@wardby/cli 0.7.0 → 0.9.0

package/dist/import/create.js

@@ -3,6 +3,8 @@
  * attachments, secrets, datastores, webhooks, budget groups) to the database
  * from a validated bundle + reconciliation.
  */
+import { toolTimeoutProblem } from "../sandbox/tool-timeout.js";
+import { loadToolMaxTimeoutMs } from "../config/tool-timeout.js";
 import { Prisma } from "#prisma";
 import { scheduleStartFields } from "../core/schedule-start.js";
 import { createSecret, attachSecret } from "../core/secrets.js";
@@ -12,7 +14,7 @@ import { SecretCheckUnavailableError, SecretInValueError, createDbSecretWriteGua
 import { createWebhook } from "../core/webhooks.js";
 import { deriveJsonSchema } from "../sandbox/zod-params.js";
 import { toolSubject, zod3ToolWarnings } from "../core/zod3-window.js";
-import { findSameNamedAttachedTool, reservedToolNameReason } from "../core/tool-names.js";
+import { findSameNamedAttachedTool, findSameNamedMcpTool, reservedToolNameReason } from "../core/tool-names.js";
 import { ToolCapabilitiesPatchSchema, FETCH_WILDCARD } from "../sandbox/tool-capabilities.js";
 import { PostgresDatastore } from "../providers/datastore/postgres.js";
 import { decryptTransferEnvelope } from "../providers/secrets/transfer-envelope.js";
@@ -70,6 +72,13 @@ export async function createFromBundle(bundle, recon, opts) {
             warnings.push(`tool ${t.name}: failed to derive JSON schema, skipping`);
             continue;
         }
+        const timeoutProblem = t.timeoutMs === undefined || t.timeoutMs === null
+            ? undefined
+            : toolTimeoutProblem(t.timeoutMs, loadToolMaxTimeoutMs());
+        if (timeoutProblem) {
+            warnings.push(`tool ${t.name}: ${timeoutProblem} Skipping`);
+            continue;
+        }
         // Names are unique per owner: reuse the target owner's own same-named
         // tool (what upsert-by-name used to do), never another owner's. A
         // compound unique with a nullable column can't key an upsert, hence
@@ -83,6 +92,7 @@ export async function createFromBundle(bundle, recon, opts) {
                     code: t.code,
                     jsonSchema: schema.value,
                     ownerId,
+                    ...(t.timeoutMs !== undefined && t.timeoutMs !== null ? { timeoutMs: t.timeoutMs } : {}),
                 },
             }));
         toolIdMap.set(t.name, tool.id);
@@ -180,6 +190,11 @@ export async function createFromBundle(bundle, recon, opts) {
             warnings.push(`agent-tool ${at.agentName}/${at.toolName}: skipped — the agent already has a different tool with the same name (${clash.id})`);
             continue;
         }
+        const mcpClash = await findSameNamedMcpTool(db, agentId, eff(at.toolName));
+        if (mcpClash) {
+            warnings.push(`agent-tool ${at.agentName}/${at.toolName}: skipped — the agent already has a tool with this name from MCP server "${mcpClash.serverName}"`);
+            continue;
+        }
         const caps = capsPatch.data;
         // The importing operator is trusted with the database, so on an agent
         // this import owns it grants the bundle's capabilities in the owner's

package/dist/import/neutral-schema.d.ts

@@ -68,6 +68,7 @@ export declare const NeutralToolSchema: z.ZodObject<{
     jsonSchema: z.ZodDefault<z.ZodNullable<z.ZodUnknown>>;
     code: z.ZodString;
     secretSchema: z.ZodDefault<z.ZodString>;
+    timeoutMs: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
 }, z.core.$strip>;
 export type NeutralTool = z.infer<typeof NeutralToolSchema>;
 export declare const NeutralAgentToolSchema: z.ZodObject<{

package/dist/import/neutral-schema.js

@@ -53,6 +53,8 @@ export const NeutralToolSchema = z.object({
     jsonSchema: z.unknown().nullable().default(null), // ignored; we re-derive (ruling 2)
     code: z.string(),
     secretSchema: z.string().default(""),
+    /** The tool's own time limit (ms); absent or null keeps the default. Checked against WARDBY_TOOL_MAX_TIMEOUT_MS on import. */
+    timeoutMs: z.number().int().nullable().optional(),
 });
 export const NeutralAgentToolSchema = z.object({
     agentName: z.string(),

package/dist/mcp/auth/access.d.ts

@@ -60,6 +60,7 @@ export declare function requireAgentAccess(ctx: McpRequestContext, id: string, r
         budgetGroupId: string | null;
         memoryEnabled: boolean;
         effort: string | null;
+        runSteps: import("#prisma").RunStepsLevel | null;
     };
     access: AgentAccess;
 }>;

package/dist/mcp/auth/grants-cli.d.ts

@@ -77,16 +77,18 @@ export interface MigrationReport {
 }
 export declare function migrationReport(db: ReportDb): Promise<MigrationReport>;
 export declare function formatMigrationReport(report: MigrationReport): string;
+/** A binding that belongs to its resource's owner; for an MCP server, boundName is the server name. */
+export type BindingKind = "secret" | "datastore" | "mcp_server";
 export interface AdoptedAgent {
     agentId: string;
     name: string;
     bindingsRemoved: {
-        kind: "secret" | "datastore";
+        kind: BindingKind;
         boundName: string;
         resourceId: string;
     }[];
     bindingsKept: {
-        kind: "secret" | "datastore";
+        kind: BindingKind;
         boundName: string;
     }[];
     capabilitiesStamped: string[];
@@ -126,7 +128,7 @@ export declare function formatAdoptResult(result: AdoptResult): string;
 export interface PruneResult {
     dryRun: boolean;
     removed: {
-        kind: "secret" | "datastore";
+        kind: BindingKind;
         agentId: string;
         agentName: string;
         boundName: string;
@@ -134,7 +136,7 @@ export interface PruneResult {
         resourceOwnerId: string | null;
     }[];
 }
-/** Deletes cross-owner secret/datastore bindings on owned agents, in one transaction. */
+/** Deletes cross-owner secret/datastore/MCP server bindings on owned agents, in one transaction. */
 export declare function pruneBindings(db: PrismaClient, opts: {
     dryRun: boolean;
 }): Promise<PruneResult>;

package/dist/mcp/auth/grants-cli.js

@@ -14,13 +14,13 @@
  *   owner's own bindings, deleting the rest, and stamping the new owner's
  *   consent on attachments of its own tools. Other attachments stay inert
  *   and are printed with the attach_tool call that re-grants them.
- * - prune-bindings deletes the secret/datastore bindings on owned agents
+ * - prune-bindings deletes the secret/datastore/MCP server bindings on owned agents
  *   whose resource another principal owns (inert at run time since the
  *   grants release) and prints each one: the "removed and listed" record.
  */
 import { parseArgs } from "node:util";
 import { Prisma } from "#prisma";
-import { canDelegate } from "../../core/grants.js";
+import { canDelegate, filterUnusableMcpServers } from "../../core/grants.js";
 import { resolvePrincipal } from "./principal.js";
 const USAGE = "Use grants migration-report [--json] | grants adopt-public --owner <subject> [--dry-run] [--keep-everyone-execute] | grants prune-bindings [--dry-run].";
 /** The attach_tool call (MCP) that re-grants an attachment's capabilities, for its owner to review and run. */
@@ -276,8 +276,14 @@ export async function adoptPublic(db, opts) {
                     include: { datastore: { select: { ownerId: true } } },
                     orderBy: { boundName: "asc" },
                 });
+                const mcpServers = await tx.agentMcpServer.findMany({
+                    where: { agentId: id },
+                    include: { server: { select: { id: true, name: true, ownerId: true } } },
+                    orderBy: { serverId: "asc" },
+                });
                 const foreignSecrets = secrets.filter((b) => b.secret.ownerId !== owner.id);
                 const foreignDatastores = datastores.filter((b) => b.datastore.ownerId !== owner.id);
+                const foreignMcpServers = await filterUnusableMcpServers(tx, () => owner.id, mcpServers);
                 for (const b of foreignSecrets) {
                     await tx.agentSecret.delete({ where: { agentId_secretId: { agentId: id, secretId: b.secretId } } });
                 }
@@ -286,6 +292,9 @@ export async function adoptPublic(db, opts) {
                         where: { agentId_datastoreId: { agentId: id, datastoreId: b.datastoreId } },
                     });
                 }
+                for (const b of foreignMcpServers) {
+                    await tx.agentMcpServer.delete({ where: { agentId_serverId: { agentId: id, serverId: b.serverId } } });
+                }
                 // Only the tool's owner could attach its private tool to a public
                 // agent or change that attachment's capabilities, so those carry
                 // the new owner's consent. Everything else stays inert.
@@ -350,6 +359,11 @@ export async function adoptPublic(db, opts) {
                             boundName: b.boundName,
                             resourceId: b.datastoreId,
                         })),
+                        ...foreignMcpServers.map((b) => ({
+                            kind: "mcp_server",
+                            boundName: b.server.name,
+                            resourceId: b.serverId,
+                        })),
                     ],
                     bindingsKept: [
                         ...secrets
@@ -358,6 +372,9 @@ export async function adoptPublic(db, opts) {
                         ...datastores
                             .filter((b) => b.datastore.ownerId === owner.id)
                             .map((b) => ({ kind: "datastore", boundName: b.boundName })),
+                        ...mcpServers
+                            .filter((b) => !foreignMcpServers.includes(b))
+                            .map((b) => ({ kind: "mcp_server", boundName: b.server.name })),
                     ],
                     capabilitiesStamped: own.map((at) => at.tool.name),
                     foreignTools: attachments
@@ -411,7 +428,7 @@ export function formatAdoptResult(result) {
     }
     return lines.join("\n");
 }
-/** Deletes cross-owner secret/datastore bindings on owned agents, in one transaction. */
+/** Deletes cross-owner secret/datastore/MCP server bindings on owned agents, in one transaction. */
 export async function pruneBindings(db, opts) {
     return db.$transaction(async (tx) => {
         const secrets = await tx.agentSecret.findMany({
@@ -424,8 +441,17 @@ export async function pruneBindings(db, opts) {
             include: { agent: { select: { name: true, ownerId: true } }, datastore: { select: { ownerId: true } } },
             orderBy: [{ agentId: "asc" }, { boundName: "asc" }],
         });
+        const mcpServers = await tx.agentMcpServer.findMany({
+            where: { agent: { ownerId: { not: null } } },
+            include: {
+                agent: { select: { name: true, ownerId: true } },
+                server: { select: { id: true, name: true, ownerId: true } },
+            },
+            orderBy: [{ agentId: "asc" }, { serverId: "asc" }],
+        });
         const foreignSecrets = secrets.filter((b) => b.secret.ownerId !== b.agent.ownerId);
         const foreignDatastores = datastores.filter((b) => b.datastore.ownerId !== b.agent.ownerId);
+        const foreignMcpServers = await filterUnusableMcpServers(tx, (b) => b.agent.ownerId, mcpServers);
         if (!opts.dryRun) {
             for (const b of foreignSecrets) {
                 await tx.agentSecret.delete({ where: { agentId_secretId: { agentId: b.agentId, secretId: b.secretId } } });
@@ -435,6 +461,11 @@ export async function pruneBindings(db, opts) {
                     where: { agentId_datastoreId: { agentId: b.agentId, datastoreId: b.datastoreId } },
                 });
             }
+            for (const b of foreignMcpServers) {
+                await tx.agentMcpServer.delete({
+                    where: { agentId_serverId: { agentId: b.agentId, serverId: b.serverId } },
+                });
+            }
         }
         return {
             dryRun: opts.dryRun,
@@ -455,6 +486,14 @@ export async function pruneBindings(db, opts) {
                     resourceId: b.datastoreId,
                     resourceOwnerId: b.datastore.ownerId,
                 })),
+                ...foreignMcpServers.map((b) => ({
+                    kind: "mcp_server",
+                    agentId: b.agentId,
+                    agentName: b.agent.name,
+                    boundName: b.server.name,
+                    resourceId: b.serverId,
+                    resourceOwnerId: b.server.ownerId,
+                })),
             ],
         };
     }, { isolationLevel: Prisma.TransactionIsolationLevel.Serializable });

package/dist/mcp/auth/resource-server.d.ts

@@ -19,7 +19,9 @@ export declare const SCOPES_SUPPORTED: string[];
  * runs next to every coding run that names an entry; admin:view reads every
  * owner's runs (the admin viewer API); models:admin changes the model catalog,
  * which prices every principal's runs; power:manage scales the shared coding
- * proxy and native gateway to zero (power_sleep) and reads their state.
+ * proxy and native gateway to zero (power_sleep) and reads their state;
+ * hosts:admin registers host providers, whose approved tools run in the push
+ * and pull request flow.
  * A token scope only DELEGATES — it never authorizes on its own:
  * requireScope/requireAnyScope honour one only when one of the caller's
  * roles (McpRequestContext.roles, resolved live per request) grants it.

package/dist/mcp/auth/resource-server.js

@@ -30,6 +30,9 @@ export const SCOPES_SUPPORTED = [
     // Scale the coding proxy and native gateway to zero now (power_sleep) and
     // read their state (power_status); low-power mode only (docs/getting-started-gke.md).
     "power:manage",
+    // Register host providers and approve their tools (docs/host-providers.md).
+    // Bound tools decide who has permission and who wrote a comment.
+    "hosts:admin",
 ];
 /**
  * Scopes whose operations reach beyond the caller's own (or public)
@@ -40,7 +43,9 @@ export const SCOPES_SUPPORTED = [
  * runs next to every coding run that names an entry; admin:view reads every
  * owner's runs (the admin viewer API); models:admin changes the model catalog,
  * which prices every principal's runs; power:manage scales the shared coding
- * proxy and native gateway to zero (power_sleep) and reads their state.
+ * proxy and native gateway to zero (power_sleep) and reads their state;
+ * hosts:admin registers host providers, whose approved tools run in the push
+ * and pull request flow.
  * A token scope only DELEGATES — it never authorizes on its own:
  * requireScope/requireAnyScope honour one only when one of the caller's
  * roles (McpRequestContext.roles, resolved live per request) grants it.
@@ -52,16 +57,26 @@ export const PRIVILEGED_SCOPES = [
     "admin:view",
     "models:admin",
     "power:manage",
+    "hosts:admin",
 ];
 /**
  * The built-in roles and the permissions (privileged scope names) each
  * grants. No roles = member: every non-privileged scope, nothing privileged.
  */
 export const ROLE_PERMISSIONS = {
-    admin: ["agents:admin", "packages:approve", "services:manage", "admin:view", "models:admin", "power:manage"],
+    admin: [
+        "agents:admin",
+        "packages:approve",
+        "services:manage",
+        "admin:view",
+        "models:admin",
+        "power:manage",
+        "hosts:admin",
+    ],
     "package-approver": ["packages:approve"],
     "service-manager": ["services:manage"],
     "model-manager": ["models:admin"],
+    "host-manager": ["hosts:admin"],
 };
 export const ROLE_NAMES = Object.keys(ROLE_PERMISSIONS);
 export function isRoleName(name) {

package/dist/mcp/context.d.ts

@@ -11,10 +11,12 @@ import type { Principal, PrismaClient } from "#prisma";
 import type { RequestStateAccessor } from "@modelcontextprotocol/server";
 import type { ProviderRegistry } from "../providers/index.js";
 import type { RepoAccessGate } from "../core/repo-access.js";
+import type { RunStepSink } from "../core/run-steps/types.js";
 import type { IssueTrackerRegistry } from "../providers/issue-tracker/types.js";
 import type { HostUserAuthorizerRegistry, ReviewHostRegistry } from "../providers/review-host/types.js";
 import type { Power } from "../core/power.js";
 import type { ChatProviderRegistry } from "../providers/chat/types.js";
+import type { safeFetch } from "../sandbox/safe-fetch.js";
 export type McpProviders = Pick<ProviderRegistry, "llm" | "engine" | "datastore" | "secrets" | "executor" | "memory"> & {
     reviewHosts?: ReviewHostRegistry;
     /** Issue trackers (Jira); empty or absent = no issue-tracker integration. */
@@ -31,6 +33,10 @@ export type McpProviders = Pick<ProviderRegistry, "llm" | "engine" | "datastore"
     repoAccess?: RepoAccessGate;
     /** Low-power mode (scale idle proxy/gateway to zero); absent = DISABLED_POWER. */
     power?: Power;
+    /** Overrides the outbound call to remote MCP servers (register/update/refresh_mcp_server) — tests only. */
+    sandboxFetch?: typeof safeFetch;
+    /** Records runs' steps; also what the run-steps listener writes through. */
+    runSteps?: RunStepSink;
 };
 export interface McpRequestContext {
     principal: Principal;

package/dist/mcp/index.js

@@ -13,6 +13,9 @@
  * missing `AUTH_JWKS_URI`/`AUTH_SIGNING_KEY` a deployment running stdio-only
  * never needed to set.
  */
+import { loadToolMaxTimeoutMs } from "../config/tool-timeout.js";
+import { loadMcpServersMode } from "../config/mcp-servers.js";
+import { loadMcpMaxCallsPerRun } from "../config/mcp-call-limit.js";
 import { startupTestSimulators } from "../config/test-simulators.js";
 import { loadProviderConfig, loadMcpConfig, loadShutdownDrainSeconds, loadAuthConfig, loadGitHubEventConfig, loadJiraConfig, loadGitHubVcsConfig, loadBlobStoreConfig, } from "../config/providers.js";
 import { prisma } from "../core/db.js";
@@ -62,6 +65,8 @@ import { registerCostReportTools } from "./tools/cost-report.js";
 import { registerDatastoreTools } from "./tools/datastore.js";
 import { registerSubAgentTools } from "./tools/subagents.js";
 import { registerGrantTools } from "./tools/grants.js";
+import { registerHostProviderTools } from "./tools/host-providers.js";
+import { registerMcpServerTools } from "./tools/mcp-servers.js";
 import { registerRepositoryTools } from "./tools/repositories.js";
 import { registerIssueProjectTools } from "./tools/issue-projects.js";
 import { registerNotificationChannelTools } from "./tools/notification-channels.js";
@@ -72,6 +77,9 @@ import { registerSecretsTools } from "./tools/secrets.js";
 import { registerWebhookTools } from "./tools/webhooks.js";
 import { STDIO_SECRET_PATH, secretFormRoute } from "./tools/secret-elicitation-server.js";
 import { createStdioLinkHost } from "./transport/stdio-link-host.js";
+import { loadRunStepRetentionDays, loadRunStepsLevel } from "../core/run-steps/config.js";
+import { buildRunStepWriter } from "../core/run-steps/writer.js";
+import { registerRunStepsTool } from "./tools/run-steps.js";
 import { registerRunTranscriptTool } from "./tools/run-transcript.js";
 import { handleRunTranscriptDownload, RUN_TRANSCRIPT_DOWNLOAD_PATH } from "./tools/run-transcript-download.js";
 import { createBlobStore } from "../providers/storage/index.js";
@@ -134,12 +142,15 @@ export function registerAllTools(mcp, opts) {
         blobStoreConfigured: runTranscriptUrl !== undefined && opts.blobStoreConfigured === true,
         audience: opts.runTranscriptAudience ?? "http",
     });
+    registerRunStepsTool(mcp, { level: loadRunStepsLevel(), retentionDays: loadRunStepRetentionDays() });
     registerStopRunTool(mcp);
     registerCostReportTools(mcp);
     registerDatastoreTools(mcp);
     registerSubAgentTools(mcp);
     registerGrantTools(mcp);
     registerRepositoryTools(mcp);
+    registerHostProviderTools(mcp);
+    registerMcpServerTools(mcp);
     registerIssueProjectTools(mcp);
     registerNotificationChannelTools(mcp);
     registerHostAccountTools(mcp);
@@ -164,6 +175,8 @@ export function buildMcpProviders() {
     const secretGuard = createDbSecretWriteGuard(prisma, secrets);
     const datastore = guardDatastore(new PostgresDatastore(prisma, secrets), secretGuard);
     const memory = guardAgentMemory(new PostgresAgentMemory(prisma), secretGuard);
+    // The one run-steps writer of this process (WARDBY_RUN_STEPS, RUN_STEP_RETENTION_DAYS; invalid stops start-up).
+    const runSteps = buildRunStepWriter(prisma, secrets);
     const reviewHosts = buildReviewHosts(process.env, prisma);
     const issueTrackers = buildIssueTrackers();
     const hostUserAuthorizers = buildHostUserAuthorizers();
@@ -192,7 +205,12 @@ export function buildMcpProviders() {
         reviewHosts,
         issueTrackers,
         repoAccess,
+        runSteps,
     };
+    // Read again at each tool call; checked here so a bad value stops start-up, not every run.
+    loadToolMaxTimeoutMs();
+    loadMcpServersMode();
+    loadMcpMaxCallsPerRun();
     const nativeExecutor = buildExecutor(providerConfig, nativeProviders, prisma);
     // One Power for the process, shared by both executors (wake) and the scheduler leader (sleep).
     const power = buildPower({ env: process.env, db: prisma });
@@ -221,6 +239,7 @@ export function buildMcpProviders() {
             repoAccess,
             chat,
             power,
+            runSteps,
         },
     };
 }
@@ -312,6 +331,7 @@ export async function startMcp(options = {}) {
             close: async () => {
                 await closeQuietly(stdio.close(), "stdio transport close");
                 await closeQuietly(providers.executor.close?.(), "executor close");
+                await providers.runSteps?.flush?.();
                 modelCatalog.close();
             },
         };
@@ -449,6 +469,7 @@ export async function startMcp(options = {}) {
             // closes under them; a run abandoned here is lost, never resumed.
             await waitForInFlightRuns(drainSeconds * 1000);
             await closeQuietly(providers.executor.close?.(), "executor close");
+            await providers.runSteps?.flush?.();
             modelCatalog.close();
         },
     };