dreadnode 2.0.42__tar.gz → 2.0.43__tar.gz

{dreadnode-2.0.42 → dreadnode-2.0.43}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: dreadnode
-Version: 2.0.42
+Version: 2.0.43
 Summary: Dreadnode SDK
 Project-URL: Homepage, https://dreadnode.io
 Project-URL: Documentation, https://docs.dreadnode.io

{dreadnode-2.0.42 → dreadnode-2.0.43}/dreadnode/agents/agent.py

@@ -710,6 +710,8 @@ class Agent(Executor[AgentEvent, Trajectory]):
         self, tool_call: "ToolCall", step_count: int
     ) -> t.AsyncGenerator[AgentEvent, None]:
         """Process a single tool call with its own span."""
+        tool = next((t for t in self.all_tools if t.wire_name == tool_call.name), None)
+        redact_telemetry = tool is not None and tool.source == "command"
         with dreadnode.task_span(
             f"tool:{tool_call.name}",
             type="tool",
@@ -721,13 +723,12 @@ class Agent(Executor[AgentEvent, Trajectory]):
                 agent_name=self.name,
                 status="running",
                 tool_call=tool_call,
+                redact_telemetry=redact_telemetry,
             )
             start_event.emit(t_span)
             async for event in self._dispatch(start_event):
                 yield event
 
-            tool = next((t for t in self.all_tools if t.wire_name == tool_call.name), None)
-
             if tool is None:
                 error_msg = f"Tool '{tool_call.name}' not found."
                 logger.warning(error_msg)
@@ -791,6 +792,7 @@ class Agent(Executor[AgentEvent, Trajectory]):
                     error_type=tool_error_type,
                     cost_usd=tool_cost_usd,
                     policy_decision=start_event.policy_decision,
+                    redact_telemetry=redact_telemetry,
                 )
                 async for event in self._dispatch(end_event):
                     yield event

{dreadnode-2.0.42 → dreadnode-2.0.43}/dreadnode/agents/events.py

@@ -457,6 +457,7 @@ class ToolStart(AgentEvent):
 
     tool_call: ToolCall
     policy_decision: dict[str, t.Any] | None = None
+    redact_telemetry: bool = Field(default=False, exclude=True)
 
     def _get_data(self) -> dict[str, t.Any]:
         try:
@@ -480,14 +481,15 @@ class ToolStart(AgentEvent):
         span.set_attribute(TOOL_ATTRIBUTE_NAME, self.tool_call.name)
         span.set_attribute(TOOL_ATTRIBUTE_CALL_ID, self.tool_call.id)
 
-        # Parse and set arguments
-        try:
-            args = json.loads(self.tool_call.function.arguments)
-        except (json.JSONDecodeError, TypeError):
-            args = self.tool_call.function.arguments
+        if not self.redact_telemetry:
+            # Parse and set arguments
+            try:
+                args = json.loads(self.tool_call.function.arguments)
+            except (json.JSONDecodeError, TypeError):
+                args = self.tool_call.function.arguments
 
-        span.set_attribute(TOOL_ATTRIBUTE_ARGUMENTS, args)
-        span.log_input("arguments", args)
+            span.set_attribute(TOOL_ATTRIBUTE_ARGUMENTS, args)
+            span.log_input("arguments", args)
 
         super().emit(span)
 
@@ -544,11 +546,12 @@ class ToolEnd(AgentEvent):
     error: str | None = None
     error_type: str | None = None
     cost_usd: float | None = None
-    policy_decision: dict[str, t.Any] | None = None
     """Estimated USD cost contributed by this tool call, when the tool
     ran an internal LLM (e.g. ``spawn_agent``). ``None`` for ordinary
     tools — the TUI only accumulates this into the sub-agent cost
     display, never the main session cost."""
+    policy_decision: dict[str, t.Any] | None = None
+    redact_telemetry: bool = Field(default=False, exclude=True)
 
     def _get_data(self) -> dict[str, t.Any]:
         return {
@@ -571,13 +574,13 @@ class ToolEnd(AgentEvent):
 
     def emit(self, span: "TaskSpan") -> None:
         # Attributes
-        if self.result:
+        if self.result and not self.redact_telemetry:
             span.set_attribute(TOOL_ATTRIBUTE_RESULT, self.result)
             span.log_output("result", self.result)
 
         span.set_attribute(TOOL_ATTRIBUTE_STOPPED, self.stop)
 
-        if self.error:
+        if self.error and not self.redact_telemetry:
             span.set_attribute(TOOL_ATTRIBUTE_ERROR, self.error)
             span.log_metric(f"tool/{self.tool_call.name}/error", 1)
 

{dreadnode-2.0.42 → dreadnode-2.0.43}/dreadnode/agents/tools.py

@@ -201,7 +201,7 @@ async def offload_tool_output(
     return truncated, file_path
 
 
-ToolSource = t.Literal["builtin", "python", "mcp", "synthetic", "bundled"]
+ToolSource = t.Literal["builtin", "python", "command", "mcp", "synthetic", "bundled"]
 """The origin of a tool. See CAP-IDENT-001 in specs/capabilities/runtime.md."""
 
 _WIRE_NAME_MAX = 64

{dreadnode-2.0.42 → dreadnode-2.0.43}/dreadnode/airt/compliance/owasp_agentic.py

@@ -128,6 +128,8 @@ OWASP_AGENTIC_CAPABILITY_MAP: dict[OWASPAgenticCategory, dict[str, list[str]]] =
             "indirect_injection_success",
             "echo_chamber_detected",
             "sycophancy_detected",
+            "visual_injection_followed",
+            "navigation_hijacked",
         ],
         "rubrics": ["goal_hijacking"],
     },
@@ -144,6 +146,8 @@ OWASP_AGENTIC_CAPABILITY_MAP: dict[OWASPAgenticCategory, dict[str, list[str]]] =
             "tool_description_poisoned",
             "implicit_tool_poison_detected",
             "tool_output_injected",
+            "clickfix_executed",
+            "domain_validation_bypassed",
         ],
         "rubrics": ["tool_selection_safety", "tool_chaining"],
     },
@@ -166,6 +170,9 @@ OWASP_AGENTIC_CAPABILITY_MAP: dict[OWASPAgenticCategory, dict[str, list[str]]] =
             "markdown_exfil_detected",
             "dns_exfil_detected",
             "unicode_exfil_detected",
+            "ssrf_exfil_detected",
+            "search_query_exfil_detected",
+            "trusted_domain_exfil_detected",
         ],
         "rubrics": [],
     },

{dreadnode-2.0.42 → dreadnode-2.0.43}/dreadnode/app/cli/evaluation.py

@@ -29,10 +29,12 @@ from dreadnode.app.cli.shared import (
     confirm_destructive,
     console,
     merge_env_model_overrides,
+    parse_egress_targets,
     parse_env_model_overrides,
     print_link,
 )
 from dreadnode.app.model_catalog import resolve_model
+from dreadnode.packaging.egress import merge_targets as merge_egress_targets
 
 cli = cyclopts.App(
     name="evaluation",
@@ -724,6 +726,23 @@ def create(
             negative_iterable=(),
         ),
     ] = None,
+    egress: t.Annotated[
+        list[str] | None,
+        cyclopts.Parameter(
+            name="--egress",
+            help=(
+                "Additional outbound destination for this run's sandboxes "
+                "(e.g. --egress staging.example.com, --egress '*.internal.corp', "
+                "--egress 10.20.0.0/16; repeatable). Targets union with the "
+                "task's own egress.allow and are checked against the "
+                "deployment's egress floor identically, so they grant no reach "
+                "a task declaration could not. Supplying any target makes this "
+                "run a declaration, restricting it to what is named plus the "
+                "platform destinations the platform derives."
+            ),
+            negative_iterable=(),
+        ),
+    ] = None,
     wait: t.Annotated[bool, cyclopts.Parameter(negative=())] = False,
     poll_interval_sec: t.Annotated[
         float,
@@ -775,6 +794,12 @@ def create(
             applies as a wall-clock bound.
         cleanup_policy: Sandbox cleanup policy.
         judge_model: Override the judge model for all tasks in this evaluation.
+        egress: Additional outbound destination for this run's sandboxes, as an
+            FQDN, a '*.suffix' wildcard, an IP, or a CIDR (repeatable). Unions
+            with the task's own `egress.allow` and is checked against the
+            deployment's egress floor identically. Supplying any target makes
+            this run a declaration, restricting it to what is named plus the
+            platform destinations the platform derives.
         wait: Block until the evaluation reaches a terminal state.
         poll_interval_sec: Seconds between status polls when --wait is set.
         timeout_sec: Maximum seconds to wait before timing out.
@@ -818,6 +843,17 @@ def create(
     if merged_env_models is not None:
         request["model_overrides"] = merged_env_models
 
+    # TSK-EGR-007: --egress adds to any egress_overrides block from --file
+    # rather than replacing it, the same way --env-model merges per role.
+    # Both sides are validated here so a bad target is named before the round
+    # trip, whichever of the two the author wrote it in.
+    merged_egress = merge_egress_targets(
+        parse_egress_targets(request.get("egress_overrides"), where="egress_overrides"),
+        parse_egress_targets(egress),
+    )
+    if merged_egress is not None:
+        request["egress_overrides"] = merged_egress
+
     if not request.get("name"):
         raise ValueError(
             "dn evaluation create requires a name. Pass one positionally or in --file."
@@ -1494,10 +1530,12 @@ def retry(
     as_json: t.Annotated[bool, cyclopts.Parameter(name="--json", negative=())] = False,
     platform: PlatformScopeArgs = PlatformScopeArgs(),
 ) -> None:
-    """Retry failed and errored samples in an evaluation.
+    """Retry failed samples in an evaluation.
 
-    Resets samples that ended in failed, timed_out, or infra_error
-    back to queued so they are picked up by workers again.
+    Resets samples that ended in failed, timed_out, cancelled, or infra_error
+    back to queued so they are picked up by workers again. Samples whose judge
+    errored are not requeued: rerunning the agent would produce a different
+    trajectory.
 
     Args:
         evaluation_id: The evaluation ID.

{dreadnode-2.0.42 → dreadnode-2.0.43}/dreadnode/app/cli/runtime.py

@@ -7,10 +7,11 @@ from pathlib import Path
 import cyclopts
 import yaml
 
-from dreadnode.app.api.client import NotFoundError
+from dreadnode.app.api.client import ConflictError, NotFoundError
 from dreadnode.app.cli.args import PlatformScopeArgs
 from dreadnode.app.cli.shared import (
     _FLAG_STATE,
+    _LABEL_W,
     _collect_cursor_pages,
     _hint,
     _render,
@@ -19,9 +20,11 @@ from dreadnode.app.cli.shared import (
     _status_color,
     confirm_destructive,
     console,
+    parse_egress_targets,
     print_info,
     print_success,
 )
+from dreadnode.packaging.egress import merge_targets, normalize_declaration
 
 RuntimeStatus = t.Literal["idle", "running", "paused"]
 
@@ -217,6 +220,35 @@ def _split_runtime_manifest(
     return identity, (config or None)
 
 
+def _apply_egress_targets(
+    config: dict[str, t.Any] | None,
+    cli_targets: list[str] | None,
+) -> dict[str, t.Any] | None:
+    """Merge ``--egress`` targets into ``sandbox.egress.allow`` (`RT-SBX-006`).
+
+    Also validates a ``sandbox.egress`` block loaded from ``runtime.yaml``, so a
+    malformed target is named here rather than after a round trip.
+
+    Absent stays absent (`RT-SBX-009`): with no declaration on either side the
+    sandbox inherits the operator's floor unchanged, which is not the same as
+    an empty allow list restricting it to the platform's own destinations.
+    """
+    sandbox_raw = (config or {}).get("sandbox")
+    if sandbox_raw is not None and not isinstance(sandbox_raw, dict):
+        raise TypeError("runtime.yaml sandbox must be a mapping")
+
+    declared = normalize_declaration((sandbox_raw or {}).get("egress"))
+    merged = merge_targets(declared, cli_targets)
+    if merged is None:
+        return config
+
+    updated = dict(config or {})
+    sandbox = dict(sandbox_raw or {})
+    sandbox["egress"] = {"allow": merged}
+    updated["sandbox"] = sandbox
+    return updated
+
+
 def _coalesce_manifest_value(
     explicit: str | None,
     manifest_identity: dict[str, t.Any],
@@ -365,12 +397,30 @@ def create(
         Path | None,
         cyclopts.Parameter(name="--file", help="Load runtime.yaml from a file or directory."),
     ] = None,
+    egress: t.Annotated[
+        list[str] | None,
+        cyclopts.Parameter(
+            name="--egress",
+            help=(
+                "Outbound destination this runtime's sandbox may reach "
+                "(e.g. --egress target.example.com, --egress '*.internal.corp', "
+                "--egress 10.20.0.0/16; repeatable). Adds to any "
+                "sandbox.egress.allow from --file. A declaration can only "
+                "narrow what the deployment already permits, and declaring "
+                "anything restricts the sandbox to what is named plus the "
+                "platform destinations the platform derives. Pass "
+                "--empty-egress to declare a scope that names nothing, "
+                "restricting the sandbox to the platform destinations alone."
+            ),
+        ),
+    ] = None,
     as_json: t.Annotated[bool, cyclopts.Parameter(name="--json", negative=())] = False,
     platform: PlatformScopeArgs = PlatformScopeArgs(),
 ) -> None:
     """Ensure a runtime exists for a project or the workspace default project.
 
     Idempotent — re-running against an existing runtime returns it unchanged.
+    Re-running with a *different* config is a conflict, not an update.
 
     Args:
         project_ref: Project key or UUID. Defaults to the active project scope,
@@ -379,6 +429,10 @@ def create(
         name: Runtime display name. Required with --key when no project is resolved.
         description: Optional runtime description.
         file: Load runtime.yaml from a file or directory.
+        egress: Outbound destination this runtime's sandbox may reach, as an
+            FQDN, a '*.suffix' wildcard, an IP, or a CIDR (repeatable). Adds to
+            any `sandbox.egress.allow` from --file. Narrowing only, so it needs
+            no permission beyond owning the runtime.
         as_json: Output as JSON.
     """
     api, profile = platform.connect()
@@ -386,6 +440,7 @@ def create(
     manifest_config: dict[str, t.Any] | None = None
     if file is not None:
         manifest_identity, manifest_config = _split_runtime_manifest(api, file)
+    manifest_config = _apply_egress_targets(manifest_config, parse_egress_targets(egress))
 
     resolved_project = (
         project_ref
@@ -414,12 +469,23 @@ def create(
     if manifest_config is not None:
         create_kwargs["config"] = manifest_config
 
-    payload = api.create_runtime(
-        profile.org_key,
-        profile.workspace_key,
-        resolved_project,
-        **create_kwargs,
-    )
+    try:
+        payload = api.create_runtime(
+            profile.org_key,
+            profile.workspace_key,
+            resolved_project,
+            **create_kwargs,
+        )
+    except ConflictError as exc:
+        # The runtime exists with a different configuration. Create is ensure,
+        # not update, so say where updates go rather than leaving the user
+        # to re-run the same command.
+        runtime_ref = resolved_key or "<runtime-id>"
+        raise ConflictError(
+            f"{exc} To change a runtime's configuration, run "
+            f"`dn runtime config-set {runtime_ref} --egress <target>` or "
+            f"`dn runtime config-set {runtime_ref} --file runtime.yaml`."
+        ) from exc
     if as_json:
         _render(payload, as_json=True, summary=_summarize_runtime)
         return
@@ -699,3 +765,161 @@ def reset(
         return
     _print_lifecycle_result(str(result.get("id", runtime_id)), "reset", "red")
     _hint(f"dn runtime start {runtime_id}")
+
+
+# ---------------------------------------------------------------------------
+# Durable configuration (RT-API-023 / RT-API-024)
+# ---------------------------------------------------------------------------
+
+
+def _summarize_runtime_config(payload: dict[str, t.Any]) -> str:
+    config = payload.get("config") or {}
+    sandbox = config.get("sandbox") or {}
+    egress = sandbox.get("egress")
+
+    if egress is None:
+        # RT-SBX-009: absent is not empty. Say which one this is, because the
+        # difference decides whether the sandbox inherits the deployment's
+        # floor or is restricted to the platform's own destinations.
+        egress_line = "[dim]inherits the deployment's floor[/dim]"
+    else:
+        allowed = egress.get("allow") or []
+        egress_line = (
+            ", ".join(str(target) for target in allowed)
+            if allowed
+            else "[dim]declared, names nothing (platform destinations only)[/dim]"
+        )
+
+    capabilities = config.get("capabilities") or []
+    return "\n".join(
+        [
+            f"[dim]{'runtime':<{_LABEL_W}}[/dim]{payload.get('runtime_id', 'unknown')}",
+            f"[dim]{'version':<{_LABEL_W}}[/dim]{config.get('version', 'unknown')}",
+            f"[dim]{'capabilities':<{_LABEL_W}}[/dim]{len(capabilities)}",
+            f"[dim]{'egress':<{_LABEL_W}}[/dim]{egress_line}",
+            f"[dim]{'digest':<{_LABEL_W}}[/dim]{payload.get('config_digest', 'unknown')}",
+        ]
+    )
+
+
+@cli.command(name="config-get", alias="config")
+def config_get(
+    runtime_id: t.Annotated[str, cyclopts.Parameter(name="runtime-id")],
+    *,
+    as_json: t.Annotated[bool, cyclopts.Parameter(name="--json", negative=())] = False,
+    platform: PlatformScopeArgs = PlatformScopeArgs(),
+) -> None:
+    """Show a runtime's durable configuration.
+
+    Workspace read access is enough to read a config; only the owner may
+    replace one. Use --json for the full document — the summary shows the
+    fields with a CLI surface.
+
+    Args:
+        runtime_id: Runtime key or UUID, as shown by `dn runtime list`.
+        as_json: Output as JSON.
+    """
+    api, profile = platform.connect()
+    payload = api.get_runtime_config(profile.org_key, profile.workspace_key, runtime_id)
+    _render(payload, as_json=as_json, summary=_summarize_runtime_config)
+    if not as_json:
+        _hint(f"dn runtime config-set {runtime_id} --egress <target>")
+
+
+@cli.command(name="config-set")
+def config_set(
+    runtime_id: t.Annotated[str, cyclopts.Parameter(name="runtime-id")],
+    *,
+    file: t.Annotated[
+        Path | None,
+        cyclopts.Parameter(
+            name="--file",
+            help=(
+                "Replace the whole configuration with this runtime.yaml. "
+                "Wholesale, not a merge: a field the file omits is reset to "
+                "its default. Without --file the stored configuration is "
+                "edited in place and every other field is preserved."
+            ),
+        ),
+    ] = None,
+    egress: t.Annotated[
+        list[str] | None,
+        cyclopts.Parameter(
+            name="--egress",
+            help=(
+                "Outbound destination this runtime's sandbox may reach "
+                "(e.g. --egress target.example.com, --egress '*.internal.corp', "
+                "--egress 10.20.0.0/16; repeatable). Adds to the scope already "
+                "stored, or to --file's when given. Pass --empty-egress to "
+                "declare a scope that names nothing, restricting the sandbox "
+                "to the platform destinations alone."
+            ),
+        ),
+    ] = None,
+    yes: t.Annotated[bool, cyclopts.Parameter(name="--yes", alias="-y", negative=())] = False,
+    as_json: t.Annotated[bool, cyclopts.Parameter(name="--json", negative=())] = False,
+    platform: PlatformScopeArgs = PlatformScopeArgs(),
+) -> None:
+    """Replace a runtime's durable configuration.
+
+    Only the runtime's owner may call this, and it does not alter an already
+    running sandbox — the new configuration applies from the next start.
+
+    A narrowing egress declaration needs no permission beyond owning the
+    runtime, and is re-checked against the deployment's egress floor at start,
+    so a target the floor denies fails the start naming the target rather than
+    starting without it.
+
+    Args:
+        runtime_id: Runtime key or UUID, as shown by `dn runtime list`.
+        file: Replace the whole configuration with this runtime.yaml. Wholesale,
+            not a merge — a field the file omits is reset to its default.
+        egress: Outbound destination this runtime's sandbox may reach, as an
+            FQDN, a '*.suffix' wildcard, an IP, or a CIDR (repeatable).
+        yes: Skip the confirmation prompt when replacing wholesale with --file.
+        as_json: Output as JSON.
+    """
+    if file is None and egress is None:
+        raise ValueError(
+            "dn runtime config-set requires --file or --egress. "
+            "Run `dn runtime config-get <runtime-id>` to see the current configuration."
+        )
+
+    api, profile = platform.connect()
+
+    if file is not None:
+        manifest_identity, base = _split_runtime_manifest(api, file)
+        if manifest_identity:
+            # Identity is not part of the configuration document, so silently
+            # dropping these would look like they had been applied.
+            raise ValueError(
+                "runtime.yaml passed to config-set may not carry identity fields: "
+                + ", ".join(sorted(manifest_identity))
+                + ". Set those with `dn runtime create`."
+            )
+        base = base or {}
+        if not confirm_destructive(
+            f"Replace the configuration of runtime '{runtime_id}' wholesale? "
+            "Fields absent from the file are reset to their defaults.",
+            yes=yes,
+        ):
+            print_info("Aborted")
+            return
+    else:
+        current = api.get_runtime_config(profile.org_key, profile.workspace_key, runtime_id)
+        base = dict(current.get("config") or {})
+
+    updated = _apply_egress_targets(base, parse_egress_targets(egress)) or {}
+    payload = api.update_runtime_config(
+        profile.org_key,
+        profile.workspace_key,
+        runtime_id,
+        updated,
+    )
+
+    if as_json:
+        _render(payload, as_json=True, summary=_summarize_runtime_config)
+        return
+    print_success(f"Updated configuration for runtime '{runtime_id}'")
+    console.print(_summarize_runtime_config(payload))
+    _hint(f"dn runtime start {runtime_id}")

{dreadnode-2.0.42 → dreadnode-2.0.43}/dreadnode/app/cli/shared.py

@@ -16,6 +16,7 @@ if t.TYPE_CHECKING:
     from dreadnode.app.main import Dreadnode
 
 from dreadnode.core.log import console
+from dreadnode.packaging.egress import validate_target_list
 
 # Label-column width for detail views (2-space indent + label text + padding).
 # Shared so every domain renders key/value blocks with consistent alignment.
@@ -279,6 +280,29 @@ def merge_env_model_overrides(
     return merged or None
 
 
+def parse_egress_targets(
+    values: list[str] | None,
+    *,
+    where: str = "--egress",
+) -> list[str] | None:
+    """Parse repeatable ``--egress TARGET`` flags into a canonical target list.
+
+    Also used for the equivalent block loaded from a manifest -- pass ``where``
+    so the error names the field the author actually wrote.
+
+    Validated against the same grammar the task contract uses (``TSK-EGR-002``)
+    so a bad target is named here rather than after a round trip. Whether a
+    target is *reachable* depends on the deployment's egress floor, which only
+    the platform can judge, so that check stays at provision (``TSK-EGR-005``).
+
+    Returns ``None`` when no flags are given -- distinct from an empty list,
+    which is a declaration in its own right.
+    """
+    if values is None:
+        return None
+    return validate_target_list(values, where=where)
+
+
 def _parse_ref(value: str) -> tuple[str | None, str, str | None]:
     """Shared parsing logic for artifact references."""
     version: str | None = None

{dreadnode-2.0.42 → dreadnode-2.0.43}/dreadnode/app/cli/task.py

@@ -754,6 +754,19 @@ def info(
     if tags and isinstance(tags, list):
         console.print(f"  [dim]tags:[/dim] {', '.join(str(tag) for tag in tags)}")
 
+    # Shown only when declared: absent means the task inherits the deployment's
+    # floor, and an empty allow list is a declaration in its own right, so the
+    # two must not read alike (TSK-EGR-003).
+    egress = task.get("egress")
+    if isinstance(egress, dict):
+        allowed = egress.get("allow") or []
+        egress_line = (
+            ", ".join(str(target) for target in allowed)
+            if allowed
+            else "[dim]declared, names nothing (platform destinations only)[/dim]"
+        )
+        console.print(f"  [dim]egress:[/dim] {egress_line}")
+
     instruction = task.get("instruction")
     if instruction:
         console.print()

{dreadnode-2.0.42 → dreadnode-2.0.43}/dreadnode/app/server/capability_manager.py

@@ -25,11 +25,6 @@ if t.TYPE_CHECKING:
     from dreadnode.capabilities.types import AgentDef
 
 
-def _tool_name(tool: t.Any) -> str:
-    """Get the name of a tool object."""
-    return getattr(tool, "name", "")
-
-
 _COMPONENT_KINDS: frozenset[str] = frozenset(t.get_args(ComponentKind))
 _LOGGED_MALFORMED_ENTRIES: set[str] = set()
 
@@ -163,28 +158,15 @@ class CapabilityRegistry:
         return capability_name, capability, agent_def
 
     def all_tools(self) -> list[t.Any]:
-        """All tools from all capabilities + MCP servers, deduped by name."""
-        seen: set[str] = set()
+        """Return every tool with a unique computed wire name."""
+        from dreadnode.capabilities.tool_rules import validate_wire_names
+
         tools: list[t.Any] = []
         for cap in self.capabilities.values():
-            for tool in cap.tools:
-                name = _tool_name(tool)
-                if name and name not in seen:
-                    tools.append(tool)
-                    seen.add(name)
-                elif name in seen:
-                    logger.debug(
-                        "Tool '{}' already registered, skipping duplicate",
-                        name,
-                    )
+            tools.extend(cap.tools)
         if self.mcp_manager:
-            for tool in self.mcp_manager.all_tools():
-                name = _tool_name(tool)
-                if name and name not in seen:
-                    tools.append(tool)
-                    seen.add(name)
-                elif name in seen:
-                    logger.debug("Tool '{}' already registered (MCP), skipping", name)
+            tools.extend(self.mcp_manager.all_tools())
+        validate_wire_names(tools)
         return tools
 
     def all_hooks(self) -> list[t.Any]: