@rosthq/cli 0.7.132 → 0.7.133

package/dist/index.js

@@ -32804,6 +32804,10 @@ var mcpCatalogSchema = external_exports.object({
   digest: external_exports.string().regex(/^sha256:[0-9a-f]{64}$/),
   discovered_at: external_exports.string().datetime({ offset: true })
 }).strict();
+var mcpToolRefusalReasonSchema = external_exports.enum([
+  "credential_shaped_tool_name",
+  "credential_shaped_schema_key"
+]);
 
 // ../../packages/protocol/src/cli-bootstrap.ts
 var uuidSchema10 = external_exports.string().uuid();
@@ -57214,7 +57218,7 @@ After import, continue from the draft Seat page. Review the Charter, choose a St
     order: 91,
     title: "Remote MCP connection guide",
     summary: "How an operator connects a company-wide remote MCP server, reviews its advertised tools, and disconnects \u2014 connect grants no agent access on its own.",
-    version: "2026-07-22.1",
+    version: "2026-07-31.1",
     public: false,
     audiences: ["human"],
     stages: ["operating_rhythm"],
@@ -57247,6 +57251,8 @@ An owner or admin opens Settings \u2192 Connections and connects one of the work
 
 Each connected server lists the tools it advertises. Every tool is shown with a conservative tier: **Read** only when the server explicitly marks the tool read-only, otherwise **Approval-held** (a steward must approve each use). A tool the server flags as destructive is labelled so. These labels are advisory context for the human \u2014 the signed Charter and the guard remain the authority on what an agent may actually call.
 
+A tool can be absent from this list even though the server advertises it. Discovery withholds any tool whose name \u2014 or any argument name in its input schema \u2014 is shaped like credential material, because that string is the contract a grant and the model must reproduce, so it cannot be rewritten the way a description can. The omission is silent at the point of use: the withheld tool simply never exists for your company, so an agent asked to call it has no such tool and no error at the call site names why. What you do see is the record: the connection's lifecycle event notes how many tools were withheld and the typed reason category, never the credential-shaped string itself.
+
 ## Disconnect
 
 Disconnecting revokes the stored credential immediately (any in-flight run fails closed), marks the connection disconnected, and revokes the vault secret. It is idempotent and admin-gated.
@@ -57256,6 +57262,7 @@ Disconnecting revokes the stored credential immediately (any in-flight run fails
 - The server URL is fixed at connect time; a model can never redirect the connector to another host or tool.
 - Every outbound request passes an SSRF chokepoint (HTTPS-only, private/link-local/metadata addresses rejected, the validated IP pinned to defeat DNS rebinding) and never follows a redirect with the credential attached.
 - Responses are size- and time-bounded and validated before they reach a model; the bearer token is redacted from any result.
+- A tool whose advertised name or argument names look like credential material is withheld at discovery rather than stored or shown to a model, and self-reported descriptions and labels are scanned for secret material before they are persisted.
 - Connections are tenant-isolated by RLS; one company never sees another's servers or catalog.`
   }
 ];