feat(warden): ship warden as a workspace agent package

Extract @corbits/agent-warden following the agents/explorer precedent
(PR #1339): byte-identical prompt, order-identical tools, registry imports
the workspace dep, in-tree package.ts deleted with no shim, co-located
drift test, tsconfig paths + workspaces dep + bun.lock.

Fixes CL-9803

Author: TheGreatAxios

agents/warden/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "@corbits/agent-warden",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "license": "SEE LICENSE IN LICENSE.md",
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "default": "./src/index.ts"
+    }
+  }
+}

src/agent/directors/warden/package.ts agents/warden/src/index.tssrc/agent/directors/warden/package.ts renamed to agents/warden/src/index.ts

@@ -1,11 +1,48 @@
-import type { DirectorPackage } from "../types.js";
-import { REVIEW_TOOLS } from "../tool-sets.js";
-
 /**
  * Warden trust-review worker (CL-7657).
  * Permission / provider-auth / plugin-loader diffs only; findings, never fixes.
+ *
+ * Ships as the @corbits/agent-warden workspace package: the tool allowlist
+ * lives here so the package stays importable without the app. Drift against
+ * the app build surface fails src/agent/directors/warden/package.test.ts.
  */
-export const wardenPackage: DirectorPackage = {
+export type AgentPackage = {
+  readonly id: "warden";
+  readonly primaryIntent: string;
+  readonly outOfLane: readonly string[];
+  readonly description: string;
+  readonly systemPrompt: string;
+  /** Unset — warden never attaches skill bodies at spawn. */
+  readonly attachedSkills?: readonly string[];
+  /** Unset — warden declares no skill scope. */
+  readonly optionalSkills?: readonly string[];
+  readonly tools: {
+    readonly allow: readonly string[];
+  };
+  readonly spawn: {
+    readonly maySpawn: false;
+  };
+  readonly modelRole: "review";
+  readonly tier: "leaf";
+};
+
+const WARDEN_TOOLS = [
+  "read_file",
+  "grep",
+  "search_files",
+  "list_dir",
+  "lsp",
+  "run_shell",
+  "web_fetch",
+  "web_search",
+  "skill_search",
+  "use_skill",
+  "write_file",
+  "edit_file",
+  "delete_file",
+] as const;
+
+export const wardenPackage: AgentPackage = {
   id: "warden",
   primaryIntent:
     "Trust review of permission, provider-auth, and plugin-loader diffs; never fix product code",
@@ -16,10 +53,6 @@ export const wardenPackage: DirectorPackage = {
     "feature design",
   ],
   description: "Permission and trust review worker",
-  tools: { allow: REVIEW_TOOLS },
-  spawn: { maySpawn: false },
-  tier: "leaf",
-  modelRole: "review",
   systemPrompt: `You are WardenDirector (Warden), a specialist in Corbits Code.
 
 PRIMARY INTENT: trust review of permission, provider-auth, and plugin-loader diffs. Find trust defects with evidence; never fix product code. Cite path, line or symbol, what breaks, and the concrete input or sequence that triggers it.
@@ -45,4 +78,8 @@ OUT OF LANE → refuse or reclassify under Blockers:
 - implementing fixes (route to coder)
 - general code review outside trust paths (route to reviewer)
 - feature requirements or planning (route to planner)`,
+  tools: { allow: [...WARDEN_TOOLS] },
+  spawn: { maySpawn: false },
+  tier: "leaf",
+  modelRole: "review",
 };

bun.lock

@@ -86,6 +86,7 @@
     "tar": "^7.5.1"
   },
   "dependencies": {
+    "@corbits/agent-warden": "workspace:*",
     "@corbits/codex-provider": "0.1.1",
     "@corbits/oauth-core": "0.2.0",
     "@corbits/openai-responses": "0.2.1",

package.json

@@ -1,3 +1,4 @@
+import { wardenPackage } from "@corbits/agent-warden";
 import type { AgentProfile, CapabilityFilter } from "../profile-types.js";
 import { artistPackage } from "./artist/package.js";
 import { coderPackage } from "./coder/package.js";
@@ -9,7 +10,6 @@ import { proberPackage } from "./prober/package.js";
 import { qaLeadPackage } from "./qa-lead/package.js";
 import { reviewerPackage } from "./reviewer/package.js";
 import { shakespearePackage } from "./shakespeare/package.js";
-import { wardenPackage } from "./warden/package.js";
 import { formatDirectorSystemPrompt } from "./identity.js";
 import {
   DIRECTOR_IDS,

src/agent/directors/registry.ts

@@ -0,0 +1,25 @@
+import { describe, expect, test } from "bun:test";
+
+import { wardenPackage } from "@corbits/agent-warden";
+import { REVIEW_TOOLS } from "../tool-sets.js";
+import { DIRECTOR_REGISTRY } from "../registry.js";
+import type { DirectorPackage } from "../types.js";
+
+describe("wardenPackage", () => {
+  test("workspace package satisfies the director contract and feeds the registry", () => {
+    const asDirector: DirectorPackage = wardenPackage;
+    expect(asDirector.id).toBe("warden");
+    expect(DIRECTOR_REGISTRY.warden).toBe(wardenPackage);
+    expect([...wardenPackage.tools.allow]).toEqual([...REVIEW_TOOLS]);
+  });
+
+  test("extracted copy stays trust-review-scoped and non-spawning", () => {
+    expect(wardenPackage.tools.allow).toContain("read_file");
+    expect(wardenPackage.tools.allow).toContain("grep");
+    expect(wardenPackage.tools.allow).not.toContain("spawn_agent");
+    expect(wardenPackage.tools.allow).not.toContain("ask_operator");
+    expect(wardenPackage.spawn.maySpawn).toBe(false);
+    expect(wardenPackage.tier).toBe("leaf");
+    expect(wardenPackage.modelRole).toBe("review");
+  });
+});

src/agent/directors/warden/package.test.ts

@@ -5,6 +5,7 @@
     "composite": false,
     "baseUrl": ".",
     "paths": {
+      "@corbits/agent-warden": ["./agents/warden/src/index.ts"],
       "@corbits/provider-opencode-go": ["./packages/opencode-go/src/index.ts"],
       "@corbits/first-class-providers": [
         "./packages/first-class-providers/src/index.ts"