@wardby/cli 0.2.0 → 0.3.0

package/dist/mcp/tools/services.js

@@ -0,0 +1,222 @@
+/**
+ * The coding-run service catalog over MCP (docs/coding-services.md). Reading
+ * it needs only agents:read: agent owners need to see which services exist and
+ * the variables (testEnv) their tests will get before allowing one, and entries
+ * hold no secrets (serviceEnv values are throwaway per-run test credentials).
+ * Changing it needs services:manage, a privileged scope honoured only with a
+ * role granting it (service-manager or admin; resource-server.ts): an entry
+ * decides which image runs next to every coding run that names it, and with
+ * what. Each change is audit-logged (event coding.service_catalog.<action>).
+ * Built-in entries ship with wardby and change only with a release.
+ */
+import { z } from "zod";
+import { CodingServiceDefinitionSchema, catalogEntryFromRow, codingServiceNameSchema, codingServiceVersionSchema, } from "../../coding/services/catalog.js";
+import { logger } from "../../core/logger.js";
+import { McpError } from "../errors.js";
+import { textResult } from "./text-result.js";
+const servicesLog = logger.child({ module: "mcp-services" });
+const KeySchema = z.object({ name: codingServiceNameSchema, version: codingServiceVersionSchema }).strict();
+/** Everything but the key is optional here; the merged entry is validated in full. */
+const UpdateSchema = z
+    .object({
+    name: codingServiceNameSchema,
+    version: codingServiceVersionSchema,
+    image: z.unknown().optional(),
+    port: z.unknown().optional(),
+    serviceEnv: z.unknown().optional(),
+    testEnv: z.unknown().optional(),
+    readiness: z.unknown().optional(),
+    resources: z.unknown().optional(),
+    dataPath: z.unknown().optional(),
+    writablePaths: z.unknown().optional(),
+})
+    .strict();
+function parse(schema, label, value) {
+    const result = schema.safeParse(value);
+    if (!result.success) {
+        const details = result.error.issues
+            .map((issue) => `${issue.path.join(".") || "input"}: ${issue.message}`)
+            .join("; ");
+        throw new McpError(400, `Invalid ${label}: ${details}`);
+    }
+    return result.data;
+}
+function audit(ctx, action, entry) {
+    servicesLog.info({
+        event: `coding.service_catalog.${action}`,
+        name: entry.name,
+        version: entry.version,
+        ...(entry.image ? { image: entry.image } : {}),
+        by: ctx.principal.id,
+    }, "coding service catalog changed");
+}
+async function findEntry(ctx, key) {
+    const row = await ctx.db.codingService.findUnique({ where: { name_version: key } });
+    if (!row)
+        throw new McpError(404, `No coding service "${key.name} ${key.version}" in the catalog.`);
+    return row;
+}
+function refuseBuiltin(key) {
+    return new McpError(403, `"${key.name} ${key.version}" is built in: built-in services change only with a wardby release. Create an entry under another name or version instead.`);
+}
+function view(row) {
+    return { ...catalogEntryFromRow(row), builtin: row.builtin, createdAt: row.createdAt, updatedAt: row.updatedAt };
+}
+const keyJsonSchema = {
+    name: { type: "string", description: 'Catalog name a repository declares, e.g. "postgres".' },
+    version: { type: "string", description: 'Version a repository declares, e.g. "16".' },
+};
+const definitionProperties = {
+    ...keyJsonSchema,
+    image: { type: "string", description: "Registry digest to run: repo@sha256:<64 hex>. Tags are refused." },
+    port: {
+        type: "integer",
+        minimum: 1,
+        maximum: 65535,
+        description: "The port the service listens on (informational).",
+    },
+    serviceEnv: {
+        type: "object",
+        additionalProperties: { type: "string" },
+        description: "Environment for the service container. Throwaway per-run values only, never secrets.",
+    },
+    testEnv: {
+        type: "object",
+        additionalProperties: { type: "string" },
+        description: "Variables the agent's shells receive (e.g. DATABASE_URL). Upper-case names; wardby's own names (PATH, HOME, PIP_*, WARDBY_*, ...) are refused.",
+    },
+    readiness: {
+        type: "object",
+        additionalProperties: false,
+        required: ["command", "periodSeconds", "timeoutSeconds", "failureThreshold"],
+        properties: {
+            command: { type: "array", minItems: 1, maxItems: 16, items: { type: "string" } },
+            periodSeconds: { type: "integer", minimum: 1, maximum: 60 },
+            timeoutSeconds: { type: "integer", minimum: 1, maximum: 60 },
+            failureThreshold: { type: "integer", minimum: 1, maximum: 120 },
+        },
+        description: "Startup probe: a command in the service's image that succeeds once it accepts connections on 127.0.0.1.",
+    },
+    resources: {
+        type: "object",
+        additionalProperties: false,
+        required: ["cpuMillicores", "memoryMib", "diskMib"],
+        properties: {
+            cpuMillicores: { type: "integer", minimum: 100, maximum: 4000 },
+            memoryMib: { type: "integer", minimum: 64, maximum: 16384 },
+            diskMib: { type: "integer", minimum: 64, maximum: 8192 },
+        },
+        description: "Requests equal limits. diskMib sizes the data volume.",
+    },
+    dataPath: {
+        type: "string",
+        description: "Absolute directory the service writes its data to: an empty volume in each run.",
+    },
+    writablePaths: {
+        type: "array",
+        maxItems: 4,
+        items: { type: "string" },
+        description: "Further directories the image writes to (a socket directory, /tmp); its root filesystem is read-only.",
+    },
+};
+export function registerServiceTools(mcp) {
+    mcp.registerTool({
+        name: "list_services",
+        scope: "agents:read",
+        description: "The coding-run service catalog (name, version, image, built in or not): the names a coding agent's codingProfile.services can allow.",
+        inputSchema: { type: "object", additionalProperties: false, properties: {} },
+        handler: async (_args, ctx) => {
+            const rows = await ctx.db.codingService.findMany({ orderBy: [{ name: "asc" }, { version: "asc" }] });
+            return textResult(rows.map((row) => ({
+                name: row.name,
+                version: row.version,
+                kind: row.kind,
+                image: row.image,
+                port: row.port,
+                builtin: row.builtin,
+            })));
+        },
+    });
+    mcp.registerTool({
+        name: "get_service",
+        scope: "agents:read",
+        description: "One catalog entry in full, including the variables (testEnv) a run's shells receive — the contract a repository's tests rely on.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["name", "version"],
+            properties: keyJsonSchema,
+        },
+        handler: async (rawArgs, ctx) => {
+            const key = parse(KeySchema, "get_service arguments", rawArgs);
+            return textResult(view(await findEntry(ctx, key)));
+        },
+    });
+    mcp.registerTool({
+        name: "create_service",
+        scope: "services:manage",
+        description: "Service managers (services:manage): add a catalog entry repositories can then declare in .wardby/services.yaml. The image must be pinned by digest; kind is sidecar (a fresh instance in each run's pod).",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["name", "version", "image", "port", "readiness", "resources", "dataPath"],
+            // kind is checked by the zod schema (only "sidecar" today), so a refusal names the field.
+            properties: { ...definitionProperties, kind: { type: "string", description: 'Only "sidecar" today.' } },
+        },
+        handler: async (rawArgs, ctx) => {
+            const definition = parse(CodingServiceDefinitionSchema, "create_service arguments", rawArgs);
+            const key = { name: definition.name, version: definition.version };
+            if (await ctx.db.codingService.findUnique({ where: { name_version: key } })) {
+                throw new McpError(409, `The catalog already has "${key.name} ${key.version}"; use update_service to change it.`);
+            }
+            const row = await ctx.db.codingService.create({
+                data: { ...definition, builtin: false, createdById: ctx.principal.id },
+            });
+            audit(ctx, "create", definition);
+            return textResult(view(row));
+        },
+    });
+    mcp.registerTool({
+        name: "update_service",
+        scope: "services:manage",
+        description: "Service managers (services:manage): change a non-built-in catalog entry (name and version identify it and never change). Runs already dispatched keep the entry they started with.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["name", "version"],
+            properties: definitionProperties,
+        },
+        handler: async (rawArgs, ctx) => {
+            const { name, version, ...patch } = parse(UpdateSchema, "update_service arguments", rawArgs);
+            const row = await findEntry(ctx, { name, version });
+            if (row.builtin)
+                throw refuseBuiltin({ name, version });
+            const changes = Object.fromEntries(Object.entries(patch).filter(([, value]) => value !== undefined));
+            const next = parse(CodingServiceDefinitionSchema, "coding service", { ...catalogEntryFromRow(row), ...changes });
+            const { name: _name, version: _version, kind: _kind, ...fields } = next;
+            const updated = await ctx.db.codingService.update({ where: { name_version: { name, version } }, data: fields });
+            audit(ctx, "update", next);
+            return textResult(view(updated));
+        },
+    });
+    mcp.registerTool({
+        name: "delete_service",
+        scope: "services:manage",
+        description: "Service managers (services:manage): remove a non-built-in catalog entry. Repositories still declaring it are refused at their next run (service_unknown).",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["name", "version"],
+            properties: keyJsonSchema,
+        },
+        handler: async (rawArgs, ctx) => {
+            const key = parse(KeySchema, "delete_service arguments", rawArgs);
+            const row = await findEntry(ctx, key);
+            if (row.builtin)
+                throw refuseBuiltin(key);
+            await ctx.db.codingService.delete({ where: { name_version: key } });
+            audit(ctx, "delete", key);
+            return textResult({ deleted: key });
+        },
+    });
+}

package/dist/mcp/tools/subagents.js

@@ -1,13 +1,20 @@
 /**
- * AgentSubAgent CRUD — agent-composition edges. Attach/detach require
- * ownership of both the parent and child agent (same convention as
- * attach_tool requiring ownership of both the agent and the tool), and
- * attach rejects any edge that would create a cycle in the parent/child
- * graph (§7 of the design doc) — cycles are not something Postgres can
- * enforce natively.
+ * AgentSubAgent CRUD — agent-composition edges. An edge runs the child
+ * (with its owner's bindings) whenever the parent delegates, and hands the
+ * child whatever the parent's runs pass it, so it is a binding of the
+ * parent: only the parent's owner attaches or detaches one (review I2; a
+ * write-grantee could otherwise route every run's data to their own agent).
+ * Across owners it also needs an explicit grant (resource-sharing grants
+ * spec §3.4.4, N1): the caller needs execute on the child, and the parent's
+ * owner must be the child's owner or hold execute on it (canDelegate,
+ * re-checked on every delegation at run time). The child's owner can
+ * always cut an edge. Attach also rejects any edge that would
+ * create a cycle in the parent/child graph (§7 of the design doc) — cycles
+ * are not something Postgres can enforce natively.
  */
-import { Prisma } from "@prisma/client";
-import { requireOwnedAgent } from "../auth/ownership.js";
+import { Prisma } from "#prisma";
+import { atLeast, canDelegate } from "../../core/grants.js";
+import { agentAccess, agentAccessResolver, agentNotFound, requireAgentAccess, requireBindingOwner, } from "../auth/access.js";
 import { McpError } from "../errors.js";
 import { textResult } from "./text-result.js";
 /**
@@ -60,8 +67,16 @@ export function registerSubAgentTools(mcp) {
             if (args.parentAgentId === args.childAgentId) {
                 throw new McpError(400, "An agent cannot be its own sub-agent.");
             }
-            const parent = await requireOwnedAgent(ctx.db, args.parentAgentId, ctx.principal.id);
-            const child = await requireOwnedAgent(ctx.db, args.childAgentId, ctx.principal.id);
+            const { agent: parent } = await requireAgentAccess(ctx, args.parentAgentId, "read");
+            requireBindingOwner(ctx, parent);
+            // The caller could trigger the child anyway; the edge must not widen that.
+            const { agent: child } = await requireAgentAccess(ctx, args.childAgentId, "execute");
+            if (parent.ownerId === null) {
+                throw new McpError(403, `Agent "${parent.id}" has no owner, so it can't take sub-agents; an admin can assign one with make_owner.`);
+            }
+            if (!(await canDelegate(ctx.db, parent, child))) {
+                throw new McpError(403, `"${child.name}" belongs to another owner, who has not given the owner of "${parent.name}" execute access to it.`);
+            }
             if (await canReach(ctx.db, args.childAgentId, args.parentAgentId)) {
                 throw new McpError(400, `Attaching "${child.name}" as a sub-agent of "${parent.name}" would create a cycle.`);
             }
@@ -95,8 +110,20 @@ export function registerSubAgentTools(mcp) {
             required: ["parentAgentId", "childAgentId"],
         },
         handler: async (args, ctx) => {
-            await requireOwnedAgent(ctx.db, args.parentAgentId, ctx.principal.id);
-            await requireOwnedAgent(ctx.db, args.childAgentId, ctx.principal.id);
+            // The parent's owner (or the stdio operator), or the child's owner: a
+            // child's owner can always take its agent back out of someone else's
+            // composition.
+            const [parent, child] = await Promise.all([
+                ctx.db.agent.findUnique({ where: { id: args.parentAgentId } }),
+                ctx.db.agent.findUnique({ where: { id: args.childAgentId } }),
+            ]);
+            const parentAccess = parent ? await agentAccess(ctx, parent) : "none";
+            const childAccess = child ? await agentAccess(ctx, child) : "none";
+            if (parentAccess !== "owner" && childAccess !== "owner") {
+                if (!atLeast("agent", parentAccess, "read"))
+                    throw agentNotFound(args.parentAgentId);
+                throw new McpError(403, `Detaching needs ownership of "${args.parentAgentId}" or of "${args.childAgentId}".`);
+            }
             await ctx.db.agentSubAgent.deleteMany({
                 where: { parentAgentId: args.parentAgentId, childAgentId: args.childAgentId },
             });
@@ -113,20 +140,29 @@ export function registerSubAgentTools(mcp) {
             required: ["agentId"],
         },
         handler: async (args, ctx) => {
-            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            await requireAgentAccess(ctx, args.agentId, "read");
+            const accessOf = await agentAccessResolver(ctx);
             const [asParent, asChild] = await Promise.all([
                 ctx.db.agentSubAgent.findMany({
                     where: { parentAgentId: args.agentId },
-                    include: { child: { select: { id: true, name: true } } },
+                    include: { child: { select: { id: true, name: true, ownerId: true } } },
                 }),
                 ctx.db.agentSubAgent.findMany({
                     where: { childAgentId: args.agentId },
-                    include: { parent: { select: { id: true, name: true } } },
+                    include: { parent: { select: { id: true, name: true, ownerId: true } } },
                 }),
             ]);
+            // Only agents the caller can read are named; the rest are counted.
+            const readable = (agent) => atLeast("agent", accessOf(agent), "read");
+            const children = asParent.filter((e) => readable(e.child));
+            const parents = asChild.filter((e) => readable(e.parent));
+            const hiddenChildren = asParent.length - children.length;
+            const hiddenParents = asChild.length - parents.length;
             return textResult({
-                children: asParent.map((e) => ({ boundName: e.boundName, agentId: e.child.id, agentName: e.child.name })),
-                parents: asChild.map((e) => ({ boundName: e.boundName, agentId: e.parent.id, agentName: e.parent.name })),
+                children: children.map((e) => ({ boundName: e.boundName, agentId: e.child.id, agentName: e.child.name })),
+                parents: parents.map((e) => ({ boundName: e.boundName, agentId: e.parent.id, agentName: e.parent.name })),
+                ...(hiddenChildren > 0 ? { hiddenChildren } : {}),
+                ...(hiddenParents > 0 ? { hiddenParents } : {}),
             });
         },
     });

package/dist/mcp/tools/tools.d.ts

@@ -1,2 +1,43 @@
+/**
+ * Tool authoring — raw path only (Amendment A: the guided Elicitation/Tasks
+ * flow is deferred; this ships create_tool + dry_run_tool as the
+ * test-before-commit loop instead). A compile/validation failure is a
+ * NORMAL tool result carrying `{ok:false, errorKind, errorMessage}` — not
+ * an isError — since the call itself succeeded (compilation was attempted
+ * and correctly reported a problem the caller can fix and retry), matching
+ * runInSandbox's own SandboxResult convention. Ownership/scope failures
+ * (attach/detach on an agent or tool you don't own) DO throw, same
+ * convention as every other tool in this codebase.
+ */
+import { type Tool } from "#prisma";
 import type { WardbyMcpServer } from "../server.js";
+/**
+ * A tool row as a caller who doesn't own it may see it: name and
+ * description, never code or paramsZod (A7). `public` tells an owner-less
+ * tool apart from the caller's own same-named one (names are unique per
+ * owner, not globally). Shared by list_tools and get_agent.
+ */
+export declare function projectTool(tool: Tool, principalId: string): {
+    name: string;
+    code: string;
+    id: string;
+    ownerId: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+    description: string;
+    paramsZod: string;
+    jsonSchema: import("@prisma/client/runtime/client").JsonValue;
+} | {
+    id: string;
+    name: string;
+    description: string;
+    public: boolean;
+    ownerIsCaller?: undefined;
+} | {
+    id: string;
+    name: string;
+    description: string;
+    public: boolean;
+    ownerIsCaller: boolean;
+};
 export declare function registerToolAuthoringTools(mcp: WardbyMcpServer): void;