@wardby/cli 0.5.3 → 0.7.0

package/dist/mcp/tools/secrets.js

@@ -4,26 +4,109 @@
  * value/ciphertext at the source); this file adds ownership on top.
  */
 import { inputRequired, inputResponse } from "@modelcontextprotocol/server";
-import { createSecret, listSecrets, attachSecret, detachSecret, deleteSecret } from "../../core/secrets.js";
+import { createSecret, listSecrets, attachSecret, detachSecret, deleteSecret, setSecretBroker, } from "../../core/secrets.js";
+import { brokerConfigHash, parseSecretBrokerConfig } from "../../core/secret-broker-config.js";
 import { McpError } from "../errors.js";
 import { requireOwnedSecret } from "../auth/ownership.js";
-import { requireAgentAccess, requireBindingOwner } from "../auth/access.js";
-import { getSecretElicitationOutcome } from "./secret-elicitation.js";
+import { requireAgentAccess, requireBindable, requireBindingOwner } from "../auth/access.js";
+import { clearUnbrokerOutcome, getSecretElicitationOutcome, } from "./secret-elicitation.js";
+import { allowedSecretNames, brokerCompatibilityWarnings } from "./secret-broker-compat.js";
 import { textResult } from "./text-result.js";
+const BROKER_SCHEMA_DOC = '{ hosts: exact hostnames, pathPrefixes?: ["/..."], placement: { kind: "header", name, format containing {value} } | { kind: "query", name } | { kind: "body", field } | { kind: "aws-sigv4", region, service } }';
+/** Validates a caller-supplied broker config; an invalid one is the caller's 400. */
+function parseBrokerArg(input) {
+    try {
+        return parseSecretBrokerConfig(input);
+    }
+    catch (err) {
+        throw new McpError(400, err instanceof Error ? err.message : String(err));
+    }
+}
+/** Maps core/secrets.ts's coded errors to MCP statuses; anything else propagates unchanged. */
+function mapSecretError(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (message.startsWith("secret_not_found"))
+        throw new McpError(404, message);
+    if (message.startsWith("secret_broker_config_invalid") || message.startsWith("secret_broker_value_invalid")) {
+        throw new McpError(400, message);
+    }
+    throw err;
+}
+/**
+ * Non-blocking warnings: tools that can see this secret (under any alias it is
+ * attached as) but still read it with secrets.get(), which a brokered secret refuses.
+ */
+async function brokerWarningsForSecret(db, ownerId, name) {
+    const bindings = await db.agentSecret.findMany({
+        where: { secret: { ownerId, name } },
+        select: { agentId: true, boundName: true },
+    });
+    if (!bindings.length)
+        return [];
+    const aliasesByAgent = new Map();
+    for (const b of bindings) {
+        const aliases = aliasesByAgent.get(b.agentId) ?? new Set();
+        aliases.add(b.boundName);
+        aliasesByAgent.set(b.agentId, aliases);
+    }
+    const attachments = await db.agentTool.findMany({
+        where: { agentId: { in: [...aliasesByAgent.keys()] } },
+        include: { tool: { select: { name: true, code: true } } },
+    });
+    const warnings = new Set();
+    for (const a of attachments) {
+        const tools = [{ name: a.tool.name, code: a.tool.code, allowedSecrets: allowedSecretNames(a.allowedSecrets) }];
+        for (const w of brokerCompatibilityWarnings(tools, aliasesByAgent.get(a.agentId)))
+            warnings.add(w);
+    }
+    return [...warnings];
+}
+function withWarnings(body, warnings) {
+    return warnings.length ? { ...body, warnings } : body;
+}
+async function findOwnSecret(ctx, name) {
+    const secret = await ctx.db.secret.findUnique({ where: { ownerId_name: { ownerId: ctx.principal.id, name } } });
+    if (!secret)
+        throw new McpError(404, `secret_not_found: no secret named "${name}"`);
+    return secret;
+}
 export function registerSecretsTools(mcp, opts) {
     mcp.registerTool({
         name: "create_secret",
         scope: "secrets:write",
-        description: 'Creates a secret. Omit "value" to enter it securely via a one-time browser link instead of passing it as a plaintext argument.',
+        description: 'Creates a secret. Omit "value" to enter it securely via a one-time browser link instead of passing it as a plaintext argument. Pass "broker" ({ hosts, pathPrefixes?, placement }) to make it brokered: tools can then only send it to those hosts with fetch(url, { secrets: [name] }) and can never read it. See the help article "brokered-secrets".',
         inputSchema: {
             type: "object",
-            properties: { name: { type: "string" }, value: { type: "string" } },
+            properties: {
+                name: { type: "string" },
+                value: { type: "string" },
+                broker: { type: "object", description: `Optional broker config: ${BROKER_SCHEMA_DOC}` },
+            },
             required: ["name"],
         },
         handler: async (args, ctx) => {
+            const broker = args.broker === undefined ? undefined : parseBrokerArg(args.broker);
             if (args.value !== undefined) {
-                const secret = await createSecret(args.name, args.value, ctx.principal.id, ctx.providers.secrets, ctx.db);
-                return textResult({ id: secret.id, name: secret.name, keyId: secret.keyId, createdAt: secret.createdAt });
+                let secret;
+                try {
+                    secret = await createSecret(args.name, args.value, ctx.principal.id, ctx.providers.secrets, ctx.db, {
+                        broker,
+                        via: "mcp",
+                    });
+                }
+                catch (err) {
+                    mapSecretError(err);
+                }
+                // A fresh broker config supersedes any earlier, browser-confirmed removal still on record.
+                if (broker)
+                    await clearUnbrokerOutcome(ctx.principal.id, args.name, ctx.db);
+                return textResult({
+                    id: secret.id,
+                    name: secret.name,
+                    keyId: secret.keyId,
+                    createdAt: secret.createdAt,
+                    broker: secret.broker == null ? null : parseSecretBrokerConfig(secret.broker),
+                });
             }
             if (opts.protocolElicitation) {
                 const state = ctx.mcpReq.requestState();
@@ -43,7 +126,12 @@ export function registerSecretsTools(mcp, opts) {
                     throw new McpError(400, existingOutcome.error);
                 return textResult(existingOutcome.secret);
             }
-            const payload = { ownerId: ctx.principal.id, secretName: args.name };
+            const payload = {
+                ownerId: ctx.principal.id,
+                secretName: args.name,
+                kind: "create",
+                ...(broker ? { broker } : {}),
+            };
             const token = await mcp.mintRequestState(payload);
             const url = await opts.buildElicitationUrl(token);
             if (opts.protocolElicitation) {
@@ -66,6 +154,95 @@ export function registerSecretsTools(mcp, opts) {
             });
         },
     });
+    mcp.registerTool({
+        name: "set_secret_broker",
+        scope: "secrets:write",
+        description: 'Sets or changes a secret\'s broker config ({ hosts, pathPrefixes?, placement }), so tools can only send it to those hosts with fetch(url, { secrets: [name] }) and never read it. broker: null removes brokering, which must be confirmed by a person in the browser link this returns. Every change is audited. See the help article "brokered-secrets".',
+        inputSchema: {
+            type: "object",
+            properties: {
+                name: { type: "string" },
+                broker: {
+                    type: ["object", "null"],
+                    description: `The broker config ${BROKER_SCHEMA_DOC}, or null to remove brokering (browser-confirmed).`,
+                },
+            },
+            required: ["name", "broker"],
+        },
+        handler: async (args, ctx) => {
+            const ownerId = ctx.principal.id;
+            if (args.broker !== null) {
+                const broker = parseBrokerArg(args.broker);
+                await findOwnSecret(ctx, args.name);
+                let change;
+                try {
+                    change = await setSecretBroker(ctx.db, ctx.providers.secrets, {
+                        ownerId,
+                        name: args.name,
+                        broker,
+                        actorId: ownerId,
+                        via: "mcp",
+                    });
+                }
+                catch (err) {
+                    mapSecretError(err);
+                }
+                await clearUnbrokerOutcome(ownerId, args.name, ctx.db);
+                const warnings = await brokerWarningsForSecret(ctx.db, ownerId, args.name);
+                return textResult(withWarnings({ name: args.name, before: change.before, broker: change.after }, warnings));
+            }
+            // broker: null — never removed here. Only a person submitting the
+            // browser form (fulfillUnbrokerElicitation) removes it; this call hands
+            // out the link and, once that has happened, reports it.
+            if (opts.protocolElicitation) {
+                const state = ctx.mcpReq.requestState();
+                if (state) {
+                    const view = inputResponse(ctx.mcpReq.inputResponses, "confirmUnbroker");
+                    if (view.kind === "elicit" && view.action !== "accept") {
+                        throw new McpError(400, `Removing brokering was ${view.action}d.`);
+                    }
+                }
+            }
+            const existingOutcome = await getSecretElicitationOutcome(ownerId, args.name, ctx.db, "unbroker");
+            if (existingOutcome) {
+                if (!existingOutcome.ok)
+                    mapSecretError(new Error(existingOutcome.error));
+                return textResult({ unbrokered: true, secret: existingOutcome.secret });
+            }
+            const secret = await findOwnSecret(ctx, args.name);
+            if (secret.broker == null) {
+                // Nothing to remove, so nothing for a person to confirm.
+                const metadata = (await listSecrets(ownerId, ctx.db)).find((s) => s.id === secret.id);
+                return textResult({ unbrokered: true, secret: metadata });
+            }
+            // The hash pins the link to the config being confirmed: if it changes before
+            // the person submits, fulfillUnbrokerElicitation refuses (secret_broker_changed).
+            const payload = {
+                ownerId,
+                secretName: args.name,
+                kind: "unbroker",
+                brokerHash: brokerConfigHash(parseSecretBrokerConfig(secret.broker)),
+            };
+            const token = await mcp.mintRequestState(payload);
+            const url = await opts.buildElicitationUrl(token);
+            if (opts.protocolElicitation) {
+                return inputRequired({
+                    requestState: token,
+                    inputRequests: {
+                        confirmUnbroker: inputRequired.elicitUrl({
+                            url,
+                            message: `Confirm removing brokering for secret "${args.name}" in your browser.`,
+                        }),
+                    },
+                });
+            }
+            return textResult({
+                status: "pending",
+                message: `Open this link in your browser to confirm removing brokering for secret "${args.name}", then call set_secret_broker again with broker: null to finish.`,
+                url,
+            });
+        },
+    });
     mcp.registerTool({
         name: "list_secrets",
         scope: "secrets:write",
@@ -92,7 +269,7 @@ export function registerSecretsTools(mcp, opts) {
             // (A2/S2-2): a binding hands the value to every tool the owner lets
             // read it. Not even the stdio operator crosses owners.
             const { agent } = await requireAgentAccess(ctx, args.agentId, "read");
-            requireBindingOwner(ctx, agent);
+            await requireBindable(ctx, agent);
             const ownerId = agent.ownerId;
             try {
                 // Resolved among the agent owner's secrets (== the caller here).

package/dist/mcp/tools/stop-run.d.ts

@@ -0,0 +1,2 @@
+import type { WardbyMcpServer } from "../server.js";
+export declare function registerStopRunTool(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/stop-run.js

@@ -0,0 +1,82 @@
+/**
+ * stop_run: stops a run that is still pending (including a coding run queued for a slot) or
+ * running, and the delegated child runs it has in flight (src/core/stop-run.ts). A run that already
+ * finished is returned unchanged, so calling it again is harmless.
+ *
+ * Access mirrors trigger_agent: stopping a run needs execute on its agent. Runs are visible only to
+ * the agent's owner and to the run's triggerer (get_run's rule), so anyone else gets the same 404 as
+ * for a missing run; a triggerer whose access to the agent has dropped below execute gets a 403.
+ */
+import { z } from "zod";
+import { atLeast } from "../../core/grants.js";
+import { stopRun } from "../../core/stop-run.js";
+import { agentAccess, insufficientAgentAccess } from "../auth/access.js";
+import { McpError } from "../errors.js";
+import { textResult } from "./text-result.js";
+const StopRunSchema = z
+    .object({
+    runId: z.string().trim().min(1).max(128),
+    reason: z.string().trim().max(500).optional(),
+})
+    .strict();
+export function registerStopRunTool(mcp) {
+    mcp.registerTool({
+        name: "stop_run",
+        scope: "runs:trigger",
+        description: "Stop a run that is pending, queued, or running, and the sub-agent runs it delegated that are still in " +
+            "flight. The run ends as `cancelled`; a coding run's worker is stopped and opens or updates no pull " +
+            "request. A run that already finished is returned unchanged. Needs execute access to the run's agent.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                runId: { type: "string" },
+                reason: {
+                    type: "string",
+                    description: "Why the run is being stopped; recorded on the run (up to 500 characters).",
+                },
+            },
+            required: ["runId"],
+        },
+        handler: async (raw, ctx) => {
+            const parsed = StopRunSchema.safeParse(raw);
+            if (!parsed.success) {
+                const details = parsed.error.issues.map((i) => `${i.path.join(".") || "input"}: ${i.message}`).join("; ");
+                throw new McpError(400, `Invalid stop_run arguments: ${details}`);
+            }
+            const { runId, reason } = parsed.data;
+            const notFound = new McpError(404, `Run "${runId}" not found.`);
+            const run = await ctx.db.run.findUnique({
+                where: { id: runId },
+                select: { id: true, agentId: true, triggeredById: true },
+            });
+            if (!run)
+                throw notFound;
+            const agent = await ctx.db.agent.findUnique({ where: { id: run.agentId }, select: { id: true, ownerId: true } });
+            if (!agent)
+                throw notFound;
+            const access = await agentAccess(ctx, agent);
+            const isTriggerer = run.triggeredById !== null && run.triggeredById === ctx.principal.id;
+            // Visible to the agent's owner and the run's triggerer only, exactly as get_run.
+            if (access !== "owner" && !isTriggerer)
+                throw notFound;
+            if (!atLeast("agent", access, "execute"))
+                throw insufficientAgentAccess(agent.id, "execute", access);
+            const result = await stopRun({
+                db: ctx.db,
+                executor: ctx.providers.executor,
+                runId,
+                stoppedBy: ctx.principal.id,
+                reason,
+            });
+            const message = !result.stopRequested
+                ? `Run already finished as ${result.status}; nothing was changed.`
+                : result.status === "cancelled"
+                    ? "Run stopped."
+                    : result.status === "pending" || result.status === "running"
+                        ? `Stop requested; the run is still ${result.status}. Check it again with get_run.`
+                        : `The run finished as ${result.status} before the stop took effect.`;
+            return textResult({ ...result, message });
+        },
+    });
+}

package/dist/mcp/tools/subagents.js

@@ -14,7 +14,7 @@
  */
 import { Prisma } from "#prisma";
 import { atLeast, canDelegate } from "../../core/grants.js";
-import { agentAccess, agentAccessResolver, agentNotFound, requireAgentAccess, requireBindingOwner, } from "../auth/access.js";
+import { agentAccess, agentAccessResolver, agentNotFound, requireAgentAccess, requireBindable, } from "../auth/access.js";
 import { McpError } from "../errors.js";
 import { textResult } from "./text-result.js";
 /**
@@ -68,7 +68,7 @@ export function registerSubAgentTools(mcp) {
                 throw new McpError(400, "An agent cannot be its own sub-agent.");
             }
             const { agent: parent } = await requireAgentAccess(ctx, args.parentAgentId, "read");
-            requireBindingOwner(ctx, parent);
+            await requireBindable(ctx, parent);
             // The caller could trigger the child anyway; the edge must not widen that.
             const { agent: child } = await requireAgentAccess(ctx, args.childAgentId, "execute");
             if (parent.ownerId === null) {

package/dist/mcp/tools/tools.d.ts

@@ -19,14 +19,14 @@ import type { WardbyMcpServer } from "../server.js";
  */
 export declare function projectTool(tool: Tool, principalId: string): {
     name: string;
+    updatedAt: Date;
     code: string;
     createdAt: Date;
-    updatedAt: Date;
     id: string;
     ownerId: string | null;
     description: string;
-    paramsZod: string;
     jsonSchema: import("@prisma/client/runtime/client").JsonValue;
+    paramsZod: string;
 } | {
     id: string;
     name: string;

package/dist/mcp/tools/tools.js

@@ -11,6 +11,7 @@
  */
 import { Prisma } from "#prisma";
 import { deriveJsonSchema, validateParams } from "../../sandbox/zod-params.js";
+import { cachedZod4Compatibility, toolSubject, withZod3ToolWarnings, zod3SampleArgsWarning, zod3ToolWarnings, zod3WindowWarning, } from "../../core/zod3-window.js";
 import { runInSandbox } from "../../sandbox/run-in-sandbox.js";
 import { ToolCapabilitiesPatchSchema } from "../../sandbox/tool-capabilities.js";
 import { buildSharedDatastoreAccessor } from "../../core/datastores.js";
@@ -19,8 +20,9 @@ import { ToolAttachedError, deleteToolGuarded, hasToolChanges, prepareToolUpdate
 import { McpError } from "../errors.js";
 import { requireOwnedTool, requireStrictlyOwnedTool, assertStrictlyOwnedTool, visibleToPrincipal, canRead, } from "../auth/ownership.js";
 import { agentAccessResolver, assertAgentAccess, requireAgentAccess } from "../auth/access.js";
-import { atLeast } from "../../core/grants.js";
+import { atLeast, isPublicWritable } from "../../core/grants.js";
 import { textResult } from "./text-result.js";
+import { brokerCompatibilityWarnings } from "./secret-broker-compat.js";
 /**
  * Names the agents the caller can read (its own and ones granted to it)
  * and only counts the rest, so a refusal never reveals another principal's
@@ -48,6 +50,22 @@ export function projectTool(tool, principalId) {
         ? { id: tool.id, name: tool.name, description: tool.description, public: true }
         : { id: tool.id, name: tool.name, description: tool.description, public: false, ownerIsCaller: false };
 }
+/**
+ * Non-blocking: which of the secrets just granted to this attachment are
+ * brokered on the agent, and does the tool still read them with
+ * secrets.get()? Reveals only that fact about a tool the caller may not own
+ * (attach_tool already lets the agent's owner grant capabilities to such code).
+ */
+async function brokeredSecretWarnings(db, agentId, tool, allowedSecrets) {
+    if (!tool || !allowedSecrets?.length)
+        return [];
+    const bindings = await db.agentSecret.findMany({
+        where: { agentId, boundName: { in: [...allowedSecrets] } },
+        include: { secret: { select: { broker: true } } },
+    });
+    const brokered = new Set(bindings.filter((b) => b.secret.broker != null).map((b) => b.boundName));
+    return brokerCompatibilityWarnings([{ ...tool, allowedSecrets }], brokered);
+}
 /** Refuses a name one of the runner's built-ins would shadow (see core/tool-names.ts). */
 function assertToolNameAllowed(name) {
     const reason = reservedToolNameReason(name);
@@ -85,7 +103,8 @@ export function registerToolAuthoringTools(mcp) {
                         ownerId: ctx.principal.id,
                     },
                 });
-                return textResult(tool);
+                const warnings = await zod3ToolWarnings(toolSubject(tool.name), args.paramsZod);
+                return textResult(warnings.length ? { ...tool, warnings } : tool);
             }
             catch (err) {
                 if (err instanceof Prisma.PrismaClientKnownRequestError && err.code === "P2002") {
@@ -128,7 +147,8 @@ export function registerToolAuthoringTools(mcp) {
             // landing between the check and the write.
             try {
                 const tool = await updateToolGuarded(ctx.db, args.toolId, prepared.data, (row) => assertStrictlyOwnedTool(row, args.toolId, ctx.principal.id));
-                return textResult(tool);
+                const warnings = args.paramsZod === undefined ? [] : await zod3ToolWarnings(toolSubject(tool.name), args.paramsZod);
+                return textResult(warnings.length ? { ...tool, warnings } : tool);
             }
             catch (err) {
                 if (err instanceof ToolAttachedError) {
@@ -176,7 +196,7 @@ export function registerToolAuthoringTools(mcp) {
     mcp.registerTool({
         name: "dry_run_tool",
         scope: "tools:write",
-        description: "Test-runs tool code against sample args without persisting it. Fetch is denied by default, same as a freshly attached tool — pass allowedHosts to test code that calls fetch().",
+        description: "Test-runs tool code against sample args without persisting it. Fetch is denied by default, same as a freshly attached tool — pass allowedHosts to test code that calls fetch(). For this release a paramsZod is still compiled with Zod 3; a `warnings` list in the result means the next release, which compiles it with Zod 4 only, will reject it or treat the sample args differently.",
         inputSchema: {
             type: "object",
             properties: {
@@ -200,10 +220,19 @@ export function registerToolAuthoringTools(mcp) {
             }
             const jsonSchema = schemaResult.value;
             const validated = await validateParams(args.paramsZod, args.sampleArgs);
+            // Zod 3 compatibility window: would the next release (Zod 4 only) compile
+            // this schema, and treat the sample arguments the same way?
+            const subject = "This paramsZod";
+            const compatibility = await cachedZod4Compatibility(args.paramsZod);
+            const compatWarning = compatibility.compatible === true
+                ? zod3SampleArgsWarning(subject, validated, await validateParams(args.paramsZod, args.sampleArgs, ["v4"]))
+                : zod3WindowWarning(subject, compatibility);
+            const warnings = compatWarning ? { warnings: [compatWarning] } : {};
             if (!validated.ok) {
                 return textResult({
                     jsonSchema,
                     result: { ok: false, errorKind: validated.errorKind, errorMessage: validated.errorMessage },
+                    ...warnings,
                 });
             }
             // No real agent exists for a dry run — the caller's own principal
@@ -226,13 +255,13 @@ export function registerToolAuthoringTools(mcp) {
                 toolName: "dry_run_tool",
                 allowedFetchHosts: hosts.data.allowedHosts ?? [],
             });
-            return textResult({ jsonSchema, result: sandboxResult });
+            return textResult({ jsonSchema, result: sandboxResult, ...warnings });
         },
     });
     mcp.registerTool({
         name: "attach_tool",
         scope: "tools:write",
-        description: "Attaches a tool to an agent (needs write on the agent). The four capability fields (allowedSecrets, allowedDatastorePrefixes, allowedHosts, allowedSharedDatastorePrefixes) are the agent owner's to grant: anyone else passing one gets 403, and their attachment runs with none until the owner re-runs attach_tool with the capabilities. When the owner grants an attachment it had not granted before (someone else attached it, or the agent changed owner), every capability not passed is reset to empty, so state each one you want. Granting capabilities to a tool someone else owns vouches for code you can't read (only its owner sees it); the tool's owner can't change it while it's attached to your agent, and detaching drops your grant.",
+        description: "Attaches a tool to an agent (needs write on the agent). The four capability fields (allowedSecrets, allowedDatastorePrefixes, allowedHosts, allowedSharedDatastorePrefixes) are the agent owner's to grant: anyone else passing one gets 403, and their attachment runs with none until the owner re-runs attach_tool with the capabilities. When the owner grants an attachment it had not granted before (someone else attached it, or the agent changed owner), every capability not passed is reset to empty, so state each one you want. Granting capabilities to a tool someone else owns vouches for code you can't read (only its owner sees it); the tool's owner can't change it while it's attached to your agent, and detaching drops your grant. Granting a brokered secret lets the tool send it only via fetch(url, { secrets: [name] }), never read it; the result includes warnings when the tool calls secrets.get() on one.",
         inputSchema: {
             type: "object",
             properties: {
@@ -263,6 +292,7 @@ export function registerToolAuthoringTools(mcp) {
                 throw new McpError(400, `Invalid tool capabilities: ${patch.error.issues.map((i) => i.message).join("; ")}`);
             }
             const capabilitiesPassed = Object.values(patch.data).some((value) => value !== undefined);
+            let attachedTool;
             await ctx.db.$transaction(async (tx) => {
                 const { agent } = await assertAgentAccess(ctx, await tx.agent.findUnique({ where: { id: args.agentId } }), args.agentId, "write", tx);
                 if (agent.kind === "coding") {
@@ -276,6 +306,9 @@ export function registerToolAuthoringTools(mcp) {
                 if (capabilitiesPassed && !isOwner) {
                     throw new McpError(403, "Only the agent's owner can grant capabilities to an attachment; ask them to re-run attach_tool with the capabilities.");
                 }
+                if (capabilitiesPassed && (await isPublicWritable(tx, agent.id))) {
+                    throw new McpError(409, `Agent "${agent.id}" is writable by everyone, so tool capabilities cannot be granted on it; revoke or lower the everyone grant first.`);
+                }
                 const existing = await tx.agentTool.findUnique({
                     where: { agentId_toolId: { agentId: args.agentId, toolId: args.toolId } },
                 });
@@ -290,6 +323,7 @@ export function registerToolAuthoringTools(mcp) {
                 // The runtime dispatches by name, and names are only unique per
                 // owner: a second same-named tool on one agent would be a
                 // duplicate tool name to the model and silently shadow one of them.
+                attachedTool = { name: tool.name, code: tool.code };
                 const clash = await findSameNamedAttachedTool(tx, args.agentId, tool);
                 if (clash) {
                     // The clashing tool may be another principal's private one (a
@@ -330,7 +364,8 @@ export function registerToolAuthoringTools(mcp) {
                     update: ownerGrant,
                 });
             }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });
-            return textResult({ attached: true });
+            const warnings = await brokeredSecretWarnings(ctx.db, args.agentId, attachedTool, patch.data.allowedSecrets);
+            return textResult(warnings.length ? { attached: true, warnings } : { attached: true });
         },
     });
     mcp.registerTool({
@@ -354,19 +389,20 @@ export function registerToolAuthoringTools(mcp) {
         scope: "tools:write",
         inputSchema: { type: "object", properties: { agentId: { type: "string" } } },
         handler: async (args, ctx) => {
-            const project = (tool) => projectTool(tool, ctx.principal.id);
+            // Zod 3 window: the caller's own tools carry their warnings (cached per paramsZod text).
+            const project = (tool) => withZod3ToolWarnings(projectTool(tool, ctx.principal.id));
             if (args.agentId) {
                 const { access } = await requireAgentAccess(ctx, args.agentId, "read");
                 const rows = await ctx.db.agentTool.findMany({ where: { agentId: args.agentId }, include: { tool: true } });
                 // The agent's owner sees every tool on it (projected: code only for
                 // the tool's own owner); anyone else only tools they could see anyway.
-                return textResult(rows
+                return textResult(await Promise.all(rows
                     .map((r) => r.tool)
                     .filter((tool) => access === "owner" || canRead(tool.ownerId, ctx.principal.id))
-                    .map(project));
+                    .map(project)));
             }
             const tools = await ctx.db.tool.findMany({ where: visibleToPrincipal(ctx.principal.id) });
-            return textResult(tools.filter((tool) => canRead(tool.ownerId, ctx.principal.id)).map(project));
+            return textResult(await Promise.all(tools.filter((tool) => canRead(tool.ownerId, ctx.principal.id)).map(project)));
         },
     });
 }

package/dist/mcp/transport/stdio-link-host.d.ts

@@ -0,0 +1,20 @@
+/**
+ * stdio-only host for the signed links some tools hand out (the secret-entry
+ * form, a run transcript download): an ephemeral, loopback-only HTTP server,
+ * started lazily on the first link and closed after a period of inactivity.
+ * stdio's MCP process has no other listener (see stdio.ts); this one exists
+ * only while a link may be in use, consistent with stdio's "no token; the
+ * operator is trusted" model: reachable only from this same machine, and
+ * only a holder of a signed link can do anything with it.
+ *
+ * Request logging: none. A link's token travels in its `t` query parameter
+ * and must never be logged.
+ */
+import { type IncomingMessage, type ServerResponse } from "node:http";
+/** Handles one request for a path; receives the `t` query parameter. Must not log the token. */
+export type StdioLinkHandler = (req: IncomingMessage, res: ServerResponse, token: string | null) => Promise<void>;
+export interface StdioLinkHost {
+    /** The loopback URL for `path` carrying `token`; starts the server if it is not running. */
+    urlFor(path: string, token: string): Promise<string>;
+}
+export declare function createStdioLinkHost(routes: Record<string, StdioLinkHandler>): StdioLinkHost;

package/dist/mcp/transport/stdio-link-host.js

@@ -0,0 +1,67 @@
+/**
+ * stdio-only host for the signed links some tools hand out (the secret-entry
+ * form, a run transcript download): an ephemeral, loopback-only HTTP server,
+ * started lazily on the first link and closed after a period of inactivity.
+ * stdio's MCP process has no other listener (see stdio.ts); this one exists
+ * only while a link may be in use, consistent with stdio's "no token; the
+ * operator is trusted" model: reachable only from this same machine, and
+ * only a holder of a signed link can do anything with it.
+ *
+ * Request logging: none. A link's token travels in its `t` query parameter
+ * and must never be logged.
+ */
+import { createServer } from "node:http";
+/** Matches the requestState codec's own TTL (server.ts): no point outliving the tokens it serves. */
+const IDLE_SHUTDOWN_MS = 10 * 60_000;
+export function createStdioLinkHost(routes) {
+    let server;
+    let port = 0;
+    let idleTimer;
+    function scheduleIdleShutdown() {
+        if (idleTimer)
+            clearTimeout(idleTimer);
+        idleTimer = setTimeout(() => {
+            server?.close();
+            server = undefined;
+        }, IDLE_SHUTDOWN_MS);
+        idleTimer.unref();
+    }
+    async function ensureServer() {
+        if (server) {
+            scheduleIdleShutdown();
+            return port;
+        }
+        const s = createServer((req, res) => {
+            scheduleIdleShutdown();
+            const url = new URL(req.url ?? "/", "http://127.0.0.1");
+            const handler = Object.hasOwn(routes, url.pathname) ? routes[url.pathname] : undefined;
+            if (!handler) {
+                res.writeHead(404).end();
+                return;
+            }
+            // A failure here must never become an unhandled rejection: that would take
+            // down the whole stdio MCP process, not just this request.
+            handler(req, res, url.searchParams.get("t")).catch(() => {
+                if (!res.headersSent)
+                    res.writeHead(500, { "content-type": "text/plain; charset=utf-8" });
+                if (!res.writableEnded)
+                    res.end("Internal error");
+            });
+        });
+        server = s;
+        await new Promise((resolve, reject) => {
+            s.once("error", reject);
+            s.listen(0, "127.0.0.1", resolve);
+        });
+        const address = s.address();
+        port = typeof address === "object" && address ? address.port : 0;
+        scheduleIdleShutdown();
+        return port;
+    }
+    return {
+        async urlFor(path, token) {
+            const p = await ensureServer();
+            return `http://127.0.0.1:${p}${path}?t=${encodeURIComponent(token)}`;
+        },
+    };
+}

package/dist/mcp/transport/streamable-http.d.ts

@@ -8,7 +8,16 @@ import type { McpProviders } from "../context.js";
 import { type GitHubIngressDeps } from "../host-events/github-ingress.js";
 import { type JiraIngressDeps } from "../host-events/jira-ingress.js";
 import { type HostUserCallbackDeps } from "../host-events/github-user-callback.js";
+import type { BlobStore } from "../../providers/storage/types.js";
 import { type ViewerApi } from "../../viewer/http.js";
+/**
+ * close() waits this long for open requests to finish, then cuts them. A
+ * connected MCP client's event stream never ends on its own, so without a
+ * limit close() would hold shutdown until the pod is killed. On Kubernetes
+ * the load balancer has already moved traffic away by then (preStop), and
+ * clients reconnect to another instance.
+ */
+export declare const CLOSE_GRACE_MS = 10000;
 export interface HttpServerConfig {
     canonicalUri: string;
     httpBind: {
@@ -40,6 +49,10 @@ export interface StartHttpServerOptions {
     };
     /** The admin viewer API (/admin/api/*); absent = those paths answer 404. */
     viewer?: ViewerApi;
+    /** The blob store run transcripts are served from (get_run_transcript links); absent = they answer 503. */
+    blobs?: BlobStore;
+    /** How long close() lets open requests finish before cutting them (default CLOSE_GRACE_MS). */
+    closeGraceMs?: number;
 }
 export interface HttpServerHandle {
     port: number;