@hotmeshio/long-tail 0.23.2 → 0.24.0

package/build/services/workflow-invocation.d.ts

@@ -53,7 +53,20 @@ export declare class InvocationError extends Error {
  */
 export declare function invokeWorkflow(input: InvokeWorkflowInput): Promise<InvokeWorkflowResult>;
 /**
- * Check invocation_roles when present on a workflow config.
- * Throws InvocationError if the user lacks the required role.
+ * Check a caller against the workflow's invocation rules, from the caller's
+ * live grants rather than any role claim a token carries. A workflow with no
+ * invocation roles is open, except a system-authority workflow, which needs a
+ * superadmin.
  */
-export declare function checkInvocationRoles(workflowType: string, userId: string, authRole?: string): Promise<void>;
+export declare function checkInvocationRoles(workflowType: string, userId: string): Promise<void>;
+/** Refuse an execute_as override that would exceed the caller's own authority. */
+export declare function assertMayActAs(userId: string, executeAs: string): Promise<void>;
+/**
+ * Authorize an invocation that arrives from outside the process (REST, /mcp):
+ * the workflow's invocation rules, then any execute_as override.
+ */
+export declare function authorizeInvocation(input: {
+    workflowType: string;
+    userId: string;
+    executeAs?: string;
+}): Promise<void>;

package/build/services/workflow-invocation.js

@@ -45,8 +45,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.InvocationError = void 0;
 exports.invokeWorkflow = invokeWorkflow;
 exports.checkInvocationRoles = checkInvocationRoles;
+exports.assertMayActAs = assertMayActAs;
+exports.authorizeInvocation = authorizeInvocation;
 const hotmesh_1 = require("@hotmeshio/hotmesh");
 const invocation_access_1 = require("./invocation-access");
+const uuid_1 = require("../lib/uuid");
 const workers_1 = require("../workers");
 const configService = __importStar(require("./config"));
 const userService = __importStar(require("./user"));
@@ -138,26 +141,55 @@ async function resolveTaskQueue(workflowType) {
     }
     return worker.taskQueue;
 }
+/** A principal's grants by uuid or external_id, or null when no such user exists. */
+async function grantsOf(identifier) {
+    const user = (0, uuid_1.isUuid)(identifier)
+        ? await userService.getUser(identifier)
+        : await userService.getUserByExternalId(identifier);
+    return user ? user.roles.map((r) => ({ role: r.role, type: r.type })) : null;
+}
 /**
- * Check invocation_roles when present on a workflow config.
- * Throws InvocationError if the user lacks the required role.
+ * Check a caller against the workflow's invocation rules, from the caller's
+ * live grants rather than any role claim a token carries. A workflow with no
+ * invocation roles is open, except a system-authority workflow, which needs a
+ * superadmin.
  */
-async function checkInvocationRoles(workflowType, userId, authRole) {
+async function checkInvocationRoles(workflowType, userId) {
     const wfConfig = await configService.getWorkflowConfig(workflowType);
-    if (!wfConfig || wfConfig.invocation_roles.length === 0)
-        return;
-    // Superadmin from JWT bypasses all invocation role checks
-    if (authRole === 'superadmin')
+    const systemAuthority = invocation_access_1.SYSTEM_AUTHORITY_WORKFLOWS.has(workflowType);
+    if (!systemAuthority && (!wfConfig || wfConfig.invocation_roles.length === 0))
         return;
-    const user = await userService.getUser(userId);
-    if (!user) {
+    const roles = await grantsOf(userId);
+    if (!roles) {
         throw new InvocationError('User not registered', 403);
     }
     // invocable is resolveTaskQueue's concern; this gate decides roles only.
-    if (!(0, invocation_access_1.canInvokeWorkflow)({ ...wfConfig, invocable: true }, user.roles, authRole)) {
+    const rules = { workflow_type: workflowType, invocation_roles: wfConfig?.invocation_roles ?? [], invocable: true };
+    if (!(0, invocation_access_1.canInvokeWorkflow)(rules, roles)) {
         throw new InvocationError('Insufficient role for invocation', 403);
     }
 }
+/** Refuse an execute_as override that would exceed the caller's own authority. */
+async function assertMayActAs(userId, executeAs) {
+    const caller = await grantsOf(userId);
+    if (!caller)
+        throw new InvocationError('User not registered', 403);
+    const target = await grantsOf(executeAs);
+    if (!target)
+        throw new InvocationError(`execute_as principal "${executeAs}" not found`, 404);
+    if (!(0, invocation_access_1.mayActAs)(caller, target)) {
+        throw new InvocationError('execute_as may not exceed your own authority', 403);
+    }
+}
+/**
+ * Authorize an invocation that arrives from outside the process (REST, /mcp):
+ * the workflow's invocation rules, then any execute_as override.
+ */
+async function authorizeInvocation(input) {
+    await checkInvocationRoles(input.workflowType, input.userId);
+    if (input.executeAs)
+        await assertMayActAs(input.userId, input.executeAs);
+}
 /**
  * Build the LTEnvelope with IAM context.
  */

package/build/services/yaml-workflow/deployer.d.ts

@@ -27,10 +27,18 @@ export declare function deployYamlWorkflow(appId: string, yamlContent: string):
  * Activate a deployed version of a YAML workflow.
  */
 export declare function activateYamlWorkflow(appId: string, version: string): Promise<boolean>;
+/** The key compiled workflow activities read their identity context from. */
+export declare const SCOPE_KEY = "_scope";
+/**
+ * The trigger data a compiled workflow starts with. Identity context is never
+ * taken from the data a caller supplied: any `_scope` there is dropped, and
+ * only the scope the server resolved is set.
+ */
+export declare function withTrustedScope(data: Record<string, unknown>, scope?: Record<string, unknown>): Record<string, unknown>;
 /**
  * Invoke a YAML workflow (fire-and-forget). Returns the job ID.
  */
-export declare function invokeYamlWorkflow(appId: string, topic: string, data: Record<string, unknown>, entity?: string, context?: Record<string, any>): Promise<string>;
+export declare function invokeYamlWorkflow(appId: string, topic: string, data: Record<string, unknown>, entity?: string, context?: Record<string, any>, scope?: Record<string, unknown>): Promise<string>;
 /**
  * Invoke a YAML workflow and wait for the result.
  *
@@ -40,7 +48,7 @@ export declare function invokeYamlWorkflow(appId: string, topic: string, data: R
  *
  * Source: @hotmeshio/hotmesh engine/index.js pubsub()
  */
-export declare function invokeYamlWorkflowSync(appId: string, topic: string, data: Record<string, unknown>, timeout?: number, entity?: string): Promise<{
+export declare function invokeYamlWorkflowSync(appId: string, topic: string, data: Record<string, unknown>, timeout?: number, entity?: string, scope?: Record<string, unknown>): Promise<{
     job_id: string;
     result: Record<string, unknown>;
 }>;

package/build/services/yaml-workflow/deployer.js

@@ -33,11 +33,12 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildMergedYaml = void 0;
+exports.SCOPE_KEY = exports.buildMergedYaml = void 0;
 exports.getEngine = getEngine;
 exports.deployAppId = deployAppId;
 exports.deployYamlWorkflow = deployYamlWorkflow;
 exports.activateYamlWorkflow = activateYamlWorkflow;
+exports.withTrustedScope = withTrustedScope;
 exports.invokeYamlWorkflow = invokeYamlWorkflow;
 exports.invokeYamlWorkflowSync = invokeYamlWorkflowSync;
 exports.stopEngine = stopEngine;
@@ -142,12 +143,23 @@ async function activateYamlWorkflow(appId, version) {
     logger_1.loggerRegistry.info(`[yaml-workflow] activated ${appId} v${version}`);
     return result;
 }
+/** The key compiled workflow activities read their identity context from. */
+exports.SCOPE_KEY = '_scope';
+/**
+ * The trigger data a compiled workflow starts with. Identity context is never
+ * taken from the data a caller supplied: any `_scope` there is dropped, and
+ * only the scope the server resolved is set.
+ */
+function withTrustedScope(data, scope) {
+    const { [exports.SCOPE_KEY]: _dropped, ...rest } = data ?? {};
+    return scope ? { ...rest, [exports.SCOPE_KEY]: scope } : rest;
+}
 /**
  * Invoke a YAML workflow (fire-and-forget). Returns the job ID.
  */
-async function invokeYamlWorkflow(appId, topic, data, entity, context) {
+async function invokeYamlWorkflow(appId, topic, data, entity, context, scope) {
     const engine = await getEngine(appId);
-    return engine.pub(topic, data, context, entity ? { entity } : undefined);
+    return engine.pub(topic, withTrustedScope(data, scope), context, entity ? { entity } : undefined);
 }
 /**
  * Invoke a YAML workflow and wait for the result.
@@ -158,7 +170,7 @@ async function invokeYamlWorkflow(appId, topic, data, entity, context) {
  *
  * Source: @hotmeshio/hotmesh engine/index.js pubsub()
  */
-async function invokeYamlWorkflowSync(appId, topic, data, timeout, entity) {
+async function invokeYamlWorkflowSync(appId, topic, data, timeout, entity, scope) {
     const hotmesh = await getEngine(appId);
     const engine = hotmesh.engine;
     const timeoutMs = timeout ?? defaults_1.WORKFLOW_SYNC_TIMEOUT_MS;
@@ -171,7 +183,7 @@ async function invokeYamlWorkflowSync(appId, topic, data, timeout, entity) {
     };
     // Publish with entity via extended param
     const extended = entity ? { entity } : undefined;
-    const jobId = await engine.pub(topic, data, context, extended);
+    const jobId = await engine.pub(topic, withTrustedScope(data, scope), context, extended);
     return new Promise((resolve, reject) => {
         engine.registerJobCallback(jobId, (_topic, output) => {
             if (output.metadata.err) {

package/build/services/yaml-workflow/invoke.js

@@ -37,36 +37,37 @@ exports.invokeYamlWorkflow = invokeYamlWorkflow;
 const yamlDeployer = __importStar(require("./deployer"));
 const principal_1 = require("../iam/principal");
 const publish_1 = require("../../lib/events/publish");
+/**
+ * The identity context compiled workflow activities run under, from the
+ * server-side identity: execute_as with the invoker as initiator, else the
+ * invoker. Never read from the caller's data.
+ */
+async function resolveScope(executeAs, userId) {
+    if (executeAs) {
+        const [botPrincipal, invokerPrincipal] = await Promise.all([
+            (0, principal_1.resolvePrincipal)(executeAs),
+            userId ? (0, principal_1.resolvePrincipal)(userId) : Promise.resolve(null),
+        ]);
+        if (!botPrincipal)
+            return undefined;
+        return {
+            principal: botPrincipal,
+            scopes: ['mcp:tool:call'],
+            ...(invokerPrincipal ? { initiatedBy: userId, initiatingPrincipal: invokerPrincipal } : {}),
+        };
+    }
+    if (!userId)
+        return undefined;
+    const principal = await (0, principal_1.resolvePrincipal)(userId);
+    return principal ? { principal, scopes: ['mcp:tool:call'] } : undefined;
+}
 /**
  * Invoke a YAML workflow with scope injection.
  * Shared by HTTP route and cron callback.
  */
 async function invokeYamlWorkflow(wf, options = {}) {
     const data = { ...(options.data || {}) };
-    // Inject _scope so compiled workflow activities have identity context
-    if (!data._scope) {
-        const executeAs = options.execute_as;
-        const userId = options.userId;
-        if (executeAs) {
-            const [botPrincipal, invokerPrincipal] = await Promise.all([
-                (0, principal_1.resolvePrincipal)(executeAs),
-                userId ? (0, principal_1.resolvePrincipal)(userId) : Promise.resolve(null),
-            ]);
-            if (botPrincipal) {
-                data._scope = {
-                    principal: botPrincipal,
-                    scopes: ['mcp:tool:call'],
-                    ...(invokerPrincipal ? { initiatedBy: userId, initiatingPrincipal: invokerPrincipal } : {}),
-                };
-            }
-        }
-        else if (userId) {
-            const principal = await (0, principal_1.resolvePrincipal)(userId);
-            if (principal) {
-                data._scope = { principal, scopes: ['mcp:tool:call'] };
-            }
-        }
-    }
+    const scope = await resolveScope(options.execute_as, options.userId);
     if (options.source) {
         if (!data._metadata)
             data._metadata = {};
@@ -85,7 +86,7 @@ async function invokeYamlWorkflow(wf, options = {}) {
             status: 'running',
         });
         try {
-            const { job_id, result } = await yamlDeployer.invokeYamlWorkflowSync(wf.app_id, wf.graph_topic, data, options.timeout, wf.graph_topic);
+            const { job_id, result } = await yamlDeployer.invokeYamlWorkflowSync(wf.app_id, wf.graph_topic, data, options.timeout, wf.graph_topic, scope);
             (0, publish_1.publishWorkflowEvent)({
                 type: 'workflow.completed',
                 source: 'graph',
@@ -121,7 +122,7 @@ async function invokeYamlWorkflow(wf, options = {}) {
             },
         }
         : undefined;
-    const jobId = await yamlDeployer.invokeYamlWorkflow(wf.app_id, wf.graph_topic, data, wf.graph_topic, context);
+    const jobId = await yamlDeployer.invokeYamlWorkflow(wf.app_id, wf.graph_topic, data, wf.graph_topic, context, scope);
     (0, publish_1.publishWorkflowEvent)({
         type: 'workflow.started',
         source: 'graph',

package/build/start/config.js

@@ -100,6 +100,13 @@ async function applyServerAuthConfig(startConfig) {
             baseUrl: startConfig.auth.oauth.baseUrl,
         });
     }
+    const oauthServer = startConfig.auth?.oauthServer
+        ?? (config_1.config.LT_OAUTH_ISSUER ? { issuer: config_1.config.LT_OAUTH_ISSUER } : undefined);
+    if (oauthServer) {
+        const { setOAuthServerConfig } = await Promise.resolve().then(() => __importStar(require('../modules/oauth-server')));
+        setOAuthServerConfig(oauthServer);
+        logger_1.loggerRegistry.info(`[long-tail] OAuth authorization server enabled — issuer ${oauthServer.issuer}`);
+    }
     // SSO — store config for requireAuth fallback and /api/auth/sso exchange
     if (startConfig.auth?.sso) {
         const { setSSOConfig } = await Promise.resolve().then(() => __importStar(require('../modules/sso')));

package/build/start/index.js

@@ -13,10 +13,8 @@ const config_1 = require("./config");
 const adapters_1 = require("./adapters");
 const workers_1 = require("./workers");
 const server_1 = require("./server");
-const socketio_1 = require("../lib/events/socketio");
+const express_1 = require("../adapters/express");
 const system_events_1 = require("../lib/events/system-events");
-const nats_1 = require("../lib/events/nats");
-const nats_ws_proxy_1 = require("../lib/events/nats-ws-proxy");
 /**
  * Start Long Tail with a declarative configuration.
  *
@@ -75,25 +73,9 @@ async function start(startConfig) {
     const serverEnabled = startConfig.server?.enabled !== false;
     let httpServer = null;
     if (serverEnabled) {
-        httpServer = (0, server_1.startServer)();
-        // Attach socket.io adapter to the HTTP server (if registered)
-        const socketAdapter = events_1.eventRegistry.getAdapter(socketio_1.SocketIOEventAdapter);
-        if (socketAdapter && httpServer) {
-            socketAdapter.attachServer(httpServer);
-            await socketAdapter.connect();
-        }
-        // Attach NATS WebSocket proxy (if configured)
-        const natsAdapter = events_1.eventRegistry.getAdapter(nats_1.NatsEventAdapter);
-        if (natsAdapter?.wsProxyTarget && httpServer) {
-            (0, nats_ws_proxy_1.attachNatsWsProxy)(httpServer, natsAdapter.wsProxyTarget, {
-                onWsUrlDerived: (url) => {
-                    // Auto-set wsUrl if not explicitly configured
-                    if (!natsAdapter.wsUrl) {
-                        natsAdapter.setWsUrl(url);
-                    }
-                },
-            });
-        }
+        const adapter = new express_1.LTExpressAdapter();
+        httpServer = (0, server_1.startServer)(adapter);
+        await adapter.attachServer(httpServer);
     }
     // 7. Return instance
     const connection = (0, workers_1.buildConnection)();

package/build/start/server.d.ts

@@ -1,6 +1,8 @@
-import express from 'express';
+import type { Server } from 'http';
+import { LTExpressAdapter } from '../adapters/express';
 /**
- * Create and start the embedded Express server with health check,
- * API routes, and optional dashboard static assets.
+ * Create and start the standalone server. It owns its app and mounts the
+ * same router an embedding host mounts, at the root, so standalone and
+ * embedded deployments serve one surface.
  */
-export declare function startServer(): ReturnType<typeof express.application.listen>;
+export declare function startServer(adapter: LTExpressAdapter): Server;

package/build/start/server.js

@@ -1,52 +1,28 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.startServer = startServer;
-const fs_1 = require("fs");
-const path_1 = __importDefault(require("path"));
-const express_1 = __importDefault(require("express"));
+const http_1 = require("../lib/http");
 const config_1 = require("../modules/config");
 const logger_1 = require("../lib/logger");
-const routes_1 = __importDefault(require("../routes"));
-const mcp_endpoint_1 = __importDefault(require("../routes/mcp-endpoint"));
 /**
- * Create and start the embedded Express server with health check,
- * API routes, and optional dashboard static assets.
+ * Create and start the standalone server. It owns its app and mounts the
+ * same router an embedding host mounts, at the root, so standalone and
+ * embedded deployments serve one surface.
  */
-function startServer() {
-    const app = (0, express_1.default)();
+function startServer(adapter) {
+    const app = (0, http_1.createApp)();
     if (process.env.NODE_ENV !== 'production') {
         app.disable('etag');
     }
-    app.use(express_1.default.json());
-    app.get('/health', (_req, res) => {
-        res.json({ status: 'ok', timestamp: new Date().toISOString() });
-    });
-    app.use('/api', routes_1.default);
-    app.use('/mcp', mcp_endpoint_1.default);
-    // Serve dashboard static assets
-    // Resolves correctly in both dev (ts-node from root) and prod (node build/)
-    const devDist = path_1.default.join(__dirname, '..', 'dashboard', 'dist');
-    const prodDist = path_1.default.join(__dirname, '..', '..', 'dashboard', 'dist');
-    const dashboardDist = (0, fs_1.existsSync)(devDist) ? devDist : prodDist;
-    if ((0, fs_1.existsSync)(dashboardDist)) {
-        app.use(express_1.default.static(dashboardDist, { index: false }));
-        // SPA fallback — inject <base href="/"> so relative asset paths
-        // resolve from root regardless of route depth (e.g. /admin/users).
-        // Read on each request so dashboard rebuilds take effect without restart.
-        const indexPath = path_1.default.join(dashboardDist, 'index.html');
-        app.get('/{*splat}', (_req, res) => {
-            const html = (0, fs_1.readFileSync)(indexPath, 'utf-8').replace('<head>', '<head><base href="/">');
-            res.type('html').send(html);
-        });
-        logger_1.loggerRegistry.info(`[long-tail] Dashboard: http://localhost:${config_1.config.PORT}/`);
-    }
+    app.use(adapter.getWellKnownRouter());
+    app.use(adapter.getRouter());
     const httpServer = app.listen(config_1.config.PORT, () => {
         logger_1.loggerRegistry.info(`[long-tail] server running on port ${config_1.config.PORT}`);
         logger_1.loggerRegistry.info(`[long-tail] API: http://localhost:${config_1.config.PORT}/api`);
         logger_1.loggerRegistry.info(`[long-tail] Health: http://localhost:${config_1.config.PORT}/health`);
+        if (adapter.hasDashboard()) {
+            logger_1.loggerRegistry.info(`[long-tail] Dashboard: http://localhost:${config_1.config.PORT}/`);
+        }
     });
     return httpServer;
 }

package/build/start/socket-auth.js

@@ -23,7 +23,8 @@ function createSocketIOAuthenticator(startConfig) {
     return (token) => {
         try {
             const payload = jsonwebtoken_1.default.verify(token, secret);
-            return !!(payload && typeof payload === 'object' && payload.userId);
+            const userId = payload && typeof payload === 'object' ? payload.userId : undefined;
+            return typeof userId === 'string' && userId ? { userId } : false;
         }
         catch {
             return false;

package/build/start/workers.js

@@ -315,7 +315,7 @@ async function startWorkers(startConfig, workers, builtinMcpServerFactories) {
         };
         // 1. Register all factories (runtime — always applied)
         for (const [name, entry] of Object.entries(allFactories)) {
-            registerBuiltinServer(name, entry.factory);
+            registerBuiltinServer(name, entry.factory, entry.config?.toolManifest);
         }
         logger_1.loggerRegistry.info(`[long-tail] ${Object.keys(allFactories).length} MCP server factories registered`);
         // Set exposure config for the /mcp endpoint

package/build/system/mcp-servers/admin/agent-subscriptions.js

@@ -35,7 +35,22 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerAgentSubscriptionTools = registerAgentSubscriptionTools;
 const api = __importStar(require("../../../api/agent-subscriptions"));
+const authority_1 = require("../../../services/agent/authority");
+const workflow_invocation_1 = require("../../../services/workflow-invocation");
+const caller_auth_1 = require("../caller-auth");
 const schemas_1 = require("./schemas");
+/** An MCP error for a refused authority check; null when the call may go on. */
+async function refusal(check) {
+    try {
+        await check();
+        return null;
+    }
+    catch (err) {
+        if (!(err instanceof workflow_invocation_1.InvocationError))
+            throw err;
+        return { content: [{ type: 'text', text: JSON.stringify({ error: err.message }) }], isError: true };
+    }
+}
 function registerAgentSubscriptionTools(server) {
     // mirrors GET /api/agents/:agentId/subscriptions
     server.registerTool('list_agent_subscriptions', {
@@ -55,8 +70,16 @@ function registerAgentSubscriptionTools(server) {
         description: 'Create an event subscription for an agent. When events match the ' +
             'topic pattern, the configured reaction is triggered.',
         inputSchema: schemas_1.createAgentSubscriptionSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
         const { agent_id, ...body } = args;
+        const caller = (0, caller_auth_1.externalCaller)(extra);
+        const refused = caller
+            ? await refusal(() => (0, authority_1.assertMayConfigureSubscription)(caller.userId, {
+                agentId: agent_id, reaction_type: body.reaction_type, execute_as: body.execute_as,
+            }))
+            : null;
+        if (refused)
+            return refused;
         const result = await api.createSubscription({ agentId: agent_id, ...body });
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };

package/build/system/mcp-servers/admin/agents.js

@@ -35,7 +35,22 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerAgentTools = registerAgentTools;
 const api = __importStar(require("../../../api/agents"));
+const authority_1 = require("../../../services/agent/authority");
+const workflow_invocation_1 = require("../../../services/workflow-invocation");
+const caller_auth_1 = require("../caller-auth");
 const schemas_1 = require("./schemas");
+/** An MCP error for a refused authority check; null when the call may go on. */
+async function refusal(check) {
+    try {
+        await check();
+        return null;
+    }
+    catch (err) {
+        if (!(err instanceof workflow_invocation_1.InvocationError))
+            throw err;
+        return { content: [{ type: 'text', text: JSON.stringify({ error: err.message }) }], isError: true };
+    }
+}
 function registerAgentTools(server) {
     // mirrors GET /api/agents
     server.registerTool('list_agents', {
@@ -69,7 +84,11 @@ function registerAgentTools(server) {
         description: 'Create a new agent automation with identity, goals, rules, ' +
             'optional schedules, and event subscriptions.',
         inputSchema: schemas_1.createAgentSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const caller = (0, caller_auth_1.externalCaller)(extra);
+        const refused = caller ? await refusal(() => (0, authority_1.assertMayConfigureAgent)(caller.userId, { ...args, id: undefined })) : null;
+        if (refused)
+            return refused;
         const result = await api.createAgent(args);
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
@@ -81,7 +100,11 @@ function registerAgentTools(server) {
         title: 'Update Agent',
         description: 'Update an existing agent automation.',
         inputSchema: schemas_1.updateAgentSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const caller = (0, caller_auth_1.externalCaller)(extra);
+        const refused = caller ? await refusal(() => (0, authority_1.assertMayConfigureAgent)(caller.userId, args)) : null;
+        if (refused)
+            return refused;
         const result = await api.updateAgent(args);
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };

package/build/system/mcp-servers/admin/announcements.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerAnnouncementTools = registerAnnouncementTools;
 const zod_1 = require("zod");
 const api = __importStar(require("../../../api/announcements"));
+const caller_auth_1 = require("../caller-auth");
 const publishAnnouncementSchema = zod_1.z.object({
     body: zod_1.z.string().describe('Markdown body — the only required field.'),
     title: zod_1.z.string().optional().describe('Headline shown on the collapsed banner.'),
@@ -53,14 +54,14 @@ function registerAnnouncementTools(server) {
             '(default 24h) are optional. Bodies broadcast to all authenticated ' +
             'subscribers — never include secrets.',
         inputSchema: publishAnnouncementSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
         const result = await api.createAnnouncement({
             body: args.body,
             title: args.title,
             layout: args.layout,
             roles: args.roles,
             expiresAt: args.expires_at,
-        }, { userId: 'lt-system', role: 'superadmin' });
+        }, (0, caller_auth_1.externalCaller)(extra) ?? { userId: 'lt-system', role: 'superadmin' });
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }

package/build/system/mcp-servers/admin/bot-accounts.js

@@ -35,7 +35,23 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerBotAccountTools = registerBotAccountTools;
 const api = __importStar(require("../../../api/bot-accounts"));
+const bot_api_key_1 = require("../../../services/auth/bot-api-key");
+const capabilities_1 = require("../../../modules/capabilities");
+const caller_auth_1 = require("../caller-auth");
 const schemas_1 = require("./schemas");
+/** An MCP error for a refused decision; null when the call may go on. */
+function refusal(decision) {
+    if (decision.allowed)
+        return null;
+    return { content: [{ type: 'text', text: JSON.stringify({ error: decision.error }) }], isError: true };
+}
+/** For a /mcp caller, the account rule on `botId`; internal calls act as lt-system. */
+async function accountRefusal(extra, botId) {
+    const caller = (0, caller_auth_1.externalCaller)(extra);
+    if (!caller || !botId)
+        return null;
+    return refusal(await (0, capabilities_1.mayManageAccount)(caller.userId, botId));
+}
 function registerBotAccountTools(server) {
     // mirrors GET /api/bot-accounts
     server.registerTool('list_bot_accounts', {
@@ -67,7 +83,11 @@ function registerBotAccountTools(server) {
         description: 'Create a new bot (service) account with optional roles. ' +
             'Bot accounts can run workflows and hold API keys.',
         inputSchema: schemas_1.createBotSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const caller = (0, caller_auth_1.externalCaller)(extra);
+        const refused = caller ? refusal(await (0, capabilities_1.mayGrantRoles)(caller.userId, args.roles)) : null;
+        if (refused)
+            return refused;
         const result = await api.createBot(args);
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
@@ -79,7 +99,10 @@ function registerBotAccountTools(server) {
         title: 'Update Bot Account',
         description: 'Update a bot account (display name, description, status).',
         inputSchema: schemas_1.updateBotSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const refused = await accountRefusal(extra, args.id);
+        if (refused)
+            return refused;
         const result = await api.updateBot(args);
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
@@ -91,7 +114,10 @@ function registerBotAccountTools(server) {
         title: 'Delete Bot Account',
         description: 'Delete a bot account and all its API keys.',
         inputSchema: schemas_1.deleteBotSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const refused = await accountRefusal(extra, args.id);
+        if (refused)
+            return refused;
         const result = await api.deleteBot(args);
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
@@ -104,7 +130,10 @@ function registerBotAccountTools(server) {
         description: 'Generate a new API key for a bot account. Returns the raw key ' +
             'ONCE — it cannot be retrieved again.',
         inputSchema: schemas_1.createBotApiKeySchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const refused = await accountRefusal(extra, args.id);
+        if (refused)
+            return refused;
         const result = await api.createBotKey(args);
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
@@ -116,7 +145,10 @@ function registerBotAccountTools(server) {
         title: 'Revoke Bot API Key',
         description: 'Revoke (delete) an API key for a bot account.',
         inputSchema: schemas_1.revokeBotKeySchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const refused = (0, caller_auth_1.externalCaller)(extra) ? await accountRefusal(extra, await (0, bot_api_key_1.getBotApiKeyOwner)(args.key_id)) : null;
+        if (refused)
+            return refused;
         const result = await api.revokeBotKey({ keyId: args.key_id });
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };

package/build/system/mcp-servers/admin/escalations.d.ts

@@ -1,11 +1,9 @@
 /**
  * Escalation tools — mirrors routes/escalations/
  *
- * Every tool runs as the `lt-system` bot. The escalation RBAC helpers
- * (getVisibleRoles / getUserRoles / hasGlobalEscalationAccess) query a uuid
- * column, so the bot's external_id string ('lt-system') would blow up with
- * `invalid input syntax for type uuid`. `systemAuth()` resolves the bot's real
- * UUID once and caches it; that UUID (a superadmin) is passed as the principal.
+ * A call that arrived at `/mcp` runs as its caller, so the escalation RBAC in
+ * api/ applies to them exactly as it does over REST. Internal calls from
+ * workflows and agents run as the `lt-system` bot.
  */
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 export declare function registerEscalationTools(server: McpServer): void;