@aiwg/cli 2026.8.3 → 2026.8.4

package/dist/src/mcp/registry.mjs

@@ -60,6 +60,17 @@ const DEFAULT_REGISTRY = {
   servers: {},
 };
 
+const ENV_REFERENCE_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+function validateCredentialReferences(def) {
+  for (const [header, envName] of Object.entries(def.headerEnv || {})) {
+    if (!header.trim()) throw new Error('MCP header-env header name must not be empty');
+    if (!ENV_REFERENCE_NAME.test(envName)) {
+      throw new Error(`Invalid MCP header environment variable reference "${envName}"`);
+    }
+  }
+}
+
 export class McpServerRegistry {
   #configDir;
   #cache = null;
@@ -99,6 +110,7 @@ export class McpServerRegistry {
   }
 
   async add(def) {
+    validateCredentialReferences(def);
     const data = await this.load();
 
     if (data.servers[def.name]) {
@@ -133,12 +145,14 @@ export class McpServerRegistry {
       throw new Error(`Server "${name}" not found.`);
     }
 
-    data.servers[name] = {
+    const next = {
       ...data.servers[name],
       ...updates,
       name,
       updatedAt: new Date().toISOString(),
     };
+    validateCredentialReferences(next);
+    data.servers[name] = next;
 
     await this.save();
   }

package/dist/src/research/query-cli.js

@@ -40,7 +40,7 @@ function usage() {
     return [
         "Usage: aiwg research-query <question> [--backend fortemi-core|local] [--graph <name>]",
         "                           [--depth quick|thorough] [--sources-only] [--max-sources N]",
-        "                           [--json] [--save]",
+        "                           [--include-diagnostics] [--json] [--save]",
     ].join("\n");
 }
 function flagValue(args, flag, errorMessage) {
@@ -73,7 +73,12 @@ function stripFlags(args) {
         "--depth",
         "--max-sources",
     ]);
-    const bareFlags = new Set(["--sources-only", "--json", "--save"]);
+    const bareFlags = new Set([
+        "--sources-only",
+        "--include-diagnostics",
+        "--json",
+        "--save",
+    ]);
     const question = [];
     for (let index = 0; index < args.length; index++) {
         const arg = args[index];
@@ -96,8 +101,7 @@ function parseArgs(args) {
     if (backend && backend !== "local" && backend !== "fortemi-core") {
         throw new Error("--backend must be local or fortemi-core");
     }
-    const depth = (flagValue(args, "--depth", "--depth must be quick or thorough") ??
-        "thorough");
+    const depth = (flagValue(args, "--depth", "--depth must be quick or thorough") ?? "thorough");
     if (depth !== "quick" && depth !== "thorough") {
         throw new Error("--depth must be quick or thorough");
     }
@@ -113,6 +117,7 @@ function parseArgs(args) {
         depth,
         maxSources,
         sourcesOnly: hasFlag(args, "--sources-only"),
+        includeDiagnostics: hasFlag(args, "--include-diagnostics"),
         json: hasFlag(args, "--json"),
         save: hasFlag(args, "--save"),
     };
@@ -140,18 +145,40 @@ function entryId(entry) {
         text.match(/\bPROF-[A-Z0-9-]+/i)?.[0]?.toUpperCase() ??
         path.basename(entry.path).replace(/\.[^.]+$/, ""));
 }
-function gradeFromText(text) {
-    const normalized = text.toUpperCase();
-    if (/\bVERY\s+LOW\b/.test(normalized))
+function normalizedGrade(value) {
+    const normalized = value.trim().toUpperCase();
+    if (/^(VERY\s+LOW|D)$/.test(normalized))
         return "VERY LOW";
-    if (/\bHIGH\b/.test(normalized))
+    if (/^(HIGH|A(?:-)?)$/.test(normalized))
         return "HIGH";
-    if (/\bMODERATE\b/.test(normalized))
+    if (/^(MODERATE|B(?:-)?)$/.test(normalized))
         return "MODERATE";
-    if (/\bLOW\b/.test(normalized))
+    if (/^(LOW|C(?:-)?)$/.test(normalized))
         return "LOW";
     return "UNKNOWN";
 }
+/**
+ * Extract only an explicitly declared research grade. Generic severity words
+ * in scan reports must never become evidence-quality signals.
+ */
+function gradeForEntry(entry, body) {
+    for (const tag of entry.tags) {
+        const tagged = tag.match(/^grade[-_: ](very[-_ ]low|high|moderate|low|[a-d](?:-)?)$/i);
+        if (tagged)
+            return normalizedGrade(tagged[1].replace(/[-_]/g, " "));
+    }
+    const text = [entry.summary, body].join("\n");
+    const declarations = [
+        /\bGRADE(?:\s+(?:quality|rating|level|assessment))?\s*[:=]\s*\*{0,2}\s*(VERY\s+LOW|HIGH|MODERATE|LOW|[A-D](?:-)?)\b/i,
+        /##\s+GRADE[^\n]*\n(?:[^\n]*\n){0,3}?[^\n]*?(?:overall|rating|level)?\s*[:=]\s*\*{0,2}\s*(VERY\s+LOW|HIGH|MODERATE|LOW|[A-D](?:-)?)\b/i,
+    ];
+    for (const declaration of declarations) {
+        const match = declaration.exec(text);
+        if (match)
+            return normalizedGrade(match[1]);
+    }
+    return "UNKNOWN";
+}
 function relevance(score) {
     if (score >= 0.55)
         return "direct";
@@ -191,26 +218,58 @@ function isResearchEntry(entry) {
         entryPath.includes("/research/") ||
         entryPath.includes("/kb/"));
 }
+/** Generated diagnostics are searchable only by explicit operator opt-in. */
+function isDiagnosticEntry(entry) {
+    const type = entry.type.toLowerCase();
+    const entryPath = entry.path.toLowerCase().replaceAll("\\", "/");
+    const tags = entry.tags.map((tag) => tag.toLowerCase());
+    return (entryPath.includes("/.aiwg/research/quarantine/") ||
+        entryPath.includes("/research/quarantine/") ||
+        /(?:^|\/)no-ref-[^/]*artifact-scan\.md$/.test(entryPath) ||
+        /(?:llm|integrity|artifact)-scan\.md$/.test(entryPath) ||
+        /(?:integrity|artifact|llm)[-_ ]scan|quarantine|diagnostic/.test(type) ||
+        tags.some((tag) => /^(?:integrity|artifact|llm)[-_ ]scan$|^quarantine$|^diagnostic$/.test(tag)));
+}
 function localEntries(cwd, graph) {
     const index = loadGraphIndexFile(cwd, "metadata.json", graph);
-    return index ? Object.values(index.entries) : [];
+    return index ? Object.values(index.entries).map((entry) => ({ entry })) : [];
+}
+function cachedRecordBody(record) {
+    return [
+        record.search?.body,
+        record.text,
+        ...(record.chunks ?? []).map((chunk) => chunk.text),
+    ]
+        .filter((part) => Boolean(part))
+        .join("\n");
 }
 async function backendEntries(cwd, graph, backend) {
     if (backend === "fortemi-core") {
-        const { loadFortemiCoreMetadataEntries } = await import("../artifacts/fortemi-core-query-adapter.js");
+        const { loadFortemiCoreExport, loadFortemiCoreMetadataEntries } = await import("../artifacts/fortemi-core-query-adapter.js");
         const loaded = loadFortemiCoreMetadataEntries(cwd, graph);
-        return { entries: loaded.entries, hint: loaded.reason };
+        if (loaded.reason)
+            return { entries: [], hint: loaded.reason };
+        const exported = loadFortemiCoreExport(cwd, graph);
+        if (!exported.exported)
+            return { entries: [], hint: exported.reason };
+        const records = new Map(exported.exported.items.map((record) => [record.source.path, record]));
+        return {
+            entries: loaded.entries.map((entry) => {
+                const record = records.get(entry.path);
+                return {
+                    entry,
+                    cachedBody: record ? cachedRecordBody(record) : "",
+                };
+            }),
+        };
     }
     return { entries: localEntries(cwd, graph) };
 }
-function sourceForEntry(cwd, entry, question, depth) {
-    const body = depth === "thorough" ? readEntryBody(cwd, entry.path) : "";
-    const sourceText = [
-        entry.title,
-        entry.summary,
-        entry.tags.join(" "),
-        body,
-    ].join("\n");
+function sourceForEntry(cwd, candidate, question, depth) {
+    const { entry } = candidate;
+    const body = depth === "thorough"
+        ? (candidate.cachedBody ?? readEntryBody(cwd, entry.path))
+        : "";
     const score = scoreEntry(entry, question, body, depth);
     if (score <= 0)
         return null;
@@ -219,7 +278,7 @@ function sourceForEntry(cwd, entry, question, depth) {
         path: entry.path,
         title: entry.title,
         type: entry.type,
-        grade: gradeFromText(sourceText),
+        grade: gradeForEntry(entry, body),
         relevance: relevance(score),
         score: Math.round(score * 1000) / 1000,
         summary: entry.summary,
@@ -236,13 +295,24 @@ export async function runResearchQuery(cwd, options) {
         throw new Error(loaded.hint);
     }
     const sources = loaded.entries
-        .filter(isResearchEntry)
-        .map((entry) => sourceForEntry(cwd, entry, options.question, depth))
+        .filter(({ entry }) => isResearchEntry(entry))
+        .filter(({ entry }) => options.includeDiagnostics || !isDiagnosticEntry(entry))
+        .map((candidate) => sourceForEntry(cwd, candidate, options.question, depth))
         .filter((source) => source !== null)
         .sort((left, right) => {
         const scoreCmp = right.score - left.score;
         if (scoreCmp !== 0)
             return scoreCmp;
+        const gradeOrder = [
+            "HIGH",
+            "MODERATE",
+            "LOW",
+            "VERY LOW",
+            "UNKNOWN",
+        ];
+        const gradeCmp = gradeOrder.indexOf(left.grade) - gradeOrder.indexOf(right.grade);
+        if (gradeCmp !== 0)
+            return gradeCmp;
         return left.path.localeCompare(right.path);
     })
         .slice(0, maxSources);

package/dist/src/serve/shared-host-scheduler.js

@@ -0,0 +1,260 @@
+/**
+ * Cross-orchestrator scheduling and admission for shared execution hosts.
+ *
+ * The store is the global serialization boundary. Multiple AIWG processes must
+ * use the same durable implementation; the in-memory store is for tests and
+ * single-process embedding only. Executor substrates report capacity and run
+ * admitted work, but do not own this policy.
+ *
+ * @implements #1566
+ */
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { dirname } from 'node:path';
+export class InMemoryAdmissionStore {
+    snapshot = { revision: 0, records: {} };
+    transact(mutate) {
+        const draft = structuredClone(this.snapshot);
+        const result = mutate(draft);
+        draft.revision += 1;
+        this.snapshot = draft;
+        return result;
+    }
+    read() {
+        return structuredClone(this.snapshot);
+    }
+}
+/** Durable cross-process store. The lock is deliberately non-blocking: a
+ * concurrent writer receives a conflict and retries through its control loop. */
+export class FileAdmissionStore {
+    path;
+    constructor(path) {
+        this.path = path;
+    }
+    transact(mutate) {
+        mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
+        const lockPath = `${this.path}.lock`;
+        let descriptor;
+        try {
+            descriptor = openSync(lockPath, 'wx', 0o600);
+        }
+        catch (error) {
+            if (error.code === 'EEXIST') {
+                throw new Error('shared-host admission store is busy; retry the request');
+            }
+            throw error;
+        }
+        try {
+            const snapshot = this.readUnsafe();
+            const result = mutate(snapshot);
+            snapshot.revision += 1;
+            const temporary = `${this.path}.${process.pid}.tmp`;
+            writeFileSync(temporary, `${JSON.stringify(snapshot, null, 2)}\n`, { mode: 0o600 });
+            renameSync(temporary, this.path);
+            return result;
+        }
+        finally {
+            closeSync(descriptor);
+            try {
+                unlinkSync(lockPath);
+            }
+            catch { /* best-effort lock cleanup */ }
+        }
+    }
+    read() {
+        return structuredClone(this.readUnsafe());
+    }
+    readUnsafe() {
+        if (!existsSync(this.path))
+            return { revision: 0, records: {} };
+        return JSON.parse(readFileSync(this.path, 'utf8'));
+    }
+}
+const terminalStates = new Set([
+    'denied', 'cancelled', 'timed-out', 'preempted',
+]);
+export class SharedHostScheduler {
+    store;
+    policy;
+    clock;
+    constructor(store, policy, clock = Date.now) {
+        this.store = store;
+        this.policy = policy;
+        this.clock = clock;
+        if (!Number.isInteger(policy.maxConcurrent) || policy.maxConcurrent < 1) {
+            throw new Error('maxConcurrent must be a positive integer');
+        }
+        if (policy.leaseTtlMs < 1 || policy.agingIntervalMs < 1) {
+            throw new Error('leaseTtlMs and agingIntervalMs must be positive');
+        }
+    }
+    submit(request) {
+        this.validateRequest(request);
+        return this.store.transact(snapshot => {
+            const existing = snapshot.records[request.requestId];
+            if (existing) {
+                if (!sameRequest(existing, request)) {
+                    throw new Error(`request '${request.requestId}' conflicts with an existing admission`);
+                }
+                return existing;
+            }
+            snapshot.records[request.requestId] = {
+                ...structuredClone(request),
+                state: 'queued',
+                revision: 1,
+                reason: 'awaiting shared-host capacity',
+            };
+            this.reconcile(snapshot);
+            return structuredClone(snapshot.records[request.requestId]);
+        });
+    }
+    reconcileNow() {
+        return this.store.transact(snapshot => {
+            this.reconcile(snapshot);
+            return structuredClone(snapshot);
+        });
+    }
+    renew(requestId) {
+        return this.store.transact(snapshot => {
+            const record = this.required(snapshot, requestId);
+            if (record.state !== 'admitted')
+                throw new Error(`cannot renew ${record.state} admission`);
+            record.leaseExpiresAt = new Date(this.clock() + this.policy.leaseTtlMs).toISOString();
+            record.revision += 1;
+            record.reason = 'lease renewed';
+            return structuredClone(record);
+        });
+    }
+    release(requestId) {
+        return this.store.transact(snapshot => {
+            const record = this.required(snapshot, requestId);
+            delete snapshot.records[requestId];
+            if (record.state === 'admitted')
+                this.reconcile(snapshot);
+            return structuredClone(snapshot);
+        });
+    }
+    cancel(requestId) {
+        return this.store.transact(snapshot => {
+            const record = this.required(snapshot, requestId);
+            if (terminalStates.has(record.state))
+                return structuredClone(record);
+            record.state = 'cancelled';
+            record.reason = 'cancelled by orchestrator';
+            record.finishedAt = new Date(this.clock()).toISOString();
+            record.revision += 1;
+            this.reconcile(snapshot);
+            return structuredClone(record);
+        });
+    }
+    snapshot() {
+        return this.store.read();
+    }
+    reconcile(snapshot) {
+        const now = this.clock();
+        for (const record of Object.values(snapshot.records)) {
+            if (record.state === 'admitted' && Date.parse(record.leaseExpiresAt ?? '') <= now) {
+                record.state = 'timed-out';
+                record.reason = 'admission lease expired; capacity recovered';
+                record.finishedAt = new Date(now).toISOString();
+                record.revision += 1;
+            }
+            else if (record.state === 'queued' && Date.parse(record.submittedAt) + record.queueTimeoutMs <= now) {
+                record.state = 'timed-out';
+                record.reason = 'queue deadline elapsed';
+                record.finishedAt = new Date(now).toISOString();
+                record.revision += 1;
+            }
+        }
+        let queued = Object.values(snapshot.records)
+            .filter(record => record.state === 'queued')
+            .sort((a, b) => this.compare(a, b, now));
+        for (const candidate of queued) {
+            if (!this.hasCapacity(snapshot, candidate)) {
+                if (this.policy.allowPreemption)
+                    this.tryPreempt(snapshot, candidate, now);
+            }
+            if (!this.hasCapacity(snapshot, candidate))
+                continue;
+            candidate.state = 'admitted';
+            candidate.reason = 'admitted by shared-host policy';
+            candidate.admittedAt = new Date(now).toISOString();
+            candidate.leaseExpiresAt = new Date(now + this.policy.leaseTtlMs).toISOString();
+            candidate.revision += 1;
+        }
+        queued = [];
+    }
+    tryPreempt(snapshot, candidate, now) {
+        const victims = Object.values(snapshot.records)
+            .filter(record => record.state === 'admitted' && record.preemptible === true)
+            .sort((a, b) => this.compare(b, a, now));
+        const victim = victims.find(record => {
+            if (this.effectivePriority(record, now) >= this.effectivePriority(candidate, now))
+                return false;
+            const priorState = record.state;
+            record.state = 'preempted';
+            const freesRequiredCapacity = this.hasCapacity(snapshot, candidate);
+            record.state = priorState;
+            return freesRequiredCapacity;
+        });
+        if (!victim)
+            return;
+        victim.state = 'preempted';
+        victim.reason = `preempted by higher-priority request '${candidate.requestId}'`;
+        victim.preemptedBy = candidate.requestId;
+        victim.finishedAt = new Date(now).toISOString();
+        victim.revision += 1;
+    }
+    hasCapacity(snapshot, candidate) {
+        const active = Object.values(snapshot.records).filter(record => record.state === 'admitted');
+        if (active.length >= this.policy.maxConcurrent)
+            return false;
+        if (!belowQuota(active, 'environment', candidate.environment, this.policy.environmentQuotas))
+            return false;
+        if (!belowQuota(active, 'provider', candidate.provider, this.policy.providerQuotas))
+            return false;
+        const runtimeQuotas = {
+            host: this.policy.defaultHostQuota ?? 1,
+            ...this.policy.runtimeQuotas,
+        };
+        return belowQuota(active, 'runtimeKind', candidate.runtimeKind, runtimeQuotas);
+    }
+    effectivePriority(record, now) {
+        const waited = Math.max(0, now - Date.parse(record.submittedAt));
+        return record.priority + Math.floor(waited / this.policy.agingIntervalMs);
+    }
+    compare(a, b, now) {
+        return this.effectivePriority(b, now) - this.effectivePriority(a, now)
+            || Date.parse(a.submittedAt) - Date.parse(b.submittedAt)
+            || a.requestId.localeCompare(b.requestId);
+    }
+    required(snapshot, requestId) {
+        const record = snapshot.records[requestId];
+        if (!record)
+            throw new Error(`unknown admission request '${requestId}'`);
+        return record;
+    }
+    validateRequest(request) {
+        if (!request.requestId || !request.orchestratorId || !request.environment || !request.provider) {
+            throw new Error('request identity, orchestrator, environment, and provider are required');
+        }
+        if (!Number.isFinite(request.priority))
+            throw new Error('priority must be finite');
+        if (!Number.isFinite(Date.parse(request.submittedAt)))
+            throw new Error('submittedAt must be a timestamp');
+        if (request.queueTimeoutMs < 1)
+            throw new Error('queueTimeoutMs must be positive');
+    }
+}
+function belowQuota(active, field, value, quotas) {
+    const quota = quotas?.[String(value)];
+    if (quota === undefined)
+        return true;
+    return active.filter(record => record[field] === value).length < quota;
+}
+function sameRequest(record, request) {
+    return record.orchestratorId === request.orchestratorId
+        && record.environment === request.environment
+        && record.provider === request.provider
+        && record.runtimeKind === request.runtimeKind;
+}
+//# sourceMappingURL=shared-host-scheduler.js.map

package/dist/src/storage/backends/fortemi.js

@@ -37,6 +37,58 @@
  * @issue #972
  */
 const DEFAULT_MCP_SERVER = 'fortemi';
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export function resolveMcpRequestHeaders(server, environment = process.env) {
+    const headers = { ...(server.headers ?? {}) };
+    for (const [header, envName] of Object.entries(server.headerEnv ?? {})) {
+        if (!ENV_NAME.test(envName)) {
+            throw new Error(`storage(fortemi): invalid environment variable reference "${envName}"`);
+        }
+        const value = environment[envName];
+        if (!value) {
+            throw new Error(`storage(fortemi): required credential environment variable "${envName}" is not set`);
+        }
+        headers[header] = header.toLowerCase() === 'authorization' ? `Bearer ${value}` : value;
+    }
+    return headers;
+}
+export function validateRemoteMcpUrl(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new Error(`storage(fortemi): invalid MCP server URL "${raw}"`);
+    }
+    const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback)) {
+        throw new Error('storage(fortemi): remote MCP URLs must use HTTPS; HTTP is allowed only for loopback development');
+    }
+    return url;
+}
+export function unwrapMcpToolResult(result) {
+    if (!result || typeof result !== 'object')
+        return result;
+    const envelope = result;
+    if (envelope.isError) {
+        const detail = envelope.content
+            ?.filter((item) => item.type === 'text' && typeof item.text === 'string')
+            .map((item) => item.text)
+            .join('; ');
+        throw new Error(`storage(fortemi): MCP tool failed${detail ? `: ${detail}` : ''}`);
+    }
+    if (envelope.structuredContent !== undefined)
+        return envelope.structuredContent;
+    const text = envelope.content?.find((item) => item.type === 'text' && typeof item.text === 'string')?.text;
+    if (text === undefined)
+        return result;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return { content: text };
+    }
+}
 export class FortemiAdapter {
     subsystem;
     mcpServer;
@@ -194,30 +246,60 @@ export class FortemiAdapter {
  * Implemented as a lazy import so tests that inject a stub never load
  * the SDK or touch the registry.
  */
-export const createDefaultMcpClient = async (serverName) => {
+export const createDefaultMcpClient = async (serverName, registryOverride, environment = process.env) => {
     const { McpServerRegistry } = await import('../../mcp/registry.js');
-    const registry = new McpServerRegistry();
+    const registry = registryOverride ?? new McpServerRegistry();
     const server = await registry.get(serverName);
     if (!server) {
         throw new Error(`storage(fortemi): MCP server "${serverName}" is not registered. ` +
             `Add it via "aiwg mcp add ${serverName} --command <cmd>" before using the fortemi backend.`);
     }
-    if (server.type !== 'stdio') {
-        throw new Error(`storage(fortemi): only stdio MCP servers are supported (got "${server.type}" for "${serverName}")`);
-    }
-    // Lazy import the SDK so tests that inject a stub don't pay the cost
+    // Lazy imports keep unit tests that inject a stub isolated from transports.
     const { Client } = await import('@modelcontextprotocol/sdk/client/index.js');
-    const { StdioClientTransport } = await import('@modelcontextprotocol/sdk/client/stdio.js');
-    const transport = new StdioClientTransport({
-        command: server.command ?? '',
-        args: server.args ?? [],
-        env: server.env,
-    });
+    let transport;
+    if (server.type === 'stdio') {
+        const { StdioClientTransport } = await import('@modelcontextprotocol/sdk/client/stdio.js');
+        transport = new StdioClientTransport({
+            command: server.command ?? '',
+            args: server.args ?? [],
+            env: server.env,
+        });
+    }
+    else {
+        if (!server.url) {
+            throw new Error(`storage(fortemi): MCP server "${serverName}" has no URL`);
+        }
+        const url = validateRemoteMcpUrl(server.url);
+        const headers = resolveMcpRequestHeaders(server, environment);
+        if (server.type === 'http') {
+            const { StreamableHTTPClientTransport } = await import('@modelcontextprotocol/sdk/client/streamableHttp.js');
+            transport = new StreamableHTTPClientTransport(url, {
+                requestInit: { headers },
+            });
+        }
+        else if (server.type === 'sse') {
+            const { SSEClientTransport } = await import('@modelcontextprotocol/sdk/client/sse.js');
+            transport = new SSEClientTransport(url, {
+                requestInit: { headers },
+                eventSourceInit: {
+                    fetch: async (input, init) => {
+                        const merged = new Headers(init?.headers);
+                        for (const [name, value] of Object.entries(headers))
+                            merged.set(name, value);
+                        return fetch(input, { ...init, headers: merged });
+                    },
+                },
+            });
+        }
+        else {
+            throw new Error(`storage(fortemi): unsupported MCP transport "${String(server.type)}"`);
+        }
+    }
     const client = new Client({ name: 'aiwg-storage-fortemi-adapter', version: '1.0.0' }, { capabilities: {} });
     await client.connect(transport);
     return {
         async callTool(name, args) {
-            return client.callTool({ name, arguments: args });
+            return unwrapMcpToolResult(await client.callTool({ name, arguments: args }));
         },
         async close() {
             await client.close();