@wardby/cli 0.1.0

package/dist/mcp/tools/secret-elicitation.js

@@ -0,0 +1,52 @@
+import { createSecret } from "../../core/secrets.js";
+const ELICITATION_TTL_MS = 600_000;
+/** Sweeps every expired entry, not just the one being looked up, so a set-and-never-polled-again entry doesn't linger forever. */
+async function pruneExpired(db, now) {
+    await db.secretElicitationOutcome.deleteMany({ where: { expiresAt: { lte: now } } });
+}
+export async function getSecretElicitationOutcome(ownerId, secretName, db) {
+    const now = new Date();
+    await pruneExpired(db, now);
+    const row = await db.secretElicitationOutcome.findUnique({ where: { ownerId_secretName: { ownerId, secretName } } });
+    return row?.outcome;
+}
+/**
+ * Called by the browser form's POST handler. Idempotent — a resubmit for
+ * the same (ownerId, secretName) that's already fulfilled returns the
+ * recorded outcome rather than writing again.
+ */
+export async function fulfillSecretElicitation(payload, value, cipher, db) {
+    const now = new Date();
+    await pruneExpired(db, now);
+    const { ownerId, secretName } = payload;
+    const existing = await db.secretElicitationOutcome.findUnique({
+        where: { ownerId_secretName: { ownerId, secretName } },
+    });
+    if (existing)
+        return existing.outcome;
+    let outcome;
+    try {
+        const secret = await createSecret(secretName, value, ownerId, cipher, db);
+        outcome = {
+            ok: true,
+            secret: {
+                id: secret.id,
+                name: secret.name,
+                keyId: secret.keyId,
+                ownerId: secret.ownerId,
+                createdAt: secret.createdAt,
+                updatedAt: secret.updatedAt,
+            },
+        };
+    }
+    catch (err) {
+        outcome = { ok: false, error: err instanceof Error ? err.message : String(err) };
+    }
+    const expiresAt = new Date(now.getTime() + ELICITATION_TTL_MS);
+    await db.secretElicitationOutcome.upsert({
+        where: { ownerId_secretName: { ownerId, secretName } },
+        create: { ownerId, secretName, outcome, expiresAt },
+        update: { outcome, expiresAt },
+    });
+    return outcome;
+}

package/dist/mcp/tools/secrets.d.ts

@@ -0,0 +1,13 @@
+import type { WardbyMcpServer } from "../server.js";
+/** Builds the browser-form URL for a minted token — stdio's ephemeral loopback server or the HTTP transport's mounted route (see mcp/index.ts and streamable-http.ts). */
+export type SecretElicitationUrlBuilder = (token: string) => Promise<string>;
+export interface SecretsToolsOptions {
+    buildElicitationUrl: SecretElicitationUrlBuilder;
+    /**
+     * Use the MCP protocol's own URL-mode elicitation (InputRequiredResult)
+     * instead of the plain-text "here's a link, call me again" fallback.
+     * See McpConfig.secretElicitationProtocol for why this defaults off.
+     */
+    protocolElicitation: boolean;
+}
+export declare function registerSecretsTools(mcp: WardbyMcpServer, opts: SecretsToolsOptions): void;

package/dist/mcp/tools/secrets.js

@@ -0,0 +1,124 @@
+/**
+ * MCP secrets tools — thin wrappers over core/secrets.ts. The write-only /
+ * never-returned invariants are enforced there (listSecrets already omits
+ * value/ciphertext at the source); this file adds ownership on top.
+ */
+import { inputRequired, inputResponse } from "@modelcontextprotocol/server";
+import { createSecret, listSecrets, attachSecret, detachSecret, deleteSecret } from "../../core/secrets.js";
+import { McpError } from "../errors.js";
+import { requireOwnedAgent, requireOwnedSecret } from "../auth/ownership.js";
+import { getSecretElicitationOutcome } from "./secret-elicitation.js";
+import { textResult } from "./text-result.js";
+export function registerSecretsTools(mcp, opts) {
+    mcp.registerTool({
+        name: "create_secret",
+        scope: "secrets:write",
+        description: 'Creates a secret. Omit "value" to enter it securely via a one-time browser link instead of passing it as a plaintext argument.',
+        inputSchema: {
+            type: "object",
+            properties: { name: { type: "string" }, value: { type: "string" } },
+            required: ["name"],
+        },
+        handler: async (args, ctx) => {
+            if (args.value !== undefined) {
+                const secret = await createSecret(args.name, args.value, ctx.principal.id, ctx.providers.secrets, ctx.db);
+                return textResult({ id: secret.id, name: secret.name, keyId: secret.keyId, createdAt: secret.createdAt });
+            }
+            if (opts.protocolElicitation) {
+                const state = ctx.mcpReq.requestState();
+                if (state) {
+                    const view = inputResponse(ctx.mcpReq.inputResponses, "secretValue");
+                    if (view.kind === "elicit" && view.action !== "accept") {
+                        throw new McpError(400, `Secret entry was ${view.action}d.`);
+                    }
+                    // Not yet submitted in the browser falls through to the shared
+                    // outcome check below, then re-mints so the client's retry/cancel
+                    // controls apply to the fresh elicitation.
+                }
+            }
+            const existingOutcome = await getSecretElicitationOutcome(ctx.principal.id, args.name, ctx.db);
+            if (existingOutcome) {
+                if (!existingOutcome.ok)
+                    throw new McpError(400, existingOutcome.error);
+                return textResult(existingOutcome.secret);
+            }
+            const payload = { ownerId: ctx.principal.id, secretName: args.name };
+            const token = await mcp.mintRequestState(payload);
+            const url = await opts.buildElicitationUrl(token);
+            if (opts.protocolElicitation) {
+                return inputRequired({
+                    requestState: token,
+                    inputRequests: {
+                        secretValue: inputRequired.elicitUrl({
+                            url,
+                            message: `Enter the value for secret "${args.name}" in your browser.`,
+                        }),
+                    },
+                });
+            }
+            // Polling fallback: no MCP protocol feature required, so it works
+            // regardless of what the connecting client declares support for.
+            return textResult({
+                status: "pending",
+                message: `Open this link in your browser to enter the value for secret "${args.name}", then call create_secret again with the same name to finish.`,
+                url,
+            });
+        },
+    });
+    mcp.registerTool({
+        name: "list_secrets",
+        scope: "secrets:write",
+        inputSchema: { type: "object", properties: {} },
+        handler: async (_args, ctx) => {
+            const secrets = await listSecrets(ctx.principal.id, ctx.db);
+            return textResult(secrets);
+        },
+    });
+    mcp.registerTool({
+        name: "attach_secret",
+        scope: "secrets:write",
+        inputSchema: {
+            type: "object",
+            properties: {
+                agentId: { type: "string" },
+                name: { type: "string" },
+                alias: { type: "string" },
+            },
+            required: ["agentId", "name"],
+        },
+        handler: async (args, ctx) => {
+            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            try {
+                await attachSecret(args.agentId, args.name, ctx.principal.id, ctx.db, args.alias ?? args.name);
+            }
+            catch (err) {
+                throw new McpError(404, err instanceof Error ? err.message : String(err));
+            }
+            return textResult({ attached: true });
+        },
+    });
+    mcp.registerTool({
+        name: "detach_secret",
+        scope: "secrets:write",
+        inputSchema: {
+            type: "object",
+            properties: { agentId: { type: "string" }, name: { type: "string" } },
+            required: ["agentId", "name"],
+        },
+        handler: async (args, ctx) => {
+            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            await detachSecret(args.agentId, args.name, ctx.db);
+            return textResult({ detached: true });
+        },
+    });
+    mcp.registerTool({
+        name: "delete_secret",
+        scope: "secrets:write",
+        inputSchema: { type: "object", properties: { id: { type: "string" } }, required: ["id"] },
+        handler: async (args, ctx) => {
+            await requireOwnedSecret(ctx.db, args.id, ctx.principal.id);
+            await deleteSecret(args.id, ctx.db);
+            return textResult({ deleted: args.id });
+        },
+    });
+}

package/dist/mcp/tools/subagents.d.ts

@@ -0,0 +1,2 @@
+import type { WardbyMcpServer } from "../server.js";
+export declare function registerSubAgentTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/subagents.js

@@ -0,0 +1,133 @@
+/**
+ * AgentSubAgent CRUD — agent-composition edges. Attach/detach require
+ * ownership of both the parent and child agent (same convention as
+ * attach_tool requiring ownership of both the agent and the tool), and
+ * attach rejects any edge that would create a cycle in the parent/child
+ * graph (§7 of the design doc) — cycles are not something Postgres can
+ * enforce natively.
+ */
+import { Prisma } from "@prisma/client";
+import { requireOwnedAgent } from "../auth/ownership.js";
+import { McpError } from "../errors.js";
+import { textResult } from "./text-result.js";
+/**
+ * True if `fromAgentId` can already reach `toAgentId` by following existing
+ * parent -> child edges. Attaching a new edge parentAgentId -> childAgentId
+ * is only safe when childAgentId cannot already reach parentAgentId --
+ * otherwise the new edge would close a cycle. Loads the whole edge set and
+ * walks it in JS rather than a recursive SQL query: the edge count is
+ * expected to stay small (agent-composition graphs, not a general graph
+ * store), and this keeps the check readable and easy to unit test.
+ */
+async function canReach(db, fromAgentId, toAgentId) {
+    const edges = await db.agentSubAgent.findMany({ select: { parentAgentId: true, childAgentId: true } });
+    const childrenOf = new Map();
+    for (const edge of edges) {
+        const list = childrenOf.get(edge.parentAgentId) ?? [];
+        list.push(edge.childAgentId);
+        childrenOf.set(edge.parentAgentId, list);
+    }
+    const seen = new Set([fromAgentId]);
+    const stack = [fromAgentId];
+    while (stack.length > 0) {
+        const current = stack.pop();
+        if (current === toAgentId)
+            return true;
+        for (const next of childrenOf.get(current) ?? []) {
+            if (!seen.has(next)) {
+                seen.add(next);
+                stack.push(next);
+            }
+        }
+    }
+    return false;
+}
+export function registerSubAgentTools(mcp) {
+    mcp.registerTool({
+        name: "attach_subagent",
+        scope: "agents:write",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                parentAgentId: { type: "string" },
+                childAgentId: { type: "string" },
+                boundName: { type: "string", minLength: 1 },
+            },
+            required: ["parentAgentId", "childAgentId"],
+        },
+        handler: async (args, ctx) => {
+            if (args.parentAgentId === args.childAgentId) {
+                throw new McpError(400, "An agent cannot be its own sub-agent.");
+            }
+            const parent = await requireOwnedAgent(ctx.db, args.parentAgentId, ctx.principal.id);
+            const child = await requireOwnedAgent(ctx.db, args.childAgentId, ctx.principal.id);
+            if (await canReach(ctx.db, args.childAgentId, args.parentAgentId)) {
+                throw new McpError(400, `Attaching "${child.name}" as a sub-agent of "${parent.name}" would create a cycle.`);
+            }
+            const boundName = args.boundName ?? child.name;
+            try {
+                await ctx.db.agentSubAgent.upsert({
+                    where: { parentAgentId_childAgentId: { parentAgentId: args.parentAgentId, childAgentId: args.childAgentId } },
+                    create: { parentAgentId: args.parentAgentId, childAgentId: args.childAgentId, boundName },
+                    update: { boundName },
+                });
+            }
+            catch (err) {
+                if (err instanceof Prisma.PrismaClientKnownRequestError && err.code === "P2002") {
+                    throw new McpError(409, `"${parent.name}" already has a different sub-agent bound to name "${boundName}".`);
+                }
+                throw err;
+            }
+            return textResult({ attached: true, boundName });
+        },
+    });
+    mcp.registerTool({
+        name: "detach_subagent",
+        scope: "agents:write",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                parentAgentId: { type: "string" },
+                childAgentId: { type: "string" },
+            },
+            required: ["parentAgentId", "childAgentId"],
+        },
+        handler: async (args, ctx) => {
+            await requireOwnedAgent(ctx.db, args.parentAgentId, ctx.principal.id);
+            await requireOwnedAgent(ctx.db, args.childAgentId, ctx.principal.id);
+            await ctx.db.agentSubAgent.deleteMany({
+                where: { parentAgentId: args.parentAgentId, childAgentId: args.childAgentId },
+            });
+            return textResult({ detached: true });
+        },
+    });
+    mcp.registerTool({
+        name: "list_subagents",
+        scope: "agents:read",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: { agentId: { type: "string" } },
+            required: ["agentId"],
+        },
+        handler: async (args, ctx) => {
+            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            const [asParent, asChild] = await Promise.all([
+                ctx.db.agentSubAgent.findMany({
+                    where: { parentAgentId: args.agentId },
+                    include: { child: { select: { id: true, name: true } } },
+                }),
+                ctx.db.agentSubAgent.findMany({
+                    where: { childAgentId: args.agentId },
+                    include: { parent: { select: { id: true, name: true } } },
+                }),
+            ]);
+            return textResult({
+                children: asParent.map((e) => ({ boundName: e.boundName, agentId: e.child.id, agentName: e.child.name })),
+                parents: asChild.map((e) => ({ boundName: e.boundName, agentId: e.parent.id, agentName: e.parent.name })),
+            });
+        },
+    });
+}

package/dist/mcp/tools/text-result.d.ts

@@ -0,0 +1,6 @@
+export declare function textResult(value: unknown): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+};

package/dist/mcp/tools/text-result.js

@@ -0,0 +1,3 @@
+export function textResult(value) {
+    return { content: [{ type: "text", text: JSON.stringify(value) }] };
+}

package/dist/mcp/tools/tools.d.ts

@@ -0,0 +1,2 @@
+import type { WardbyMcpServer } from "../server.js";
+export declare function registerToolAuthoringTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/tools.js

@@ -0,0 +1,211 @@
+/**
+ * Tool authoring — raw path only (Amendment A: the guided Elicitation/Tasks
+ * flow is deferred; this ships create_tool + dry_run_tool as the
+ * test-before-commit loop instead). A compile/validation failure is a
+ * NORMAL tool result carrying `{ok:false, errorKind, errorMessage}` — not
+ * an isError — since the call itself succeeded (compilation was attempted
+ * and correctly reported a problem the caller can fix and retry), matching
+ * runInSandbox's own SandboxResult convention. Ownership/scope failures
+ * (attach/detach on an agent or tool you don't own) DO throw, same
+ * convention as every other tool in this codebase.
+ */
+import { Prisma } from "@prisma/client";
+import { deriveJsonSchema, validateParams } from "../../sandbox/zod-params.js";
+import { runInSandbox } from "../../sandbox/run-in-sandbox.js";
+import { ToolCapabilitiesPatchSchema } from "../../sandbox/tool-capabilities.js";
+import { buildSharedDatastoreAccessor } from "../../core/datastores.js";
+import { MEMORY_TOOL_NAMES } from "../../core/memory-tools.js";
+import { McpError } from "../errors.js";
+import { assertCanMutate, requireOwnedAgent, requireOwnedTool, requireReadableAgent, visibleToPrincipal, canRead, } from "../auth/ownership.js";
+import { textResult } from "./text-result.js";
+export function registerToolAuthoringTools(mcp) {
+    mcp.registerTool({
+        name: "create_tool",
+        scope: "tools:write",
+        inputSchema: {
+            type: "object",
+            properties: {
+                name: { type: "string" },
+                description: { type: "string" },
+                paramsZod: { type: "string" },
+                code: { type: "string" },
+            },
+            required: ["name", "description", "paramsZod", "code"],
+        },
+        handler: async (args, ctx) => {
+            if (MEMORY_TOOL_NAMES.has(args.name)) {
+                throw new McpError(400, `Tool name "${args.name}" is reserved for the built-in agent-memory tools.`);
+            }
+            const schemaResult = await deriveJsonSchema(args.paramsZod);
+            if (!schemaResult.ok) {
+                return textResult({ ok: false, errorKind: schemaResult.errorKind, errorMessage: schemaResult.errorMessage });
+            }
+            const tool = await ctx.db.tool.create({
+                data: {
+                    name: args.name,
+                    description: args.description,
+                    paramsZod: args.paramsZod,
+                    code: args.code,
+                    jsonSchema: schemaResult.value,
+                    ownerId: ctx.principal.id,
+                },
+            });
+            return textResult(tool);
+        },
+    });
+    mcp.registerTool({
+        name: "dry_run_tool",
+        scope: "tools:write",
+        description: "Test-runs tool code against sample args without persisting it. Fetch is denied by default, same as a freshly attached tool — pass allowedHosts to test code that calls fetch().",
+        inputSchema: {
+            type: "object",
+            properties: {
+                paramsZod: { type: "string" },
+                code: { type: "string" },
+                sampleArgs: { type: "object" },
+                allowedHosts: { type: "array", items: { type: "string" } },
+            },
+            required: ["paramsZod", "code", "sampleArgs"],
+        },
+        handler: async (args, ctx) => {
+            const hosts = ToolCapabilitiesPatchSchema.pick({ allowedHosts: true }).safeParse({
+                allowedHosts: args.allowedHosts,
+            });
+            if (!hosts.success) {
+                throw new McpError(400, `Invalid allowedHosts: ${hosts.error.issues.map((i) => i.message).join("; ")}`);
+            }
+            const schemaResult = await deriveJsonSchema(args.paramsZod);
+            if (!schemaResult.ok) {
+                return textResult({ ok: false, errorKind: schemaResult.errorKind, errorMessage: schemaResult.errorMessage });
+            }
+            const jsonSchema = schemaResult.value;
+            const validated = await validateParams(args.paramsZod, args.sampleArgs);
+            if (!validated.ok) {
+                return textResult({
+                    jsonSchema,
+                    result: { ok: false, errorKind: validated.errorKind, errorMessage: validated.errorMessage },
+                });
+            }
+            // No real agent exists for a dry run — the caller's own principal
+            // scopes the sandbox's datastore access, keeping dry-run reads/writes
+            // isolated per-caller rather than colliding across authors. Fetch is
+            // deny-by-default here too — same posture as a freshly attached tool
+            // (OWASP LLM08) — rather than the unconditional wildcard this used to
+            // pass; a caller testing fetch-dependent code must declare the hosts
+            // it needs, same as at attach_tool time. sharedDatastore is likewise
+            // unscoped here: there's no tool attachment to carry
+            // allowedSharedDatastorePrefixes for a dry run, so it resolves exactly
+            // like a real agent with no shared-datastore attachments at all
+            // (empty reads, throwing writes) — never a capability-scoping bypass.
+            const sandboxResult = await runInSandbox({
+                code: args.code,
+                params: validated.value,
+                agentId: ctx.principal.id,
+                datastore: ctx.providers.datastore,
+                sharedDatastore: buildSharedDatastoreAccessor(ctx.principal.id, ctx.providers.datastore, ctx.db),
+                toolName: "dry_run_tool",
+                allowedFetchHosts: hosts.data.allowedHosts ?? [],
+            });
+            return textResult({ jsonSchema, result: sandboxResult });
+        },
+    });
+    mcp.registerTool({
+        name: "attach_tool",
+        scope: "tools:write",
+        inputSchema: {
+            type: "object",
+            properties: {
+                agentId: { type: "string" },
+                toolId: { type: "string" },
+                allowedSecrets: { type: "array", items: { type: "string" } },
+                allowedDatastorePrefixes: { type: "array", items: { type: "string" } },
+                allowedHosts: { type: "array", items: { type: "string" } },
+                // { [boundName]: allowedKeyPrefixes[] } — per shared-datastore
+                // attachment, the same default-deny grant as allowedDatastorePrefixes
+                // is for the agent's private store. A boundName absent from this map
+                // denies that shared store entirely.
+                allowedSharedDatastorePrefixes: {
+                    type: "object",
+                    additionalProperties: { type: "array", items: { type: "string" } },
+                },
+            },
+            required: ["agentId", "toolId"],
+        },
+        handler: async (args, ctx) => {
+            const patch = ToolCapabilitiesPatchSchema.safeParse({
+                allowedSecrets: args.allowedSecrets,
+                allowedDatastorePrefixes: args.allowedDatastorePrefixes,
+                allowedHosts: args.allowedHosts,
+                allowedSharedDatastorePrefixes: args.allowedSharedDatastorePrefixes,
+            });
+            if (!patch.success) {
+                throw new McpError(400, `Invalid tool capabilities: ${patch.error.issues.map((i) => i.message).join("; ")}`);
+            }
+            await ctx.db.$transaction(async (tx) => {
+                const agent = await tx.agent.findUnique({ where: { id: args.agentId } });
+                if (!agent)
+                    throw new McpError(404, `Agent "${args.agentId}" not found.`);
+                assertCanMutate(agent.ownerId, ctx.principal.id, `Agent "${args.agentId}" is not owned by the caller.`);
+                if (agent.kind === "coding") {
+                    throw new McpError(400, "Native sandbox tools cannot be attached to coding agents.");
+                }
+                await requireOwnedTool(tx, args.toolId, ctx.principal.id);
+                await tx.agentTool.upsert({
+                    where: { agentId_toolId: { agentId: args.agentId, toolId: args.toolId } },
+                    create: {
+                        agentId: args.agentId,
+                        toolId: args.toolId,
+                        allowedSecrets: patch.data.allowedSecrets ?? [],
+                        allowedDatastorePrefixes: patch.data.allowedDatastorePrefixes ?? [],
+                        allowedHosts: patch.data.allowedHosts ?? [],
+                        allowedSharedDatastorePrefixes: patch.data.allowedSharedDatastorePrefixes ?? {},
+                    },
+                    update: {
+                        ...(patch.data.allowedSecrets !== undefined ? { allowedSecrets: patch.data.allowedSecrets } : {}),
+                        ...(patch.data.allowedDatastorePrefixes !== undefined
+                            ? { allowedDatastorePrefixes: patch.data.allowedDatastorePrefixes }
+                            : {}),
+                        ...(patch.data.allowedHosts !== undefined ? { allowedHosts: patch.data.allowedHosts } : {}),
+                        ...(patch.data.allowedSharedDatastorePrefixes !== undefined
+                            ? { allowedSharedDatastorePrefixes: patch.data.allowedSharedDatastorePrefixes }
+                            : {}),
+                    },
+                });
+            }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });
+            return textResult({ attached: true });
+        },
+    });
+    mcp.registerTool({
+        name: "detach_tool",
+        scope: "tools:write",
+        inputSchema: {
+            type: "object",
+            properties: { agentId: { type: "string" }, toolId: { type: "string" } },
+            required: ["agentId", "toolId"],
+        },
+        handler: async (args, ctx) => {
+            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            await requireOwnedTool(ctx.db, args.toolId, ctx.principal.id);
+            await ctx.db.agentTool.deleteMany({ where: { agentId: args.agentId, toolId: args.toolId } });
+            return textResult({ detached: true });
+        },
+    });
+    mcp.registerTool({
+        name: "list_tools",
+        scope: "tools:write",
+        inputSchema: { type: "object", properties: { agentId: { type: "string" } } },
+        handler: async (args, ctx) => {
+            const project = (tool) => tool.ownerId === ctx.principal.id ? tool : { id: tool.id, name: tool.name, description: tool.description };
+            if (args.agentId) {
+                await requireReadableAgent(ctx.db, args.agentId, ctx.principal.id);
+                const rows = await ctx.db.agentTool.findMany({ where: { agentId: args.agentId }, include: { tool: true } });
+                return textResult(rows
+                    .map((r) => r.tool)
+                    .filter((tool) => canRead(tool.ownerId, ctx.principal.id))
+                    .map(project));
+            }
+            const tools = await ctx.db.tool.findMany({ where: visibleToPrincipal(ctx.principal.id) });
+            return textResult(tools.filter((tool) => canRead(tool.ownerId, ctx.principal.id)).map(project));
+        },
+    });
+}

package/dist/mcp/tools/trigger.d.ts

@@ -0,0 +1,2 @@
+import type { WardbyMcpServer } from "../server.js";
+export declare function registerTriggerTool(mcp: WardbyMcpServer): void;