@wardby/cli 0.6.0 → 0.8.0

package/dist/mcp/tools/runs.js

@@ -1,9 +1,18 @@
+import { agentAccessResolver, readableAgentsWhere, requireAgentAccess } from "../auth/access.js";
+import { requireScope } from "../auth/resource-server.js";
 import { McpError } from "../errors.js";
-import { agentAccess, requireAgentAccess } from "../auth/access.js";
-import { publicCodingRunResult } from "../../coding/protocol.js";
+import { loadGraphRuns } from "../../viewer/graph.js";
+import { loadJiraConfig } from "../../config/providers.js";
+import { findReadableRun } from "./run-access.js";
+import { publicCodingRunResult, redactTokenShapedValues, sanitizeDependencyCacheReport, } from "../../coding/protocol.js";
 import { countPlanRefusals, summarizeRegistryFetches } from "../../coding/registry/report.js";
+import { summarizePackageAudit } from "../../coding/registry/audit-mode.js";
 import { storedServiceLabels } from "../../coding/services/catalog.js";
 import { textResult } from "./text-result.js";
+import { loadBudgetEvents } from "../../core/budget-events.js";
+import { loadAgentSecretValues, maskNamedSecrets } from "../../core/secret-guard.js";
+import { logger } from "../../core/logger.js";
+const runsLog = logger.child({ module: "mcp-runs" });
 /**
  * Run visibility (resource-sharing grants spec §3.5, A6): a run's output is
  * the triggerer's and the agent owner's, never every reader's. The owner
@@ -15,69 +24,215 @@ function withOperatorMode(run) {
     const mode = run.nativeExecutionMode;
     return { ...run, nativeExecutionMode: mode == null ? null : mode === "sandbox" ? "sandbox" : "control-plane" };
 }
+/**
+ * A coding run's request as its readers may see it. It can be text a caller or an issue wrote, so
+ * the agent's secret values and token-shaped values are masked here on every read. A secret that
+ * can't be read means the text can't be checked, so it is withheld; the log carries the error name only.
+ */
+async function requestForReader(ctx, run, request) {
+    try {
+        const named = await loadAgentSecretValues(ctx.db, ctx.providers.secrets, run.agentId);
+        return { request: redactTokenShapedValues(maskNamedSecrets(request, named)) };
+    }
+    catch (err) {
+        runsLog.warn({ runId: run.id, errorName: err instanceof Error ? err.name : typeof err }, "could not read the agent's secrets to check a run's request; withholding it");
+        return { requestUnavailable: true };
+    }
+}
+/** The issue-tracker sites issue links are built from (the admin viewer's own source); none when unset or invalid. */
+function issueSites() {
+    try {
+        const jira = loadJiraConfig();
+        return jira ? { jira: jira.siteUrl } : {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * What started each run and what it produced, in the admin viewer API's shapes (docs/viewer-api.md):
+ * `triggerInfo` (the pull request, issue, schedule or lead behind it), `outcomes` (pull requests opened,
+ * comments, checks) and `serviceReadiness` (each coding-run service's state). Only ids and links:
+ * repositories, numbers, issue keys, URLs, states and times, never free text. A service's failure
+ * `reason` is left out, since it can quote what the service printed.
+ */
+async function runGraphFields(ctx, runIds) {
+    const graph = await loadGraphRuns(ctx.db, runIds, issueSites());
+    return new Map(graph.map((run) => [
+        run.id,
+        {
+            triggerInfo: run.trigger,
+            outcomes: run.outcomes,
+            serviceReadiness: run.services.map(({ name, state, attempts, readyAt, failedAt }) => ({
+                name,
+                state,
+                attempts,
+                readyAt,
+                failedAt,
+            })),
+        },
+    ]));
+}
+/** Statuses `active: true` keeps, and that `since` always keeps. */
+const ACTIVE_STATUSES = ["pending", "running"];
+/** Rows returned without an agentId: a default and a cap, since it spans every agent the caller can see. */
+const ACROSS_AGENTS_DEFAULT_LIMIT = 50;
+const ACROSS_AGENTS_MAX_LIMIT = 200;
+/** The `active` and `since` filters, as clauses to AND onto the visibility rule. */
+function runFilters(args) {
+    const filters = [];
+    if (args.active === true)
+        filters.push({ status: { in: ACTIVE_STATUSES } });
+    if (args.since !== undefined) {
+        const since = new Date(args.since);
+        if (Number.isNaN(since.getTime()))
+            throw new McpError(400, "since must be an ISO date or time");
+        filters.push({
+            OR: [{ startedAt: { gte: since } }, { finishedAt: { gte: since } }, { status: { in: ACTIVE_STATUSES } }],
+        });
+    }
+    return filters;
+}
+/**
+ * Runs across every agent the caller can read, under the same rule as one agent's listing: all runs of
+ * agents they own, only the runs they triggered on the rest. With `all` (admin:view, checked by the
+ * caller), every run in the deployment, as the admin viewer shows. Rows name their agent and leave
+ * out finalText, which can be long and is one get_run away.
+ */
+async function listRunsAcrossAgents(ctx, filters, opts) {
+    const [where, accessOf] = await Promise.all([
+        opts.all ? Promise.resolve({}) : readableAgentsWhere(ctx),
+        agentAccessResolver(ctx),
+    ]);
+    const agents = await ctx.db.agent.findMany({
+        where,
+        select: { id: true, ownerId: true, name: true, budgetUsd: true },
+    });
+    const owned = agents.filter((agent) => opts.all || accessOf(agent) === "owner").map((agent) => agent.id);
+    const others = agents.filter((agent) => !opts.all && accessOf(agent) !== "owner").map((agent) => agent.id);
+    const byId = new Map(agents.map((agent) => [agent.id, agent]));
+    // A limit that isn't a finite number falls back to the default rather than reaching the query as NaN.
+    const requested = Number.isFinite(opts.limit) ? Math.floor(opts.limit) : ACROSS_AGENTS_DEFAULT_LIMIT;
+    const take = Math.min(Math.max(1, requested), ACROSS_AGENTS_MAX_LIMIT);
+    const status = opts.status;
+    const runs = await ctx.db.run.findMany({
+        where: {
+            OR: [{ agentId: { in: owned } }, { agentId: { in: others }, triggeredById: ctx.principal.id }],
+            ...(status ? { status: status } : {}),
+            ...(filters.length > 0 ? { AND: filters } : {}),
+        },
+        omit: { finalText: true, pricingSnapshot: true },
+        take,
+        orderBy: { startedAt: "desc" },
+    });
+    const graph = await runGraphFields(ctx, runs.map((run) => run.id));
+    return runs.map((run) => {
+        const agent = byId.get(run.agentId);
+        return {
+            ...run,
+            agentName: agent?.name ?? null,
+            agentBudgetUsd: agent ? Number(agent.budgetUsd) : null,
+            ...(graph.get(run.id) ?? { triggerInfo: null, outcomes: [], serviceReadiness: [] }),
+        };
+    });
+}
+/** Same rule as get_run: a pending coding run with queuedAt is waiting for a concurrency slot (CODING_MAX_CONCURRENT), not stuck. */
+async function withQueuedAt(ctx, runs) {
+    const pendingIds = runs.filter((run) => run.status === "pending").map((run) => run.id);
+    const queued = pendingIds.length > 0
+        ? await ctx.db.codingRun.findMany({
+            where: { runId: { in: pendingIds }, queuedAt: { not: null } },
+            select: { runId: true, queuedAt: true },
+        })
+        : [];
+    const queuedAtByRun = new Map(queued.map((row) => [row.runId, row.queuedAt?.toISOString()]));
+    return runs.map((run) => {
+        const codingQueuedAt = queuedAtByRun.get(run.id);
+        return codingQueuedAt ? { ...withOperatorMode(run), codingQueuedAt } : withOperatorMode(run);
+    });
+}
 export function registerRunTools(mcp) {
     mcp.registerTool({
         name: "list_runs",
         scope: "agents:read",
+        description: "Lists runs, newest first. With agentId, that agent's runs; without it, runs across every agent you can see " +
+            "(each row adds agentName, agentBudgetUsd, triggerInfo, outcomes and serviceReadiness, and leaves out finalText " +
+            `and pricingSnapshot; default limit ${ACROSS_AGENTS_DEFAULT_LIMIT}, ` +
+            `at most ${ACROSS_AGENTS_MAX_LIMIT}). You see all runs of agents you own and only the runs you triggered on others. ` +
+            "active: true keeps pending and running runs; since (ISO time) keeps runs that started or finished then or later, " +
+            "plus any still pending or running. all: true (no agentId) lists every run in the deployment (admins only, admin:view). " +
+            "Use get_run for one run's detail.",
         inputSchema: {
             type: "object",
-            properties: { agentId: { type: "string" }, status: { type: "string" }, limit: { type: "number" } },
-            required: ["agentId"],
+            properties: {
+                agentId: { type: "string" },
+                status: { type: "string" },
+                active: { type: "boolean" },
+                since: { type: "string", description: "ISO date or time" },
+                all: { type: "boolean" },
+                limit: { type: "number" },
+            },
         },
         handler: async (args, ctx) => {
+            const filters = runFilters(args);
+            if (args.all === true) {
+                if (args.agentId !== undefined)
+                    throw new McpError(400, "all lists every agent's runs; leave out agentId");
+                if (!ctx.operator)
+                    requireScope(ctx, ctx.canonicalUri, "admin:view");
+            }
+            if (args.agentId === undefined) {
+                const runs = await listRunsAcrossAgents(ctx, filters, {
+                    status: args.status,
+                    limit: args.limit,
+                    all: args.all === true,
+                });
+                return textResult(await withQueuedAt(ctx, runs));
+            }
             const { access } = await requireAgentAccess(ctx, args.agentId, "read");
             const runs = await ctx.db.run.findMany({
                 where: {
                     agentId: args.agentId,
                     ...(args.status ? { status: args.status } : {}),
                     ...(access === "owner" ? {} : { triggeredById: ctx.principal.id }),
+                    ...(filters.length > 0 ? { AND: filters } : {}),
                 },
                 take: args.limit,
                 orderBy: { startedAt: "desc" },
             });
-            // Same rule as get_run: a pending coding run with queuedAt is waiting
-            // for a concurrency slot (CODING_MAX_CONCURRENT), not stuck.
-            const pendingIds = runs.filter((run) => run.status === "pending").map((run) => run.id);
-            const queued = pendingIds.length > 0
-                ? await ctx.db.codingRun.findMany({
-                    where: { runId: { in: pendingIds }, queuedAt: { not: null } },
-                    select: { runId: true, queuedAt: true },
-                })
-                : [];
-            const queuedAtByRun = new Map(queued.map((row) => [row.runId, row.queuedAt?.toISOString()]));
-            return textResult(runs.map((run) => {
-                const codingQueuedAt = queuedAtByRun.get(run.id);
-                return codingQueuedAt ? { ...withOperatorMode(run), codingQueuedAt } : withOperatorMode(run);
-            }));
+            return textResult(await withQueuedAt(ctx, runs));
         },
     });
     mcp.registerTool({
         name: "get_run",
         scope: "agents:read",
+        description: "One run in full: status, cost, request, result, errors and budget events, plus triggerInfo (what started it: " +
+            "a pull request review or mention, an issue, a schedule or a lead run), outcomes (pull requests opened, comments, " +
+            "checks) and serviceReadiness. A run's pull-request outcome matching another run's triggerInfo links the two.",
         inputSchema: { type: "object", properties: { runId: { type: "string" } }, required: ["runId"] },
         handler: async (args, ctx) => {
-            const run = await ctx.db.run.findUnique({ where: { id: args.runId } });
-            const notFound = new McpError(404, `Run "${args.runId}" not found.`);
-            if (!run)
-                throw notFound;
             // Its triggerer keeps seeing it even after losing access to the agent;
             // otherwise only the agent's owner. read on the agent is not enough.
-            if (run.triggeredById !== ctx.principal.id) {
-                const agent = await ctx.db.agent.findUnique({ where: { id: run.agentId } });
-                if (!agent || (await agentAccess(ctx, agent)) !== "owner")
-                    throw notFound;
-            }
+            const run = await findReadableRun(ctx, args.runId);
             const codingRun = await ctx.db.codingRun.findUnique({
                 where: { runId: run.id },
                 select: {
                     result: true,
+                    request: true,
                     queuedAt: true,
                     failureCategory: true,
                     diagnosticId: true,
                     debugTrace: true,
+                    debugTraceMaxMb: true,
                     services: true,
                     resultBranch: true,
                     baseSha: true,
+                    dependencyCacheResult: true,
+                    prDescriptionOutcome: true,
+                    packageAuditMode: true,
+                    budgetBaseUsd: true,
+                    budgetReservedUsd: true,
+                    budgetLimitUsd: true,
                 },
             });
             const localPr = await ctx.db.localPullRequest.findUnique({
@@ -102,6 +257,12 @@ export function registerRunTools(mcp) {
                     refused: countPlanRefusals(registryFetches),
                 }
                 : undefined;
+            // Package audit mode, fixed at dispatch: what the registry served only
+            // because of it (empty when nothing was), read only for a run that had it.
+            const packageAuditMode = codingRun?.packageAuditMode ?? null;
+            const packageAudit = packageAuditMode
+                ? summarizePackageAudit(await ctx.db.registryAuditRecord.findMany({ where: { runId: run.id }, orderBy: { createdAt: "asc" } })).entries
+                : undefined;
             // A failed coding run's error is only an opaque id; these two say which
             // stage failed and are the key an operator searches the control-plane
             // log for (the real reason is logged there, never persisted). Both are
@@ -110,17 +271,37 @@ export function registerRunTools(mcp) {
             const diagnosticId = codingRun?.diagnosticId ?? undefined;
             // Which services the run started with ("postgres 16"); never their images or environments.
             const services = codingRun ? storedServiceLabels(codingRun.services) : [];
+            // The worker's dependency cache report (stable codes, folder names and numbers only), re-bounded on read.
+            const dependencyCache = codingRun?.dependencyCacheResult !== null && codingRun?.dependencyCacheResult !== undefined
+                ? sanitizeDependencyCacheReport(codingRun.dependencyCacheResult)
+                : undefined;
+            // Well-formed refusals only, with group, lead and agent budget filled as the run error's are.
+            const budgetEvents = await loadBudgetEvents(ctx.db, run.id);
+            // What started the run and what it produced, as the admin viewer shows them.
+            const graph = (await runGraphFields(ctx, [run.id])).get(run.id);
+            // What the run was asked to do: the trigger's or lead's task, without the agent's standing instructions.
+            const request = codingRun?.request ? await requestForReader(ctx, run, codingRun.request) : {};
             return textResult({
                 ...withOperatorMode(run),
+                ...request,
+                ...(graph ?? {}),
+                ...(budgetEvents.length > 0 ? { budgetEvents } : {}),
+                ...(codingRun?.budgetReservedUsd != null ? { budgetReservedUsd: Number(codingRun.budgetReservedUsd) } : {}),
+                ...(codingRun?.budgetBaseUsd != null ? { budgetBaseUsd: Number(codingRun.budgetBaseUsd) } : {}),
+                // The most overrun top-ups may raise budgetReservedUsd to; absent = the reservation is the limit.
+                ...(codingRun?.budgetLimitUsd != null ? { budgetLimitUsd: Number(codingRun.budgetLimitUsd) } : {}),
                 ...(codingResult ? { codingResult } : {}),
                 ...(failureCategory ? { failureCategory } : {}),
                 ...(diagnosticId ? { diagnosticId } : {}),
                 ...(codingQueuedAt ? { codingQueuedAt } : {}),
                 // An admin turned on the debug trace: the worker's full trace is in its pod log.
                 ...(codingRun?.debugTrace ? { debugTrace: true } : {}),
+                ...(codingRun?.debugTrace && codingRun.debugTraceMaxMb ? { debugTraceMaxMb: codingRun.debugTraceMaxMb } : {}),
                 ...(services.length > 0 ? { services } : {}),
                 ...(codingRun?.resultBranch ? { resultBranch: codingRun.resultBranch } : {}),
                 ...(codingRun?.baseSha ? { baseSha: codingRun.baseSha } : {}),
+                ...(dependencyCache ? { dependencyCache } : {}),
+                ...(codingRun?.prDescriptionOutcome ? { prDescriptionOutcome: codingRun.prDescriptionOutcome } : {}),
                 ...(localPr
                     ? {
                         review: {
@@ -137,6 +318,7 @@ export function registerRunTools(mcp) {
                     }
                     : {}),
                 ...(codingRun ? { packages, packageRefusals, packagePlan } : {}),
+                ...(packageAuditMode ? { packageAuditMode, packageAudit } : {}),
             });
         },
     });

package/dist/mcp/tools/scheduling.js

@@ -1,5 +1,6 @@
 import { Prisma } from "#prisma";
 import { validateCronExpression } from "../../core/cron.js";
+import { scheduleStartFields } from "../../core/schedule-start.js";
 import { McpError } from "../errors.js";
 import { assertAgentAccess, requireAgentAccess } from "../auth/access.js";
 import { textResult } from "./text-result.js";
@@ -24,9 +25,10 @@ export function registerSchedulingTools(mcp) {
                 if (existing.kind === "coding" && !existing.codingProfile?.defaultTask) {
                     throw new McpError(400, "A default task is required before enabling a coding-agent schedule.");
                 }
+                const next = { schedule: args.schedule, timezone: args.timezone, scheduleEnabled: true };
                 return tx.agent.update({
                     where: { id: args.agentId },
-                    data: { schedule: args.schedule, timezone: args.timezone, scheduleEnabled: true },
+                    data: { ...next, ...(await scheduleStartFields(tx, existing, next)) },
                 });
             }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });
             return textResult(agent);

package/dist/mcp/tools/secret-elicitation-form.js

@@ -123,6 +123,11 @@ export async function handleSecretElicitationForm(method, token, readFormBody, r
         if (!token)
             throw new Error("missing token");
         payload = await deps.verify(token);
+        // Other links share the signing key (a run transcript download, a tool's
+        // requestState): only a secret link's kind opens this form.
+        if (payload.kind !== undefined && payload.kind !== "create" && payload.kind !== "unbroker") {
+            throw new Error("not a secret link");
+        }
     }
     catch {
         html(res, 400, "<h1>Link expired</h1><p>This link is invalid or has expired. Return to your MCP client and try again.</p>");

package/dist/mcp/tools/secret-elicitation-server.d.ts

@@ -1,5 +1,11 @@
 import type { SecretFormDeps } from "./secret-elicitation-form.js";
+import { type StdioLinkHandler } from "../transport/stdio-link-host.js";
+/** The loopback path the form is served at on stdio. */
+export declare const STDIO_SECRET_PATH = "/secret";
 export interface StdioSecretElicitationHost {
     urlFor(token: string): Promise<string>;
 }
+/** The secret form as a link-host route. */
+export declare function secretFormRoute(deps: SecretFormDeps): StdioLinkHandler;
+/** A link host serving only the secret form (the composition root shares one host across routes). */
 export declare function createStdioSecretElicitationHost(deps: SecretFormDeps): StdioSecretElicitationHost;

package/dist/mcp/tools/secret-elicitation-server.js

@@ -1,64 +1,13 @@
-/**
- * stdio-only host for the secret-entry form: an ephemeral, loopback-only
- * HTTP server, started lazily on the first pending elicitation and closed
- * after a period of inactivity. stdio's MCP process has no other listener
- * (see mcp/transport/stdio.ts) — this one exists only while a secret entry
- * is actually pending, consistent with stdio's "no token; the operator is
- * trusted" model: reachable only from this same machine, and only a holder
- * of the one-time signed URL can do anything with it.
- */
-import { createServer } from "node:http";
 import { handleSecretElicitationForm, readFormBody } from "./secret-elicitation-form.js";
-/** Matches the requestState codec's own TTL (server.ts) — no point outliving the tokens it serves. */
-const IDLE_SHUTDOWN_MS = 10 * 60_000;
+import { createStdioLinkHost } from "../transport/stdio-link-host.js";
+/** The loopback path the form is served at on stdio. */
+export const STDIO_SECRET_PATH = "/secret";
+/** The secret form as a link-host route. */
+export function secretFormRoute(deps) {
+    return (req, res, token) => handleSecretElicitationForm(req.method, token, () => readFormBody(req), res, deps);
+}
+/** A link host serving only the secret form (the composition root shares one host across routes). */
 export function createStdioSecretElicitationHost(deps) {
-    let server;
-    let port = 0;
-    let idleTimer;
-    function scheduleIdleShutdown() {
-        if (idleTimer)
-            clearTimeout(idleTimer);
-        idleTimer = setTimeout(() => {
-            server?.close();
-            server = undefined;
-        }, IDLE_SHUTDOWN_MS);
-        idleTimer.unref();
-    }
-    async function ensureServer() {
-        if (server) {
-            scheduleIdleShutdown();
-            return port;
-        }
-        const s = createServer((req, res) => {
-            scheduleIdleShutdown();
-            const url = new URL(req.url ?? "/", "http://127.0.0.1");
-            if (url.pathname !== "/secret") {
-                res.writeHead(404).end();
-                return;
-            }
-            // A failure here must never become an unhandled rejection: that would take
-            // down the whole stdio MCP process, not just this request.
-            handleSecretElicitationForm(req.method, url.searchParams.get("t"), () => readFormBody(req), res, deps).catch(() => {
-                if (!res.headersSent)
-                    res.writeHead(500, { "content-type": "text/plain; charset=utf-8" });
-                if (!res.writableEnded)
-                    res.end("Internal error");
-            });
-        });
-        server = s;
-        await new Promise((resolve, reject) => {
-            s.once("error", reject);
-            s.listen(0, "127.0.0.1", resolve);
-        });
-        const address = s.address();
-        port = typeof address === "object" && address ? address.port : 0;
-        scheduleIdleShutdown();
-        return port;
-    }
-    return {
-        async urlFor(token) {
-            const p = await ensureServer();
-            return `http://127.0.0.1:${p}/secret?t=${encodeURIComponent(token)}`;
-        },
-    };
+    const host = createStdioLinkHost({ [STDIO_SECRET_PATH]: secretFormRoute(deps) });
+    return { urlFor: (token) => host.urlFor(STDIO_SECRET_PATH, token) };
 }

package/dist/mcp/tools/secret-elicitation.d.ts

@@ -38,6 +38,8 @@ export interface SecretElicitationPayload {
      * removal is refused if the secret's config has changed since (or the link has none).
      */
     brokerHash?: string;
+    /** The caller passed the hosts:admin check when the link was minted. */
+    hostManager?: boolean;
 }
 export type SecretElicitationOutcome = {
     ok: true;

package/dist/mcp/tools/secret-elicitation.js

@@ -1,4 +1,4 @@
-import { createSecret, listSecrets, setSecretBroker } from "../../core/secrets.js";
+import { createSecret, hostProvidersUsingSecret, listSecrets, setSecretBroker, } from "../../core/secrets.js";
 import { parseSecretBrokerConfig, SECRET_BROKER_CHANGED, } from "../../core/secret-broker-config.js";
 /**
  * A link only does what it was minted for: a create link can't confirm an
@@ -19,6 +19,18 @@ function kindOf(outcome) {
     return outcome.kind ?? "create";
 }
 const ELICITATION_TTL_MS = 600_000;
+const HOST_PROVIDER_LINK_STALE = "host_provider_secret_link_stale: a host provider now uses this secret; request a new link with hosts:admin";
+/**
+ * A link minted before the secret joined a host provider carries no hosts:admin check.
+ * Refused without recording an outcome, so a fresh link from a host manager still works.
+ */
+async function isStaleForHostProvider(db, payload) {
+    if (payload.hostManager)
+        return false;
+    const { ownerId, secretName: name } = payload;
+    const secret = await db.secret.findUnique({ where: { ownerId_name: { ownerId, name } }, select: { id: true } });
+    return secret !== null && (await hostProvidersUsingSecret(db, secret.id)).providers.length > 0;
+}
 /** Sweeps every expired entry, not just the one being looked up, so a set-and-never-polled-again entry doesn't linger forever. */
 async function pruneExpired(db, now) {
     await db.secretElicitationOutcome.deleteMany({ where: { expiresAt: { lte: now } } });
@@ -58,6 +70,9 @@ export async function fulfillSecretElicitation(payload, value, cipher, db, broke
     });
     if (existing && kindOf(existing.outcome) === "create")
         return existing.outcome;
+    if (await isStaleForHostProvider(db, payload)) {
+        return { ok: false, kind: "create", error: HOST_PROVIDER_LINK_STALE };
+    }
     let outcome;
     try {
         const secret = await createSecret(secretName, value, ownerId, cipher, db, {
@@ -89,7 +104,12 @@ export async function fulfillSecretElicitation(payload, value, cipher, db, broke
     await recordOutcome(db, ownerId, secretName, outcome, now);
     return outcome;
 }
-const CORRECTABLE_ERRORS = ["secret_broker_value_invalid", "secret_broker_config_invalid", "bridge_input_limit"];
+const CORRECTABLE_ERRORS = [
+    "secret_broker_value_invalid",
+    "secret_broker_config_invalid",
+    "bridge_input_limit",
+    "host_provider_webhook_secret_short",
+];
 function isCorrectableInput(message) {
     return CORRECTABLE_ERRORS.some((code) => message.startsWith(code));
 }
@@ -115,6 +135,9 @@ export async function fulfillUnbrokerElicitation(payload, cipher, db) {
     });
     if (existing && kindOf(existing.outcome) === "unbroker")
         return existing.outcome;
+    if (await isStaleForHostProvider(db, payload)) {
+        return { ok: false, kind: "unbroker", error: HOST_PROVIDER_LINK_STALE };
+    }
     let outcome;
     try {
         await setSecretBroker(db, cipher, {

package/dist/mcp/tools/secrets.js

@@ -4,11 +4,13 @@
  * value/ciphertext at the source); this file adds ownership on top.
  */
 import { inputRequired, inputResponse } from "@modelcontextprotocol/server";
-import { createSecret, listSecrets, attachSecret, detachSecret, deleteSecret, setSecretBroker, } from "../../core/secrets.js";
+import { createSecret, listSecrets, attachSecret, detachSecret, deleteSecret, hostProvidersUsingSecret, setSecretBroker, WEBHOOK_SECRET_ATTACHED, } from "../../core/secrets.js";
+import { mcpServersUsingSecret } from "../../core/mcp-servers.js";
 import { brokerConfigHash, parseSecretBrokerConfig } from "../../core/secret-broker-config.js";
 import { McpError } from "../errors.js";
 import { requireOwnedSecret } from "../auth/ownership.js";
-import { requireAgentAccess, requireBindingOwner } from "../auth/access.js";
+import { requireScope } from "../auth/resource-server.js";
+import { requireAgentAccess, requireBindable, requireBindingOwner } from "../auth/access.js";
 import { clearUnbrokerOutcome, getSecretElicitationOutcome, } from "./secret-elicitation.js";
 import { allowedSecretNames, brokerCompatibilityWarnings } from "./secret-broker-compat.js";
 import { textResult } from "./text-result.js";
@@ -27,7 +29,9 @@ function mapSecretError(err) {
     const message = err instanceof Error ? err.message : String(err);
     if (message.startsWith("secret_not_found"))
         throw new McpError(404, message);
-    if (message.startsWith("secret_broker_config_invalid") || message.startsWith("secret_broker_value_invalid")) {
+    if (message.startsWith("secret_broker_config_invalid") ||
+        message.startsWith("secret_broker_value_invalid") ||
+        message.startsWith("host_provider_webhook_secret_short")) {
         throw new McpError(400, message);
     }
     throw err;
@@ -70,11 +74,26 @@ async function findOwnSecret(ctx, name) {
         throw new McpError(404, `secret_not_found: no secret named "${name}"`);
     return secret;
 }
+/**
+ * A host provider's secret needs hosts:admin as well as secrets:write: replacing a credential
+ * or its broker config changes what the provider does. True when the caller passed that check,
+ * and its links say so; checked before any link is minted, and again when one is submitted.
+ */
+async function requireHostsAdminIfProviderSecret(ctx, name) {
+    const secret = await ctx.db.secret.findUnique({
+        where: { ownerId_name: { ownerId: ctx.principal.id, name } },
+        select: { id: true },
+    });
+    if (!secret || (await hostProvidersUsingSecret(ctx.db, secret.id)).providers.length === 0)
+        return false;
+    requireScope(ctx, ctx.canonicalUri, "hosts:admin");
+    return true;
+}
 export function registerSecretsTools(mcp, opts) {
     mcp.registerTool({
         name: "create_secret",
         scope: "secrets:write",
-        description: 'Creates a secret. Omit "value" to enter it securely via a one-time browser link instead of passing it as a plaintext argument. Pass "broker" ({ hosts, pathPrefixes?, placement }) to make it brokered: tools can then only send it to those hosts with fetch(url, { secrets: [name] }) and can never read it. See the help article "brokered-secrets".',
+        description: 'Creates a secret. Omit "value" to enter it securely via a one-time browser link instead of passing it as a plaintext argument. Pass "broker" ({ hosts, pathPrefixes?, placement }) to make it brokered: tools can then only send it to those hosts with fetch(url, { secrets: [name] }) and can never read it. A secret a host provider uses also needs hosts:admin. See the help article "brokered-secrets".',
         inputSchema: {
             type: "object",
             properties: {
@@ -85,6 +104,7 @@ export function registerSecretsTools(mcp, opts) {
             required: ["name"],
         },
         handler: async (args, ctx) => {
+            const hostManager = await requireHostsAdminIfProviderSecret(ctx, args.name);
             const broker = args.broker === undefined ? undefined : parseBrokerArg(args.broker);
             if (args.value !== undefined) {
                 let secret;
@@ -131,6 +151,7 @@ export function registerSecretsTools(mcp, opts) {
                 secretName: args.name,
                 kind: "create",
                 ...(broker ? { broker } : {}),
+                ...(hostManager ? { hostManager } : {}),
             };
             const token = await mcp.mintRequestState(payload);
             const url = await opts.buildElicitationUrl(token);
@@ -157,7 +178,7 @@ export function registerSecretsTools(mcp, opts) {
     mcp.registerTool({
         name: "set_secret_broker",
         scope: "secrets:write",
-        description: 'Sets or changes a secret\'s broker config ({ hosts, pathPrefixes?, placement }), so tools can only send it to those hosts with fetch(url, { secrets: [name] }) and never read it. broker: null removes brokering, which must be confirmed by a person in the browser link this returns. Every change is audited. See the help article "brokered-secrets".',
+        description: 'Sets or changes a secret\'s broker config ({ hosts, pathPrefixes?, placement }), so tools can only send it to those hosts with fetch(url, { secrets: [name] }) and never read it. broker: null removes brokering, which must be confirmed by a person in the browser link this returns. Every change is audited. A secret a host provider uses also needs hosts:admin. See the help article "brokered-secrets".',
         inputSchema: {
             type: "object",
             properties: {
@@ -171,6 +192,7 @@ export function registerSecretsTools(mcp, opts) {
         },
         handler: async (args, ctx) => {
             const ownerId = ctx.principal.id;
+            const hostManager = await requireHostsAdminIfProviderSecret(ctx, args.name);
             if (args.broker !== null) {
                 const broker = parseBrokerArg(args.broker);
                 await findOwnSecret(ctx, args.name);
@@ -222,6 +244,7 @@ export function registerSecretsTools(mcp, opts) {
                 secretName: args.name,
                 kind: "unbroker",
                 brokerHash: brokerConfigHash(parseSecretBrokerConfig(secret.broker)),
+                ...(hostManager ? { hostManager } : {}),
             };
             const token = await mcp.mintRequestState(payload);
             const url = await opts.buildElicitationUrl(token);
@@ -269,13 +292,15 @@ export function registerSecretsTools(mcp, opts) {
             // (A2/S2-2): a binding hands the value to every tool the owner lets
             // read it. Not even the stdio operator crosses owners.
             const { agent } = await requireAgentAccess(ctx, args.agentId, "read");
-            requireBindingOwner(ctx, agent);
+            await requireBindable(ctx, agent);
             const ownerId = agent.ownerId;
             try {
                 // Resolved among the agent owner's secrets (== the caller here).
                 await attachSecret(args.agentId, args.name, ownerId, ctx.db, args.alias ?? args.name);
             }
             catch (err) {
+                if (err instanceof Error && err.message === WEBHOOK_SECRET_ATTACHED)
+                    throw new McpError(409, err.message);
                 throw new McpError(404, err instanceof Error ? err.message : String(err));
             }
             return textResult({ attached: true });
@@ -306,6 +331,15 @@ export function registerSecretsTools(mcp, opts) {
         inputSchema: { type: "object", properties: { id: { type: "string" } }, required: ["id"] },
         handler: async (args, ctx) => {
             await requireOwnedSecret(ctx.db, args.id, ctx.principal.id);
+            const { providers } = await hostProvidersUsingSecret(ctx.db, args.id);
+            if (providers.length > 0) {
+                throw new McpError(409, `This secret is used by host provider ${providers.map((p) => `"${p}"`).join(", ")}; re-register it or delete_host_provider first.`);
+            }
+            const secret = await ctx.db.secret.findUnique({ where: { id: args.id }, select: { name: true } });
+            const servers = secret ? await mcpServersUsingSecret(ctx.db, ctx.principal.id, secret.name) : [];
+            if (servers.length > 0) {
+                throw new McpError(409, `Secret "${secret.name}" is used by MCP server(s) ${servers.join(", ")}; update or delete them first.`);
+            }
             await deleteSecret(args.id, ctx.db);
             return textResult({ deleted: args.id });
         },

package/dist/mcp/tools/stop-run.d.ts

@@ -0,0 +1,2 @@
+import type { WardbyMcpServer } from "../server.js";
+export declare function registerStopRunTool(mcp: WardbyMcpServer): void;