@wardby/cli 0.2.1 → 0.4.0

package/dist/mcp/tools/runs.js

@@ -1,7 +1,15 @@
 import { McpError } from "../errors.js";
-import { requireReadableAgent } from "../auth/ownership.js";
+import { agentAccess, requireAgentAccess } from "../auth/access.js";
 import { publicCodingRunResult } from "../../coding/protocol.js";
+import { countPlanRefusals, summarizeRegistryFetches } from "../../coding/registry/report.js";
+import { storedServiceLabels } from "../../coding/services/catalog.js";
 import { textResult } from "./text-result.js";
+/**
+ * Run visibility (resource-sharing grants spec §3.5, A6): a run's output is
+ * the triggerer's and the agent owner's, never every reader's. The owner
+ * (and the stdio operator) sees every run; anyone else only runs with
+ * Run.triggeredById equal to themselves.
+ */
 export function registerRunTools(mcp) {
     mcp.registerTool({
         name: "list_runs",
@@ -12,9 +20,13 @@ export function registerRunTools(mcp) {
             required: ["agentId"],
         },
         handler: async (args, ctx) => {
-            await requireReadableAgent(ctx.db, args.agentId, ctx.principal.id);
+            const { access } = await requireAgentAccess(ctx, args.agentId, "read");
             const runs = await ctx.db.run.findMany({
-                where: { agentId: args.agentId, ...(args.status ? { status: args.status } : {}) },
+                where: {
+                    agentId: args.agentId,
+                    ...(args.status ? { status: args.status } : {}),
+                    ...(access === "owner" ? {} : { triggeredById: ctx.principal.id }),
+                },
                 take: args.limit,
                 orderBy: { startedAt: "desc" },
             });
@@ -40,21 +52,63 @@ export function registerRunTools(mcp) {
         inputSchema: { type: "object", properties: { runId: { type: "string" } }, required: ["runId"] },
         handler: async (args, ctx) => {
             const run = await ctx.db.run.findUnique({ where: { id: args.runId } });
+            const notFound = new McpError(404, `Run "${args.runId}" not found.`);
             if (!run)
-                throw new McpError(404, `Run "${args.runId}" not found.`);
-            await requireReadableAgent(ctx.db, run.agentId, ctx.principal.id);
+                throw notFound;
+            // Its triggerer keeps seeing it even after losing access to the agent;
+            // otherwise only the agent's owner. read on the agent is not enough.
+            if (run.triggeredById !== ctx.principal.id) {
+                const agent = await ctx.db.agent.findUnique({ where: { id: run.agentId } });
+                if (!agent || (await agentAccess(ctx, agent)) !== "owner")
+                    throw notFound;
+            }
             const codingRun = await ctx.db.codingRun.findUnique({
                 where: { runId: run.id },
-                select: { result: true, queuedAt: true },
+                select: {
+                    result: true,
+                    queuedAt: true,
+                    failureCategory: true,
+                    diagnosticId: true,
+                    debugTrace: true,
+                    services: true,
+                },
             });
             const codingResult = publicCodingRunResult(codingRun?.result);
             // A pending coding run with queuedAt is waiting for a concurrency slot
             // (CODING_MAX_CONCURRENT), not stuck.
             const codingQueuedAt = run.status === "pending" && codingRun?.queuedAt ? codingRun.queuedAt.toISOString() : undefined;
+            // Packages served/refused only exist for coding runs; a non-coding run
+            // has no RegistryFetch rows at all, so skip the query entirely.
+            const registryFetches = codingRun
+                ? await ctx.db.registryFetch.findMany({ where: { runId: run.id }, orderBy: { createdAt: "asc" } })
+                : [];
+            const { packages, packageRefusals } = summarizeRegistryFetches(registryFetches);
+            // Lockfile verification (POST /registry/<ecosystem>/-/plan): exact
+            // versions approved for the run, and distinct entries it refused.
+            const packagePlan = codingRun
+                ? {
+                    approved: await ctx.db.registryApprovedVersion.count({ where: { runId: run.id } }),
+                    refused: countPlanRefusals(registryFetches),
+                }
+                : undefined;
+            // A failed coding run's error is only an opaque id; these two say which
+            // stage failed and are the key an operator searches the control-plane
+            // log for (the real reason is logged there, never persisted). Both are
+            // designed to be safe to show the agent's owner (schema.prisma).
+            const failureCategory = codingRun?.failureCategory ?? undefined;
+            const diagnosticId = codingRun?.diagnosticId ?? undefined;
+            // Which services the run started with ("postgres 16"); never their images or environments.
+            const services = codingRun ? storedServiceLabels(codingRun.services) : [];
             return textResult({
                 ...run,
                 ...(codingResult ? { codingResult } : {}),
+                ...(failureCategory ? { failureCategory } : {}),
+                ...(diagnosticId ? { diagnosticId } : {}),
                 ...(codingQueuedAt ? { codingQueuedAt } : {}),
+                // An admin turned on the debug trace: the worker's full trace is in its pod log.
+                ...(codingRun?.debugTrace ? { debugTrace: true } : {}),
+                ...(services.length > 0 ? { services } : {}),
+                ...(codingRun ? { packages, packageRefusals, packagePlan } : {}),
             });
         },
     });

package/dist/mcp/tools/scheduling.js

@@ -1,7 +1,7 @@
 import { Prisma } from "#prisma";
 import { validateCronExpression } from "../../core/cron.js";
 import { McpError } from "../errors.js";
-import { assertCanMutate, requireOwnedAgent } from "../auth/ownership.js";
+import { assertAgentAccess, requireAgentAccess } from "../auth/access.js";
 import { textResult } from "./text-result.js";
 export function registerSchedulingTools(mcp) {
     mcp.registerTool({
@@ -20,10 +20,7 @@ export function registerSchedulingTools(mcp) {
                 throw new McpError(400, `Invalid schedule/timezone: ${err instanceof Error ? err.message : String(err)}`);
             }
             const agent = await ctx.db.$transaction(async (tx) => {
-                const existing = await tx.agent.findUnique({ where: { id: args.agentId }, include: { codingProfile: true } });
-                if (!existing)
-                    throw new McpError(404, `Agent "${args.agentId}" not found.`);
-                assertCanMutate(existing.ownerId, ctx.principal.id, `Agent "${args.agentId}" is not owned by the caller.`);
+                const { agent: existing } = await assertAgentAccess(ctx, await tx.agent.findUnique({ where: { id: args.agentId }, include: { codingProfile: true } }), args.agentId, "write", tx);
                 if (existing.kind === "coding" && !existing.codingProfile?.defaultTask) {
                     throw new McpError(400, "A default task is required before enabling a coding-agent schedule.");
                 }
@@ -40,7 +37,7 @@ export function registerSchedulingTools(mcp) {
         scope: "agents:write",
         inputSchema: { type: "object", properties: { agentId: { type: "string" } }, required: ["agentId"] },
         handler: async (args, ctx) => {
-            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            await requireAgentAccess(ctx, args.agentId, "write");
             const agent = await ctx.db.agent.update({ where: { id: args.agentId }, data: { scheduleEnabled: false } });
             return textResult(agent);
         },

package/dist/mcp/tools/secrets.js

@@ -6,7 +6,8 @@
 import { inputRequired, inputResponse } from "@modelcontextprotocol/server";
 import { createSecret, listSecrets, attachSecret, detachSecret, deleteSecret } from "../../core/secrets.js";
 import { McpError } from "../errors.js";
-import { requireOwnedAgent, requireOwnedSecret } from "../auth/ownership.js";
+import { requireOwnedSecret } from "../auth/ownership.js";
+import { requireAgentAccess, requireBindingOwner } from "../auth/access.js";
 import { getSecretElicitationOutcome } from "./secret-elicitation.js";
 import { textResult } from "./text-result.js";
 export function registerSecretsTools(mcp, opts) {
@@ -87,9 +88,15 @@ export function registerSecretsTools(mcp, opts) {
             required: ["agentId", "name"],
         },
         handler: async (args, ctx) => {
-            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            // Strictly the agent owner's own secret on the owner's own agent
+            // (A2/S2-2): a binding hands the value to every tool the owner lets
+            // read it. Not even the stdio operator crosses owners.
+            const { agent } = await requireAgentAccess(ctx, args.agentId, "read");
+            requireBindingOwner(ctx, agent);
+            const ownerId = agent.ownerId;
             try {
-                await attachSecret(args.agentId, args.name, ctx.principal.id, ctx.db, args.alias ?? args.name);
+                // Resolved among the agent owner's secrets (== the caller here).
+                await attachSecret(args.agentId, args.name, ownerId, ctx.db, args.alias ?? args.name);
             }
             catch (err) {
                 throw new McpError(404, err instanceof Error ? err.message : String(err));
@@ -100,15 +107,20 @@ export function registerSecretsTools(mcp, opts) {
     mcp.registerTool({
         name: "detach_secret",
         scope: "secrets:write",
+        description: "Detaches a secret from an agent. `name` is the alias it was attached under; the secret's own name also works when no attachment has that alias.",
         inputSchema: {
             type: "object",
             properties: { agentId: { type: "string" }, name: { type: "string" } },
             required: ["agentId", "name"],
         },
         handler: async (args, ctx) => {
-            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
-            await detachSecret(args.agentId, args.name, ctx.db);
-            return textResult({ detached: true });
+            const { agent } = await requireAgentAccess(ctx, args.agentId, "read");
+            requireBindingOwner(ctx, agent);
+            const count = await detachSecret(args.agentId, args.name, ctx.db);
+            if (count === 0) {
+                throw new McpError(404, `No secret is attached to agent "${args.agentId}" as "${args.name}".`);
+            }
+            return textResult({ detached: true, count });
         },
     });
     mcp.registerTool({

package/dist/mcp/tools/services.d.ts

@@ -0,0 +1,2 @@
+import type { WardbyMcpServer } from "../server.js";
+export declare function registerServiceTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/services.js

@@ -0,0 +1,222 @@
+/**
+ * The coding-run service catalog over MCP (docs/coding-services.md). Reading
+ * it needs only agents:read: agent owners need to see which services exist and
+ * the variables (testEnv) their tests will get before allowing one, and entries
+ * hold no secrets (serviceEnv values are throwaway per-run test credentials).
+ * Changing it needs services:manage, a privileged scope honoured only with a
+ * role granting it (service-manager or admin; resource-server.ts): an entry
+ * decides which image runs next to every coding run that names it, and with
+ * what. Each change is audit-logged (event coding.service_catalog.<action>).
+ * Built-in entries ship with wardby and change only with a release.
+ */
+import { z } from "zod";
+import { CodingServiceDefinitionSchema, catalogEntryFromRow, codingServiceNameSchema, codingServiceVersionSchema, } from "../../coding/services/catalog.js";
+import { logger } from "../../core/logger.js";
+import { McpError } from "../errors.js";
+import { textResult } from "./text-result.js";
+const servicesLog = logger.child({ module: "mcp-services" });
+const KeySchema = z.object({ name: codingServiceNameSchema, version: codingServiceVersionSchema }).strict();
+/** Everything but the key is optional here; the merged entry is validated in full. */
+const UpdateSchema = z
+    .object({
+    name: codingServiceNameSchema,
+    version: codingServiceVersionSchema,
+    image: z.unknown().optional(),
+    port: z.unknown().optional(),
+    serviceEnv: z.unknown().optional(),
+    testEnv: z.unknown().optional(),
+    readiness: z.unknown().optional(),
+    resources: z.unknown().optional(),
+    dataPath: z.unknown().optional(),
+    writablePaths: z.unknown().optional(),
+})
+    .strict();
+function parse(schema, label, value) {
+    const result = schema.safeParse(value);
+    if (!result.success) {
+        const details = result.error.issues
+            .map((issue) => `${issue.path.join(".") || "input"}: ${issue.message}`)
+            .join("; ");
+        throw new McpError(400, `Invalid ${label}: ${details}`);
+    }
+    return result.data;
+}
+function audit(ctx, action, entry) {
+    servicesLog.info({
+        event: `coding.service_catalog.${action}`,
+        name: entry.name,
+        version: entry.version,
+        ...(entry.image ? { image: entry.image } : {}),
+        by: ctx.principal.id,
+    }, "coding service catalog changed");
+}
+async function findEntry(ctx, key) {
+    const row = await ctx.db.codingService.findUnique({ where: { name_version: key } });
+    if (!row)
+        throw new McpError(404, `No coding service "${key.name} ${key.version}" in the catalog.`);
+    return row;
+}
+function refuseBuiltin(key) {
+    return new McpError(403, `"${key.name} ${key.version}" is built in: built-in services change only with a wardby release. Create an entry under another name or version instead.`);
+}
+function view(row) {
+    return { ...catalogEntryFromRow(row), builtin: row.builtin, createdAt: row.createdAt, updatedAt: row.updatedAt };
+}
+const keyJsonSchema = {
+    name: { type: "string", description: 'Catalog name a repository declares, e.g. "postgres".' },
+    version: { type: "string", description: 'Version a repository declares, e.g. "16".' },
+};
+const definitionProperties = {
+    ...keyJsonSchema,
+    image: { type: "string", description: "Registry digest to run: repo@sha256:<64 hex>. Tags are refused." },
+    port: {
+        type: "integer",
+        minimum: 1,
+        maximum: 65535,
+        description: "The port the service listens on (informational).",
+    },
+    serviceEnv: {
+        type: "object",
+        additionalProperties: { type: "string" },
+        description: "Environment for the service container. Throwaway per-run values only, never secrets.",
+    },
+    testEnv: {
+        type: "object",
+        additionalProperties: { type: "string" },
+        description: "Variables the agent's shells receive (e.g. DATABASE_URL). Upper-case names; wardby's own names (PATH, HOME, PIP_*, WARDBY_*, ...) are refused.",
+    },
+    readiness: {
+        type: "object",
+        additionalProperties: false,
+        required: ["command", "periodSeconds", "timeoutSeconds", "failureThreshold"],
+        properties: {
+            command: { type: "array", minItems: 1, maxItems: 16, items: { type: "string" } },
+            periodSeconds: { type: "integer", minimum: 1, maximum: 60 },
+            timeoutSeconds: { type: "integer", minimum: 1, maximum: 60 },
+            failureThreshold: { type: "integer", minimum: 1, maximum: 120 },
+        },
+        description: "Startup probe: a command in the service's image that succeeds once it accepts connections on 127.0.0.1.",
+    },
+    resources: {
+        type: "object",
+        additionalProperties: false,
+        required: ["cpuMillicores", "memoryMib", "diskMib"],
+        properties: {
+            cpuMillicores: { type: "integer", minimum: 100, maximum: 4000 },
+            memoryMib: { type: "integer", minimum: 64, maximum: 16384 },
+            diskMib: { type: "integer", minimum: 64, maximum: 8192 },
+        },
+        description: "Requests equal limits. diskMib sizes the data volume.",
+    },
+    dataPath: {
+        type: "string",
+        description: "Absolute directory the service writes its data to: an empty volume in each run.",
+    },
+    writablePaths: {
+        type: "array",
+        maxItems: 4,
+        items: { type: "string" },
+        description: "Further directories the image writes to (a socket directory, /tmp); its root filesystem is read-only.",
+    },
+};
+export function registerServiceTools(mcp) {
+    mcp.registerTool({
+        name: "list_services",
+        scope: "agents:read",
+        description: "The coding-run service catalog (name, version, image, built in or not): the names a coding agent's codingProfile.services can allow.",
+        inputSchema: { type: "object", additionalProperties: false, properties: {} },
+        handler: async (_args, ctx) => {
+            const rows = await ctx.db.codingService.findMany({ orderBy: [{ name: "asc" }, { version: "asc" }] });
+            return textResult(rows.map((row) => ({
+                name: row.name,
+                version: row.version,
+                kind: row.kind,
+                image: row.image,
+                port: row.port,
+                builtin: row.builtin,
+            })));
+        },
+    });
+    mcp.registerTool({
+        name: "get_service",
+        scope: "agents:read",
+        description: "One catalog entry in full, including the variables (testEnv) a run's shells receive — the contract a repository's tests rely on.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["name", "version"],
+            properties: keyJsonSchema,
+        },
+        handler: async (rawArgs, ctx) => {
+            const key = parse(KeySchema, "get_service arguments", rawArgs);
+            return textResult(view(await findEntry(ctx, key)));
+        },
+    });
+    mcp.registerTool({
+        name: "create_service",
+        scope: "services:manage",
+        description: "Service managers (services:manage): add a catalog entry repositories can then declare in .wardby/services.yaml. The image must be pinned by digest; kind is sidecar (a fresh instance in each run's pod).",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["name", "version", "image", "port", "readiness", "resources", "dataPath"],
+            // kind is checked by the zod schema (only "sidecar" today), so a refusal names the field.
+            properties: { ...definitionProperties, kind: { type: "string", description: 'Only "sidecar" today.' } },
+        },
+        handler: async (rawArgs, ctx) => {
+            const definition = parse(CodingServiceDefinitionSchema, "create_service arguments", rawArgs);
+            const key = { name: definition.name, version: definition.version };
+            if (await ctx.db.codingService.findUnique({ where: { name_version: key } })) {
+                throw new McpError(409, `The catalog already has "${key.name} ${key.version}"; use update_service to change it.`);
+            }
+            const row = await ctx.db.codingService.create({
+                data: { ...definition, builtin: false, createdById: ctx.principal.id },
+            });
+            audit(ctx, "create", definition);
+            return textResult(view(row));
+        },
+    });
+    mcp.registerTool({
+        name: "update_service",
+        scope: "services:manage",
+        description: "Service managers (services:manage): change a non-built-in catalog entry (name and version identify it and never change). Runs already dispatched keep the entry they started with.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["name", "version"],
+            properties: definitionProperties,
+        },
+        handler: async (rawArgs, ctx) => {
+            const { name, version, ...patch } = parse(UpdateSchema, "update_service arguments", rawArgs);
+            const row = await findEntry(ctx, { name, version });
+            if (row.builtin)
+                throw refuseBuiltin({ name, version });
+            const changes = Object.fromEntries(Object.entries(patch).filter(([, value]) => value !== undefined));
+            const next = parse(CodingServiceDefinitionSchema, "coding service", { ...catalogEntryFromRow(row), ...changes });
+            const { name: _name, version: _version, kind: _kind, ...fields } = next;
+            const updated = await ctx.db.codingService.update({ where: { name_version: { name, version } }, data: fields });
+            audit(ctx, "update", next);
+            return textResult(view(updated));
+        },
+    });
+    mcp.registerTool({
+        name: "delete_service",
+        scope: "services:manage",
+        description: "Service managers (services:manage): remove a non-built-in catalog entry. Repositories still declaring it are refused at their next run (service_unknown).",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["name", "version"],
+            properties: keyJsonSchema,
+        },
+        handler: async (rawArgs, ctx) => {
+            const key = parse(KeySchema, "delete_service arguments", rawArgs);
+            const row = await findEntry(ctx, key);
+            if (row.builtin)
+                throw refuseBuiltin(key);
+            await ctx.db.codingService.delete({ where: { name_version: key } });
+            audit(ctx, "delete", key);
+            return textResult({ deleted: key });
+        },
+    });
+}

package/dist/mcp/tools/subagents.js

@@ -1,13 +1,20 @@
 /**
- * AgentSubAgent CRUD — agent-composition edges. Attach/detach require
- * ownership of both the parent and child agent (same convention as
- * attach_tool requiring ownership of both the agent and the tool), and
- * attach rejects any edge that would create a cycle in the parent/child
- * graph (§7 of the design doc) — cycles are not something Postgres can
- * enforce natively.
+ * AgentSubAgent CRUD — agent-composition edges. An edge runs the child
+ * (with its owner's bindings) whenever the parent delegates, and hands the
+ * child whatever the parent's runs pass it, so it is a binding of the
+ * parent: only the parent's owner attaches or detaches one (review I2; a
+ * write-grantee could otherwise route every run's data to their own agent).
+ * Across owners it also needs an explicit grant (resource-sharing grants
+ * spec §3.4.4, N1): the caller needs execute on the child, and the parent's
+ * owner must be the child's owner or hold execute on it (canDelegate,
+ * re-checked on every delegation at run time). The child's owner can
+ * always cut an edge. Attach also rejects any edge that would
+ * create a cycle in the parent/child graph (§7 of the design doc) — cycles
+ * are not something Postgres can enforce natively.
  */
 import { Prisma } from "#prisma";
-import { requireOwnedAgent } from "../auth/ownership.js";
+import { atLeast, canDelegate } from "../../core/grants.js";
+import { agentAccess, agentAccessResolver, agentNotFound, requireAgentAccess, requireBindingOwner, } from "../auth/access.js";
 import { McpError } from "../errors.js";
 import { textResult } from "./text-result.js";
 /**
@@ -60,8 +67,16 @@ export function registerSubAgentTools(mcp) {
             if (args.parentAgentId === args.childAgentId) {
                 throw new McpError(400, "An agent cannot be its own sub-agent.");
             }
-            const parent = await requireOwnedAgent(ctx.db, args.parentAgentId, ctx.principal.id);
-            const child = await requireOwnedAgent(ctx.db, args.childAgentId, ctx.principal.id);
+            const { agent: parent } = await requireAgentAccess(ctx, args.parentAgentId, "read");
+            requireBindingOwner(ctx, parent);
+            // The caller could trigger the child anyway; the edge must not widen that.
+            const { agent: child } = await requireAgentAccess(ctx, args.childAgentId, "execute");
+            if (parent.ownerId === null) {
+                throw new McpError(403, `Agent "${parent.id}" has no owner, so it can't take sub-agents; an admin can assign one with make_owner.`);
+            }
+            if (!(await canDelegate(ctx.db, parent, child))) {
+                throw new McpError(403, `"${child.name}" belongs to another owner, who has not given the owner of "${parent.name}" execute access to it.`);
+            }
             if (await canReach(ctx.db, args.childAgentId, args.parentAgentId)) {
                 throw new McpError(400, `Attaching "${child.name}" as a sub-agent of "${parent.name}" would create a cycle.`);
             }
@@ -95,8 +110,20 @@ export function registerSubAgentTools(mcp) {
             required: ["parentAgentId", "childAgentId"],
         },
         handler: async (args, ctx) => {
-            await requireOwnedAgent(ctx.db, args.parentAgentId, ctx.principal.id);
-            await requireOwnedAgent(ctx.db, args.childAgentId, ctx.principal.id);
+            // The parent's owner (or the stdio operator), or the child's owner: a
+            // child's owner can always take its agent back out of someone else's
+            // composition.
+            const [parent, child] = await Promise.all([
+                ctx.db.agent.findUnique({ where: { id: args.parentAgentId } }),
+                ctx.db.agent.findUnique({ where: { id: args.childAgentId } }),
+            ]);
+            const parentAccess = parent ? await agentAccess(ctx, parent) : "none";
+            const childAccess = child ? await agentAccess(ctx, child) : "none";
+            if (parentAccess !== "owner" && childAccess !== "owner") {
+                if (!atLeast("agent", parentAccess, "read"))
+                    throw agentNotFound(args.parentAgentId);
+                throw new McpError(403, `Detaching needs ownership of "${args.parentAgentId}" or of "${args.childAgentId}".`);
+            }
             await ctx.db.agentSubAgent.deleteMany({
                 where: { parentAgentId: args.parentAgentId, childAgentId: args.childAgentId },
             });
@@ -113,20 +140,29 @@ export function registerSubAgentTools(mcp) {
             required: ["agentId"],
         },
         handler: async (args, ctx) => {
-            await requireOwnedAgent(ctx.db, args.agentId, ctx.principal.id);
+            await requireAgentAccess(ctx, args.agentId, "read");
+            const accessOf = await agentAccessResolver(ctx);
             const [asParent, asChild] = await Promise.all([
                 ctx.db.agentSubAgent.findMany({
                     where: { parentAgentId: args.agentId },
-                    include: { child: { select: { id: true, name: true } } },
+                    include: { child: { select: { id: true, name: true, ownerId: true } } },
                 }),
                 ctx.db.agentSubAgent.findMany({
                     where: { childAgentId: args.agentId },
-                    include: { parent: { select: { id: true, name: true } } },
+                    include: { parent: { select: { id: true, name: true, ownerId: true } } },
                 }),
             ]);
+            // Only agents the caller can read are named; the rest are counted.
+            const readable = (agent) => atLeast("agent", accessOf(agent), "read");
+            const children = asParent.filter((e) => readable(e.child));
+            const parents = asChild.filter((e) => readable(e.parent));
+            const hiddenChildren = asParent.length - children.length;
+            const hiddenParents = asChild.length - parents.length;
             return textResult({
-                children: asParent.map((e) => ({ boundName: e.boundName, agentId: e.child.id, agentName: e.child.name })),
-                parents: asChild.map((e) => ({ boundName: e.boundName, agentId: e.parent.id, agentName: e.parent.name })),
+                children: children.map((e) => ({ boundName: e.boundName, agentId: e.child.id, agentName: e.child.name })),
+                parents: parents.map((e) => ({ boundName: e.boundName, agentId: e.parent.id, agentName: e.parent.name })),
+                ...(hiddenChildren > 0 ? { hiddenChildren } : {}),
+                ...(hiddenParents > 0 ? { hiddenParents } : {}),
             });
         },
     });

package/dist/mcp/tools/tools.d.ts

@@ -1,2 +1,43 @@
+/**
+ * Tool authoring — raw path only (Amendment A: the guided Elicitation/Tasks
+ * flow is deferred; this ships create_tool + dry_run_tool as the
+ * test-before-commit loop instead). A compile/validation failure is a
+ * NORMAL tool result carrying `{ok:false, errorKind, errorMessage}` — not
+ * an isError — since the call itself succeeded (compilation was attempted
+ * and correctly reported a problem the caller can fix and retry), matching
+ * runInSandbox's own SandboxResult convention. Ownership/scope failures
+ * (attach/detach on an agent or tool you don't own) DO throw, same
+ * convention as every other tool in this codebase.
+ */
+import { type Tool } from "#prisma";
 import type { WardbyMcpServer } from "../server.js";
+/**
+ * A tool row as a caller who doesn't own it may see it: name and
+ * description, never code or paramsZod (A7). `public` tells an owner-less
+ * tool apart from the caller's own same-named one (names are unique per
+ * owner, not globally). Shared by list_tools and get_agent.
+ */
+export declare function projectTool(tool: Tool, principalId: string): {
+    name: string;
+    code: string;
+    createdAt: Date;
+    updatedAt: Date;
+    id: string;
+    ownerId: string | null;
+    description: string;
+    paramsZod: string;
+    jsonSchema: import("@prisma/client/runtime/client").JsonValue;
+} | {
+    id: string;
+    name: string;
+    description: string;
+    public: boolean;
+    ownerIsCaller?: undefined;
+} | {
+    id: string;
+    name: string;
+    description: string;
+    public: boolean;
+    ownerIsCaller: boolean;
+};
 export declare function registerToolAuthoringTools(mcp: WardbyMcpServer): void;