@wardby/cli 0.7.0 → 0.9.0

package/dist/providers/vcs/git.js

@@ -10,12 +10,13 @@ import { simulatorGitEnvironment } from "../../config/test-simulators.js";
 import { globRegex } from "../../core/glob.js";
 import { redactExactSecretValues } from "../../core/secret-spans.js";
 import { MAX_REDACTED_SPAN, redactTokenShapedValues, normalizeGitRef } from "../../coding/protocol.js";
-import { isSafeGitHubInstallationToken } from "./github.js";
+import { isSafeGitAuthToken } from "./remote.js";
 export const DEFAULT_MAX_CHANGED_FILES = 1_000;
 export const DEFAULT_MAX_DIFF_BYTES = 1024 * 1024;
 const MAX_GIT_OUTPUT_BYTES = 2 * 1024 * 1024;
 const MAX_WORKSPACE_ENTRIES = 100_000;
 const SAFE_COMMIT_SHA = /^[0-9a-f]{40}$/;
+const SAFE_GIT_USERNAME = /^[A-Za-z0-9._-]{1,64}$/;
 const SAFE_RUN_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
 /** Where a continuation's target branch is fetched to (never under refs/remotes, so baseCommit's ref is untouched). */
 const MERGE_TARGET_REF = "refs/wardby/merge-target";
@@ -82,9 +83,12 @@ export class NodeGitCommandRunner {
             options.askPassPath ?? fileURLToPath(new URL("../../../scripts/git-askpass.sh", import.meta.url));
     }
     async run(args, options = {}) {
-        if (options.authToken !== undefined && !isSafeGitHubInstallationToken(options.authToken)) {
+        if (options.authToken !== undefined && !isSafeGitAuthToken(options.authToken)) {
             throw new Error("git_auth_token_invalid");
         }
+        if (options.authUsername !== undefined && !SAFE_GIT_USERNAME.test(options.authUsername)) {
+            throw new Error("git_auth_username_invalid");
+        }
         const env = {
             PATH: this.path,
             HOME: this.options.homeDir,
@@ -97,6 +101,7 @@ export class NodeGitCommandRunner {
             GIT_TERMINAL_PROMPT: "0",
             GCM_INTERACTIVE: "never",
             GIT_ASKPASS: options.authToken ? this.askPassPath : "/bin/false",
+            ...(options.authToken && options.authUsername ? { WARDBY_GIT_USERNAME: options.authUsername } : {}),
             SSH_ASKPASS: "/bin/false",
             GIT_LFS_SKIP_SMUDGE: "1",
             // WARDBY_TEST_SIMULATORS (test only): the simulator's throwaway CA; empty otherwise.
@@ -293,7 +298,7 @@ export class GitVcsProvider {
         let mergeFetched = false;
         try {
             await this.remote.withAccess(normalized.repository, async (token) => {
-                const auth = token !== undefined ? { authToken: token } : {};
+                const auth = this.gitAuth(token);
                 if (this.remote.refNotFoundError) {
                     const listed = await this.git.run([
                         ...HARDENED_GIT_CONFIG,
@@ -937,10 +942,16 @@ export class GitVcsProvider {
             throw new Error("vcs_git_config_unsafe");
         }
     }
+    /** The git credentials for a remote's access token; none when the remote needs no token. */
+    gitAuth(token) {
+        if (token === undefined)
+            return {};
+        return { authToken: token, ...(this.remote.gitUsername ? { authUsername: this.remote.gitUsername } : {}) };
+    }
     async pushOnce(workspace, commitSha) {
         this.remote.assertPushRef?.(workspace.headRef);
         await this.remote.withAccess(workspace.repository, async (token) => {
-            const auth = token !== undefined ? { authToken: token } : {};
+            const auth = this.gitAuth(token);
             const remote = await this.remoteHead(workspace, auth);
             if (remote === commitSha)
                 return;

package/dist/providers/vcs/github.d.ts

@@ -1,5 +1,7 @@
 import { type PackageAuditReport } from "../../coding/registry/audit-mode.js";
 import { RELATED_SECTION_END, RELATED_SECTION_START } from "./pr-description.js";
+import type { DescriptionBaseline, DescriptionUpdateResult, RelatedPullRequestEntry, RelatedPullRequestState, RelatedPullRequestsInput, RepositoryFileInput } from "./types.js";
+export type { DescriptionBaseline, DescriptionUpdateResult, RelatedPullRequestEntry, RelatedPullRequestState, RelatedPullRequestsInput, RepositoryFileInput, };
 export { RELATED_SECTION_END, RELATED_SECTION_START };
 export interface GitHubAppConfig {
     appId: string;
@@ -106,22 +108,6 @@ export interface PullRequestResult {
      */
     descriptionSha256?: string;
 }
-/** What wardby last wrote into a pull request description (control-plane records). */
-export interface DescriptionBaseline {
-    /** Null = legacy pull request (no recorded write). */
-    recordedSha256: string | null;
-    /**
-     * Legacy pull requests only: the hash of the body wardby would have written
-     * for the root run, rebuilt from stored records. A current body with this
-     * hash is unedited. Absent when the records can't rebuild it (then the
-     * description counts as edited).
-     */
-    legacySha256?: string;
-    /** Stored summary of the run whose text the description carries (root run for legacy). */
-    previousAgentText?: string;
-    /** That run's id. */
-    agentTextRunId: string;
-}
 /**
  * A fix round's description update. `runId` is this (latest) run; the pull
  * request is re-found by `rootRunId`'s marker. `related` is ignored: the
@@ -138,23 +124,6 @@ export interface UpdateDescriptionInput extends Omit<PullRequestInput, "runId" |
      */
     headSha?: string;
 }
-/** `agentTextRunId` is the run whose summary the description now carries. */
-export type DescriptionUpdateResult = {
-    kind: "replaced" | "unchanged";
-    sha256: string;
-    agentTextRunId: string;
-} | {
-    kind: "refreshed";
-    reason: "empty" | "too_short" | "missing_closing_keyword";
-    sha256: string;
-    agentTextRunId: string;
-} | {
-    kind: "edited_by_hand";
-    commentPosted: boolean;
-} | {
-    kind: "skipped";
-    reason: "not_open" | "too_long" | "error";
-};
 /** See VcsProvider.notifyContinuationStarted/Finished (types.ts) — these back that GitHub-specific mechanism. */
 export interface ContinuationStatusCommentInput {
     /** This continuation round's own run id — the comment's identity/marker key. */
@@ -185,15 +154,6 @@ export interface ContinuationCheckRunCompleteInput {
      */
     headRef?: string;
 }
-/** One file at one ref, read through the API without a clone. */
-export interface RepositoryFileInput {
-    repository: string;
-    ref: string;
-    /** Repository-relative POSIX path. */
-    path: string;
-    /** Refused above this many bytes. */
-    maxBytes: number;
-}
 export interface GitHubRepositoryAccess {
     withRepositoryToken<T>(repository: string, action: (token: string) => Promise<T>): Promise<T>;
     createOrFindDraftPullRequest(input: PullRequestInput): Promise<PullRequestResult>;
@@ -264,8 +224,6 @@ export interface GitHubRepositoryAccess {
     readFileAtRef?(input: RepositoryFileInput): Promise<string | null>;
 }
 type Fetch = typeof globalThis.fetch;
-/** Accepts bounded opaque installation tokens without allowing control characters. */
-export declare function isSafeGitHubInstallationToken(value: unknown): value is string;
 /**
  * Same shape as ISSUE_KEY (issue-tracker/types.ts); duplicated so the VCS layer
  * stays free of issue-tracker imports (a test keeps the two in step). The
@@ -279,33 +237,6 @@ export declare function pullRequestTitle(input: PullRequestInput): string;
 export declare const MAX_RELATED_PULL_REQUESTS = 20;
 /** GitHub rejects a pull request body longer than this. */
 export declare const MAX_PULL_REQUEST_BODY_CHARS = 65536;
-export type RelatedPullRequestState = "open" | "draft" | "merged" | "closed";
-/** One pull request of the request's set, from stored control-plane rows only. */
-export interface RelatedPullRequestEntry {
-    repository: string;
-    /** Absent only for `self` while the pull request is being created. */
-    number?: number;
-    /** Live state; absent when unknown (at creation). */
-    state?: RelatedPullRequestState;
-    /** The pull request whose description this section is in. */
-    self?: boolean;
-    /**
-     * Step in the delegating agent's declared merge order (1-99), from
-     * CodingRun.mergeOrder; absent = the delegating agent set no order
-     * (an open entry is listed under "Not ordered:" when any other entry,
-     * open or done, has one).
-     */
-    mergeOrder?: number;
-}
-export interface RelatedPullRequestsInput {
-    /** In merge order: by mergeOrder when set, else the order the request's coding runs were dispatched. */
-    entries: readonly RelatedPullRequestEntry[];
-    issue?: {
-        key: string;
-        url?: string;
-        trackerName?: string;
-    };
-}
 /**
  * The "Related pull requests" block, markers included, built only from
  * stored rows (never agent text). Open (and draft, and not-yet-known) pull

package/dist/providers/vcs/github.js

@@ -2,8 +2,10 @@ import { createPrivateKey } from "node:crypto";
 import { importPKCS8, SignJWT } from "jose";
 import { isGitHubLogin } from "../../config/github-allowed-accounts.js";
 import { testSimulatorBase } from "../../config/test-simulators.js";
+import { codeProviderOf, normalizeHostedRepository, pullRequestWebUrl } from "../../coding/code-host.js";
 import { ACCEPTED_ADVISORY_ID } from "../../coding/registry/allowlist.js";
 import { packageAuditRows, packageAuditWording, summarizePackageAudit, } from "../../coding/registry/audit-mode.js";
+import { isSafeGitAuthToken } from "./remote.js";
 import { refusalMeaning } from "../../coding/registry/refusal-hints.js";
 import { DEPENDENCY_CACHE_PATH, normalizeGitHubRepository, normalizeGitRef, truncateText, } from "../../coding/protocol.js";
 import { LATEST_RUN_MARKER_PREFIX, RELATED_SECTION_END, RELATED_SECTION_START, assessFinalMessage, descriptionAppliedComment, descriptionFallbackComment, descriptionSha256, extractRelatedBlock, findDescriptionComments, hasClosingKeyword, isUneditedDescription, supersededDescriptionComment, } from "./pr-description.js";
@@ -33,13 +35,6 @@ function safeApiError(response) {
     const requestId = response.headers.get("x-github-request-id");
     return new Error(`github_api_error:${response.status}${requestId ? `:${requestId}` : ""}`);
 }
-/** Accepts bounded opaque installation tokens without allowing control characters. */
-export function isSafeGitHubInstallationToken(value) {
-    return (typeof value === "string" &&
-        value.length >= 20 &&
-        Buffer.byteLength(value, "utf8") <= 512 &&
-        /^[A-Za-z0-9._-]+$/.test(value));
-}
 /**
  * Same shape as ISSUE_KEY (issue-tracker/types.ts); duplicated so the VCS layer
  * stays free of issue-tracker imports (a test keeps the two in step). The
@@ -109,10 +104,10 @@ export const MAX_RELATED_PULL_REQUESTS = 20;
 /** GitHub rejects a pull request body longer than this. */
 export const MAX_PULL_REQUEST_BODY_CHARS = 65_536;
 const RELATED_STATES = new Set(["open", "draft", "merged", "closed"]);
-/** The repository normalized, or undefined when it isn't a plain owner/name safe inside a link. */
+/** The repository normalized, or undefined when it isn't a hosted repository id safe inside a link. */
 function safeRepository(value) {
     try {
-        const repository = normalizeGitHubRepository(value);
+        const repository = normalizeHostedRepository(value);
         return isSafeMarkdownFragment(repository) && !/[[\]()<>\s]/.test(repository) ? repository : undefined;
     }
     catch {
@@ -129,7 +124,9 @@ function relatedLine(entry, prefix) {
         return `${prefix} **This pull request**${state}`;
     if (!Number.isSafeInteger(entry.number) || (entry.number ?? 0) <= 0)
         return undefined;
-    return `${prefix} [${repository}#${entry.number}](https://github.com/${repository}/pull/${entry.number})${state}`;
+    const label = `${repository}#${entry.number}`;
+    const url = pullRequestWebUrl(codeProviderOf(repository), repository, entry.number);
+    return `${prefix} ${url ? `[${label}](${url})` : label}${state}`;
 }
 const isDone = (entry) => entry.state === "merged" || entry.state === "closed";
 /**
@@ -1103,7 +1100,7 @@ export class GitHubAppClient {
         const expiresAt = typeof payload.expires_at === "string" ? Date.parse(payload.expires_at) : Number.NaN;
         const unexpectedPermission = Object.entries(grantedPermissions).some(([permissionName, level]) => !isAllowedPermission(permissionName, level));
         const requestedGranted = Object.entries(permissions).every(([permissionName, level]) => grantedPermissions[permissionName] === level);
-        if (!isSafeGitHubInstallationToken(payload.token) ||
+        if (!isSafeGitAuthToken(payload.token) ||
             !Number.isFinite(expiresAt) ||
             expiresAt <= this.now().getTime() + 60_000 ||
             !requestedGranted ||

package/dist/providers/vcs/index.d.ts

@@ -5,7 +5,7 @@ export { GitHubAppClient } from "./github.js";
 export { GitVcsProvider, NodeGitCommandRunner } from "./git.js";
 export { GitHubRemote } from "./github-remote.js";
 export { LocalRemote } from "./local-remote.js";
-export { RoutingVcsProvider, VCS_GITHUB_NOT_CONFIGURED_ERROR } from "./routing.js";
+export { RoutingVcsProvider, VCS_GITHUB_NOT_CONFIGURED_ERROR, VCS_HOST_PROVIDER_NOT_CONFIGURED_ERROR, } from "./routing.js";
 export type { GitRemote, PublishInput, PublishResult } from "./remote.js";
 export interface BuildVcsProviderOptions {
     /** Startup warnings; the module logger by default. */

package/dist/providers/vcs/index.js

@@ -14,7 +14,7 @@ export { GitHubAppClient } from "./github.js";
 export { GitVcsProvider, NodeGitCommandRunner } from "./git.js";
 export { GitHubRemote } from "./github-remote.js";
 export { LocalRemote } from "./local-remote.js";
-export { RoutingVcsProvider, VCS_GITHUB_NOT_CONFIGURED_ERROR } from "./routing.js";
+export { RoutingVcsProvider, VCS_GITHUB_NOT_CONFIGURED_ERROR, VCS_HOST_PROVIDER_NOT_CONFIGURED_ERROR, } from "./routing.js";
 /**
  * GitHub is built only with App credentials, local repositories only with
  * LOCAL_REPO_ROOTS; neither being set is allowed (the server still starts) and

package/dist/providers/vcs/remote.d.ts

@@ -1,4 +1,6 @@
 import type { DescriptionWriteOutcome, FinalizeChangesDetails, PreparedWorkspace, VcsProvider } from "./types.js";
+/** Accepts bounded opaque git auth tokens without allowing control characters. */
+export declare function isSafeGitAuthToken(value: unknown): value is string;
 /** What a remote needs to publish a pushed commit (GitHub: open or find the draft PR). */
 export interface PublishInput {
     /** The validated workspace whose headRef was just pushed. */
@@ -25,6 +27,8 @@ export type PublishResult = {
  * fetch-compare-push) stays in GitVcsProvider and applies to every remote.
  */
 export interface GitRemote {
+    /** The username git sends with the token (GitHub: unset, git-askpass.sh's default). */
+    readonly gitUsername?: string;
     /** Extra `-c` pairs appended after HARDENED_GIT_CONFIG for clone/push/ls-remote (GitHub: none). */
     readonly gitConfig: readonly string[];
     /** Syntactic normalization of a repository id for this remote (GitHub: owner/name; local: local:/abs/path). */

package/dist/providers/vcs/remote.js

@@ -1 +1,7 @@
-export {};
+/** Accepts bounded opaque git auth tokens without allowing control characters. */
+export function isSafeGitAuthToken(value) {
+    return (typeof value === "string" &&
+        value.length >= 20 &&
+        Buffer.byteLength(value, "utf8") <= 512 &&
+        /^[A-Za-z0-9._-]+$/.test(value));
+}

package/dist/providers/vcs/routing.d.ts

@@ -1,19 +1,25 @@
-import type { RepositoryFileInput } from "./github.js";
+import type { RepositoryFileInput } from "./types.js";
 import type { ContinuationFinishedDetails, ContinuationOutcome, ContinuationTarget, DescriptionWriteOutcome, FinalizeChangesDetails, FinalizeChangesResult, PreparedWorkspace, VcsPrepareInput, VcsProvider } from "./types.js";
 /** Keeps the `vcs_github_not_configured` code prefix that error matching and categorization key on. */
 export declare const VCS_GITHUB_NOT_CONFIGURED_ERROR = "vcs_github_not_configured: set GITHUB_APP_ID and GITHUB_APP_PRIVATE_KEY to run coding agents on GitHub repositories";
+/** Keeps a stable code prefix for error matching. The provider name comes from a validated repository id. */
+export declare const VCS_HOST_PROVIDER_NOT_CONFIGURED_ERROR = "vcs_host_provider_not_configured";
 export interface RoutingVcsOptions {
     /** Null when no GitHub App is configured. */
     github: VcsProvider | null;
     /** Null when no local repository roots are configured. */
     local: VcsProvider | null;
+    /** Registered host providers, by name. */
+    hosted?: ReadonlyMap<string, VcsProvider>;
 }
 /**
- * One VcsProvider over both repository kinds: `local:/abs/path` goes to the
- * local provider, everything else to GitHub. A kind that is not configured
- * fails only when a repository of that kind is actually used, so a server with
- * only one of the two still starts. The repository name is not re-resolved
- * here: the local provider verifies it against the trusted roots.
+ * One VcsProvider over every repository kind: `local:/abs/path` goes to the
+ * local provider, `<provider>:<workspace>/<repo>` to the registered host
+ * provider of that name, and everything else to GitHub. A kind that is not
+ * configured fails only when a repository of that kind is actually used, so a
+ * server with only some of them still starts. A hosted repository never falls
+ * back to GitHub. The repository name is not re-resolved here: the local
+ * provider verifies it against the trusted roots.
  */
 export declare class RoutingVcsProvider implements VcsProvider {
     private readonly options;

package/dist/providers/vcs/routing.js

@@ -1,12 +1,17 @@
+import { codeProviderOf } from "../../coding/code-host.js";
 import { LocalRepoError, isLocalRepository } from "../../coding/local-repo.js";
 /** Keeps the `vcs_github_not_configured` code prefix that error matching and categorization key on. */
 export const VCS_GITHUB_NOT_CONFIGURED_ERROR = "vcs_github_not_configured: set GITHUB_APP_ID and GITHUB_APP_PRIVATE_KEY to run coding agents on GitHub repositories";
+/** Keeps a stable code prefix for error matching. The provider name comes from a validated repository id. */
+export const VCS_HOST_PROVIDER_NOT_CONFIGURED_ERROR = "vcs_host_provider_not_configured";
 /**
- * One VcsProvider over both repository kinds: `local:/abs/path` goes to the
- * local provider, everything else to GitHub. A kind that is not configured
- * fails only when a repository of that kind is actually used, so a server with
- * only one of the two still starts. The repository name is not re-resolved
- * here: the local provider verifies it against the trusted roots.
+ * One VcsProvider over every repository kind: `local:/abs/path` goes to the
+ * local provider, `<provider>:<workspace>/<repo>` to the registered host
+ * provider of that name, and everything else to GitHub. A kind that is not
+ * configured fails only when a repository of that kind is actually used, so a
+ * server with only some of them still starts. A hosted repository never falls
+ * back to GitHub. The repository name is not re-resolved here: the local
+ * provider verifies it against the trusted roots.
  */
 export class RoutingVcsProvider {
     options;
@@ -20,13 +25,23 @@ export class RoutingVcsProvider {
             }
             return this.options.local;
         }
+        const provider = codeProviderOf(repository);
+        if (provider !== "github") {
+            const hosted = this.options.hosted?.get(provider);
+            if (!hosted)
+                throw new Error(`${VCS_HOST_PROVIDER_NOT_CONFIGURED_ERROR}: no host provider named ${provider}`);
+            return hosted;
+        }
         if (!this.options.github)
             throw new Error(VCS_GITHUB_NOT_CONFIGURED_ERROR);
         return this.options.github;
     }
     /** The target when configured, else null (best-effort calls that must never throw). */
     optionalTarget(repository) {
-        return (isLocalRepository(repository) ? this.options.local : this.options.github) ?? null;
+        if (isLocalRepository(repository))
+            return this.options.local ?? null;
+        const provider = codeProviderOf(repository);
+        return (provider === "github" ? this.options.github : this.options.hosted?.get(provider)) ?? null;
     }
     async prepareWorkspace(input) {
         return this.target(input.repository).prepareWorkspace(input);

package/dist/providers/vcs/types.d.ts

@@ -1,5 +1,4 @@
 import type { PackageAuditReport } from "../../coding/registry/audit-mode.js";
-import type { DescriptionBaseline, DescriptionUpdateResult, RelatedPullRequestsInput, RepositoryFileInput } from "./github.js";
 /** What happened to a pull request description: wardby just wrote it (a new PR) or updated a fix round's. */
 export type DescriptionWriteOutcome = {
     kind: "written";
@@ -168,8 +167,8 @@ export interface VcsProvider {
      * Best-effort "wardby is working on this" signal for a continuation
      * a no-op when `workspace.continuation` is unset, since a fresh run has
      * no PR to attach anything to until its one commit lands. Optional
-     * because this is a GitHub-specific concept, not a universal VCS one --
-     * a future non-GitHub provider (or a test double) can simply omit it,
+     * because not every host has this signal (GitHub does; others may too) --
+     * a provider (or a test double) can simply omit it,
      * mirroring `Executor.resolveCodingWorkerImage?` (dispatch.ts calls it
      * with `?.()`). Implementations MUST NOT throw: this is strictly
      * observability, never allowed to affect the real coding run.
@@ -248,3 +247,72 @@ export interface ContinuationFinishedDetails {
         pullRequestNumber?: number;
     };
 }
+/** What wardby last wrote into a pull request description (control-plane records). */
+export interface DescriptionBaseline {
+    /** Null = legacy pull request (no recorded write). */
+    recordedSha256: string | null;
+    /**
+     * Legacy pull requests only: the hash of the body wardby would have written
+     * for the root run, rebuilt from stored records. A current body with this
+     * hash is unedited. Absent when the records can't rebuild it (then the
+     * description counts as edited).
+     */
+    legacySha256?: string;
+    /** Stored summary of the run whose text the description carries (root run for legacy). */
+    previousAgentText?: string;
+    /** That run's id. */
+    agentTextRunId: string;
+}
+/** `agentTextRunId` is the run whose summary the description now carries. */
+export type DescriptionUpdateResult = {
+    kind: "replaced" | "unchanged";
+    sha256: string;
+    agentTextRunId: string;
+} | {
+    kind: "refreshed";
+    reason: "empty" | "too_short" | "missing_closing_keyword";
+    sha256: string;
+    agentTextRunId: string;
+} | {
+    kind: "edited_by_hand";
+    commentPosted: boolean;
+} | {
+    kind: "skipped";
+    reason: "not_open" | "too_long" | "error";
+};
+/** One file at one ref, read through the API without a clone. */
+export interface RepositoryFileInput {
+    repository: string;
+    ref: string;
+    /** Repository-relative POSIX path. */
+    path: string;
+    /** Refused above this many bytes. */
+    maxBytes: number;
+}
+export type RelatedPullRequestState = "open" | "draft" | "merged" | "closed";
+/** One pull request of the request's set, from stored control-plane rows only. */
+export interface RelatedPullRequestEntry {
+    repository: string;
+    /** Absent only for `self` while the pull request is being created. */
+    number?: number;
+    /** Live state; absent when unknown (at creation). */
+    state?: RelatedPullRequestState;
+    /** The pull request whose description this section is in. */
+    self?: boolean;
+    /**
+     * Step in the delegating agent's declared merge order (1-99), from
+     * CodingRun.mergeOrder; absent = the delegating agent set no order
+     * (an open entry is listed under "Not ordered:" when any other entry,
+     * open or done, has one).
+     */
+    mergeOrder?: number;
+}
+export interface RelatedPullRequestsInput {
+    /** In merge order: by mergeOrder when set, else the order the request's coding runs were dispatched. */
+    entries: readonly RelatedPullRequestEntry[];
+    issue?: {
+        key: string;
+        url?: string;
+        trackerName?: string;
+    };
+}

package/dist/quickstart/index.d.ts

@@ -5,6 +5,11 @@
  */
 export declare function mcpAddArgs(client: "codex" | "claude", projectDir: string, packageSpec: string): string[];
 export declare function quickstartCommand(args: string[]): Promise<void>;
+/**
+ * Doctor's Claude Code pane section. The pane is optional, so its lines are information: a "✗"
+ * from them would be read as a failure, so none reaches the output.
+ */
+export declare function claudePaneDoctorLines<D>(lines: (deps: D) => string[], deps: D): string[];
 export declare function doctorCommand(args: string[]): Promise<void>;
 export declare function statusCommand(args: string[]): Promise<void>;
 export declare function logsCommand(args: string[]): Promise<void>;

package/dist/quickstart/index.js

@@ -360,6 +360,7 @@ export async function quickstartCommand(args) {
             client: { type: "string" },
             "non-interactive": { type: "boolean" },
             "skip-demo": { type: "boolean" },
+            "claude-plugin": { type: "boolean" },
             yes: { type: "boolean", short: "y" },
         },
     });
@@ -447,6 +448,15 @@ export async function quickstartCommand(args) {
     const codingRan = coding?.seed !== undefined && coding.seed.builder.status !== "skipped" && coding.seed.reviewer.status !== "skipped";
     const client = parseClient(values.client) ?? (await chooseClient(nonInteractive));
     const mcpConfigured = client !== "none" && configureMcpClients(client, paths);
+    // With Claude Code connected, offer the runs pane (the wardby-runs plugin): off unless asked for.
+    {
+        const { claudePluginDeps, installPlugin, quickstartPaneStep } = await import("../claude-plugin/command.js");
+        await quickstartPaneStep({ client, mcpConfigured, flag: values["claude-plugin"], nonInteractive, yes: values.yes ?? false }, {
+            ask: (question) => promptYesNo(question, false),
+            install: (options) => installPlugin(options, claudePluginDeps()),
+            warn: (line) => console.warn(line),
+        });
+    }
     console.log("\nWardby is ready.");
     console.log("  npx @wardby/cli@latest status");
     console.log("  npx @wardby/cli@latest doctor");
@@ -471,6 +481,13 @@ async function databaseHealthy(paths) {
         await db.$disconnect();
     }
 }
+/**
+ * Doctor's Claude Code pane section. The pane is optional, so its lines are information: a "✗"
+ * from them would be read as a failure, so none reaches the output.
+ */
+export function claudePaneDoctorLines(lines, deps) {
+    return lines(deps).map((line) => (line.startsWith("✗") ? `!${line.slice(1)}` : line));
+}
 export async function doctorCommand(args) {
     parseArgs({ args, options: {} });
     const paths = quickstartPaths(resolveProjectDir());
@@ -520,6 +537,10 @@ export async function doctorCommand(args) {
         failed ||= line.startsWith("✗");
         console.log(line);
     }
+    // The Claude Code runs pane is optional: its lines never fail doctor.
+    const { claudePluginDeps, claudePluginDoctorLines } = await import("../claude-plugin/command.js");
+    for (const line of claudePaneDoctorLines(claudePluginDoctorLines, claudePluginDeps()))
+        console.log(line);
     const base = baseImageLine(resolveQuickstartImages({ env: runtimeEnv(paths), packageRoot }));
     if (base)
         console.log(base);

package/dist/quickstart-images.json

@@ -1 +1 @@
-{"runtime":"ghcr.io/wardby/wardby/wardby-runtime@sha256:e7458c9fba898c8315f3478b1ad0585d54e099d266aad65efe13d14d000fb49c","worker":"ghcr.io/wardby/wardby/wardby-coding-worker@sha256:e0fb40eff1583a63830c2647c4397e8553f4cc1f3005dd7a745b7936cc79d18c","claudeWorker":"ghcr.io/wardby/wardby/wardby-claude-coding-worker@sha256:f6ecf8c2195f4a8b7fcd859db2e6c101f0494e5eb5447a4613030ba9e3d966f2","claudeToolRunner":"ghcr.io/wardby/wardby/wardby-claude-tool-runner@sha256:efd0987be3a2ed67695fd8b4309762a33f0d0eb8dadd03bf5d6bda12108f282a","workerNodePython":"ghcr.io/wardby/wardby/wardby-coding-worker-node-python@sha256:ea42d825288b34da8d309fda3f344a8bdfb66be50c6179018daef5a98f7938f0","claudeToolRunnerNodePython":"ghcr.io/wardby/wardby/wardby-claude-tool-runner-node-python@sha256:876b387f0ada205ccf5cc5f6c0a07e5faf8d8dd47d21611df0905bfba5dd99f4","nativeWorker":"ghcr.io/wardby/wardby/wardby-native-worker@sha256:4ecf9ebf498de9f5e70f313e750e38bcba72a71c334c5f68413a71242c0bf18c","driver":"ghcr.io/wardby/wardby/wardby-coding-worker-driver@sha256:a9af4a2561c1aeb5876159fcbb28a3ae2ce386fe27c161ebb9855bd092ec3fc8"}
+{"runtime":"ghcr.io/wardby/wardby/wardby-runtime@sha256:d5cb8fcfbfd43c230418374e9a5e203528b7d7fd372c01c8545284bc261edd58","worker":"ghcr.io/wardby/wardby/wardby-coding-worker@sha256:943a4023bcdc86d84fb923ebd97e3b0b0b5c0055ea81542cb9972ddc6ee36e69","claudeWorker":"ghcr.io/wardby/wardby/wardby-claude-coding-worker@sha256:861ef8f23bd70c329cde7013191371737d266b854678942d328906b29242d08f","claudeToolRunner":"ghcr.io/wardby/wardby/wardby-claude-tool-runner@sha256:247a870862a3b20d02b6d0a2a87ef7b3d2ae57a30478b6d517ae58535bf54260","workerNodePython":"ghcr.io/wardby/wardby/wardby-coding-worker-node-python@sha256:9684306a84da26ea057b6ccdaaa73f7377820a74bb30fe1740afb8c734da4300","claudeToolRunnerNodePython":"ghcr.io/wardby/wardby/wardby-claude-tool-runner-node-python@sha256:71bd16fd9635eee62b561771da9568120db25ec259807aa070c2eb7865dbbf0f","nativeWorker":"ghcr.io/wardby/wardby/wardby-native-worker@sha256:33606de7284c11dee354a44b6563cc7999fd135d71545c1e63244d867f1a7b2c","driver":"ghcr.io/wardby/wardby/wardby-coding-worker-driver@sha256:281a7cabc53d6ff1977d1b68c1420b2ef598f90da3995cb13df27395a58a60ef"}

package/dist/sandbox/eval-core.d.ts

@@ -6,7 +6,7 @@
  * compilation/validation is pure computation, no host I/O at all).
  */
 import type { QuickJSContext, QuickJSRuntime } from "quickjs-emscripten";
-export type SandboxErrorKind = "thrown" | "timeout" | "memory" | "cpu" | "non_serializable";
+export type SandboxErrorKind = "thrown" | "timeout" | "memory" | "cpu" | "non_serializable" | "cancelled";
 export type SandboxResult = {
     ok: true;
     value: unknown;
@@ -34,4 +34,14 @@ export declare function classifyEvalError(dumped: {
     name?: string;
     message?: string;
 }): SandboxResult;
-export declare function evalToJson(code: string, limitsOverride: Partial<SandboxLimits> | undefined, installExtras: (context: QuickJSContext, runtime: QuickJSRuntime, signal: AbortSignal) => void): Promise<SandboxResult>;
+export interface EvalOptions {
+    /**
+     * Ends the evaluation early when it aborts (a stopped run): the result is `aborted(reason)`,
+     * and every host call still in flight is aborted with it.
+     */
+    signal?: AbortSignal;
+    aborted?: (reason: unknown) => SandboxResult;
+    /** The wall-time error's text; defaults to naming the limit. */
+    timeoutMessage?: (limitMs: number) => string;
+}
+export declare function evalToJson(code: string, limitsOverride: Partial<SandboxLimits> | undefined, installExtras: (context: QuickJSContext, runtime: QuickJSRuntime, signal: AbortSignal) => void, options?: EvalOptions): Promise<SandboxResult>;

package/dist/sandbox/eval-core.js

@@ -56,9 +56,14 @@ export function classifyEvalError(dumped) {
         errorMessage: dumped.message ? `${dumped.name ?? "Error"}: ${dumped.message}` : JSON.stringify(dumped),
     };
 }
-export async function evalToJson(code, limitsOverride, installExtras) {
+const defaultAborted = () => ({ ok: false, errorKind: "cancelled", errorMessage: "Cancelled." });
+export async function evalToJson(code, limitsOverride, installExtras, options = {}) {
     const limits = { ...DEFAULT_SANDBOX_LIMITS, ...limitsOverride };
+    const aborted = options.aborted ?? defaultAborted;
+    if (options.signal?.aborted)
+        return aborted(options.signal.reason);
     const controller = new AbortController();
+    let onAbort;
     let timer;
     const deadline = Date.now() + limits.wallTimeLimitMs;
     const qjsModule = await getQuickJsModule();
@@ -68,7 +73,7 @@ export async function evalToJson(code, limitsOverride, installExtras) {
     let steps = 0;
     runtime.setInterruptHandler(() => {
         steps += 1;
-        return steps > limits.maxInterruptChecks || Date.now() >= deadline;
+        return steps > limits.maxInterruptChecks || Date.now() >= deadline || options.signal?.aborted === true;
     });
     const context = runtime.newContext();
     let disposed = false;
@@ -139,10 +144,19 @@ export async function evalToJson(code, limitsOverride, installExtras) {
             timer = setTimeout(() => resolve({
                 ok: false,
                 errorKind: "timeout",
-                errorMessage: `Exceeded the ${limits.wallTimeLimitMs}ms wall-time limit.`,
+                errorMessage: options.timeoutMessage
+                    ? options.timeoutMessage(limits.wallTimeLimitMs)
+                    : `Exceeded the ${limits.wallTimeLimitMs}ms wall-time limit.`,
             }), limits.wallTimeLimitMs);
         });
-        return await Promise.race([runPromise, timeoutPromise]);
+        const external = options.signal;
+        const abortPromise = new Promise((resolve) => {
+            if (!external)
+                return;
+            onAbort = () => resolve(aborted(external.reason));
+            external.addEventListener("abort", onAbort, { once: true });
+        });
+        return await Promise.race([runPromise, timeoutPromise, abortPromise]);
     }
     catch (err) {
         return {
@@ -153,6 +167,8 @@ export async function evalToJson(code, limitsOverride, installExtras) {
     }
     finally {
         clearTimeout(timer);
+        if (onAbort)
+            options.signal?.removeEventListener("abort", onAbort);
         controller.abort();
         disposeAll();
     }

package/dist/sandbox/host-functions.d.ts

@@ -43,6 +43,8 @@ export interface HostFunctionOptions {
     redactSecretValues?: readonly string[];
     /** Overrides the network call — tests only. */
     fetchImpl?: typeof safeFetch;
+    /** Each fetch's timeout (fetchTimeoutFor the tool's limit); the default fetch timeout when absent. */
+    fetchTimeoutMs?: number;
 }
 /** One host bridge: JSON-string arguments in, a JSON-serializable value out (bridge.ts). */
 export type HostBridge = (argsJson: string) => Promise<unknown>;
@@ -63,6 +65,8 @@ export declare function createPrivilegedHost(options: PrivilegedHostOptions): Pr
 export interface SandboxApiOptions {
     privileged: PrivilegedHost;
     signal?: AbortSignal;
+    /** The tool's time limit, which also caps sleep(); the default wall-time cap when absent. */
+    wallTimeLimitMs?: number;
     /** Overrides the shared default parser-worker pool — mainly for tests. */
     parserPool?: ParserWorkerPool;
 }