@wardby/cli 0.6.0 → 0.8.0

package/dist/core/schedule-start.d.ts

@@ -0,0 +1,12 @@
+import type { PrismaClient } from "#prisma";
+import { type ScheduleState } from "./cron.js";
+/**
+ * The `lastScheduledAt` to write with a schedule change: the database's
+ * clock when the change starts the schedule (see startsSchedule), nothing
+ * otherwise. The database's clock, not this process's, because the CLI and
+ * import can run on an operator's machine: a clock running ahead there would
+ * record a start after a window the scheduler has yet to fire, and skip it.
+ */
+export declare function scheduleStartFields(db: Pick<PrismaClient, "$queryRaw">, before: ScheduleState | null, after: ScheduleState): Promise<{
+    lastScheduledAt: Date;
+} | Record<string, never>>;

package/dist/core/schedule-start.js

@@ -0,0 +1,14 @@
+import { startsSchedule } from "./cron.js";
+/**
+ * The `lastScheduledAt` to write with a schedule change: the database's
+ * clock when the change starts the schedule (see startsSchedule), nothing
+ * otherwise. The database's clock, not this process's, because the CLI and
+ * import can run on an operator's machine: a clock running ahead there would
+ * record a start after a window the scheduler has yet to fire, and skip it.
+ */
+export async function scheduleStartFields(db, before, after) {
+    if (!startsSchedule(before, after))
+        return {};
+    const [{ now }] = await db.$queryRaw `SELECT now() AS now`;
+    return { lastScheduledAt: now };
+}

package/dist/core/secret-broker-config.d.ts

@@ -1,88 +1,26 @@
 import { z } from "zod";
 export declare const MIN_BROKERED_VALUE_LENGTH = 6;
+/** False for a name a resolver could read as an IPv4 address ("127.1", "0x7f.0.0.1") or with a label ending in "-". */
+export declare function isExactHostname(h: string): boolean;
 export declare const SecretBrokerConfigSchema: z.ZodObject<{
-    hosts: z.ZodArray<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, "many">;
-    pathPrefixes: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
-    placement: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+    hosts: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+    pathPrefixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    placement: z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"header">;
-        name: z.ZodEffects<z.ZodString, string, string>;
-        format: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
-    }, "strict", z.ZodTypeAny, {
-        name: string;
-        kind: "header";
-        format: string;
-    }, {
-        name: string;
-        kind: "header";
-        format: string;
-    }>, z.ZodObject<{
+        name: z.ZodString;
+        format: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"query">;
         name: z.ZodString;
-    }, "strict", z.ZodTypeAny, {
-        name: string;
-        kind: "query";
-    }, {
-        name: string;
-        kind: "query";
-    }>, z.ZodObject<{
+    }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"body">;
         field: z.ZodString;
-    }, "strict", z.ZodTypeAny, {
-        kind: "body";
-        field: string;
-    }, {
-        kind: "body";
-        field: string;
-    }>, z.ZodObject<{
+    }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"aws-sigv4">;
         region: z.ZodString;
         service: z.ZodString;
-    }, "strict", z.ZodTypeAny, {
-        kind: "aws-sigv4";
-        service: string;
-        region: string;
-    }, {
-        kind: "aws-sigv4";
-        service: string;
-        region: string;
-    }>]>;
-}, "strict", z.ZodTypeAny, {
-    hosts: string[];
-    placement: {
-        name: string;
-        kind: "header";
-        format: string;
-    } | {
-        name: string;
-        kind: "query";
-    } | {
-        kind: "body";
-        field: string;
-    } | {
-        kind: "aws-sigv4";
-        service: string;
-        region: string;
-    };
-    pathPrefixes?: string[] | undefined;
-}, {
-    hosts: string[];
-    placement: {
-        name: string;
-        kind: "header";
-        format: string;
-    } | {
-        name: string;
-        kind: "query";
-    } | {
-        kind: "body";
-        field: string;
-    } | {
-        kind: "aws-sigv4";
-        service: string;
-        region: string;
-    };
-    pathPrefixes?: string[] | undefined;
-}>;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>;
 export type SecretBrokerConfig = z.infer<typeof SecretBrokerConfigSchema>;
 export type SecretBrokerPlacement = SecretBrokerConfig["placement"];
 export declare function parseSecretBrokerConfig(input: unknown): SecretBrokerConfig;

package/dist/core/secret-broker-config.js

@@ -11,7 +11,7 @@ const TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]{1,128}$/;
 const HOSTNAME = /^(?=.{1,253}$)(?!-)[a-z0-9-]{1,63}(?:\.(?!-)[a-z0-9-]{1,63})+$/;
 const IPV4 = /^\d{1,3}(?:\.\d{1,3}){3}$/;
 /** False for a name a resolver could read as an IPv4 address ("127.1", "0x7f.0.0.1") or with a label ending in "-". */
-function isExactHostname(h) {
+export function isExactHostname(h) {
     if (!HOSTNAME.test(h) || IPV4.test(h))
         return false;
     const labels = h.split(".");

package/dist/core/secret-guard.d.ts

@@ -0,0 +1,49 @@
+import type { PrismaClient } from "#prisma";
+import { buildSecretsAccessor } from "./secrets.js";
+export interface NamedSecretValues {
+    name: string;
+    values: string[];
+}
+type SecretGuardCipher = Parameters<typeof buildSecretsAccessor>[1];
+type SecretGuardDb = Parameters<typeof buildSecretsAccessor>[2] & Pick<PrismaClient, "agentSecret" | "agentMcpServer" | "secret">;
+/**
+ * Every secret attached to the agent (readable and brokered), and every secret of an MCP server
+ * attached to it (named `mcp:<server>/<secret>`), with every form to look for. Rejects if any read fails.
+ */
+export declare function loadAgentSecretValues(db: SecretGuardDb, cipher: SecretGuardCipher, agentId: string): Promise<NamedSecretValues[]>;
+/** The sorted, unique names of the secrets whose value occurs anywhere in `value`. */
+export declare function secretNamesIn(value: unknown, named: readonly NamedSecretValues[]): string[];
+/** The agent-visible refusal: names the secrets, never a value. At most 1000 characters. */
+export declare function secretInValueMessage(names: readonly string[]): string;
+export declare const SECRET_CHECK_UNAVAILABLE_MESSAGE = "secret_check_unavailable: not stored. The agent's secrets could not be read to check this value; try again.";
+export declare const WITHHELD_TEXT_NOTICE = "[withheld: this text could not be checked for secret values]";
+export declare class SecretInValueError extends Error {
+    readonly code = "secret_in_value";
+    readonly secretNames: string[];
+    constructor(names: readonly string[]);
+}
+export declare class SecretCheckUnavailableError extends Error {
+    readonly code = "secret_check_unavailable";
+    constructor();
+}
+/** `text` with every value of every named secret masked. */
+export declare function maskNamedSecrets(text: string, named: readonly NamedSecretValues[]): string;
+export interface SecretWriteGuard {
+    assertNoSecrets(agentId: string, value: unknown): Promise<void>;
+}
+/** Refuses a value holding an attached secret's value; fails closed when the secrets cannot be read. */
+export declare function createSecretWriteGuard(source: {
+    load(agentId: string): Promise<NamedSecretValues[]>;
+}): SecretWriteGuard;
+export declare function createDbSecretWriteGuard(db: SecretGuardDb, cipher: SecretGuardCipher): SecretWriteGuard;
+/**
+ * Built-in tools whose arguments become text on a host, so their arguments are masked before
+ * the call. Review host: repo_publish_review (summary, body, inline comment bodies), repo_comment
+ * (body). Jira: jira_comment and jira_edit_own_comment (body), jira_update_fields (labels,
+ * components, priority, custom fields), jira_create_issue (summary, description, labels,
+ * components, custom fields, fingerprint), jira_set_property (a stored value), jira_transition
+ * (toStatus, which Jira may echo in an error). Read tools and jira_link_issues (a link type name
+ * checked against an allowlist) are left out.
+ */
+export declare const POSTING_TOOL_NAMES: ReadonlySet<string>;
+export {};

package/dist/core/secret-guard.js

@@ -0,0 +1,119 @@
+import { MIN_REDACTABLE_SECRET_LENGTH, redactExactSecretValues, withEscapedForms } from "./secret-spans.js";
+import { buildSecretsAccessor } from "./secrets.js";
+import { consoleRedactionValues } from "../sandbox/secret-broker.js";
+import { mcpNamedSecretValues } from "./mcp-tools.js";
+/**
+ * Every secret attached to the agent (readable and brokered), and every secret of an MCP server
+ * attached to it (named `mcp:<server>/<secret>`), with every form to look for. Rejects if any read fails.
+ */
+export async function loadAgentSecretValues(db, cipher, agentId) {
+    const [rows, mcp] = await Promise.all([
+        db.agentSecret.findMany({ where: { agentId }, select: { boundName: true } }),
+        mcpNamedSecretValues(db, cipher, agentId),
+    ]);
+    const accessor = buildSecretsAccessor(agentId, cipher, db);
+    const own = await Promise.all(rows.map(async ({ boundName }) => {
+        const entry = await accessor.resolve(boundName);
+        return { name: boundName, values: entry ? withEscapedForms(consoleRedactionValues(entry)) : [] };
+    }));
+    return [...own, ...mcp];
+}
+function textOf(value) {
+    return typeof value === "string" ? value : (JSON.stringify(value) ?? "");
+}
+/** The sorted, unique names of the secrets whose value occurs anywhere in `value`. */
+export function secretNamesIn(value, named) {
+    const text = textOf(value);
+    const hits = new Set();
+    for (const { name, values } of named) {
+        if (values.some((v) => v.length >= MIN_REDACTABLE_SECRET_LENGTH && text.includes(v)))
+            hits.add(name);
+    }
+    return [...hits].sort();
+}
+const MAX_MESSAGE_LENGTH = 1000;
+const MCP_SECRET_PREFIX = "mcp:";
+function refusal(names, listed) {
+    const shown = names.slice(0, listed).map((n) => JSON.stringify(n));
+    const more = names.length - listed;
+    const list = shown.join(", ") + (more > 0 ? `, and ${more} more` : "");
+    const noun = names.length > 1 ? "secrets" : "secret";
+    const head = `secret_in_value: not stored. The value contains the value of ${noun} ${list} attached to this agent, and secret values are never stored.`;
+    // An MCP server's secret (`mcp:<server>/<secret>`) is not readable by the agent, so it gets no secrets.get hint.
+    const readable = names.find((n) => !n.startsWith(MCP_SECRET_PREFIX));
+    const mcpNote = names.some((n) => n.startsWith(MCP_SECRET_PREFIX))
+        ? " A name starting with mcp: is an MCP server's secret: it is used only by that server's tools and can't be stored or read."
+        : "";
+    if (readable === undefined)
+        return head + mcpNote;
+    const first = JSON.stringify(readable);
+    return `${head} Store the secret's name instead and read it when you need it: secrets.get(${first}), or fetch(url, { secrets: [${first}] }) if it is brokered.${mcpNote}`;
+}
+/** The agent-visible refusal: names the secrets, never a value. At most 1000 characters. */
+export function secretInValueMessage(names) {
+    let listed = names.length;
+    while (listed > 1 && refusal(names, listed).length > MAX_MESSAGE_LENGTH)
+        listed--;
+    return refusal(names, listed);
+}
+export const SECRET_CHECK_UNAVAILABLE_MESSAGE = "secret_check_unavailable: not stored. The agent's secrets could not be read to check this value; try again.";
+export const WITHHELD_TEXT_NOTICE = "[withheld: this text could not be checked for secret values]";
+export class SecretInValueError extends Error {
+    code = "secret_in_value";
+    secretNames;
+    constructor(names) {
+        super(secretInValueMessage(names));
+        this.name = "SecretInValueError";
+        this.secretNames = [...names];
+    }
+}
+export class SecretCheckUnavailableError extends Error {
+    code = "secret_check_unavailable";
+    constructor() {
+        super(SECRET_CHECK_UNAVAILABLE_MESSAGE);
+        this.name = "SecretCheckUnavailableError";
+    }
+}
+/** `text` with every value of every named secret masked. */
+export function maskNamedSecrets(text, named) {
+    return redactExactSecretValues(text, named.flatMap((n) => n.values));
+}
+/** Refuses a value holding an attached secret's value; fails closed when the secrets cannot be read. */
+export function createSecretWriteGuard(source) {
+    return {
+        async assertNoSecrets(agentId, value) {
+            let named;
+            try {
+                named = await source.load(agentId);
+            }
+            catch {
+                throw new SecretCheckUnavailableError();
+            }
+            const names = secretNamesIn(value, named);
+            if (names.length > 0)
+                throw new SecretInValueError(names);
+        },
+    };
+}
+export function createDbSecretWriteGuard(db, cipher) {
+    return createSecretWriteGuard({ load: (id) => loadAgentSecretValues(db, cipher, id) });
+}
+/**
+ * Built-in tools whose arguments become text on a host, so their arguments are masked before
+ * the call. Review host: repo_publish_review (summary, body, inline comment bodies), repo_comment
+ * (body). Jira: jira_comment and jira_edit_own_comment (body), jira_update_fields (labels,
+ * components, priority, custom fields), jira_create_issue (summary, description, labels,
+ * components, custom fields, fingerprint), jira_set_property (a stored value), jira_transition
+ * (toStatus, which Jira may echo in an error). Read tools and jira_link_issues (a link type name
+ * checked against an allowlist) are left out.
+ */
+export const POSTING_TOOL_NAMES = new Set([
+    "repo_publish_review",
+    "repo_comment",
+    "jira_comment",
+    "jira_edit_own_comment",
+    "jira_update_fields",
+    "jira_create_issue",
+    "jira_set_property",
+    "jira_transition",
+]);

package/dist/core/secret-guarded-stores.d.ts

@@ -0,0 +1,12 @@
+import type { Datastore } from "../providers/datastore/types.js";
+import type { AgentMemoryStore } from "../providers/memory/types.js";
+import { type SecretWriteGuard } from "./secret-guard.js";
+/**
+ * Datastore that refuses a key or value holding an attached secret's value. Shared
+ * writes are checked against `opts.writerAgentId`; without it the writer is
+ * unknown, so the write is refused (fail closed). `writerAgentId` is stripped
+ * before the inner store sees it.
+ */
+export declare function guardDatastore(inner: Datastore, guard: SecretWriteGuard): Datastore;
+/** Agent memory that refuses a key or content holding an attached secret's value. */
+export declare function guardAgentMemory(inner: AgentMemoryStore, guard: SecretWriteGuard): AgentMemoryStore;

package/dist/core/secret-guarded-stores.js

@@ -0,0 +1,41 @@
+import { SecretCheckUnavailableError } from "./secret-guard.js";
+/**
+ * Datastore that refuses a key or value holding an attached secret's value. Shared
+ * writes are checked against `opts.writerAgentId`; without it the writer is
+ * unknown, so the write is refused (fail closed). `writerAgentId` is stripped
+ * before the inner store sees it.
+ */
+export function guardDatastore(inner, guard) {
+    return {
+        get: (agentId, key) => inner.get(agentId, key),
+        async set(agentId, key, value, opts) {
+            await guard.assertNoSecrets(agentId, [key, value]);
+            return inner.set(agentId, key, value, opts);
+        },
+        delete: (agentId, key) => inner.delete(agentId, key),
+        list: (agentId, prefix) => inner.list(agentId, prefix),
+        getShared: (datastoreId, key) => inner.getShared(datastoreId, key),
+        async setShared(datastoreId, key, value, opts) {
+            const { writerAgentId, ...rest } = opts ?? {};
+            if (!writerAgentId)
+                throw new SecretCheckUnavailableError();
+            await guard.assertNoSecrets(writerAgentId, [key, value]);
+            return inner.setShared(datastoreId, key, value, rest);
+        },
+        deleteShared: (datastoreId, key) => inner.deleteShared(datastoreId, key),
+        listShared: (datastoreId, prefix) => inner.listShared(datastoreId, prefix),
+    };
+}
+/** Agent memory that refuses a key or content holding an attached secret's value. */
+export function guardAgentMemory(inner, guard) {
+    return {
+        get: (agentId, key) => inner.get(agentId, key),
+        async set(agentId, key, content) {
+            await guard.assertNoSecrets(agentId, [key, content]);
+            return inner.set(agentId, key, content);
+        },
+        list: (agentId) => inner.list(agentId),
+        search: (agentId, query, limit) => inner.search(agentId, query, limit),
+        delete: (agentId, key) => inner.delete(agentId, key),
+    };
+}

package/dist/core/secret-spans.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The one redactor for exact secret values: every site that masks values it knows (the sandbox
+ * console bridge, the native gateway's log, the native worker's stderr, a brokered response, a
+ * coding worker's debug trace, git output) goes through these functions. It masks the union of
+ * every occurrence of every value, overlapping occurrences included, so no character of any
+ * occurrence survives however occurrences overlap (a value such as `abcabcabc` in `abc` x 5).
+ *
+ * No imports: every worker image (native sandbox, coding driver, Claude coding worker) ships this
+ * file next to its callers.
+ */
+/** Below this length a "secret" is too likely to coincidentally match ordinary log text — not worth the false-positive risk of redacting it. */
+export declare const MIN_REDACTABLE_SECRET_LENGTH = 6;
+/** The marker that stands in for each masked span, unless a site passes its own. */
+export declare const REDACTED_MARKER = "[REDACTED]";
+export interface RedactOptions {
+    /** Replaces each merged span (default REDACTED_MARKER). */
+    marker?: string;
+    /** Values shorter than this are left alone (default MIN_REDACTABLE_SECRET_LENGTH; an empty value never matches). */
+    minLength?: number;
+}
+/**
+ * Each value plus its JSON-escaped forms, deduplicated: escaped once (`JSON.stringify(v).slice(1, -1)`)
+ * and twice. A value holding a quote, a backslash, a newline or a control character appears escaped
+ * once inside JSON text (a console line, a log line), and twice when that JSON text is itself
+ * logged as a string (`console.log(JSON.stringify({ key: value }))` through the console bridge, or
+ * a logger field that already holds JSON). The one expansion every redaction list goes through.
+ */
+export declare function withEscapedForms(values: Iterable<string>): string[];
+/**
+ * The merged, sorted [start, end) spans of `text` covered by any occurrence of any value, overlapping
+ * occurrences included (the search advances by one character, not by the value's length), so a
+ * self-overlapping value is covered wherever any occurrence of it lies. Values shorter than
+ * `minLength` are ignored. Overlapping or adjacent spans merge.
+ */
+export declare function secretSpans(text: string, values: Iterable<string>, minLength?: number): Array<[number, number]>;
+/** `spans` sorted and merged, overlapping or adjacent ones joined. */
+export declare function mergeSpans(spans: ReadonlyArray<readonly [number, number]>): Array<[number, number]>;
+/** `text` with each of the merged, sorted `spans` replaced by one `marker`. */
+export declare function maskSpans(text: string, spans: ReadonlyArray<readonly [number, number]>, marker?: string): string;
+/**
+ * `text` with the union of every occurrence of each value (secretSpans) replaced by the marker;
+ * values shorter than the minimum length are left alone.
+ */
+export declare function redactExactSecretValues(text: string, values: Iterable<string>, options?: RedactOptions): string;
+/**
+ * Whether `text` equals, contains, or is contained in any of `values`, under the same minimum
+ * length as redactExactSecretValues. For a short field that is sent whole or not at all (a native
+ * gateway error's cause code), where redacting part of it would still leave part of a value.
+ */
+export declare function overlapsSecretValue(text: string, values: Iterable<string>): boolean;

package/dist/core/secret-spans.js

@@ -0,0 +1,94 @@
+/**
+ * The one redactor for exact secret values: every site that masks values it knows (the sandbox
+ * console bridge, the native gateway's log, the native worker's stderr, a brokered response, a
+ * coding worker's debug trace, git output) goes through these functions. It masks the union of
+ * every occurrence of every value, overlapping occurrences included, so no character of any
+ * occurrence survives however occurrences overlap (a value such as `abcabcabc` in `abc` x 5).
+ *
+ * No imports: every worker image (native sandbox, coding driver, Claude coding worker) ships this
+ * file next to its callers.
+ */
+/** Below this length a "secret" is too likely to coincidentally match ordinary log text — not worth the false-positive risk of redacting it. */
+export const MIN_REDACTABLE_SECRET_LENGTH = 6;
+/** The marker that stands in for each masked span, unless a site passes its own. */
+export const REDACTED_MARKER = "[REDACTED]";
+/** `text` as it appears inside a JSON string literal (JSON.stringify without the quotes). */
+const jsonEscaped = (text) => JSON.stringify(text).slice(1, -1);
+/**
+ * Each value plus its JSON-escaped forms, deduplicated: escaped once (`JSON.stringify(v).slice(1, -1)`)
+ * and twice. A value holding a quote, a backslash, a newline or a control character appears escaped
+ * once inside JSON text (a console line, a log line), and twice when that JSON text is itself
+ * logged as a string (`console.log(JSON.stringify({ key: value }))` through the console bridge, or
+ * a logger field that already holds JSON). The one expansion every redaction list goes through.
+ */
+export function withEscapedForms(values) {
+    const out = new Set();
+    for (const value of values) {
+        const once = jsonEscaped(value);
+        out.add(value);
+        out.add(once);
+        out.add(jsonEscaped(once));
+    }
+    return [...out];
+}
+/**
+ * The merged, sorted [start, end) spans of `text` covered by any occurrence of any value, overlapping
+ * occurrences included (the search advances by one character, not by the value's length), so a
+ * self-overlapping value is covered wherever any occurrence of it lies. Values shorter than
+ * `minLength` are ignored. Overlapping or adjacent spans merge.
+ */
+export function secretSpans(text, values, minLength = MIN_REDACTABLE_SECRET_LENGTH) {
+    const spans = [];
+    const shortest = Math.max(1, minLength);
+    for (const value of new Set(values)) {
+        if (value.length < shortest)
+            continue;
+        for (let at = text.indexOf(value); at >= 0; at = text.indexOf(value, at + 1))
+            spans.push([at, at + value.length]);
+    }
+    return mergeSpans(spans);
+}
+/** `spans` sorted and merged, overlapping or adjacent ones joined. */
+export function mergeSpans(spans) {
+    const sorted = spans.filter(([start, end]) => end > start).sort((a, b) => a[0] - b[0] || a[1] - b[1]);
+    const merged = [];
+    for (const [start, end] of sorted) {
+        const last = merged[merged.length - 1];
+        if (last && start <= last[1])
+            last[1] = Math.max(last[1], end);
+        else
+            merged.push([start, end]);
+    }
+    return merged;
+}
+/** `text` with each of the merged, sorted `spans` replaced by one `marker`. */
+export function maskSpans(text, spans, marker = REDACTED_MARKER) {
+    let out = "";
+    let from = 0;
+    for (const [start, end] of spans) {
+        out += `${text.slice(from, start)}${marker}`;
+        from = end;
+    }
+    return out + text.slice(from);
+}
+/**
+ * `text` with the union of every occurrence of each value (secretSpans) replaced by the marker;
+ * values shorter than the minimum length are left alone.
+ */
+export function redactExactSecretValues(text, values, options = {}) {
+    return maskSpans(text, secretSpans(text, values, options.minLength), options.marker);
+}
+/**
+ * Whether `text` equals, contains, or is contained in any of `values`, under the same minimum
+ * length as redactExactSecretValues. For a short field that is sent whole or not at all (a native
+ * gateway error's cause code), where redacting part of it would still leave part of a value.
+ */
+export function overlapsSecretValue(text, values) {
+    for (const value of values) {
+        if (value.length < MIN_REDACTABLE_SECRET_LENGTH)
+            continue;
+        if (text.includes(value) || value.includes(text))
+            return true;
+    }
+    return false;
+}

package/dist/core/secrets.d.ts

@@ -23,6 +23,15 @@ export interface SecretsAccessor {
     /** Host-internal: value and broker config, brokered or not. Never exposed to tool code. */
     resolve?(name: string): Promise<SecretEntry | undefined>;
 }
+/** A webhook secret signs what a host sends us, so a short one is refused at registration and at rotation. */
+export declare const MIN_WEBHOOK_SECRET_LENGTH = 16;
+export declare const WEBHOOK_SECRET_SHORT = "host_provider_webhook_secret_short: a host provider's webhook secret needs at least 16 characters";
+export declare const WEBHOOK_SECRET_ATTACHED = "host_provider_webhook_secret_attached: this secret is a host provider's webhook secret and can't be attached to an agent";
+/** The host providers using a secret, by name, and whether it's the webhook secret of any. */
+export declare function hostProvidersUsingSecret(db: Pick<PrismaClient, "hostProvider" | "hostProviderCredential">, secretId: string): Promise<{
+    providers: string[];
+    webhook: boolean;
+}>;
 /**
  * Encrypts and stores a secret value. Upserts on (ownerId, name) — calling
  * this again for a name the owner already has rotates its value in place
@@ -56,7 +65,8 @@ export declare function setSecretBroker(db: PrismaClient, cipher: SecretCipher,
 export declare function listSecrets(ownerId: string, db: PrismaClient): Promise<SecretMetadata[]>;
 /** Attaches one of the owner's own secrets (by canonical name) to an agent,
  *  under `boundName` — the point-of-use name the agent's tools resolve
- *  (`secrets.get(boundName)`). Defaults to the secret's own name. */
+ *  (`secrets.get(boundName)`). Defaults to the secret's own name. A host
+ *  provider's webhook secret is kept off every agent, so no tool can read it. */
 export declare function attachSecret(agentId: string, name: string, ownerId: string, db: PrismaClient, boundName?: string): Promise<void>;
 /** Detaches by point-of-use name — the pair (agentId, boundName) uniquely
  *  identifies the edge — falling back to the secret's own name when no edge

package/dist/core/secrets.js

@@ -13,6 +13,22 @@ function brokerOf(secret) {
     return secret.broker === null || secret.broker === undefined ? null : parseSecretBrokerConfig(secret.broker);
 }
 const BROKERED_GET_MESSAGE = 'secret_brokered: this secret is brokered; send it with fetch(url, { secrets: ["NAME"] }) instead of reading it';
+/** A webhook secret signs what a host sends us, so a short one is refused at registration and at rotation. */
+export const MIN_WEBHOOK_SECRET_LENGTH = 16;
+export const WEBHOOK_SECRET_SHORT = `host_provider_webhook_secret_short: a host provider's webhook secret needs at least ${MIN_WEBHOOK_SECRET_LENGTH} characters`;
+export const WEBHOOK_SECRET_ATTACHED = "host_provider_webhook_secret_attached: this secret is a host provider's webhook secret and can't be attached to an agent";
+/** The host providers using a secret, by name, and whether it's the webhook secret of any. */
+export async function hostProvidersUsingSecret(db, secretId) {
+    const credentials = await db.hostProviderCredential.findMany({ where: { secretId }, select: { provider: true } });
+    const rows = await db.hostProvider.findMany({
+        where: { OR: [{ webhookSecretId: secretId }, { permissionSecretId: secretId }] },
+        select: { name: true, webhookSecretId: true },
+    });
+    return {
+        providers: [...new Set([...credentials.map((c) => c.provider), ...rows.map((r) => r.name)])].sort(),
+        webhook: rows.some((r) => r.webhookSecretId === secretId),
+    };
+}
 /**
  * Encrypts and stores a secret value. Upserts on (ownerId, name) — calling
  * this again for a name the owner already has rotates its value in place
@@ -23,6 +39,12 @@ const BROKERED_GET_MESSAGE = 'secret_brokered: this secret is brokered; send it
 export async function createSecret(name, value, ownerId, cipher, db, options = {}) {
     boundedString(name, 1024);
     boundedString(value, 65_536);
+    if (value.length < MIN_WEBHOOK_SECRET_LENGTH) {
+        const current = await db.secret.findUnique({ where: { ownerId_name: { ownerId, name } }, select: { id: true } });
+        if (current && (await db.hostProvider.count({ where: { webhookSecretId: current.id } })) > 0) {
+            throw new Error(WEBHOOK_SECRET_SHORT);
+        }
+    }
     const broker = options.broker ? parseSecretBrokerConfig(options.broker) : undefined;
     if (broker)
         assertBrokerableValue(broker, value);
@@ -122,11 +144,15 @@ async function findOwnedSecretByName(db, ownerId, name) {
 }
 /** Attaches one of the owner's own secrets (by canonical name) to an agent,
  *  under `boundName` — the point-of-use name the agent's tools resolve
- *  (`secrets.get(boundName)`). Defaults to the secret's own name. */
+ *  (`secrets.get(boundName)`). Defaults to the secret's own name. A host
+ *  provider's webhook secret is kept off every agent, so no tool can read it. */
 export async function attachSecret(agentId, name, ownerId, db, boundName = name) {
     const secret = await findOwnedSecretByName(db, ownerId, name);
     if (!secret)
         throw new Error(`No secret named "${name}" owned by this caller.`);
+    if ((await db.hostProvider.count({ where: { webhookSecretId: secret.id } })) > 0) {
+        throw new Error(WEBHOOK_SECRET_ATTACHED);
+    }
     await db.agentSecret.create({ data: { agentId, secretId: secret.id, boundName } });
 }
 /** Detaches by point-of-use name — the pair (agentId, boundName) uniquely

package/dist/core/serializable-retry.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Run first inside each of those transactions (make_owner, attach_mcp_server, grant/revoke). Postgres's Serializable mode takes a predicate (SIREAD)
+ * lock on everything a statement reads, and a sequential scan locks the whole relation and checks every
+ * row in it for conflicts. On small tables (a fresh deployment, or a test database) the planner picks a
+ * sequential scan even for a primary-key lookup, so two admin actions on unrelated agents read each
+ * other's rows and abort one another, retry after retry, while either keeps running. The Postgres manual
+ * ("Serializable Isolation Level") recommends steering these transactions to index scans; their queries
+ * are keyed by indexed agent, server or resource ids, so turning sequential scans off for this
+ * transaction only (SET LOCAL) narrows the locks to the rows and index pages actually read. It changes
+ * plans, never results: a query with no usable index still scans.
+ */
+export declare function preferIndexScans(tx: {
+    $executeRawUnsafe(query: string): Promise<number>;
+}): Promise<void>;
+export declare function withSerializableRetry<T>(fn: () => Promise<T>, options?: {
+    attempts?: number;
+    sleep?: (ms: number) => Promise<void>;
+}): Promise<T>;

package/dist/core/serializable-retry.js

@@ -0,0 +1,43 @@
+/**
+ * A bounded retry for short Serializable transactions on admin and owner actions (make_owner,
+ * attach_mcp_server, grant/revoke that prune attachments). Postgres aborts one side of a conflicting
+ * pair; nothing of the aborted attempt was committed, so running it again is safe. Only serialization
+ * conflicts (isSerializationConflict: P2034, a raw-statement 40001/40P01, or one at COMMIT) are
+ * retried; anything else, and the last attempt's conflict, is rethrown for mapPrismaError (409).
+ */
+import { isSerializationConflict } from "./dispatch.js";
+const BASE_DELAY_MS = 20;
+const MAX_DELAY_MS = 250;
+/** Jittered exponential backoff: half the ceiling plus up to half again. */
+function delayMs(attempt) {
+    const ceiling = Math.min(MAX_DELAY_MS, BASE_DELAY_MS * 2 ** attempt);
+    return Math.floor(ceiling / 2 + Math.random() * (ceiling / 2));
+}
+/**
+ * Run first inside each of those transactions (make_owner, attach_mcp_server, grant/revoke). Postgres's Serializable mode takes a predicate (SIREAD)
+ * lock on everything a statement reads, and a sequential scan locks the whole relation and checks every
+ * row in it for conflicts. On small tables (a fresh deployment, or a test database) the planner picks a
+ * sequential scan even for a primary-key lookup, so two admin actions on unrelated agents read each
+ * other's rows and abort one another, retry after retry, while either keeps running. The Postgres manual
+ * ("Serializable Isolation Level") recommends steering these transactions to index scans; their queries
+ * are keyed by indexed agent, server or resource ids, so turning sequential scans off for this
+ * transaction only (SET LOCAL) narrows the locks to the rows and index pages actually read. It changes
+ * plans, never results: a query with no usable index still scans.
+ */
+export async function preferIndexScans(tx) {
+    await tx.$executeRawUnsafe("SET LOCAL enable_seqscan = off");
+}
+export async function withSerializableRetry(fn, options = {}) {
+    const attempts = Math.max(1, options.attempts ?? 3);
+    const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    for (let attempt = 0;; attempt += 1) {
+        try {
+            return await fn();
+        }
+        catch (err) {
+            if (!isSerializationConflict(err) || attempt >= attempts - 1)
+                throw err;
+            await sleep(delayMs(attempt));
+        }
+    }
+}