@agenthippo-ai/agenthippo 0.1.1 → 1.110.9

package/out/engines/codex.js

@@ -37,6 +37,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CodexEngine = void 0;
+exports.registerNewFilesWithTracker = registerNewFilesWithTracker;
 const fs_1 = require("fs");
 const path = __importStar(require("path"));
 const mcp_1 = require("../mcp");
@@ -46,6 +47,9 @@ const utils_1 = require("../utils");
 const permissions_1 = require("../permissions");
 const session_1 = require("../session");
 const agentpack_1 = require("../agentpack");
+const credential_context_1 = require("../cli/credential-context");
+const runtime_1 = require("../cli/runtime");
+const types_1 = require("../sandbox/types");
 // Note: HTTP edit server removed - file changes are now handled directly via file_change events
 // -----------------------------------------------------------------------------
 // Constants
@@ -62,11 +66,56 @@ const AGENTIDE_CODEX_AGENT_VERSION_ENV_VAR = 'AGENTIDE_ANALYTICS_AGENT_VERSION';
 const AGENTIDE_CODEX_SOURCE_ENV_VAR = 'AGENTIDE_ANALYTICS_SOURCE';
 const AGENTIDE_CODEX_ENGINE_ENV_VAR = 'AGENTIDE_ANALYTICS_ENGINE';
 const AGENTIDE_CODEX_REQUEST_ID_ENV_VAR = 'AGENTIDE_ANALYTICS_REQUEST_ID';
+const AGENTIDE_CODEX_POLICY_VERSION_ENV_VAR = 'AGENTIDE_ANALYTICS_POLICY_VERSION';
+const AGENTIDE_CODEX_PACK_DIGEST_ENV_VAR = 'AGENTIDE_ANALYTICS_PACK_DIGEST';
+const AGENTIDE_CODEX_ENGINE_VERSION_ENV_VAR = 'AGENTIDE_ANALYTICS_ENGINE_VERSION';
+const AGENTIDE_CODEX_TIER_ENV_VAR = 'AGENTIDE_ANALYTICS_TIER';
+const AGENTIDE_CODEX_INSTANCE_ID_ENV_VAR = 'AGENTIDE_ANALYTICS_INSTANCE_ID';
 // Bump when we change generated config semantics so long-lived sessions regenerate config.toml.
-const AGENTIDE_CODEX_CONFIG_VERSION = 18; // v18: Codex CLI dropped wire_api=chat; always use responses
+const AGENTIDE_CODEX_CONFIG_VERSION = 21; // v21: sandbox_mode "danger-full-access" now requires tier 2, not merely being inside a sandbox — a tier-0 home written by v20 must be rewritten
 // Per-process runtime context for agents (not analytics): lets the agent locate its per-session context export.
 const AGENTIDE_CONTEXT_EXPORT_PATH_ENV_VAR = 'AGENTIDE_CONTEXT_EXPORT_PATH';
 const AGENTIDE_TERMINAL_LOG_PATH_ENV_VAR = 'AGENTIDE_TERMINAL_LOG_PATH';
+/**
+ * Hand files codex just CREATED to the edit tracker so the IDE can render them against an empty
+ * original — without ever risking the agent's work.
+ *
+ * The IDE trick is read → delete → `applyEdit`. That delete caused live data loss: headless
+ * (`serve`/`ask`/`chat` and every sandbox) gets `NoOpEditTracker`, whose `applyEdit` does nothing, so
+ * every new file codex created was silently destroyed. The command exited 0, the file was there
+ * during the command, and it was gone by the next one — while standalone `codex exec` wrote it
+ * fine. Two guards now: skip trackers that do not write back, and restore the file if it is
+ * missing when we are done, whatever the tracker did or threw.
+ *
+ * Exported so the invariant "a file the agent created still exists after the turn" is testable.
+ */
+async function registerNewFilesWithTracker(files, editTracker, sessionId) {
+    // A tracker that does not write the file back must never see a delete.
+    if (editTracker.appliesEdits === false) {
+        return;
+    }
+    for (const f of files) {
+        try {
+            if ((0, utils_1.isBinaryFile)(f)) {
+                continue; // Binary would be corrupted by the UTF-8 read/write round trip.
+            }
+            if (!(await (0, utils_1.pathExists)(f))) {
+                continue;
+            }
+            const code = await fs_1.promises.readFile(f, 'utf-8');
+            try {
+                await fs_1.promises.unlink(f);
+                await editTracker.applyEdit(sessionId, f, code, true);
+            }
+            finally {
+                if (!(await (0, utils_1.pathExists)(f))) {
+                    await fs_1.promises.writeFile(f, code, 'utf-8');
+                }
+            }
+        }
+        catch { /* ignore — never fail a turn over edit-diff bookkeeping */ }
+    }
+}
 function isCodexItemEvent(event) {
     return event.type === 'item.started' || event.type === 'item.updated' || event.type === 'item.completed';
 }
@@ -100,7 +149,8 @@ class CodexEngine {
         const threadModelId = options.modelId;
         // Resolve API routing (LiteLLM proxy vs direct OpenAI)
         // Use openaiBaseUrl which has overrideOpenAIBaseUrl applied
-        const routing = (0, utils_1.resolveApiRouting)(options, this.config.litellmApiKey, this.config.litellmBaseUrl);
+        // codex routes to OpenAI when direct (or the LiteLLM proxy when configured) — never Anthropic.
+        const routing = (0, utils_1.resolveApiRouting)(options, this.config, 'openai');
         const apiKey = routing.apiKey;
         const baseUrl = routing.openaiBaseUrl; // Use OpenAI-specific URL
         const useLiteLLM = routing.useLiteLLM;
@@ -126,6 +176,17 @@ class CodexEngine {
             ...(runtime.cliEnvPatch ?? {}),
             OPENAI_LOG: 'debug',
         };
+        // The OpenClaw gateway token must never enter the agent's trust domain (secure-obo-design
+        // §7.6 / §7.4 gap 1). UNCONDITIONALLY (serve-v4 §10 hole 2): the scrub used to depend on
+        // the egress broker being up, so a deployment without --gateway-bridge re-inherited the
+        // token — and buildCliEnvPatch can bake it in from the host's ~/.openclaw config, not just
+        // process.env. This engine never needs it: outbound goes through the broker's turn nonce,
+        // and the openclaw CLI reads its own config file on single-tenant hosts.
+        delete codexEnv[runtime_1.OPENCLAW_GATEWAY_TOKEN_ENV];
+        // Data-plane sidecar control token: the engine only needs the gateway URL + its per-turn
+        // nonce, never the register token — scrub it so a compromised agent can't forge a turn as
+        // another user (secure-obo-design §7.6). Harmless when absent (in-process/no data plane).
+        delete codexEnv['AGENTHIPPO_DATA_PLANE_TOKEN'];
         // Always expose the VS Code chat session id to the agent process so it can locate:
         //   .agentide/sessions/<sessionId>/context.md
         const rawChatSessionId = sessionId?.trim();
@@ -141,8 +202,12 @@ class CodexEngine {
         // Note: workingDirectory is ALWAYS workspaceRoot - active agent content is synced to workspace's .codex/
         const agentId = options.agentPackId ?? 'default';
         const runtimePaths = (0, agentpack_1.resolveRuntimePaths)(options.workspaceRoot, this.config.storagePath, agentId, options.agentPackVersion);
-        // Use agent-isolated CODEX_HOME (for session/state isolation)
-        const codexHome = runtimePaths.codexHome;
+        // Use agent-isolated CODEX_HOME (for session/state isolation). In multi-tenant serve,
+        // additionally key it by the verified request user: config.toml is rewritten per turn,
+        // and a shared per-agent home lets concurrent turns of different users race it
+        // (secure-obo-design §1 defect 1 / §8 Phase 0). No credential frame (IDE,
+        // single-tenant CLI) ⇒ unchanged per-agent path.
+        const codexHome = (0, agentpack_1.userScopedEngineHome)(runtimePaths.codexHome, (0, credential_context_1.currentCredential)()?.userId);
         codexEnv['CODEX_HOME'] = codexHome;
         await fs_1.promises.mkdir(codexHome, { recursive: true });
         // Always set AGENT_ID for agent to know its identity
@@ -164,7 +229,15 @@ class CodexEngine {
         agentId, // Pass agent ID for correct skills path
         runtime.permissionHandler instanceof interfaces_1.AutoApprovePermissionHandler);
         // LiteLLM analytics metadata (enriched - see PLAN/analytics-design.md)
-        if (useLiteLLM && this.config.codexHome) {
+        //
+        // Gate on the codexHome actually in use (resolved above), NOT `this.config.codexHome`:
+        // headless/index.ts passes `codexHome: undefined`, so under serve/ask/chat and inside
+        // every sandbox this block was skipped and codex sent NO metadata headers at all — no
+        // session-id, user-id, agent-id, source, request-id, or engine. Spotlight lost codex
+        // attribution outside the IDE, and the gateway could not see `x-litellm-metadata-engine`,
+        // so engine-conditional ah-auto routing never fired. config.toml was written correctly
+        // the whole time (it uses this same resolved home) — only the env vars it reads were missing.
+        if (useLiteLLM && codexHome) {
             if (analyticsUserId?.trim()) {
                 codexEnv[AGENTIDE_CODEX_USER_ENV_VAR] = analyticsUserId.trim();
             }
@@ -182,6 +255,21 @@ class CodexEngine {
             if (options.requestId) {
                 codexEnv[AGENTIDE_CODEX_REQUEST_ID_ENV_VAR] = options.requestId;
             }
+            if (options.policyVersion?.trim()) {
+                codexEnv[AGENTIDE_CODEX_POLICY_VERSION_ENV_VAR] = options.policyVersion.trim();
+            }
+            if (options.packDigest?.trim()) {
+                codexEnv[AGENTIDE_CODEX_PACK_DIGEST_ENV_VAR] = options.packDigest.trim();
+            }
+            if (options.engineVersion?.trim()) {
+                codexEnv[AGENTIDE_CODEX_ENGINE_VERSION_ENV_VAR] = options.engineVersion.trim();
+            }
+            if (options.tier !== undefined) {
+                codexEnv[AGENTIDE_CODEX_TIER_ENV_VAR] = String(options.tier);
+            }
+            if (options.instanceId?.trim()) {
+                codexEnv[AGENTIDE_CODEX_INSTANCE_ID_ENV_VAR] = options.instanceId.trim();
+            }
         }
         // For custom providers (OpenRouter, LiteLLM), set API key in CODEX_API_KEY.
         // The config.toml's `env_key = "CODEX_API_KEY"` tells the CLI to read from this variable.
@@ -210,6 +298,16 @@ class CodexEngine {
             ];
             // Map unified permissions to Codex SDK options
             const codexPermOpts = (0, permissions_1.toCodexOptions)(effectivePerms, workspaceFolders);
+            // One boundary, not two — but only when the OTHER boundary is real. Inside a tier-2
+            // container Codex's own bubblewrap sandbox cannot start (it needs a user namespace
+            // `--cap-drop ALL` + `no-new-privileges` deny), so standing it down is the difference
+            // between working shell commands and silent failures. The tier-0 process driver
+            // provides NO boundary — same uid, same filesystem as serve — so there Codex's own
+            // sandbox is the only thing between the agent and the host and must stay on.
+            // The SDK's ThreadOptions.sandboxMode overrides config.toml, so force it here too.
+            if ((0, types_1.isContainerSandbox)()) {
+                codexPermOpts.sandboxMode = 'danger-full-access';
+            }
             logger.info(`[AgentIDE] Codex mapped: sandboxMode=${codexPermOpts.sandboxMode}, approvalPolicy=${codexPermOpts.approvalPolicy}`);
             // Build thread options
             // workingDirectory is ALWAYS workspaceRoot - pack content is synced to workspace's .codex/
@@ -396,21 +494,7 @@ class CodexEngine {
                                         catch { /* ignore */ }
                                         pendingOperations.delete(item.id);
                                     }
-                                    // New files: read, delete, apply (so VS Code sees original=empty)
-                                    // Skip binary files - they would be corrupted by UTF-8 read/write
-                                    for (const f of pendingNewFiles.get(item.id) ?? []) {
-                                        try {
-                                            if ((0, utils_1.isBinaryFile)(f)) {
-                                                continue; // Don't track binary files for edit diffs
-                                            }
-                                            if (await (0, utils_1.pathExists)(f)) {
-                                                const code = await fs_1.promises.readFile(f, 'utf-8');
-                                                await fs_1.promises.unlink(f);
-                                                await editTracker.applyEdit(rawChatSessionId, f, code, true);
-                                            }
-                                        }
-                                        catch { /* ignore */ }
-                                    }
+                                    await registerNewFilesWithTracker(pendingNewFiles.get(item.id) ?? [], editTracker, rawChatSessionId);
                                     pendingNewFiles.delete(item.id);
                                 }
                             }
@@ -601,7 +685,11 @@ class CodexEngine {
         // Codex CLI requires wire_api=responses (chat wire was removed in newer Codex releases).
         const wireApi = 'responses';
         const routingType = useLiteLLM ? 'litellm' : (customBaseUrl ? 'custom' : 'openai');
-        const signature = `${AGENTIDE_CODEX_CONFIG_VERSION}:${routingType}:${customBaseUrl ?? ''}:${wireApi}:${agentId}:${codexInstructionsFile ?? ''}:${(0, mcp_1.mcpConfigCacheSignatureSuffix)()}`;
+        // No per-turn component in this signature: config.toml must be byte-identical across
+        // turns (per-turn auth rides the process env via bearer_token_env_var, never the file),
+        // so concurrent same-home turns write identical bytes and the old cross-turn race is
+        // gone by construction (secure-obo-design §3.2).
+        const signature = `${AGENTIDE_CODEX_CONFIG_VERSION}:${routingType}:${customBaseUrl ?? ''}:${wireApi}:${agentId}:${codexInstructionsFile ?? ''}`;
         if (this.lastWrittenConfigSignature === signature) {
             return;
         }
@@ -618,6 +706,16 @@ class CodexEngine {
             // Codex CLI loads a single "model instructions" file that acts like a system/developer prompt overlay.
             // Note: experimental_instructions_file is deprecated and ignored by newer Codex CLI versions.
             codexInstructionsFile ? `model_instructions_file = ${JSON.stringify(codexInstructionsFile)}` : undefined,
+            // Inside a TIER-2 sandbox the container is the boundary, so Codex's own sandbox is not
+            // just redundant — it cannot start. It shells out to bubblewrap, which needs to create
+            // a user namespace and scratch space under /tmp; a container drops those capabilities by
+            // design (`--cap-drop ALL`, `no-new-privileges`), so every shell command and file
+            // write failed while still reporting exit 0. One boundary, not two — but the tier-0
+            // process driver is not a boundary at all, so it never earns this. Keyed on the tier
+            // the driver reports, not on merely being inside a sandbox.
+            ...((0, types_1.isContainerSandbox)()
+                ? ['sandbox_mode = "danger-full-access"']
+                : []),
         ];
         // Add custom provider section for LiteLLM or custom providers (e.g., OpenRouter)
         if (customBaseUrl) {
@@ -636,7 +734,12 @@ class CodexEngine {
                     `"x-litellm-metadata-agent-version" = "${AGENTIDE_CODEX_AGENT_VERSION_ENV_VAR}", ` +
                     `"x-litellm-metadata-source" = "${AGENTIDE_CODEX_SOURCE_ENV_VAR}", ` +
                     `"x-litellm-metadata-engine" = "${AGENTIDE_CODEX_ENGINE_ENV_VAR}", ` +
-                    `"x-litellm-metadata-request-id" = "${AGENTIDE_CODEX_REQUEST_ID_ENV_VAR}" }`);
+                    `"x-litellm-metadata-request-id" = "${AGENTIDE_CODEX_REQUEST_ID_ENV_VAR}", ` +
+                    `"x-litellm-metadata-policy-version" = "${AGENTIDE_CODEX_POLICY_VERSION_ENV_VAR}", ` +
+                    `"x-litellm-metadata-pack-digest" = "${AGENTIDE_CODEX_PACK_DIGEST_ENV_VAR}", ` +
+                    `"x-litellm-metadata-engine-version" = "${AGENTIDE_CODEX_ENGINE_VERSION_ENV_VAR}", ` +
+                    `"x-litellm-metadata-tier" = "${AGENTIDE_CODEX_TIER_ENV_VAR}", ` +
+                    `"x-litellm-metadata-instance-id" = "${AGENTIDE_CODEX_INSTANCE_ID_ENV_VAR}" }`);
             }
         }
         // Add MCP servers section (pack-aware)

package/out/engines/custom.js

@@ -38,6 +38,8 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CustomEngine = void 0;
 exports.resolveCustomEngineLoadStrategy = resolveCustomEngineLoadStrategy;
+exports.deliverModelRoutingEnv = deliverModelRoutingEnv;
+exports.buildRunnerChildEnv = buildRunnerChildEnv;
 exports.probeCustomEngineImport = probeCustomEngineImport;
 const node_child_process_1 = require("node:child_process");
 const node_readline_1 = require("node:readline");
@@ -45,6 +47,7 @@ const fs_1 = require("fs");
 const path = __importStar(require("path"));
 const url_1 = require("url");
 const base_1 = require("./base");
+const runtime_1 = require("../cli/runtime");
 const customRegistry_1 = require("./customRegistry");
 const paths_1 = require("../agentpack/paths");
 const utils_1 = require("../utils");
@@ -83,10 +86,45 @@ function prependNodePath(env, engineDir) {
         ? `${engineNodeModules}${path.delimiter}${existing}`
         : engineNodeModules;
 }
+/**
+ * Deliver the per-turn model-routing values into the env vars a manifest declares
+ * (`model.apiKeyEnvVar` / `baseUrlEnvVar` / `openaiBaseUrlEnvVar`).
+ *
+ * NON-CLOBBERING: a var already set in the host's own ambient env is left alone. Two reasons:
+ * (1) it preserves the effective behavior deployments already relied on — the old
+ *     `{...turn.env, ...process.env}` child-env spread accidentally let ambient values win,
+ *     and operators' engine-owned keys (e.g. a real CURSOR_API_KEY vs a stale manifest that
+ *     wrongly declared it as a delivery slot) must keep winning after that spread is fixed;
+ * (2) it makes the manifest contract safe by construction: mis-declaring an operator-owned
+ *     credential as a delivery slot can shadow nothing.
+ * The flip side is documented on CustomEngineModelConfig: ambient-exporting a genuine
+ * delivery var (e.g. LITELLM_API_KEY in serve's shell) shadows per-turn rotation.
+ */
+function deliverModelRoutingEnv(env, manifest, routing, ambientEnv, logger) {
+    const deliver = (envVar, value, label) => {
+        if (!envVar || !value) {
+            return;
+        }
+        if (ambientEnv[envVar]?.trim()) {
+            logger?.info(`[AgentIDE] Custom engine "${manifest.id}": ${envVar} already set in ambient env — keeping the operator's value, skipping per-turn ${label} delivery`);
+            return;
+        }
+        env[envVar] = value;
+    };
+    deliver(manifest.model?.apiKeyEnvVar, routing.apiKey, 'API key');
+    deliver(manifest.model?.baseUrlEnvVar, routing.baseUrl, 'base URL');
+    deliver(manifest.model?.openaiBaseUrlEnvVar, routing.openaiBaseUrl, 'OpenAI base URL');
+}
 function buildRunnerChildEnv(manifest, turn, probeImport) {
     const childEnv = {
-        ...turn.env,
+        // Per-turn values WIN over the host's ambient env. turn.env starts from a spread of
+        // process.env, so for undeclared vars this is identical either way; the difference is
+        // deliberate per-turn state (AGENTHIPPO_* control vars, the data-plane turn nonce,
+        // session paths, manifest-declared deliveries) which must never be reverted by a
+        // same-named var in the host's own environment. Ambient-vs-delivery precedence for
+        // manifest credential vars is decided earlier, in deliverModelRoutingEnv (non-clobber).
         ...process.env,
+        ...turn.env,
         AGENTHIPPO_ENGINE_ENTRY: manifest.entryPath,
         AGENTHIPPO_MESSAGE: turn.message,
         AGENTHIPPO_WORKSPACE_ROOT: turn.workspaceRoot,
@@ -466,7 +504,10 @@ class CustomEngine {
         const attachmentsDir = path.join(workspaceSessionDir, 'attachments');
         const nativeSessionId = this.activeSessions.get(conversationKey)?.nativeSessionId ??
             (0, base_1.getPersistedSessionId)(`custom:${manifest.id}`, conversationKey);
-        const routing = (0, utils_1.resolveApiRouting)(options, this.config.litellmApiKey, this.config.litellmBaseUrl, runtime.configProvider);
+        // A custom engine isn't pinned to one vendor — infer its direct provider from the model
+        // (e.g. openclaw's litellm/* routes through the proxy anyway; a claude-* model → Anthropic).
+        // The engine's manifest still decides which env var receives the resolved key.
+        const routing = (0, utils_1.resolveApiRouting)(options, this.config, (0, utils_1.inferModelProvider)(options.modelId), runtime.configProvider);
         const routingApiKey = routing.apiKey?.trim() || undefined;
         const routingBaseUrl = routing.baseUrl?.trim() || undefined;
         const routingOpenAIBaseUrl = routing.openaiBaseUrl?.trim() || undefined;
@@ -494,6 +535,8 @@ class CustomEngine {
             AGENTHIPPO_MODEL_ID: modelId,
             AGENTHIPPO_USE_LITELLM: routing.useLiteLLM ? 'true' : 'false',
         };
+        delete env[runtime_1.OPENCLAW_GATEWAY_TOKEN_ENV];
+        delete env['AGENTHIPPO_DATA_PLANE_TOKEN'];
         prependNodePath(env, manifest.manifestDir);
         if (routingApiKey) {
             env.AGENTHIPPO_API_KEY = routingApiKey;
@@ -520,6 +563,11 @@ class CustomEngine {
                 source: 'agenthippo',
                 engine: `custom:${manifest.id}`,
                 requestId: options.requestId,
+                policyVersion: options.policyVersion,
+                packDigest: options.packDigest,
+                instanceId: options.instanceId,
+                engineVersion: options.engineVersion,
+                tier: options.tier,
             });
             if (litellmMetadataHeaders.length > 0) {
                 env.AGENTHIPPO_LITELLM_METADATA_HEADERS = litellmMetadataHeaders.join('\n');
@@ -532,15 +580,7 @@ class CustomEngine {
         if (manifest.homeEnvVar) {
             env[manifest.homeEnvVar] = engineHomeDir;
         }
-        if (manifest.model?.apiKeyEnvVar && routingApiKey) {
-            env[manifest.model.apiKeyEnvVar] = routingApiKey;
-        }
-        if (manifest.model?.baseUrlEnvVar && routingBaseUrl) {
-            env[manifest.model.baseUrlEnvVar] = routingBaseUrl;
-        }
-        if (manifest.model?.openaiBaseUrlEnvVar && routingOpenAIBaseUrl) {
-            env[manifest.model.openaiBaseUrlEnvVar] = routingOpenAIBaseUrl;
-        }
+        deliverModelRoutingEnv(env, manifest, { apiKey: routingApiKey, baseUrl: routingBaseUrl, openaiBaseUrl: routingOpenAIBaseUrl }, process.env, runtime.logger);
         if ((routingBaseUrl && (0, utils_1.applyLocalTlsBypass)(env, routingBaseUrl))
             || (routingOpenAIBaseUrl && routingOpenAIBaseUrl !== routingBaseUrl && (0, utils_1.applyLocalTlsBypass)(env, routingOpenAIBaseUrl))) {
             runtime.logger.info(`[AgentIDE] Disabling TLS verification for local HTTPS (${manifest.id})`);
@@ -550,7 +590,9 @@ class CustomEngine {
             : (routingBaseUrl ? 'custom provider' : 'native provider');
         runtime.logger.info(`[AgentIDE] Custom engine "${manifest.id}" routing: ${routingDescription}, baseUrl=${routingBaseUrl || 'default'}, model=${modelId}`);
         const resolvedMcp = await (0, mcp_1.loadMcpServers)(agentId, options.workspaceRoot, this.getBundledBasePromptsDir());
-        const mcpServers = (0, mcp_1.formatInlineMcpServers)(resolvedMcp);
+        // `env` is this turn's child env — URL servers resolve bearerTokenEnv (turn nonce)
+        // from it in memory, so per-turn auth never lands in a shared file.
+        const mcpServers = (0, mcp_1.formatInlineMcpServers)(resolvedMcp, env);
         if (resolvedMcp.length > 0) {
             runtime.logger.debug(`[AgentIDE] Custom engine "${manifest.id}" MCP (${agentId}): ${resolvedMcp.map(s => s.name).join(', ')}`);
         }