@wardby/cli 0.7.0 → 0.8.0

package/dist/mcp/tools/grants.js

@@ -1,18 +1,22 @@
 /**
  * grant_access / revoke_access / list_access: the owner's sharing controls
- * (resource-sharing grants spec §3.11). Phase 1 shares agents only; other
- * resource types are refused as "not shareable yet".
+ * (resource-sharing grants spec §3.11). Agents and MCP servers are shareable;
+ * other resource types are refused as "not shareable yet".
  *
  * - Only the resource's owner (or the stdio operator) grants and revokes.
  *   Admins get no implicit access: they may only list_access, for incident
  *   response ("who can reach this?"), and reassign with make_owner.
  * - One grant per resource and grantee, so granting again replaces the
  *   level (also downgrades). Everyone grants are capped below write.
- * - Takes effect on the next check; runs already in flight keep going.
+ * - Takes effect on the next check; runs already in flight keep going. For
+ *   MCP servers the check is every tool call: revoking or lowering a grant
+ *   below use also removes the attachments of agents whose owner can no
+ *   longer use the server, in the same transaction.
  */
 import { z } from "zod";
 import { Prisma } from "#prisma";
-import { EVERYONE_KEY, EVERYONE_MAX, LEVELS, agentOwnerBindings, SHAREABLE_TYPES, accessRank, atLeast, isLevel, isResourceType, principalGranteeKey, } from "../../core/grants.js";
+import { EVERYONE_KEY, EVERYONE_MAX, LEVELS, agentOwnerBindings, SHAREABLE_TYPES, accessRank, atLeast, isLevel, isResourceType, principalGranteeKey, pruneUnusableMcpAttachments, } from "../../core/grants.js";
+import { preferIndexScans, withSerializableRetry } from "../../core/serializable-retry.js";
 import { agentNotFound, assertAgentAccess, agentAccess } from "../auth/access.js";
 import { permissionsOf } from "../auth/resource-server.js";
 import { McpError } from "../errors.js";
@@ -54,10 +58,17 @@ async function resolveGrantee(db, grantee) {
     }
     return principal;
 }
-/** Grant management is the owner's (or the stdio operator's). Phase 1: agents. */
+/** Grant management is the owner's (or the stdio operator's). Agents and MCP servers. */
 async function requireOwnedResource(ctx, db, type, id) {
-    // Only "agent" reaches here in Phase 1 (shareableType).
-    void type;
+    if (type === "mcp_server") {
+        const server = await db.mcpServer.findUnique({ where: { id } });
+        // Missing and someone else's look the same. The stdio operator owns everything.
+        if (!server || (!ctx.operator && server.ownerId !== ctx.principal.id)) {
+            throw new McpError(404, `MCP server "${id}" not found.`);
+        }
+        return server;
+    }
+    // Only "agent" and "mcp_server" reach here (shareableType).
     const row = await db.agent.findUnique({ where: { id } });
     return (await assertAgentAccess(ctx, row, id, "owner", db)).agent;
 }
@@ -65,17 +76,21 @@ async function requireOwnedResource(ctx, db, type, id) {
  * The ownership check and the write in one Serializable transaction (review
  * M3): a concurrent make_owner, which resets grants in its own transaction,
  * conflicts instead of letting the old owner's grant land on the new
- * owner's agent.
+ * owner's agent. A conflict is retried a bounded number of times
+ * (withSerializableRetry); the last one still reaches the caller as a 409.
  */
 function inSerializable(ctx, fn) {
-    return ctx.db.$transaction((tx) => fn(tx), { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });
+    return withSerializableRetry(() => ctx.db.$transaction(async (tx) => {
+        await preferIndexScans(tx);
+        return fn(tx);
+    }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable }));
 }
 function isAdmin(ctx) {
     return ctx.scopes.has("agents:admin") && permissionsOf(ctx.roles).has("agents:admin");
 }
 const TYPE_PROPERTIES = {
     // No enum: another type gets a clear "not shareable yet" from the handler.
-    resourceType: { type: "string", description: 'Only "agent" is shareable today.' },
+    resourceType: { type: "string", description: 'Agents and MCP servers are shareable: "agent" or "mcp_server".' },
     resourceId: { type: "string" },
 };
 const GRANTEE_PROPERTY = {
@@ -100,21 +115,22 @@ export function registerGrantTools(mcp) {
     mcp.registerTool({
         name: "grant_access",
         scope: "agents:write",
-        description: "Shares an agent you own with one principal or with everyone, at a level: " +
+        description: "Shares an agent or MCP server you own with one principal or with everyone, at a level: " +
             "read (see its config, never secret values or other owners' tool code); " +
             "execute (also trigger runs and see the runs they triggered); " +
             "write (also change its name, prompt, model, budget amount, max turns, effort, memory on/off and schedule, attach tools they can use and detach tools, and create webhooks). " +
             "Owner-only whatever the level: the coding profile (task, base ref, protected paths, task-override opt-in, image, packages, limits), kind, budget group, sub-agents, secret/datastore/repository bindings, tool capabilities, memory and datastore contents, grants, delete. " +
             "Consequences: execute lets them run your agent with your tools, secrets, datastores and repository, and every run shares the agent's memory; they supply no task text unless it's a coding agent with allowWebhookTaskOverride. " +
             "Write lets them rewrite what those runs do: the prompt can make a run use everything the agent can already reach (the capabilities you granted, its memory, its linked repositories), and on a coding agent the prompt is part of every coding task, so write directs work done with your GitHub access. " +
-            "Granting again replaces the level. Everyone may get write only on a native agent with no secrets, datastores, repositories, sub-agents or tool capabilities. The grantee must have signed in once.",
+            "MCP servers (resourceType mcp_server): read < use < write; use on an MCP server lets them attach it to their own agents; its tools then run with your server's credentials. Write adds nothing beyond use: only the owner updates, refreshes, deletes or re-grants a server. Lowering a grant to read (including everyone from use to read) detaches the server from every agent whose owner can no longer use it, and their runs' next call to it is refused. " +
+            "Granting again replaces the level. Everyone may get write only on a native agent with no secrets, datastores, repositories, sub-agents, MCP servers or tool capabilities. The grantee must have signed in once.",
         inputSchema: {
             type: "object",
             additionalProperties: false,
             properties: {
                 ...TYPE_PROPERTIES,
                 grantee: GRANTEE_PROPERTY,
-                level: { type: "string", description: "Agents: read < execute < write." },
+                level: { type: "string", description: "Agents: read < execute < write. MCP servers: read < use < write." },
             },
             required: ["resourceType", "resourceId", "grantee", "level"],
         },
@@ -124,7 +140,7 @@ export function registerGrantTools(mcp) {
             if (!isLevel(type, args.level)) {
                 throw new McpError(400, `Level "${args.level}" is not valid for ${type} (${LEVELS[type].join(" < ")}).`);
             }
-            const { resource, principal, grant } = await inSerializable(ctx, async (tx) => {
+            const { resource, principal, grant, attachmentsRemoved } = await inSerializable(ctx, async (tx) => {
                 const resource = await requireOwnedResource(ctx, tx, type, args.resourceId);
                 const principal = await resolveGrantee(tx, args.grantee);
                 if (principal && (principal.id === resource.ownerId || principal.id === ctx.principal.id)) {
@@ -154,7 +170,11 @@ export function registerGrantTools(mcp) {
                     },
                     update: { level: args.level, source: "owner", grantedById: ctx.principal.id },
                 });
-                return { resource, principal, grant };
+                // Below use, agents whose owner can no longer use the server lose it now (C1).
+                const attachmentsRemoved = type === "mcp_server" && !atLeast(type, args.level, "use")
+                    ? await pruneUnusableMcpAttachments(tx, resource.id)
+                    : 0;
+                return { resource, principal, grant, attachmentsRemoved };
             });
             return textResult({
                 granted: true,
@@ -167,13 +187,14 @@ export function registerGrantTools(mcp) {
                         ? { principalId: principal.id, subject: principal.subject }
                         : { principalId: principal.id },
                 level: grant.level,
+                ...(attachmentsRemoved > 0 ? { attachmentsRemoved } : {}),
             });
         },
     });
     mcp.registerTool({
         name: "revoke_access",
         scope: "agents:write",
-        description: "Removes a grant on an agent you own. Idempotent. Takes effect on the next check (trigger, delegation, webhook fire); runs already in flight keep going.",
+        description: "Removes a grant on an agent or MCP server you own. Idempotent. Takes effect on the next check (trigger, delegation, webhook fire); runs already in flight keep going. For an MCP server the check is every tool call: the server is detached from every agent whose owner can no longer use it (your own agents are untouched), and a run's next call to it is refused with mcp_tool_not_allowed.",
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -183,20 +204,25 @@ export function registerGrantTools(mcp) {
         handler: async (rawArgs, ctx) => {
             const args = parse(RevokeSchema, "revoke_access", rawArgs);
             const type = shareableType(args.resourceType);
-            const { count } = await inSerializable(ctx, async (tx) => {
+            const { count, attachmentsRemoved } = await inSerializable(ctx, async (tx) => {
                 const resource = await requireOwnedResource(ctx, tx, type, args.resourceId);
                 const granteeKey = args.grantee === "everyone"
                     ? EVERYONE_KEY
                     : principalGranteeKey((await resolveGrantee(tx, args.grantee)).id);
-                return tx.resourceGrant.deleteMany({ where: { resourceType: type, resourceId: resource.id, granteeKey } });
+                const { count } = await tx.resourceGrant.deleteMany({
+                    where: { resourceType: type, resourceId: resource.id, granteeKey },
+                });
+                // Agents whose owner can no longer use the server lose it now (C1).
+                const attachmentsRemoved = type === "mcp_server" ? await pruneUnusableMcpAttachments(tx, resource.id) : 0;
+                return { count, attachmentsRemoved };
             });
-            return textResult({ revoked: count > 0 });
+            return textResult({ revoked: count > 0, ...(attachmentsRemoved > 0 ? { attachmentsRemoved } : {}) });
         },
     });
     mcp.registerTool({
         name: "list_access",
         scope: "agents:read",
-        description: "Lists who an agent is shared with (grant metadata only). For its owner, the stdio operator, and admins (incident response).",
+        description: "Lists who an agent or MCP server is shared with (grant metadata only). For its owner, the stdio operator, and admins (incident response).",
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -206,16 +232,28 @@ export function registerGrantTools(mcp) {
         handler: async (rawArgs, ctx) => {
             const args = parse(ListSchema, "list_access", rawArgs);
             const type = shareableType(args.resourceType);
-            const resource = await ctx.db.agent.findUnique({ where: { id: args.resourceId } });
-            if (!resource)
-                throw agentNotFound(args.resourceId);
-            if (!isAdmin(ctx)) {
-                const access = await agentAccess(ctx, resource);
-                if (!atLeast("agent", access, "read"))
+            let resource;
+            if (type === "mcp_server") {
+                const server = await ctx.db.mcpServer.findUnique({ where: { id: args.resourceId } });
+                // Owner, stdio operator or admin; anyone else sees a missing server.
+                if (!server || (!ctx.operator && !isAdmin(ctx) && server.ownerId !== ctx.principal.id)) {
+                    throw new McpError(404, `MCP server "${args.resourceId}" not found.`);
+                }
+                resource = server;
+            }
+            else {
+                const agent = await ctx.db.agent.findUnique({ where: { id: args.resourceId } });
+                if (!agent)
                     throw agentNotFound(args.resourceId);
-                if (access !== "owner") {
-                    throw new McpError(403, `Agent "${resource.id}": only its owner (or an admin) can list who it is shared with.`);
+                if (!isAdmin(ctx)) {
+                    const access = await agentAccess(ctx, agent);
+                    if (!atLeast("agent", access, "read"))
+                        throw agentNotFound(args.resourceId);
+                    if (access !== "owner") {
+                        throw new McpError(403, `Agent "${agent.id}": only its owner (or an admin) can list who it is shared with.`);
+                    }
                 }
+                resource = agent;
             }
             const grants = await ctx.db.resourceGrant.findMany({
                 where: { resourceType: type, resourceId: resource.id },

package/dist/mcp/tools/host-providers.d.ts

@@ -0,0 +1,2 @@
+import type { WardbyMcpServer } from "../server.js";
+export declare function registerHostProviderTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/host-providers.js

@@ -0,0 +1,215 @@
+/**
+ * Host providers over MCP (docs/host-providers.md). Everything here needs hosts:admin, a
+ * privileged scope honoured only with a role granting it (host-manager or admin; the stdio
+ * operator holds both): bound tools decide who has permission and who wrote a comment, and
+ * they run in the push and pull request flow. Results carry secret names, never values.
+ */
+import { z } from "zod";
+import { codeProviderOf, normalizeHostedRepository } from "../../coding/code-host.js";
+import { logger } from "../../core/logger.js";
+import { approveHostProviderTools, deleteHostProvider, getHostProviderView, HostProviderError, registerHostProvider, RegisterHostProviderSchema, } from "../../providers/host-tools/registry.js";
+import { hostToolFetch, loadProviderForCalls, selfTestHostProvider } from "../../providers/host-tools/self-test.js";
+import { McpError } from "../errors.js";
+import { textResult } from "./text-result.js";
+const hostsLog = logger.child({ module: "mcp-host-providers" });
+function audit(ctx, action, provider, extra = {}) {
+    hostsLog.info({ event: `hosts.provider.${action}`, provider, by: ctx.principal.id, ...extra }, "host provider changed");
+}
+function parse(schema, label, value) {
+    const result = schema.safeParse(value);
+    if (result.success)
+        return result.data;
+    const details = result.error.issues.map((i) => `${i.path.join(".") || "input"}: ${i.message}`).join("; ");
+    throw new McpError(400, `Invalid ${label}: ${details}`);
+}
+async function mapped(work) {
+    try {
+        return await work();
+    }
+    catch (err) {
+        if (err instanceof HostProviderError) {
+            throw new McpError(err.code === "host_provider_not_found" ? 404 : 400, err.message);
+        }
+        throw err;
+    }
+}
+const ApproveSchema = z
+    .object({ provider: z.string().min(1).max(40), tools: z.array(z.string().min(1).max(100)).min(1) })
+    .strict();
+const GetSchema = z.object({ provider: z.string().min(1).max(40), includeCode: z.boolean().optional() }).strict();
+const TestSchema = z
+    .object({
+    provider: z.string().min(1).max(40),
+    repository: z.string().min(1).max(300),
+    pullRequest: z.number().int().positive().optional(),
+    headRef: z.string().min(1).max(255).optional(),
+    ref: z.string().min(1).max(255).optional(),
+    accountId: z
+        .string()
+        .regex(/^[A-Za-z0-9:{}_-]{1,128}$/)
+        .optional(),
+})
+    .strict();
+const DeleteSchema = z.object({ provider: z.string().min(1).max(40) }).strict();
+export function registerHostProviderTools(mcp) {
+    mcp.registerTool({
+        name: "register_host_provider",
+        scope: "hosts:admin",
+        description: "Host managers (hosts:admin): register a code host implemented by your custom tools, or replace one. Each tool's code and schema are copied, and only that copy ever runs: update_tool changes nothing until approve_host_provider_tools. Credentials must be your brokered secrets, allowed on every API host and gitHost. Without permissionCredential, trustedAccounts decides who may start runs. No restart is needed today, because agents can't use a provider yet; a new provider will need one once they can.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: [
+                "provider",
+                "gitHost",
+                "apiHosts",
+                "gitUsername",
+                "pullRequestUrlTemplate",
+                "repositoryApiPath",
+                "webhook",
+                "credentials",
+                "tools",
+            ],
+            properties: {
+                provider: { type: "string", description: "Prefix of its repository ids: <provider>:<workspace>/<repo>." },
+                gitHost: { type: "string" },
+                apiHosts: { type: "array", items: { type: "string" } },
+                gitUsername: { type: "string" },
+                pullRequestUrlTemplate: { type: "string", description: "https URL on gitHost with {repository} and {number}." },
+                repositoryApiPath: { type: "string", description: "API path of one repository, with {repository}." },
+                permissionApiPath: { type: "string", description: "Permission endpoint path, with {workspace} and {repo}." },
+                webhook: {
+                    type: "object",
+                    additionalProperties: false,
+                    required: ["header", "algorithm", "deliveryHeader", "eventHeader", "secret"],
+                    properties: {
+                        header: { type: "string" },
+                        algorithm: { type: "string", enum: ["sha256"] },
+                        deliveryHeader: { type: "string" },
+                        eventHeader: { type: "string" },
+                        secret: { type: "string", description: "Name of your secret; not attached to any agent." },
+                    },
+                },
+                credentials: {
+                    type: "array",
+                    items: {
+                        type: "object",
+                        additionalProperties: false,
+                        required: ["repositories", "secret"],
+                        properties: {
+                            repositories: { type: "string", description: '"workspace/repo" or "workspace/*".' },
+                            secret: { type: "string" },
+                        },
+                    },
+                },
+                permissionCredential: { type: "string" },
+                trustedAccounts: { type: "array", items: { type: "string" } },
+                tools: {
+                    type: "object",
+                    additionalProperties: { type: "string" },
+                    description: "Operation name to your tool's name.",
+                },
+            },
+        },
+        handler: async (rawArgs, ctx) => {
+            const input = parse(RegisterHostProviderSchema, "register_host_provider arguments", rawArgs);
+            const view = await mapped(() => registerHostProvider(ctx.db, ctx.providers.secrets, ctx.principal.id, input));
+            audit(ctx, "register", view.provider, { mode: view.mode, operations: view.operations.length });
+            return textResult({
+                ...view,
+                note: view.mode === "permission"
+                    ? "Permission mode: once agents can use this provider, the host will decide who has access, and a failed lookup will refuse."
+                    : "Allowlist mode: once agents can use this provider, only trustedAccounts will be able to start runs, at write level.",
+            });
+        },
+    });
+    mcp.registerTool({
+        name: "approve_host_provider_tools",
+        scope: "hosts:admin",
+        description: "Host managers (hosts:admin): copy the named operations' current tool code over their approved snapshots. Applies from the next call. Read the change first with get_host_provider and includeCode.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["provider", "tools"],
+            properties: {
+                provider: { type: "string" },
+                tools: { type: "array", items: { type: "string" }, description: "Operation names." },
+            },
+        },
+        handler: async (rawArgs, ctx) => {
+            const { provider, tools } = parse(ApproveSchema, "approve_host_provider_tools arguments", rawArgs);
+            const view = await mapped(() => approveHostProviderTools(ctx.db, ctx.principal.id, provider, tools));
+            audit(ctx, "approve", provider, { operations: tools });
+            return textResult(view);
+        },
+    });
+    mcp.registerTool({
+        name: "get_host_provider",
+        scope: "hosts:admin",
+        description: "Host managers (hosts:admin): a provider's config, active permission mode, secret names (never values), and which tools have unapproved changes. includeCode adds each approved snapshot's code and schema, and any newer code and schema, to review before approving.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["provider"],
+            properties: { provider: { type: "string" }, includeCode: { type: "boolean" } },
+        },
+        handler: async (rawArgs, ctx) => {
+            const { provider, includeCode } = parse(GetSchema, "get_host_provider arguments", rawArgs);
+            const view = await getHostProviderView(ctx.db, provider, { includeCode });
+            if (!view)
+                throw new McpError(404, `Host provider "${provider}" not found.`);
+            return textResult(view);
+        },
+    });
+    mcp.registerTool({
+        name: "delete_host_provider",
+        scope: "hosts:admin",
+        description: "Host managers (hosts:admin): remove a provider and its snapshots, freeing its secrets. Refused while an agent links to one of its repositories.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["provider"],
+            properties: { provider: { type: "string" } },
+        },
+        handler: async (rawArgs, ctx) => {
+            const { provider } = parse(DeleteSchema, "delete_host_provider arguments", rawArgs);
+            await mapped(() => deleteHostProvider(ctx.db, provider));
+            audit(ctx, "delete", provider);
+            return textResult({ deleted: provider });
+        },
+    });
+    mcp.registerTool({
+        name: "test_host_provider",
+        scope: "hosts:admin",
+        description: "Host managers (hosts:admin): run each approved read-only tool against one repository, with its real credential, and report pass, fail or skipped with a fixed code per operation. Changes nothing on the host: write operations are skipped, and a read-only tool can only send GET. Name a pullRequest, headRef, ref and accountId to reach the checks that need them. The report holds no response data, so it can be shared.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["provider", "repository"],
+            properties: {
+                provider: { type: "string" },
+                repository: { type: "string", description: "<provider>:<workspace>/<repo>" },
+                pullRequest: { type: "integer", minimum: 1 },
+                headRef: { type: "string", description: "A branch with an open pull request." },
+                ref: { type: "string", description: "A commit or branch. Defaults to the pull request's head." },
+                accountId: { type: "string", description: "A host account to look up, in permission mode." },
+            },
+        },
+        handler: async (rawArgs, ctx) => {
+            const { provider, ...input } = parse(TestSchema, "test_host_provider arguments", rawArgs);
+            const loaded = await loadProviderForCalls(ctx.db, provider);
+            if (!loaded)
+                throw new McpError(404, `Host provider "${provider}" not found.`);
+            try {
+                if (codeProviderOf(normalizeHostedRepository(input.repository)) !== provider)
+                    throw new Error("mismatch");
+            }
+            catch {
+                throw new McpError(400, `repository must be ${provider}:<workspace>/<repo>`);
+            }
+            const report = await selfTestHostProvider(loaded, ctx.providers.secrets, input, hostToolFetch());
+            audit(ctx, "test", provider, { repository: report.repository });
+            return textResult(report);
+        },
+    });
+}

package/dist/mcp/tools/mcp-servers.d.ts

@@ -0,0 +1,26 @@
+import { Prisma, type PrismaClient } from "#prisma";
+import { MCP_SERVERS_OFF_MESSAGE } from "../../config/mcp-servers.js";
+import type { WardbyMcpServer } from "../server.js";
+export { MCP_SERVERS_OFF_MESSAGE };
+/** get_agent's mcpServers field: each attachment with its exposed names and allowed tools gone from the snapshot. */
+export declare function agentMcpServerViews(db: Pick<PrismaClient, "agentMcpServer">, agentId: string): Promise<{
+    serverId: string;
+    serverName: string;
+    allowedTools: string[];
+    exposedNames: string[];
+    callTimeoutMs: number | null;
+    missingTools: string[];
+}[]>;
+/** The update_agent warning when an agent becomes Codex with attached tools the server doesn't mark read-only. */
+export declare function codexWriteToolsWarning(names: readonly string[]): string;
+/**
+ * The exposed names of an agent's attached, allowed tools that the saved tool list doesn't mark read-only:
+ * a Codex run never gets them (loadMcpToolPins with readOnlyOnly). Tools no longer listed are left out.
+ */
+export declare function codexUnavailableMcpTools(db: Pick<PrismaClient, "agentMcpServer">, agentId: string): Promise<string[]>;
+export declare function registerMcpServerTools(mcp: WardbyMcpServer): void;
+/**
+ * 409 naming the first exposed name that clashes with a built-in, an attached tool or another MCP attachment.
+ * Exported for tests: no valid server and tool name maps to a built-in repository tool name.
+ */
+export declare function assertNoClash(tx: Prisma.TransactionClient, agentId: string, serverId: string, exposed: string[]): Promise<void>;