@wardby/cli 0.1.0

package/dist/mcp/tools/datastore.js

@@ -0,0 +1,217 @@
+import { Prisma } from "@prisma/client";
+import { requireOwnedAgent, requireReadableAgent, requireOwnedDatastore, canRead, assertCanMutate, } from "../auth/ownership.js";
+import { createDatastore, listDatastores, deleteDatastore, attachDatastore, detachDatastore, buildSharedDatastoreAccessor, } from "../../core/datastores.js";
+import { McpError } from "../errors.js";
+import { textResult } from "./text-result.js";
+/**
+ * A `boundName` names an *attachment* (agentId, boundName) -> Datastore.
+ * requireOwnedAgent/requireReadableAgent only check the agent's own
+ * ownership — for a public (null-owner) agent that's readable/mutable by
+ * anyone, so gating solely on the agent would let a principal who attaches
+ * their own private Datastore to a public agent inadvertently expose that
+ * Datastore's full read/write access to every other principal, with no
+ * sandbox mediation. So every boundName branch additionally checks the
+ * underlying Datastore's own ownership. When no attachment exists under
+ * that boundName, this resolves to `undefined` and callers fall through to
+ * today's unchanged behavior (miss for reads, throw for writes) — this
+ * check only ever narrows access when an attachment IS found, it never
+ * grants access an attachment didn't already imply.
+ */
+async function findAttachedDatastore(db, agentId, boundName) {
+    const attachment = await db.agentDatastore.findFirst({ where: { agentId, boundName }, include: { datastore: true } });
+    return attachment?.datastore;
+}
+async function requireReadableSharedDatastore(db, agentId, boundName, principalId) {
+    const datastore = await findAttachedDatastore(db, agentId, boundName);
+    if (!datastore)
+        return;
+    if (!canRead(datastore.ownerId, principalId)) {
+        throw new McpError(404, `Datastore bound as "${boundName}" not found.`);
+    }
+}
+async function requireMutableSharedDatastore(db, agentId, boundName, principalId) {
+    const datastore = await findAttachedDatastore(db, agentId, boundName);
+    if (!datastore)
+        return;
+    assertCanMutate(datastore.ownerId, principalId, `Datastore bound as "${boundName}" is not owned by the caller.`);
+}
+export function registerDatastoreTools(mcp) {
+    mcp.registerTool({
+        name: "create_datastore",
+        scope: "datastore:write",
+        inputSchema: {
+            type: "object",
+            properties: { name: { type: "string" } },
+            required: ["name"],
+        },
+        handler: async (args, ctx) => {
+            try {
+                const datastore = await createDatastore(args.name, ctx.principal.id, ctx.db);
+                return textResult({ id: datastore.id, name: datastore.name, createdAt: datastore.createdAt });
+            }
+            catch (err) {
+                if (err instanceof Prisma.PrismaClientKnownRequestError && err.code === "P2002") {
+                    throw new McpError(409, `A datastore named "${args.name}" already exists.`);
+                }
+                throw err;
+            }
+        },
+    });
+    mcp.registerTool({
+        name: "list_datastores",
+        scope: "datastore:write",
+        inputSchema: { type: "object", properties: {} },
+        handler: async (_args, ctx) => {
+            const datastores = await listDatastores(ctx.principal.id, ctx.db);
+            return textResult(datastores);
+        },
+    });
+    mcp.registerTool({
+        name: "delete_datastore",
+        scope: "datastore:write",
+        inputSchema: { type: "object", properties: { id: { type: "string" } }, required: ["id"] },
+        handler: async (args, ctx) => {
+            await requireOwnedDatastore(ctx.db, args.id, ctx.principal.id);
+            try {
+                await deleteDatastore(args.id, ctx.db);
+            }
+            catch (err) {
+                if (err instanceof Prisma.PrismaClientKnownRequestError && (err.code === "P2003" || err.code === "P2014")) {
+                    throw new McpError(409, "Datastore still has attached agents or entries — detach/clear it first.");
+                }
+                throw err;
+            }
+            return textResult({ deleted: args.id });
+        },
+    });
+    mcp.registerTool({
+        name: "attach_datastore",
+        scope: "datastore:write",
+        inputSchema: {
+            type: "object",
+            properties: {
+                agentId: { type: "string" },
+                datastoreId: { type: "string" },
+                boundName: { type: "string", minLength: 1 },
+            },
+            required: ["agentId", "datastoreId"],
+        },
+        handler: async (args, ctx) => {
+            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            const datastore = await requireOwnedDatastore(ctx.db, args.datastoreId, ctx.principal.id);
+            const boundName = args.boundName ?? datastore.name;
+            try {
+                await attachDatastore(args.agentId, args.datastoreId, ctx.db, boundName);
+            }
+            catch (err) {
+                if (err instanceof Prisma.PrismaClientKnownRequestError && err.code === "P2002") {
+                    throw new McpError(409, `Agent already binds a datastore under name "${boundName}".`);
+                }
+                throw err;
+            }
+            return textResult({ attached: true });
+        },
+    });
+    mcp.registerTool({
+        name: "detach_datastore",
+        scope: "datastore:write",
+        inputSchema: {
+            type: "object",
+            properties: { agentId: { type: "string" }, boundName: { type: "string" } },
+            required: ["agentId", "boundName"],
+        },
+        handler: async (args, ctx) => {
+            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            await requireMutableSharedDatastore(ctx.db, args.agentId, args.boundName, ctx.principal.id);
+            await detachDatastore(args.agentId, args.boundName, ctx.db);
+            return textResult({ detached: true });
+        },
+    });
+    mcp.registerTool({
+        name: "datastore_get",
+        scope: "agents:read",
+        inputSchema: {
+            type: "object",
+            properties: { agentId: { type: "string" }, key: { type: "string" }, boundName: { type: "string" } },
+            required: ["agentId", "key"],
+        },
+        handler: async (args, ctx) => {
+            await requireReadableAgent(ctx.db, args.agentId, ctx.principal.id);
+            if (args.boundName) {
+                await requireReadableSharedDatastore(ctx.db, args.agentId, args.boundName, ctx.principal.id);
+                const accessor = buildSharedDatastoreAccessor(args.agentId, ctx.providers.datastore, ctx.db);
+                const value = await accessor.get(args.boundName, args.key);
+                return textResult({ value: value ?? null });
+            }
+            const value = await ctx.providers.datastore.get(args.agentId, args.key);
+            return textResult({ value: value ?? null });
+        },
+    });
+    mcp.registerTool({
+        name: "datastore_list",
+        scope: "agents:read",
+        inputSchema: {
+            type: "object",
+            properties: { agentId: { type: "string" }, prefix: { type: "string" }, boundName: { type: "string" } },
+            required: ["agentId"],
+        },
+        handler: async (args, ctx) => {
+            await requireReadableAgent(ctx.db, args.agentId, ctx.principal.id);
+            if (args.boundName) {
+                await requireReadableSharedDatastore(ctx.db, args.agentId, args.boundName, ctx.principal.id);
+                const accessor = buildSharedDatastoreAccessor(args.agentId, ctx.providers.datastore, ctx.db);
+                const keys = await accessor.list(args.boundName, args.prefix);
+                return textResult(keys);
+            }
+            const keys = await ctx.providers.datastore.list(args.agentId, args.prefix);
+            return textResult(keys);
+        },
+    });
+    mcp.registerTool({
+        name: "datastore_set",
+        scope: "datastore:write",
+        description: 'Sets a datastore value. Pass "boundName" to write to a shared datastore attached under that name instead of the agent\'s private one. Pass "pii": true to encrypt the value at rest (AES-256-GCM) — opt in only for values that actually carry PII, never inferred automatically.',
+        inputSchema: {
+            type: "object",
+            properties: {
+                agentId: { type: "string" },
+                key: { type: "string" },
+                value: {},
+                pii: { type: "boolean" },
+                boundName: { type: "string" },
+            },
+            required: ["agentId", "key", "value"],
+        },
+        handler: async (args, ctx) => {
+            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            if (args.boundName) {
+                await requireMutableSharedDatastore(ctx.db, args.agentId, args.boundName, ctx.principal.id);
+                const accessor = buildSharedDatastoreAccessor(args.agentId, ctx.providers.datastore, ctx.db);
+                await accessor.set(args.boundName, args.key, args.value, { pii: args.pii });
+                return textResult({ ok: true });
+            }
+            await ctx.providers.datastore.set(args.agentId, args.key, args.value, { pii: args.pii });
+            return textResult({ ok: true });
+        },
+    });
+    mcp.registerTool({
+        name: "datastore_delete",
+        scope: "datastore:write",
+        inputSchema: {
+            type: "object",
+            properties: { agentId: { type: "string" }, key: { type: "string" }, boundName: { type: "string" } },
+            required: ["agentId", "key"],
+        },
+        handler: async (args, ctx) => {
+            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            if (args.boundName) {
+                await requireMutableSharedDatastore(ctx.db, args.agentId, args.boundName, ctx.principal.id);
+                const accessor = buildSharedDatastoreAccessor(args.agentId, ctx.providers.datastore, ctx.db);
+                await accessor.delete(args.boundName, args.key);
+                return textResult({ ok: true });
+            }
+            await ctx.providers.datastore.delete(args.agentId, args.key);
+            return textResult({ ok: true });
+        },
+    });
+}

package/dist/mcp/tools/memory.d.ts

@@ -0,0 +1,3 @@
+/** Operator inspection of agent memory, mirroring the Datastore MCP tools (`./datastore.ts`). */
+import type { WardbyMcpServer } from "../server.js";
+export declare function registerMemoryTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/memory.js

@@ -0,0 +1,60 @@
+import { requireOwnedAgent, requireReadableAgent } from "../auth/ownership.js";
+import { textResult } from "./text-result.js";
+export function registerMemoryTools(mcp) {
+    mcp.registerTool({
+        name: "get_agent_memory",
+        scope: "agents:read",
+        inputSchema: {
+            type: "object",
+            properties: { agentId: { type: "string" }, key: { type: "string" } },
+            required: ["agentId", "key"],
+        },
+        handler: async (args, ctx) => {
+            await requireReadableAgent(ctx.db, args.agentId, ctx.principal.id);
+            const content = await ctx.providers.memory.get(args.agentId, args.key);
+            return textResult({ content: content ?? null });
+        },
+    });
+    mcp.registerTool({
+        name: "list_agent_memory",
+        scope: "agents:read",
+        inputSchema: {
+            type: "object",
+            properties: { agentId: { type: "string" } },
+            required: ["agentId"],
+        },
+        handler: async (args, ctx) => {
+            await requireReadableAgent(ctx.db, args.agentId, ctx.principal.id);
+            const keys = await ctx.providers.memory.list(args.agentId);
+            return textResult(keys);
+        },
+    });
+    mcp.registerTool({
+        name: "set_agent_memory",
+        scope: "memory:write",
+        inputSchema: {
+            type: "object",
+            properties: { agentId: { type: "string" }, key: { type: "string" }, content: { type: "string" } },
+            required: ["agentId", "key", "content"],
+        },
+        handler: async (args, ctx) => {
+            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            await ctx.providers.memory.set(args.agentId, args.key, args.content);
+            return textResult({ ok: true });
+        },
+    });
+    mcp.registerTool({
+        name: "delete_agent_memory",
+        scope: "memory:write",
+        inputSchema: {
+            type: "object",
+            properties: { agentId: { type: "string" }, key: { type: "string" } },
+            required: ["agentId", "key"],
+        },
+        handler: async (args, ctx) => {
+            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            await ctx.providers.memory.delete(args.agentId, args.key);
+            return textResult({ ok: true });
+        },
+    });
+}

package/dist/mcp/tools/models.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Read-only lookup for which model IDs the deployment actually has an LLM
+ * provider registered for — without it, the only way to learn a valid
+ * model name was to trigger a run and read the "Known models" list off a
+ * failed run's error message.
+ */
+import type { WardbyMcpServer } from "../server.js";
+export declare function registerModelTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/models.js

@@ -0,0 +1,15 @@
+import { textResult } from "./text-result.js";
+export function registerModelTools(mcp) {
+    mcp.registerTool({
+        name: "list_models",
+        scope: "agents:read",
+        inputSchema: { type: "object", properties: {} },
+        handler: async (_args, ctx) => {
+            // Production always wires ctx.providers.llm as a RoutingLlmProvider
+            // (see buildMcpProviders in mcp/index.ts) — listModels() is specific
+            // to that composite router, not part of the single-provider LlmProvider seam.
+            const llm = ctx.providers.llm;
+            return textResult({ models: llm.listModels() });
+        },
+    });
+}

package/dist/mcp/tools/runs.d.ts

@@ -0,0 +1,2 @@
+import type { WardbyMcpServer } from "../server.js";
+export declare function registerRunTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/runs.js

@@ -0,0 +1,61 @@
+import { McpError } from "../errors.js";
+import { requireReadableAgent } from "../auth/ownership.js";
+import { publicCodingRunResult } from "../../coding/protocol.js";
+import { textResult } from "./text-result.js";
+export function registerRunTools(mcp) {
+    mcp.registerTool({
+        name: "list_runs",
+        scope: "agents:read",
+        inputSchema: {
+            type: "object",
+            properties: { agentId: { type: "string" }, status: { type: "string" }, limit: { type: "number" } },
+            required: ["agentId"],
+        },
+        handler: async (args, ctx) => {
+            await requireReadableAgent(ctx.db, args.agentId, ctx.principal.id);
+            const runs = await ctx.db.run.findMany({
+                where: { agentId: args.agentId, ...(args.status ? { status: args.status } : {}) },
+                take: args.limit,
+                orderBy: { startedAt: "desc" },
+            });
+            // Same rule as get_run: a pending coding run with queuedAt is waiting
+            // for a concurrency slot (CODING_MAX_CONCURRENT), not stuck.
+            const pendingIds = runs.filter((run) => run.status === "pending").map((run) => run.id);
+            const queued = pendingIds.length > 0
+                ? await ctx.db.codingRun.findMany({
+                    where: { runId: { in: pendingIds }, queuedAt: { not: null } },
+                    select: { runId: true, queuedAt: true },
+                })
+                : [];
+            const queuedAtByRun = new Map(queued.map((row) => [row.runId, row.queuedAt?.toISOString()]));
+            return textResult(runs.map((run) => {
+                const codingQueuedAt = queuedAtByRun.get(run.id);
+                return codingQueuedAt ? { ...run, codingQueuedAt } : run;
+            }));
+        },
+    });
+    mcp.registerTool({
+        name: "get_run",
+        scope: "agents:read",
+        inputSchema: { type: "object", properties: { runId: { type: "string" } }, required: ["runId"] },
+        handler: async (args, ctx) => {
+            const run = await ctx.db.run.findUnique({ where: { id: args.runId } });
+            if (!run)
+                throw new McpError(404, `Run "${args.runId}" not found.`);
+            await requireReadableAgent(ctx.db, run.agentId, ctx.principal.id);
+            const codingRun = await ctx.db.codingRun.findUnique({
+                where: { runId: run.id },
+                select: { result: true, queuedAt: true },
+            });
+            const codingResult = publicCodingRunResult(codingRun?.result);
+            // A pending coding run with queuedAt is waiting for a concurrency slot
+            // (CODING_MAX_CONCURRENT), not stuck.
+            const codingQueuedAt = run.status === "pending" && codingRun?.queuedAt ? codingRun.queuedAt.toISOString() : undefined;
+            return textResult({
+                ...run,
+                ...(codingResult ? { codingResult } : {}),
+                ...(codingQueuedAt ? { codingQueuedAt } : {}),
+            });
+        },
+    });
+}

package/dist/mcp/tools/scheduling.d.ts

@@ -0,0 +1,2 @@
+import type { WardbyMcpServer } from "../server.js";
+export declare function registerSchedulingTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/scheduling.js

@@ -0,0 +1,48 @@
+import { Prisma } from "@prisma/client";
+import { validateCronExpression } from "../../core/cron.js";
+import { McpError } from "../errors.js";
+import { assertCanMutate, requireOwnedAgent } from "../auth/ownership.js";
+import { textResult } from "./text-result.js";
+export function registerSchedulingTools(mcp) {
+    mcp.registerTool({
+        name: "set_schedule",
+        scope: "agents:write",
+        inputSchema: {
+            type: "object",
+            properties: { agentId: { type: "string" }, schedule: { type: "string" }, timezone: { type: "string" } },
+            required: ["agentId", "schedule", "timezone"],
+        },
+        handler: async (args, ctx) => {
+            try {
+                validateCronExpression(args.schedule, args.timezone);
+            }
+            catch (err) {
+                throw new McpError(400, `Invalid schedule/timezone: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            const agent = await ctx.db.$transaction(async (tx) => {
+                const existing = await tx.agent.findUnique({ where: { id: args.agentId }, include: { codingProfile: true } });
+                if (!existing)
+                    throw new McpError(404, `Agent "${args.agentId}" not found.`);
+                assertCanMutate(existing.ownerId, ctx.principal.id, `Agent "${args.agentId}" is not owned by the caller.`);
+                if (existing.kind === "coding" && !existing.codingProfile?.defaultTask) {
+                    throw new McpError(400, "A default task is required before enabling a coding-agent schedule.");
+                }
+                return tx.agent.update({
+                    where: { id: args.agentId },
+                    data: { schedule: args.schedule, timezone: args.timezone, scheduleEnabled: true },
+                });
+            }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });
+            return textResult(agent);
+        },
+    });
+    mcp.registerTool({
+        name: "disable_schedule",
+        scope: "agents:write",
+        inputSchema: { type: "object", properties: { agentId: { type: "string" } }, required: ["agentId"] },
+        handler: async (args, ctx) => {
+            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            const agent = await ctx.db.agent.update({ where: { id: args.agentId }, data: { scheduleEnabled: false } });
+            return textResult(agent);
+        },
+    });
+}

package/dist/mcp/tools/secret-elicitation-form.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The one-time browser form a secret-elicitation URL points to — shared by
+ * both hosts: stdio's ephemeral loopback server (secret-elicitation-server.ts)
+ * and the HTTP transport's mounted route (wired in streamable-http.ts). No
+ * JavaScript: a plain HTML form POST is enough for one password field, so
+ * CSP can forbid scripts outright rather than needing a nonce.
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { PrismaClient } from "@prisma/client";
+import type { SecretCipher } from "../../providers/secrets/types.js";
+import { type SecretElicitationPayload } from "./secret-elicitation.js";
+/** The HTTP-transport route path this form is mounted at (see streamable-http.ts). */
+export declare const SECRET_ELICITATION_PATH = "/elicit/secret";
+export interface SecretFormDeps {
+    verify: (token: string) => Promise<SecretElicitationPayload>;
+    secrets: SecretCipher;
+    db: PrismaClient;
+}
+/** Handles one GET (render) or POST (submit) for the secret-entry form at the given token. */
+export declare function handleSecretElicitationForm(method: string | undefined, token: string | null, readFormBody: () => Promise<URLSearchParams>, res: ServerResponse, deps: SecretFormDeps): Promise<void>;
+/** Reads a small `application/x-www-form-urlencoded` body (8 KiB cap — a secret value, nothing more). */
+export declare function readFormBody(req: IncomingMessage): Promise<URLSearchParams>;

package/dist/mcp/tools/secret-elicitation-form.js

@@ -0,0 +1,93 @@
+import { fulfillSecretElicitation } from "./secret-elicitation.js";
+/** The HTTP-transport route path this form is mounted at (see streamable-http.ts). */
+export const SECRET_ELICITATION_PATH = "/elicit/secret";
+function escape(value) {
+    return value.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+}
+const STYLE = `
+:root { color-scheme: light dark; }
+* { box-sizing: border-box; }
+body { margin: 0; min-height: 100vh; display: flex; align-items: center; justify-content: center; padding: 24px;
+  background: #f5f5f7; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
+.card { background: #fff; border-radius: 14px; box-shadow: 0 1px 3px rgba(0,0,0,.1), 0 8px 24px rgba(0,0,0,.08);
+  padding: 36px; max-width: 480px; width: 100%; }
+h1 { margin: 0 0 10px; font-size: 21px; }
+p { margin: 0 0 24px; color: #555; font-size: 14px; line-height: 1.5; }
+p strong { color: #111; }
+input[type=password] { display: block; width: 100%; padding: 16px 18px; font-size: 17px; letter-spacing: .02em;
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; border: 1px solid #d1d1d6; border-radius: 10px;
+  margin-bottom: 18px; }
+input[type=password]:focus { outline: none; border-color: #0071e3; box-shadow: 0 0 0 3px rgba(0,113,227,.15); }
+button { width: 100%; padding: 15px; font-size: 15px; font-weight: 600; color: #fff; background: #0071e3;
+  border: none; border-radius: 10px; cursor: pointer; }
+button:hover { background: #0077ed; }
+@media (prefers-color-scheme: dark) {
+  body { background: #1c1c1e; }
+  .card { background: #2c2c2e; box-shadow: none; }
+  h1 { color: #f5f5f7; }
+  p { color: #a1a1a6; }
+  p strong { color: #f5f5f7; }
+  input[type=password] { background: #1c1c1e; border-color: #48484a; color: #f5f5f7; }
+}`;
+function html(res, status, body) {
+    res.setHeader("content-security-policy", "default-src 'none'; script-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'");
+    res.setHeader("cache-control", "no-store");
+    res.setHeader("x-content-type-options", "nosniff");
+    res.setHeader("referrer-policy", "no-referrer");
+    res
+        .writeHead(status, { "content-type": "text/html; charset=utf-8" })
+        .end(`<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">` +
+        `<title>wardby secret entry</title><style>${STYLE}</style><body><div class="card">${body}</div></body></html>`);
+}
+/** Handles one GET (render) or POST (submit) for the secret-entry form at the given token. */
+export async function handleSecretElicitationForm(method, token, readFormBody, res, deps) {
+    let payload;
+    try {
+        if (!token)
+            throw new Error("missing token");
+        payload = await deps.verify(token);
+    }
+    catch {
+        html(res, 400, "<h1>Link expired</h1><p>This link is invalid or has expired. Return to your MCP client and try again.</p>");
+        return;
+    }
+    if (method === "GET") {
+        html(res, 200, `<h1>Enter secret value</h1><p>Name: <strong>${escape(payload.secretName)}</strong></p>` +
+            `<form method="post"><input type="password" name="value" autocomplete="off" required autofocus placeholder="Paste the value here">` +
+            `<button type="submit">Save</button></form>`);
+        return;
+    }
+    if (method === "POST") {
+        const body = await readFormBody();
+        const value = body.get("value") ?? "";
+        if (!value) {
+            html(res, 400, "<h1>A value is required.</h1>");
+            return;
+        }
+        const outcome = await fulfillSecretElicitation(payload, value, deps.secrets, deps.db);
+        if (outcome.ok)
+            html(res, 200, "<h1>Saved</h1><p>You can close this tab and return to your MCP client.</p>");
+        else
+            html(res, 400, `<h1>Could not save</h1><p>${escape(outcome.error)}</p>`);
+        return;
+    }
+    res.writeHead(405).end();
+}
+/** Reads a small `application/x-www-form-urlencoded` body (8 KiB cap — a secret value, nothing more). */
+export function readFormBody(req) {
+    return new Promise((resolve, reject) => {
+        let size = 0;
+        const chunks = [];
+        req.on("data", (chunk) => {
+            size += chunk.length;
+            if (size > 8192) {
+                reject(new Error("body_too_large"));
+                req.destroy();
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on("end", () => resolve(new URLSearchParams(Buffer.concat(chunks).toString("utf8"))));
+        req.on("error", reject);
+    });
+}

package/dist/mcp/tools/secret-elicitation-server.d.ts

@@ -0,0 +1,5 @@
+import type { SecretFormDeps } from "./secret-elicitation-form.js";
+export interface StdioSecretElicitationHost {
+    urlFor(token: string): Promise<string>;
+}
+export declare function createStdioSecretElicitationHost(deps: SecretFormDeps): StdioSecretElicitationHost;

package/dist/mcp/tools/secret-elicitation-server.js

@@ -0,0 +1,57 @@
+/**
+ * stdio-only host for the secret-entry form: an ephemeral, loopback-only
+ * HTTP server, started lazily on the first pending elicitation and closed
+ * after a period of inactivity. stdio's MCP process has no other listener
+ * (see mcp/transport/stdio.ts) — this one exists only while a secret entry
+ * is actually pending, consistent with stdio's "no token; the operator is
+ * trusted" model: reachable only from this same machine, and only a holder
+ * of the one-time signed URL can do anything with it.
+ */
+import { createServer } from "node:http";
+import { handleSecretElicitationForm, readFormBody } from "./secret-elicitation-form.js";
+/** Matches the requestState codec's own TTL (server.ts) — no point outliving the tokens it serves. */
+const IDLE_SHUTDOWN_MS = 10 * 60_000;
+export function createStdioSecretElicitationHost(deps) {
+    let server;
+    let port = 0;
+    let idleTimer;
+    function scheduleIdleShutdown() {
+        if (idleTimer)
+            clearTimeout(idleTimer);
+        idleTimer = setTimeout(() => {
+            server?.close();
+            server = undefined;
+        }, IDLE_SHUTDOWN_MS);
+        idleTimer.unref();
+    }
+    async function ensureServer() {
+        if (server) {
+            scheduleIdleShutdown();
+            return port;
+        }
+        const s = createServer((req, res) => {
+            scheduleIdleShutdown();
+            const url = new URL(req.url ?? "/", "http://127.0.0.1");
+            if (url.pathname !== "/secret") {
+                res.writeHead(404).end();
+                return;
+            }
+            void handleSecretElicitationForm(req.method, url.searchParams.get("t"), () => readFormBody(req), res, deps);
+        });
+        server = s;
+        await new Promise((resolve, reject) => {
+            s.once("error", reject);
+            s.listen(0, "127.0.0.1", resolve);
+        });
+        const address = s.address();
+        port = typeof address === "object" && address ? address.port : 0;
+        scheduleIdleShutdown();
+        return port;
+    }
+    return {
+        async urlFor(token) {
+            const p = await ensureServer();
+            return `http://127.0.0.1:${p}/secret?t=${encodeURIComponent(token)}`;
+        },
+    };
+}

package/dist/mcp/tools/secret-elicitation.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Out-of-band secret entry: `create_secret` called without a `value`
+ * mints a signed token (server.ts's mintRequestState/verifyRequestState)
+ * and hands the caller a one-time browser-form URL instead. The browser
+ * form writes the secret directly via `createSecret` — this module's
+ * `SecretElicitationOutcome` table is how the retried `tools/call` learns
+ * whether that write has happened yet.
+ *
+ * Backed by Postgres, not an in-process Map: a multi-instance HTTP
+ * deployment can serve the mint, the browser-form POST, and the polling
+ * retry from three different processes (see server.ts's `REQUEST_STATE_KEY`
+ * doc comment for the matching fix on the token side). Entries expire after
+ * ELICITATION_TTL_MS (matches server.ts's mintRequestState ttlSeconds: an
+ * elicitation nobody completes or polls within that window is abandoned).
+ * Expiry is swept lazily on every read and write via a `deleteMany` rather
+ * than a timer, so an idle process holds no interval.
+ */
+import type { PrismaClient } from "@prisma/client";
+import { type SecretMetadata } from "../../core/secrets.js";
+import type { SecretCipher } from "../../providers/secrets/types.js";
+export interface SecretElicitationPayload {
+    ownerId: string;
+    secretName: string;
+}
+export type SecretElicitationOutcome = {
+    ok: true;
+    secret: SecretMetadata;
+} | {
+    ok: false;
+    error: string;
+};
+export declare function getSecretElicitationOutcome(ownerId: string, secretName: string, db: PrismaClient): Promise<SecretElicitationOutcome | undefined>;
+/**
+ * Called by the browser form's POST handler. Idempotent — a resubmit for
+ * the same (ownerId, secretName) that's already fulfilled returns the
+ * recorded outcome rather than writing again.
+ */
+export declare function fulfillSecretElicitation(payload: SecretElicitationPayload, value: string, cipher: SecretCipher, db: PrismaClient): Promise<SecretElicitationOutcome>;