@wardby/cli 0.6.0 → 0.8.0

package/dist/core/mcp-servers.js

@@ -0,0 +1,230 @@
+import { redactTokenShapedValues } from "../coding/protocol.js";
+import { McpClientError, McpHttpClient, } from "./mcp-client/client.js";
+import { parseSecretBrokerConfig } from "./secret-broker-config.js";
+import { redactExactSecretValues, withEscapedForms } from "./secret-spans.js";
+import { brokeredFetch } from "../sandbox/brokered-fetch.js";
+import { safeFetch } from "../sandbox/safe-fetch.js";
+import { consoleRedactionValues, encodedForms } from "../sandbox/secret-broker.js";
+export class McpServerInputError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "McpServerInputError";
+    }
+}
+/** What the server's owner (or an admin) sees when a stored secret of the server can't be decrypted. */
+export const CREDENTIALS_UNAVAILABLE_MESSAGE = "The MCP server's credentials can't be decrypted on this server. Check that every Wardby process (control plane, scheduler, native gateway) uses the same SECRET_APP_KEY, or set the secret again.";
+/**
+ * A server's brokered secret exists but its stored value can't be decrypted (another
+ * SECRET_APP_KEY, a key-id mismatch, a corrupt ciphertext). Not an input problem: the message is
+ * fixed and never carries the cipher's error, the ciphertext or a value.
+ */
+export class McpCredentialsUnavailableError extends Error {
+    serverId;
+    serverName;
+    secretName;
+    code = "mcp_server_credentials_unavailable";
+    constructor(
+    /** Empty while a server is being registered (it has no id yet). */
+    serverId, serverName, secretName) {
+        super(CREDENTIALS_UNAVAILABLE_MESSAGE);
+        this.serverId = serverId;
+        this.serverName = serverName;
+        this.secretName = secretName;
+        this.name = "McpCredentialsUnavailableError";
+    }
+}
+/** The one operator line for an undecryptable server secret: ids and names only, never the cipher's error text. */
+export function logCredentialsUnavailable(log, error) {
+    log.warn({
+        reason: "mcp_secret_decrypt_failed",
+        ...(error.serverId !== "" ? { serverId: error.serverId } : {}),
+        serverName: error.serverName,
+        secretName: error.secretName,
+    }, "MCP server secret could not be decrypted");
+}
+const SERVER_NAME = /^[a-z0-9][a-z0-9_-]{0,31}$/;
+const EXPOSED_NAME = /^[A-Za-z0-9_-]{1,64}$/;
+const DEFAULT_TIMEOUT_MS = 30_000;
+/** Validates a server URL: https, no userinfo, no fragment, default port; returns the normalised string. */
+export function normaliseServerUrl(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new McpServerInputError("The MCP server URL is not a valid URL.");
+    }
+    if (url.protocol !== "https:")
+        throw new McpServerInputError("The MCP server URL must use https.");
+    if (url.username !== "" || url.password !== "")
+        throw new McpServerInputError("The MCP server URL must not contain a username or password; use a brokered secret.");
+    if (url.hash !== "")
+        throw new McpServerInputError("The MCP server URL must not contain a fragment (#).");
+    if (url.port !== "")
+        throw new McpServerInputError("The MCP server URL must use the default https port (443).");
+    return url.href;
+}
+export function assertServerName(name) {
+    if (!SERVER_NAME.test(name)) {
+        throw new McpServerInputError("The MCP server name must be 1-32 characters: lower-case letters, digits, _ or -, starting with a letter or digit.");
+    }
+}
+/** The tool name the model sees: `<server>__<tool>` with any other character mapped to `_`. */
+export function exposedToolName(serverName, toolName) {
+    const name = `${serverName}__${toolName}`.replace(/[^A-Za-z0-9_-]/g, "_");
+    if (!EXPOSED_NAME.test(name)) {
+        throw new McpServerInputError(`The tool name "${name.slice(0, 40)}..." is longer than 64 characters once prefixed.`);
+    }
+    return name;
+}
+/** A server's saved tool list (toolSnapshot); anything but an array reads as empty. */
+export function snapshotOf(server) {
+    return Array.isArray(server.toolSnapshot) ? server.toolSnapshot : [];
+}
+/** Exposed names of allowed tools; a name too long to expose is left out (refused at attach anyway). */
+export function exposedNames(serverName, allowedTools) {
+    return allowedTools.flatMap((tool) => {
+        try {
+            return [exposedToolName(serverName, tool)];
+        }
+        catch {
+            return [];
+        }
+    });
+}
+/** Added, removed and changed (description or schema) tool names between two snapshots; order-independent. */
+export function diffSnapshots(before, after) {
+    const old = new Map(before.map((t) => [t.name, t]));
+    const next = new Map(after.map((t) => [t.name, t]));
+    const added = [...next.keys()].filter((n) => !old.has(n)).sort();
+    const removed = [...old.keys()].filter((n) => !next.has(n)).sort();
+    const changed = [...next.keys()].filter((n) => old.has(n) && canonical(old.get(n)) !== canonical(next.get(n))).sort();
+    return { added, removed, changed };
+}
+function canonical(value) {
+    return JSON.stringify(value, (_key, v) => v !== null && typeof v === "object" && !Array.isArray(v)
+        ? Object.fromEntries(Object.entries(v).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)))
+        : v);
+}
+/** Redacts every secret value of this server (exact, every encoded and escaped form) plus token shapes. */
+export function redactForServer(text, values) {
+    const forms = withEscapedForms(values.flatMap(encodedForms)).sort((a, b) => b.length - a.length);
+    return redactTokenShapedValues(redactExactSecretValues(text, [...values, ...forms]));
+}
+/** The same error with its message redacted; an McpClientError keeps its code, any other keeps its name. */
+export function redactError(error, values) {
+    const message = redactForServer(error instanceof Error ? error.message : "The MCP server call failed.", values);
+    if (error instanceof McpClientError)
+        return new McpClientError(error.code, message);
+    if (error instanceof McpServerInputError)
+        return new McpServerInputError(message);
+    // Its message is fixed and carries no value: keep it (and its ids) as it is.
+    if (error instanceof McpCredentialsUnavailableError)
+        return error;
+    const out = new Error(message);
+    if (error instanceof Error)
+        out.name = error.name;
+    return out;
+}
+/**
+ * Loads the owner's secrets for the server; each must exist, be owned by ownerId, be brokered, and list
+ * the URL's host (McpServerInputError otherwise). A stored value that can't be decrypted throws
+ * McpCredentialsUnavailableError.
+ */
+export async function loadServerSecrets(db, cipher, server) {
+    const host = new URL(server.url).hostname.toLowerCase();
+    const entries = new Map();
+    const values = new Set();
+    for (const name of server.secretNames) {
+        const stored = await db.secret.findUnique({
+            where: { ownerId_name: { ownerId: server.ownerId, name } },
+            select: { ciphertext: true, broker: true },
+        });
+        if (!stored)
+            throw new McpServerInputError(`Secret "${name}" was not found among your secrets.`);
+        if (stored.broker === null || stored.broker === undefined)
+            throw new McpServerInputError(`Secret "${name}" is not brokered; set its broker config first (set_secret_broker).`);
+        let broker;
+        try {
+            broker = parseSecretBrokerConfig(stored.broker);
+        }
+        catch {
+            throw new McpServerInputError(`Secret "${name}" has a broker config that cannot be read; set it again.`);
+        }
+        if (!broker.hosts.includes(host))
+            throw new McpServerInputError(`Secret "${name}" is not brokered to host ${host}; add it to the secret's hosts.`);
+        let value;
+        try {
+            value = await cipher.decrypt(stored.ciphertext);
+        }
+        catch {
+            // The cipher's error is dropped: it is not an input problem, and its text is not ours to pass on.
+            throw new McpCredentialsUnavailableError(server.id, server.name, name);
+        }
+        const entry = { value, broker };
+        entries.set(name, entry);
+        for (const v of withEscapedForms(consoleRedactionValues(entry)))
+            values.add(v);
+    }
+    const accessor = {
+        get: async () => {
+            throw new Error("secret_brokered: this secret is brokered; it is never readable");
+        },
+        resolve: async (name) => entries.get(name),
+    };
+    return { accessor, values: [...values] };
+}
+/** The McpFetch for one server: brokeredFetch over safeFetch with the timeout and signal; text body, lower-case headers. */
+export function serverFetch(server, accessor, options) {
+    return async (request, signal) => {
+        const response = (await brokeredFetch({
+            url: server.url,
+            init: { method: request.method, headers: request.headers, body: request.body },
+            secretNames: server.secretNames,
+            secrets: accessor,
+            fetchImpl: options.fetchImpl ?? safeFetch,
+            policy: { timeoutMs: options.timeoutMs, signal },
+            redactFromConsole: () => { },
+        }));
+        return {
+            status: response.status,
+            headers: Object.fromEntries(Object.entries(response.headers).map(([k, v]) => [k.toLowerCase(), v])),
+            body: Buffer.from(response.bodyBase64, "base64").toString("utf8"),
+        };
+    };
+}
+/** initialize + listTools + close; the result is redacted (as JSON text) before it is returned. */
+export async function fetchSnapshot(server, deps) {
+    const timeoutMs = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const { accessor, values } = await loadServerSecrets(deps.db, deps.cipher, server);
+    const client = new McpHttpClient({
+        fetch: serverFetch(server, accessor, { timeoutMs, fetchImpl: deps.fetchImpl }),
+        signal: AbortSignal.timeout(timeoutMs * 3),
+    });
+    let raw;
+    try {
+        const serverInfo = await client.initialize();
+        raw = { serverInfo, tools: await client.listTools() };
+    }
+    catch (error) {
+        throw redactError(error, values);
+    }
+    finally {
+        await client.close().catch(() => { });
+    }
+    const redacted = redactForServer(JSON.stringify(raw), values);
+    try {
+        return JSON.parse(redacted);
+    }
+    catch {
+        throw new McpServerInputError("The MCP server's tool list could not be saved safely.");
+    }
+}
+/** For the secret delete guard: names of the owner's MCP servers whose secretNames include the secret. */
+export async function mcpServersUsingSecret(db, ownerId, secretName) {
+    const rows = await db.mcpServer.findMany({
+        where: { ownerId, secretNames: { has: secretName } },
+        select: { name: true },
+    });
+    return rows.map((r) => r.name).sort();
+}

package/dist/core/mcp-tools.d.ts

@@ -0,0 +1,108 @@
+/**
+ * A native run's remote MCP tools: the load step pins the agent's attached, allowed tools
+ * (loadMcpToolPins), the runner offers them as built-ins (mcpToolDefs), and every call runs on the
+ * control plane through handleMcpTool. The pin decides only which tools the model sees for this
+ * run; each call re-checks the live attachment, that the agent's owner may still use the server (owns
+ * it or holds use on it), and uses the live server row (URL, secrets). A pin carries no URL (a query
+ * string can carry a token), secret names or owner id: pins are saved in the run's step results.
+ *
+ * Secret values never leave: results and errors are redacted against the server's secrets (every
+ * encoded form) plus token shapes, the log line carries no arguments, bodies or URL, and
+ * mcpNamedSecretValues feeds the run's own redaction (secret-guard.ts loadAgentSecretValues).
+ */
+import type { PrismaClient } from "#prisma";
+import type { Logger } from "./logger.js";
+import type { LoadedTool } from "../providers/engine/types.js";
+import type { SecretCipher } from "../providers/secrets/types.js";
+import type { safeFetch } from "../sandbox/safe-fetch.js";
+/** One MCP tool as the load step pins it. */
+export interface McpToolPin {
+    /** The name the model sees: `<server name>__<tool name>`. */
+    exposedName: string;
+    /** The name the server knows. */
+    toolName: string;
+    serverId: string;
+    serverName: string;
+    /** Only when the attachment sets one. */
+    callTimeoutMs?: number;
+    definition: {
+        description: string;
+        inputSchema: Record<string, unknown>;
+    };
+}
+export declare const DEFAULT_MCP_CALL_TIMEOUT_MS = 30000;
+/** What a grantee's run sees when the server owner's credentials can't be loaded. */
+export declare const SHARED_CREDENTIALS_MESSAGE = "The MCP server's credentials can't be used; ask its owner to check it.";
+/**
+ * A Codex coding agent runs shell commands that can read the run's MCP token, so it may use only tools
+ * the server marks read-only (annotations.readOnlyHint === true in the saved tool list).
+ */
+export declare function isMarkedReadOnly(entry: {
+    annotations?: Record<string, unknown>;
+} | undefined): boolean;
+/**
+ * Whether a coding provider gets the Codex read-only rule. Fails closed: anything but exactly
+ * "claude-code" (Codex, an unknown value, or a coding agent with no profile) counts as Codex. A run
+ * is judged by the provider it was dispatched with (CodingRun.provider), never the agent's current
+ * profile, which can change between dispatch and launch.
+ */
+export declare function isCodexCoding(provider: string | null | undefined): boolean;
+type McpToolsDb = Pick<PrismaClient, "agentMcpServer" | "secret" | "resourceGrant">;
+/** Redaction reads attachments and secrets only: it covers every attached server, usable or not. */
+type McpSecretsDb = Pick<PrismaClient, "agentMcpServer" | "secret">;
+export interface McpToolPinOptions {
+    /**
+     * Pin only tools the server marks read-only: the caller sets it for a Codex coding run, from the
+     * provider the run was dispatched with (isCodexCoding(run.provider)). Native runs leave it unset.
+     */
+    readOnlyOnly?: boolean;
+}
+/**
+ * Builds pins for an agent's attachments: allowed tools present in the snapshot only, from servers the
+ * agent's owner may still use (owns, or holds use on); none when the mode is off.
+ */
+export declare function loadMcpToolPins(db: Pick<PrismaClient, "agentMcpServer" | "resourceGrant">, agentId: string, options?: McpToolPinOptions): Promise<McpToolPin[]>;
+/**
+ * The pins whose exposed name no other tool of the run uses. Attach refuses clashes; this covers a
+ * name that became a built-in (or an attached tool) later: the MCP tool is left out, with a warning.
+ */
+export declare function withoutClashingPins(pins: readonly McpToolPin[], otherNames: readonly string[], log: Pick<Logger, "warn">): McpToolPin[];
+export declare function mcpToolDefs(pins: readonly McpToolPin[]): LoadedTool[];
+export interface McpToolContext {
+    db: McpToolsDb;
+    cipher: Pick<SecretCipher, "decrypt">;
+    /** The agent whose attachment is re-checked on every call. */
+    agentId: string;
+    /** The run, for the per-call log line. */
+    runId: string;
+    /** The run's stop signal: aborting it stops a call in flight. */
+    signal: AbortSignal;
+    /** A sandboxed run's session deadline; the call's time limit never runs past it. */
+    deadlineAt?: Date;
+    /**
+     * Refuse any tool the live tool list doesn't mark read-only: set by the coding gateway for a Codex
+     * run, from the run's dispatched provider (isCodexCoding(codingRun.provider)). Native runs leave it unset.
+     */
+    readOnlyOnly?: boolean;
+    fetchImpl?: typeof safeFetch;
+    log: Pick<Logger, "info" | "warn">;
+}
+/**
+ * Never throws. Re-checks the live attachment, validates the arguments, runs initialize → tools/call →
+ * close under the time limit, and returns the redacted result text or a JSON error. One log line per call.
+ */
+export declare function handleMcpTool(pin: McpToolPin, argsJson: string, ctx: McpToolContext): Promise<string>;
+export interface NamedMcpSecretValues {
+    /** `mcp:<server name>/<secret name>`. */
+    name: string;
+    values: string[];
+}
+/**
+ * Every secret value of every server attached to the agent, named `mcp:<server>/<secret>`, in
+ * every form the server's own redaction looks for. A secret that no longer exists has no value to
+ * leak and is skipped; a read that fails rejects (callers fail closed).
+ */
+export declare function mcpNamedSecretValues(db: McpSecretsDb, cipher: Pick<SecretCipher, "decrypt">, agentId: string): Promise<NamedMcpSecretValues[]>;
+/** Secret values for every attached server of this agent (for run-text masking and gateway cause checks). */
+export declare function mcpSecretValuesForAgent(db: McpSecretsDb, cipher: Pick<SecretCipher, "decrypt">, agentId: string): Promise<string[]>;
+export {};

package/dist/core/mcp-tools.js

@@ -0,0 +1,287 @@
+import { ownerCanUseMcpServer } from "./grants.js";
+import { loadMcpServersMode, MCP_SERVERS_OFF_MESSAGE } from "../config/mcp-servers.js";
+import { loadToolMaxTimeoutMs } from "../config/tool-timeout.js";
+import { McpClientError, McpHttpClient } from "./mcp-client/client.js";
+import { toolResultText } from "./mcp-client/results.js";
+import { exposedToolName, loadServerSecrets, logCredentialsUnavailable, McpCredentialsUnavailableError, McpServerInputError, redactForServer, serverFetch, snapshotOf, } from "./mcp-servers.js";
+import { parseSecretBrokerConfig } from "./secret-broker-config.js";
+import { withEscapedForms } from "./secret-spans.js";
+import { consoleRedactionValues, encodedForms } from "../sandbox/secret-broker.js";
+export const DEFAULT_MCP_CALL_TIMEOUT_MS = 30_000;
+/** What a grantee's run sees when the server owner's credentials can't be loaded. */
+export const SHARED_CREDENTIALS_MESSAGE = "The MCP server's credentials can't be used; ask its owner to check it.";
+/**
+ * A Codex coding agent runs shell commands that can read the run's MCP token, so it may use only tools
+ * the server marks read-only (annotations.readOnlyHint === true in the saved tool list).
+ */
+export function isMarkedReadOnly(entry) {
+    return entry?.annotations?.readOnlyHint === true;
+}
+/**
+ * Whether a coding provider gets the Codex read-only rule. Fails closed: anything but exactly
+ * "claude-code" (Codex, an unknown value, or a coding agent with no profile) counts as Codex. A run
+ * is judged by the provider it was dispatched with (CodingRun.provider), never the agent's current
+ * profile, which can change between dispatch and launch.
+ */
+export function isCodexCoding(provider) {
+    return provider !== "claude-code";
+}
+/**
+ * Builds pins for an agent's attachments: allowed tools present in the snapshot only, from servers the
+ * agent's owner may still use (owns, or holds use on); none when the mode is off.
+ */
+export async function loadMcpToolPins(db, agentId, options = {}) {
+    if (loadMcpServersMode() === "off")
+        return [];
+    const rows = await db.agentMcpServer.findMany({
+        where: { agentId },
+        include: { server: true, agent: { select: { ownerId: true } } },
+        orderBy: [{ createdAt: "asc" }, { serverId: "asc" }],
+    });
+    const pins = [];
+    for (const row of rows) {
+        if (!(await ownerCanUseMcpServer(db, row.agent.ownerId, row.server)))
+            continue;
+        const byName = new Map(snapshotOf(row.server).map((t) => [t.name, t]));
+        for (const toolName of row.allowedTools) {
+            const entry = byName.get(toolName);
+            if (!entry)
+                continue;
+            // A refresh can drop readOnlyHint after attach: such a tool stays out of a Codex run.
+            if (options.readOnlyOnly === true && !isMarkedReadOnly(entry))
+                continue;
+            let exposedName;
+            try {
+                exposedName = exposedToolName(row.server.name, toolName);
+            }
+            catch {
+                continue;
+            }
+            pins.push({
+                exposedName,
+                toolName,
+                serverId: row.server.id,
+                serverName: row.server.name,
+                ...(row.callTimeoutMs !== null ? { callTimeoutMs: row.callTimeoutMs } : {}),
+                definition: { description: entry.description, inputSchema: entry.inputSchema },
+            });
+        }
+    }
+    return pins;
+}
+/**
+ * The pins whose exposed name no other tool of the run uses. Attach refuses clashes; this covers a
+ * name that became a built-in (or an attached tool) later: the MCP tool is left out, with a warning.
+ */
+export function withoutClashingPins(pins, otherNames, log) {
+    const taken = new Set(otherNames);
+    return pins.filter((pin) => {
+        if (!taken.has(pin.exposedName)) {
+            taken.add(pin.exposedName);
+            return true;
+        }
+        log.warn({ serverId: pin.serverId, tool: pin.toolName, exposedName: pin.exposedName }, "MCP tool left out of the run: its name clashes with another tool");
+        return false;
+    });
+}
+export function mcpToolDefs(pins) {
+    return pins.map((pin) => ({
+        name: pin.exposedName,
+        description: `From MCP server ${pin.serverName}: ${pin.definition.description}`,
+        jsonSchema: pin.definition.inputSchema,
+    }));
+}
+function error(code, message) {
+    return JSON.stringify({ error: code, message });
+}
+function parseArgs(argsJson) {
+    if (argsJson.trim() === "")
+        return {};
+    try {
+        const value = JSON.parse(argsJson);
+        return value !== null && typeof value === "object" && !Array.isArray(value)
+            ? value
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Never throws. Re-checks the live attachment, validates the arguments, runs initialize → tools/call →
+ * close under the time limit, and returns the redacted result text or a JSON error. One log line per call.
+ */
+export async function handleMcpTool(pin, argsJson, ctx) {
+    const startedAt = Date.now();
+    const done = (text, outcome) => {
+        ctx.log.info({
+            runId: ctx.runId,
+            agentId: ctx.agentId,
+            serverId: pin.serverId,
+            tool: pin.toolName,
+            outcome,
+            durationMs: Date.now() - startedAt,
+            resultChars: text.length,
+        }, "mcp tool call");
+        return text;
+    };
+    const fail = (code, message) => done(error(code, message), code);
+    let values = [];
+    try {
+        if (loadMcpServersMode() === "off")
+            return fail("mcp_servers_off", MCP_SERVERS_OFF_MESSAGE);
+        const row = await ctx.db.agentMcpServer.findUnique({
+            where: { agentId_serverId: { agentId: ctx.agentId, serverId: pin.serverId } },
+            include: { server: true, agent: { select: { ownerId: true } } },
+        });
+        if (!row || !row.allowedTools.includes(pin.toolName)) {
+            return fail("mcp_tool_not_allowed", `The tool "${pin.exposedName}" is no longer allowed for this agent: its MCP server was detached or the tool was taken off the allowed list.`);
+        }
+        // A revoked or lowered grant stops the very next call, even before the attachment is pruned.
+        if (!(await ownerCanUseMcpServer(ctx.db, row.agent.ownerId, row.server))) {
+            return fail("mcp_tool_not_allowed", `The tool "${pin.exposedName}" is no longer allowed for this agent: its owner no longer has use access to MCP server "${row.server.name}".`);
+        }
+        const live = snapshotOf(row.server).find((t) => t.name === pin.toolName);
+        if (!live) {
+            return fail("mcp_tool_removed", `The tool "${pin.exposedName}" is no longer in MCP server "${row.server.name}"'s tool list.`);
+        }
+        if (ctx.readOnlyOnly === true && !isMarkedReadOnly(live)) {
+            return fail("mcp_tool_not_allowed", `The tool "${pin.exposedName}" is no longer allowed for this agent: Codex agents can use only tools the server marks read-only.`);
+        }
+        const args = parseArgs(argsJson);
+        if (!args)
+            return fail("invalid_arguments", "The tool's arguments must be a JSON object.");
+        const configured = Math.min(row.callTimeoutMs ?? pin.callTimeoutMs ?? DEFAULT_MCP_CALL_TIMEOUT_MS, loadToolMaxTimeoutMs());
+        const untilDeadline = ctx.deadlineAt ? ctx.deadlineAt.getTime() - Date.now() : Infinity;
+        const limitMs = Math.max(0, Math.min(configured, untilDeadline));
+        const timedOut = `The MCP server did not answer within ${limitMs} ms.`;
+        if (ctx.signal.aborted)
+            return fail("mcp_call_timeout", "The call was stopped.");
+        if (limitMs <= 0)
+            return fail("mcp_call_timeout", "The run's time limit has been reached.");
+        const server = {
+            id: row.server.id,
+            ownerId: row.server.ownerId,
+            name: row.server.name,
+            url: row.server.url,
+            secretNames: row.server.secretNames,
+        };
+        let secrets;
+        try {
+            secrets = await loadServerSecrets(ctx.db, ctx.cipher, server);
+        }
+        catch (err) {
+            const shared = row.agent.ownerId !== server.ownerId;
+            if (err instanceof McpCredentialsUnavailableError) {
+                logCredentialsUnavailable(ctx.log, err);
+                return fail(err.code, shared ? SHARED_CREDENTIALS_MESSAGE : err.message);
+            }
+            // The detail names the server owner's secrets and speaks to that owner: a grantee's run gets neither.
+            if (err instanceof McpServerInputError && shared) {
+                return fail("mcp_server_error", SHARED_CREDENTIALS_MESSAGE);
+            }
+            throw err;
+        }
+        values = secrets.values;
+        const controller = new AbortController();
+        let stopped = false;
+        const onStop = () => {
+            stopped = true;
+            controller.abort();
+        };
+        ctx.signal.addEventListener("abort", onStop, { once: true });
+        const timer = setTimeout(() => controller.abort(), limitMs);
+        // The race ends the call even if a transport ignores the signal.
+        const aborted = new Promise((_resolve, reject) => {
+            controller.signal.addEventListener("abort", () => reject(new McpClientError("mcp_call_timeout", "aborted")), {
+                once: true,
+            });
+        });
+        aborted.catch(() => { });
+        // A stop that fired while the secrets were loading came before the listener; act on it now.
+        if (ctx.signal.aborted)
+            onStop();
+        const client = new McpHttpClient({
+            fetch: serverFetch(server, secrets.accessor, { timeoutMs: limitMs, fetchImpl: ctx.fetchImpl }),
+            signal: controller.signal,
+        });
+        try {
+            const result = await Promise.race([
+                (async () => {
+                    await client.initialize();
+                    return client.callTool(pin.toolName, args);
+                })(),
+                aborted,
+            ]);
+            const { text, isError } = toolResultText(result, (raw) => redactForServer(raw, values));
+            return done(text, isError ? "mcp_server_error" : "ok");
+        }
+        catch (err) {
+            if (controller.signal.aborted) {
+                return fail("mcp_call_timeout", stopped ? "The call was stopped." : timedOut);
+            }
+            throw err;
+        }
+        finally {
+            clearTimeout(timer);
+            ctx.signal.removeEventListener("abort", onStop);
+            // Best effort; never waits on a server that already ran out of time.
+            if (controller.signal.aborted)
+                void client.close().catch(() => { });
+            else
+                await client.close().catch(() => { });
+        }
+    }
+    catch (err) {
+        const message = redactForServer(err instanceof Error ? err.message : "The MCP server call failed.", values);
+        if (err instanceof McpClientError)
+            return fail(err.code, message);
+        if (err instanceof McpServerInputError)
+            return fail("mcp_server_error", message);
+        return fail("mcp_server_unreachable", "The MCP server could not be reached.");
+    }
+}
+/**
+ * Every secret value of every server attached to the agent, named `mcp:<server>/<secret>`, in
+ * every form the server's own redaction looks for. A secret that no longer exists has no value to
+ * leak and is skipped; a read that fails rejects (callers fail closed).
+ */
+export async function mcpNamedSecretValues(db, cipher, agentId) {
+    const rows = await db.agentMcpServer.findMany({
+        where: { agentId },
+        select: { server: { select: { name: true, ownerId: true, secretNames: true } } },
+    });
+    const named = [];
+    for (const { server } of rows) {
+        for (const secretName of server.secretNames) {
+            const stored = await db.secret.findUnique({
+                where: { ownerId_name: { ownerId: server.ownerId, name: secretName } },
+                select: { ciphertext: true, broker: true },
+            });
+            if (!stored)
+                continue;
+            const value = await cipher.decrypt(stored.ciphertext);
+            const base = consoleRedactionValues({ value, broker: readableBroker(stored.broker) });
+            named.push({
+                name: `mcp:${server.name}/${secretName}`,
+                values: withEscapedForms([...new Set([...base, ...base.flatMap(encodedForms)])]),
+            });
+        }
+    }
+    return named;
+}
+/** A stored broker config, or null when there is none or it cannot be read (the value alone is then redacted). */
+function readableBroker(stored) {
+    if (stored === null || stored === undefined)
+        return null;
+    try {
+        return parseSecretBrokerConfig(stored);
+    }
+    catch {
+        return null;
+    }
+}
+/** Secret values for every attached server of this agent (for run-text masking and gateway cause checks). */
+export async function mcpSecretValuesForAgent(db, cipher, agentId) {
+    return (await mcpNamedSecretValues(db, cipher, agentId)).flatMap((n) => n.values);
+}

package/dist/core/memory-tools.js

@@ -10,6 +10,7 @@
  * agents' data.
  */
 import { z } from "zod";
+import { SecretInValueError, SecretCheckUnavailableError } from "./secret-guard.js";
 import { MEMORY_CONTENT_MAX_BYTES, MEMORY_KEY_MAX_BYTES, MEMORY_MAX_KEYS_PER_AGENT, MEMORY_SEARCH_MAX_LIMIT, } from "../providers/memory/types.js";
 export const MEMORY_TOOL_NAMES = new Set([
     "memory_get",
@@ -116,6 +117,12 @@ export async function handleMemoryTool(name, argsJson, agentId, memory) {
                 message: err.issues.map((issue) => `${issue.path.join(".") || "input"}: ${issue.message}`).join("; "),
             });
         }
+        if (err instanceof SecretInValueError) {
+            return JSON.stringify({ error: err.code, message: err.message, secretNames: err.secretNames });
+        }
+        if (err instanceof SecretCheckUnavailableError) {
+            return JSON.stringify({ error: err.code, message: err.message });
+        }
         const code = err instanceof Error ? err.message : "memory_error";
         return JSON.stringify({ error: code, message: MEMORY_ERROR_MESSAGES[code] ?? code });
     }

package/dist/core/merge-order-check.d.ts

@@ -21,6 +21,7 @@
 import type { Run } from "#prisma";
 import type { PullRequestOrigin, ReviewHostRegistry, UpsertNamedCheckInput } from "../providers/review-host/types.js";
 import { type Logger } from "./logger.js";
+import { type MarkReadyDb } from "./mark-ready.js";
 import { type RelatedPullRequestsDb } from "./related-pull-requests.js";
 export declare const MERGE_ORDER_CHECK_NAME = "wardby merge order";
 export interface MergeOrderMember {
@@ -49,7 +50,7 @@ export type MergeOrderVerdict = {
  * as its entry in `set`; only `mergeOrder` is read from it.
  */
 export declare function mergeOrderVerdict(self: MergeOrderMember, set: readonly MergeOrderMember[]): MergeOrderVerdict;
-export type MergeOrderDb = RelatedPullRequestsDb;
+export type MergeOrderDb = RelatedPullRequestsDb & MarkReadyDb;
 export interface MergeOrderSyncDeps {
     db: MergeOrderDb;
     hosts: ReviewHostRegistry | undefined;