("host_provider_repository_mismatch");
+    const results = [];
+    const skip = (operation, code) => results.push({ operation, outcome: "skipped", code });
+    const check = async (operation, fields) => {
+        const result = await callHostOperation(provider, cipher, repository, operation, fields, options);
+        results.push(result.ok ? { operation, outcome: "pass" } : { operation, outcome: "fail", code: result.code });
+        return result;
+    };
+    const bound = (name) => provider.operations.some((o) => o.operation === name);
+    // The pull request comes first: its head is the ref for the checks that need one.
+    let ref = input.ref;
+    const number = input.pullRequest;
+    if (!bound("getPullRequest"))
+        skip("getPullRequest", "not_bound");
+    else if (number === undefined)
+        skip("getPullRequest", "needs_pull_request");
+    else {
+        const pr = await check("getPullRequest", { number });
+        if (pr.ok)
+            ref ??= pr.value.headSha;
+    }
+    for (const operation of ["listPullRequestFiles", "getDiff", "listComments"]) {
+        if (!bound(operation))
+            skip(operation, "not_bound");
+        else if (number === undefined)
+            skip(operation, "needs_pull_request");
+        else
+            await check(operation, { number });
+    }
+    if (!bound("findPullRequest"))
+        skip("findPullRequest", "not_bound");
+    else if (input.headRef === undefined)
+        skip("findPullRequest", "needs_head_ref");
+    else
+        await check("findPullRequest", { headRef: input.headRef });
+    for (const [operation, fields] of [
+        ["readFile", { path: "README.md" }],
+        ["listFiles", { path: "" }],
+        ["listCommitStatuses", {}],
+    ]) {
+        if (!bound(operation))
+            skip(operation, "not_bound");
+        else if (ref === undefined)
+            skip(operation, "needs_ref");
+        else
+            await check(operation, { ref, ...fields });
+    }
+    const mode = provider.permissionSecret ? "permission" : "allowlist";
+    if (mode === "allowlist")
+        skip("getRepositoryPermission", "allowlist_mode");
+    else if (!bound("getRepositoryPermission"))
+        skip("getRepositoryPermission", "not_bound");
+    else if (input.accountId === undefined)
+        skip("getRepositoryPermission", "needs_account");
+    else
+        await check("getRepositoryPermission", { accountId: input.accountId });
+    for (const { operation } of provider.operations) {
+        if (isHostOperation(operation) && !HOST_OPERATIONS[operation].readOnly)
+            skip(operation, "not_read_only");
+    }
+    return { provider: provider.name, repository, mode, results };
+}

package/dist/providers/jobs/docker-isolation.d.ts

@@ -214,6 +214,6 @@ export declare function assertStorageVolumeInspection(volume: DockerVolumeInspec
 export declare function assertKeeperContainerInspection(container: DockerContainerInspection, spec: JobSpec): void;
 export declare function assertNetworkKeeperContainerInspection(container: DockerContainerInspection, spec: JobSpec): void;
 export declare function assertProxyContainerInspection(container: DockerContainerInspection, runId: string): void;
-export declare function assertWorkerContainerInspection(container: DockerContainerInspection, spec: JobSpec, expectedCapability: string, networkKeeperId?: string): void;
-export declare function assertClaudeAgentContainerInspection(container: DockerContainerInspection, spec: JobSpec, expectedCapability: string): void;
+export declare function assertWorkerContainerInspection(container: DockerContainerInspection, spec: JobSpec, expectedCapability: string, networkKeeperId?: string, expectedMcpToken?: string): void;
+export declare function assertClaudeAgentContainerInspection(container: DockerContainerInspection, spec: JobSpec, expectedCapability: string, expectedMcpToken?: string): void;
 export declare function assertClaudeToolRunnerContainerInspection(container: DockerContainerInspection, spec: JobSpec, expectedSetup: string, networkKeeperId?: string): void;

package/dist/providers/jobs/docker-isolation.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { MCP_TOKEN_ENV } from "../../coding/mcp-token.js";
 export const CODING_WORKER_UID = 10001;
 export const CODING_WORKER_GID = 10001;
 // The keeper needs headroom for runc's short-lived exec process plus Node's threads.
@@ -101,6 +102,8 @@ function validateSpec(spec) {
     if (spec.sessionResume !== undefined && (spec.sessionResume !== true || spec.provider !== "claude-code")) {
         throw isolationError();
     }
+    if (spec.mcpTools !== undefined && spec.mcpTools !== true)
+        throw isolationError();
     if (spec.services !== undefined) {
         // docker-services.ts re-validates every entry against the catalog schema. Both providers' shells
         // share the network keeper's namespace: Codex's worker, and Claude Code's tool runner.
@@ -306,6 +309,27 @@ function workerNetworkMode(spec) {
     const names = isolationNames(spec.runId);
     return spec.services === undefined ? names.network : `container:${names.networkKeeperContainer}`;
 }
+/**
+ * A run with MCP tools only: the agent's MCP token, by name. Like the capability, its value comes
+ * from the docker process's own environment (DockerCommandOptions.env), never the command line.
+ */
+function mcpTokenEnvArgs(spec) {
+    return spec.mcpTools ? ["--env", MCP_TOKEN_ENV] : [];
+}
+/**
+ * The agent container's exact WARDBY_ environment: the proxy URL, the capability, and for a run with
+ * MCP tools its MCP token. Anything missing, changed or extra fails the attestation.
+ */
+function agentEnvironmentMatches(environment, spec, expectedCapability, expectedMcpToken) {
+    if (spec.mcpTools && expectedMcpToken === undefined)
+        return false;
+    const expected = [
+        `WARDBY_PROXY_URL=http://${CODING_PROXY_ALIAS}:${CODING_PROXY_PORT}`,
+        `WARDBY_RUN_CAPABILITY=${expectedCapability}`,
+        ...(spec.mcpTools ? [`${MCP_TOKEN_ENV}=${expectedMcpToken}`] : []),
+    ];
+    return environment.length === expected.length && expected.every((value) => environment.includes(value));
+}
 export function buildWorkerCreateArgs(spec, proxyPort = CODING_PROXY_PORT) {
     validateSpec(spec);
     assertIntegerRange(proxyPort, 1, 65_535);
@@ -360,6 +384,7 @@ export function buildWorkerCreateArgs(spec, proxyPort = CODING_PROXY_PORT) {
         `WARDBY_PROXY_URL=http://${CODING_PROXY_ALIAS}:${proxyPort}`,
         "--env",
         "WARDBY_RUN_CAPABILITY",
+        ...mcpTokenEnvArgs(spec),
         "--restart",
         "no",
         "--stop-signal",
@@ -459,6 +484,7 @@ export function buildClaudeAgentCreateArgs(spec, proxyPort = CODING_PROXY_PORT)
         `WARDBY_PROXY_URL=http://${CODING_PROXY_ALIAS}:${proxyPort}`,
         "--env",
         "WARDBY_RUN_CAPABILITY",
+        ...mcpTokenEnvArgs(spec),
         "--restart",
         "no",
         "--stop-signal",
@@ -780,7 +806,7 @@ function assertExactWorkerMounts(container, names) {
         }
     }
 }
-export function assertWorkerContainerInspection(container, spec, expectedCapability, networkKeeperId) {
+export function assertWorkerContainerInspection(container, spec, expectedCapability, networkKeeperId, expectedMcpToken) {
     validateSpec(spec);
     const names = isolationNames(spec.runId);
     const host = container.HostConfig;
@@ -822,9 +848,7 @@ export function assertWorkerContainerInspection(container, spec, expectedCapabil
         Object.keys(container.NetworkSettings?.Ports ?? {}).length !== 0) {
         throw isolationError();
     }
-    if (wardbyEnvironment.length !== 2 ||
-        !wardbyEnvironment.includes(`WARDBY_PROXY_URL=http://${CODING_PROXY_ALIAS}:${CODING_PROXY_PORT}`) ||
-        !wardbyEnvironment.includes(`WARDBY_RUN_CAPABILITY=${expectedCapability}`)) {
+    if (!agentEnvironmentMatches(wardbyEnvironment, spec, expectedCapability, expectedMcpToken)) {
         throw isolationError();
     }
     const tmpfs = host.Tmpfs ?? {};
@@ -893,16 +917,14 @@ function assertClaudeContainerBaseline(container, image, spec, limits) {
         !host.Tmpfs?.["/home/wardby"]?.includes("noexec"))
         throw isolationError();
 }
-export function assertClaudeAgentContainerInspection(container, spec, expectedCapability) {
+export function assertClaudeAgentContainerInspection(container, spec, expectedCapability, expectedMcpToken) {
     validateSpec(spec);
     if (spec.provider !== "claude-code")
         throw isolationError();
     const names = isolationNames(spec.runId);
     assertClaudeContainerBaseline(container, spec.image, spec, claudeAgentLimits(spec));
     const environment = (container.Config?.Env ?? []).filter((value) => value.startsWith("WARDBY_"));
-    if (environment.length !== 2 ||
-        !environment.includes(`WARDBY_PROXY_URL=http://${CODING_PROXY_ALIAS}:${CODING_PROXY_PORT}`) ||
-        !environment.includes(`WARDBY_RUN_CAPABILITY=${expectedCapability}`))
+    if (!agentEnvironmentMatches(environment, spec, expectedCapability, expectedMcpToken))
         throw isolationError();
     assertExactMountSet(container, names, [
         { path: WORKER_PATHS.input, writable: false, subpath: "input" },

package/dist/providers/jobs/docker.d.ts

@@ -88,6 +88,12 @@ export interface DockerJobLauncherOptions {
     workspaceRoot: string;
     proxyContainer: string;
     resolveCapability: (runId: string) => Promise<string>;
+    /**
+     * The run's MCP token (the capability vault), asked for only when the spec has mcpTools; the agent
+     * container gets it as WARDBY_MCP_TOKEN, through the docker process's environment like the
+     * capability. Absent = a run with MCP tools can't be launched.
+     */
+    resolveMcpToken?: (runId: string) => Promise<string | undefined>;
     /** Consult the durable application state before a startup sweep deletes resources. */
     isRunActive: (runId: string, handle: JobHandle) => Promise<boolean>;
     docker?: DockerCommandRunner;
@@ -131,6 +137,8 @@ export declare class DockerJobLauncher implements WorkspaceJobLauncher {
     remove(handle: JobHandle): Promise<void>;
     private initialize;
     private launchLocked;
+    /** The run's MCP token for a spec with mcpTools (refused unless well formed); undefined otherwise, unasked. */
+    private mcpTokenFor;
     private provision;
     /**
      * A run with services (docs/coding-services.md). The network keeper joins the run's internal

package/dist/providers/jobs/docker.js

@@ -12,6 +12,7 @@ import { assertDockerHostSupportsIsolation, assertClaudeAgentContainerInspection
 import { serviceUnreadyError } from "../../coding/services/wording.js";
 import { assertServiceContainerInspection, buildDockerServicePlan, dockerServiceContainerNames, } from "./docker-services.js";
 import { claudeToolSetup } from "./claude-tool-setup.js";
+import { isMcpToken, MCP_TOKEN_ENV } from "../../coding/mcp-token.js";
 import { reportServiceState, } from "./service-state.js";
 import { replaceDirectoryFromStaging } from "./workspace-swap.js";
 const BACKEND = "docker";
@@ -95,7 +96,7 @@ export class NodeDockerCommandRunner {
         if (args.some((argument) => argument.includes("\0")))
             throw new Error("docker_argument_invalid");
         const extraEnv = options.env ?? {};
-        if (Object.keys(extraEnv).some((key) => key !== "WARDBY_RUN_CAPABILITY" && key !== CLAUDE_TOOL_SETUP_ENV))
+        if (Object.keys(extraEnv).some((key) => key !== "WARDBY_RUN_CAPABILITY" && key !== MCP_TOKEN_ENV && key !== CLAUDE_TOOL_SETUP_ENV))
             throw new Error("docker_environment_invalid");
         const env = {
             PATH: this.path,
@@ -447,6 +448,10 @@ function serviceUnready(name, cause) {
 function capabilityFromInspection(container) {
     return container.Config?.Env?.find((value) => value.startsWith("WARDBY_RUN_CAPABILITY="))?.slice("WARDBY_RUN_CAPABILITY=".length);
 }
+function mcpTokenFromInspection(container) {
+    const prefix = `${MCP_TOKEN_ENV}=`;
+    return container.Config?.Env?.find((value) => value.startsWith(prefix))?.slice(prefix.length);
+}
 function dockerState(inspection) {
     const state = inspection.State;
     if (!state)
@@ -655,14 +660,19 @@ export class DockerJobLauncher {
             const capability = ensureCapability(await this.options.resolveCapability(spec.runId));
             if (hash(capability) !== existing.capabilityHash)
                 throw new Error("docker_capability_changed");
+            const mcpToken = await this.mcpTokenFor(spec);
+            if ((mcpToken === undefined ? undefined : hash(mcpToken)) !== existing.mcpTokenHash) {
+                throw new Error("docker_mcp_token_changed");
+            }
             if (existing.phase === "active") {
                 await this.refresh(existing);
                 return clone(existing.handle);
             }
-            return this.provision(existing, plan, services, capability);
+            return this.provision(existing, plan, services, capability, mcpToken);
         }
         await this.validateInputArtifact(spec.inputArtifact);
         const capability = ensureCapability(await this.options.resolveCapability(spec.runId));
+        const mcpToken = await this.mcpTokenFor(spec);
         const record = {
             schemaVersion: STATE_SCHEMA_VERSION,
             runId: spec.runId,
@@ -673,12 +683,13 @@ export class DockerJobLauncher {
             createdAt: this.now(),
             deadlineAt: this.now() + plan.deadlineMs,
             capabilityHash: hash(capability),
+            ...(mcpToken !== undefined ? { mcpTokenHash: hash(mcpToken) } : {}),
             phase: "provisioning",
         };
         // This durable record is the idempotency fence before any Docker side effect.
         await this.writeRecord(record);
         try {
-            return await this.provision(record, plan, services, capability);
+            return await this.provision(record, plan, services, capability, mcpToken);
         }
         catch (error) {
             await this.options
@@ -691,7 +702,16 @@ export class DockerJobLauncher {
             throw error;
         }
     }
-    async provision(record, plan, services, capability) {
+    /** The run's MCP token for a spec with mcpTools (refused unless well formed); undefined otherwise, unasked. */
+    async mcpTokenFor(spec) {
+        if (!spec.mcpTools)
+            return undefined;
+        const token = await this.options.resolveMcpToken?.(spec.runId);
+        if (!isMcpToken(token))
+            throw new Error("docker_mcp_token_invalid");
+        return token;
+    }
+    async provision(record, plan, services, capability, mcpToken) {
         await this.assertHost();
         const labels = resourceLabels(record);
         await this.createAndAssert(appendLabels(plan.networkCreateArgs, labels), ["network", "inspect", plan.names.network], (value) => {
@@ -740,14 +760,14 @@ export class DockerJobLauncher {
         await this.createAndAssert(workerArgs, ["container", "inspect", plan.names.workerContainer], (value) => {
             const inspected = value;
             if (record.spec.provider === "claude-code") {
-                assertClaudeAgentContainerInspection(inspected, record.spec, capability);
+                assertClaudeAgentContainerInspection(inspected, record.spec, capability, mcpToken);
             }
             else {
-                assertWorkerContainerInspection(inspected, record.spec, capability, networkKeeperId);
+                assertWorkerContainerInspection(inspected, record.spec, capability, networkKeeperId, mcpToken);
             }
             if (!labelsMatch(inspected.Config?.Labels, labels))
                 throw new Error("docker_resource_attestation_failed");
-        }, { env: { WARDBY_RUN_CAPABILITY: capability } });
+        }, { env: { WARDBY_RUN_CAPABILITY: capability, ...(mcpToken !== undefined ? { [MCP_TOKEN_ENV]: mcpToken } : {}) } });
         await this.startContainer(plan.names.workerContainer);
         record.phase = "active";
         await this.writeRecord(record);
@@ -939,8 +959,12 @@ export class DockerJobLauncher {
         const capability = capabilityFromInspection(inspection);
         if (!capability || hash(capability) !== record.capabilityHash)
             throw new Error("docker_resource_attestation_failed");
+        // Only a run with MCP tools carries a token, and only the one its record hashed.
+        const mcpToken = record.spec.mcpTools ? mcpTokenFromInspection(inspection) : undefined;
+        if (record.spec.mcpTools && (!mcpToken || hash(mcpToken) !== record.mcpTokenHash))
+            throw new Error("docker_resource_attestation_failed");
         if (record.spec.provider === "claude-code") {
-            assertClaudeAgentContainerInspection(inspection, record.spec, capability);
+            assertClaudeAgentContainerInspection(inspection, record.spec, capability, mcpToken);
             const tool = await this.inspect([
                 "container",
                 "inspect",
@@ -956,7 +980,7 @@ export class DockerJobLauncher {
             }
         }
         else {
-            assertWorkerContainerInspection(inspection, record.spec, capability, await this.attestedNetworkKeeperId(record));
+            assertWorkerContainerInspection(inspection, record.spec, capability, await this.attestedNetworkKeeperId(record), mcpToken);
         }
         const phase = dockerState(inspection);
         if (!phase || phase === "provisioning" || phase === "active")

package/dist/providers/jobs/kubernetes-isolation.d.ts

@@ -13,6 +13,8 @@ export declare const WORKER_CONTAINER = "worker";
 export declare const TOOL_RUNNER_CONTAINER = "tool-runner";
 /** The run Secret's key holding the tool runner's setup (claude-tool-setup.ts). */
 export declare const TOOL_SETUP_SECRET_KEY = "tool-setup";
+/** The run Secret's key for the MCP token (a run with MCP tools only); the agent container alone reads it. */
+export declare const MCP_TOKEN_SECRET_KEY = "mcp-token";
 /** Where the tool runner listens and the agent's relay connects (claude-tool-runner/main.mjs). */
 export declare const TOOL_SOCKET_PATH = "/run/wardby/tool/runner.sock";
 /** Every service sidecar's container name starts with this (service-postgres, service-redis, ...). */
@@ -82,7 +84,7 @@ export interface RunPodOptions {
 }
 export declare function buildRunPod(spec: JobSpec, options: RunPodOptions): V1Pod;
 export declare function buildRunNetworkPolicy(spec: JobSpec, namespace: string): V1NetworkPolicy;
-export declare function buildCapabilitySecret(spec: JobSpec, namespace: string, capability: string, toolSetup?: string): V1Secret;
+export declare function buildCapabilitySecret(spec: JobSpec, namespace: string, capability: string, toolSetup?: string, mcpToken?: string): V1Secret;
 /** A copy of a container's resources with every quantity in one rendering ("1" and "1000m" alike); see normalizeResources. */
 export declare function canonicalResources(r?: V1Container["resources"]): V1Container["resources"];
 /**

package/dist/providers/jobs/kubernetes-isolation.js

@@ -7,6 +7,7 @@
 import { createHash } from "node:crypto";
 import { isIP } from "node:net";
 import { StoredCodingServicesSchema } from "../../coding/services/catalog.js";
+import { MCP_TOKEN_ENV } from "../../coding/mcp-token.js";
 import { CLAUDE_CONFIG_PATH, CLAUDE_CONFIG_SCRATCH_MIB, CLAUDE_TOOL_SETUP_ENV, CODING_PROXY_ALIAS, CODING_PROXY_DENY_PORT, CODING_PROXY_PORT, CODING_WORKER_GID, CODING_WORKER_UID, WORKER_STOP_GRACE_SECONDS, claudeToolLimits, isRepositoryDigest, } from "./docker-isolation.js";
 import { GVISOR_RUNTIME_CLASS, KubernetesPlatformError, STORAGE_INIT_EPHEMERAL_MIB, TOOL_RUNNER_EPHEMERAL_MIB, WORKER_EPHEMERAL_MIB, conformResources, describeMib, normalizePlatformMetadata, platformProfile, podEphemeralStorageMib, } from "./kubernetes-platform.js";
 export const KUBERNETES_ISOLATION_ERROR = "kubernetes_isolation_unsupported";
@@ -19,6 +20,8 @@ export const WORKER_CONTAINER = "worker";
 export const TOOL_RUNNER_CONTAINER = "tool-runner";
 /** The run Secret's key holding the tool runner's setup (claude-tool-setup.ts). */
 export const TOOL_SETUP_SECRET_KEY = "tool-setup";
+/** The run Secret's key for the MCP token (a run with MCP tools only); the agent container alone reads it. */
+export const MCP_TOKEN_SECRET_KEY = "mcp-token";
 /** Where the tool runner listens and the agent's relay connects (claude-tool-runner/main.mjs). */
 export const TOOL_SOCKET_PATH = "/run/wardby/tool/runner.sock";
 const CODEX_ENTRYPOINT = "/opt/wardby/coding-worker/main.js";
@@ -172,6 +175,8 @@ export function validateKubernetesSpec(spec) {
     if (spec.sessionResume !== undefined && (spec.sessionResume !== true || spec.provider !== "claude-code")) {
         throw isolationError("session-resume-not-claude");
     }
+    if (spec.mcpTools !== undefined && spec.mcpTools !== true)
+        throw isolationError("mcp-tools-invalid");
     if (!isRegistryDigest(spec.image))
         throw isolationError("image-not-registry-digest");
     if (spec.services !== undefined) {
@@ -313,6 +318,10 @@ export function buildRunPod(spec, options) {
         env: [
             { name: "WARDBY_PROXY_URL", value: `http://${CODING_PROXY_ALIAS}:${CODING_PROXY_PORT}` },
             { name: "WARDBY_RUN_CAPABILITY", valueFrom: { secretKeyRef: { name: names.secret, key: "capability" } } },
+            // A run with MCP tools only: the agent's bearer for the proxy's /mcp route. Never the tool runner's.
+            ...(spec.mcpTools
+                ? [{ name: MCP_TOKEN_ENV, valueFrom: { secretKeyRef: { name: names.secret, key: MCP_TOKEN_SECRET_KEY } } }]
+                : []),
         ],
         securityContext: containerSecurity(),
         resources: conformResources(profile, {
@@ -464,14 +473,18 @@ export function buildRunNetworkPolicy(spec, namespace) {
         },
     };
 }
-export function buildCapabilitySecret(spec, namespace, capability, toolSetup) {
+export function buildCapabilitySecret(spec, namespace, capability, toolSetup, mcpToken) {
     const names = kubernetesRunNames(spec.runId);
     return {
         apiVersion: "v1",
         kind: "Secret",
         type: "Opaque",
         metadata: { name: names.secret, namespace, labels: runLabels(spec.runId) },
-        stringData: { capability, ...(toolSetup !== undefined ? { [TOOL_SETUP_SECRET_KEY]: toolSetup } : {}) },
+        stringData: {
+            capability,
+            ...(toolSetup !== undefined ? { [TOOL_SETUP_SECRET_KEY]: toolSetup } : {}),
+            ...(mcpToken !== undefined ? { [MCP_TOKEN_SECRET_KEY]: mcpToken } : {}),
+        },
     };
 }
 /**

package/dist/providers/jobs/kubernetes.d.ts

@@ -14,6 +14,11 @@ export interface KubernetesJobLauncherOptions {
     config: KubernetesJobConfig;
     workspaceRoot: string;
     resolveCapability: (runId: string) => Promise<string>;
+    /**
+     * The run's MCP token (the capability vault), asked for only when the spec has mcpTools; it goes into
+     * the run's Secret next to the capability. Absent = a run with MCP tools can't be launched.
+     */
+    resolveMcpToken?: (runId: string) => Promise<string | undefined>;
     /**
      * Cluster preflight run once before the first launch; failure fails every launch. It may return the
      * proxy ClusterIP it validated; otherwise the launcher reads the proxy witness once itself. Either way
@@ -95,6 +100,14 @@ export declare class KubernetesJobLauncher implements WorkspaceJobLauncher {
     hasCapacityFor(spec: JobSpec): Promise<boolean>;
     private readonly warnedOnce;
     private warnOnce;
+    /**
+     * Wakes what the run needs before anything is created: the coding proxy always, and the native
+     * gateway too for a run with MCP tools (its MCP calls go proxy -> gateway; without a gateway the
+     * worker would start with its MCP tools missing). Both wake at once, so a cold start waits for
+     * the slower of the two, not their sum. A gateway that does not wake fails the launch with
+     * coding_mcp_gateway_unavailable; the proxy's own wake error is reported first.
+     */
+    private wakeForRun;
     launch(spec: JobSpec): Promise<JobHandle>;
     status(handle: JobHandle): Promise<JobStatus>;
     collect(handle: JobHandle): Promise<JobResult>;

package/dist/providers/jobs/kubernetes.js

@@ -29,13 +29,14 @@ import { finished } from "node:stream/promises";
 import { createHash } from "node:crypto";
 import { isIP } from "node:net";
 import { logger } from "../../core/logger.js";
-import { DISABLED_POWER, wakeTimeoutMs } from "../../core/power.js";
+import { CODING_MCP_GATEWAY_UNAVAILABLE, DISABLED_POWER, wakeTimeoutMs } from "../../core/power.js";
 import { MAX_CODING_ARTIFACT_BYTES, MAX_CODING_INPUT_BYTES, MAX_DEBUG_TRACE_LINE_BYTES, parseCodingWorkerOutputJson, } from "../../coding/protocol.js";
 import { CODING_PROXY_DENY_PORT, CODING_PROXY_PORT } from "./docker-isolation.js";
 import { parseWorkerDiagnosticLine } from "./docker.js";
 import { KubernetesAlreadyExistsError, KubernetesConflictError, KubernetesQuotaExceededError, } from "./kubernetes-api.js";
 import { ENFORCEMENT_PROBE_DENY_REACHABLE, ENFORCEMENT_PROBE_PROVEN, ENFORCEMENT_PROBE_DENY_REFUSED, ENFORCEMENT_PROBE_PROXY_UNREACHABLE, KEEPER_CONTAINER, KEEPER_SEEDED_MARKER, KUBERNETES_ISOLATION_ERROR, STORAGE_ROOT, TOOL_RUNNER_CONTAINER, WORKER_CONTAINER, assertRunNetworkPolicyMatches, assertRunPodMatches, buildCapabilitySecret, buildRunNetworkPolicy, buildRunPod, enforcementStreakScript, kubernetesRunNames, kubernetesRunNamesForToken, runLabels, serviceContainerName, validateKubernetesSpec, } from "./kubernetes-isolation.js";
 import { claudeToolSetup } from "./claude-tool-setup.js";
+import { isMcpToken } from "../../coding/mcp-token.js";
 import { podQuotaUsage, quotaShortfall } from "./kubernetes-quota.js";
 import { readProxyWitness } from "./kubernetes-witness.js";
 import { safeExtract } from "./safe-extract.js";
@@ -499,6 +500,25 @@ export class KubernetesJobLauncher {
         this.warnedOnce.add(message);
         this.warn(message);
     }
+    /**
+     * Wakes what the run needs before anything is created: the coding proxy always, and the native
+     * gateway too for a run with MCP tools (its MCP calls go proxy -> gateway; without a gateway the
+     * worker would start with its MCP tools missing). Both wake at once, so a cold start waits for
+     * the slower of the two, not their sum. A gateway that does not wake fails the launch with
+     * coding_mcp_gateway_unavailable; the proxy's own wake error is reported first.
+     */
+    async wakeForRun(spec) {
+        const opts = { timeoutMs: wakeTimeoutMs(this.readyTimeoutMs), runId: spec.runId };
+        const [proxy, gateway] = await Promise.allSettled([
+            this.power.ensureAwake("proxy", opts),
+            spec.mcpTools ? this.power.ensureAwake("gateway", opts) : Promise.resolve(),
+        ]);
+        if (proxy.status === "rejected")
+            throw proxy.reason;
+        if (gateway.status === "rejected") {
+            throw new Error(`${CODING_MCP_GATEWAY_UNAVAILABLE}: the native gateway, which serves this run's MCP tools, did not wake.`, { cause: gateway.reason });
+        }
+    }
     async launch(spec) {
         try {
             validateKubernetesSpec(spec);
@@ -515,9 +535,8 @@ export class KubernetesJobLauncher {
         }
         // Low-power mode: the proxy may be scaled to zero; wake it before the preflight reads it. Guarded
         // (not just a no-op await) so mode off keeps launch() joining an in-flight warm-up synchronously.
-        if (this.power.enabled) {
-            await this.power.ensureAwake("proxy", { timeoutMs: wakeTimeoutMs(this.readyTimeoutMs), runId: spec.runId });
-        }
+        if (this.power.enabled)
+            await this.wakeForRun(spec);
         await this.runPreflight();
         const names = kubernetesRunNames(spec.runId);
         const handle = { backend: BACKEND, id: `${this.namespace}/${names.token}` };
@@ -838,6 +857,10 @@ export class KubernetesJobLauncher {
         const capability = await this.options.resolveCapability(spec.runId);
         if (!CAPABILITY.test(capability))
             throw new Error("kubernetes_capability_invalid");
+        const mcpToken = spec.mcpTools ? await this.options.resolveMcpToken?.(spec.runId) : undefined;
+        if (spec.mcpTools && !isMcpToken(mcpToken)) {
+            throw new Error("kubernetes_mcp_token_invalid");
+        }
         // Re-read (not just the ClusterIP): the gate below reads "deny port unreachable" as evidence,
         // which is only meaningful against a Service that actually exposes it with a ready backend.
         const witness = await readProxyWitness(this.api, this.namespace, proxyService);
@@ -851,7 +874,7 @@ export class KubernetesJobLauncher {
         });
         const policy = buildRunNetworkPolicy(spec, this.namespace);
         const toolSetup = spec.provider === "claude-code" ? claudeToolSetup(spec, capability) : undefined;
-        await this.createIfMissing(() => this.api.createSecret(this.namespace, buildCapabilitySecret(spec, this.namespace, capability, toolSetup)));
+        await this.createIfMissing(() => this.api.createSecret(this.namespace, buildCapabilitySecret(spec, this.namespace, capability, toolSetup, mcpToken)));
         await this.createIfMissing(() => this.api.createNetworkPolicy(this.namespace, policy));
         await this.createIfMissing(() => this.api.createPod(this.namespace, pod));
         await this.waitForKeeper(names, spec.runId, (spec.services ?? []).map((service) => service.name), spec.provider === "claude-code");

package/dist/providers/jobs/types.d.ts

@@ -29,6 +29,12 @@ export interface JobSpec {
      * scratch so a long session never fills the worker's shared /tmp.
      */
     sessionResume?: true;
+    /**
+     * Set only when the run has pinned MCP tools (remote MCP servers); absent otherwise, never false.
+     * The launcher then delivers the run's MCP token, from the capability vault, as WARDBY_MCP_TOKEN to
+     * the agent container only (never Claude's tool runner). The token itself is never in the spec.
+     */
+    mcpTools?: true;
     timeoutSec: number;
     limits: JobResourceLimits;
     labels: Record<string, string>;

package/dist/providers/review-host/types.d.ts

@@ -1,14 +1,16 @@
 /**
  * Host-neutral code-review surface for native agents. GitHub (./github.ts) and
- * local git repositories (./local.ts) implement it; Bitbucket Cloud is anticipated. Every method
+ * local git repositories (./local.ts) implement it, and registered host providers add their own. Every method
  * takes the repository and mints its own least-permission credential — no
  * method accepts a token or a permission. See
  * docs/private/2026-09-25-code-review-host-design.md §5.
  */
-export type ReviewHostProvider = "github" | "local";
-export declare const REVIEW_HOST_PROVIDERS: readonly ReviewHostProvider[];
+/** Compiled-in hosts. Registered host providers add their own names at runtime. */
+export type BuiltInHostProvider = "github" | "local";
+export type ReviewHostProvider = BuiltInHostProvider | (string & {});
+export declare const REVIEW_HOST_PROVIDERS: readonly BuiltInHostProvider[];
 /** Providers with host user accounts to link (link_host_account); a local repository has none. */
-export declare const HOST_ACCOUNT_PROVIDERS: readonly ReviewHostProvider[];
+export declare const HOST_ACCOUNT_PROVIDERS: readonly BuiltInHostProvider[];
 export type ReviewVerdict = "APPROVE" | "CHANGES_REQUESTED" | "COMMENT";
 export type CheckConclusion = "success" | "failure" | "neutral";
 export type CommentSide = "LEFT" | "RIGHT";

package/dist/providers/review-host/types.js

@@ -1,6 +1,6 @@
 /**
  * Host-neutral code-review surface for native agents. GitHub (./github.ts) and
- * local git repositories (./local.ts) implement it; Bitbucket Cloud is anticipated. Every method
+ * local git repositories (./local.ts) implement it, and registered host providers add their own. Every method
  * takes the repository and mints its own least-permission credential — no
  * method accepts a token or a permission. See
  * docs/private/2026-09-25-code-review-host-design.md §5.

package/dist/providers/vcs/git.d.ts

@@ -1,11 +1,13 @@
-import { type RepositoryFileInput } from "./github.js";
-import type { GitRemote } from "./remote.js";
+import type { RepositoryFileInput } from "./types.js";
+import { type GitRemote } from "./remote.js";
 import type { ContinuationFinishedDetails, ContinuationOutcome, ContinuationTarget, DescriptionWriteOutcome, FinalizeChangesDetails, FinalizeChangesResult, PreparedWorkspace, VcsPrepareInput, VcsProvider } from "./types.js";
 export declare const DEFAULT_MAX_CHANGED_FILES = 1000;
 export declare const DEFAULT_MAX_DIFF_BYTES: number;
 export interface GitCommandOptions {
     cwd?: string;
     authToken?: string;
+    /** The username git sends with the token (default: git-askpass.sh's GitHub default). Not secret. */
+    authUsername?: string;
     maxOutputBytes?: number;
     /** Non-zero exit codes that still resolve with the output (`merge-tree` exits 1 on conflicts). */
     acceptExitCodes?: readonly number[];
@@ -127,6 +129,8 @@ export declare class GitVcsProvider implements VcsProvider {
      * problem).
      */
     private assertSafeLocalConfig;
+    /** The git credentials for a remote's access token; none when the remote needs no token. */
+    private gitAuth;
     private pushOnce;
     private remoteHead;
     private revParse;