@ai-sdk/harness-acp 1.0.76 → 1.0.77

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @ai-sdk/harness-acp
 
+## 1.0.77
+
+### Patch Changes
+
+- 58030b5: fix(harness-acp): enforce tool call match with host tool relay
+
 ## 1.0.76
 
 ### Patch Changes

package/dist/bridge/host-tool-mcp.mjs

@@ -6,7 +6,7 @@ import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { CallToolRequestSchema, ErrorCode, ListToolsRequestSchema, McpError } from "@modelcontextprotocol/sdk/types.js";
 import { Agent, request } from "node:http";
 //#region src/v1/bridge/host-tool-mcp-server.ts
-const VERSION = "1.0.76";
+const VERSION = "1.0.77";
 function createHostToolMCPServer({ tools, revision = 1, invoke, onListTools }) {
 	let catalog = createCatalog({
 		revision,

package/dist/bridge/index.mjs

@@ -736,7 +736,7 @@ function mergeRecords({ left, right }) {
 	const result = { ...left };
 	for (const [key, value] of Object.entries(right)) {
 		const previous = result[key];
-		result[key] = isRecord$6(previous) && isRecord$6(value) ? mergeRecords({
+		result[key] = isRecord$7(previous) && isRecord$7(value) ? mergeRecords({
 			left: previous,
 			right: value
 		}) : value;
@@ -748,10 +748,10 @@ function requireGateway({ gateway }) {
 	return gateway;
 }
 function asRecord(value) {
-	if (!isRecord$6(value)) throw new Error("ACP profile data must resolve to an object.");
+	if (!isRecord$7(value)) throw new Error("ACP profile data must resolve to an object.");
 	return value;
 }
-function isRecord$6(value) {
+function isRecord$7(value) {
 	return value != null && typeof value === "object" && !Array.isArray(value);
 }
 //#endregion
@@ -817,27 +817,27 @@ function captureACPStream({ stream }) {
 }
 function getRawSessionUpdate({ message }) {
 	const record = message;
-	if (record.method !== "session/update" || !isRecord$5(record.params)) return { isSessionUpdate: false };
+	if (record.method !== "session/update" || !isRecord$6(record.params)) return { isSessionUpdate: false };
 	const params = record.params;
 	return {
 		isSessionUpdate: true,
 		value: params.update,
-		canFilterUnknown: typeof params.sessionId === "string" && isRecord$5(params.update)
+		canFilterUnknown: typeof params.sessionId === "string" && isRecord$6(params.update)
 	};
 }
 function sessionUpdatesMatch({ rawUpdate, update }) {
-	if (!isRecord$5(rawUpdate)) return false;
+	if (!isRecord$6(rawUpdate)) return false;
 	if (rawUpdate.sessionUpdate !== update.sessionUpdate) return false;
 	if (update.sessionUpdate === "tool_call" || update.sessionUpdate === "tool_call_update") return rawUpdate.toolCallId === update.toolCallId;
 	if (update.sessionUpdate === "user_message_chunk" || update.sessionUpdate === "agent_message_chunk" || update.sessionUpdate === "agent_thought_chunk") return rawUpdate.messageId === update.messageId;
 	return true;
 }
 function getStringProperty$1({ value, property }) {
-	if (!isRecord$5(value)) return void 0;
+	if (!isRecord$6(value)) return void 0;
 	const propertyValue = value[property];
 	return typeof propertyValue === "string" ? propertyValue : void 0;
 }
-function isRecord$5(value) {
+function isRecord$6(value) {
 	return value != null && typeof value === "object" && !Array.isArray(value);
 }
 //#endregion
@@ -1223,10 +1223,10 @@ function resolveBuiltinTool({ programmaticName, metadata, title, kind, rawInput,
 	});
 }
 function findMostSpecificSchemaMatch({ rawInput, schemaMatches }) {
-	if (!isRecord$4(rawInput)) return void 0;
+	if (!isRecord$5(rawInput)) return void 0;
 	const rawInputKeys = Object.keys(rawInput);
 	const coverageOf = (tool) => {
-		const properties = isRecord$4(tool.inputSchema) ? isRecord$4(tool.inputSchema.properties) ? tool.inputSchema.properties : {} : {};
+		const properties = isRecord$5(tool.inputSchema) ? isRecord$5(tool.inputSchema.properties) ? tool.inputSchema.properties : {} : {};
 		return rawInputKeys.filter((key) => key in properties).length;
 	};
 	const highestCoverage = Math.max(...schemaMatches.map(coverageOf));
@@ -1275,7 +1275,7 @@ function findBuiltinToolsInMetadata({ metadata, builtinToolsByName }) {
 	};
 }
 function matchesBuiltinToolInput({ rawInput, inputSchema }) {
-	if (!isRecord$4(rawInput) || !isRecord$4(inputSchema)) return false;
+	if (!isRecord$5(rawInput) || !isRecord$5(inputSchema)) return false;
 	if (inputSchema.type !== "object") return false;
 	const required = inputSchema.required;
 	if (!Array.isArray(required) || required.length === 0 || !required.every((property) => typeof property === "string")) return false;
@@ -1283,7 +1283,7 @@ function matchesBuiltinToolInput({ rawInput, inputSchema }) {
 		rawInput,
 		inputSchema
 	})) return false;
-	const properties = isRecord$4(inputSchema.properties) ? inputSchema.properties : {};
+	const properties = isRecord$5(inputSchema.properties) ? inputSchema.properties : {};
 	return Object.entries(properties).filter(([, schema]) => isJSONSchemaDiscriminator({ schema })).every(([property, schema]) => {
 		if (!Object.prototype.hasOwnProperty.call(rawInput, property)) return false;
 		return matchesJSONSchemaValue({
@@ -1293,12 +1293,12 @@ function matchesBuiltinToolInput({ rawInput, inputSchema }) {
 	});
 }
 function hasRequiredBuiltinToolInput({ rawInput, inputSchema }) {
-	if (!isRecord$4(inputSchema) || inputSchema.type !== "object") return true;
-	if (!isRecord$4(rawInput)) return false;
+	if (!isRecord$5(inputSchema) || inputSchema.type !== "object") return true;
+	if (!isRecord$5(rawInput)) return false;
 	const required = inputSchema.required;
 	if (!Array.isArray(required) || required.length === 0) return true;
 	if (!required.every((property) => typeof property === "string")) return true;
-	const properties = isRecord$4(inputSchema.properties) ? inputSchema.properties : {};
+	const properties = isRecord$5(inputSchema.properties) ? inputSchema.properties : {};
 	return required.every((property) => {
 		if (!Object.prototype.hasOwnProperty.call(rawInput, property)) return false;
 		return matchesJSONSchemaValue({
@@ -1308,11 +1308,11 @@ function hasRequiredBuiltinToolInput({ rawInput, inputSchema }) {
 	});
 }
 function isJSONSchemaDiscriminator({ schema }) {
-	return isRecord$4(schema) && ("const" in schema || Array.isArray(schema.enum) && schema.enum.length === 1);
+	return isRecord$5(schema) && ("const" in schema || Array.isArray(schema.enum) && schema.enum.length === 1);
 }
 function matchesJSONSchemaValue({ value, schema }) {
 	if (schema === true) return true;
-	if (schema === false || !isRecord$4(schema)) return false;
+	if (schema === false || !isRecord$5(schema)) return false;
 	if ("const" in schema && !Object.is(value, schema.const)) return false;
 	if (Array.isArray(schema.enum) && !schema.enum.some((candidate) => Object.is(value, candidate))) return false;
 	for (const alternatives of [schema.anyOf, schema.oneOf]) if (Array.isArray(alternatives) && !alternatives.some((alternative) => matchesJSONSchemaValue({
@@ -1327,7 +1327,7 @@ function matchesJSONSchemaValue({ value, schema }) {
 		case "number": return typeof value === "number" && Number.isFinite(value);
 		case "string": return typeof value === "string";
 		case "array": return Array.isArray(value);
-		case "object": return isRecord$4(value);
+		case "object": return isRecord$5(value);
 		default: return true;
 	}
 }
@@ -1373,7 +1373,7 @@ function createACPToolCall({ state }) {
 		...Array.isArray(state.values.locations) ? { locations: state.values.locations } : {},
 		...Object.prototype.hasOwnProperty.call(state.values, "rawInput") ? { rawInput: state.values.rawInput } : {},
 		...Object.prototype.hasOwnProperty.call(state.values, "rawOutput") ? { rawOutput: state.values.rawOutput } : {},
-		...state.values._meta === null || isRecord$4(state.values._meta) ? { _meta: state.values._meta } : {}
+		...state.values._meta === null || isRecord$5(state.values._meta) ? { _meta: state.values._meta } : {}
 	};
 }
 function isACPToolKind(value) {
@@ -1385,7 +1385,7 @@ function isACPToolCallStatus(value) {
 function emitFileChanges({ state, emit }) {
 	const content = Array.isArray(state.values.content) ? state.values.content : [];
 	for (const item of content) {
-		if (!isRecord$4(item) || item.type !== "diff") continue;
+		if (!isRecord$5(item) || item.type !== "diff") continue;
 		const path = getStringProperty({
 			value: item,
 			property: "path"
@@ -1476,11 +1476,11 @@ function toSafeJSONValue({ value, fallback, seen = /* @__PURE__ */ new Set() })
 	return result;
 }
 function getStringProperty({ value, property }) {
-	if (!isRecord$4(value)) return void 0;
+	if (!isRecord$5(value)) return void 0;
 	const propertyValue = value[property];
 	return typeof propertyValue === "string" ? propertyValue : void 0;
 }
-function isRecord$4(value) {
+function isRecord$5(value) {
 	return value != null && typeof value === "object" && !Array.isArray(value);
 }
 function mapACPUsage({ usage }) {
@@ -1527,6 +1527,17 @@ function unknownUsage$1() {
 	};
 }
 //#endregion
+//#region src/v1/bridge/canonical-json-fingerprint.ts
+function canonicalFingerprint({ value }) {
+	return JSON.stringify(canonicalizeJSON({ value }));
+}
+function canonicalizeJSON({ value }) {
+	if (Array.isArray(value)) return value.map((item) => canonicalizeJSON({ value: item }));
+	if (value == null || typeof value !== "object") return value;
+	const record = value;
+	return Object.fromEntries(Object.keys(record).sort().filter((key) => record[key] !== void 0).map((key) => [key, canonicalizeJSON({ value: record[key] })]));
+}
+//#endregion
 //#region src/v1/bridge/host-tool-correlation.ts
 const CORRELATION_WINDOW_MS = 1e3;
 const MAX_BUFFERED_UPDATES = 128;
@@ -1770,7 +1781,7 @@ function hasPortableEvidence({ candidate, invocation }) {
 			hasServerIdentity = true;
 			hasToolName = true;
 		}
-		if (typeof deferredToolName === "string" && isRecord$3(deferredToolInput) && hasDelimitedPair({
+		if (typeof deferredToolName === "string" && isRecord$4(deferredToolInput) && hasDelimitedPair({
 			value: deferredToolName,
 			serverName: invocation.serverName,
 			toolName: invocation.toolName
@@ -1795,7 +1806,7 @@ function hasPortableEvidence({ candidate, invocation }) {
 	return hasServerIdentity && hasToolName && hasInput;
 }
 function resolvePermissionHostTool({ toolCall, serverName, toolName }) {
-	if (!isRecord$3(toolCall.rawInput)) return void 0;
+	if (!isRecord$4(toolCall.rawInput)) return void 0;
 	const deferredToolName = getProperty({
 		value: toolCall.rawInput,
 		property: "tool_name"
@@ -1811,7 +1822,7 @@ function resolvePermissionHostTool({ toolCall, serverName, toolName }) {
 		value: toolCall.rawInput,
 		property: "tool_input"
 	})) {
-		if (typeof deferredToolName !== "string" || !isRecord$3(deferredToolInput) || !hasDelimitedPair({
+		if (typeof deferredToolName !== "string" || !isRecord$4(deferredToolInput) || !hasDelimitedPair({
 			value: deferredToolName,
 			serverName,
 			toolName
@@ -1844,21 +1855,14 @@ function resolvePermissionHostTool({ toolCall, serverName, toolName }) {
 	};
 }
 function containsCombinedIdentity({ value, serverName, toolName }) {
-	const seen = /* @__PURE__ */ new Set();
-	const visit = (candidate) => {
-		if (typeof candidate === "string") return hasDelimitedPair({
+	return containsString({
+		value,
+		matches: (candidate) => hasDelimitedPair({
 			value: candidate,
 			serverName,
 			toolName
-		});
-		if (candidate == null || typeof candidate !== "object") return false;
-		if (seen.has(candidate)) return false;
-		seen.add(candidate);
-		const values = Array.isArray(candidate) ? candidate : Object.values(candidate);
-		for (const item of values) if (visit(item)) return true;
-		return false;
-	};
-	return visit(value);
+		})
+	});
 }
 function hasDelimitedPair({ value, serverName, toolName }) {
 	if (serverName.length === 0 || toolName.length === 0) return false;
@@ -1898,9 +1902,15 @@ function isToolUpdate(message) {
 	return message.update.sessionUpdate === "tool_call" || message.update.sessionUpdate === "tool_call_update";
 }
 function containsExactValue({ value, target }) {
+	return containsString({
+		value,
+		matches: (candidate) => candidate === target
+	});
+}
+function containsString({ value, matches }) {
 	const seen = /* @__PURE__ */ new Set();
 	const visit = (candidate) => {
-		if (candidate === target) return true;
+		if (typeof candidate === "string") return matches(candidate);
 		if (candidate == null || typeof candidate !== "object") return false;
 		if (seen.has(candidate)) return false;
 		seen.add(candidate);
@@ -1924,14 +1934,6 @@ function containsFingerprint({ value, target }) {
 	};
 	return visit(value);
 }
-function canonicalFingerprint({ value }) {
-	return JSON.stringify(canonicalizeJSON$1({ value }));
-}
-function canonicalizeJSON$1({ value }) {
-	if (Array.isArray(value)) return value.map((item) => canonicalizeJSON$1({ value: item }));
-	if (value == null || typeof value !== "object") return value;
-	return Object.fromEntries(Object.keys(value).sort().filter((key) => value[key] !== void 0).map((key) => [key, canonicalizeJSON$1({ value: value[key] })]));
-}
 function getProperty({ value, property }) {
 	if (value == null || typeof value !== "object" || Array.isArray(value)) return;
 	return Reflect.get(value, property);
@@ -1939,7 +1941,7 @@ function getProperty({ value, property }) {
 function hasOwnProperty({ value, property }) {
 	return Object.prototype.hasOwnProperty.call(value, property);
 }
-function isRecord$3(value) {
+function isRecord$4(value) {
 	return value != null && typeof value === "object" && !Array.isArray(value);
 }
 function isTerminalToolUpdate(message) {
@@ -2059,7 +2061,7 @@ function setStringAtPath({ record, path, value }) {
 	return {
 		...record,
 		[key]: remainingPath.length === 0 ? value : setStringAtPath({
-			record: isRecord$2(record[key]) ? record[key] : {},
+			record: isRecord$3(record[key]) ? record[key] : {},
 			path: remainingPath,
 			value
 		})
@@ -2068,12 +2070,12 @@ function setStringAtPath({ record, path, value }) {
 function assertSafePath({ path }) {
 	if (path.length === 0 || path.some((segment) => segment.length === 0 || UNSAFE_PATH_SEGMENTS.has(segment))) throw new Error("ACP instruction mapping path must contain only safe, non-empty property names.");
 }
-function isRecord$2(value) {
+function isRecord$3(value) {
 	return value != null && typeof value === "object" && !Array.isArray(value);
 }
 //#endregion
 //#region src/v1/bridge/host-tool-mcp-server.ts
-const VERSION = "1.0.76";
+const VERSION = "1.0.77";
 function createHostToolMCPServer({ tools, revision = 1, invoke, onListTools }) {
 	let catalog = createCatalog({
 		revision,
@@ -2429,7 +2431,7 @@ async function handleRequest({ request, credential, state, serverName, turn, nex
 	});
 }
 async function handleCatalogNext({ body, state }) {
-	if (!isRecord$1(body) || !Number.isSafeInteger(body.afterRevision) || body.afterRevision < 0) throw new RelayRequestError({
+	if (!isRecord$2(body) || !Number.isSafeInteger(body.afterRevision) || body.afterRevision < 0) throw new RelayRequestError({
 		status: 400,
 		message: "Invalid host tool catalog poll request."
 	});
@@ -2445,7 +2447,7 @@ async function handleCatalogNext({ body, state }) {
 	} : { revision: state.revision };
 }
 function handleCatalogSeen({ body, state }) {
-	if (!isRecord$1(body) || !Number.isSafeInteger(body.revision) || body.revision < 1 || body.revision > state.revision) throw new RelayRequestError({
+	if (!isRecord$2(body) || !Number.isSafeInteger(body.revision) || body.revision < 1 || body.revision > state.revision) throw new RelayRequestError({
 		status: 400,
 		message: "Invalid host tool catalog acknowledgment."
 	});
@@ -2467,7 +2469,7 @@ async function handleInvocation({ body, state, serverName, turn, nextInvocationO
 		status: 409,
 		message: "No ACP prompt turn is active."
 	});
-	if (!isRecord$1(body) || typeof body.requestId !== "string" || typeof body.toolName !== "string" || !isRecord$1(body.input) || !Number.isSafeInteger(body.catalogRevision)) throw new RelayRequestError({
+	if (!isRecord$2(body) || typeof body.requestId !== "string" || typeof body.toolName !== "string" || !isRecord$2(body.input) || !Number.isSafeInteger(body.catalogRevision)) throw new RelayRequestError({
 		status: 400,
 		message: "Invalid host tool relay request."
 	});
@@ -2480,6 +2482,13 @@ async function handleInvocation({ body, state, serverName, turn, nextInvocationO
 		status: 404,
 		message: `Host tool ${body.toolName} is not active in catalog revision ${state.revision}.`
 	});
+	if (!await turn.waitForToolCallAuthorization({
+		toolName: tool.name,
+		input: body.input
+	})) throw new RelayRequestError({
+		status: 401,
+		message: "Unauthorized host tool relay request."
+	});
 	const correlationToken = randomBytes(32).toString("hex");
 	turn.registerCorrelationInvocation({
 		token: correlationToken,
@@ -2556,12 +2565,7 @@ function resolveRefreshWaiters({ state, closing }) {
 	for (const waiter of [...state.refreshWaiters]) if (closing || state.servedRevision >= waiter.revision) waiter.resolve(!closing);
 }
 function catalogFingerprint({ tools }) {
-	return JSON.stringify(canonicalizeJSON({ value: tools }));
-}
-function canonicalizeJSON({ value }) {
-	if (Array.isArray(value)) return value.map((item) => canonicalizeJSON({ value: item }));
-	if (!isRecord$1(value)) return value;
-	return Object.fromEntries(Object.keys(value).sort().filter((key) => value[key] !== void 0).map((key) => [key, canonicalizeJSON({ value: value[key] })]));
+	return canonicalFingerprint({ value: tools });
 }
 async function readJSONBody({ request }) {
 	const chunks = [];
@@ -2607,7 +2611,7 @@ function closeServer({ server }) {
 		});
 	});
 }
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return value != null && typeof value === "object" && !Array.isArray(value);
 }
 var RelayRequestError = class extends Error {
@@ -2618,6 +2622,149 @@ var RelayRequestError = class extends Error {
 	}
 };
 //#endregion
+//#region src/v1/bridge/host-tool-relay-authorization.ts
+const DEFAULT_AUTHORIZATION_WAIT_MS = 1e4;
+function createHostToolRelayAuthorization({ serverName, toolNames, ttlMs = DEFAULT_AUTHORIZATION_WAIT_MS }) {
+	const observedCalls = /* @__PURE__ */ new Map();
+	const authorizations = /* @__PURE__ */ new Map();
+	const pendingRequests = [];
+	let closed = false;
+	const observe = ({ toolCall }) => {
+		if (closed) return;
+		const previous = observedCalls.get(toolCall.toolCallId);
+		if (previous?.consumed || previous?.terminal) return;
+		const merged = {
+			...previous?.toolCall,
+			...toolCall,
+			...toolCall.name == null && previous?.toolCall.name != null ? { name: previous.toolCall.name } : {},
+			...toolCall.rawInput === void 0 && previous?.toolCall.rawInput !== void 0 ? { rawInput: previous.toolCall.rawInput } : {},
+			...toolCall.title == null && previous?.toolCall.title != null ? { title: previous.toolCall.title } : {},
+			...toolCall._meta == null && previous?.toolCall._meta != null ? { _meta: previous.toolCall._meta } : {}
+		};
+		const observed = {
+			toolCall: merged,
+			consumed: false,
+			terminal: merged.status === "completed" || merged.status === "failed"
+		};
+		observedCalls.set(toolCall.toolCallId, observed);
+		if (observed.terminal) {
+			authorizations.delete(toolCall.toolCallId);
+			return;
+		}
+		const call = resolveHostToolCall({
+			toolCall: merged,
+			serverName,
+			toolNames
+		});
+		if (call == null) {
+			authorizations.delete(toolCall.toolCallId);
+			return;
+		}
+		const key = callKey(call);
+		authorizations.set(toolCall.toolCallId, key);
+		const pendingIndex = pendingRequests.findIndex((request) => request.key === key);
+		if (pendingIndex !== -1) {
+			const [pending] = pendingRequests.splice(pendingIndex, 1);
+			clearTimeout(pending.timeout);
+			authorizations.delete(toolCall.toolCallId);
+			observed.consumed = true;
+			pending.resolve(true);
+		}
+	};
+	return {
+		observeUpdate: ({ update }) => {
+			if (update.sessionUpdate === "tool_call" || update.sessionUpdate === "tool_call_update") observe({ toolCall: update });
+		},
+		observeAllowedPermission: ({ toolCall }) => observe({ toolCall }),
+		waitForToolCallAuthorization: ({ toolName, input }) => {
+			if (closed) return Promise.resolve(false);
+			const key = callKey({
+				toolName,
+				input
+			});
+			for (const [toolCallId, authorizationKey] of authorizations) {
+				if (authorizationKey !== key) continue;
+				authorizations.delete(toolCallId);
+				observedCalls.get(toolCallId).consumed = true;
+				return Promise.resolve(true);
+			}
+			return new Promise((resolve) => {
+				const pending = {
+					key,
+					timeout: setTimeout(() => {
+						const index = pendingRequests.indexOf(pending);
+						if (index !== -1) pendingRequests.splice(index, 1);
+						resolve(false);
+					}, ttlMs),
+					resolve
+				};
+				pendingRequests.push(pending);
+			});
+		},
+		close: () => {
+			if (closed) return;
+			closed = true;
+			observedCalls.clear();
+			authorizations.clear();
+			for (const request of pendingRequests.splice(0)) {
+				clearTimeout(request.timeout);
+				request.resolve(false);
+			}
+		}
+	};
+}
+function resolveHostToolCall({ toolCall, serverName, toolNames }) {
+	const rawInput = toolCall.rawInput;
+	if (!isRecord$1(rawInput)) return void 0;
+	const isDeferred = "tool_name" in rawInput;
+	const isProvider = "providerIdentifier" in rawInput && "toolName" in rawInput && "args" in rawInput;
+	const isOrigin = "origin" in rawInput && "operation" in rawInput && "arguments" in rawInput;
+	const isCodex = "server" in rawInput && "tool" in rawInput && "arguments" in rawInput;
+	if ([
+		isDeferred,
+		isProvider,
+		isOrigin,
+		isCodex
+	].filter(Boolean).length > 1) return;
+	const matches = [];
+	for (const toolName of toolNames) {
+		const qualifiedNames = [
+			`mcp__${serverName}__${toolName}`,
+			`${serverName}__${toolName}`,
+			`mcp_${serverName}_${toolName}`
+		];
+		const isQualified = (value) => typeof value === "string" && qualifiedNames.includes(value);
+		const isDirect = toolCall.name === toolName && isRecord$1(toolCall._meta) && toolCall._meta.serverName === serverName;
+		if (isDeferred && isQualified(rawInput.tool_name) && isRecord$1(rawInput.tool_input) && (toolCall.name == null || toolCall.name === "use_tool" || isQualified(toolCall.name))) matches.push({
+			toolName,
+			input: rawInput.tool_input
+		});
+		else if (isProvider && rawInput.providerIdentifier === serverName && rawInput.toolName === toolName && isRecord$1(rawInput.args) && (toolCall.name == null || isQualified(toolCall.name))) matches.push({
+			toolName,
+			input: rawInput.args
+		});
+		else if (isCodex && rawInput.server === serverName && rawInput.tool === toolName && isRecord$1(rawInput.arguments) && (toolCall.name == null || isQualified(toolCall.name))) matches.push({
+			toolName,
+			input: rawInput.arguments
+		});
+		else if (isOrigin && rawInput.origin === serverName && rawInput.operation === toolName && isRecord$1(rawInput.arguments) && (toolCall.name == null || toolCall.name === toolName || isQualified(toolCall.name))) matches.push({
+			toolName,
+			input: rawInput.arguments
+		});
+		else if (!isDeferred && !isProvider && !isOrigin && !isCodex && (isDirect || isQualified(toolCall.name) || toolCall.name == null && (isQualified(toolCall.title) || toolCall.title === `${serverName}-${toolName}`))) matches.push({
+			toolName,
+			input: rawInput
+		});
+	}
+	return matches.length === 1 ? matches[0] : void 0;
+}
+function callKey({ toolName, input }) {
+	return `${toolName}\0${canonicalFingerprint({ value: input })}`;
+}
+function isRecord$1(value) {
+	return value != null && typeof value === "object" && !Array.isArray(value);
+}
+//#endregion
 //#region src/v1/bridge/host-tool-mcp-definition.ts
 function createHostToolMcpServerDefinition({ mcpTransport, relay, serverName, catalogPath, initialization, harnessId }) {
 	if (mcpTransport === "stdio") return {
@@ -2680,7 +2827,7 @@ async function refreshHostToolCatalog({ relay, tools, harnessId, timeoutMs }) {
 //#endregion
 //#region src/v1/bridge/permission-controller.ts
 let permissionRequestCounter = 0;
-function createACPPermissionController({ turn, sessionId, permissionMode, hasPermissionModeMapping, emitToolCall, claimHostToolPermission }) {
+function createACPPermissionController({ turn, sessionId, permissionMode, hasPermissionModeMapping, emitToolCall, claimHostToolPermission, onHostToolPermissionAllowed }) {
 	const pendingPermissions = /* @__PURE__ */ new Map();
 	return {
 		async requestPermission(request) {
@@ -2695,10 +2842,13 @@ function createACPPermissionController({ turn, sessionId, permissionMode, hasPer
 				turn.emitWarning({ message: `ACP permission request for tool call ${JSON.stringify(request.toolCall.toolCallId)} was cancelled because it did not advertise ${missing.join(" and ")}.` });
 				return cancelled();
 			}
-			if (claimHostToolPermission({ toolCall: request.toolCall })) return { outcome: {
-				outcome: "selected",
-				optionId: allowOnce.optionId
-			} };
+			if (claimHostToolPermission({ toolCall: request.toolCall })) {
+				onHostToolPermissionAllowed?.({ toolCall: request.toolCall });
+				return { outcome: {
+					outcome: "selected",
+					optionId: allowOnce.optionId
+				} };
+			}
 			if (!hasPermissionModeMapping && shouldAutoApprove({
 				permissionMode,
 				kind: request.toolCall.kind
@@ -3132,9 +3282,14 @@ async function runTurn(start, turn) {
 	cancellationFailure.catch(() => {});
 	let cancellationRequested = false;
 	let cancellationFailureError;
+	const hostToolAuthorization = createHostToolRelayAuthorization({
+		serverName: HOST_TOOL_MCP_SERVER_NAME,
+		toolNames: (start.tools ?? []).map((tool) => tool.name)
+	});
 	const cancel = async () => {
 		if (cancellationRequested) return;
 		cancellationRequested = true;
+		hostToolAuthorization.close();
 		activePermissionController?.cancelAll();
 		try {
 			if (connection == null) throw new Error("ACP connection closed before cancellation.");
@@ -3176,10 +3331,12 @@ async function runTurn(start, turn) {
 		permissionMode: start.permissionMode ?? "allow-all",
 		hasPermissionModeMapping: start.permissionModeMapping != null,
 		emitToolCall: emitStreamEvent.permissionToolCall,
-		claimHostToolPermission: emitStreamEvent.claimHostToolPermission
+		claimHostToolPermission: emitStreamEvent.claimHostToolPermission,
+		onHostToolPermissionAllowed: hostToolAuthorization.observeAllowedPermission
 	});
 	activePermissionController = permissionController;
 	const relayTurn = {
+		waitForToolCallAuthorization: hostToolAuthorization.waitForToolCallAuthorization,
 		emitToolCall: emitStreamEvent.hostToolCall,
 		emitToolResult: emitStreamEvent.hostToolResult,
 		requestToolResult: (toolCallId) => turn.requestToolResult(toolCallId),
@@ -3230,6 +3387,7 @@ async function runTurn(start, turn) {
 			}
 			if (message.kind === "session_update") {
 				const captured = streamCapture?.takeForUpdate({ update: message.update });
+				hostToolAuthorization.observeUpdate({ update: message.update });
 				for (const rawValue of captured?.precedingRawValues ?? []) emitStreamEvent.raw({ rawValue });
 				emitStreamEvent.message({
 					message,
@@ -3241,6 +3399,7 @@ async function runTurn(start, turn) {
 			if (emitStreamEvent.message({ message })) return;
 		}
 	} finally {
+		hostToolAuthorization.close();
 		if (activeQuestionRequest?.turn === turn) activeQuestionRequest = void 0;
 		permissionController.cancelAll();
 		activePermissionController = void 0;