pi-roundtable-sandbox 0.7.12 → 0.7.13

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.7.13
+
+- `precheckScriptRunner` forwards only the tools approved with the script (pi-roundtable 0.7.13's `PrecheckScriptContext.tools`) among those `grant` allows, and takes `toolName(server, tool)`, the name the host's hold rules know a tool by (default the tool's own name).
+
 ## 0.7.12
 
 - A host compactor gets at most half the time the turn has left (the runtime passes the broker its `deadline`, `PiHostContext.deadline`), so Pi's own summary still fits after it runs out; with under two seconds left the broker falls back to Pi's summary at once.

package/README.md

@@ -391,7 +391,8 @@ export const precheckScripts = definePlugin({
 });
 ```
 
-`grant({ channel, target })` returns the `PrecheckMcpServer`s a script for that schedule may call: `{ name, url, tools, token? }`.
+`grant({ channel, target, tier })` returns the `PrecheckMcpServer`s a script for that schedule may call: `{ name, url, tools, token? }`.
+Each run reaches only the granted tools that were approved with the script: the core reads a script's calls when it is saved, and saving one that calls a tool the host's hold rules hold waits for the owner's approval. `toolName(server, tool)` gives the name those rules know a tool by, the name the host's own agent calls it by; the default is the tool's own name, so pass it when your agent sees MCP tools under another name, such as `${server}_${tool}`.
 The script calls a server by `name`, only the listed `tools`, and only with single `tools/call` requests; every other server, tool, method, query, and extra credential is refused, and refused calls count against the run's budget (`maxCalls`, default 16).
 `url` is a fixed HTTPS Streamable HTTP endpoint answering with JSON or one SSE event; `token` is read on the host for each call and inserted by the broker. An answer that carries it, plainly, inside JSON text, or base64-encoded, is refused; this catches an echo, not an upstream set on leaking it, so grant only upstreams you trust.
 Calls run one at a time; a second call while one is pending is refused.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-roundtable-sandbox",
-	"version": "0.7.12",
+	"version": "0.7.13",
 	"description": "Sealed guest channels and an allow-listed credential broker for pi-roundtable",
 	"type": "module",
 	"license": "MIT",
@@ -52,7 +52,7 @@
 		"@biomejs/biome": "2.5.15",
 		"@types/bun": "1.4.2",
 		"discord.js": "14.27.0",
-		"pi-roundtable": "0.7.12",
+		"pi-roundtable": "0.7.13",
 		"typebox": "1.3.34",
 		"typescript": "7.0.2"
 	}

package/src/precheck-runner.ts

@@ -51,6 +51,12 @@ export interface PrecheckScriptRunnerOptions {
 	grant(
 		scope: PrecheckScope,
 	): readonly PrecheckMcpServer[] | Promise<readonly PrecheckMcpServer[]>;
+	/**
+	 * The name the host's hold rules know `mcp.call(server, tool)` by, which is the name its own
+	 * agent calls that tool by; default `tool` itself. A script calling a tool the rules hold needs
+	 * the owner's approval to be saved.
+	 */
+	toolName?: (server: string, tool: string) => string;
 	/** The container's command; default the package's worker in the Pi image's layout. */
 	entrypoint?: readonly string[];
 	/** How long a script may run; default 60 seconds. */
@@ -286,6 +292,7 @@ function guide(servers: readonly PrecheckMcpServer[]): string {
 		"`result` is `{ wake: false, note? }` to skip the turn (the note, if any, is posted in small text) or `{ wake: true, context }` to wake you with `context`. Anything else, a throw, or running too long wakes you with the error.",
 		"`today` is the date in the host's time zone (YYYY-MM-DD); pass it to tools instead of computing dates in UTC. `firedAt` is a Date and `timeZone` an IANA zone.",
 		"Await each call before making the next; calls do not run in parallel. console output is discarded; only the returned result counts.",
+		'Write each call as mcp.call("server", "tool", args) or mcp.json(...), with server and tool as strings: the host reads them when the script is saved, and each run may call only those. A script that calls a tool needing the owner\'s approval waits for it when saved, once.',
 		"`await mcp.call(server, tool, args)` returns the MCP tool result; `await mcp.json(server, tool, args)` returns its structured content, or its first text content parsed as JSON. A tool error throws.",
 		"The script runs in a container with no network, no files of the host, and no credentials; it reaches only the tools below.",
 		reach,
@@ -315,6 +322,7 @@ export function precheckScriptRunner(
 			? {}
 			: { timeoutMs: options.timeoutMs }),
 		describe: async (scope) => guide(await grant(scope)),
+		toolName: options.toolName ?? ((_server, tool) => tool),
 		run: async (script, context) => runOne(script, context),
 	};
 
@@ -323,10 +331,21 @@ export function precheckScriptRunner(
 		context: PrecheckScriptContext,
 	): Promise<PrecheckResult> {
 		const { schedule, signal } = context;
-		const servers = await grant({
-			channel: schedule.channel,
-			target: schedule.target,
-			tier: schedule.createdTier,
+		// Only what the grant allows and the owner approved with the script: the broker refuses the rest.
+		const approved = new Set(
+			context.tools.map(({ server, tool }) => `${server}\u0000${tool}`),
+		);
+		const servers = (
+			await grant({
+				channel: schedule.channel,
+				target: schedule.target,
+				tier: schedule.createdTier,
+			})
+		).flatMap((server) => {
+			const tools = server.tools.filter((tool) =>
+				approved.has(`${server.name}\u0000${tool}`),
+			);
+			return tools.length > 0 ? [{ ...server, tools }] : [];
 		});
 		const dirs: string[] = [];
 		let listener: Awaited<ReturnType<typeof listenBroker>> | undefined;