@wardby/cli 0.7.0 → 0.8.0

package/dist/mcp/tools/runs.js

@@ -1,11 +1,18 @@
-import { requireAgentAccess } from "../auth/access.js";
+import { agentAccessResolver, readableAgentsWhere, requireAgentAccess } from "../auth/access.js";
+import { requireScope } from "../auth/resource-server.js";
+import { McpError } from "../errors.js";
+import { loadGraphRuns } from "../../viewer/graph.js";
+import { loadJiraConfig } from "../../config/providers.js";
 import { findReadableRun } from "./run-access.js";
-import { publicCodingRunResult, sanitizeDependencyCacheReport } from "../../coding/protocol.js";
+import { publicCodingRunResult, redactTokenShapedValues, sanitizeDependencyCacheReport, } from "../../coding/protocol.js";
 import { countPlanRefusals, summarizeRegistryFetches } from "../../coding/registry/report.js";
 import { summarizePackageAudit } from "../../coding/registry/audit-mode.js";
 import { storedServiceLabels } from "../../coding/services/catalog.js";
 import { textResult } from "./text-result.js";
 import { loadBudgetEvents } from "../../core/budget-events.js";
+import { loadAgentSecretValues, maskNamedSecrets } from "../../core/secret-guard.js";
+import { logger } from "../../core/logger.js";
+const runsLog = logger.child({ module: "mcp-runs" });
 /**
  * Run visibility (resource-sharing grants spec §3.5, A6): a run's output is
  * the triggerer's and the agent owner's, never every reader's. The owner
@@ -17,45 +24,191 @@ function withOperatorMode(run) {
     const mode = run.nativeExecutionMode;
     return { ...run, nativeExecutionMode: mode == null ? null : mode === "sandbox" ? "sandbox" : "control-plane" };
 }
+/**
+ * A coding run's request as its readers may see it. It can be text a caller or an issue wrote, so
+ * the agent's secret values and token-shaped values are masked here on every read. A secret that
+ * can't be read means the text can't be checked, so it is withheld; the log carries the error name only.
+ */
+async function requestForReader(ctx, run, request) {
+    try {
+        const named = await loadAgentSecretValues(ctx.db, ctx.providers.secrets, run.agentId);
+        return { request: redactTokenShapedValues(maskNamedSecrets(request, named)) };
+    }
+    catch (err) {
+        runsLog.warn({ runId: run.id, errorName: err instanceof Error ? err.name : typeof err }, "could not read the agent's secrets to check a run's request; withholding it");
+        return { requestUnavailable: true };
+    }
+}
+/** The issue-tracker sites issue links are built from (the admin viewer's own source); none when unset or invalid. */
+function issueSites() {
+    try {
+        const jira = loadJiraConfig();
+        return jira ? { jira: jira.siteUrl } : {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * What started each run and what it produced, in the admin viewer API's shapes (docs/viewer-api.md):
+ * `triggerInfo` (the pull request, issue, schedule or lead behind it), `outcomes` (pull requests opened,
+ * comments, checks) and `serviceReadiness` (each coding-run service's state). Only ids and links:
+ * repositories, numbers, issue keys, URLs, states and times, never free text. A service's failure
+ * `reason` is left out, since it can quote what the service printed.
+ */
+async function runGraphFields(ctx, runIds) {
+    const graph = await loadGraphRuns(ctx.db, runIds, issueSites());
+    return new Map(graph.map((run) => [
+        run.id,
+        {
+            triggerInfo: run.trigger,
+            outcomes: run.outcomes,
+            serviceReadiness: run.services.map(({ name, state, attempts, readyAt, failedAt }) => ({
+                name,
+                state,
+                attempts,
+                readyAt,
+                failedAt,
+            })),
+        },
+    ]));
+}
+/** Statuses `active: true` keeps, and that `since` always keeps. */
+const ACTIVE_STATUSES = ["pending", "running"];
+/** Rows returned without an agentId: a default and a cap, since it spans every agent the caller can see. */
+const ACROSS_AGENTS_DEFAULT_LIMIT = 50;
+const ACROSS_AGENTS_MAX_LIMIT = 200;
+/** The `active` and `since` filters, as clauses to AND onto the visibility rule. */
+function runFilters(args) {
+    const filters = [];
+    if (args.active === true)
+        filters.push({ status: { in: ACTIVE_STATUSES } });
+    if (args.since !== undefined) {
+        const since = new Date(args.since);
+        if (Number.isNaN(since.getTime()))
+            throw new McpError(400, "since must be an ISO date or time");
+        filters.push({
+            OR: [{ startedAt: { gte: since } }, { finishedAt: { gte: since } }, { status: { in: ACTIVE_STATUSES } }],
+        });
+    }
+    return filters;
+}
+/**
+ * Runs across every agent the caller can read, under the same rule as one agent's listing: all runs of
+ * agents they own, only the runs they triggered on the rest. With `all` (admin:view, checked by the
+ * caller), every run in the deployment, as the admin viewer shows. Rows name their agent and leave
+ * out finalText, which can be long and is one get_run away.
+ */
+async function listRunsAcrossAgents(ctx, filters, opts) {
+    const [where, accessOf] = await Promise.all([
+        opts.all ? Promise.resolve({}) : readableAgentsWhere(ctx),
+        agentAccessResolver(ctx),
+    ]);
+    const agents = await ctx.db.agent.findMany({
+        where,
+        select: { id: true, ownerId: true, name: true, budgetUsd: true },
+    });
+    const owned = agents.filter((agent) => opts.all || accessOf(agent) === "owner").map((agent) => agent.id);
+    const others = agents.filter((agent) => !opts.all && accessOf(agent) !== "owner").map((agent) => agent.id);
+    const byId = new Map(agents.map((agent) => [agent.id, agent]));
+    // A limit that isn't a finite number falls back to the default rather than reaching the query as NaN.
+    const requested = Number.isFinite(opts.limit) ? Math.floor(opts.limit) : ACROSS_AGENTS_DEFAULT_LIMIT;
+    const take = Math.min(Math.max(1, requested), ACROSS_AGENTS_MAX_LIMIT);
+    const status = opts.status;
+    const runs = await ctx.db.run.findMany({
+        where: {
+            OR: [{ agentId: { in: owned } }, { agentId: { in: others }, triggeredById: ctx.principal.id }],
+            ...(status ? { status: status } : {}),
+            ...(filters.length > 0 ? { AND: filters } : {}),
+        },
+        omit: { finalText: true, pricingSnapshot: true },
+        take,
+        orderBy: { startedAt: "desc" },
+    });
+    const graph = await runGraphFields(ctx, runs.map((run) => run.id));
+    return runs.map((run) => {
+        const agent = byId.get(run.agentId);
+        return {
+            ...run,
+            agentName: agent?.name ?? null,
+            agentBudgetUsd: agent ? Number(agent.budgetUsd) : null,
+            ...(graph.get(run.id) ?? { triggerInfo: null, outcomes: [], serviceReadiness: [] }),
+        };
+    });
+}
+/** Same rule as get_run: a pending coding run with queuedAt is waiting for a concurrency slot (CODING_MAX_CONCURRENT), not stuck. */
+async function withQueuedAt(ctx, runs) {
+    const pendingIds = runs.filter((run) => run.status === "pending").map((run) => run.id);
+    const queued = pendingIds.length > 0
+        ? await ctx.db.codingRun.findMany({
+            where: { runId: { in: pendingIds }, queuedAt: { not: null } },
+            select: { runId: true, queuedAt: true },
+        })
+        : [];
+    const queuedAtByRun = new Map(queued.map((row) => [row.runId, row.queuedAt?.toISOString()]));
+    return runs.map((run) => {
+        const codingQueuedAt = queuedAtByRun.get(run.id);
+        return codingQueuedAt ? { ...withOperatorMode(run), codingQueuedAt } : withOperatorMode(run);
+    });
+}
 export function registerRunTools(mcp) {
     mcp.registerTool({
         name: "list_runs",
         scope: "agents:read",
+        description: "Lists runs, newest first. With agentId, that agent's runs; without it, runs across every agent you can see " +
+            "(each row adds agentName, agentBudgetUsd, triggerInfo, outcomes and serviceReadiness, and leaves out finalText " +
+            `and pricingSnapshot; default limit ${ACROSS_AGENTS_DEFAULT_LIMIT}, ` +
+            `at most ${ACROSS_AGENTS_MAX_LIMIT}). You see all runs of agents you own and only the runs you triggered on others. ` +
+            "active: true keeps pending and running runs; since (ISO time) keeps runs that started or finished then or later, " +
+            "plus any still pending or running. all: true (no agentId) lists every run in the deployment (admins only, admin:view). " +
+            "Use get_run for one run's detail.",
         inputSchema: {
             type: "object",
-            properties: { agentId: { type: "string" }, status: { type: "string" }, limit: { type: "number" } },
-            required: ["agentId"],
+            properties: {
+                agentId: { type: "string" },
+                status: { type: "string" },
+                active: { type: "boolean" },
+                since: { type: "string", description: "ISO date or time" },
+                all: { type: "boolean" },
+                limit: { type: "number" },
+            },
         },
         handler: async (args, ctx) => {
+            const filters = runFilters(args);
+            if (args.all === true) {
+                if (args.agentId !== undefined)
+                    throw new McpError(400, "all lists every agent's runs; leave out agentId");
+                if (!ctx.operator)
+                    requireScope(ctx, ctx.canonicalUri, "admin:view");
+            }
+            if (args.agentId === undefined) {
+                const runs = await listRunsAcrossAgents(ctx, filters, {
+                    status: args.status,
+                    limit: args.limit,
+                    all: args.all === true,
+                });
+                return textResult(await withQueuedAt(ctx, runs));
+            }
             const { access } = await requireAgentAccess(ctx, args.agentId, "read");
             const runs = await ctx.db.run.findMany({
                 where: {
                     agentId: args.agentId,
                     ...(args.status ? { status: args.status } : {}),
                     ...(access === "owner" ? {} : { triggeredById: ctx.principal.id }),
+                    ...(filters.length > 0 ? { AND: filters } : {}),
                 },
                 take: args.limit,
                 orderBy: { startedAt: "desc" },
             });
-            // Same rule as get_run: a pending coding run with queuedAt is waiting
-            // for a concurrency slot (CODING_MAX_CONCURRENT), not stuck.
-            const pendingIds = runs.filter((run) => run.status === "pending").map((run) => run.id);
-            const queued = pendingIds.length > 0
-                ? await ctx.db.codingRun.findMany({
-                    where: { runId: { in: pendingIds }, queuedAt: { not: null } },
-                    select: { runId: true, queuedAt: true },
-                })
-                : [];
-            const queuedAtByRun = new Map(queued.map((row) => [row.runId, row.queuedAt?.toISOString()]));
-            return textResult(runs.map((run) => {
-                const codingQueuedAt = queuedAtByRun.get(run.id);
-                return codingQueuedAt ? { ...withOperatorMode(run), codingQueuedAt } : withOperatorMode(run);
-            }));
+            return textResult(await withQueuedAt(ctx, runs));
         },
     });
     mcp.registerTool({
         name: "get_run",
         scope: "agents:read",
+        description: "One run in full: status, cost, request, result, errors and budget events, plus triggerInfo (what started it: " +
+            "a pull request review or mention, an issue, a schedule or a lead run), outcomes (pull requests opened, comments, " +
+            "checks) and serviceReadiness. A run's pull-request outcome matching another run's triggerInfo links the two.",
         inputSchema: { type: "object", properties: { runId: { type: "string" } }, required: ["runId"] },
         handler: async (args, ctx) => {
             // Its triggerer keeps seeing it even after losing access to the agent;
@@ -65,6 +218,7 @@ export function registerRunTools(mcp) {
                 where: { runId: run.id },
                 select: {
                     result: true,
+                    request: true,
                     queuedAt: true,
                     failureCategory: true,
                     diagnosticId: true,
@@ -123,8 +277,14 @@ export function registerRunTools(mcp) {
                 : undefined;
             // Well-formed refusals only, with group, lead and agent budget filled as the run error's are.
             const budgetEvents = await loadBudgetEvents(ctx.db, run.id);
+            // What started the run and what it produced, as the admin viewer shows them.
+            const graph = (await runGraphFields(ctx, [run.id])).get(run.id);
+            // What the run was asked to do: the trigger's or lead's task, without the agent's standing instructions.
+            const request = codingRun?.request ? await requestForReader(ctx, run, codingRun.request) : {};
             return textResult({
                 ...withOperatorMode(run),
+                ...request,
+                ...(graph ?? {}),
                 ...(budgetEvents.length > 0 ? { budgetEvents } : {}),
                 ...(codingRun?.budgetReservedUsd != null ? { budgetReservedUsd: Number(codingRun.budgetReservedUsd) } : {}),
                 ...(codingRun?.budgetBaseUsd != null ? { budgetBaseUsd: Number(codingRun.budgetBaseUsd) } : {}),

package/dist/mcp/tools/secret-elicitation.d.ts

@@ -38,6 +38,8 @@ export interface SecretElicitationPayload {
      * removal is refused if the secret's config has changed since (or the link has none).
      */
     brokerHash?: string;
+    /** The caller passed the hosts:admin check when the link was minted. */
+    hostManager?: boolean;
 }
 export type SecretElicitationOutcome = {
     ok: true;

package/dist/mcp/tools/secret-elicitation.js

@@ -1,4 +1,4 @@
-import { createSecret, listSecrets, setSecretBroker } from "../../core/secrets.js";
+import { createSecret, hostProvidersUsingSecret, listSecrets, setSecretBroker, } from "../../core/secrets.js";
 import { parseSecretBrokerConfig, SECRET_BROKER_CHANGED, } from "../../core/secret-broker-config.js";
 /**
  * A link only does what it was minted for: a create link can't confirm an
@@ -19,6 +19,18 @@ function kindOf(outcome) {
     return outcome.kind ?? "create";
 }
 const ELICITATION_TTL_MS = 600_000;
+const HOST_PROVIDER_LINK_STALE = "host_provider_secret_link_stale: a host provider now uses this secret; request a new link with hosts:admin";
+/**
+ * A link minted before the secret joined a host provider carries no hosts:admin check.
+ * Refused without recording an outcome, so a fresh link from a host manager still works.
+ */
+async function isStaleForHostProvider(db, payload) {
+    if (payload.hostManager)
+        return false;
+    const { ownerId, secretName: name } = payload;
+    const secret = await db.secret.findUnique({ where: { ownerId_name: { ownerId, name } }, select: { id: true } });
+    return secret !== null && (await hostProvidersUsingSecret(db, secret.id)).providers.length > 0;
+}
 /** Sweeps every expired entry, not just the one being looked up, so a set-and-never-polled-again entry doesn't linger forever. */
 async function pruneExpired(db, now) {
     await db.secretElicitationOutcome.deleteMany({ where: { expiresAt: { lte: now } } });
@@ -58,6 +70,9 @@ export async function fulfillSecretElicitation(payload, value, cipher, db, broke
     });
     if (existing && kindOf(existing.outcome) === "create")
         return existing.outcome;
+    if (await isStaleForHostProvider(db, payload)) {
+        return { ok: false, kind: "create", error: HOST_PROVIDER_LINK_STALE };
+    }
     let outcome;
     try {
         const secret = await createSecret(secretName, value, ownerId, cipher, db, {
@@ -89,7 +104,12 @@ export async function fulfillSecretElicitation(payload, value, cipher, db, broke
     await recordOutcome(db, ownerId, secretName, outcome, now);
     return outcome;
 }
-const CORRECTABLE_ERRORS = ["secret_broker_value_invalid", "secret_broker_config_invalid", "bridge_input_limit"];
+const CORRECTABLE_ERRORS = [
+    "secret_broker_value_invalid",
+    "secret_broker_config_invalid",
+    "bridge_input_limit",
+    "host_provider_webhook_secret_short",
+];
 function isCorrectableInput(message) {
     return CORRECTABLE_ERRORS.some((code) => message.startsWith(code));
 }
@@ -115,6 +135,9 @@ export async function fulfillUnbrokerElicitation(payload, cipher, db) {
     });
     if (existing && kindOf(existing.outcome) === "unbroker")
         return existing.outcome;
+    if (await isStaleForHostProvider(db, payload)) {
+        return { ok: false, kind: "unbroker", error: HOST_PROVIDER_LINK_STALE };
+    }
     let outcome;
     try {
         await setSecretBroker(db, cipher, {

package/dist/mcp/tools/secrets.js

@@ -4,10 +4,12 @@
  * value/ciphertext at the source); this file adds ownership on top.
  */
 import { inputRequired, inputResponse } from "@modelcontextprotocol/server";
-import { createSecret, listSecrets, attachSecret, detachSecret, deleteSecret, setSecretBroker, } from "../../core/secrets.js";
+import { createSecret, listSecrets, attachSecret, detachSecret, deleteSecret, hostProvidersUsingSecret, setSecretBroker, WEBHOOK_SECRET_ATTACHED, } from "../../core/secrets.js";
+import { mcpServersUsingSecret } from "../../core/mcp-servers.js";
 import { brokerConfigHash, parseSecretBrokerConfig } from "../../core/secret-broker-config.js";
 import { McpError } from "../errors.js";
 import { requireOwnedSecret } from "../auth/ownership.js";
+import { requireScope } from "../auth/resource-server.js";
 import { requireAgentAccess, requireBindable, requireBindingOwner } from "../auth/access.js";
 import { clearUnbrokerOutcome, getSecretElicitationOutcome, } from "./secret-elicitation.js";
 import { allowedSecretNames, brokerCompatibilityWarnings } from "./secret-broker-compat.js";
@@ -27,7 +29,9 @@ function mapSecretError(err) {
     const message = err instanceof Error ? err.message : String(err);
     if (message.startsWith("secret_not_found"))
         throw new McpError(404, message);
-    if (message.startsWith("secret_broker_config_invalid") || message.startsWith("secret_broker_value_invalid")) {
+    if (message.startsWith("secret_broker_config_invalid") ||
+        message.startsWith("secret_broker_value_invalid") ||
+        message.startsWith("host_provider_webhook_secret_short")) {
         throw new McpError(400, message);
     }
     throw err;
@@ -70,11 +74,26 @@ async function findOwnSecret(ctx, name) {
         throw new McpError(404, `secret_not_found: no secret named "${name}"`);
     return secret;
 }
+/**
+ * A host provider's secret needs hosts:admin as well as secrets:write: replacing a credential
+ * or its broker config changes what the provider does. True when the caller passed that check,
+ * and its links say so; checked before any link is minted, and again when one is submitted.
+ */
+async function requireHostsAdminIfProviderSecret(ctx, name) {
+    const secret = await ctx.db.secret.findUnique({
+        where: { ownerId_name: { ownerId: ctx.principal.id, name } },
+        select: { id: true },
+    });
+    if (!secret || (await hostProvidersUsingSecret(ctx.db, secret.id)).providers.length === 0)
+        return false;
+    requireScope(ctx, ctx.canonicalUri, "hosts:admin");
+    return true;
+}
 export function registerSecretsTools(mcp, opts) {
     mcp.registerTool({
         name: "create_secret",
         scope: "secrets:write",
-        description: 'Creates a secret. Omit "value" to enter it securely via a one-time browser link instead of passing it as a plaintext argument. Pass "broker" ({ hosts, pathPrefixes?, placement }) to make it brokered: tools can then only send it to those hosts with fetch(url, { secrets: [name] }) and can never read it. See the help article "brokered-secrets".',
+        description: 'Creates a secret. Omit "value" to enter it securely via a one-time browser link instead of passing it as a plaintext argument. Pass "broker" ({ hosts, pathPrefixes?, placement }) to make it brokered: tools can then only send it to those hosts with fetch(url, { secrets: [name] }) and can never read it. A secret a host provider uses also needs hosts:admin. See the help article "brokered-secrets".',
         inputSchema: {
             type: "object",
             properties: {
@@ -85,6 +104,7 @@ export function registerSecretsTools(mcp, opts) {
             required: ["name"],
         },
         handler: async (args, ctx) => {
+            const hostManager = await requireHostsAdminIfProviderSecret(ctx, args.name);
             const broker = args.broker === undefined ? undefined : parseBrokerArg(args.broker);
             if (args.value !== undefined) {
                 let secret;
@@ -131,6 +151,7 @@ export function registerSecretsTools(mcp, opts) {
                 secretName: args.name,
                 kind: "create",
                 ...(broker ? { broker } : {}),
+                ...(hostManager ? { hostManager } : {}),
             };
             const token = await mcp.mintRequestState(payload);
             const url = await opts.buildElicitationUrl(token);
@@ -157,7 +178,7 @@ export function registerSecretsTools(mcp, opts) {
     mcp.registerTool({
         name: "set_secret_broker",
         scope: "secrets:write",
-        description: 'Sets or changes a secret\'s broker config ({ hosts, pathPrefixes?, placement }), so tools can only send it to those hosts with fetch(url, { secrets: [name] }) and never read it. broker: null removes brokering, which must be confirmed by a person in the browser link this returns. Every change is audited. See the help article "brokered-secrets".',
+        description: 'Sets or changes a secret\'s broker config ({ hosts, pathPrefixes?, placement }), so tools can only send it to those hosts with fetch(url, { secrets: [name] }) and never read it. broker: null removes brokering, which must be confirmed by a person in the browser link this returns. Every change is audited. A secret a host provider uses also needs hosts:admin. See the help article "brokered-secrets".',
         inputSchema: {
             type: "object",
             properties: {
@@ -171,6 +192,7 @@ export function registerSecretsTools(mcp, opts) {
         },
         handler: async (args, ctx) => {
             const ownerId = ctx.principal.id;
+            const hostManager = await requireHostsAdminIfProviderSecret(ctx, args.name);
             if (args.broker !== null) {
                 const broker = parseBrokerArg(args.broker);
                 await findOwnSecret(ctx, args.name);
@@ -222,6 +244,7 @@ export function registerSecretsTools(mcp, opts) {
                 secretName: args.name,
                 kind: "unbroker",
                 brokerHash: brokerConfigHash(parseSecretBrokerConfig(secret.broker)),
+                ...(hostManager ? { hostManager } : {}),
             };
             const token = await mcp.mintRequestState(payload);
             const url = await opts.buildElicitationUrl(token);
@@ -276,6 +299,8 @@ export function registerSecretsTools(mcp, opts) {
                 await attachSecret(args.agentId, args.name, ownerId, ctx.db, args.alias ?? args.name);
             }
             catch (err) {
+                if (err instanceof Error && err.message === WEBHOOK_SECRET_ATTACHED)
+                    throw new McpError(409, err.message);
                 throw new McpError(404, err instanceof Error ? err.message : String(err));
             }
             return textResult({ attached: true });
@@ -306,6 +331,15 @@ export function registerSecretsTools(mcp, opts) {
         inputSchema: { type: "object", properties: { id: { type: "string" } }, required: ["id"] },
         handler: async (args, ctx) => {
             await requireOwnedSecret(ctx.db, args.id, ctx.principal.id);
+            const { providers } = await hostProvidersUsingSecret(ctx.db, args.id);
+            if (providers.length > 0) {
+                throw new McpError(409, `This secret is used by host provider ${providers.map((p) => `"${p}"`).join(", ")}; re-register it or delete_host_provider first.`);
+            }
+            const secret = await ctx.db.secret.findUnique({ where: { id: args.id }, select: { name: true } });
+            const servers = secret ? await mcpServersUsingSecret(ctx.db, ctx.principal.id, secret.name) : [];
+            if (servers.length > 0) {
+                throw new McpError(409, `Secret "${secret.name}" is used by MCP server(s) ${servers.join(", ")}; update or delete them first.`);
+            }
             await deleteSecret(args.id, ctx.db);
             return textResult({ deleted: args.id });
         },

package/dist/mcp/tools/tools.d.ts

@@ -21,6 +21,7 @@ export declare function projectTool(tool: Tool, principalId: string): {
     name: string;
     updatedAt: Date;
     code: string;
+    timeoutMs: number | null;
     createdAt: Date;
     id: string;
     ownerId: string | null;
@@ -28,16 +29,17 @@ export declare function projectTool(tool: Tool, principalId: string): {
     jsonSchema: import("@prisma/client/runtime/client").JsonValue;
     paramsZod: string;
 } | {
+    public: boolean;
     id: string;
     name: string;
     description: string;
-    public: boolean;
-    ownerIsCaller?: undefined;
+    timeoutMs: number | null;
 } | {
+    public: boolean;
+    ownerIsCaller: boolean;
     id: string;
     name: string;
     description: string;
-    public: boolean;
-    ownerIsCaller: boolean;
+    timeoutMs: number | null;
 };
 export declare function registerToolAuthoringTools(mcp: WardbyMcpServer): void;

package/dist/mcp/tools/tools.js

@@ -13,9 +13,11 @@ import { Prisma } from "#prisma";
 import { deriveJsonSchema, validateParams } from "../../sandbox/zod-params.js";
 import { cachedZod4Compatibility, toolSubject, withZod3ToolWarnings, zod3SampleArgsWarning, zod3ToolWarnings, zod3WindowWarning, } from "../../core/zod3-window.js";
 import { runInSandbox } from "../../sandbox/run-in-sandbox.js";
+import { effectiveToolTimeoutMs, toolTimeoutProblem } from "../../sandbox/tool-timeout.js";
+import { loadToolMaxTimeoutMs } from "../../config/tool-timeout.js";
 import { ToolCapabilitiesPatchSchema } from "../../sandbox/tool-capabilities.js";
 import { buildSharedDatastoreAccessor } from "../../core/datastores.js";
-import { findSameNamedAttachedTool, reservedToolNameReason } from "../../core/tool-names.js";
+import { findSameNamedAttachedTool, findSameNamedMcpTool, reservedToolNameReason, sameNamedMcpToolMessage, } from "../../core/tool-names.js";
 import { ToolAttachedError, deleteToolGuarded, hasToolChanges, prepareToolUpdate, updateToolGuarded, } from "../../core/tool-admin.js";
 import { McpError } from "../errors.js";
 import { requireOwnedTool, requireStrictlyOwnedTool, assertStrictlyOwnedTool, visibleToPrincipal, canRead, } from "../auth/ownership.js";
@@ -46,9 +48,16 @@ async function describeAgents(agents, ctx) {
 export function projectTool(tool, principalId) {
     if (tool.ownerId !== null && tool.ownerId === principalId)
         return tool;
-    return tool.ownerId === null
-        ? { id: tool.id, name: tool.name, description: tool.description, public: true }
-        : { id: tool.id, name: tool.name, description: tool.description, public: false, ownerIsCaller: false };
+    // timeoutMs is not code: anyone who sees the tool sees how long its calls may take.
+    const shown = { id: tool.id, name: tool.name, description: tool.description, timeoutMs: tool.timeoutMs };
+    return tool.ownerId === null ? { ...shown, public: true } : { ...shown, public: false, ownerIsCaller: false };
+}
+const TIMEOUT_MS_DESCRIPTION = "The tool's time limit per call, in milliseconds (at least 1000). Omitted: the default of 10000. Capped by the server's WARDBY_TOOL_MAX_TIMEOUT_MS (default 300000); a larger value is refused. Each fetch times out just before it, and sleep() is capped at it.";
+/** Refuses (400) a timeoutMs this server can't store, naming its ceiling. */
+function assertToolTimeout(timeoutMs) {
+    const problem = toolTimeoutProblem(timeoutMs, loadToolMaxTimeoutMs());
+    if (problem)
+        throw new McpError(400, problem);
 }
 /**
  * Non-blocking: which of the secrets just granted to this attachment are
@@ -83,11 +92,14 @@ export function registerToolAuthoringTools(mcp) {
                 description: { type: "string" },
                 paramsZod: { type: "string" },
                 code: { type: "string" },
+                timeoutMs: { type: "integer", description: TIMEOUT_MS_DESCRIPTION },
             },
             required: ["name", "description", "paramsZod", "code"],
         },
         handler: async (args, ctx) => {
             assertToolNameAllowed(args.name);
+            if (args.timeoutMs !== undefined)
+                assertToolTimeout(args.timeoutMs);
             const schemaResult = await deriveJsonSchema(args.paramsZod);
             if (!schemaResult.ok) {
                 return textResult({ ok: false, errorKind: schemaResult.errorKind, errorMessage: schemaResult.errorMessage });
@@ -101,6 +113,7 @@ export function registerToolAuthoringTools(mcp) {
                         code: args.code,
                         jsonSchema: schemaResult.value,
                         ownerId: ctx.principal.id,
+                        ...(args.timeoutMs !== undefined ? { timeoutMs: args.timeoutMs } : {}),
                     },
                 });
                 const warnings = await zod3ToolWarnings(toolSubject(tool.name), args.paramsZod);
@@ -117,7 +130,7 @@ export function registerToolAuthoringTools(mcp) {
     mcp.registerTool({
         name: "update_tool",
         scope: "tools:write",
-        description: "Replaces a tool's description, paramsZod and/or code in place (its name can't change: agents' prompts call it by name). Owner-only: public tools can't be changed over MCP. Refused while the tool is attached to any agent you don't own, including owner-less ones and agents shared with you, since the change would reach another owner's agent; detach it there first or create a new tool. Runs already started keep the version they loaded for their whole lifetime; the next run picks up the new one.",
+        description: "Replaces a tool's description, paramsZod, code and/or timeoutMs (null: back to the default limit) in place (its name can't change: agents' prompts call it by name). Owner-only: public tools can't be changed over MCP. Refused while the tool is attached to any agent you don't own, including owner-less ones and agents shared with you, since the change would reach another owner's agent; detach it there first or create a new tool. Runs already started keep the version they loaded for their whole lifetime; the next run picks up the new one.",
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -126,14 +139,25 @@ export function registerToolAuthoringTools(mcp) {
                 description: { type: "string" },
                 paramsZod: { type: "string" },
                 code: { type: "string" },
+                timeoutMs: {
+                    type: ["integer", "null"],
+                    description: `${TIMEOUT_MS_DESCRIPTION} Pass null to go back to the default.`,
+                },
             },
             required: ["toolId"],
         },
         handler: async (args, ctx) => {
-            const changes = { description: args.description, paramsZod: args.paramsZod, code: args.code };
+            const changes = {
+                description: args.description,
+                paramsZod: args.paramsZod,
+                code: args.code,
+                timeoutMs: args.timeoutMs,
+            };
             if (!hasToolChanges(changes)) {
-                throw new McpError(400, "update_tool needs at least one of description, paramsZod or code.");
+                throw new McpError(400, "update_tool needs at least one of description, paramsZod, code or timeoutMs.");
             }
+            if (args.timeoutMs !== undefined && args.timeoutMs !== null)
+                assertToolTimeout(args.timeoutMs);
             // Checked once up front so a non-owner never gets as far as a sandbox
             // compile, and again (with the attachments) inside the transaction.
             await requireStrictlyOwnedTool(ctx.db, args.toolId, ctx.principal.id);
@@ -196,7 +220,7 @@ export function registerToolAuthoringTools(mcp) {
     mcp.registerTool({
         name: "dry_run_tool",
         scope: "tools:write",
-        description: "Test-runs tool code against sample args without persisting it. Fetch is denied by default, same as a freshly attached tool — pass allowedHosts to test code that calls fetch(). For this release a paramsZod is still compiled with Zod 3; a `warnings` list in the result means the next release, which compiles it with Zod 4 only, will reject it or treat the sample args differently.",
+        description: "Test-runs tool code against sample args without persisting it, with the same time limit a run would give it (timeoutMs, as on create_tool). Fetch is denied by default, same as a freshly attached tool — pass allowedHosts to test code that calls fetch(). For this release a paramsZod is still compiled with Zod 3; a `warnings` list in the result means the next release, which compiles it with Zod 4 only, will reject it or treat the sample args differently.",
         inputSchema: {
             type: "object",
             properties: {
@@ -204,10 +228,13 @@ export function registerToolAuthoringTools(mcp) {
                 code: { type: "string" },
                 sampleArgs: { type: "object" },
                 allowedHosts: { type: "array", items: { type: "string" } },
+                timeoutMs: { type: "integer", description: TIMEOUT_MS_DESCRIPTION },
             },
             required: ["paramsZod", "code", "sampleArgs"],
         },
         handler: async (args, ctx) => {
+            if (args.timeoutMs !== undefined)
+                assertToolTimeout(args.timeoutMs);
             const hosts = ToolCapabilitiesPatchSchema.pick({ allowedHosts: true }).safeParse({
                 allowedHosts: args.allowedHosts,
             });
@@ -254,6 +281,7 @@ export function registerToolAuthoringTools(mcp) {
                 sharedDatastore: buildSharedDatastoreAccessor(ctx.principal.id, ctx.providers.datastore, ctx.db),
                 toolName: "dry_run_tool",
                 allowedFetchHosts: hosts.data.allowedHosts ?? [],
+                timeoutMs: effectiveToolTimeoutMs(args.timeoutMs, loadToolMaxTimeoutMs()),
             });
             return textResult({ jsonSchema, result: sandboxResult, ...warnings });
         },
@@ -334,6 +362,10 @@ export function registerToolAuthoringTools(mcp) {
                         : " (a tool owned by another principal)";
                     throw new McpError(409, `Agent "${args.agentId}" already has a different tool named "${tool.name}" attached${which}; detach it first.`);
                 }
+                // Nor a name one of the agent's MCP servers already gives the model.
+                const mcpClash = await findSameNamedMcpTool(tx, args.agentId, tool.name);
+                if (mcpClash)
+                    throw new McpError(409, sameNamedMcpToolMessage(args.agentId, tool.name, mcpClash.serverName));
                 // Re-granting an attachment this owner never vouched for: what is
                 // not restated is reset, never silently adopted.
                 const keepUnstated = existing?.capabilitiesGrantedById === agent.ownerId;