@wardby/cli 0.6.0 → 0.8.0

package/dist/mcp/index.js

@@ -13,8 +13,14 @@
  * missing `AUTH_JWKS_URI`/`AUTH_SIGNING_KEY` a deployment running stdio-only
  * never needed to set.
  */
-import { loadProviderConfig, loadMcpConfig, loadShutdownDrainSeconds, loadAuthConfig, loadGitHubEventConfig, loadJiraConfig, loadGitHubVcsConfig, } from "../config/providers.js";
+import { loadToolMaxTimeoutMs } from "../config/tool-timeout.js";
+import { loadMcpServersMode } from "../config/mcp-servers.js";
+import { loadMcpMaxCallsPerRun } from "../config/mcp-call-limit.js";
+import { startupTestSimulators } from "../config/test-simulators.js";
+import { loadProviderConfig, loadMcpConfig, loadShutdownDrainSeconds, loadAuthConfig, loadGitHubEventConfig, loadJiraConfig, loadGitHubVcsConfig, loadBlobStoreConfig, } from "../config/providers.js";
 import { prisma } from "../core/db.js";
+import { guardDatastore, guardAgentMemory } from "../core/secret-guarded-stores.js";
+import { createDbSecretWriteGuard } from "../core/secret-guard.js";
 import { waitForInFlightRuns } from "../core/in-flight-runs.js";
 import { NativeEngine } from "../core/engine-native.js";
 import { resolveLlmRegistrations, RoutingLlmProvider } from "../providers/llm/index.js";
@@ -35,6 +41,7 @@ import { loadGitHubAllowedAccounts } from "../config/github-allowed-accounts.js"
 import { buildMcpServer } from "./server.js";
 import { buildPower } from "../core/power-composition.js";
 import { countUnattendedSchedules, unattendedSchedulesWarning } from "./unattended-schedules.js";
+import { logZod3ToolWarnings } from "../core/zod3-window.js";
 import { runStdioServer } from "./transport/stdio.js";
 import { startHttpServer } from "./transport/streamable-http.js";
 import { resolvePrincipal } from "./auth/principal.js";
@@ -53,18 +60,26 @@ import { registerTriggerTool } from "./tools/trigger.js";
 import { registerToolAuthoringTools } from "./tools/tools.js";
 import { registerSchedulingTools } from "./tools/scheduling.js";
 import { registerRunTools } from "./tools/runs.js";
+import { registerStopRunTool } from "./tools/stop-run.js";
 import { registerCostReportTools } from "./tools/cost-report.js";
 import { registerDatastoreTools } from "./tools/datastore.js";
 import { registerSubAgentTools } from "./tools/subagents.js";
 import { registerGrantTools } from "./tools/grants.js";
+import { registerHostProviderTools } from "./tools/host-providers.js";
+import { registerMcpServerTools } from "./tools/mcp-servers.js";
 import { registerRepositoryTools } from "./tools/repositories.js";
 import { registerIssueProjectTools } from "./tools/issue-projects.js";
 import { registerNotificationChannelTools } from "./tools/notification-channels.js";
 import { registerHostAccountTools } from "./tools/host-accounts.js";
 import { registerMemoryTools } from "./tools/memory.js";
+import { registerPackageTools } from "./tools/packages.js";
 import { registerSecretsTools } from "./tools/secrets.js";
 import { registerWebhookTools } from "./tools/webhooks.js";
-import { createStdioSecretElicitationHost } from "./tools/secret-elicitation-server.js";
+import { STDIO_SECRET_PATH, secretFormRoute } from "./tools/secret-elicitation-server.js";
+import { createStdioLinkHost } from "./transport/stdio-link-host.js";
+import { registerRunTranscriptTool } from "./tools/run-transcript.js";
+import { handleRunTranscriptDownload, RUN_TRANSCRIPT_DOWNLOAD_PATH } from "./tools/run-transcript-download.js";
+import { createBlobStore } from "../providers/storage/index.js";
 import { SECRET_ELICITATION_PATH } from "./tools/secret-elicitation-form.js";
 import { installWorkflowEventRecorder } from "../core/notifications.js";
 import { logger } from "../core/logger.js";
@@ -118,15 +133,25 @@ export function registerAllTools(mcp, opts) {
     registerToolAuthoringTools(mcp);
     registerSchedulingTools(mcp);
     registerRunTools(mcp);
+    const runTranscriptUrl = opts.runTranscriptUrl;
+    registerRunTranscriptTool(mcp, {
+        downloadUrl: runTranscriptUrl ?? (() => Promise.reject(new Error("run transcripts are not served here"))),
+        blobStoreConfigured: runTranscriptUrl !== undefined && opts.blobStoreConfigured === true,
+        audience: opts.runTranscriptAudience ?? "http",
+    });
+    registerStopRunTool(mcp);
     registerCostReportTools(mcp);
     registerDatastoreTools(mcp);
     registerSubAgentTools(mcp);
     registerGrantTools(mcp);
     registerRepositoryTools(mcp);
+    registerHostProviderTools(mcp);
+    registerMcpServerTools(mcp);
     registerIssueProjectTools(mcp);
     registerNotificationChannelTools(mcp);
     registerHostAccountTools(mcp);
     registerMemoryTools(mcp);
+    registerPackageTools(mcp);
     registerSecretsTools(mcp, {
         buildElicitationUrl: opts.secretElicitationUrl,
         protocolElicitation: opts.secretElicitationProtocol,
@@ -143,8 +168,9 @@ export function buildMcpProviders() {
     const llm = new RoutingLlmProvider(llmResult.registrations);
     const engine = new NativeEngine();
     const secrets = buildSecretCipher(providerConfig);
-    const datastore = new PostgresDatastore(prisma, secrets);
-    const memory = new PostgresAgentMemory(prisma);
+    const secretGuard = createDbSecretWriteGuard(prisma, secrets);
+    const datastore = guardDatastore(new PostgresDatastore(prisma, secrets), secretGuard);
+    const memory = guardAgentMemory(new PostgresAgentMemory(prisma), secretGuard);
     const reviewHosts = buildReviewHosts(process.env, prisma);
     const issueTrackers = buildIssueTrackers();
     const hostUserAuthorizers = buildHostUserAuthorizers();
@@ -174,6 +200,10 @@ export function buildMcpProviders() {
         issueTrackers,
         repoAccess,
     };
+    // Read again at each tool call; checked here so a bad value stops start-up, not every run.
+    loadToolMaxTimeoutMs();
+    loadMcpServersMode();
+    loadMcpMaxCallsPerRun();
     const nativeExecutor = buildExecutor(providerConfig, nativeProviders, prisma);
     // One Power for the process, shared by both executors (wake) and the scheduler leader (sleep).
     const power = buildPower({ env: process.env, db: prisma });
@@ -183,6 +213,7 @@ export function buildMcpProviders() {
         providerConfig,
         repoAccess,
         power,
+        secretCipher: secrets,
         // Sandbox-mode native runs (docs/native-sandbox.md); undefined when NATIVE_SANDBOX_LAUNCHER is unset.
         nativeSandbox: buildNativeSandboxExecutor({ db: prisma, providers: nativeProviders, power }),
     });
@@ -233,6 +264,8 @@ export function warmUpExecutor(executor) {
 /** The real CLI entry point: `wardby mcp`. Reads config from the environment, starts stdio or HTTP per MCP_TRANSPORT. */
 export async function startMcp(options = {}) {
     const mcpConfig = loadMcpConfig();
+    // WARDBY_TEST_SIMULATORS (test only): refuses to start beside production configuration.
+    startupTestSimulators("server");
     // Parsed up front so a malformed value fails at startup, not at shutdown.
     const drainSeconds = loadShutdownDrainSeconds();
     // Parsed now so a malformed list stops startup instead of failing every event.
@@ -251,15 +284,32 @@ export async function startMcp(options = {}) {
     warmUpExecutor(providers.executor);
     if (!options.schedulerAttached)
         await warnIfNothingWillFireSchedules();
+    // Zod 3 compatibility window: one warning per custom tool the next release breaks. In the background.
+    void logZod3ToolWarnings(prisma, mcpLog);
+    // Run transcripts (get_run_transcript) are served from the blob store they were stored in.
+    const blobStoreConfig = loadBlobStoreConfig();
+    const blobs = blobStoreConfig ? createBlobStore(blobStoreConfig) : undefined;
     if (mcpConfig.transport === "stdio") {
         const mcp = buildMcpServer({ providers, db: prisma, config: { canonicalUri: STDIO_PLACEHOLDER_URI } });
-        const secretElicitationHost = createStdioSecretElicitationHost({
-            verify: (token) => mcp.verifyRequestState(token),
-            secrets: providers.secrets,
-            db: prisma,
+        // One loopback server for every signed link a stdio tool hands out.
+        const linkHost = createStdioLinkHost({
+            [STDIO_SECRET_PATH]: secretFormRoute({
+                verify: (token) => mcp.verifyRequestState(token),
+                secrets: providers.secrets,
+                db: prisma,
+            }),
+            [RUN_TRANSCRIPT_DOWNLOAD_PATH]: (req, res, token) => handleRunTranscriptDownload(req.method, token, res, {
+                verify: (t) => mcp.verifyRequestState(t),
+                audience: "stdio",
+                db: prisma,
+                blobs,
+            }),
         });
         registerAllTools(mcp, {
-            secretElicitationUrl: (token) => secretElicitationHost.urlFor(token),
+            secretElicitationUrl: (token) => linkHost.urlFor(STDIO_SECRET_PATH, token),
+            runTranscriptUrl: (token) => linkHost.urlFor(RUN_TRANSCRIPT_DOWNLOAD_PATH, token),
+            runTranscriptAudience: "stdio",
+            blobStoreConfigured: blobs !== undefined,
             secretElicitationProtocol: mcpConfig.secretElicitationProtocol,
             refreshModelCatalog: () => modelCatalog.refreshNow(),
         });
@@ -291,10 +341,17 @@ export async function startMcp(options = {}) {
     const authProviderKind = providerConfig.auth === "self-hosted" ? "self-hosted" : "delegating";
     const authProvider = buildAuthProvider(providerConfig.auth, authConfig, prisma);
     const selfHosted = authProviderKind === "self-hosted" ? authProvider : undefined;
-    const mcp = buildMcpServer({ providers, db: prisma, config: { canonicalUri: mcpConfig.canonicalUri } });
+    const mcp = buildMcpServer({
+        providers,
+        db: prisma,
+        config: { canonicalUri: mcpConfig.canonicalUri },
+        deriveRequestStateKey: true,
+    });
     const httpOrigin = canonicalUrl(mcpConfig.canonicalUri).origin;
     registerAllTools(mcp, {
         secretElicitationUrl: (token) => Promise.resolve(`${httpOrigin}${SECRET_ELICITATION_PATH}?t=${encodeURIComponent(token)}`),
+        runTranscriptUrl: (token) => Promise.resolve(`${httpOrigin}${RUN_TRANSCRIPT_DOWNLOAD_PATH}?t=${encodeURIComponent(token)}`),
+        blobStoreConfigured: blobs !== undefined,
         secretElicitationProtocol: mcpConfig.secretElicitationProtocol,
         refreshModelCatalog: () => modelCatalog.refreshNow(),
     });
@@ -319,6 +376,7 @@ export async function startMcp(options = {}) {
                 webhookSecret: eventConfig.webhookSecret,
                 appIdentity: (opts) => githubApp.appIdentity(opts),
                 allowedAccounts: () => allowedAccounts,
+                mentionExplanations: eventConfig.mentionExplanations,
                 uninstallInstallation: (id) => githubApp.deleteInstallation(id),
             },
         }
@@ -385,6 +443,7 @@ export async function startMcp(options = {}) {
         hostEvents,
         hostUserAuth,
         viewer,
+        blobs,
     });
     const cleanupTimer = selfHosted
         ? setInterval(() => {

package/dist/mcp/server.d.ts

@@ -25,6 +25,14 @@
 import { type McpServerFactory, type InputRequiredResult } from "@modelcontextprotocol/server";
 import type { PrismaClient } from "#prisma";
 import type { McpRequestContext, McpProviders } from "./context.js";
+/**
+ * Most array elements plus object members one `tools/call` may carry
+ * (GHSA-46jr-4wx8-v453). Validating an argument tree costs memory per node, so
+ * without a bound one request inside the 1 MiB body limit could hold a very
+ * large tree. The largest legitimate input is a datastore value, itself capped
+ * at 1 MiB; 100,000 nodes leaves ample room for any realistic value.
+ */
+export declare const MAX_TOOL_INPUT_ELEMENTS = 100000;
 export interface ToolSpec<Args = Record<string, unknown>> {
     name: string;
     description?: string;
@@ -58,6 +66,11 @@ export interface BuildMcpServerOptions {
     config: McpServerConfig;
     /** Testability hook for REQUEST_STATE_KEY — defaults to process.env, matching buildSecretCipher's convention. */
     env?: NodeJS.ProcessEnv;
+    /**
+     * HTTP transport: with REQUEST_STATE_KEY unset, derive the requestState key from SECRET_APP_KEY so
+     * every instance sharing that key verifies every other instance's tokens. stdio leaves it off.
+     */
+    deriveRequestStateKey?: boolean;
 }
 export interface DiscoverResultLike {
     capabilities: {

package/dist/mcp/server.js

@@ -23,7 +23,7 @@
  * whole connection.
  */
 import { McpServer, fromJsonSchema, createRequestStateCodec, CLIENT_CAPABILITIES_META_KEY, } from "@modelcontextprotocol/server";
-import { randomBytes } from "node:crypto";
+import { hkdfSync, randomBytes } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { requireScope } from "./auth/resource-server.js";
 import { McpError, mapPrismaError } from "./errors.js";
@@ -33,17 +33,35 @@ import { grantedIds } from "../core/grants.js";
 import { logger } from "../core/logger.js";
 /** The package version, reported in MCP server info (package.json sits two levels up from src/mcp and dist/mcp). */
 const SERVER_VERSION = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8")).version;
+/**
+ * Most array elements plus object members one `tools/call` may carry
+ * (GHSA-46jr-4wx8-v453). Validating an argument tree costs memory per node, so
+ * without a bound one request inside the 1 MiB body limit could hold a very
+ * large tree. The largest legitimate input is a datastore value, itself capped
+ * at 1 MiB; 100,000 nodes leaves ample room for any realistic value.
+ */
+export const MAX_TOOL_INPUT_ELEMENTS = 100_000;
 const REQUEST_STATE_KEY_BYTES = 32;
+/** HKDF info for the requestState key derived from SECRET_APP_KEY; never reused for another key. */
+const REQUEST_STATE_KEY_INFO = "wardby/mcp/request-state/http/v1";
 /**
  * REQUEST_STATE_KEY (hex, 32 bytes) shares the requestState HMAC key across
- * instances — see the requestStateCodec construction below. Unset falls back
- * to a fresh random key, which is correct for stdio and single-instance HTTP
- * and is NOT an error: only a multi-instance HTTP deployment needs this set.
+ * instances — see the requestStateCodec construction below. Unset, the HTTP
+ * transport derives it from SECRET_APP_KEY (HKDF-SHA256, a label of its own),
+ * which every instance of one deployment already shares, so a multi-instance
+ * deployment needs no extra setting; the derived key reveals nothing about
+ * SECRET_APP_KEY. Without either, or on stdio, it is a fresh random key per
+ * process, which is correct when nothing outside that process verifies its
+ * tokens (and keeps stdio tokens from verifying on the HTTP server).
  */
-function loadRequestStateKey(env) {
+function loadRequestStateKey(env, derive) {
     const hex = env.REQUEST_STATE_KEY;
-    if (!hex)
-        return randomBytes(REQUEST_STATE_KEY_BYTES);
+    if (!hex) {
+        const appKey = derive && env.SECRET_APP_KEY ? Buffer.from(env.SECRET_APP_KEY, "hex") : undefined;
+        if (appKey?.length !== REQUEST_STATE_KEY_BYTES)
+            return randomBytes(REQUEST_STATE_KEY_BYTES);
+        return new Uint8Array(hkdfSync("sha256", appKey, Buffer.alloc(0), REQUEST_STATE_KEY_INFO, REQUEST_STATE_KEY_BYTES));
+    }
     const key = Buffer.from(hex, "hex");
     if (key.length !== REQUEST_STATE_KEY_BYTES) {
         throw new Error(`REQUEST_STATE_KEY must be ${REQUEST_STATE_KEY_BYTES} bytes of hex (${REQUEST_STATE_KEY_BYTES * 2} hex chars); got ${key.length} bytes.`);
@@ -76,16 +94,16 @@ export function buildMcpServer(opts) {
     // against the codec's implementation) — safe to call verifyRequestState()
     // from outside a real MCP request (the secret-elicitation browser form).
     //
-    // REQUEST_STATE_KEY, when set, lets a token minted by one process verify
-    // on another — required for the secret-elicitation round trip (mint,
-    // browser-form POST, polling retry) to work under a multi-instance HTTP
+    // REQUEST_STATE_KEY (or, over HTTP, the key derived from SECRET_APP_KEY)
+    // lets a token minted by one process verify on another — required for the
+    // secret-elicitation round trip (mint, browser-form POST, polling retry)
+    // and the run-transcript download to work under a multi-instance HTTP
     // deployment, where those three legs can land on three different
     // processes (see secret-elicitation.ts's matching Postgres-backed outcome
-    // store). stdio and single-instance HTTP need no configuration: with the
-    // env var unset, a fresh random key per process is fine, since nothing
-    // outside this same running server ever needs to verify a token it minted.
+    // store). stdio needs no configuration: a fresh random key per process is
+    // fine, since nothing outside that running server verifies its tokens.
     const requestStateCodec = createRequestStateCodec({
-        key: loadRequestStateKey(opts.env ?? process.env),
+        key: loadRequestStateKey(opts.env ?? process.env, opts.deriveRequestStateKey ?? false),
         ttlSeconds: 600,
     });
     function mcpReqOf(sdkCtx) {
@@ -125,6 +143,7 @@ export function buildMcpServer(opts) {
         const mcpServer = new McpServer({ name: "wardby", version: SERVER_VERSION }, {
             requestState: { verify: (state, ctx) => requestStateCodec.verify(state, ctx) },
             instructions: SERVER_INSTRUCTIONS,
+            maxToolInputElements: MAX_TOOL_INPUT_ELEMENTS,
         });
         mcpServer.server.registerCapabilities({ extensions: { [TASKS_EXTENSION_ID]: {} } });
         for (const spec of specs) {

package/dist/mcp/tools/agents.d.ts

@@ -1,2 +1,6 @@
 import type { WardbyMcpServer } from "../server.js";
+/** The warning create_agent / update_agent return (not a refusal): wardby can't tell how old a custom image is. */
+export declare const DEPENDENCY_CACHE_IMAGE_WARNING = "dependencyCache is on and this agent runs its own worker image (workerImageRef): rebuild that image FROM the wardby release that includes the dependency cache before its next run, or the run fails at input (worker_input_failed). See the dependency-cache help article.";
+export declare const SESSION_RESUME_IMAGE_WARNING = "sessionResume is on and this agent runs its own worker image (workerImageRef): rebuild that image FROM the wardby release that includes session resume before its next run, or the run fails at input (worker_input_failed).";
+export declare const SESSION_RESUME_NO_STORE_WARNING = "sessionResume is on but this server has no blob store (BLOB_STORE), so transcripts are not kept. See the resume-runs-locally help article.";
 export declare function registerAgentTools(mcp: WardbyMcpServer): void;