wolfpack-mcp 1.0.78 → 1.0.80

package/dist/agentBuilderTools.js

@@ -116,7 +116,8 @@ export const AGENT_BUILDER_TOOLS = [
         description: 'Create an alias of an agent, so the same definition can run work in parallel. ' +
             'An agent runs one session at a time, so N concurrent workers means N aliases. ' +
             'The alias live-tracks the source for container image, prompts, instructions, LLM, tools, skills and tasks — edit those once on the source. ' +
-            'It does NOT inherit project assignment, API key permissions, secrets or schedules: set those on the alias afterwards, or it will start with a read-only key and no repository. ' +
+            'It does NOT inherit project assignment, API key permissions or schedules: set those on the alias afterwards, or it will start with a read-only key and no repository. ' +
+            'Secrets are inherited only when marked shared_with_aliases on the source (same-org only); an alias-local secret of the same name overrides. ' +
             'Aliases are auto-named from the source (e.g. "Coder (2)"). You cannot alias an alias.',
         inputSchema: {
             type: 'object',
@@ -714,16 +715,21 @@ export const AGENT_BUILDER_TOOLS = [
     {
         name: 'set_agent_secret',
         description: 'Create or update a secret for an agent. ' +
-            'Name must be uppercase letters, digits, and underscores (e.g. MY_API_KEY).',
+            'Name must be uppercase letters, digits, and underscores (e.g. MY_API_KEY). ' +
+            'Omit value to change only shared_with_aliases on an existing secret.',
         inputSchema: {
             type: 'object',
             properties: {
                 agent_id: { type: 'string', description: 'Agent profile ID' },
                 name: { type: 'string', description: 'Secret name (e.g. MY_API_KEY)' },
                 value: { type: 'string', description: 'Secret value (encrypted at rest)' },
+                shared_with_aliases: {
+                    type: 'boolean',
+                    description: 'Share with same-org aliases of this agent (default false)',
+                },
                 ...ORG_SLUG_PROP,
             },
-            required: ['agent_id', 'name', 'value'],
+            required: ['agent_id', 'name'],
         },
     },
     // ─── Group 7: Discovery ───────────────────────────────────────────────────
@@ -1315,11 +1321,12 @@ export async function handleAgentBuilderTool(name, args, client) {
                 .object({
                 agent_id: z.string(),
                 name: z.string(),
-                value: z.string(),
+                value: z.string().optional(),
+                shared_with_aliases: z.boolean().optional(),
                 org_slug: orgSlugField,
             })
                 .parse(args);
-            const secret = await client.setAgentSecret(parsed.agent_id, parsed.name, parsed.value, resolveOrg(parsed));
+            const secret = await client.setAgentSecret(parsed.agent_id, parsed.name, parsed.value, parsed.shared_with_aliases, resolveOrg(parsed));
             return { content: [{ type: 'text', text: `Set secret "${secret.name}"` }] };
         }
         // ─── Discovery ────────────────────────────────────────────────────────────

package/dist/agentMemoryTools.test.js

@@ -0,0 +1,19 @@
+import { describe, it, expect } from 'vitest';
+import { AGENT_SELF_TOOLS, AGENT_MEMORY_TOOLS } from './agentSelfTools.js';
+const names = (tools) => tools.map((t) => t.name);
+describe('agent self and memory tool split (#1776)', () => {
+    it('keeps the memory tools out of the self tools, so they can be withheld separately', () => {
+        expect(names(AGENT_SELF_TOOLS)).toEqual(['get_self', 'get_own_sessions']);
+    });
+    it('groups every memory tool under the separately gated set', () => {
+        expect(names(AGENT_MEMORY_TOOLS).sort()).toEqual([
+            'get_memory',
+            'list_memories',
+            'save_memory',
+        ]);
+    });
+    it('never lists the same tool twice', () => {
+        const all = [...names(AGENT_SELF_TOOLS), ...names(AGENT_MEMORY_TOOLS)];
+        expect(new Set(all).size).toBe(all.length);
+    });
+});

package/dist/agentSelfTools.js

@@ -23,6 +23,12 @@ export const AGENT_SELF_TOOLS = [
             },
         },
     },
+];
+/**
+ * Memory tools, gated by the `agent_memory` capability so an agent whose
+ * memory is disabled (#1776) is never offered them.
+ */
+export const AGENT_MEMORY_TOOLS = [
     {
         name: 'list_memories',
         description: 'List all your persistent memory entries. Memory persists across sessions and is scoped to you. ' +

package/dist/apiClient.js

@@ -1,4 +1,4 @@
-import fetch from 'node-fetch';
+import { fetch } from './proxyFetch.js';
 import { config } from './config.js';
 export class ApiError extends Error {
     status;

package/dist/client.js

@@ -762,8 +762,12 @@ export class WolfpackClient {
     async listAgentSecrets(agentId, orgSlug) {
         return this.api.get(this.withOrgSlug(`/agents/${agentId}/secrets`, orgSlug));
     }
-    async setAgentSecret(agentId, name, value, orgSlug) {
-        return this.api.post(this.withOrgSlug(`/agents/${agentId}/secrets`, orgSlug), { name, value });
+    async setAgentSecret(agentId, name, value, sharedWithAliases, orgSlug) {
+        return this.api.post(this.withOrgSlug(`/agents/${agentId}/secrets`, orgSlug), {
+            name,
+            value,
+            sharedWithAliases,
+        });
     }
     // ─── Agent Builder: Skills (write) ────────────────────────────────────────
     async createSkill(body, orgSlug) {

package/dist/index.js

@@ -11,8 +11,9 @@ import { allTasksChecked, getWorkItemReminders } from './workItemReminders.js';
 import { validateConfig, config } from './config.js';
 import { AGENT_BUILDER_TOOLS, handleAgentBuilderTool } from './agentBuilderTools.js';
 import { PROCEDURE_TOOLS, handleProcedureTool } from './procedureTools.js';
-import { AGENT_SELF_TOOLS, handleAgentSelfTool } from './agentSelfTools.js';
+import { AGENT_SELF_TOOLS, AGENT_MEMORY_TOOLS, handleAgentSelfTool } from './agentSelfTools.js';
 import { resolveRadarItemId } from './resolveRadarItemId.js';
+import { fetch as proxyFetch } from './proxyFetch.js';
 // Get current package version
 const require = createRequire(import.meta.url);
 const packageJson = require('../package.json');
@@ -21,7 +22,10 @@ const PACKAGE_NAME = packageJson.name;
 // Check for updates from npm registry
 async function checkForUpdates() {
     try {
-        const response = await fetch(`https://registry.npmjs.org/${PACKAGE_NAME}/latest`, {
+        // proxyFetch, not global fetch: in a restricted container the registry is
+        // only reachable through the proxy, and a direct attempt just stalls until
+        // the timeout on every start (#1793).
+        const response = await proxyFetch(`https://registry.npmjs.org/${PACKAGE_NAME}/latest`, {
             headers: { Accept: 'application/json' },
             signal: AbortSignal.timeout(5000), // 5 second timeout
         });
@@ -754,6 +758,8 @@ class WolfpackMCPServer {
                             'AGENTS: unless granted the mcp:work_items:read_all permission, your results are always ' +
                             'narrowed to items assigned to you or routed to a work pool you belong to, whatever ' +
                             'assigned_to_id you pass; the response says so when this applies. ' +
+                            'AGENTS: when more than one item is claimable, the response also states the order to take ' +
+                            'them in (bug fixes first, then higher priority, then oldest) and which to pull next. ' +
                             'TERMINOLOGY: "board" and "kanban" are synonymous - both refer to the Kanban board of work items. ' +
                             'The board has columns: "new" (to do), "doing" (in progress), "review" (pending review), "ready" (code done, awaiting deployment), "blocked", "completed" (deployed). ' +
                             'The "backlog" or "pending" status represents items not yet on the board. ' +
@@ -982,6 +988,8 @@ class WolfpackMCPServer {
                             'agent and will return 403: ask a human to route it to your pool or assign it to you. ' +
                             'AGENTS: pulling puts the item straight into "doing" — you are taking it to start on it ' +
                             'now — so there is no separate "move it to doing" step. Move it to "review" when done. ' +
+                            'AGENTS: with more than one item claimable, take them in the order list_work_items gives ' +
+                            'you: bug fixes first, then higher priority, then oldest. ' +
                             'If no assignee is specified, assigns to the API key owner. ' +
                             'In personal projects, items are always assigned to the owner.',
                         inputSchema: {
@@ -2036,6 +2044,7 @@ class WolfpackMCPServer {
                     },
                     ...(this.capabilities.includes('procedures') ? PROCEDURE_TOOLS : []),
                     ...(this.capabilities.includes('agent_self') ? AGENT_SELF_TOOLS : []),
+                    ...(this.capabilities.includes('agent_memory') ? AGENT_MEMORY_TOOLS : []),
                     ...(this.capabilities.includes('agent_builder') ? AGENT_BUILDER_TOOLS : []),
                 ],
             };
@@ -2961,6 +2970,13 @@ class WolfpackMCPServer {
                                 return handleAgentSelfTool(name, args, this.client);
                             }
                         }
+                        // Check memory tools (separately gated — #1776)
+                        if (this.capabilities.includes('agent_memory')) {
+                            const memoryToolNames = AGENT_MEMORY_TOOLS.map((t) => t.name);
+                            if (memoryToolNames.includes(name)) {
+                                return handleAgentSelfTool(name, args, this.client);
+                            }
+                        }
                         // Check agent builder tools
                         if (this.capabilities.includes('agent_builder')) {
                             return handleAgentBuilderTool(name, args, this.client);

package/dist/proxyFetch.js

@@ -0,0 +1,61 @@
+import nodeFetch from 'node-fetch';
+import { HttpProxyAgent } from 'http-proxy-agent';
+import { HttpsProxyAgent } from 'https-proxy-agent';
+/**
+ * Whether a host is exempted from proxying by NO_PROXY. Entries match the host
+ * exactly or as a domain suffix (`.example.com`, or bare `example.com` for its
+ * subdomains); `*` exempts everything.
+ */
+export function bypassesProxy(hostname, noProxy) {
+    if (!noProxy)
+        return false;
+    const host = hostname.toLowerCase();
+    return noProxy
+        .split(',')
+        .map((entry) => entry.trim().toLowerCase())
+        .filter(Boolean)
+        .some((entry) => {
+        if (entry === '*')
+            return true;
+        const suffix = entry.startsWith('.') ? entry : `.${entry}`;
+        return host === entry.replace(/^\./, '') || host.endsWith(suffix);
+    });
+}
+/** The proxy URL that applies to a target, or null to connect directly. */
+export function proxyForUrl(target, env = process.env) {
+    if (bypassesProxy(target.hostname, env.NO_PROXY ?? env.no_proxy))
+        return null;
+    const proxy = target.protocol === 'https:'
+        ? (env.HTTPS_PROXY ?? env.https_proxy ?? env.HTTP_PROXY ?? env.http_proxy)
+        : (env.HTTP_PROXY ?? env.http_proxy);
+    return proxy || null;
+}
+const agents = new Map();
+function agentFor(target) {
+    const proxy = proxyForUrl(target);
+    if (!proxy)
+        return undefined;
+    const key = `${target.protocol}${proxy}`;
+    let agent = agents.get(key);
+    if (!agent) {
+        agent = target.protocol === 'https:' ? new HttpsProxyAgent(proxy) : new HttpProxyAgent(proxy);
+        agents.set(key, agent);
+    }
+    return agent;
+}
+/**
+ * `node-fetch` with the proxy from the environment applied.
+ *
+ * node-fetch does not read HTTP_PROXY/HTTPS_PROXY on its own, so inside a
+ * restricted agent container this client connected direct to the backend —
+ * which has no route out and no DNS, the container's only permitted egress
+ * being the Squid proxy (#1793). Agents are cached per origin, and requests
+ * are unaffected when no proxy variables are set.
+ */
+export function fetch(url, init = {}) {
+    if (init.agent !== undefined)
+        return nodeFetch(url, init);
+    const target = new URL(typeof url === 'string' ? url : url.url);
+    return nodeFetch(url, { ...init, agent: agentFor(target) });
+}
+export default fetch;

package/dist/proxyFetch.test.js

@@ -0,0 +1,67 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { createServer } from 'node:http';
+import { once } from 'node:events';
+import { bypassesProxy, fetch, proxyForUrl } from './proxyFetch.js';
+const port = (server) => server.address().port;
+describe('bypassesProxy', () => {
+    it('exempts an exact host and its subdomains, on a dot boundary only', () => {
+        expect(bypassesProxy('localhost', 'localhost,127.0.0.1')).toBe(true);
+        expect(bypassesProxy('api.example.com', '.example.com')).toBe(true);
+        expect(bypassesProxy('example.com', 'example.com')).toBe(true);
+        expect(bypassesProxy('notexample.com', 'example.com')).toBe(false);
+        expect(bypassesProxy('wolfpacks.work', 'localhost,127.0.0.1')).toBe(false);
+    });
+    it('treats * as exempting everything, and no NO_PROXY as exempting nothing', () => {
+        expect(bypassesProxy('wolfpacks.work', '*')).toBe(true);
+        expect(bypassesProxy('wolfpacks.work', undefined)).toBe(false);
+    });
+});
+describe('proxyForUrl', () => {
+    it('prefers HTTPS_PROXY for https and falls back to HTTP_PROXY', () => {
+        const env = { HTTPS_PROXY: 'http://s:1', HTTP_PROXY: 'http://p:2' };
+        expect(proxyForUrl(new URL('https://wolfpacks.work/api'), env)).toBe('http://s:1');
+        expect(proxyForUrl(new URL('http://wolfpacks.work/api'), env)).toBe('http://p:2');
+        expect(proxyForUrl(new URL('https://wolfpacks.work/api'), { HTTP_PROXY: 'http://p:2' })).toBe('http://p:2');
+    });
+    it('returns null for a NO_PROXY host and when no proxy is configured', () => {
+        expect(proxyForUrl(new URL('http://localhost:3001/api'), {
+            NO_PROXY: 'localhost',
+            HTTP_PROXY: 'http://p:1',
+        })).toBeNull();
+        expect(proxyForUrl(new URL('https://wolfpacks.work/api'), {})).toBeNull();
+    });
+});
+describe('fetch', () => {
+    let proxy;
+    let seen;
+    beforeEach(async () => {
+        seen = [];
+        proxy = createServer((req, res) => {
+            seen.push(req.url ?? '');
+            res.writeHead(200, { 'content-type': 'application/json' });
+            res.end('{"proxied":true}');
+        });
+        proxy.listen(0);
+        await once(proxy, 'listening');
+    });
+    afterEach(() => {
+        proxy.close();
+        delete process.env.HTTP_PROXY;
+        delete process.env.NO_PROXY;
+    });
+    // Regression test for #1793: node-fetch does not read the proxy variables,
+    // so inside a restricted container this client connected direct to a backend
+    // it had neither a route to nor DNS for.
+    it('sends the request to the proxy, for a host it cannot itself resolve', async () => {
+        process.env.HTTP_PROXY = `http://127.0.0.1:${port(proxy)}`;
+        const res = await fetch('http://nowhere.invalid/api/mcp/work-items');
+        expect(res.status).toBe(200);
+        expect(seen).toEqual(['http://nowhere.invalid/api/mcp/work-items']);
+    });
+    it('connects direct when no proxy is configured', async () => {
+        const res = await fetch(`http://127.0.0.1:${port(proxy)}/direct`);
+        expect(res.status).toBe(200);
+        // Reached the server as an origin request, not as a proxy request
+        expect(seen).toEqual(['/direct']);
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wolfpack-mcp",
-  "version": "1.0.78",
+  "version": "1.0.80",
   "description": "MCP server for Wolfpack AI-enhanced software delivery tools",
   "main": "dist/index.js",
   "type": "module",
@@ -35,6 +35,8 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.26.0",
+    "http-proxy-agent": "^7.0.2",
+    "https-proxy-agent": "^7.0.6",
     "node-fetch": "^3.3.2",
     "yaml": "^2.8.0",
     "zod": "^3.24.1"