@sleep2agi/commhub-server 0.9.0-preview.4 → 0.9.0-preview.5

package/src/tools.ts

@@ -24,6 +24,22 @@ import {
   auditCreateNode,
   resolveCallerDaemonTokenBound as _resolveCallerDaemonTokenBound,
 } from "./create-node.js";
+import {
+  vaultUpsert, vaultGet, vaultListKeys, vaultDelete,
+  VaultError,
+} from "./vault.js";
+import {
+  validateBaseUrl as _validateBaseUrl,
+  SUPPORTED_VENDORS,
+  ProbeValidationError,
+} from "./probe-validate.js";
+import {
+  putPendingProbeSecret,
+  newProbeId,
+  finalizeProbeAck,
+  startPendingProbeGcTimer,
+  startProbeSweeperTimer,
+} from "./probe.js";
 import { canonicalAliasExists, cleanupRenamedAliasSession, resolveCanonicalAlias } from "./rename.js";
 import {
   ALLOWED_FLAGS,
@@ -2128,6 +2144,469 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, status }) }] };
     },
   );
+
+  // ── RFC-028 P1 — Provider & Model Registry + connectivity probe ──
+  // Background timers (probe GC + sweeper) idempotent; safe to call
+  // per registerTools.
+  startPendingProbeGcTimer();
+  startProbeSweeperTimer();
+
+  // Helper: zod to JSON-RPC reply for ProbeValidationError + VaultError
+  const probeFailReply = (e: unknown) => {
+    if (e instanceof ProbeValidationError) {
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: e.code, ...(e.detail || {}) }) }] };
+    }
+    if (e instanceof VaultError) {
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: e.code, message: e.message }) }] };
+    }
+    throw e;
+  };
+
+  // §2.3.4 — upsert_network_secret (OWNER-ONLY; vault write).
+  server.tool(
+    "upsert_network_secret",
+    "Write or replace a secret value in the network's vault (AES-GCM encrypted at rest). OWNER-only. RFC-028.",
+    {
+      key: z.string().min(1).max(64).regex(/^[A-Z][A-Z0-9_]{0,63}$/),
+      value: z.string().min(1).max(16 * 1024),
+      network_id: z.string().max(200).optional(),
+    },
+    async ({ key, value, network_id: clientNetId }) => {
+      const effectiveNetId = getNetworkId(clientNetId);
+      if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId, "write");
+      const callerRole = enforceUserId && effectiveNetId
+        ? getUserNetworkRole(enforceUserId, effectiveNetId)
+        : null;
+      if (callerRole !== "owner") {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "secret_owner_only", required_role: "owner", caller_role: callerRole }) }] };
+      }
+      try {
+        vaultUpsert(effectiveNetId || "default", key, value);
+        auditCreateNode({
+          action: "create_node_dispatched",  // reusing audit_log shape (provider follow-up logs)
+          user_id: enforceUserId, network_id: effectiveNetId, target_id: null,
+          detail: { op: "vault_upsert", key, network_id: effectiveNetId },
+        });
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, key }) }] };
+      } catch (e) {
+        return probeFailReply(e);
+      }
+    },
+  );
+
+  // §2.3.4b — list_network_secrets (key names only; viewer+).
+  server.tool(
+    "list_network_secrets",
+    "List vault key NAMES (NEVER values) for a network. RFC-028.",
+    { network_id: z.string().max(200).optional() },
+    async ({ network_id: clientNetId }) => {
+      const effectiveNetId = getNetworkId(clientNetId);
+      if (!canWrite(effectiveNetId) && enforceUserId) {
+        // viewer-level: allow if caller has any role in network
+        const role = getUserNetworkRole(enforceUserId, effectiveNetId || "default");
+        if (!role) return writeDeniedReply(effectiveNetId, "read");
+      }
+      const keys = vaultListKeys(effectiveNetId || "default");
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, keys }) }] };
+    },
+  );
+
+  // §2.3.1 — upsert_provider (admin+).
+  server.tool(
+    "upsert_provider",
+    "Create or update a provider (vendor + base_url + secret_key_ref + initial models). Admin+. RFC-028.",
+    {
+      name: z.string().min(1).max(100),
+      vendor: z.string().min(1).max(64),
+      base_url: z.string().min(1).max(500),
+      secret_key_ref: z.string().min(1).max(64),
+      models: z.array(z.object({
+        model_name: z.string().min(1).max(100),
+        display_name: z.string().max(100).optional(),
+        context_window: z.number().int().min(0).optional(),
+        supports_vision: z.boolean().optional(),
+      })).optional(),
+      network_id: z.string().max(200).optional(),
+    },
+    async ({ name, vendor, base_url, secret_key_ref, models, network_id: clientNetId }) => {
+      const effectiveNetId = getNetworkId(clientNetId);
+      if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId, "write");
+      const callerRole = enforceUserId && effectiveNetId
+        ? getUserNetworkRole(enforceUserId, effectiveNetId)
+        : null;
+      if (callerRole !== "admin" && callerRole !== "owner") {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "insufficient_role_for_provider", required_role: "admin", caller_role: callerRole }) }] };
+      }
+      try {
+        _validateBaseUrl(vendor, base_url);
+      } catch (e) {
+        return probeFailReply(e);
+      }
+      // Verify vault key exists (best-effort; just lists names)
+      const vaultKeys = vaultListKeys(effectiveNetId || "default");
+      if (!vaultKeys.includes(secret_key_ref)) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "secret_not_in_vault", key: secret_key_ref, hint: "upsert_network_secret first" }) }] };
+      }
+      const providerId = `prov_${uuidv4()}`;
+      try {
+        db.run(
+          `INSERT INTO providers (provider_id, network_id, name, vendor, base_url, secret_key_ref, created_at, created_by, enabled)
+           VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 1)`,
+          [providerId, effectiveNetId || "default", name, vendor, base_url, secret_key_ref, Date.now(), enforceUserId || "unknown"],
+        );
+      } catch (e: any) {
+        if (/UNIQUE constraint failed/.test(e?.message || "")) {
+          return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "provider_name_conflict", name }) }] };
+        }
+        throw e;
+      }
+      const modelIds: string[] = [];
+      if (models) {
+        for (const m of models) {
+          const mid = `pm_${uuidv4()}`;
+          db.run(
+            `INSERT INTO provider_models (model_id, provider_id, model_name, display_name, context_window, supports_vision, enabled, created_at)
+             VALUES (?1, ?2, ?3, ?4, ?5, ?6, 1, ?7)`,
+            [mid, providerId, m.model_name, m.display_name ?? null, m.context_window ?? null, m.supports_vision ? 1 : 0, Date.now()],
+          );
+          modelIds.push(mid);
+        }
+      }
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, provider_id: providerId, model_ids: modelIds }) }] };
+    },
+  );
+
+  // §2.3.2 — update_provider (admin+; patch semantics). RFC-028 P1.5.
+  // Single tool for editing existing providers — patch model: name/base_url/
+  // models/enabled all optional, at least one required. Vendor and
+  // secret_key_ref are IMMUTABLE via this tool (vendor change = create+delete;
+  // secret change goes through upsert_network_secret first). network_id is
+  // immutable (cross-tenant move forbidden).
+  //
+  // base_url change re-runs validateBaseUrl with vendor read from DB row
+  // (NOT from patch) — defends against trying to widen host allowlist by
+  // smuggling a new vendor name. zod .strict() on the wrapping object
+  // surfaces extras as -32602 at MCP boundary (R3 lock, same as
+  // ack_probe_request per #308 fold-in).
+  //
+  // Audit: every successful update writes audit_log with before/after diff
+  // of the changed fields ONLY (no secret values — secret isn't a patch
+  // field, no leak path).
+  server.registerTool(
+    "update_provider",
+    {
+      description: "Edit existing provider (name/base_url/models/enabled). Patch semantics — at least one field. Vendor/secret/network_id immutable. Admin+. RFC-028 P1.5.",
+      inputSchema: z.object({
+        provider_id: z.string().regex(/^prov_[a-zA-Z0-9_-]+$/).max(200),
+        network_id: z.string().max(200).optional(),
+        patch: z.object({
+          name: z.string().min(1).max(100).optional(),
+          base_url: z.string().min(1).max(500).optional(),
+          models: z.array(z.object({
+            model_name: z.string().min(1).max(100),
+            display_name: z.string().max(100).optional(),
+            context_window: z.number().int().min(0).optional(),
+            supports_vision: z.boolean().optional(),
+          })).optional(),
+          enabled: z.boolean().optional(),
+        }).strict(),
+      }).strict() as any,
+    },
+    async (args: any) => {
+      const { provider_id, network_id: clientNetId, patch } = args;
+      const effectiveNetId = getNetworkId(clientNetId);
+      if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId, "write");
+      const callerRole = enforceUserId && effectiveNetId
+        ? getUserNetworkRole(enforceUserId, effectiveNetId)
+        : null;
+      if (callerRole !== "admin" && callerRole !== "owner") {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "insufficient_role_for_provider", required_role: "admin", caller_role: callerRole }) }] };
+      }
+
+      // Empty patch — surface noop_no_changes (don't silently succeed)
+      const patchKeys = Object.keys(patch || {});
+      if (patchKeys.length === 0) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "noop_no_changes", hint: "patch must include at least one of: name, base_url, models, enabled" }) }] };
+      }
+
+      // SEC-1: row must exist within caller's network (SQL-level enforcement)
+      const row = db.get<{ provider_id: string; vendor: string; name: string; base_url: string; enabled: number }>(
+        `SELECT provider_id, vendor, name, base_url, enabled FROM providers WHERE provider_id = ?1 AND network_id = ?2`,
+        provider_id, effectiveNetId || "default",
+      );
+      if (!row) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "provider_not_found", provider_id }) }] };
+      }
+
+      // base_url change → re-run validateBaseUrl with vendor from DB (not patch)
+      if (patch.base_url !== undefined && patch.base_url !== row.base_url) {
+        try {
+          _validateBaseUrl(row.vendor, patch.base_url);
+        } catch (e) {
+          return probeFailReply(e);
+        }
+      }
+
+      // Diff staging — collect before/after for audit (NO secret values; secret
+      // isn't a patch field). Skip fields that didn't actually change.
+      const diff: Record<string, { before: unknown; after: unknown }> = {};
+      const sets: string[] = [];
+      const params: unknown[] = [];
+      let paramIdx = 1;
+      if (patch.name !== undefined && patch.name !== row.name) {
+        sets.push(`name = ?${paramIdx++}`); params.push(patch.name);
+        diff.name = { before: row.name, after: patch.name };
+      }
+      if (patch.base_url !== undefined && patch.base_url !== row.base_url) {
+        sets.push(`base_url = ?${paramIdx++}`); params.push(patch.base_url);
+        diff.base_url = { before: row.base_url, after: patch.base_url };
+      }
+      if (patch.enabled !== undefined) {
+        const newEnabled = patch.enabled ? 1 : 0;
+        if (newEnabled !== row.enabled) {
+          sets.push(`enabled = ?${paramIdx++}`); params.push(newEnabled);
+          diff.enabled = { before: row.enabled === 1, after: patch.enabled };
+        }
+      }
+
+      // Replace models list (if supplied) atomically with the providers UPDATE
+      const willReplaceModels = patch.models !== undefined;
+      const newModelIds: string[] = [];
+
+      try {
+        db.exec("BEGIN");
+        if (sets.length > 0) {
+          params.push(provider_id);
+          try {
+            db.run(`UPDATE providers SET ${sets.join(", ")} WHERE provider_id = ?${paramIdx}`, params);
+          } catch (e: any) {
+            if (/UNIQUE constraint failed/.test(e?.message || "")) {
+              db.exec("ROLLBACK");
+              return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "provider_name_conflict", name: patch.name }) }] };
+            }
+            throw e;
+          }
+        }
+        if (willReplaceModels) {
+          db.run(`DELETE FROM provider_models WHERE provider_id = ?1`, [provider_id]);
+          for (const m of patch.models) {
+            const mid = `pm_${uuidv4()}`;
+            db.run(
+              `INSERT INTO provider_models (model_id, provider_id, model_name, display_name, context_window, supports_vision, enabled, created_at)
+               VALUES (?1, ?2, ?3, ?4, ?5, ?6, 1, ?7)`,
+              [mid, provider_id, m.model_name, m.display_name ?? null, m.context_window ?? null, m.supports_vision ? 1 : 0, Date.now()],
+            );
+            newModelIds.push(mid);
+          }
+          diff.models = { before: "(prior list)", after: `${patch.models.length} models replaced` };
+        }
+        db.run(
+          `INSERT INTO audit_log (user_id, username, action, target_type, target_id, detail, network_id)
+           VALUES (?1, ?2, 'update_provider', 'provider', ?3, ?4, ?5)`,
+          [enforceUserId || null, callerAlias || null, provider_id, JSON.stringify({ diff, fields_changed: Object.keys(diff) }), effectiveNetId || null],
+        );
+        db.exec("COMMIT");
+      } catch (e: any) {
+        try { db.exec("ROLLBACK"); } catch { /* ok */ }
+        throw e;
+      }
+
+      if (Object.keys(diff).length === 0 && !willReplaceModels) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, provider_id, no_changes: true, hint: "patch fields matched existing row, no-op" }) }] };
+      }
+
+      return { content: [{ type: "text" as const, text: JSON.stringify({
+        ok: true, provider_id,
+        fields_changed: Object.keys(diff),
+        models_replaced: willReplaceModels ? newModelIds.length : null,
+      }) }] };
+    },
+  );
+
+  // §2.3.3 — list_providers (viewer+; never returns secret VALUES).
+  server.tool(
+    "list_providers",
+    "List providers + models in the caller's network. Never returns secret VALUES. RFC-028.",
+    { network_id: z.string().max(200).optional() },
+    async ({ network_id: clientNetId }) => {
+      const effectiveNetId = getNetworkId(clientNetId);
+      // viewer access: caller must be member of network (read access)
+      if (enforceUserId) {
+        const role = getUserNetworkRole(enforceUserId, effectiveNetId || "default");
+        if (!role) return writeDeniedReply(effectiveNetId, "read");
+      }
+      const providers = db.all<any>(
+        `SELECT provider_id, name, vendor, base_url, secret_key_ref, enabled FROM providers WHERE network_id = ?1 AND enabled = 1 ORDER BY name`,
+        effectiveNetId || "default",
+      );
+      const out = providers.map(p => {
+        const models = db.all<any>(
+          `SELECT model_id, model_name, display_name, context_window, supports_vision, enabled FROM provider_models WHERE provider_id = ?1 AND enabled = 1 ORDER BY model_name`,
+          p.provider_id,
+        );
+        return { ...p, in_vault: true, models };  // in_vault: true since we required it on upsert
+      });
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, providers: out }) }] };
+    },
+  );
+
+  // §2.3.5 — probe_provider_model (admin+; dispatches to daemon).
+  server.tool(
+    "probe_provider_model",
+    "Dispatch a connectivity probe to a daemon. Mints ephemeral secret blob; daemon pulls via get_probe_request. Admin+. RFC-028.",
+    {
+      provider_id: z.string().min(1).max(200),
+      model_name: z.string().min(1).max(100),
+      daemon_node_id: z.string().min(1).max(200),
+      network_id: z.string().max(200).optional(),
+    },
+    async ({ provider_id, model_name, daemon_node_id, network_id: clientNetId }) => {
+      const effectiveNetId = getNetworkId(clientNetId);
+      if (!canWrite(effectiveNetId)) return writeDeniedReply(effectiveNetId, "write");
+      const callerRole = enforceUserId && effectiveNetId
+        ? getUserNetworkRole(enforceUserId, effectiveNetId)
+        : null;
+      if (callerRole !== "admin" && callerRole !== "owner") {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "insufficient_role_for_probe", required_role: "admin", caller_role: callerRole }) }] };
+      }
+      // Resolve provider + model (network-scoped). Distinguish "not found"
+      // from "disabled" so the dashboard can render the right error
+      // (P1.5 dashboard编辑/停用 needs this to explain why probe rejected).
+      const provider = db.get<any>(
+        `SELECT provider_id, vendor, base_url, secret_key_ref, enabled FROM providers WHERE provider_id = ?1 AND network_id = ?2`,
+        provider_id, effectiveNetId || "default",
+      );
+      if (!provider) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "provider_not_found", provider_id }) }] };
+      if (provider.enabled !== 1) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "provider_disabled", provider_id, hint: "update_provider with enabled:true to re-enable" }) }] };
+      const model = db.get<any>(
+        `SELECT model_id, model_name FROM provider_models WHERE provider_id = ?1 AND model_name = ?2 AND enabled = 1`,
+        provider_id, model_name,
+      );
+      if (!model) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "model_not_found", model_name }) }] };
+      // Resolve daemon (must be in caller network)
+      const { row: daemon, sec1Ok } = resolveTargetNode(daemon_node_id, effectiveNetId);
+      if (!daemon) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "daemon_not_found" }) }] };
+      if (!sec1Ok) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "cross_network_node" }) }] };
+      // Vault decrypt the API key (may throw VaultError)
+      let apiKey: string;
+      try {
+        const v = vaultGet(effectiveNetId || "default", provider.secret_key_ref);
+        if (!v) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "secret_not_in_vault", key: provider.secret_key_ref }) }] };
+        apiKey = v;
+      } catch (e) { return probeFailReply(e); }
+      // Mint probe row + stash ephemeral blob
+      const probeId = newProbeId();
+      db.run(
+        `INSERT INTO probe_results (probe_id, provider_id, model_name, daemon_node_id, network_id, status, probed_at, probed_by_user)
+         VALUES (?1, ?2, ?3, ?4, ?5, 'pending', ?6, ?7)`,
+        [probeId, provider_id, model_name, daemon_node_id, effectiveNetId || "default", Date.now(), enforceUserId || null],
+      );
+      putPendingProbeSecret({
+        probe_id: probeId,
+        daemon_node_id,
+        provider_id,
+        vendor: provider.vendor,
+        base_url: provider.base_url,
+        model_name,
+        api_key: apiKey,
+        network_id: effectiveNetId || "default",
+      });
+      pushEvent(daemon.alias, { type: "probe_provider", probe_id: probeId }, daemon.network_id || effectiveNetId || "default");
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, probe_id: probeId }) }] };
+    },
+  );
+
+  // §2.3.6 — get_probe_results (viewer+; matrix renderer source).
+  server.tool(
+    "get_probe_results",
+    "Query probe history (optionally filtered by provider/model/daemon). Used by dashboard reachability matrix. RFC-028.",
+    {
+      provider_id: z.string().max(200).optional(),
+      model_name: z.string().max(100).optional(),
+      daemon_node_id: z.string().max(200).optional(),
+      limit: z.number().int().min(1).max(500).optional(),
+      network_id: z.string().max(200).optional(),
+    },
+    async ({ provider_id, model_name, daemon_node_id, limit, network_id: clientNetId }) => {
+      const effectiveNetId = getNetworkId(clientNetId);
+      if (enforceUserId) {
+        const role = getUserNetworkRole(enforceUserId, effectiveNetId || "default");
+        if (!role) return writeDeniedReply(effectiveNetId, "read");
+      }
+      const where: string[] = ["network_id = ?1"];
+      const params: any[] = [effectiveNetId || "default"];
+      if (provider_id)    { where.push(`provider_id = ?${params.length + 1}`); params.push(provider_id); }
+      if (model_name)     { where.push(`model_name = ?${params.length + 1}`); params.push(model_name); }
+      if (daemon_node_id) { where.push(`daemon_node_id = ?${params.length + 1}`); params.push(daemon_node_id); }
+      const sql = `SELECT probe_id, provider_id, model_name, daemon_node_id, status, latency_ms, error_label, probed_at, raw_status_code FROM probe_results WHERE ${where.join(" AND ")} ORDER BY probed_at DESC LIMIT ${limit ?? 100}`;
+      const rows = db.all<any>(sql, ...params);
+      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, results: rows }) }] };
+    },
+  );
+
+  // §2.3.7 daemon-facing — get_probe_request.
+  server.tool(
+    "get_probe_request",
+    "Daemon pulls a pending probe request (called when SSE probe_provider doorbell arrives). RFC-028.",
+    { probe_id: z.string().min(1).max(200) },
+    async ({ probe_id }) => {
+      const callerDaemon = _resolveCallerDaemonTokenBound({ callerTokenIsNetwork, callerTokenId, enforceNetworkId });
+      if (!callerDaemon.ok) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: callerDaemon.error }) }] };
+      }
+      // takePendingProbeSecret enforces daemon binding + evicts
+      const blob = (await import("./probe.js")).takePendingProbeSecret(probe_id, callerDaemon.daemonNodeId);
+      if (!blob) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "probe_request_unavailable", reason: "not_found_or_wrong_daemon_or_expired" }) }] };
+      }
+      return { content: [{ type: "text" as const, text: JSON.stringify({
+        ok: true,
+        probe_id: blob.probe_id,
+        vendor: blob.vendor,
+        base_url: blob.base_url,
+        model_name: blob.model_name,
+        api_key: blob.api_key,        // ephemeral; daemon writes to .env.local or in-memory only
+      }) }] };
+    },
+  );
+
+  // §2.3.8 daemon-facing — ack_probe_request (STRICT whitelist via zod).
+  // R3 LOCK (RFC-028 v3): ack payload has EXACTLY 4 keys. We pass a
+  // ZodObject with .strict() so the MCP SDK's validateToolInput surfaces
+  // any extra field (e.g. an attacker smuggling `error_message` to leak a
+  // secret) as a -32602 Invalid params error at the protocol boundary
+  // BEFORE our handler runs. The SDK invokes z.object(shape) by default
+  // which is strip-mode; passing a fully-constructed strict object
+  // bypasses that and enforces unknownKeys='strict'.
+  server.registerTool(
+    "ack_probe_request",
+    {
+      description: "Daemon acks a probe. Schema is STRICT whitelist (no error_message; v3 R3 LOCK). RFC-028.",
+      // Strict-mode ZodObject so the MCP SDK's validateToolInput surfaces
+      // any extra field as a -32602 Invalid params error BEFORE the
+      // handler runs. server.tool() accepts only ZodRawShape (default
+      // strip-mode); registerTool() accepts a constructed ZodObject and
+      // honors its unknownKeys policy.
+      inputSchema: z.object({
+        probe_id: z.string().min(1).max(200),
+        status: z.enum(["ok", "auth_fail", "quota", "rate_limit", "network_error", "timeout", "redirect_forbidden", "vendor_5xx", "other_4xx", "tls_error", "probe_resolve_unsafe_ip", "probe_target_forbidden"]),
+        raw_status_code: z.number().int().min(100).max(599).optional(),
+        latency_ms: z.number().int().min(0).max(60_000),
+      }).strict() as any,
+    },
+    async (args: any) => {
+      const callerDaemon = _resolveCallerDaemonTokenBound({ callerTokenIsNetwork, callerTokenId, enforceNetworkId });
+      if (!callerDaemon.ok) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: callerDaemon.error }) }] };
+      }
+      try {
+        const r = finalizeProbeAck(args, { network_id: callerDaemon.networkId, daemon_node_id: callerDaemon.daemonNodeId });
+        return { content: [{ type: "text" as const, text: JSON.stringify(r) }] };
+      } catch (e) {
+        return probeFailReply(e);
+      }
+    },
+  );
 }
 
 // ────────────────────────────────────────────────────────────────────

package/src/update-provider.test.ts

@@ -0,0 +1,169 @@
+import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import { db } from "./db.js";
+import {
+  validateBaseUrl,
+  ProbeValidationError,
+} from "./probe-validate.js";
+
+// RFC-028 P1.5 — update_provider invariants. Tests the building blocks
+// the MCP handler relies on:
+//   - SQL-level SEC-1 (provider_id × network_id uniqueness across tenants)
+//   - audit_log row written for every update
+//   - validateBaseUrl re-runs against vendor from DB (not patch) on
+//     base_url change → vendor immutability bypass attempt fails
+//   - patch-empty noop path
+//   - DELETE FROM provider_models + INSERT replacement is atomic
+//
+// Boundary behaviour (zod-strict patch wrapper, MCP -32602 on extras,
+// admin gate, cross-tenant rejection) is covered by the docker e2e
+// (qa-rfc028-update-provider). The unit layer focuses on the impl
+// guarantees that survive even if the MCP boundary changes.
+
+const NET_A = "net_test_pa_alpha";
+const NET_B = "net_test_pa_beta";
+const PROV_A = "prov_test_p15_alpha";
+const PROV_B = "prov_test_p15_beta";
+
+beforeEach(() => {
+  for (const p of [PROV_A, PROV_B]) {
+    try { db.run("DELETE FROM provider_models WHERE provider_id = ?1", [p]); } catch {}
+    try { db.run("DELETE FROM providers WHERE provider_id = ?1", [p]); } catch {}
+  }
+  try { db.run("DELETE FROM audit_log WHERE target_id IN (?1, ?2)", [PROV_A, PROV_B]); } catch {}
+});
+
+afterAll(() => {
+  for (const p of [PROV_A, PROV_B]) {
+    try { db.run("DELETE FROM provider_models WHERE provider_id = ?1", [p]); } catch {}
+    try { db.run("DELETE FROM providers WHERE provider_id = ?1", [p]); } catch {}
+  }
+  try { db.run("DELETE FROM audit_log WHERE target_id IN (?1, ?2)", [PROV_A, PROV_B]); } catch {}
+});
+
+function seedProvider(provider_id: string, network_id: string, opts: Partial<{ name: string; vendor: string; base_url: string; enabled: number }> = {}) {
+  db.run(
+    `INSERT INTO providers (provider_id, network_id, name, vendor, base_url, secret_key_ref, created_at, created_by, enabled)
+     VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)`,
+    [provider_id, network_id, opts.name ?? "anthro-prod", opts.vendor ?? "anthropic",
+     opts.base_url ?? "https://api.anthropic.com", "ANTHROPIC_API_KEY",
+     Date.now(), "test", opts.enabled ?? 1],
+  );
+}
+
+describe("update_provider — SQL invariants (RFC-028 P1.5)", () => {
+  test("SEC-1: provider_id is unique-per-network — netA query for netB provider_id returns nothing", () => {
+    seedProvider(PROV_A, NET_A);
+    seedProvider(PROV_B, NET_B);
+    // The handler's lookup query: SELECT ... WHERE provider_id = ? AND network_id = ?
+    const fromNetA = db.get<any>(
+      "SELECT provider_id FROM providers WHERE provider_id = ?1 AND network_id = ?2",
+      PROV_B, NET_A,
+    );
+    expect(fromNetA == null).toBe(true);
+    // Sanity: PROV_B does exist in its own network
+    const fromNetB = db.get<any>(
+      "SELECT provider_id FROM providers WHERE provider_id = ?1 AND network_id = ?2",
+      PROV_B, NET_B,
+    );
+    expect(fromNetB?.provider_id).toBe(PROV_B);
+  });
+
+  test("vendor immutability via validateBaseUrl: changing base_url uses DB vendor, attempt to widen via patched vendor fails", () => {
+    seedProvider(PROV_A, NET_A, { vendor: "anthropic" });
+    // Handler reads vendor from DB row, NOT from patch. Suppose patch tried
+    // to set vendor=evil + base_url=https://attacker.example.com — the
+    // handler ignores the vendor from patch (it's not a field in the
+    // zod patch schema), and validateBaseUrl runs with vendor='anthropic'
+    // from the DB, so the host check is applied.
+    const dbVendor = db.get<{vendor: string}>("SELECT vendor FROM providers WHERE provider_id = ?1", PROV_A)!.vendor;
+    expect(dbVendor).toBe("anthropic");
+    // attempting to use base_url not in anthropic allowlist fails
+    expect(() => validateBaseUrl(dbVendor, "https://attacker.example.com")).toThrow(ProbeValidationError);
+    expect(() => validateBaseUrl(dbVendor, "https://attacker.example.com")).toThrow(/probe_target_forbidden/);
+    // valid anthropic host passes
+    expect(() => validateBaseUrl(dbVendor, "https://api.anthropic.com/v1")).not.toThrow();
+  });
+
+  test("patch noop: enabled set to same value → SET clause skipped", () => {
+    seedProvider(PROV_A, NET_A, { enabled: 1 });
+    const before = db.get<{enabled: number}>("SELECT enabled FROM providers WHERE provider_id = ?1", PROV_A)!.enabled;
+    expect(before).toBe(1);
+    // simulate the handler's diff logic: if patch.enabled === row.enabled, skip
+    const newEnabled = true ? 1 : 0;
+    const shouldUpdate = newEnabled !== before;
+    expect(shouldUpdate).toBe(false);
+    // verify no SET ran (row unchanged)
+    const after = db.get<{enabled: number}>("SELECT enabled FROM providers WHERE provider_id = ?1", PROV_A)!.enabled;
+    expect(after).toBe(1);
+  });
+
+  test("enabled toggle 1→0 written + audit log row created in same transaction", () => {
+    seedProvider(PROV_A, NET_A, { enabled: 1 });
+    db.exec("BEGIN");
+    db.run("UPDATE providers SET enabled = 0 WHERE provider_id = ?1", [PROV_A]);
+    db.run(
+      `INSERT INTO audit_log (user_id, username, action, target_type, target_id, detail, network_id)
+       VALUES (?1, ?2, 'update_provider', 'provider', ?3, ?4, ?5)`,
+      ["u_test", "test", PROV_A, JSON.stringify({ diff: { enabled: { before: true, after: false } } }), NET_A],
+    );
+    db.exec("COMMIT");
+    expect(db.get<{enabled:number}>("SELECT enabled FROM providers WHERE provider_id = ?1", PROV_A)?.enabled).toBe(0);
+    const audit = db.get<any>("SELECT action, target_id, detail FROM audit_log WHERE target_id = ?1 AND action = 'update_provider'", PROV_A);
+    expect(audit?.action).toBe("update_provider");
+    expect(audit?.target_id).toBe(PROV_A);
+    expect(JSON.parse(audit!.detail).diff.enabled.after).toBe(false);
+  });
+
+  test("audit detail does NOT contain secret_key_ref VALUE under any patch", () => {
+    seedProvider(PROV_A, NET_A);
+    // Even if an attacker tried to slip secret into the diff (impossible
+    // through the schema, but defense-in-depth), the audit serializer
+    // only includes the fields actually in `diff`. Secret isn't a patch
+    // field, so it can't reach the diff. Verify the absence:
+    const auditPayload = JSON.stringify({ diff: { name: { before: "old", after: "new" } } });
+    expect(auditPayload).not.toContain("secret");
+    expect(auditPayload).not.toContain("ANTHROPIC_API_KEY");
+    expect(auditPayload).not.toContain("sk-");
+  });
+
+  test("provider_models DELETE+INSERT atomicity (transaction wraps both)", () => {
+    seedProvider(PROV_A, NET_A);
+    db.run(
+      `INSERT INTO provider_models (model_id, provider_id, model_name, enabled, created_at)
+       VALUES ('pm_old1', ?1, 'claude-old-1', 1, ?2), ('pm_old2', ?1, 'claude-old-2', 1, ?2)`,
+      [PROV_A, Date.now()],
+    );
+    expect(db.all("SELECT model_id FROM provider_models WHERE provider_id = ?1", PROV_A).length).toBe(2);
+    // Replace in one transaction
+    db.exec("BEGIN");
+    db.run("DELETE FROM provider_models WHERE provider_id = ?1", [PROV_A]);
+    db.run(
+      `INSERT INTO provider_models (model_id, provider_id, model_name, enabled, created_at)
+       VALUES ('pm_new1', ?1, 'claude-new-1', 1, ?2)`,
+      [PROV_A, Date.now()],
+    );
+    db.exec("COMMIT");
+    const rows = db.all<{model_name: string}>("SELECT model_name FROM provider_models WHERE provider_id = ?1", PROV_A);
+    expect(rows.length).toBe(1);
+    expect(rows[0].model_name).toBe("claude-new-1");
+  });
+
+  test("base_url change rejected via validateBaseUrl when host not in vendor allowlist", () => {
+    seedProvider(PROV_A, NET_A, { vendor: "anthropic" });
+    const vendor = db.get<{vendor: string}>("SELECT vendor FROM providers WHERE provider_id = ?1", PROV_A)!.vendor;
+    // any host other than api.anthropic.com is rejected
+    expect(() => validateBaseUrl(vendor, "https://api.openai.com")).toThrow(/probe_target_forbidden/);
+    expect(() => validateBaseUrl(vendor, "https://169.254.169.254/v1")).toThrow(/probe_target_forbidden/);
+    expect(() => validateBaseUrl(vendor, "http://api.anthropic.com")).toThrow(/probe_base_url_invalid/);
+  });
+
+  test("provider_disabled error distinct from provider_not_found in probe lookup", () => {
+    seedProvider(PROV_A, NET_A, { enabled: 0 });
+    // The new probe handler does the lookup WITHOUT enabled filter, then
+    // checks .enabled — distinguishing not_found vs disabled.
+    const row = db.get<{enabled: number}>("SELECT enabled FROM providers WHERE provider_id = ?1 AND network_id = ?2", PROV_A, NET_A);
+    expect(row).toBeTruthy();
+    expect(row!.enabled).toBe(0);
+    // dashboard renders different message for these two cases
+  });
+});