@wardby/cli 0.7.0 → 0.9.0

package/dist/mcp/tools/run-steps.d.ts

@@ -0,0 +1,16 @@
+/**
+ * get_run_steps: what a run did, one line per step, oldest first. Same access as get_run. Steps
+ * are stored already redacted (src/core/run-steps/writer.ts) and returned as stored; a step's
+ * callId is never returned; its detail text (the detail level) only to the agent's owner, the run's
+ * starter and the stdio operator (canReadRunDetail).
+ */
+import { type RunStepsLevel } from "../../core/run-steps/config.js";
+import type { WardbyMcpServer } from "../server.js";
+export declare const RUN_STEPS_DEFAULT_LIMIT = 50;
+export declare const RUN_STEPS_MAX_LIMIT = 200;
+export interface RunStepsToolOptions {
+    level: RunStepsLevel;
+    retentionDays: number;
+    now?: () => Date;
+}
+export declare function registerRunStepsTool(mcp: WardbyMcpServer, opts: RunStepsToolOptions): void;

package/dist/mcp/tools/run-steps.js

@@ -0,0 +1,85 @@
+/**
+ * get_run_steps: what a run did, one line per step, oldest first. Same access as get_run. Steps
+ * are stored already redacted (src/core/run-steps/writer.ts) and returned as stored; a step's
+ * callId is never returned; its detail text (the detail level) only to the agent's owner, the run's
+ * starter and the stdio operator (canReadRunDetail).
+ */
+import { recordedRunStepsLevel } from "../../core/run-steps/config.js";
+import { canReadRunDetail, findReadableRun } from "./run-access.js";
+import { textResult } from "./text-result.js";
+export const RUN_STEPS_DEFAULT_LIMIT = 50;
+export const RUN_STEPS_MAX_LIMIT = 200;
+const DAY_MS = 24 * 60 * 60 * 1000;
+const EXPIRED_MEANING = "No steps are kept for this run: steps are deleted RUN_STEP_RETENTION_DAYS after they are recorded.";
+export function registerRunStepsTool(mcp, opts) {
+    mcp.registerTool({
+        name: "get_run_steps",
+        scope: "agents:read",
+        description: "What a run did, one line per step, oldest first: each tool call (the tool and its command, file or first " +
+            "argument, cut short) with its status once known (ok, error or exit N), and what the model said, cut short. " +
+            "At the detail level (the instance's WARDBY_RUN_STEPS and the agent's runSteps both detail), the agent's owner " +
+            "and the run's starter also get each step's detail: the tool's input, the end of its output, or the model's " +
+            "text, redacted. Others get the lines only. level is the run's own, fixed when it started. " +
+            "To follow a running run, call again with after set to the last seq you have. " +
+            `next is the after for the next page, or null. limit defaults to ${RUN_STEPS_DEFAULT_LIMIT}, at most ` +
+            `${RUN_STEPS_MAX_LIMIT}. dropped counts steps past the per-run limit. Same access as get_run.`,
+        inputSchema: {
+            type: "object",
+            properties: {
+                runId: { type: "string" },
+                after: { type: "number", description: "Only steps with a larger seq" },
+                limit: {
+                    type: "number",
+                    description: `Steps to return (default ${RUN_STEPS_DEFAULT_LIMIT}, at most ${RUN_STEPS_MAX_LIMIT})`,
+                },
+            },
+            required: ["runId"],
+        },
+        handler: async (args, ctx) => {
+            const run = await findReadableRun(ctx, args.runId);
+            const showDetail = await canReadRunDetail(ctx.db, run, {
+                principalId: ctx.principal.id,
+                operator: ctx.operator,
+            });
+            const after = Number.isFinite(args.after) ? Math.max(0, Math.floor(args.after)) : 0;
+            const requested = Number.isFinite(args.limit) ? Math.floor(args.limit) : RUN_STEPS_DEFAULT_LIMIT;
+            const take = Math.min(Math.max(1, requested), RUN_STEPS_MAX_LIMIT);
+            const rows = await ctx.db.runStep.findMany({
+                where: { runId: run.id, seq: { gt: after } },
+                orderBy: { seq: "asc" },
+                take: take + 1,
+                select: {
+                    seq: true,
+                    at: true,
+                    kind: true,
+                    tool: true,
+                    summary: true,
+                    status: true,
+                    ...(showDetail ? { detail: true } : {}),
+                },
+            });
+            const page = rows.slice(0, take);
+            const now = (opts.now ?? (() => new Date()))();
+            const expired = page.length === 0 &&
+                after === 0 &&
+                run.finishedAt != null &&
+                run.finishedAt.getTime() + opts.retentionDays * DAY_MS < now.getTime();
+            return textResult({
+                runId: run.id,
+                level: recordedRunStepsLevel(run.runStepsLevel, opts.level),
+                steps: page.map((s) => ({
+                    seq: s.seq,
+                    at: s.at.toISOString(),
+                    kind: s.kind,
+                    tool: s.tool,
+                    summary: s.summary,
+                    status: s.status,
+                    ...(showDetail ? { detail: s.detail ?? null } : {}),
+                })),
+                next: rows.length > take ? page[page.length - 1].seq : null,
+                dropped: run.stepsDropped,
+                ...(expired ? { expired: true, meaning: EXPIRED_MEANING } : {}),
+            });
+        },
+    });
+}

package/dist/mcp/tools/runs.js

@@ -1,11 +1,19 @@
-import { requireAgentAccess } from "../auth/access.js";
+import { agentAccessResolver, readableAgentsWhere, requireAgentAccess } from "../auth/access.js";
+import { requireScope } from "../auth/resource-server.js";
+import { McpError } from "../errors.js";
+import { loadGraphRuns } from "../../viewer/graph.js";
+import { loadJiraConfig } from "../../config/providers.js";
 import { findReadableRun } from "./run-access.js";
-import { publicCodingRunResult, sanitizeDependencyCacheReport } from "../../coding/protocol.js";
+import { publicCodingRunResult, redactTokenShapedValues, sanitizeDependencyCacheReport, } from "../../coding/protocol.js";
 import { countPlanRefusals, summarizeRegistryFetches } from "../../coding/registry/report.js";
 import { summarizePackageAudit } from "../../coding/registry/audit-mode.js";
 import { storedServiceLabels } from "../../coding/services/catalog.js";
 import { textResult } from "./text-result.js";
 import { loadBudgetEvents } from "../../core/budget-events.js";
+import { loadAgentSecretValues, maskNamedSecrets } from "../../core/secret-guard.js";
+import { logger } from "../../core/logger.js";
+import { loadLastSteps } from "../../core/run-steps/last-step.js";
+const runsLog = logger.child({ module: "mcp-runs" });
 /**
  * Run visibility (resource-sharing grants spec §3.5, A6): a run's output is
  * the triggerer's and the agent owner's, never every reader's. The owner
@@ -17,45 +25,195 @@ function withOperatorMode(run) {
     const mode = run.nativeExecutionMode;
     return { ...run, nativeExecutionMode: mode == null ? null : mode === "sandbox" ? "sandbox" : "control-plane" };
 }
+/**
+ * A coding run's request as its readers may see it. It can be text a caller or an issue wrote, so
+ * the agent's secret values and token-shaped values are masked here on every read. A secret that
+ * can't be read means the text can't be checked, so it is withheld; the log carries the error name only.
+ */
+async function requestForReader(ctx, run, request) {
+    try {
+        const named = await loadAgentSecretValues(ctx.db, ctx.providers.secrets, run.agentId);
+        return { request: redactTokenShapedValues(maskNamedSecrets(request, named)) };
+    }
+    catch (err) {
+        runsLog.warn({ runId: run.id, errorName: err instanceof Error ? err.name : typeof err }, "could not read the agent's secrets to check a run's request; withholding it");
+        return { requestUnavailable: true };
+    }
+}
+/** The issue-tracker sites issue links are built from (the admin viewer's own source); none when unset or invalid. */
+function issueSites() {
+    try {
+        const jira = loadJiraConfig();
+        return jira ? { jira: jira.siteUrl } : {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * What started each run and what it produced, in the admin viewer API's shapes (docs/viewer-api.md):
+ * `triggerInfo` (the pull request, issue, schedule or lead behind it), `outcomes` (pull requests opened,
+ * comments, checks) and `serviceReadiness` (each coding-run service's state). Only ids and links:
+ * repositories, numbers, issue keys, URLs, states and times, never free text. A service's failure
+ * `reason` is left out, since it can quote what the service printed.
+ */
+async function runGraphFields(ctx, runIds) {
+    const graph = await loadGraphRuns(ctx.db, runIds, issueSites());
+    return new Map(graph.map((run) => [
+        run.id,
+        {
+            triggerInfo: run.trigger,
+            outcomes: run.outcomes,
+            serviceReadiness: run.services.map(({ name, state, attempts, readyAt, failedAt }) => ({
+                name,
+                state,
+                attempts,
+                readyAt,
+                failedAt,
+            })),
+        },
+    ]));
+}
+/** Statuses `active: true` keeps, and that `since` always keeps. */
+const ACTIVE_STATUSES = ["pending", "running"];
+/** Rows returned without an agentId: a default and a cap, since it spans every agent the caller can see. */
+const ACROSS_AGENTS_DEFAULT_LIMIT = 50;
+const ACROSS_AGENTS_MAX_LIMIT = 200;
+/** The `active` and `since` filters, as clauses to AND onto the visibility rule. */
+function runFilters(args) {
+    const filters = [];
+    if (args.active === true)
+        filters.push({ status: { in: ACTIVE_STATUSES } });
+    if (args.since !== undefined) {
+        const since = new Date(args.since);
+        if (Number.isNaN(since.getTime()))
+            throw new McpError(400, "since must be an ISO date or time");
+        filters.push({
+            OR: [{ startedAt: { gte: since } }, { finishedAt: { gte: since } }, { status: { in: ACTIVE_STATUSES } }],
+        });
+    }
+    return filters;
+}
+/**
+ * Runs across every agent the caller can read, under the same rule as one agent's listing: all runs of
+ * agents they own, only the runs they triggered on the rest. With `all` (admin:view, checked by the
+ * caller), every run in the deployment, as the admin viewer shows. Rows name their agent and leave
+ * out finalText, which can be long and is one get_run away.
+ */
+async function listRunsAcrossAgents(ctx, filters, opts) {
+    const [where, accessOf] = await Promise.all([
+        opts.all ? Promise.resolve({}) : readableAgentsWhere(ctx),
+        agentAccessResolver(ctx),
+    ]);
+    const agents = await ctx.db.agent.findMany({
+        where,
+        select: { id: true, ownerId: true, name: true, budgetUsd: true },
+    });
+    const owned = agents.filter((agent) => opts.all || accessOf(agent) === "owner").map((agent) => agent.id);
+    const others = agents.filter((agent) => !opts.all && accessOf(agent) !== "owner").map((agent) => agent.id);
+    const byId = new Map(agents.map((agent) => [agent.id, agent]));
+    // A limit that isn't a finite number falls back to the default rather than reaching the query as NaN.
+    const requested = Number.isFinite(opts.limit) ? Math.floor(opts.limit) : ACROSS_AGENTS_DEFAULT_LIMIT;
+    const take = Math.min(Math.max(1, requested), ACROSS_AGENTS_MAX_LIMIT);
+    const status = opts.status;
+    const runs = await ctx.db.run.findMany({
+        where: {
+            OR: [{ agentId: { in: owned } }, { agentId: { in: others }, triggeredById: ctx.principal.id }],
+            ...(status ? { status: status } : {}),
+            ...(filters.length > 0 ? { AND: filters } : {}),
+        },
+        omit: { finalText: true, pricingSnapshot: true },
+        take,
+        orderBy: { startedAt: "desc" },
+    });
+    const graph = await runGraphFields(ctx, runs.map((run) => run.id));
+    // The newest step of each run (the runs pane's one line), when it has any.
+    const lastSteps = await loadLastSteps(ctx.db, runs.map((run) => run.id));
+    return runs.map((run) => {
+        const agent = byId.get(run.agentId);
+        return {
+            ...run,
+            agentName: agent?.name ?? null,
+            agentBudgetUsd: agent ? Number(agent.budgetUsd) : null,
+            ...(graph.get(run.id) ?? { triggerInfo: null, outcomes: [], serviceReadiness: [] }),
+            ...(lastSteps.has(run.id) ? { lastStep: lastSteps.get(run.id) } : {}),
+        };
+    });
+}
+/** Same rule as get_run: a pending coding run with queuedAt is waiting for a concurrency slot (CODING_MAX_CONCURRENT), not stuck. */
+async function withQueuedAt(ctx, runs) {
+    const pendingIds = runs.filter((run) => run.status === "pending").map((run) => run.id);
+    const queued = pendingIds.length > 0
+        ? await ctx.db.codingRun.findMany({
+            where: { runId: { in: pendingIds }, queuedAt: { not: null } },
+            select: { runId: true, queuedAt: true },
+        })
+        : [];
+    const queuedAtByRun = new Map(queued.map((row) => [row.runId, row.queuedAt?.toISOString()]));
+    return runs.map((run) => {
+        const codingQueuedAt = queuedAtByRun.get(run.id);
+        return codingQueuedAt ? { ...withOperatorMode(run), codingQueuedAt } : withOperatorMode(run);
+    });
+}
 export function registerRunTools(mcp) {
     mcp.registerTool({
         name: "list_runs",
         scope: "agents:read",
+        description: "Lists runs, newest first. With agentId, that agent's runs; without it, runs across every agent you can see " +
+            "(each row adds agentName, agentBudgetUsd, triggerInfo, outcomes, serviceReadiness and lastStep (the run's newest step as one line, when it has steps; the agentId listing has no lastStep), and leaves out finalText " +
+            `and pricingSnapshot; default limit ${ACROSS_AGENTS_DEFAULT_LIMIT}, ` +
+            `at most ${ACROSS_AGENTS_MAX_LIMIT}). You see all runs of agents you own and only the runs you triggered on others. ` +
+            "active: true keeps pending and running runs; since (ISO time) keeps runs that started or finished then or later, " +
+            "plus any still pending or running. all: true (no agentId) lists every run in the deployment (admins only, admin:view). " +
+            "Use get_run for one run's detail.",
         inputSchema: {
             type: "object",
-            properties: { agentId: { type: "string" }, status: { type: "string" }, limit: { type: "number" } },
-            required: ["agentId"],
+            properties: {
+                agentId: { type: "string" },
+                status: { type: "string" },
+                active: { type: "boolean" },
+                since: { type: "string", description: "ISO date or time" },
+                all: { type: "boolean" },
+                limit: { type: "number" },
+            },
         },
         handler: async (args, ctx) => {
+            const filters = runFilters(args);
+            if (args.all === true) {
+                if (args.agentId !== undefined)
+                    throw new McpError(400, "all lists every agent's runs; leave out agentId");
+                if (!ctx.operator)
+                    requireScope(ctx, ctx.canonicalUri, "admin:view");
+            }
+            if (args.agentId === undefined) {
+                const runs = await listRunsAcrossAgents(ctx, filters, {
+                    status: args.status,
+                    limit: args.limit,
+                    all: args.all === true,
+                });
+                return textResult(await withQueuedAt(ctx, runs));
+            }
             const { access } = await requireAgentAccess(ctx, args.agentId, "read");
             const runs = await ctx.db.run.findMany({
                 where: {
                     agentId: args.agentId,
                     ...(args.status ? { status: args.status } : {}),
                     ...(access === "owner" ? {} : { triggeredById: ctx.principal.id }),
+                    ...(filters.length > 0 ? { AND: filters } : {}),
                 },
                 take: args.limit,
                 orderBy: { startedAt: "desc" },
             });
-            // Same rule as get_run: a pending coding run with queuedAt is waiting
-            // for a concurrency slot (CODING_MAX_CONCURRENT), not stuck.
-            const pendingIds = runs.filter((run) => run.status === "pending").map((run) => run.id);
-            const queued = pendingIds.length > 0
-                ? await ctx.db.codingRun.findMany({
-                    where: { runId: { in: pendingIds }, queuedAt: { not: null } },
-                    select: { runId: true, queuedAt: true },
-                })
-                : [];
-            const queuedAtByRun = new Map(queued.map((row) => [row.runId, row.queuedAt?.toISOString()]));
-            return textResult(runs.map((run) => {
-                const codingQueuedAt = queuedAtByRun.get(run.id);
-                return codingQueuedAt ? { ...withOperatorMode(run), codingQueuedAt } : withOperatorMode(run);
-            }));
+            return textResult(await withQueuedAt(ctx, runs));
         },
     });
     mcp.registerTool({
         name: "get_run",
         scope: "agents:read",
+        description: "One run in full: status, cost, request, result, errors and budget events, plus triggerInfo (what started it: " +
+            "a pull request review or mention, an issue, a schedule or a lead run), outcomes (pull requests opened, comments, " +
+            "checks) and serviceReadiness. A run's pull-request outcome matching another run's triggerInfo links the two. " +
+            "lastStep is the newest step; get_run_steps lists them all.",
         inputSchema: { type: "object", properties: { runId: { type: "string" } }, required: ["runId"] },
         handler: async (args, ctx) => {
             // Its triggerer keeps seeing it even after losing access to the agent;
@@ -65,6 +223,7 @@ export function registerRunTools(mcp) {
                 where: { runId: run.id },
                 select: {
                     result: true,
+                    request: true,
                     queuedAt: true,
                     failureCategory: true,
                     diagnosticId: true,
@@ -123,8 +282,17 @@ export function registerRunTools(mcp) {
                 : undefined;
             // Well-formed refusals only, with group, lead and agent budget filled as the run error's are.
             const budgetEvents = await loadBudgetEvents(ctx.db, run.id);
+            // What started the run and what it produced, as the admin viewer shows them.
+            const graph = (await runGraphFields(ctx, [run.id])).get(run.id);
+            // The newest step (get_run_steps has them all).
+            const lastStep = (await loadLastSteps(ctx.db, [run.id])).get(run.id);
+            // What the run was asked to do: the trigger's or lead's task, without the agent's standing instructions.
+            const request = codingRun?.request ? await requestForReader(ctx, run, codingRun.request) : {};
             return textResult({
                 ...withOperatorMode(run),
+                ...request,
+                ...(graph ?? {}),
+                ...(lastStep ? { lastStep } : {}),
                 ...(budgetEvents.length > 0 ? { budgetEvents } : {}),
                 ...(codingRun?.budgetReservedUsd != null ? { budgetReservedUsd: Number(codingRun.budgetReservedUsd) } : {}),
                 ...(codingRun?.budgetBaseUsd != null ? { budgetBaseUsd: Number(codingRun.budgetBaseUsd) } : {}),

package/dist/mcp/tools/secret-elicitation.d.ts

@@ -38,6 +38,8 @@ export interface SecretElicitationPayload {
      * removal is refused if the secret's config has changed since (or the link has none).
      */
     brokerHash?: string;
+    /** The caller passed the hosts:admin check when the link was minted. */
+    hostManager?: boolean;
 }
 export type SecretElicitationOutcome = {
     ok: true;

package/dist/mcp/tools/secret-elicitation.js

@@ -1,4 +1,4 @@
-import { createSecret, listSecrets, setSecretBroker } from "../../core/secrets.js";
+import { createSecret, hostProvidersUsingSecret, listSecrets, setSecretBroker, } from "../../core/secrets.js";
 import { parseSecretBrokerConfig, SECRET_BROKER_CHANGED, } from "../../core/secret-broker-config.js";
 /**
  * A link only does what it was minted for: a create link can't confirm an
@@ -19,6 +19,18 @@ function kindOf(outcome) {
     return outcome.kind ?? "create";
 }
 const ELICITATION_TTL_MS = 600_000;
+const HOST_PROVIDER_LINK_STALE = "host_provider_secret_link_stale: a host provider now uses this secret; request a new link with hosts:admin";
+/**
+ * A link minted before the secret joined a host provider carries no hosts:admin check.
+ * Refused without recording an outcome, so a fresh link from a host manager still works.
+ */
+async function isStaleForHostProvider(db, payload) {
+    if (payload.hostManager)
+        return false;
+    const { ownerId, secretName: name } = payload;
+    const secret = await db.secret.findUnique({ where: { ownerId_name: { ownerId, name } }, select: { id: true } });
+    return secret !== null && (await hostProvidersUsingSecret(db, secret.id)).providers.length > 0;
+}
 /** Sweeps every expired entry, not just the one being looked up, so a set-and-never-polled-again entry doesn't linger forever. */
 async function pruneExpired(db, now) {
     await db.secretElicitationOutcome.deleteMany({ where: { expiresAt: { lte: now } } });
@@ -58,6 +70,9 @@ export async function fulfillSecretElicitation(payload, value, cipher, db, broke
     });
     if (existing && kindOf(existing.outcome) === "create")
         return existing.outcome;
+    if (await isStaleForHostProvider(db, payload)) {
+        return { ok: false, kind: "create", error: HOST_PROVIDER_LINK_STALE };
+    }
     let outcome;
     try {
         const secret = await createSecret(secretName, value, ownerId, cipher, db, {
@@ -89,7 +104,12 @@ export async function fulfillSecretElicitation(payload, value, cipher, db, broke
     await recordOutcome(db, ownerId, secretName, outcome, now);
     return outcome;
 }
-const CORRECTABLE_ERRORS = ["secret_broker_value_invalid", "secret_broker_config_invalid", "bridge_input_limit"];
+const CORRECTABLE_ERRORS = [
+    "secret_broker_value_invalid",
+    "secret_broker_config_invalid",
+    "bridge_input_limit",
+    "host_provider_webhook_secret_short",
+];
 function isCorrectableInput(message) {
     return CORRECTABLE_ERRORS.some((code) => message.startsWith(code));
 }
@@ -115,6 +135,9 @@ export async function fulfillUnbrokerElicitation(payload, cipher, db) {
     });
     if (existing && kindOf(existing.outcome) === "unbroker")
         return existing.outcome;
+    if (await isStaleForHostProvider(db, payload)) {
+        return { ok: false, kind: "unbroker", error: HOST_PROVIDER_LINK_STALE };
+    }
     let outcome;
     try {
         await setSecretBroker(db, cipher, {

package/dist/mcp/tools/secrets.js

@@ -4,10 +4,12 @@
  * value/ciphertext at the source); this file adds ownership on top.
  */
 import { inputRequired, inputResponse } from "@modelcontextprotocol/server";
-import { createSecret, listSecrets, attachSecret, detachSecret, deleteSecret, setSecretBroker, } from "../../core/secrets.js";
+import { createSecret, listSecrets, attachSecret, detachSecret, deleteSecret, hostProvidersUsingSecret, setSecretBroker, WEBHOOK_SECRET_ATTACHED, } from "../../core/secrets.js";
+import { mcpServersUsingSecret } from "../../core/mcp-servers.js";
 import { brokerConfigHash, parseSecretBrokerConfig } from "../../core/secret-broker-config.js";
 import { McpError } from "../errors.js";
 import { requireOwnedSecret } from "../auth/ownership.js";
+import { requireScope } from "../auth/resource-server.js";
 import { requireAgentAccess, requireBindable, requireBindingOwner } from "../auth/access.js";
 import { clearUnbrokerOutcome, getSecretElicitationOutcome, } from "./secret-elicitation.js";
 import { allowedSecretNames, brokerCompatibilityWarnings } from "./secret-broker-compat.js";
@@ -27,7 +29,9 @@ function mapSecretError(err) {
     const message = err instanceof Error ? err.message : String(err);
     if (message.startsWith("secret_not_found"))
         throw new McpError(404, message);
-    if (message.startsWith("secret_broker_config_invalid") || message.startsWith("secret_broker_value_invalid")) {
+    if (message.startsWith("secret_broker_config_invalid") ||
+        message.startsWith("secret_broker_value_invalid") ||
+        message.startsWith("host_provider_webhook_secret_short")) {
         throw new McpError(400, message);
     }
     throw err;
@@ -70,11 +74,26 @@ async function findOwnSecret(ctx, name) {
         throw new McpError(404, `secret_not_found: no secret named "${name}"`);
     return secret;
 }
+/**
+ * A host provider's secret needs hosts:admin as well as secrets:write: replacing a credential
+ * or its broker config changes what the provider does. True when the caller passed that check,
+ * and its links say so; checked before any link is minted, and again when one is submitted.
+ */
+async function requireHostsAdminIfProviderSecret(ctx, name) {
+    const secret = await ctx.db.secret.findUnique({
+        where: { ownerId_name: { ownerId: ctx.principal.id, name } },
+        select: { id: true },
+    });
+    if (!secret || (await hostProvidersUsingSecret(ctx.db, secret.id)).providers.length === 0)
+        return false;
+    requireScope(ctx, ctx.canonicalUri, "hosts:admin");
+    return true;
+}
 export function registerSecretsTools(mcp, opts) {
     mcp.registerTool({
         name: "create_secret",
         scope: "secrets:write",
-        description: 'Creates a secret. Omit "value" to enter it securely via a one-time browser link instead of passing it as a plaintext argument. Pass "broker" ({ hosts, pathPrefixes?, placement }) to make it brokered: tools can then only send it to those hosts with fetch(url, { secrets: [name] }) and can never read it. See the help article "brokered-secrets".',
+        description: 'Creates a secret. Omit "value" to enter it securely via a one-time browser link instead of passing it as a plaintext argument. Pass "broker" ({ hosts, pathPrefixes?, placement }) to make it brokered: tools can then only send it to those hosts with fetch(url, { secrets: [name] }) and can never read it. A secret a host provider uses also needs hosts:admin. See the help article "brokered-secrets".',
         inputSchema: {
             type: "object",
             properties: {
@@ -85,6 +104,7 @@ export function registerSecretsTools(mcp, opts) {
             required: ["name"],
         },
         handler: async (args, ctx) => {
+            const hostManager = await requireHostsAdminIfProviderSecret(ctx, args.name);
             const broker = args.broker === undefined ? undefined : parseBrokerArg(args.broker);
             if (args.value !== undefined) {
                 let secret;
@@ -131,6 +151,7 @@ export function registerSecretsTools(mcp, opts) {
                 secretName: args.name,
                 kind: "create",
                 ...(broker ? { broker } : {}),
+                ...(hostManager ? { hostManager } : {}),
             };
             const token = await mcp.mintRequestState(payload);
             const url = await opts.buildElicitationUrl(token);
@@ -157,7 +178,7 @@ export function registerSecretsTools(mcp, opts) {
     mcp.registerTool({
         name: "set_secret_broker",
         scope: "secrets:write",
-        description: 'Sets or changes a secret\'s broker config ({ hosts, pathPrefixes?, placement }), so tools can only send it to those hosts with fetch(url, { secrets: [name] }) and never read it. broker: null removes brokering, which must be confirmed by a person in the browser link this returns. Every change is audited. See the help article "brokered-secrets".',
+        description: 'Sets or changes a secret\'s broker config ({ hosts, pathPrefixes?, placement }), so tools can only send it to those hosts with fetch(url, { secrets: [name] }) and never read it. broker: null removes brokering, which must be confirmed by a person in the browser link this returns. Every change is audited. A secret a host provider uses also needs hosts:admin. See the help article "brokered-secrets".',
         inputSchema: {
             type: "object",
             properties: {
@@ -171,6 +192,7 @@ export function registerSecretsTools(mcp, opts) {
         },
         handler: async (args, ctx) => {
             const ownerId = ctx.principal.id;
+            const hostManager = await requireHostsAdminIfProviderSecret(ctx, args.name);
             if (args.broker !== null) {
                 const broker = parseBrokerArg(args.broker);
                 await findOwnSecret(ctx, args.name);
@@ -222,6 +244,7 @@ export function registerSecretsTools(mcp, opts) {
                 secretName: args.name,
                 kind: "unbroker",
                 brokerHash: brokerConfigHash(parseSecretBrokerConfig(secret.broker)),
+                ...(hostManager ? { hostManager } : {}),
             };
             const token = await mcp.mintRequestState(payload);
             const url = await opts.buildElicitationUrl(token);
@@ -276,6 +299,8 @@ export function registerSecretsTools(mcp, opts) {
                 await attachSecret(args.agentId, args.name, ownerId, ctx.db, args.alias ?? args.name);
             }
             catch (err) {
+                if (err instanceof Error && err.message === WEBHOOK_SECRET_ATTACHED)
+                    throw new McpError(409, err.message);
                 throw new McpError(404, err instanceof Error ? err.message : String(err));
             }
             return textResult({ attached: true });
@@ -306,6 +331,15 @@ export function registerSecretsTools(mcp, opts) {
         inputSchema: { type: "object", properties: { id: { type: "string" } }, required: ["id"] },
         handler: async (args, ctx) => {
             await requireOwnedSecret(ctx.db, args.id, ctx.principal.id);
+            const { providers } = await hostProvidersUsingSecret(ctx.db, args.id);
+            if (providers.length > 0) {
+                throw new McpError(409, `This secret is used by host provider ${providers.map((p) => `"${p}"`).join(", ")}; re-register it or delete_host_provider first.`);
+            }
+            const secret = await ctx.db.secret.findUnique({ where: { id: args.id }, select: { name: true } });
+            const servers = secret ? await mcpServersUsingSecret(ctx.db, ctx.principal.id, secret.name) : [];
+            if (servers.length > 0) {
+                throw new McpError(409, `Secret "${secret.name}" is used by MCP server(s) ${servers.join(", ")}; update or delete them first.`);
+            }
             await deleteSecret(args.id, ctx.db);
             return textResult({ deleted: args.id });
         },

package/dist/mcp/tools/tools.d.ts

@@ -21,6 +21,7 @@ export declare function projectTool(tool: Tool, principalId: string): {
     name: string;
     updatedAt: Date;
     code: string;
+    timeoutMs: number | null;
     createdAt: Date;
     id: string;
     ownerId: string | null;
@@ -28,16 +29,17 @@ export declare function projectTool(tool: Tool, principalId: string): {
     jsonSchema: import("@prisma/client/runtime/client").JsonValue;
     paramsZod: string;
 } | {
+    public: boolean;
     id: string;
     name: string;
     description: string;
-    public: boolean;
-    ownerIsCaller?: undefined;
+    timeoutMs: number | null;
 } | {
+    public: boolean;
+    ownerIsCaller: boolean;
     id: string;
     name: string;
     description: string;
-    public: boolean;
-    ownerIsCaller: boolean;
+    timeoutMs: number | null;
 };
 export declare function registerToolAuthoringTools(mcp: WardbyMcpServer): void;