@akira-tl/forgerelay 1.0.1 → 1.1.0

package/dist/mcp/operations/external-mcp/external-mcp.js

@@ -0,0 +1,227 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport, getDefaultEnvironment, } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { CallToolResultSchema } from "@modelcontextprotocol/sdk/types.js";
+import { claimMediaBytes, createMediaBudget, isSupportedImageMimeType, strictBase64ByteLength, } from "../media-content.js";
+import { ExternalMcpTransformError, } from "../../hooks/external-mcp-transform.js";
+const MAX_DISCOVERED_TOOLS = 100;
+const MAX_TOOL_DESCRIPTION_CHARS = 2_000;
+const MAX_TOOL_SCHEMA_BYTES = 64 * 1024;
+const MAX_TOOL_DISCOVERY_PAGES = 16;
+export class ExternalMcpError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "ExternalMcpError";
+    }
+}
+export class ExternalMcpGateway {
+    servers;
+    mediaMaxBytes;
+    constructor(servers, mediaMaxBytes) {
+        this.servers = servers;
+        this.mediaMaxBytes = mediaMaxBytes;
+    }
+    get available() {
+        return Object.keys(this.servers).length > 0;
+    }
+    async run(input, signal, transforms) {
+        signal?.throwIfAborted();
+        switch (input.operation) {
+            case "servers":
+                return {
+                    value: {
+                        operation: "servers",
+                        servers: Object.entries(this.servers)
+                            .sort(([left], [right]) => left.localeCompare(right))
+                            .map(([name, server]) => ({ name, transport: server.transport })),
+                    },
+                };
+            case "tools":
+                return this.withClient(input.server, signal, async (client) => {
+                    const discovery = await discoverTools(client, signal);
+                    return {
+                        value: {
+                            operation: "tools",
+                            server: input.server,
+                            tools: discovery.tools.map(summarizeTool),
+                            ...(discovery.truncated ? { truncated: true } : {}),
+                        },
+                    };
+                });
+            case "call":
+                return this.withClient(input.server, signal, async (client) => {
+                    await assertRegisteredTool(client, input.server, input.tool, signal);
+                    const appliedTransforms = [];
+                    let callArguments = input.arguments ?? {};
+                    if (transforms?.request) {
+                        const transformed = await transforms.request(input.server, input.tool, callArguments);
+                        callArguments = transformed.value;
+                        appliedTransforms.push(...transformed.transforms);
+                    }
+                    let result = await client.callTool({ name: input.tool, arguments: callArguments }, undefined, { signal });
+                    assertCallToolResult(input.server, input.tool, result);
+                    if (result.isError) {
+                        throw new ExternalMcpError("tool_failed", `External MCP ${input.server} tool ${input.tool} returned an upstream tool error.`);
+                    }
+                    if (transforms?.result) {
+                        const transformed = await transforms.result(input.server, input.tool, result);
+                        result = transformed.value;
+                        appliedTransforms.push(...transformed.transforms);
+                        assertCallToolResult(input.server, input.tool, result);
+                        if (result.isError) {
+                            throw new ExternalMcpError("tool_failed", `External MCP ${input.server} tool ${input.tool} returned an error after result transformation.`);
+                        }
+                    }
+                    const projection = projectExternalMcpContent(input.server, input.tool, result, this.mediaMaxBytes);
+                    return {
+                        content: result.content,
+                        value: {
+                            operation: "call",
+                            server: input.server,
+                            tool: input.tool,
+                            content: projection.content,
+                            ...(!projection.hasMedia && isRecord(result.structuredContent)
+                                ? { structuredContent: result.structuredContent }
+                                : {}),
+                            ...(appliedTransforms.length > 0 ? { transforms: appliedTransforms } : {}),
+                        },
+                    };
+                });
+        }
+    }
+    async withClient(name, signal, operation) {
+        const config = this.servers[name];
+        if (!config)
+            throw new ExternalMcpError("unknown_server", `Unknown configured external MCP server: ${name}.`);
+        const client = new Client({ name: "forgerelay-external-mcp", version: "1.0.0" });
+        const transport = createTransport(config);
+        try {
+            signal?.throwIfAborted();
+            await client.connect(transport);
+            signal?.throwIfAborted();
+            return await operation(client);
+        }
+        catch (error) {
+            if (error instanceof ExternalMcpError || error instanceof ExternalMcpTransformError)
+                throw error;
+            if (signal?.aborted)
+                signal.throwIfAborted();
+            throw new ExternalMcpError("transport_failed", `External MCP ${name} request failed.`);
+        }
+        finally {
+            await client.close().catch(() => undefined);
+        }
+    }
+}
+function createTransport(config) {
+    if (config.transport === "stdio") {
+        return new StdioClientTransport({
+            command: config.command,
+            ...(config.args ? { args: config.args } : {}),
+            ...(config.cwd ? { cwd: config.cwd } : {}),
+            ...(config.env
+                ? { env: { ...getDefaultEnvironment(), ...config.env } }
+                : {}),
+            stderr: "ignore",
+        });
+    }
+    return new StreamableHTTPClientTransport(new URL(config.url), {
+        ...(config.headers ? { requestInit: { headers: config.headers } } : {}),
+    });
+}
+async function discoverTools(client, signal) {
+    const tools = [];
+    let cursor;
+    for (let pageIndex = 0; pageIndex < MAX_TOOL_DISCOVERY_PAGES; pageIndex += 1) {
+        signal?.throwIfAborted();
+        const page = await client.listTools(cursor ? { cursor } : undefined, { signal });
+        const remaining = MAX_DISCOVERED_TOOLS - tools.length;
+        tools.push(...page.tools.slice(0, remaining));
+        if (page.tools.length > remaining)
+            return { tools, truncated: true };
+        cursor = page.nextCursor;
+        if (!cursor)
+            return { tools, truncated: false };
+        if (tools.length >= MAX_DISCOVERED_TOOLS)
+            return { tools, truncated: true };
+    }
+    return { tools, truncated: cursor !== undefined };
+}
+async function assertRegisteredTool(client, server, tool, signal) {
+    let cursor;
+    for (let pageIndex = 0; pageIndex < MAX_TOOL_DISCOVERY_PAGES; pageIndex += 1) {
+        signal?.throwIfAborted();
+        const page = await client.listTools(cursor ? { cursor } : undefined, { signal });
+        if (page.tools.some((candidate) => candidate.name === tool))
+            return;
+        cursor = page.nextCursor;
+        if (!cursor)
+            break;
+    }
+    throw new ExternalMcpError("unknown_tool", `External MCP ${server} does not advertise tool ${tool}.`);
+}
+function summarizeTool(tool) {
+    const serialized = safeJson(tool.inputSchema);
+    const schemaTruncated = Buffer.byteLength(serialized, "utf8") > MAX_TOOL_SCHEMA_BYTES;
+    return {
+        name: tool.name,
+        ...(tool.description
+            ? { description: tool.description.slice(0, MAX_TOOL_DESCRIPTION_CHARS) }
+            : {}),
+        inputSchema: schemaTruncated ? { type: "object" } : tool.inputSchema,
+        ...(schemaTruncated ? { schemaTruncated: true } : {}),
+    };
+}
+function projectExternalMcpContent(server, tool, result, mediaMaxBytes) {
+    const budget = createMediaBudget(mediaMaxBytes);
+    const content = [];
+    let hasMedia = false;
+    for (const entry of result.content ?? []) {
+        if (entry.type === "image") {
+            hasMedia = true;
+            if (!isSupportedImageMimeType(entry.mimeType)) {
+                throw new ExternalMcpError("media_unsupported", `External MCP ${server} tool ${tool} returned unsupported image MIME type ${entry.mimeType}.`);
+            }
+            const bytes = strictBase64ByteLength(entry.data);
+            if (bytes === undefined) {
+                throw new ExternalMcpError("media_malformed", `External MCP ${server} tool ${tool} returned malformed base64 image content.`);
+            }
+            try {
+                claimMediaBytes(budget, bytes);
+            }
+            catch {
+                throw new ExternalMcpError("media_too_large", `External MCP ${server} tool ${tool} returned media exceeding the configured ${mediaMaxBytes}-byte aggregate limit.`);
+            }
+            content.push({ type: "image", mimeType: entry.mimeType, bytes });
+            continue;
+        }
+        if (entry.type === "audio") {
+            throw new ExternalMcpError("media_unsupported", `External MCP ${server} tool ${tool} returned unsupported audio media content.`);
+        }
+        if (entry.type === "resource" && "blob" in entry.resource && typeof entry.resource.blob === "string") {
+            throw new ExternalMcpError("media_unsupported", `External MCP ${server} tool ${tool} returned unsupported binary resource content.`);
+        }
+        content.push(entry);
+    }
+    return { content, hasMedia };
+}
+function assertCallToolResult(server, tool, value) {
+    if (!isRecord(value)
+        || !Array.isArray(value.content)
+        || !CallToolResultSchema.safeParse(value).success) {
+        throw new ExternalMcpError("unsupported_result", `External MCP ${server} tool ${tool} returned an unsupported result shape.`);
+    }
+}
+function safeJson(value) {
+    try {
+        return JSON.stringify(value) ?? "";
+    }
+    catch {
+        return "";
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/mcp/operations/media-content.js

@@ -0,0 +1,28 @@
+export const DEFAULT_MEDIA_MAX_BYTES = 20 * 1024 * 1024;
+export const SUPPORTED_IMAGE_MIME_TYPES = [
+    "image/png",
+    "image/jpeg",
+    "image/gif",
+    "image/webp",
+];
+export function createMediaBudget(maxBytes) {
+    return { maxBytes, remainingBytes: maxBytes };
+}
+export function isSupportedImageMimeType(value) {
+    return SUPPORTED_IMAGE_MIME_TYPES.includes(value);
+}
+export function strictBase64ByteLength(value) {
+    if (value.length === 0 || value.length % 4 !== 0)
+        return undefined;
+    if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) {
+        return undefined;
+    }
+    return Buffer.byteLength(value, "base64");
+}
+export function claimMediaBytes(budget, bytes) {
+    if (bytes > budget.remainingBytes) {
+        throw new Error(`Media content exceeds the configured per-result limit of ${budget.maxBytes} bytes ` +
+            `(${bytes} bytes requested, ${budget.remainingBytes} bytes remaining).`);
+    }
+    budget.remainingBytes -= bytes;
+}

package/dist/mcp/server/core/activity-support.js

@@ -65,6 +65,6 @@ export function runActivityTool(lifecycle, workspace, conversationScopeId, tool,
         ...relation,
     });
 }
-export function runActivityToolWithHooks(lifecycle, hooks, workspace, conversationScopeId, request, hookOptions, relation = {}) {
-    return runActivityTool(lifecycle, workspace, conversationScopeId, hookOptions.tool, request, () => runToolWithHooks(hooks, hookOptions), standardActivityOutcome, relation);
+export function runActivityToolWithHooks(lifecycle, hooks, workspace, conversationScopeId, request, hookOptions, relation = {}, auditResult) {
+    return runActivityTool(lifecycle, workspace, conversationScopeId, hookOptions.tool, request, () => runToolWithHooks(hooks, hookOptions), standardActivityOutcome, relation, auditResult);
 }

package/dist/mcp/server/core/capabilities/external-mcp.js

@@ -0,0 +1,31 @@
+import { z } from "zod";
+const externalMcpInputSchema = z.discriminatedUnion("operation", [
+    z.object({ operation: z.literal("servers") }).strict(),
+    z.object({
+        operation: z.literal("tools"),
+        server: z.string().min(1),
+    }).strict(),
+    z.object({
+        operation: z.literal("call"),
+        server: z.string().min(1),
+        tool: z.string().min(1),
+        arguments: z.record(z.string(), z.unknown()).optional(),
+    }).strict(),
+]);
+export function externalMcpCapabilityDefinitions(dependency) {
+    if (!dependency)
+        return [];
+    return [{
+            name: "mcp.external",
+            description: "Discover and call tools from user-configured external MCP servers through the ForgeRelay Capability gateway.",
+            guideName: "external-mcp",
+            readGuideBeforeFirstUse: true,
+            batchPolicy: "unsupported",
+            inputSchema: externalMcpInputSchema,
+            availability: () => ({
+                available: dependency.available,
+                reason: dependency.unavailableReason,
+            }),
+            run: async (input, context, options) => dependency.run(input, context, options),
+        }];
+}

package/dist/mcp/server/core/capabilities.js

@@ -40,6 +40,13 @@ const CAPABILITY_GUIDE_DEFINITIONS = [
         description: "Read-only semantic code navigation backed by external Language servers.",
         whenToRead: "Read before using code.intelligence or configuring Language servers.",
     },
+    {
+        name: "external-mcp",
+        directory: "host-integration/external-mcp",
+        description: "User-configured external MCP tool discovery and explicit forwarding through capability.",
+        whenToRead: "Read before discovering or calling a configured external MCP server.",
+        enabled: (config) => Object.keys(config.mcpServers).length > 0,
+    },
     {
         name: "workspace-tasks",
         directory: "workspace/workspace-tasks",
@@ -110,6 +117,9 @@ export function buildCapabilityFingerprint(config, version, context = {}) {
     if (config.subagents) {
         capabilities.push("subagent.session");
     }
+    if (Object.keys(config.mcpServers).length > 0) {
+        capabilities.push("mcp.external");
+    }
     if (config.artifactsEnabled && context.artifactDownloadSupported) {
         capabilities.push("artifact.native-download");
     }

package/dist/mcp/server/core/capability-registry.js

@@ -2,6 +2,7 @@ import { z } from "zod";
 import { MAX_CODE_INTELLIGENCE_RESULT_LIMIT, } from "../../../lsp/code-intelligence-types.js";
 import { batchExecuteInputSchema, } from "../../operations/batch/types.js";
 import { workspaceCheckpointInputSchema, } from "./capabilities/workspace-checkpoint.js";
+import { externalMcpCapabilityDefinitions, } from "./capabilities/external-mcp.js";
 export class CapabilityError extends Error {
     code;
     constructor(code, message) {
@@ -332,6 +333,7 @@ export function createCapabilityRegistry(dependencies) {
                     run: async (input, context, options) => dependencies.workspaceTasks.run(input, context, options),
                 }]
             : []),
+        ...externalMcpCapabilityDefinitions(dependencies.externalMcp),
         ...(dependencies.subagentSession
             ? [{
                     name: "subagent.session",

package/dist/mcp/server/core/tool-support.js

@@ -52,6 +52,35 @@ export function contentText(content) {
         .map((item) => item.text)
         .join("\n");
 }
+export function imageContentMetadata(content) {
+    const image = content.find((item) => item.type === "image");
+    return image
+        ? {
+            type: "image",
+            mimeType: image.mimeType,
+            bytes: Buffer.byteLength(image.data, "base64"),
+        }
+        : undefined;
+}
+export function metadataSafeContent(content) {
+    return content.filter((item) => item.type === "text");
+}
+export function auditToolResultWithoutImageData(result) {
+    if (typeof result !== "object" || result === null)
+        return result;
+    const record = result;
+    const content = Array.isArray(record.content) ? record.content : undefined;
+    if (!content)
+        return result;
+    const media = imageContentMetadata(content);
+    if (!media)
+        return result;
+    return {
+        ...record,
+        content: metadataSafeContent(content),
+        media,
+    };
+}
 export function toolErrorPreview(content) {
     const text = contentText(content).replace(/\s+/g, " ").trim();
     if (!text)

package/dist/mcp/server/operations/runtime/filesystem-tools.js

@@ -5,13 +5,14 @@ import { registerAppTool } from "@modelcontextprotocol/ext-apps/server";
 import * as z from "zod/v4";
 import { applyPatch } from "../../../filesystem/apply-patch.js";
 import { readFileTool } from "../../../filesystem/filesystem-tools.js";
+import { createMediaBudget } from "../../../operations/media-content.js";
 import { toolNames } from "../../../server-instructions.js";
 import { executeBulkRead } from "../../../operations/bulk-read.js";
 import { formatPathForPrompt } from "../../../../workspaces/resources/skills.js";
 import { activityRelationFor, activityRequestFor, runActivityTool, runActivityToolWithHooks, } from "../../core/activity-support.js";
 import { workspaceHookInvocation } from "../../core/capability-support.js";
 import { resultOutputSchema, workspaceAgentsFileOutputSchema } from "../../core/schemas.js";
-import { contentText, logToolCall, textBlock, toolResultAgentsFiles, toolResultContent, toolResultIsError, toolResultText, workspaceLogContext, } from "../../core/tool-support.js";
+import { contentText, imageContentMetadata, logToolCall, textBlock, toolResultAgentsFiles, toolResultContent, toolResultIsError, toolResultText, workspaceLogContext, } from "../../core/tool-support.js";
 import { appendAutomaticMutationDiagnostics } from "./mutation-diagnostics.js";
 const WRITE_TOOL_ANNOTATIONS = {
     readOnlyHint: false,
@@ -25,6 +26,11 @@ const EDIT_TOOL_ANNOTATIONS = {
     idempotentHint: false,
     openWorldHint: false,
 };
+const MEDIA_METADATA_OUTPUT_SCHEMA = z.object({
+    type: z.literal("image"),
+    mimeType: z.string(),
+    bytes: z.number().int().nonnegative(),
+});
 export function registerFilesystemTools(options) {
     const { server, config, workspaces, compositeWorkspaces, compositeTaskGuides, remoteWorkspaces, coreOperations, nativeBulkMutations, activityLifecycle, codeIntelligence, hooks, toolDescriptions, resolveExecutionTarget, prepareExecutionContext, presentSemanticWorkResult, hostScopeIdFor, } = options;
     registerAppTool(server, toolNames.read, {
@@ -66,10 +72,12 @@ export function registerFilesystemTools(options) {
         },
         outputSchema: resultOutputSchema({
             agentsFiles: z.array(workspaceAgentsFileOutputSchema).optional(),
+            media: MEDIA_METADATA_OUTPUT_SCHEMA.optional(),
             results: z.array(z.object({
                 path: z.string(),
                 status: z.enum(["done", "error"]),
                 result: z.string(),
+                media: MEDIA_METADATA_OUTPUT_SCHEMA.optional(),
             })).optional(),
             files: z.number().int().nonnegative().optional(),
             failed: z.number().int().nonnegative().optional(),
@@ -90,23 +98,32 @@ export function registerFilesystemTools(options) {
                 }
             }
             const startedAt = performance.now();
-            const children = await Promise.all(requestedPaths.map(async (requestedPath) => {
-                const response = await readFileTool({ path: requestedPath, offset, limit }, {
+            const mediaBudget = createMediaBudget(config.mediaMaxBytes);
+            const execution = await executeBulkRead({
+                paths: requestedPaths,
+                signal: extra.signal,
+                run: (requestedPath) => readFileTool({ path: requestedPath, offset, limit }, {
                     cwd: process.cwd(),
                     root: config.allowedRoots[0] ?? process.cwd(),
                     readRoots: config.allowedRoots,
-                });
-                return {
-                    path: requestedPath,
-                    status: response.isError ? "error" : "done",
-                    response,
-                    result: contentText(response.content),
-                };
-            }));
-            const failed = children.filter((child) => child.status === "error").length;
-            const content = children.flatMap((child) => requestedPaths.length === 1
-                ? child.response.content
-                : [textBlock(`--- ${child.path} · ${child.status} ---`), ...child.response.content]);
+                    mediaBudget,
+                }),
+                isError: (response) => response.isError === true,
+                resultText: (response) => contentText(response.content),
+            });
+            const children = execution.children;
+            const failed = execution.failed;
+            const content = children.flatMap((child) => {
+                const childContent = child.response
+                    ? child.response.content
+                    : [textBlock(child.result)];
+                return requestedPaths.length === 1
+                    ? childContent
+                    : [textBlock(`--- ${child.path} · ${child.status} ---`), ...childContent];
+            });
+            const singleMedia = requestedPaths.length === 1 && children[0]?.response
+                ? imageContentMetadata(children[0].response.content)
+                : undefined;
             logToolCall(config, {
                 tool: toolNames.read,
                 path: requestedPaths.length === 1 ? requestedPaths[0] : `${requestedPaths.length} unscoped files`,
@@ -118,9 +135,20 @@ export function registerFilesystemTools(options) {
                 ...(failed > 0 ? { isError: true } : {}),
                 structuredContent: {
                     result: contentText(content),
+                    ...(singleMedia ? { media: singleMedia } : {}),
                     ...(requestedPaths.length > 1
                         ? {
-                            results: children.map(({ path: childPath, status, result }) => ({ path: childPath, status, result })),
+                            results: children.map(({ path: childPath, status, result, response }) => {
+                                const media = response
+                                    ? imageContentMetadata(response.content)
+                                    : undefined;
+                                return {
+                                    path: childPath,
+                                    status,
+                                    result,
+                                    ...(media ? { media } : {}),
+                                };
+                            }),
                             files: children.length,
                             failed,
                         }
@@ -163,6 +191,7 @@ export function registerFilesystemTools(options) {
         const workspace = workspaces.getWorkspace(executionWorkspaceId);
         let response;
         await runActivityTool(activityLifecycle, workspace, hostScopeIdFor(extra._meta, extra.sessionId), toolNames.read, activityRequestFor({ workspaceId: executionWorkspaceId, paths, offset, limit }, executionContext), async (parentContext) => {
+            const mediaBudget = createMediaBudget(config.mediaMaxBytes);
             const execution = await executeBulkRead({
                 paths: paths,
                 signal: extra.signal,
@@ -170,6 +199,7 @@ export function registerFilesystemTools(options) {
                     ...executionContext,
                     parentActivityId: parentContext.activityId,
                     turnId: parentContext.turnId,
+                    mediaBudget,
                 }),
                 isError: toolResultIsError,
                 resultText: toolResultText,
@@ -191,11 +221,17 @@ export function registerFilesystemTools(options) {
                 content,
                 structuredContent: {
                     result: contentText(content),
-                    results: execution.children.map(({ path: childPath, status, result }) => ({
-                        path: childPath,
-                        status,
-                        result,
-                    })),
+                    results: execution.children.map(({ path: childPath, status, result, response }) => {
+                        const media = response
+                            ? imageContentMetadata(toolResultContent(response))
+                            : undefined;
+                        return {
+                            path: childPath,
+                            status,
+                            result,
+                            ...(media ? { media } : {}),
+                        };
+                    }),
                     files: execution.children.length,
                     failed: execution.failed,
                     ...(agentsFiles.length > 0 ? { agentsFiles } : {}),

package/dist/mcp/server/operations/runtime/operation-runtime.js

@@ -1,6 +1,7 @@
 import { CapabilityError } from "../../core/capability-registry.js";
 import { deletePath, renamePath } from "../../../filesystem/file-mutations.js";
 import { editFileTool, readFileTool, writeFileTool } from "../../../filesystem/filesystem-tools.js";
+import { createMediaBudget } from "../../../operations/media-content.js";
 import { runToolWithHooks } from "../../../hooks/hooks.js";
 import { toolNames } from "../../../server-instructions.js";
 import { BatchExecutor } from "../../../operations/batch/executor.js";
@@ -11,7 +12,7 @@ import { markReturnedOutput, processActivityOutcome, processToolResponse, } from
 import { capabilityActivityAuditRequest, capabilityActivityAuditResult } from "../../../../subagents/sessions/mcp/audit.js";
 import { activityRelationFor, activityRequestFor, runActivityTool, runActivityToolWithHooks, standardActivityOutcome, } from "../../core/activity-support.js";
 import { capabilityContextFor, managedWorktreeRecoveryCapabilityContext, workspaceHookInvocation, } from "../../core/capability-support.js";
-import { assertWorkspaceInstructionsLoadedBeforeSideEffect, contentLineCount, contentText, countDiffStats, formatDiscoveredWorkspaceInstructions, logFailedToolResponse, logToolCall, newFilePatch, textBlock, textSummary, toolResultContent, toolResultIsError, toolResultText, workspaceLogContext, } from "../../core/tool-support.js";
+import { assertWorkspaceInstructionsLoadedBeforeSideEffect, auditToolResultWithoutImageData, contentLineCount, contentText, countDiffStats, formatDiscoveredWorkspaceInstructions, imageContentMetadata, logFailedToolResponse, logToolCall, metadataSafeContent, newFilePatch, textBlock, textSummary, toolResultContent, toolResultIsError, toolResultText, workspaceLogContext, } from "../../core/tool-support.js";
 import { appendAutomaticMutationDiagnostics } from "./mutation-diagnostics.js";
 export function createOperationRuntime(options) {
     const { config, workspaces, activityLifecycle, hooks, processSessions, bashOutputStore, capabilityRegistry, codeIntelligence, hostScopeIdFor, } = options;
@@ -33,6 +34,7 @@ export function createOperationRuntime(options) {
                         cwd: workspace.root,
                         root: workspace.root,
                         readRoots: readPath.readRoots,
+                        mediaBudget: context.mediaBudget ?? createMediaBudget(config.mediaMaxBytes),
                     });
                     if (response.isError) {
                         logFailedToolResponse(config, {
@@ -49,10 +51,12 @@ export function createOperationRuntime(options) {
                     const content = discoveredInstructionContent
                         ? [discoveredInstructionContent, ...response.content]
                         : response.content;
+                    const media = imageContentMetadata(response.content);
                     const summary = {
                         ...textSummary(response.content),
                         offset: readInput.offset ?? 1,
                         limited: readInput.limit !== undefined,
+                        ...(media ? { media } : {}),
                     };
                     logToolCall(config, {
                         tool: toolNames.read,
@@ -70,11 +74,12 @@ export function createOperationRuntime(options) {
                                 workspaceId,
                                 path: readInput.path,
                                 summary,
-                                payload: { content: response.content },
+                                payload: { content: metadataSafeContent(response.content) },
                             },
                         },
                         structuredContent: {
                             result: contentText(content),
+                            ...(media ? { media } : {}),
                             ...(discoveredInstructions.length > 0
                                 ? {
                                     agentsFiles: discoveredInstructions.map((file) => ({
@@ -86,7 +91,7 @@ export function createOperationRuntime(options) {
                         },
                     };
                 },
-            }, activityRelationFor(context));
+            }, activityRelationFor(context), auditToolResultWithoutImageData);
         },
         write: async (input, context) => {
             const { workspaceId, ...writeInput } = input;
@@ -503,8 +508,10 @@ export function createOperationRuntime(options) {
                             activityId: activityContext.activityId,
                         });
                         changedPaths = execution.changedPaths ?? [];
+                        const transientContent = execution.content;
                         const result = {
-                            content: [textBlock(`Capability ${name} completed.\n${JSON.stringify(execution.value, null, 2)}`)],
+                            content: transientContent
+                                ?? [textBlock(`Capability ${name} completed.\n${JSON.stringify(execution.value, null, 2)}`)],
                             ...(execution.card
                                 ? {
                                     _meta: {

package/dist/mcp/server/transport/http-server.js

@@ -59,7 +59,7 @@ export function createHttpServer(config, options, createMcpServer) {
     });
     const workspaceStore = createWorkspaceStore(config.stateDir);
     const workspaces = new WorkspaceRegistry(config, workspaceStore);
-    const sharedRemoteWorkspaces = new RemoteWorkspaceRelay(config.configDir, config.stateDir);
+    const sharedRemoteWorkspaces = new RemoteWorkspaceRelay(config.configDir, config.stateDir, config.mediaMaxBytes);
     const sharedCompositeWorkspaces = new CompositeWorkspaceRegistry(config.stateDir);
     const sharedWorkspaceTasks = new WorkspaceTaskStore(config.stateDir);
     const sharedTaskReminders = new WorkspaceTaskReminderTracker(config.taskReminderInterval, sharedWorkspaceTasks);

package/dist/runtime/config/config.js

@@ -4,6 +4,8 @@ import { join, resolve } from "node:path";
 import { expandHomePath } from "../../mcp/filesystem/roots.js";
 import { mergeHookConfigs, parseHookConfig } from "../../mcp/hooks/hooks.js";
 import { forgerelayAgentsDir, forgerelaySkillsDir, generateInstanceId, loadForgeRelayFiles, } from "./user-config.js";
+import { parseExternalMcpServers, } from "./external-mcp-config.js";
+import { DEFAULT_MEDIA_MAX_BYTES } from "../../mcp/operations/media-content.js";
 import { shellInstructionPath } from "../instructions/shell-instructions.js";
 import { resolveConfiguredCommandShellRuntime, } from "../shell/command-shell-runtime.js";
 const DEFAULT_OAUTH_ACCESS_TOKEN_TTL_SECONDS = 60 * 60;
@@ -303,6 +305,7 @@ export function loadConfig(env = process.env) {
             ? files.config.artifactsEnabled === true
             : parseBoolean(productEnv(env, "ARTIFACTS")),
         artifactMaxFileBytes: parsePositiveInteger(productEnv(env, "ARTIFACT_MAX_FILE_BYTES") ?? numberConfigValue(files.config.artifactMaxFileBytes), DEFAULT_ARTIFACT_MAX_FILE_BYTES, "FORGERELAY_ARTIFACT_MAX_FILE_BYTES"),
+        mediaMaxBytes: parsePositiveInteger(productEnv(env, "MEDIA_MAX_BYTES") ?? numberConfigValue(files.config.mediaMaxBytes), DEFAULT_MEDIA_MAX_BYTES, "FORGERELAY_MEDIA_MAX_BYTES"),
         taskReminderInterval: parseNonNegativeInteger(productEnv(env, "TASK_REMINDER_INTERVAL") ?? numberConfigValue(files.config.taskReminderInterval), DEFAULT_TASK_REMINDER_INTERVAL, "FORGERELAY_TASK_REMINDER_INTERVAL"),
         skillsEnabled: productEnv(env, "SKILLS") === undefined ? true : parseBoolean(productEnv(env, "SKILLS")),
         skillPaths: parsePathList(productEnv(env, "SKILL_PATHS")),
@@ -313,6 +316,7 @@ export function loadConfig(env = process.env) {
             : parseBoolean(productEnv(env, "SUBAGENTS")),
         languageServers: files.config.languageServers ?? {},
         allowAgentLanguageServerInstall: files.config.allowAgentLanguageServerInstall === true,
+        mcpServers: parseExternalMcpServers(files.config.mcpServers),
         agentDir: resolve(expandHomePath(productEnv(env, "AGENT_DIR") ?? files.config.agentDir ?? defaultAgentDir())),
         systemInstructionsPath: parseSystemInstructionsPath(productEnv(env, "SYSTEM_INSTRUCTIONS_PATH") ?? files.config.systemInstructionsPath),
         hooks: mergeHookConfigs(parseHookConfig(files.config.hooks), parseHookConfig(files.hooks), files.hookFiles),