agent-dealer 0.3.0 → 1.0.0

package/bundle/server/dist/adapters/agent-deck-bind.test.js

@@ -0,0 +1,454 @@
+// packages/server/src/adapters/agent-deck-bind.test.ts
+//
+// prepareWorkerDeckConnection materializes a per-attempt MCP config with deck launch
+// headers (no Authorization) and verifies with get_bound_deck (NOT-106).
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { parse as parseToml } from "smol-toml";
+import { StreamableHTTPError } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-deckbind-"));
+const { migrate } = await import("../db/index.js");
+const { prepareWorkerDeckConnection, releaseWorkerDeckConnection, parseDeckToolResult, isDeckUnreachableError } = await import("./agent-deck-bind.js");
+const { codexScopedConfigDeniesSendGate } = await import("./codex-scoped-config.js");
+const { roleCeiling } = await import("@agent-dealer/shared");
+/** Default worker policy: outboundMutation is false for BOTH roles (NOT-134). */
+const DENIED = roleCeiling("reviewer");
+migrate();
+const DECK = "7eb62206-f3a3-44d1-99e5-8f40b39be084";
+const WT = "/tmp/worktrees/session-a-developer";
+function textResult(obj) {
+    return { content: [{ type: "text", text: JSON.stringify(obj) }] };
+}
+function errorResult(msg) {
+    return { isError: true, content: [{ type: "text", text: msg }] };
+}
+const BASE_OPTS = {
+    deckId: DECK,
+    worktreePath: WT,
+    runtime: "claude_code",
+};
+test("parseDeckToolResult extracts and parses the text payload", () => {
+    assert.deepEqual(parseDeckToolResult(textResult({ a: 1 })), { a: 1 });
+    assert.throws(() => parseDeckToolResult({ content: [] }));
+});
+test("prepareWorkerDeckConnection verifies and writes a claude MCP config with deck headers, no Auth", async () => {
+    let verifyCalled = false;
+    const result = await prepareWorkerDeckConnection({
+        policy: DENIED,
+        ...BASE_OPTS,
+        verifyCallTool: async (name) => {
+            verifyCalled = true;
+            assert.equal(name, "get_bound_deck");
+            return textResult({ id: DECK, name: "personal-dev" });
+        },
+    });
+    assert.equal(result.ok, true);
+    assert.equal(verifyCalled, true);
+    if (result.ok) {
+        assert.ok(fs.existsSync(result.mcpConfigPath));
+        const written = JSON.parse(fs.readFileSync(result.mcpConfigPath, "utf8"));
+        const headers = written.mcpServers["agent-deck"].headers;
+        assert.equal(headers["x-agent-deck-deck-id"], DECK);
+        assert.equal(headers["x-agent-deck-workspace"], WT);
+        assert.equal(headers.Authorization, undefined);
+        await releaseWorkerDeckConnection({ mcpConfigPath: result.mcpConfigPath });
+        assert.equal(fs.existsSync(result.mcpConfigPath), false);
+    }
+});
+test("prepareWorkerDeckConnection rejects when get_bound_deck reports a different deck", async () => {
+    const result = await prepareWorkerDeckConnection({
+        policy: DENIED,
+        ...BASE_OPTS,
+        verifyCallTool: async () => textResult({ id: "some-other-deck-id" }),
+    });
+    assert.equal(result.ok, false);
+    if (!result.ok) {
+        assert.equal(result.kind, "infra_failure");
+        assert.match(result.reason, /returned deck some-other-deck-id, expected/);
+    }
+});
+test("prepareWorkerDeckConnection returns infra_failure when verify fails", async () => {
+    const result = await prepareWorkerDeckConnection({
+        policy: DENIED,
+        ...BASE_OPTS,
+        verifyCallTool: async () => errorResult("no session"),
+    });
+    assert.equal(result.ok, false);
+    if (!result.ok) {
+        assert.equal(result.kind, "infra_failure");
+        assert.match(result.reason, /get_bound_deck returned an error/);
+    }
+});
+test("prepareWorkerDeckConnection preflights every configured playbook before spawn", async () => {
+    const calls = [];
+    const result = await prepareWorkerDeckConnection({
+        policy: DENIED,
+        ...BASE_OPTS,
+        playbookIds: ["pb-review", "pb-security", "pb-review"],
+        verifyCallTool: async (name, args) => {
+            calls.push({ name, args });
+            if (name === "get_bound_deck")
+                return textResult({ id: DECK });
+            return textResult({ id: args.playbook_id });
+        },
+    });
+    assert.equal(result.ok, true);
+    assert.deepEqual(calls, [
+        { name: "get_bound_deck", args: {} },
+        { name: "get_playbook", args: { playbook_id: "pb-review" } },
+        { name: "get_playbook", args: { playbook_id: "pb-security" } },
+    ]);
+    if (result.ok)
+        await releaseWorkerDeckConnection({ mcpConfigPath: result.mcpConfigPath });
+});
+test("prepareWorkerDeckConnection fails closed when a configured playbook is unavailable", async () => {
+    const result = await prepareWorkerDeckConnection({
+        policy: DENIED,
+        ...BASE_OPTS,
+        playbookIds: ["pb-required"],
+        verifyCallTool: async (name) => name === "get_bound_deck" ? textResult({ id: DECK }) : errorResult("playbook missing"),
+    });
+    assert.equal(result.ok, false);
+    if (!result.ok) {
+        assert.equal(result.kind, "infra_failure");
+        assert.match(result.reason, /get_playbook\(pb-required\) returned an error/);
+    }
+});
+test("prepareWorkerDeckConnection shares one timeout budget across all preflight calls", async () => {
+    const result = await prepareWorkerDeckConnection({
+        policy: DENIED,
+        ...BASE_OPTS,
+        playbookIds: ["pb-one", "pb-two"],
+        timeoutMs: 40,
+        verifyCallTool: async (name, args) => {
+            if (name === "get_bound_deck")
+                return textResult({ id: DECK });
+            await new Promise((resolve) => setTimeout(resolve, 25));
+            return textResult({ id: args.playbook_id });
+        },
+    });
+    assert.equal(result.ok, false, "the second playbook must not receive a fresh timeout budget");
+    if (!result.ok)
+        assert.match(result.reason, /40ms total preflight budget/);
+});
+test("prepareWorkerDeckConnection for codex_local writes http_headers (no bearer) and CODEX_HOME env", async () => {
+    const result = await prepareWorkerDeckConnection({
+        policy: DENIED,
+        ...BASE_OPTS,
+        runtime: "codex_local",
+        verifyCallTool: async () => textResult({ id: DECK }),
+    });
+    assert.equal(result.ok, true);
+    if (result.ok) {
+        assert.ok(fs.statSync(result.mcpConfigPath).isDirectory());
+        const toml = fs.readFileSync(path.join(result.mcpConfigPath, "config.toml"), "utf8");
+        assert.match(toml, /\[mcp_servers\.agent-deck\]/);
+        assert.match(toml, /http_headers/);
+        assert.doesNotMatch(toml, /bearer_token_env_var/);
+        assert.doesNotMatch(toml, /Authorization/);
+        assert.equal(result.mcpEnv?.CODEX_HOME, result.mcpConfigPath);
+        assert.equal(result.mcpEnv?.AGENT_DECK_AUTHORITY_BEARER, undefined);
+        await releaseWorkerDeckConnection({ mcpConfigPath: result.mcpConfigPath });
+        assert.equal(fs.existsSync(result.mcpConfigPath), false);
+    }
+});
+test("the codex scoped config carries the send-gate denial, and drops it only when policy allows", async () => {
+    // NOT-134: codex has no --disallowedTools, so this file is the only place the denial
+    // can exist. Both roles default to outboundMutation:false, so both get it.
+    const denied = await prepareWorkerDeckConnection({
+        policy: DENIED,
+        ...BASE_OPTS,
+        runtime: "codex_local",
+        verifyCallTool: async () => textResult({ id: DECK }),
+    });
+    assert.equal(denied.ok, true);
+    if (denied.ok) {
+        const cfg = parseToml(fs.readFileSync(path.join(denied.mcpConfigPath, "config.toml"), "utf8"));
+        assert.deepEqual(cfg.mcp_servers["agent-deck"].disabled_tools, ["call_service_tool"]);
+        // A non-interactive `codex exec` has approval policy `never`, so the reads need an
+        // explicit approval_mode or the deck is configured, connected and unusable. Exactly
+        // the reads — the send gate must never appear here, since that entry could undo the
+        // removal above.
+        const tools = cfg.mcp_servers["agent-deck"].tools ?? {};
+        assert.deepEqual(Object.keys(tools).sort(), [
+            "bind_workspace",
+            "get_bound_deck",
+            "get_playbook",
+            "list_service_tools",
+        ]);
+        for (const t of Object.keys(tools))
+            assert.equal(tools[t].approval_mode, "approve");
+        assert.equal(tools["call_service_tool"], undefined);
+        assert.equal(codexScopedConfigDeniesSendGate(denied.mcpConfigPath), true);
+        await releaseWorkerDeckConnection({ mcpConfigPath: denied.mcpConfigPath });
+    }
+    const allowed = await prepareWorkerDeckConnection({
+        policy: { ...DENIED, outboundMutation: true },
+        ...BASE_OPTS,
+        runtime: "codex_local",
+        verifyCallTool: async () => textResult({ id: DECK }),
+    });
+    assert.equal(allowed.ok, true);
+    if (allowed.ok) {
+        const toml = fs.readFileSync(path.join(allowed.mcpConfigPath, "config.toml"), "utf8");
+        assert.doesNotMatch(toml, /disabled_tools/);
+        assert.equal(codexScopedConfigDeniesSendGate(allowed.mcpConfigPath), false);
+        await releaseWorkerDeckConnection({ mcpConfigPath: allowed.mcpConfigPath });
+    }
+});
+test("prepareWorkerDeckConnection for codex_local symlinks ambient auth.json and preserves auth policy", async () => {
+    const ambientCodexHome = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-ambient-codex-"));
+    const ambientAuthPath = path.join(ambientCodexHome, "auth.json");
+    fs.writeFileSync(ambientAuthPath, JSON.stringify({ tokens: { access_token: "real-secret-token" } }));
+    fs.writeFileSync(path.join(ambientCodexHome, "config.toml"), [
+        'cli_auth_credentials_store = "file"',
+        'chatgpt_base_url = "https://chatgpt.example.com"',
+        'forced_login_method = "chatgpt"',
+        'forced_chatgpt_workspace_id = "ws_123"',
+        'model = "should-not-be-copied"',
+        "",
+    ].join("\n"));
+    const prevCodexHome = process.env.CODEX_HOME;
+    process.env.CODEX_HOME = ambientCodexHome;
+    try {
+        const result = await prepareWorkerDeckConnection({
+            policy: DENIED,
+            ...BASE_OPTS,
+            runtime: "codex_local",
+            verifyCallTool: async () => textResult({ id: DECK }),
+        });
+        assert.equal(result.ok, true);
+        if (result.ok) {
+            const isolatedAuthPath = path.join(result.mcpConfigPath, "auth.json");
+            assert.ok(fs.lstatSync(isolatedAuthPath).isSymbolicLink());
+            assert.equal(fs.readlinkSync(isolatedAuthPath), ambientAuthPath);
+            const isolated = parseToml(fs.readFileSync(path.join(result.mcpConfigPath, "config.toml"), "utf8"));
+            assert.equal(isolated.cli_auth_credentials_store, "file");
+            assert.equal(isolated.chatgpt_base_url, "https://chatgpt.example.com");
+            assert.equal(isolated.forced_login_method, "chatgpt");
+            assert.equal(isolated.forced_chatgpt_workspace_id, "ws_123");
+            assert.equal(isolated.model, undefined);
+            const mcpServers = isolated.mcp_servers;
+            assert.equal(mcpServers["agent-deck"].http_headers?.["x-agent-deck-deck-id"], DECK);
+            assert.equal(mcpServers["agent-deck"].http_headers?.Authorization, undefined);
+            await releaseWorkerDeckConnection({ mcpConfigPath: result.mcpConfigPath });
+            assert.equal(fs.existsSync(result.mcpConfigPath), false);
+            assert.ok(fs.existsSync(ambientAuthPath));
+        }
+    }
+    finally {
+        if (prevCodexHome === undefined)
+            delete process.env.CODEX_HOME;
+        else
+            process.env.CODEX_HOME = prevCodexHome;
+        fs.rmSync(ambientCodexHome, { recursive: true, force: true });
+    }
+});
+test("prepareWorkerDeckConnection for codex_local tolerates no ambient auth.json", async () => {
+    const ambientCodexHome = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-ambient-codex-nokey-"));
+    const prevCodexHome = process.env.CODEX_HOME;
+    process.env.CODEX_HOME = ambientCodexHome;
+    try {
+        const result = await prepareWorkerDeckConnection({
+            policy: DENIED,
+            ...BASE_OPTS,
+            runtime: "codex_local",
+            verifyCallTool: async () => textResult({ id: DECK }),
+        });
+        assert.equal(result.ok, true);
+        if (result.ok) {
+            assert.equal(fs.existsSync(path.join(result.mcpConfigPath, "auth.json")), false);
+            await releaseWorkerDeckConnection({ mcpConfigPath: result.mcpConfigPath });
+        }
+    }
+    finally {
+        if (prevCodexHome === undefined)
+            delete process.env.CODEX_HOME;
+        else
+            process.env.CODEX_HOME = prevCodexHome;
+        fs.rmSync(ambientCodexHome, { recursive: true, force: true });
+    }
+});
+function initGitRepo(dir) {
+    fs.mkdirSync(dir, { recursive: true });
+    execFileSync("git", ["init"], { cwd: dir, stdio: "ignore" });
+    execFileSync("git", ["config", "user.email", "test@example.com"], { cwd: dir, stdio: "ignore" });
+    execFileSync("git", ["config", "user.name", "test"], { cwd: dir, stdio: "ignore" });
+    fs.writeFileSync(path.join(dir, "README"), "x\n");
+    execFileSync("git", ["add", "README"], { cwd: dir, stdio: "ignore" });
+    execFileSync("git", ["commit", "-m", "init"], { cwd: dir, stdio: "ignore" });
+}
+test("prepareWorkerDeckConnection for cursor_local writes mcp.json and excludes it", async () => {
+    const repo = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-cursor-wt-"));
+    initGitRepo(repo);
+    try {
+        const result = await prepareWorkerDeckConnection({
+            policy: DENIED,
+            deckId: DECK,
+            worktreePath: repo,
+            runtime: "cursor_local",
+            verifyCallTool: async () => textResult({ id: DECK }),
+        });
+        assert.equal(result.ok, true);
+        if (result.ok) {
+            assert.equal(result.mcpConfigPath, path.join(repo, ".cursor", "mcp.json"));
+            assert.ok(fs.existsSync(result.mcpConfigPath));
+            const written = JSON.parse(fs.readFileSync(result.mcpConfigPath, "utf8"));
+            const headers = written.mcpServers["agent-deck"].headers;
+            assert.equal(headers["x-agent-deck-deck-id"], DECK);
+            assert.equal(headers.Authorization, undefined);
+            const exclude = fs.readFileSync(path.join(repo, ".git", "info", "exclude"), "utf8");
+            assert.match(exclude, /\/\.cursor\/mcp\.json/);
+            await releaseWorkerDeckConnection({ mcpConfigPath: result.mcpConfigPath });
+            assert.equal(fs.existsSync(result.mcpConfigPath), false);
+        }
+    }
+    finally {
+        fs.rmSync(repo, { recursive: true, force: true });
+    }
+});
+test("prepareWorkerDeckConnection refuses cursor_local when .cursor/mcp.json is tracked", async () => {
+    const repo = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-cursor-tracked-"));
+    initGitRepo(repo);
+    try {
+        fs.mkdirSync(path.join(repo, ".cursor"), { recursive: true });
+        fs.writeFileSync(path.join(repo, ".cursor", "mcp.json"), "{}\n");
+        execFileSync("git", ["add", ".cursor/mcp.json"], { cwd: repo, stdio: "ignore" });
+        execFileSync("git", ["commit", "-m", "track mcp"], { cwd: repo, stdio: "ignore" });
+        const result = await prepareWorkerDeckConnection({
+            policy: DENIED,
+            deckId: DECK,
+            worktreePath: repo,
+            runtime: "cursor_local",
+            verifyCallTool: async () => textResult({ id: DECK }),
+        });
+        assert.equal(result.ok, false);
+        if (!result.ok) {
+            assert.equal(result.kind, "infra_failure");
+            assert.match(result.reason, /tracked/);
+        }
+    }
+    finally {
+        fs.rmSync(repo, { recursive: true, force: true });
+    }
+});
+// ---------------------------------------------------------------------------
+// NOT-136: unreachable deck vs. a deck that answered with an error.
+// ---------------------------------------------------------------------------
+/** What node's fetch actually throws when nothing is listening on the deck port. */
+function fetchFailed(code) {
+    const err = new TypeError("fetch failed");
+    err.cause = Object.assign(new Error(`connect ${code} 127.0.0.1:1110`), { code });
+    return err;
+}
+test("isDeckUnreachableError separates transport death from a deck-reported error", () => {
+    assert.equal(isDeckUnreachableError(fetchFailed("ECONNREFUSED")), true);
+    assert.equal(isDeckUnreachableError(Object.assign(new Error("boom"), { code: "ENOTFOUND" })), true);
+    assert.equal(isDeckUnreachableError(new AggregateError([Object.assign(new Error("x"), { code: "ECONNREFUSED" })], "all failed")), true);
+    // Anything the deck itself produced must stay a real failure.
+    assert.equal(isDeckUnreachableError(new Error("Error POSTing to endpoint (HTTP 500): boom")), false);
+    assert.equal(isDeckUnreachableError(new Error("get_bound_deck returned an error: no session")), false);
+    assert.equal(isDeckUnreachableError(new Error("invalid_token")), false);
+    assert.equal(isDeckUnreachableError(null), false);
+});
+test("an HTTP status beats a transport-looking message — the deck answered", () => {
+    // The SDK pastes the response body into the error message, so a deck that is up and
+    // returns 500 with the body `fetch failed` (NOT-101's shape, reported over HTTP) throws
+    // something that reads exactly like a dead port. The status proves bytes came back.
+    assert.equal(isDeckUnreachableError(new StreamableHTTPError(500, "Error POSTing to endpoint: fetch failed")), false);
+    assert.equal(isDeckUnreachableError(new StreamableHTTPError(502, "Error POSTing to endpoint: ECONNREFUSED upstream")), false);
+    // Structural, not instanceof-dependent: a numeric status anywhere in the chain is enough.
+    assert.equal(isDeckUnreachableError(Object.assign(new Error("fetch failed"), { status: 503 })), false);
+    assert.equal(isDeckUnreachableError(new Error("connect failed", { cause: Object.assign(new Error("fetch failed"), { code: 500 }) })), false);
+    // …and it does not swallow the real thing: a string code is a transport code, not a status.
+    assert.equal(isDeckUnreachableError(fetchFailed("ECONNREFUSED")), true);
+});
+test("preflight defers only when nothing answered, never on an HTTP error body", async () => {
+    const result = await prepareWorkerDeckConnection({
+        policy: DENIED,
+        ...BASE_OPTS,
+        verifyCallTool: async () => {
+            throw new StreamableHTTPError(500, "Error POSTing to endpoint: fetch failed");
+        },
+    });
+    assert.equal(result.ok, false);
+    if (!result.ok) {
+        assert.equal(result.kind, "infra_failure");
+        assert.match(result.reason, /preflight failed: Streamable HTTP error/);
+    }
+});
+test("preflight against a dead deck returns deck_unavailable, not infra_failure", async () => {
+    const result = await prepareWorkerDeckConnection({
+        policy: DENIED,
+        ...BASE_OPTS,
+        verifyCallTool: async () => {
+            throw fetchFailed("ECONNREFUSED");
+        },
+    });
+    assert.equal(result.ok, false);
+    if (!result.ok) {
+        assert.equal(result.kind, "deck_unavailable");
+        assert.match(result.reason, /Agent Deck is unreachable — fetch failed/);
+    }
+});
+test("preflight that exhausts its budget with no answer is deck_unavailable", async () => {
+    const result = await prepareWorkerDeckConnection({
+        policy: DENIED,
+        ...BASE_OPTS,
+        timeoutMs: 20,
+        verifyCallTool: () => new Promise(() => { }),
+    });
+    assert.equal(result.ok, false);
+    if (!result.ok) {
+        assert.equal(result.kind, "deck_unavailable");
+        assert.match(result.reason, /total preflight budget/);
+    }
+});
+test("a reachable deck that answers with an HTTP error still fails the attempt", async () => {
+    const result = await prepareWorkerDeckConnection({
+        policy: DENIED,
+        ...BASE_OPTS,
+        verifyCallTool: async () => {
+            throw new Error("Error POSTing to endpoint (HTTP 500): internal error");
+        },
+    });
+    assert.equal(result.ok, false);
+    if (!result.ok) {
+        assert.equal(result.kind, "infra_failure");
+        assert.match(result.reason, /preflight failed: Error POSTing/);
+    }
+});
+test("a deck that answers, reporting its own upstream as dead, is not mistaken for a dead deck", async () => {
+    // NOT-101's shape: the deck is up and replies, but a proxied MCP service behind it is
+    // down, so its `isError` text is the literal string a dead port produces. Classifying on
+    // prose would defer this forever; it is a real deck error and must spend the attempt.
+    const result = await prepareWorkerDeckConnection({
+        policy: DENIED,
+        ...BASE_OPTS,
+        verifyCallTool: async () => errorResult("fetch failed"),
+    });
+    assert.equal(result.ok, false);
+    if (!result.ok) {
+        assert.equal(result.kind, "infra_failure");
+        assert.match(result.reason, /preflight failed: get_bound_deck returned an error: fetch failed/);
+    }
+});
+test("a deck that loses the connection mid-playbook is deck_unavailable", async () => {
+    const result = await prepareWorkerDeckConnection({
+        policy: DENIED,
+        ...BASE_OPTS,
+        playbookIds: ["pb-review"],
+        verifyCallTool: async (name) => {
+            if (name === "get_bound_deck")
+                return textResult({ id: DECK });
+            throw fetchFailed("ECONNRESET");
+        },
+    });
+    assert.equal(result.ok, false);
+    if (!result.ok)
+        assert.equal(result.kind, "deck_unavailable");
+});

package/bundle/server/dist/adapters/agent-deck.js

@@ -1,7 +1,5 @@
 import fs from "node:fs";
 import path from "node:path";
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { getAgentDeckConfig } from "../repository/intake-settings.js";
 export function getAgentDeckApiUrl() {
     if (process.env.AGENT_DECK_API_URL) {
@@ -49,18 +47,18 @@ export async function testAgentDeckConnection() {
                 error: `HTTP ${health.status}`,
             };
         }
-        let deckCount;
-        try {
-            const decksRes = await fetch(`${apiUrl}/api/decks`, { signal: AbortSignal.timeout(5000) });
-            if (decksRes.ok) {
-                const json = (await decksRes.json());
-                deckCount = json.data?.length;
-            }
-        }
-        catch {
-            /* decks optional */
+        const decksResult = await fetchDecks();
+        if (decksResult.ok) {
+            return { connected: true, apiUrl, mcpUrl, deckCount: decksResult.decks.length, envOverride };
         }
-        return { connected: true, apiUrl, mcpUrl, deckCount, envOverride };
+        return {
+            connected: true,
+            apiUrl,
+            mcpUrl,
+            envOverride,
+            deckAccessError: decksResult.code,
+            deckAccessErrorMessage: decksResult.message,
+        };
     }
     catch (e) {
         return {
@@ -72,12 +70,31 @@ export async function testAgentDeckConnection() {
         };
     }
 }
-export async function fetchAgentDeckDecks() {
-    const res = await fetch(`${getAgentDeckApiUrl()}/api/decks`, { signal: AbortSignal.timeout(5000) });
-    if (!res.ok)
-        throw new Error(`Agent Deck API error: ${res.status}`);
-    return res.json();
+/**
+ * Unauthenticated launch deck-metadata discovery (NOT-106) — `GET /api/launch/decks`.
+ * A network/parse failure is reported as a typed outcome, never as an empty deck list.
+ */
+export async function fetchDecks() {
+    try {
+        const res = await fetch(`${getAgentDeckApiUrl()}/api/launch/decks`, {
+            signal: AbortSignal.timeout(5000),
+        });
+        const json = (await res.json().catch(() => null));
+        if (!res.ok || !json || json.success === false) {
+            return {
+                ok: false,
+                code: "DECK_UNAVAILABLE",
+                message: json?.message ?? `Agent Deck API error: ${res.status}`,
+            };
+        }
+        return { ok: true, decks: json.data?.decks ?? [] };
+    }
+    catch (e) {
+        return { ok: false, code: "DECK_UNAVAILABLE", message: String(e) };
+    }
 }
+/** @deprecated Prefer `fetchDecks` — alias kept for existing call sites. */
+export const fetchAuthorizedDecks = fetchDecks;
 const DASHBOARD_HEADERS = { "x-agent-deck-client": "dashboard" };
 const DEALER_HEADERS = { "x-agent-deck-client": "dealer" };
 export async function proposePlaybookPatch(deckId, runId, proposal) {
@@ -173,7 +190,7 @@ export function toCallServiceToolPayload(toolCall) {
         arguments: toolCall.arguments,
     };
 }
-function extractPermalink(toolResult) {
+export function extractPermalink(toolResult) {
     if (!toolResult || typeof toolResult !== "object")
         return undefined;
     const content = toolResult.content;
@@ -279,34 +296,5 @@ function formatToolResultText(tr) {
         .join("\n")
         .trim() || undefined;
 }
-export async function deliverOutboundDraft(deckId, toolCall, opts) {
-    const payload = toCallServiceToolPayload(toolCall);
-    const workspaceRoot = opts?.workspaceRoot ?? process.cwd();
-    const timeoutMs = opts?.timeoutMs ?? Number(process.env.DELIVER_TIMEOUT_MS ?? 60_000);
-    const callTool = opts?.callTool ??
-        (async (p) => {
-            const mcpBase = getAgentDeckMcpUrl().replace(/\/mcp\/?$/, "");
-            const transport = new StreamableHTTPClientTransport(new URL(`${mcpBase}/mcp`));
-            const client = new Client({ name: "agent-dealer-deliver", version: "0.0.1" });
-            const connectAndCall = async () => {
-                await client.connect(transport);
-                try {
-                    await client.callTool({
-                        name: "bind_workspace",
-                        arguments: { deckId, workspaceRoot },
-                    });
-                    return await client.callTool({ name: "call_service_tool", arguments: p });
-                }
-                finally {
-                    await client.close();
-                }
-            };
-            return await Promise.race([
-                connectAndCall(),
-                new Promise((_, reject) => setTimeout(() => reject(new Error(`Outbound deliver timed out after ${timeoutMs}ms`)), timeoutMs)),
-            ]);
-        });
-    const toolResult = await callTool(payload);
-    assertCallServiceToolSuccess(toolResult);
-    return { toolResult, permalink: extractPermalink(toolResult) };
-}
+// `deliverOutboundDraft` (deck-header MCP call for approved outbound delivery) has moved to
+// ./outbound-delivery.ts (NOT-106 / NOT-95).

package/bundle/server/dist/adapters/agent-deck.test.js

@@ -0,0 +1,63 @@
+// packages/server/src/adapters/agent-deck.test.ts
+//
+// NOT-106: fetchDecks hits unauthenticated GET /api/launch/decks.
+import { test, mock } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-agentdeck-"));
+const { migrate } = await import("../db/index.js");
+const { fetchDecks, fetchAuthorizedDecks } = await import("./agent-deck.js");
+migrate();
+test("fetchDecks returns decks on success from /api/launch/decks", async () => {
+    let capturedUrl = "";
+    const fetchMock = mock.method(globalThis, "fetch", async (url, init) => {
+        capturedUrl = String(url);
+        assert.equal(init?.headers?.Authorization, undefined);
+        return new Response(JSON.stringify({ success: true, data: { decks: [{ id: "d1", name: "personal-dev" }] } }), { status: 200 });
+    });
+    try {
+        const result = await fetchDecks();
+        assert.equal(result.ok, true);
+        if (result.ok)
+            assert.deepEqual(result.decks, [{ id: "d1", name: "personal-dev" }]);
+        assert.match(capturedUrl, /\/api\/launch\/decks$/);
+    }
+    finally {
+        fetchMock.mock.restore();
+    }
+});
+test("fetchDecks reports DECK_UNAVAILABLE on HTTP error, never an empty list", async () => {
+    const fetchMock = mock.method(globalThis, "fetch", async () => {
+        return new Response(JSON.stringify({ success: false, message: "boom" }), { status: 500 });
+    });
+    try {
+        const result = await fetchDecks();
+        assert.equal(result.ok, false);
+        if (!result.ok) {
+            assert.equal(result.code, "DECK_UNAVAILABLE");
+            assert.match(result.message, /boom|500/);
+        }
+    }
+    finally {
+        fetchMock.mock.restore();
+    }
+});
+test("fetchDecks reports DECK_UNAVAILABLE on a network error, never an empty list", async () => {
+    const fetchMock = mock.method(globalThis, "fetch", async () => {
+        throw new Error("ECONNREFUSED");
+    });
+    try {
+        const result = await fetchDecks();
+        assert.equal(result.ok, false);
+        if (!result.ok)
+            assert.equal(result.code, "DECK_UNAVAILABLE");
+    }
+    finally {
+        fetchMock.mock.restore();
+    }
+});
+test("fetchAuthorizedDecks is an alias of fetchDecks", () => {
+    assert.equal(fetchAuthorizedDecks, fetchDecks);
+});