@animalabs/agent-framework 0.26.2 → 0.28.0

package/src/mcpl/conversation-router.ts

@@ -37,6 +37,7 @@
 import { createHash } from 'node:crypto';
 import type { ContextStrategy } from '@animalabs/context-manager';
 import type { ChannelDescriptor } from './types.js';
+import { destinationKey, type ChannelRef } from './channel-registry.js';
 
 // ============================================================================
 // Config & types
@@ -108,6 +109,9 @@ export interface ConversationRouterConfig {
 
 export interface ConversationBinding {
   channelId: string;
+  /** The channel's server: channel ids are unique only within one server's
+   *  connection (MCPL §14.2), so each server's channel has its own binding. */
+  serverId: string;
   agentName: string;
   /** Engagement counter per channel — fresh forks get a new generation. */
   generation: number;
@@ -157,11 +161,15 @@ export const DEFAULT_CLOSURE_PROMPT =
 export class ConversationRouter {
   private config: ConversationRouterConfig;
 
-  /** Active bindings, keyed by channelId. */
+  /** Active bindings, keyed by the channel's server and id (destinationKey):
+   *  two servers' channels with one id are two conversations. */
   private bindings = new Map<string, ConversationBinding>();
 
-  /** Engagement counter per channel — survives unbind, so a re-bound channel
-   * gets a distinct fork agent name. */
+  /** Engagement counter per channel id — survives unbind, so a re-bound
+   * channel gets a distinct fork agent name. Kept by bare id, as it's
+   * persisted: two servers sharing an id share a counter, which still never
+   * repeats a name, and their forks' names differ anyway, since each hashes
+   * its server (forkAgentName). */
   private generations = new Map<string, number>();
 
   constructor(config: ConversationRouterConfig) {
@@ -191,7 +199,7 @@ export class ConversationRouter {
    * unchanged; a failed spawn doesn't leave a dangling route.
    */
   route(facts: IncomingMessageFacts): RoutingDecision {
-    const existing = this.bindings.get(facts.channelId);
+    const existing = this.bindings.get(bindingKey({ serverId: facts.serverId ?? '', channelId: facts.channelId }));
 
     if (existing) {
       return {
@@ -223,39 +231,44 @@ export class ConversationRouter {
    * Record a binding after the framework successfully spawned the fork.
    * Returns the new binding.
    */
-  bind(channelId: string, agentName: string, generation: number, now = Date.now()): ConversationBinding {
-    this.generations.set(channelId, generation);
+  bind(channel: ChannelRef, agentName: string, generation: number, now = Date.now()): ConversationBinding {
+    // The counter is kept by bare id, and two servers' spawns on one id run
+    // beside each other, so a bind can finish after a later spawn's: the
+    // counter keeps the higher, or the next spawn would propose a fork name
+    // already used.
+    this.generations.set(channel.channelId, Math.max(this.generations.get(channel.channelId) ?? 0, generation));
     const binding: ConversationBinding = {
-      channelId,
+      channelId: channel.channelId,
+      serverId: channel.serverId,
       agentName,
       generation,
       boundAt: now,
       lastActivity: now,
     };
-    this.bindings.set(channelId, binding);
+    this.bindings.set(bindingKey(channel), binding);
     return binding;
   }
 
   /** Record delivered activity on an existing binding. Does not bind a
    * channel or advance its generation. Call after successful delivery, not
    * when previewing a route. The optional clock supports deterministic use. */
-  touch(channelId: string, now = Date.now()): void {
-    const binding = this.bindings.get(channelId);
+  touch(channel: ChannelRef, now = Date.now()): void {
+    const binding = this.bindings.get(bindingKey(channel));
     if (binding) binding.lastActivity = now;
   }
 
-  unbind(channelId: string): void {
-    this.bindings.delete(channelId);
+  unbind(channel: ChannelRef): void {
+    this.bindings.delete(bindingKey(channel));
   }
 
-  getBinding(channelId: string): ConversationBinding | undefined {
-    return this.bindings.get(channelId);
+  getBinding(channel: ChannelRef): ConversationBinding | undefined {
+    return this.bindings.get(bindingKey(channel));
   }
 
   /** Reverse lookup: the channel an agent is bound to, if any. */
-  channelForAgent(agentName: string): string | undefined {
+  channelForAgent(agentName: string): ChannelRef | undefined {
     for (const binding of this.bindings.values()) {
-      if (binding.agentName === agentName) return binding.channelId;
+      if (binding.agentName === agentName) return { serverId: binding.serverId, channelId: binding.channelId };
     }
     return undefined;
   }
@@ -325,6 +338,11 @@ export class ConversationRouter {
 /** The readable part of a fork's name stops here: uniqueness rides on the hash. */
 const FORK_NAME_READABLE_MAX = 64;
 
+/** A binding's key: its channel's server and id (destinationKey). */
+function bindingKey(channel: ChannelRef): string {
+  return destinationKey(channel);
+}
+
 /**
  * A fork's agent name: `<prefix>-<readable>-g<generation>-<hash>`, such as
  * `conversation-C123-g2-e08e564271867d16` for Slack's channel `C123` on the

package/src/mcpl/convert-block.ts

@@ -11,6 +11,7 @@ import {
   IMAGE_NO_DATA_TEXT,
   IMAGE_NO_MEDIA_TYPE_TEXT,
   INLINE_WITHHELD_TEXT,
+  classifyBlock,
   isInlineContradiction,
   referenceStubOrNull,
   unknownBlockText,
@@ -85,12 +86,24 @@ export function convertBlock(block: McplContentBlock, provenance: string, server
       }
       return { type: 'text', text: isFilledString(block.data) ? AUDIO_NO_MEDIA_TYPE_TEXT : AUDIO_NO_DATA_TEXT };
 
-    case 'resource':
+    case 'resource': {
+      // MCP's embedded resource shows as the block its contents make would
+      // show here (RFC-005 §8.1), its uri never.
+      const c = classifyBlock(block);
+      if (c.kind === 'embedded' && c.contents.kind === 'block') {
+        return convertBlock(c.contents.block as McplContentBlock, provenance, serverId);
+      }
       // RFC-005: reference blocks become bounded stubs — never raw URIs
       // (a signed URL is a bearer credential that looks like a location).
       return { type: 'text', text: referenceStubOrNull(block, provenance, serverId) ?? '[reference]' };
+    }
 
     default: {
+      // MCP's link to a resource isn't one of MCPL's own blocks, but a server
+      // can send one, and RFC-005 §8.1 makes it a reference, shown as one.
+      if ((block as { type?: unknown }).type === 'resource_link') {
+        return { type: 'text', text: referenceStubOrNull(block, provenance, serverId) ?? '[reference]' };
+      }
       // Unknown wire block types previously fell off the exhaustive switch
       // and propagated `undefined` into ContentBlock[]. Fail visibly. A type
       // that isn't a string is no type, and is never converted to one: an

package/src/mcpl/hook-orchestrator.ts

@@ -71,7 +71,9 @@ function convertContent(content: string | McplContentBlock[], serverId: string):
 
 /**
  * Convert an MCPL wire-format context injection, from the server `serverId`,
- * to a context-manager ContextInjection.
+ * to a context-manager ContextInjection. It builds only these four fields,
+ * so a server can't opt an injection out of being stored
+ * (ModuleContextInjection.placedEachCompile, which only a module may set).
  */
 function convertMcplInjection(mcplInj: McplContextInjection, serverId: string): ContextInjection {
   return {
@@ -114,8 +116,17 @@ export class HookOrchestrator {
    *
    * Returns aggregated ContextInjection[] ready for context-manager's compile().
    * Fail-open: servers that time out or error are silently skipped.
+   *
+   * `channelsFor` gives each server its own channel context (§14.4), in
+   * place of `params.channels`: channel ids are unique only within one
+   * server's connection (§14.2), so each server is told only of its own
+   * channels (ChannelRegistry.buildChannelContext). Undefined from it leaves
+   * the field out for that server.
    */
-  async beforeInference(params: BeforeInferenceParams): Promise<ContextInjection[]> {
+  async beforeInference(
+    params: BeforeInferenceParams,
+    channelsFor?: (serverId: string) => BeforeInferenceParams['channels'],
+  ): Promise<ContextInjection[]> {
     // §5.4: the GRANT decides fan-out, not the raw advertisement — which
     // also fixes selection for the recursive §5.1 shape, where
     // `beforeInference: {observe: true, …}` is an object, not `true`. A
@@ -132,7 +143,7 @@ export class HookOrchestrator {
 
     this._isInHook = true;
     try {
-      return await this.fanOutBeforeInference(servers, params);
+      return await this.fanOutBeforeInference(servers, params, channelsFor);
     } finally {
       this._isInHook = false;
     }
@@ -163,17 +174,33 @@ export class HookOrchestrator {
   private async fanOutBeforeInference(
     servers: McplServerConnection[],
     params: BeforeInferenceParams,
+    channelsFor?: (serverId: string) => BeforeInferenceParams['channels'],
   ): Promise<ContextInjection[]> {
     const results = await Promise.allSettled(
-      servers.map((server) => {
+      // Async, so a throw building one server's channel context fails that
+      // server alone, as its timeout or transport error would.
+      servers.map(async (server) => {
+        let base = params;
+        if (channelsFor) {
+          const { channels: _shared, ...rest } = params;
+          let channels: BeforeInferenceParams['channels'];
+          try {
+            channels = channelsFor(server.id);
+          } catch (err) {
+            // A bug, not a server's failure: said, then this server is skipped.
+            console.error(`[beforeInference] the channel context for "${server.id}" couldn't be built, so it isn't called:`, err);
+            throw err;
+          }
+          base = channels ? { ...rest, channels } : rest;
+        }
         // §10.1: a server not granted observe MUST receive
         // `userMessage: null` — the field is ABSENT authority, not merely
         // discouraged — while the hook is still invoked so granted
         // injection positions keep working (write-without-read).
         const perServer: BeforeInferenceParams =
           CapabilityGrant.of(server).has('contextHooks.beforeInference.observe')
-            ? params
-            : { ...params, userMessage: null };
+            ? base
+            : { ...base, userMessage: null };
         return withTimeout(
           server.sendBeforeInference(perServer),
           BEFORE_INFERENCE_TIMEOUT_MS,

package/src/mcpl/inbound-source.ts

@@ -22,6 +22,8 @@
  */
 
 import { createHash } from 'node:crypto';
+import { blockAsStored, MalformedContentError } from '@animalabs/context-manager';
+import { logDetail, logValue } from './log-value.js';
 
 /** The MCPL admission lane that accepted an item. Its contract decides what
  *  an `eventId` is worth: `push/event` deduplicates by eventId, and RFC-006
@@ -192,68 +194,23 @@ export function canonicalJson(value: unknown): string {
 }
 
 /**
- * A block as the store hands it back. Context-manager keeps inline media as
- * blobs (blob-manager.ts): an image whose source isn't a URL, and every
- * document, audio or video block, comes back as `{ type, source: { type:
- * 'base64', data, mediaType } }` and nothing else, its data re-encoded from
- * the decoded bytes, and an image's media type taken from its bytes'
- * signature where they have one. Any other block comes back as it was given,
- * except a store-internal `blob_ref` from an unresolved read, which resolves
- * to inline media by default. It is digested as given here, so an unresolved
- * read and its resolved form differ. Context-manager refuses caller-supplied
- * blob_ref writes; the MCPL lanes never store one.
+ * blockAsStored throws a `MalformedContentError` for a block the store
+ * refuses on write, a caller-supplied `blob_ref` among them. Such a block
+ * has no stored form, and whatever is thrown, it is digested as given.
  */
 function storedBlock(block: unknown): unknown {
-  const media = block as { type?: unknown; source?: { type?: unknown; data?: unknown; mediaType?: unknown } } | null;
-  const blob = media?.type === 'image'
-    ? media.source?.type !== 'url'
-    : media?.type === 'document' || media?.type === 'audio' || media?.type === 'video';
-  const source = media?.source;
-  if (!blob || typeof source?.data !== 'string') return block;
-  const data = canonicalBase64(source.data);
-  const mediaType = media!.type === 'image'
-    ? sniffRasterImageMediaType(Buffer.from(data.slice(0, 32), 'base64')) ?? source.mediaType
-    : source.mediaType;
-  return { type: media!.type, source: { type: 'base64', data, mediaType } };
-}
-
-/**
- * Base64 as the store writes it back from the decoded bytes: padded, with no
- * whitespace, the standard alphabet and zero unused bits. Data already in
- * that form, as every stored copy's is, is returned without decoding it all.
- */
-function canonicalBase64(data: string): string {
-  if (data.length % 4 === 0 && /^[A-Za-z0-9+/]*={0,2}$/.test(data)) {
-    const last = data.slice(-4);
-    if (Buffer.from(last, 'base64').toString('base64') === last) return data;
-  }
-  return Buffer.from(data, 'base64').toString('base64');
-}
-
-/**
- * The store's own test for raster image types with an unambiguous byte
- * signature, copied from context-manager's blob-manager.ts (it isn't
- * exported): the store relabels an image whose bytes match one of these.
- */
-function sniffRasterImageMediaType(bytes: Uint8Array): string | null {
-  if (bytes.length >= 8 &&
-      bytes[0] === 0x89 && bytes[1] === 0x50 && bytes[2] === 0x4e && bytes[3] === 0x47 &&
-      bytes[4] === 0x0d && bytes[5] === 0x0a && bytes[6] === 0x1a && bytes[7] === 0x0a) {
-    return 'image/png';
-  }
-  if (bytes.length >= 3 && bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff) {
-    return 'image/jpeg';
-  }
-  if (bytes.length >= 6) {
-    const signature = Buffer.from(bytes.subarray(0, 6)).toString('ascii');
-    if (signature === 'GIF87a' || signature === 'GIF89a') return 'image/gif';
-  }
-  if (bytes.length >= 12 &&
-      Buffer.from(bytes.subarray(0, 4)).toString('ascii') === 'RIFF' &&
-      Buffer.from(bytes.subarray(8, 12)).toString('ascii') === 'WEBP') {
-    return 'image/webp';
+  try {
+    return blockAsStored(block as Parameters<typeof blockAsStored>[0]);
+  } catch (err) {
+    if (!(err instanceof MalformedContentError)) {
+      const { name, message } = (err ?? {}) as { name?: unknown; message?: unknown };
+      console.error(
+        `[stored-digest-as-given] error=${logValue(typeof name === 'string' ? name : typeof err)}: ` +
+        logDetail(typeof message === 'string' ? message : ''),
+      );
+    }
+    return block;
   }
-  return null;
 }
 
 /**
@@ -261,23 +218,39 @@ function sniffRasterImageMediaType(bytes: Uint8Array): string | null {
  * room-220 #46752–#47210): SHA-256 hex of `canonicalJson([blocks])` over the
  * ContentBlock[] the framework stores for the body — after MCPL conversion,
  * before any host decoration is added and before storage shards it — with
- * each block as the store keeps it (storedBlock, canonicalJson). So a body
- * hashes alike as delivered, as handed to storage, and as read back from
- * the store. The one-element array keeps the framing an undecorated,
- * unsharded stored copy has always hashed to, so a stamped copy and an
- * older copy of the same body share a version.
+ * each block as the store keeps it, which context-manager's `blockAsStored`
+ * gives. So a body hashes alike as delivered, as handed to storage, and as
+ * read back unsharded from the store with its blobs resolved, except one
+ * whose blocks the store changes together: when it mends a `tool_use` whose
+ * input isn't an object, it also releases a raw replay form (`rawXml`,
+ * `rawItem`) that the message's other blocks share, which no one block's
+ * stored form shows. A body an MCPL lane stamps is never one. A block the
+ * store refuses on write, a `blob_ref` among them, is digested as given. The
+ * one-element array keeps the framing an undecorated, unsharded stored copy
+ * has always hashed to, so a stamped copy and an older copy of the same body
+ * share a version where the store keeps the body as it did then.
+ *
+ * A digest is a digest under the context-manager release that computed it: a
+ * release that changes what the store keeps, such as its set of image
+ * signatures, changes the digest of a body it touches.
  *
  * Ingestion stamps it as `metadata.sourceBodyDigest`, and the same function
  * over exactly the blocks handed to storage (decorations included) as
  * `metadata.storedBodyDigest`, on both MCPL lanes. Both live outside the
  * frozen admission envelope: they describe the body actually delivered (a
  * materialization, a correction), not the admission. Neither proves later
- * presence or completeness; an unsharded stored copy that no longer hashes
+ * presence or completeness. An unsharded stored copy that no longer hashes
  * to its storedBodyDigest was changed after delivery (editMessage keeps
- * metadata). A body the store shards carries the whole body's two digests
- * on every shard, and no shard hashes to them. Check a copy read back with
- * its blobs resolved (getAllMessages, getMessage, or getMessageWindow
- * without `resolveBlobs: false`): a blob reference never matches.
+ * metadata), or holds blocks the store changes together, or its digest was
+ * taken under a release that kept some block of it differently: a
+ * context-manager release that changed a stored form, or an agent-framework
+ * release from 0.24.0 up to the one that brought in blockAsStored, which
+ * took stored forms from a copy of the store's transform. Digests already
+ * stamped are never recomputed. A body the store shards carries the whole
+ * body's two digests on every shard, and no shard hashes to them. Check a
+ * copy read back with its blobs resolved (getAllMessages, getMessage, or
+ * getMessageWindow without `resolveBlobs: false`): a blob reference never
+ * matches.
  *
  * Exported from the package root, so a consumer checks a copy against either
  * field with this same function rather than a copy of it.

package/src/mcpl/index.ts

@@ -88,6 +88,11 @@ export type {
 } from './types.js';
 
 export { McplMethod } from './types.js';
+// RFC-014 tool presence and toolsets (host side).
+export { ToolsetHub, ToolsetController, TOOLSETS_MODULE, META_TOOL_NAMES } from './toolset-host.js';
+export { ToolsetsModule, TOOLSETS_REMINDER_NAMESPACE } from './toolsets-module.js';
+export { ToolPresence } from './tool-presence.js';
+export type { ChangeSet, MetaToolNames, ToolsetDecl } from './tool-presence.js';
 
 // Error codes and factories
 export {
@@ -171,7 +176,7 @@ export { InferenceRouter } from './inference-router.js';
 
 // Channel registry (channel lifecycle, incoming messages, synthesized tools)
 export { ChannelRegistry } from './channel-registry.js';
-export type { PublishRefusalReason } from './channel-registry.js';
+export type { ChannelRef, PublishRefusalReason } from './channel-registry.js';
 
 // Inbound source envelope: where each accepted item came from, stamped once;
 // and the digest of a delivered or stored body

package/src/mcpl/inference-router.ts

@@ -26,6 +26,7 @@ import type {
 import type { FeatureSetManager } from './feature-set-manager.js';
 import { McplFeatureSetError } from './feature-set-manager.js';
 import type { HookOrchestrator } from './hook-orchestrator.js';
+import { logValue } from './log-value.js';
 
 // ============================================================================
 // Responder interface
@@ -181,6 +182,10 @@ export class InferenceRouter {
   private featureSetManager: FeatureSetManager;
   private routingPolicy: InferenceRoutingPolicy | null;
   private emitTraceFn: (event: { type: string; [key: string]: unknown }) => void;
+  /** The refusals for want of a model that have been logged: one line per
+   *  server with no policy, and per server and feature set with one, so a
+   *  server that keeps asking doesn't flood the operator's log. */
+  private loggedRefusals = new Set<string>();
 
   constructor(
     membrane: Membrane,
@@ -201,7 +206,7 @@ export class InferenceRouter {
    *
    * 1. Validate feature set
    * 2. Check loop prevention (reject if inside a hook)
-   * 3. Resolve model from routing policy
+   * 3. Resolve model from routing policy, refusing when it names none
    * 4. Build membrane request
    * 5. Run inference, streaming its visible text as chunks when asked
    * 6. Answer with the result, or with the error for any ending that isn't
@@ -233,11 +238,62 @@ export class InferenceRouter {
       return;
     }
 
-    // 3. Resolve model
+    // Streaming needs a way to send chunks and an id to tag them with;
+    // without either, the request is answered whole.
+    const sendChunk = params.stream ? responder.sendChunk?.bind(responder) : undefined;
+    const chunkRequestId = sendChunk ? responder.requestId : undefined;
+    const streamed = chunkRequestId != null;
+
+    // 3. Resolve model. With no routing policy, or one that names no model
+    // for this feature set, the operator has chosen no model for this
+    // server's inference: refused rather than guessed, since a model picked
+    // here would run, on whatever credentials and at whatever price it
+    // carries, for a server the operator never chose it for. The answer is
+    // -32603, the code the router answers a failed inference with, as it
+    // answered this request when it reached the provider with no model; the
+    // server's grant can still list inferenceRequest, so not -32002.
     const model = this.resolveModel(
       params.featureSet,
       params.conversationId,
     );
+    if (model === undefined) {
+      const policy = Boolean(this.routingPolicy);
+      // One reason, quoted for where it goes: JSON for the server, logValue
+      // for the host log.
+      const reason = (quote: (value: string) => string) => policy
+        ? `the inference routing policy (inferenceRouting) names no model for feature set ${quote(params.featureSet)}`
+        : 'the host sets no inference routing policy (inferenceRouting)';
+      const message = `inference/request refused: ${reason(JSON.stringify)}, so the host has no model to run it on; ` +
+        "it stays refused until the host's operator configures one";
+      // Logged once per server with no policy, and once per server and
+      // feature set with one, since each feature set the policy misses is
+      // its own entry to add; validateInbound (step 1) bounds feature sets
+      // to those the server declares.
+      const key = JSON.stringify(policy ? [serverId, params.featureSet] : [serverId]);
+      if (!this.loggedRefusals.has(key)) {
+        this.loggedRefusals.add(key);
+        console.error(
+          `[mcpl] ${logValue(serverId)}: inference/request refused: ${reason(logValue)}; ` +
+            (policy
+              ? 'give it a default, or a byFeature or wildcards entry for that feature set. ' +
+                'This line prints once per server and feature set'
+              : 'set inferenceRouting in the framework config to choose the model server-initiated inference runs on. ' +
+                'This line prints once per server') +
+            '; later refusals are answered and traced but not logged.',
+        );
+      }
+      // The failure a trace watcher saw when this request failed at the
+      // provider, still seen; no inference_start, since none started.
+      this.emitTraceFn({
+        type: 'mcpl:inference_fail',
+        serverId,
+        model: null,
+        error: message,
+        streamed,
+      });
+      responder.respondError(-32603, message);
+      return;
+    }
 
     // Emit trace: inference start
     this.emitTraceFn({
@@ -263,12 +319,6 @@ export class InferenceRouter {
       },
     };
 
-    // Streaming needs a way to send chunks and an id to tag them with;
-    // without either, the request is answered whole.
-    const sendChunk = params.stream ? responder.sendChunk?.bind(responder) : undefined;
-    const chunkRequestId = sendChunk ? responder.requestId : undefined;
-    const streamed = chunkRequestId != null;
-
     try {
       // 5. Run inference. Both modes end in membrane's response, and one
       // builder makes the result from it.
@@ -325,37 +375,32 @@ export class InferenceRouter {
    * 2. Exact feature set match
    * 3. Wildcard pattern match (first match wins)
    * 4. Default from policy
-   * 5. Fallback string 'default'
+   *
+   * Only an entry naming a model counts: one that is empty or not a string
+   * names none and is passed over, as a missing one is. That includes what a
+   * server-sent conversation id or feature set such as `constructor` or
+   * `__proto__` finds on Object.prototype, which is never a string. A
+   * conversation id that is falsy reads no override.
+   *
+   * Undefined with no policy, or when none of these names a model: the
+   * request is then refused.
    */
   private resolveModel(
     featureSet: string,
     conversationId?: string,
-  ): string {
-    if (!this.routingPolicy) {
-      return 'default';
+  ): string | undefined {
+    const policy = this.routingPolicy;
+    if (!policy) {
+      return undefined;
     }
-
-    // Check per-conversation override
-    if (conversationId && this.routingPolicy.overrides?.[conversationId]) {
-      return this.routingPolicy.overrides[conversationId];
-    }
-
-    // Check exact feature set match
-    if (this.routingPolicy.byFeature?.[featureSet]) {
-      return this.routingPolicy.byFeature[featureSet];
-    }
-
-    // Check wildcard patterns
-    if (this.routingPolicy.wildcards) {
-      for (const [pattern, matchedModel] of Object.entries(this.routingPolicy.wildcards)) {
-        if (wildcardMatch(pattern, featureSet)) {
-          return matchedModel;
-        }
-      }
-    }
-
-    // Default
-    return this.routingPolicy.default;
+    const named = (value: unknown): string | undefined =>
+      typeof value === 'string' && value !== '' ? value : undefined;
+
+    return (conversationId ? named(policy.overrides?.[conversationId]) : undefined)
+      ?? named(policy.byFeature?.[featureSet])
+      // First wildcard that matches and names a model.
+      ?? Object.entries(policy.wildcards ?? {}).find(([pattern, m]) => named(m) && wildcardMatch(pattern, featureSet))?.[1]
+      ?? named(policy.default);
   }
 
   // ==========================================================================

package/src/mcpl/prose-grammar.ts

@@ -19,6 +19,13 @@ export interface ProsePrefix {
   body: string;
 }
 
+/** Whether a `>>` (or `>>>`) prefix line reads `name` as a target: one token,
+ *  and not `skip_reply`, which the line reads as private speech. For a name
+ *  offered to an agent to write after `>>`. */
+export function isProseTargetToken(name: string): boolean {
+  return /^\S+$/.test(name) && name !== 'skip_reply';
+}
+
 /** A REAL prefix line: `>>` immediately followed by a target token. */
 export const PROSE_PREFIX_LINE = /^>>\S/;
 

package/src/mcpl/protocol-family.ts

@@ -641,6 +641,8 @@ function isPlainRecord(value: unknown): value is Record<string, unknown> {
 export function mcplPolicyGrants(config: McplServerConfig): string[] {
   const grants: string[] = [];
   if (isEffective(config.allowHostCommands)) grants.push('allowHostCommands');
+  // RFC-014 tool hints are an MCPL advertisement.
+  if (config.toolHints === true) grants.push('toolHints');
   // An allow-list, except that a pattern matching a path denied by default
   // grants it (computeGrant's explicitlyEnabled), named by the path.
   const enabled = config.enabledCapabilities as unknown;