@hotmeshio/long-tail 0.23.2 → 0.24.1

package/build/services/yaml-workflow/deployer.js

@@ -33,11 +33,12 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildMergedYaml = void 0;
+exports.SCOPE_KEY = exports.buildMergedYaml = void 0;
 exports.getEngine = getEngine;
 exports.deployAppId = deployAppId;
 exports.deployYamlWorkflow = deployYamlWorkflow;
 exports.activateYamlWorkflow = activateYamlWorkflow;
+exports.withTrustedScope = withTrustedScope;
 exports.invokeYamlWorkflow = invokeYamlWorkflow;
 exports.invokeYamlWorkflowSync = invokeYamlWorkflowSync;
 exports.stopEngine = stopEngine;
@@ -142,12 +143,23 @@ async function activateYamlWorkflow(appId, version) {
     logger_1.loggerRegistry.info(`[yaml-workflow] activated ${appId} v${version}`);
     return result;
 }
+/** The key compiled workflow activities read their identity context from. */
+exports.SCOPE_KEY = '_scope';
+/**
+ * The trigger data a compiled workflow starts with. Identity context is never
+ * taken from the data a caller supplied: any `_scope` there is dropped, and
+ * only the scope the server resolved is set.
+ */
+function withTrustedScope(data, scope) {
+    const { [exports.SCOPE_KEY]: _dropped, ...rest } = data ?? {};
+    return scope ? { ...rest, [exports.SCOPE_KEY]: scope } : rest;
+}
 /**
  * Invoke a YAML workflow (fire-and-forget). Returns the job ID.
  */
-async function invokeYamlWorkflow(appId, topic, data, entity, context) {
+async function invokeYamlWorkflow(appId, topic, data, entity, context, scope) {
     const engine = await getEngine(appId);
-    return engine.pub(topic, data, context, entity ? { entity } : undefined);
+    return engine.pub(topic, withTrustedScope(data, scope), context, entity ? { entity } : undefined);
 }
 /**
  * Invoke a YAML workflow and wait for the result.
@@ -158,7 +170,7 @@ async function invokeYamlWorkflow(appId, topic, data, entity, context) {
  *
  * Source: @hotmeshio/hotmesh engine/index.js pubsub()
  */
-async function invokeYamlWorkflowSync(appId, topic, data, timeout, entity) {
+async function invokeYamlWorkflowSync(appId, topic, data, timeout, entity, scope) {
     const hotmesh = await getEngine(appId);
     const engine = hotmesh.engine;
     const timeoutMs = timeout ?? defaults_1.WORKFLOW_SYNC_TIMEOUT_MS;
@@ -171,7 +183,7 @@ async function invokeYamlWorkflowSync(appId, topic, data, timeout, entity) {
     };
     // Publish with entity via extended param
     const extended = entity ? { entity } : undefined;
-    const jobId = await engine.pub(topic, data, context, extended);
+    const jobId = await engine.pub(topic, withTrustedScope(data, scope), context, extended);
     return new Promise((resolve, reject) => {
         engine.registerJobCallback(jobId, (_topic, output) => {
             if (output.metadata.err) {

package/build/services/yaml-workflow/invoke.js

@@ -36,37 +36,42 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.invokeYamlWorkflow = invokeYamlWorkflow;
 const yamlDeployer = __importStar(require("./deployer"));
 const principal_1 = require("../iam/principal");
+const workflow_invocation_1 = require("../workflow-invocation");
 const publish_1 = require("../../lib/events/publish");
+/**
+ * The identity context compiled workflow activities run under, from the
+ * server-side identity: execute_as with the invoker as initiator, else the
+ * invoker. Never read from the caller's data. An identity that does not
+ * resolve is refused rather than run with none.
+ */
+async function resolveScope(executeAs, userId) {
+    if (executeAs) {
+        const [botPrincipal, invokerPrincipal] = await Promise.all([
+            (0, principal_1.resolvePrincipal)(executeAs),
+            userId ? (0, principal_1.resolvePrincipal)(userId) : Promise.resolve(null),
+        ]);
+        if (!botPrincipal)
+            throw new workflow_invocation_1.InvocationError(`execute_as principal "${executeAs}" not found`, 404);
+        return {
+            principal: botPrincipal,
+            scopes: ['mcp:tool:call'],
+            ...(invokerPrincipal ? { initiatedBy: userId, initiatingPrincipal: invokerPrincipal } : {}),
+        };
+    }
+    if (!userId)
+        return undefined;
+    const principal = await (0, principal_1.resolvePrincipal)(userId);
+    if (!principal)
+        throw new workflow_invocation_1.InvocationError('User not registered', 403);
+    return { principal, scopes: ['mcp:tool:call'] };
+}
 /**
  * Invoke a YAML workflow with scope injection.
  * Shared by HTTP route and cron callback.
  */
 async function invokeYamlWorkflow(wf, options = {}) {
     const data = { ...(options.data || {}) };
-    // Inject _scope so compiled workflow activities have identity context
-    if (!data._scope) {
-        const executeAs = options.execute_as;
-        const userId = options.userId;
-        if (executeAs) {
-            const [botPrincipal, invokerPrincipal] = await Promise.all([
-                (0, principal_1.resolvePrincipal)(executeAs),
-                userId ? (0, principal_1.resolvePrincipal)(userId) : Promise.resolve(null),
-            ]);
-            if (botPrincipal) {
-                data._scope = {
-                    principal: botPrincipal,
-                    scopes: ['mcp:tool:call'],
-                    ...(invokerPrincipal ? { initiatedBy: userId, initiatingPrincipal: invokerPrincipal } : {}),
-                };
-            }
-        }
-        else if (userId) {
-            const principal = await (0, principal_1.resolvePrincipal)(userId);
-            if (principal) {
-                data._scope = { principal, scopes: ['mcp:tool:call'] };
-            }
-        }
-    }
+    const scope = await resolveScope(options.execute_as, options.userId);
     if (options.source) {
         if (!data._metadata)
             data._metadata = {};
@@ -85,7 +90,7 @@ async function invokeYamlWorkflow(wf, options = {}) {
             status: 'running',
         });
         try {
-            const { job_id, result } = await yamlDeployer.invokeYamlWorkflowSync(wf.app_id, wf.graph_topic, data, options.timeout, wf.graph_topic);
+            const { job_id, result } = await yamlDeployer.invokeYamlWorkflowSync(wf.app_id, wf.graph_topic, data, options.timeout, wf.graph_topic, scope);
             (0, publish_1.publishWorkflowEvent)({
                 type: 'workflow.completed',
                 source: 'graph',
@@ -121,7 +126,7 @@ async function invokeYamlWorkflow(wf, options = {}) {
             },
         }
         : undefined;
-    const jobId = await yamlDeployer.invokeYamlWorkflow(wf.app_id, wf.graph_topic, data, wf.graph_topic, context);
+    const jobId = await yamlDeployer.invokeYamlWorkflow(wf.app_id, wf.graph_topic, data, wf.graph_topic, context, scope);
     (0, publish_1.publishWorkflowEvent)({
         type: 'workflow.started',
         source: 'graph',

package/build/services/yaml-workflow/workers/register.js

@@ -40,10 +40,9 @@ const db_1 = require("../../../lib/db");
 const logger_1 = require("../../../lib/logger");
 const system_events_1 = require("../../../lib/events/system-events");
 const ephemeral_1 = require("../../iam/ephemeral");
-const mcpClient = __importStar(require("../../mcp/client"));
-const connection_1 = require("../../mcp/client/connection");
 const yamlDb = __importStar(require("../db"));
 const scope_1 = require("./scope");
+const step_tool_1 = require("./step-tool");
 const callbacks_1 = require("./callbacks");
 const events_1 = require("./events");
 /**
@@ -156,7 +155,7 @@ async function registerWorkersForWorkflow(workflow) {
                     delete mergedArgs._scope;
                     delete mergedArgs.workflowName;
                     mergedArgs = await (0, ephemeral_1.exchangeTokensInArgs)(mergedArgs);
-                    const result = await mcpClient.callServerTool(dbServerId, toolName, mergedArgs);
+                    const result = await (0, step_tool_1.callStepTool)(dbServerId, toolName, mergedArgs);
                     logger_1.loggerRegistry.debug(`[yaml-workflow:worker] leaving db/${toolName} wf=${wfName} resultKeys=[${Object.keys(result || {}).join(',')}]`);
                     return { metadata: { ...data.metadata }, data: result };
                 }),
@@ -230,16 +229,7 @@ async function registerWorkersForWorkflow(workflow) {
                     }
                     const exchangedArgs = await (0, ephemeral_1.exchangeTokensInArgs)(mergedArgs);
                     const coercedArgs = coerceNumericObjects(exchangedArgs);
-                    // Try direct dispatch for built-in servers (bypasses MCP transport).
-                    // Falls through to mcpClient.callServerTool() for external servers.
-                    let result;
-                    const builtin = await (0, connection_1.dispatchBuiltinTool)(serverId, toolName, coercedArgs);
-                    if (builtin) {
-                        result = builtin.result;
-                    }
-                    else {
-                        result = await mcpClient.callServerTool(serverId, toolName, coercedArgs);
-                    }
+                    const result = await (0, step_tool_1.callStepTool)(serverId, toolName, coercedArgs);
                     if (result && typeof result === 'object' && 'error' in result) {
                         logger_1.loggerRegistry.error(`[yaml-workflow:worker] ${toolName} error: ${JSON.stringify(result).slice(0, 200)}`);
                     }

package/build/services/yaml-workflow/workers/step-tool.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Call a step's tool. A built-in tool runs as the principal the workflow was
+ * started for (its `_scope`), under the tool's manifest gate, so a step never
+ * does more than its invoker may. A run started in-process with no principal
+ * calls it as lt-system. Other servers are called as before.
+ */
+export declare function callStepTool(serverId: string, toolName: string, args: Record<string, unknown>): Promise<any>;

package/build/services/yaml-workflow/workers/step-tool.js

@@ -0,0 +1,69 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.callStepTool = callStepTool;
+const context_1 = require("../../iam/context");
+const mcpClient = __importStar(require("../../mcp/client"));
+const connection_1 = require("../../mcp/client/connection");
+/**
+ * Call a step's tool. A built-in tool runs as the principal the workflow was
+ * started for (its `_scope`), under the tool's manifest gate, so a step never
+ * does more than its invoker may. A run started in-process with no principal
+ * calls it as lt-system. Other servers are called as before.
+ */
+async function callStepTool(serverId, toolName, args) {
+    const [{ builtinServerFor, builtinToolGate }, { currentToolPrincipal }] = await Promise.all([
+        Promise.resolve().then(() => __importStar(require('../../../api/mcp/tools'))),
+        Promise.resolve().then(() => __importStar(require('../../../system/workflows/shared/principal-tools'))),
+    ]);
+    const builtin = await builtinServerFor(serverId);
+    if (!builtin)
+        return mcpClient.callServerTool(serverId, toolName, args);
+    const principal = await currentToolPrincipal();
+    if (!principal) {
+        const dispatched = await (0, connection_1.dispatchBuiltinTool)(builtin, toolName, args);
+        if (!dispatched)
+            throw new Error(`Tool ${toolName} not found on ${builtin}`);
+        return dispatched.result;
+    }
+    if (!(await principal.access(builtinToolGate(builtin, toolName)))) {
+        return { error: `${toolName} is not available to this caller` };
+    }
+    const ctx = (0, context_1.getToolContext)();
+    const credentials = ctx?.principal.id
+        ? { userId: ctx.principal.id, delegationToken: ctx.credentials.delegationToken }
+        : undefined;
+    return mcpClient.callBuiltinToolAs(builtin, toolName, args, { userId: principal.userId }, credentials);
+}

package/build/start/config.js

@@ -100,6 +100,13 @@ async function applyServerAuthConfig(startConfig) {
             baseUrl: startConfig.auth.oauth.baseUrl,
         });
     }
+    const oauthServer = startConfig.auth?.oauthServer
+        ?? (config_1.config.LT_OAUTH_ISSUER ? { issuer: config_1.config.LT_OAUTH_ISSUER } : undefined);
+    if (oauthServer) {
+        const { setOAuthServerConfig } = await Promise.resolve().then(() => __importStar(require('../modules/oauth-server')));
+        setOAuthServerConfig(oauthServer);
+        logger_1.loggerRegistry.info(`[long-tail] OAuth authorization server enabled — issuer ${oauthServer.issuer}`);
+    }
     // SSO — store config for requireAuth fallback and /api/auth/sso exchange
     if (startConfig.auth?.sso) {
         const { setSSOConfig } = await Promise.resolve().then(() => __importStar(require('../modules/sso')));

package/build/start/index.js

@@ -13,10 +13,8 @@ const config_1 = require("./config");
 const adapters_1 = require("./adapters");
 const workers_1 = require("./workers");
 const server_1 = require("./server");
-const socketio_1 = require("../lib/events/socketio");
+const express_1 = require("../adapters/express");
 const system_events_1 = require("../lib/events/system-events");
-const nats_1 = require("../lib/events/nats");
-const nats_ws_proxy_1 = require("../lib/events/nats-ws-proxy");
 /**
  * Start Long Tail with a declarative configuration.
  *
@@ -75,25 +73,9 @@ async function start(startConfig) {
     const serverEnabled = startConfig.server?.enabled !== false;
     let httpServer = null;
     if (serverEnabled) {
-        httpServer = (0, server_1.startServer)();
-        // Attach socket.io adapter to the HTTP server (if registered)
-        const socketAdapter = events_1.eventRegistry.getAdapter(socketio_1.SocketIOEventAdapter);
-        if (socketAdapter && httpServer) {
-            socketAdapter.attachServer(httpServer);
-            await socketAdapter.connect();
-        }
-        // Attach NATS WebSocket proxy (if configured)
-        const natsAdapter = events_1.eventRegistry.getAdapter(nats_1.NatsEventAdapter);
-        if (natsAdapter?.wsProxyTarget && httpServer) {
-            (0, nats_ws_proxy_1.attachNatsWsProxy)(httpServer, natsAdapter.wsProxyTarget, {
-                onWsUrlDerived: (url) => {
-                    // Auto-set wsUrl if not explicitly configured
-                    if (!natsAdapter.wsUrl) {
-                        natsAdapter.setWsUrl(url);
-                    }
-                },
-            });
-        }
+        const adapter = new express_1.LTExpressAdapter();
+        httpServer = (0, server_1.startServer)(adapter);
+        await adapter.attachServer(httpServer);
     }
     // 7. Return instance
     const connection = (0, workers_1.buildConnection)();

package/build/start/server.d.ts

@@ -1,6 +1,8 @@
-import express from 'express';
+import type { Server } from 'http';
+import { LTExpressAdapter } from '../adapters/express';
 /**
- * Create and start the embedded Express server with health check,
- * API routes, and optional dashboard static assets.
+ * Create and start the standalone server. It owns its app and mounts the
+ * same router an embedding host mounts, at the root, so standalone and
+ * embedded deployments serve one surface.
  */
-export declare function startServer(): ReturnType<typeof express.application.listen>;
+export declare function startServer(adapter: LTExpressAdapter): Server;

package/build/start/server.js

@@ -1,52 +1,28 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.startServer = startServer;
-const fs_1 = require("fs");
-const path_1 = __importDefault(require("path"));
-const express_1 = __importDefault(require("express"));
+const http_1 = require("../lib/http");
 const config_1 = require("../modules/config");
 const logger_1 = require("../lib/logger");
-const routes_1 = __importDefault(require("../routes"));
-const mcp_endpoint_1 = __importDefault(require("../routes/mcp-endpoint"));
 /**
- * Create and start the embedded Express server with health check,
- * API routes, and optional dashboard static assets.
+ * Create and start the standalone server. It owns its app and mounts the
+ * same router an embedding host mounts, at the root, so standalone and
+ * embedded deployments serve one surface.
  */
-function startServer() {
-    const app = (0, express_1.default)();
+function startServer(adapter) {
+    const app = (0, http_1.createApp)();
     if (process.env.NODE_ENV !== 'production') {
         app.disable('etag');
     }
-    app.use(express_1.default.json());
-    app.get('/health', (_req, res) => {
-        res.json({ status: 'ok', timestamp: new Date().toISOString() });
-    });
-    app.use('/api', routes_1.default);
-    app.use('/mcp', mcp_endpoint_1.default);
-    // Serve dashboard static assets
-    // Resolves correctly in both dev (ts-node from root) and prod (node build/)
-    const devDist = path_1.default.join(__dirname, '..', 'dashboard', 'dist');
-    const prodDist = path_1.default.join(__dirname, '..', '..', 'dashboard', 'dist');
-    const dashboardDist = (0, fs_1.existsSync)(devDist) ? devDist : prodDist;
-    if ((0, fs_1.existsSync)(dashboardDist)) {
-        app.use(express_1.default.static(dashboardDist, { index: false }));
-        // SPA fallback — inject <base href="/"> so relative asset paths
-        // resolve from root regardless of route depth (e.g. /admin/users).
-        // Read on each request so dashboard rebuilds take effect without restart.
-        const indexPath = path_1.default.join(dashboardDist, 'index.html');
-        app.get('/{*splat}', (_req, res) => {
-            const html = (0, fs_1.readFileSync)(indexPath, 'utf-8').replace('<head>', '<head><base href="/">');
-            res.type('html').send(html);
-        });
-        logger_1.loggerRegistry.info(`[long-tail] Dashboard: http://localhost:${config_1.config.PORT}/`);
-    }
+    app.use(adapter.getWellKnownRouter());
+    app.use(adapter.getRouter());
     const httpServer = app.listen(config_1.config.PORT, () => {
         logger_1.loggerRegistry.info(`[long-tail] server running on port ${config_1.config.PORT}`);
         logger_1.loggerRegistry.info(`[long-tail] API: http://localhost:${config_1.config.PORT}/api`);
         logger_1.loggerRegistry.info(`[long-tail] Health: http://localhost:${config_1.config.PORT}/health`);
+        if (adapter.hasDashboard()) {
+            logger_1.loggerRegistry.info(`[long-tail] Dashboard: http://localhost:${config_1.config.PORT}/`);
+        }
     });
     return httpServer;
 }

package/build/start/socket-auth.js

@@ -23,7 +23,8 @@ function createSocketIOAuthenticator(startConfig) {
     return (token) => {
         try {
             const payload = jsonwebtoken_1.default.verify(token, secret);
-            return !!(payload && typeof payload === 'object' && payload.userId);
+            const userId = payload && typeof payload === 'object' ? payload.userId : undefined;
+            return typeof userId === 'string' && userId ? { userId } : false;
         }
         catch {
             return false;

package/build/start/workers.js

@@ -315,7 +315,7 @@ async function startWorkers(startConfig, workers, builtinMcpServerFactories) {
         };
         // 1. Register all factories (runtime — always applied)
         for (const [name, entry] of Object.entries(allFactories)) {
-            registerBuiltinServer(name, entry.factory);
+            registerBuiltinServer(name, entry.factory, entry.config?.toolManifest);
         }
         logger_1.loggerRegistry.info(`[long-tail] ${Object.keys(allFactories).length} MCP server factories registered`);
         // Set exposure config for the /mcp endpoint

package/build/system/mcp-servers/admin/agent-subscriptions.js

@@ -35,7 +35,22 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerAgentSubscriptionTools = registerAgentSubscriptionTools;
 const api = __importStar(require("../../../api/agent-subscriptions"));
+const authority_1 = require("../../../services/agent/authority");
+const workflow_invocation_1 = require("../../../services/workflow-invocation");
+const caller_auth_1 = require("../caller-auth");
 const schemas_1 = require("./schemas");
+/** An MCP error for a refused authority check; null when the call may go on. */
+async function refusal(check) {
+    try {
+        await check();
+        return null;
+    }
+    catch (err) {
+        if (!(err instanceof workflow_invocation_1.InvocationError))
+            throw err;
+        return { content: [{ type: 'text', text: JSON.stringify({ error: err.message }) }], isError: true };
+    }
+}
 function registerAgentSubscriptionTools(server) {
     // mirrors GET /api/agents/:agentId/subscriptions
     server.registerTool('list_agent_subscriptions', {
@@ -55,8 +70,17 @@ function registerAgentSubscriptionTools(server) {
         description: 'Create an event subscription for an agent. When events match the ' +
             'topic pattern, the configured reaction is triggered.',
         inputSchema: schemas_1.createAgentSubscriptionSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
         const { agent_id, ...body } = args;
+        const caller = (0, caller_auth_1.externalCaller)(extra);
+        const refused = caller
+            ? await refusal(() => (0, authority_1.assertMayConfigureSubscription)(caller.userId, {
+                agentId: agent_id, reaction_type: body.reaction_type,
+                workflow_type: body.workflow_type, execute_as: body.execute_as,
+            }))
+            : null;
+        if (refused)
+            return refused;
         const result = await api.createSubscription({ agentId: agent_id, ...body });
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };

package/build/system/mcp-servers/admin/agents.js

@@ -35,7 +35,22 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerAgentTools = registerAgentTools;
 const api = __importStar(require("../../../api/agents"));
+const authority_1 = require("../../../services/agent/authority");
+const workflow_invocation_1 = require("../../../services/workflow-invocation");
+const caller_auth_1 = require("../caller-auth");
 const schemas_1 = require("./schemas");
+/** An MCP error for a refused authority check; null when the call may go on. */
+async function refusal(check) {
+    try {
+        await check();
+        return null;
+    }
+    catch (err) {
+        if (!(err instanceof workflow_invocation_1.InvocationError))
+            throw err;
+        return { content: [{ type: 'text', text: JSON.stringify({ error: err.message }) }], isError: true };
+    }
+}
 function registerAgentTools(server) {
     // mirrors GET /api/agents
     server.registerTool('list_agents', {
@@ -69,7 +84,11 @@ function registerAgentTools(server) {
         description: 'Create a new agent automation with identity, goals, rules, ' +
             'optional schedules, and event subscriptions.',
         inputSchema: schemas_1.createAgentSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const caller = (0, caller_auth_1.externalCaller)(extra);
+        const refused = caller ? await refusal(() => (0, authority_1.assertMayConfigureAgent)(caller.userId, { ...args, id: undefined })) : null;
+        if (refused)
+            return refused;
         const result = await api.createAgent(args);
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
@@ -81,7 +100,11 @@ function registerAgentTools(server) {
         title: 'Update Agent',
         description: 'Update an existing agent automation.',
         inputSchema: schemas_1.updateAgentSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const caller = (0, caller_auth_1.externalCaller)(extra);
+        const refused = caller ? await refusal(() => (0, authority_1.assertMayConfigureAgent)(caller.userId, args)) : null;
+        if (refused)
+            return refused;
         const result = await api.updateAgent(args);
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };

package/build/system/mcp-servers/admin/announcements.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerAnnouncementTools = registerAnnouncementTools;
 const zod_1 = require("zod");
 const api = __importStar(require("../../../api/announcements"));
+const caller_auth_1 = require("../caller-auth");
 const publishAnnouncementSchema = zod_1.z.object({
     body: zod_1.z.string().describe('Markdown body — the only required field.'),
     title: zod_1.z.string().optional().describe('Headline shown on the collapsed banner.'),
@@ -53,14 +54,14 @@ function registerAnnouncementTools(server) {
             '(default 24h) are optional. Bodies broadcast to all authenticated ' +
             'subscribers — never include secrets.',
         inputSchema: publishAnnouncementSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
         const result = await api.createAnnouncement({
             body: args.body,
             title: args.title,
             layout: args.layout,
             roles: args.roles,
             expiresAt: args.expires_at,
-        }, { userId: 'lt-system', role: 'superadmin' });
+        }, (0, caller_auth_1.externalCaller)(extra) ?? { userId: 'lt-system', role: 'superadmin' });
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
         }

package/build/system/mcp-servers/admin/bot-accounts.js

@@ -35,7 +35,23 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerBotAccountTools = registerBotAccountTools;
 const api = __importStar(require("../../../api/bot-accounts"));
+const bot_api_key_1 = require("../../../services/auth/bot-api-key");
+const capabilities_1 = require("../../../modules/capabilities");
+const caller_auth_1 = require("../caller-auth");
 const schemas_1 = require("./schemas");
+/** An MCP error for a refused decision; null when the call may go on. */
+function refusal(decision) {
+    if (decision.allowed)
+        return null;
+    return { content: [{ type: 'text', text: JSON.stringify({ error: decision.error }) }], isError: true };
+}
+/** For a /mcp caller, the account rule on `botId`; internal calls act as lt-system. */
+async function accountRefusal(extra, botId) {
+    const caller = (0, caller_auth_1.externalCaller)(extra);
+    if (!caller || !botId)
+        return null;
+    return refusal(await (0, capabilities_1.mayManageAccount)(caller.userId, botId));
+}
 function registerBotAccountTools(server) {
     // mirrors GET /api/bot-accounts
     server.registerTool('list_bot_accounts', {
@@ -67,7 +83,11 @@ function registerBotAccountTools(server) {
         description: 'Create a new bot (service) account with optional roles. ' +
             'Bot accounts can run workflows and hold API keys.',
         inputSchema: schemas_1.createBotSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const caller = (0, caller_auth_1.externalCaller)(extra);
+        const refused = caller ? refusal(await (0, capabilities_1.mayGrantRoles)(caller.userId, args.roles)) : null;
+        if (refused)
+            return refused;
         const result = await api.createBot(args);
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
@@ -79,7 +99,10 @@ function registerBotAccountTools(server) {
         title: 'Update Bot Account',
         description: 'Update a bot account (display name, description, status).',
         inputSchema: schemas_1.updateBotSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const refused = await accountRefusal(extra, args.id);
+        if (refused)
+            return refused;
         const result = await api.updateBot(args);
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
@@ -91,7 +114,10 @@ function registerBotAccountTools(server) {
         title: 'Delete Bot Account',
         description: 'Delete a bot account and all its API keys.',
         inputSchema: schemas_1.deleteBotSchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const refused = await accountRefusal(extra, args.id);
+        if (refused)
+            return refused;
         const result = await api.deleteBot(args);
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
@@ -104,7 +130,10 @@ function registerBotAccountTools(server) {
         description: 'Generate a new API key for a bot account. Returns the raw key ' +
             'ONCE — it cannot be retrieved again.',
         inputSchema: schemas_1.createBotApiKeySchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const refused = await accountRefusal(extra, args.id);
+        if (refused)
+            return refused;
         const result = await api.createBotKey(args);
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };
@@ -116,7 +145,10 @@ function registerBotAccountTools(server) {
         title: 'Revoke Bot API Key',
         description: 'Revoke (delete) an API key for a bot account.',
         inputSchema: schemas_1.revokeBotKeySchema,
-    }, async (args) => {
+    }, async (args, extra) => {
+        const refused = (0, caller_auth_1.externalCaller)(extra) ? await accountRefusal(extra, await (0, bot_api_key_1.getBotApiKeyOwner)(args.key_id)) : null;
+        if (refused)
+            return refused;
         const result = await api.revokeBotKey({ keyId: args.key_id });
         if (result.error) {
             return { content: [{ type: 'text', text: JSON.stringify({ error: result.error }) }], isError: true };

package/build/system/mcp-servers/admin/escalations.d.ts

@@ -1,11 +1,9 @@
 /**
  * Escalation tools — mirrors routes/escalations/
  *
- * Every tool runs as the `lt-system` bot. The escalation RBAC helpers
- * (getVisibleRoles / getUserRoles / hasGlobalEscalationAccess) query a uuid
- * column, so the bot's external_id string ('lt-system') would blow up with
- * `invalid input syntax for type uuid`. `systemAuth()` resolves the bot's real
- * UUID once and caches it; that UUID (a superadmin) is passed as the principal.
+ * A call that arrived at `/mcp` runs as its caller, so the escalation RBAC in
+ * api/ applies to them exactly as it does over REST. Internal calls from
+ * workflows and agents run as the `lt-system` bot.
  */
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 export declare function registerEscalationTools(server: McpServer): void;