@dexto/core 1.1.10 → 1.2.0

package/dist/tools/tool-manager.cjs

@@ -1,8 +1,15 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __knownSymbol = (name, symbol) => (symbol = Symbol[name]) ? symbol : Symbol.for("Symbol." + name);
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -16,6 +23,44 @@ var __copyProps = (to, from, except, desc) => {
   return to;
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __decoratorStart = (base) => [, , , __create(base?.[__knownSymbol("metadata")] ?? null)];
+var __decoratorStrings = ["class", "method", "getter", "setter", "accessor", "field", "value", "get", "set"];
+var __expectFn = (fn) => fn !== void 0 && typeof fn !== "function" ? __typeError("Function expected") : fn;
+var __decoratorContext = (kind, name, done, metadata, fns) => ({ kind: __decoratorStrings[kind], name, metadata, addInitializer: (fn) => done._ ? __typeError("Already initialized") : fns.push(__expectFn(fn || null)) });
+var __decoratorMetadata = (array, target) => __defNormalProp(target, __knownSymbol("metadata"), array[3]);
+var __runInitializers = (array, flags, self, value) => {
+  for (var i = 0, fns = array[flags >> 1], n = fns && fns.length; i < n; i++) flags & 1 ? fns[i].call(self) : value = fns[i].call(self, value);
+  return value;
+};
+var __decorateElement = (array, flags, name, decorators, target, extra) => {
+  var fn, it, done, ctx, access, k = flags & 7, s = !!(flags & 8), p = !!(flags & 16);
+  var j = k > 3 ? array.length + 1 : k ? s ? 1 : 2 : 0, key = __decoratorStrings[k + 5];
+  var initializers = k > 3 && (array[j - 1] = []), extraInitializers = array[j] || (array[j] = []);
+  var desc = k && (!p && !s && (target = target.prototype), k < 5 && (k > 3 || !p) && __getOwnPropDesc(k < 4 ? target : { get [name]() {
+    return __privateGet(this, extra);
+  }, set [name](x) {
+    return __privateSet(this, extra, x);
+  } }, name));
+  k ? p && k < 4 && __name(extra, (k > 2 ? "set " : k > 1 ? "get " : "") + name) : __name(target, name);
+  for (var i = decorators.length - 1; i >= 0; i--) {
+    ctx = __decoratorContext(k, name, done = {}, array[3], extraInitializers);
+    if (k) {
+      ctx.static = s, ctx.private = p, access = ctx.access = { has: p ? (x) => __privateIn(target, x) : (x) => name in x };
+      if (k ^ 3) access.get = p ? (x) => (k ^ 1 ? __privateGet : __privateMethod)(x, target, k ^ 4 ? extra : desc.get) : (x) => x[name];
+      if (k > 2) access.set = p ? (x, y) => __privateSet(x, target, y, k ^ 4 ? extra : desc.set) : (x, y) => x[name] = y;
+    }
+    it = (0, decorators[i])(k ? k < 4 ? p ? extra : desc[key] : k > 4 ? void 0 : { get: desc.get, set: desc.set } : target, ctx), done._ = 1;
+    if (k ^ 4 || it === void 0) __expectFn(it) && (k > 4 ? initializers.unshift(it) : k ? p ? extra = it : desc[key] = it : target = it);
+    else if (typeof it !== "object" || it === null) __typeError("Object expected");
+    else __expectFn(fn = it.get) && (desc.get = fn), __expectFn(fn = it.set) && (desc.set = fn), __expectFn(fn = it.init) && initializers.unshift(fn);
+  }
+  return k || __decoratorMetadata(array, target), desc && __defProp(target, name, desc), p ? k ^ 4 ? extra : desc : target;
+};
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateIn = (member, obj) => Object(obj) !== obj ? __typeError('Cannot use the "in" operator on this value') : member.has(obj);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
 var tool_manager_exports = {};
 __export(tool_manager_exports, {
   ToolManager: () => ToolManager
@@ -24,26 +69,51 @@ module.exports = __toCommonJS(tool_manager_exports);
 var import_provider = require("./internal-tools/provider.js");
 var import_errors = require("./errors.js");
 var import_logger = require("../logger/index.js");
-class ToolManager {
+var import_types2 = require("../approval/types.js");
+var import_decorators = require("../telemetry/decorators.js");
+var _ToolManager_decorators, _init;
+_ToolManager_decorators = [(0, import_decorators.InstrumentClass)({
+  prefix: "tool",
+  excludeMethods: [
+    "setPluginManager",
+    "setStateManager",
+    "getApprovalManager",
+    "getAllowedToolsProvider"
+  ]
+})];
+let _ToolManager = class _ToolManager {
   mcpManager;
   internalToolsProvider;
-  confirmationProvider;
+  approvalManager;
+  allowedToolsProvider;
+  approvalMode;
+  agentEventBus;
+  toolPolicies;
+  // Plugin support - set after construction to avoid circular dependencies
+  pluginManager;
+  sessionManager;
+  stateManager;
   // Tool source prefixing - ALL tools get prefixed by source
   static MCP_TOOL_PREFIX = "mcp--";
   static INTERNAL_TOOL_PREFIX = "internal--";
   // Tool caching for performance
   toolsCache = {};
   cacheValid = false;
-  constructor(mcpManager, confirmationProvider, options) {
+  constructor(mcpManager, approvalManager, allowedToolsProvider, approvalMode, agentEventBus, toolPolicies, options) {
     this.mcpManager = mcpManager;
-    this.confirmationProvider = confirmationProvider;
+    this.approvalManager = approvalManager;
+    this.allowedToolsProvider = allowedToolsProvider;
+    this.approvalMode = approvalMode;
+    this.agentEventBus = agentEventBus;
+    this.toolPolicies = toolPolicies;
     if (options?.internalToolsConfig && options.internalToolsConfig.length > 0) {
       this.internalToolsProvider = new import_provider.InternalToolsProvider(
         options.internalToolsServices || {},
-        confirmationProvider,
+        approvalManager,
         options.internalToolsConfig
       );
     }
+    this.setupNotificationListeners();
     import_logger.logger.debug("ToolManager initialized");
   }
   /**
@@ -55,6 +125,15 @@ class ToolManager {
     }
     import_logger.logger.debug("ToolManager initialization complete");
   }
+  /**
+   * Set plugin support services (called after construction to avoid circular dependencies)
+   */
+  setPluginSupport(pluginManager, sessionManager, stateManager) {
+    this.pluginManager = pluginManager;
+    this.sessionManager = sessionManager;
+    this.stateManager = stateManager;
+    import_logger.logger.debug("Plugin support configured for ToolManager");
+  }
   /**
    * Invalidate the tools cache when tool sources change
    */
@@ -62,6 +141,21 @@ class ToolManager {
     this.cacheValid = false;
     this.toolsCache = {};
   }
+  /**
+   * Set up listeners for MCP notifications to invalidate cache on changes
+   */
+  setupNotificationListeners() {
+    this.agentEventBus.on("dexto:mcpServerConnected", async (payload) => {
+      if (payload.success) {
+        import_logger.logger.debug(`\u{1F504} MCP server connected, invalidating tool cache: ${payload.name}`);
+        this.invalidateCache();
+      }
+    });
+    this.agentEventBus.on("dexto:mcpServerRemoved", async (payload) => {
+      import_logger.logger.debug(`\u{1F504} MCP server removed: ${payload.serverName}, invalidating tool cache`);
+      this.invalidateCache();
+    });
+  }
   getMcpManager() {
     return this.mcpManager;
   }
@@ -75,6 +169,16 @@ class ToolManager {
   /**
    * Build all tools from sources with universal prefixing
    * ALL tools get prefixed by their source - no exceptions
+   *
+   * TODO: Rethink tool naming convention for more consistency
+   * Current issue: MCP tools have dynamic naming based on conflicts:
+   * - No conflict: mcp--toolName
+   * - With conflict: mcp--serverName--toolName
+   * This makes policy configuration fragile. Consider:
+   * 1. Always including server name: mcp--serverName--toolName (breaking change)
+   * 2. Using a different delimiter pattern that's more predictable
+   * 3. Providing a tool discovery command to help users find exact names
+   * Related: Tool policies now support dual matching (exact + suffix) as a workaround
    */
   async buildAllTools() {
     const allTools = {};
@@ -97,7 +201,7 @@ class ToolManager {
       internalTools = {};
     }
     for (const [toolName, toolDef] of Object.entries(internalTools)) {
-      const qualifiedName = `${ToolManager.INTERNAL_TOOL_PREFIX}${toolName}`;
+      const qualifiedName = `${_ToolManager.INTERNAL_TOOL_PREFIX}${toolName}`;
       allTools[qualifiedName] = {
         ...toolDef,
         name: qualifiedName,
@@ -105,7 +209,7 @@ class ToolManager {
       };
     }
     for (const [toolName, toolDef] of Object.entries(mcpTools)) {
-      const qualifiedName = `${ToolManager.MCP_TOOL_PREFIX}${toolName}`;
+      const qualifiedName = `${_ToolManager.MCP_TOOL_PREFIX}${toolName}`;
       allTools[qualifiedName] = {
         ...toolDef,
         name: qualifiedName,
@@ -116,7 +220,7 @@ class ToolManager {
     const mcpCount = Object.keys(mcpTools).length;
     const internalCount = Object.keys(internalTools).length;
     import_logger.logger.debug(
-      `\u{1F527} Unified tool discovery: ${totalTools} total tools (${mcpCount} MCP \u2192 ${ToolManager.MCP_TOOL_PREFIX}*, ${internalCount} internal \u2192 ${ToolManager.INTERNAL_TOOL_PREFIX}*)`
+      `\u{1F527} Unified tool discovery: ${totalTools} total tools (${mcpCount} MCP \u2192 ${_ToolManager.MCP_TOOL_PREFIX}*, ${internalCount} internal \u2192 ${_ToolManager.INTERNAL_TOOL_PREFIX}*)`
     );
     return allTools;
   }
@@ -140,33 +244,44 @@ class ToolManager {
   async executeTool(toolName, args, sessionId) {
     import_logger.logger.debug(`\u{1F527} Tool execution requested: '${toolName}'`);
     import_logger.logger.debug(`Tool args: ${JSON.stringify(args, null, 2)}`);
-    const approved = await this.confirmationProvider.requestConfirmation({
-      toolName,
-      args,
-      ...sessionId && { sessionId }
-    });
-    if (!approved) {
-      import_logger.logger.debug(`\u{1F6AB} Tool execution denied: ${toolName}`);
-      throw import_errors.ToolError.executionDenied(toolName, sessionId);
-    }
+    await this.handleToolApproval(toolName, args, sessionId);
     import_logger.logger.debug(`\u2705 Tool execution approved: ${toolName}`);
     import_logger.logger.info(
       `\u{1F527} Tool execution started for ${toolName}, sessionId: ${sessionId ?? "global"}`
     );
     const startTime = Date.now();
+    if (this.pluginManager && this.sessionManager && this.stateManager) {
+      const beforePayload = {
+        toolName,
+        args,
+        ...sessionId !== void 0 && { sessionId }
+      };
+      const modifiedPayload = await this.pluginManager.executePlugins(
+        "beforeToolCall",
+        beforePayload,
+        {
+          sessionManager: this.sessionManager,
+          mcpManager: this.mcpManager,
+          toolManager: this,
+          stateManager: this.stateManager,
+          ...sessionId !== void 0 && { sessionId }
+        }
+      );
+      args = modifiedPayload.args;
+    }
     try {
       let result;
-      if (toolName.startsWith(ToolManager.MCP_TOOL_PREFIX)) {
+      if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
         import_logger.logger.debug(`\u{1F527} Detected MCP tool: '${toolName}'`);
-        const actualToolName = toolName.substring(ToolManager.MCP_TOOL_PREFIX.length);
+        const actualToolName = toolName.substring(_ToolManager.MCP_TOOL_PREFIX.length);
         if (actualToolName.length === 0) {
           throw import_errors.ToolError.invalidName(toolName, "tool name cannot be empty after prefix");
         }
         import_logger.logger.debug(`\u{1F3AF} MCP routing: '${toolName}' -> '${actualToolName}'`);
         result = await this.mcpManager.executeTool(actualToolName, args, sessionId);
-      } else if (toolName.startsWith(ToolManager.INTERNAL_TOOL_PREFIX)) {
+      } else if (toolName.startsWith(_ToolManager.INTERNAL_TOOL_PREFIX)) {
         import_logger.logger.debug(`\u{1F527} Detected internal tool: '${toolName}'`);
-        const actualToolName = toolName.substring(ToolManager.INTERNAL_TOOL_PREFIX.length);
+        const actualToolName = toolName.substring(_ToolManager.INTERNAL_TOOL_PREFIX.length);
         if (actualToolName.length === 0) {
           throw import_errors.ToolError.invalidName(toolName, "tool name cannot be empty after prefix");
         }
@@ -183,7 +298,7 @@ class ToolManager {
         import_logger.logger.debug(`\u{1F527} Detected tool without proper prefix: '${toolName}'`);
         const stats = await this.getToolStats();
         import_logger.logger.error(
-          `\u274C Tool missing source prefix: '${toolName}' (expected '${ToolManager.MCP_TOOL_PREFIX}*' or '${ToolManager.INTERNAL_TOOL_PREFIX}*')`
+          `\u274C Tool missing source prefix: '${toolName}' (expected '${_ToolManager.MCP_TOOL_PREFIX}*' or '${_ToolManager.INTERNAL_TOOL_PREFIX}*')`
         );
         import_logger.logger.debug(`Available: ${stats.mcp} MCP tools, ${stats.internal} internal tools`);
         throw import_errors.ToolError.notFound(toolName);
@@ -193,12 +308,47 @@ class ToolManager {
       import_logger.logger.info(
         `\u2705 Tool execution completed successfully for ${toolName} in ${duration}ms, sessionId: ${sessionId ?? "global"}`
       );
+      if (this.pluginManager && this.sessionManager && this.stateManager) {
+        const afterPayload = {
+          toolName,
+          result,
+          success: true,
+          ...sessionId !== void 0 && { sessionId }
+        };
+        const modifiedPayload = await this.pluginManager.executePlugins(
+          "afterToolResult",
+          afterPayload,
+          {
+            sessionManager: this.sessionManager,
+            mcpManager: this.mcpManager,
+            toolManager: this,
+            stateManager: this.stateManager,
+            ...sessionId !== void 0 && { sessionId }
+          }
+        );
+        result = modifiedPayload.result;
+      }
       return result;
     } catch (error) {
       const duration = Date.now() - startTime;
       import_logger.logger.error(
         `\u274C Tool execution failed for ${toolName} after ${duration}ms, sessionId: ${sessionId ?? "global"}: ${error instanceof Error ? error.message : String(error)}`
       );
+      if (this.pluginManager && this.sessionManager && this.stateManager) {
+        const afterPayload = {
+          toolName,
+          result: error instanceof Error ? error.message : String(error),
+          success: false,
+          ...sessionId !== void 0 && { sessionId }
+        };
+        await this.pluginManager.executePlugins("afterToolResult", afterPayload, {
+          sessionManager: this.sessionManager,
+          mcpManager: this.mcpManager,
+          toolManager: this,
+          stateManager: this.stateManager,
+          ...sessionId !== void 0 && { sessionId }
+        });
+      }
       throw error;
     }
   }
@@ -206,12 +356,12 @@ class ToolManager {
    * Check if a tool exists (must have proper source prefix)
    */
   async hasTool(toolName) {
-    if (toolName.startsWith(ToolManager.MCP_TOOL_PREFIX)) {
-      const actualToolName = toolName.substring(ToolManager.MCP_TOOL_PREFIX.length);
+    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+      const actualToolName = toolName.substring(_ToolManager.MCP_TOOL_PREFIX.length);
       return this.mcpManager.getToolClient(actualToolName) !== void 0;
     }
-    if (toolName.startsWith(ToolManager.INTERNAL_TOOL_PREFIX)) {
-      const actualToolName = toolName.substring(ToolManager.INTERNAL_TOOL_PREFIX.length);
+    if (toolName.startsWith(_ToolManager.INTERNAL_TOOL_PREFIX)) {
+      const actualToolName = toolName.substring(_ToolManager.INTERNAL_TOOL_PREFIX.length);
       return this.internalToolsProvider?.hasTool(actualToolName) ?? false;
     }
     return false;
@@ -253,22 +403,171 @@ class ToolManager {
    * @returns The source of the tool
    */
   getToolSource(toolName) {
-    if (toolName.startsWith(ToolManager.MCP_TOOL_PREFIX) && toolName.length > ToolManager.MCP_TOOL_PREFIX.length) {
+    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX) && toolName.length > _ToolManager.MCP_TOOL_PREFIX.length) {
       return "mcp";
     }
-    if (toolName.startsWith(ToolManager.INTERNAL_TOOL_PREFIX) && toolName.length > ToolManager.INTERNAL_TOOL_PREFIX.length) {
+    if (toolName.startsWith(_ToolManager.INTERNAL_TOOL_PREFIX) && toolName.length > _ToolManager.INTERNAL_TOOL_PREFIX.length) {
       return "internal";
     }
     return "unknown";
   }
+  /**
+   * Check if a tool matches a policy pattern
+   * Supports both exact matching and suffix matching for MCP tools with server prefixes
+   *
+   * Examples:
+   * - Policy "mcp--read_file" matches "mcp--read_file" (exact)
+   * - Policy "mcp--read_file" matches "mcp--filesystem--read_file" (suffix)
+   * - Policy "internal--ask_user" matches "internal--ask_user" (exact only)
+   *
+   * @param toolName The fully qualified tool name (e.g., "mcp--filesystem--read_file")
+   * @param policyPattern The policy pattern to match against (e.g., "mcp--read_file")
+   * @returns true if the tool matches the policy pattern
+   */
+  matchesToolPolicy(toolName, policyPattern) {
+    if (toolName === policyPattern) {
+      return true;
+    }
+    if (policyPattern.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+      const baseName = policyPattern.substring(_ToolManager.MCP_TOOL_PREFIX.length);
+      if (toolName.endsWith(`--${baseName}`) && toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+        return true;
+      }
+    }
+    return false;
+  }
+  /**
+   * Check if a tool is in the static alwaysDeny list
+   * Supports both exact and suffix matching (e.g., "mcp--read_file" matches "mcp--server--read_file")
+   * @param toolName The fully qualified tool name to check
+   * @returns true if the tool is in the deny list
+   */
+  isInAlwaysDenyList(toolName) {
+    if (!this.toolPolicies?.alwaysDeny) {
+      return false;
+    }
+    return this.toolPolicies.alwaysDeny.some(
+      (pattern) => this.matchesToolPolicy(toolName, pattern)
+    );
+  }
+  /**
+   * Check if a tool is in the static alwaysAllow list
+   * Supports both exact and suffix matching (e.g., "mcp--read_file" matches "mcp--server--read_file")
+   * @param toolName The fully qualified tool name to check
+   * @returns true if the tool is in the allow list
+   */
+  isInAlwaysAllowList(toolName) {
+    if (!this.toolPolicies?.alwaysAllow) {
+      return false;
+    }
+    return this.toolPolicies.alwaysAllow.some(
+      (pattern) => this.matchesToolPolicy(toolName, pattern)
+    );
+  }
+  /**
+   * Handle tool approval/confirmation flow
+   * Checks allowed list, manages approval modes (event-based, auto-approve, auto-deny),
+   * and handles remember choice logic
+   */
+  async handleToolApproval(toolName, args, sessionId) {
+    if (this.isInAlwaysDenyList(toolName)) {
+      import_logger.logger.info(
+        `Tool '${toolName}' is in static deny list \u2013 blocking execution (session: ${sessionId ?? "global"})`
+      );
+      import_logger.logger.debug(`\u{1F6AB} Tool execution blocked by policy: ${toolName}`);
+      throw import_errors.ToolError.executionDenied(toolName, sessionId);
+    }
+    if (this.isInAlwaysAllowList(toolName)) {
+      import_logger.logger.info(
+        `Tool '${toolName}' is in static allow list \u2013 skipping confirmation (session: ${sessionId ?? "global"})`
+      );
+      return;
+    }
+    const isAllowed = await this.allowedToolsProvider.isToolAllowed(toolName, sessionId);
+    if (isAllowed) {
+      import_logger.logger.info(
+        `Tool '${toolName}' already allowed for session '${sessionId ?? "global"}' \u2013 skipping confirmation.`
+      );
+      return;
+    }
+    if (this.approvalMode === "auto-approve") {
+      import_logger.logger.debug(`\u{1F7E2} Auto-approving tool execution: ${toolName}`);
+      return;
+    }
+    if (this.approvalMode === "auto-deny") {
+      import_logger.logger.debug(`\u{1F6AB} Auto-denying tool execution: ${toolName}`);
+      throw import_errors.ToolError.executionDenied(toolName, sessionId);
+    }
+    import_logger.logger.info(
+      `Tool confirmation requested for ${toolName}, sessionId: ${sessionId ?? "global"}`
+    );
+    try {
+      const requestData = {
+        toolName,
+        args
+      };
+      if (sessionId !== void 0) {
+        requestData.sessionId = sessionId;
+      }
+      const response = await this.approvalManager.requestToolConfirmation(requestData);
+      const rememberChoice = response.data && "rememberChoice" in response.data ? response.data.rememberChoice : false;
+      if (response.status === import_types2.ApprovalStatus.APPROVED && rememberChoice) {
+        const allowSessionId = sessionId ?? response.sessionId;
+        await this.allowedToolsProvider.allowTool(toolName, allowSessionId);
+        import_logger.logger.info(
+          `Tool '${toolName}' added to allowed tools for session '${allowSessionId ?? "global"}' (remember choice selected)`
+        );
+      }
+      const approved = response.status === import_types2.ApprovalStatus.APPROVED;
+      if (!approved) {
+        import_logger.logger.info(
+          `Tool confirmation denied for ${toolName}, sessionId: ${sessionId ?? "global"}`
+        );
+        import_logger.logger.debug(`\u{1F6AB} Tool execution denied: ${toolName}`);
+        throw import_errors.ToolError.executionDenied(toolName, sessionId);
+      }
+      import_logger.logger.info(
+        `Tool confirmation approved for ${toolName}, sessionId: ${sessionId ?? "global"}`
+      );
+    } catch (error) {
+      import_logger.logger.error(
+        `Tool confirmation error for ${toolName}: ${error instanceof Error ? error.message : String(error)}`
+      );
+      throw error;
+    }
+  }
   /**
    * Refresh tool discovery (call when MCP servers change)
+   * Refreshes both MCPManager's cache (server capabilities) and ToolManager's cache (combined tools)
    */
   async refresh() {
+    await this.mcpManager.refresh();
     this.invalidateCache();
-    import_logger.logger.debug("ToolManager refreshed");
+    import_logger.logger.debug("ToolManager refreshed (including MCP server capabilities)");
   }
-}
+  /**
+   * Get list of pending confirmation requests
+   */
+  getPendingConfirmations() {
+    return this.approvalManager.getPendingApprovals();
+  }
+  /**
+   * Cancel a pending confirmation request
+   */
+  cancelConfirmation(approvalId) {
+    this.approvalManager.cancelApproval(approvalId);
+  }
+  /**
+   * Cancel all pending confirmation requests
+   */
+  cancelAllConfirmations() {
+    this.approvalManager.cancelAllApprovals();
+  }
+};
+_init = __decoratorStart(null);
+_ToolManager = __decorateElement(_init, 0, "ToolManager", _ToolManager_decorators, _ToolManager);
+__runInitializers(_init, 1, _ToolManager);
+let ToolManager = _ToolManager;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ToolManager

package/dist/tools/tool-manager.d.ts

@@ -1,25 +1,17 @@
 import { MCPManager } from '../mcp/manager.js';
 import { InternalToolsServices } from './internal-tools/registry.js';
-import { InternalToolsConfig } from './schemas.js';
+import type { InternalToolsConfig, ToolPolicies } from './schemas.js';
 import { ToolSet } from './types.js';
-import { ToolConfirmationProvider } from './confirmation/types.js';
-import '../mcp/schemas.js';
-import 'zod';
-import '../mcp/types.js';
-import '@modelcontextprotocol/sdk/client/index.js';
-import '@modelcontextprotocol/sdk/types.js';
-import '../search/search-service.js';
-import '../storage/backend/database-backend.js';
-import '../search/types.js';
-import '../context/types.js';
-import '../llm/types.js';
-import 'json-schema';
-import './confirmation/allowed-tools-provider/types.js';
-
+import type { AgentEventBus } from '../events/index.js';
+import type { ApprovalManager } from '../approval/manager.js';
+import type { IAllowedToolsProvider } from './confirmation/allowed-tools-provider/types.js';
+import type { PluginManager } from '../plugins/manager.js';
+import type { SessionManager } from '../session/index.js';
+import type { AgentStateManager } from '../agent/state-manager.js';
 /**
  * Options for internal tools configuration in ToolManager
  */
-interface InternalToolsOptions {
+export interface InternalToolsOptions {
     internalToolsServices?: InternalToolsServices;
     internalToolsConfig?: InternalToolsConfig;
 }
@@ -34,29 +26,53 @@ interface InternalToolsOptions {
  * - Aggregate tools from MCP servers and internal tools with conflict resolution
  * - Route tool execution to appropriate source (MCP vs Internal)
  * - Provide unified tool interface to LLM
- * - Manage tool confirmation and security
+ * - Manage tool confirmation and security via ApprovalManager
  * - Handle cross-source naming conflicts (internal tools have precedence)
  *
  * Architecture:
  * LLMService → ToolManager → [MCPManager, InternalToolsProvider]
+ *                ↓
+ *          ApprovalManager (for confirmations)
+ *
+ * TODO (Telemetry): Add OpenTelemetry metrics collection
+ *   - Tool execution counters (by tool name, source: MCP/internal)
+ *   - Tool execution latency histograms
+ *   - Tool success/failure rate counters
+ *   - Tool approval/denial counters
+ *   See feature-plans/telemetry.md for details
  */
-declare class ToolManager {
+export declare class ToolManager {
     private mcpManager;
     private internalToolsProvider?;
-    private confirmationProvider;
+    private approvalManager;
+    private allowedToolsProvider;
+    private approvalMode;
+    private agentEventBus;
+    private toolPolicies;
+    private pluginManager?;
+    private sessionManager?;
+    private stateManager?;
     private static readonly MCP_TOOL_PREFIX;
     private static readonly INTERNAL_TOOL_PREFIX;
     private toolsCache;
     private cacheValid;
-    constructor(mcpManager: MCPManager, confirmationProvider: ToolConfirmationProvider, options?: InternalToolsOptions);
+    constructor(mcpManager: MCPManager, approvalManager: ApprovalManager, allowedToolsProvider: IAllowedToolsProvider, approvalMode: 'event-based' | 'auto-approve' | 'auto-deny', agentEventBus: AgentEventBus, toolPolicies?: ToolPolicies, options?: InternalToolsOptions);
     /**
      * Initialize the ToolManager and its components
      */
     initialize(): Promise<void>;
+    /**
+     * Set plugin support services (called after construction to avoid circular dependencies)
+     */
+    setPluginSupport(pluginManager: PluginManager, sessionManager: SessionManager, stateManager: AgentStateManager): void;
     /**
      * Invalidate the tools cache when tool sources change
      */
     private invalidateCache;
+    /**
+     * Set up listeners for MCP notifications to invalidate cache on changes
+     */
+    private setupNotificationListeners;
     getMcpManager(): MCPManager;
     /**
      * Get all MCP tools (delegates to mcpManager.getAllTools())
@@ -66,6 +82,16 @@ declare class ToolManager {
     /**
      * Build all tools from sources with universal prefixing
      * ALL tools get prefixed by their source - no exceptions
+     *
+     * TODO: Rethink tool naming convention for more consistency
+     * Current issue: MCP tools have dynamic naming based on conflicts:
+     * - No conflict: mcp--toolName
+     * - With conflict: mcp--serverName--toolName
+     * This makes policy configuration fragile. Consider:
+     * 1. Always including server name: mcp--serverName--toolName (breaking change)
+     * 2. Using a different delimiter pattern that's more predictable
+     * 3. Providing a tool discovery command to help users find exact names
+     * Related: Tool policies now support dual matching (exact + suffix) as a workaround
      */
     private buildAllTools;
     /**
@@ -97,10 +123,56 @@ declare class ToolManager {
      * @returns The source of the tool
      */
     getToolSource(toolName: string): 'mcp' | 'internal' | 'unknown';
+    /**
+     * Check if a tool matches a policy pattern
+     * Supports both exact matching and suffix matching for MCP tools with server prefixes
+     *
+     * Examples:
+     * - Policy "mcp--read_file" matches "mcp--read_file" (exact)
+     * - Policy "mcp--read_file" matches "mcp--filesystem--read_file" (suffix)
+     * - Policy "internal--ask_user" matches "internal--ask_user" (exact only)
+     *
+     * @param toolName The fully qualified tool name (e.g., "mcp--filesystem--read_file")
+     * @param policyPattern The policy pattern to match against (e.g., "mcp--read_file")
+     * @returns true if the tool matches the policy pattern
+     */
+    private matchesToolPolicy;
+    /**
+     * Check if a tool is in the static alwaysDeny list
+     * Supports both exact and suffix matching (e.g., "mcp--read_file" matches "mcp--server--read_file")
+     * @param toolName The fully qualified tool name to check
+     * @returns true if the tool is in the deny list
+     */
+    private isInAlwaysDenyList;
+    /**
+     * Check if a tool is in the static alwaysAllow list
+     * Supports both exact and suffix matching (e.g., "mcp--read_file" matches "mcp--server--read_file")
+     * @param toolName The fully qualified tool name to check
+     * @returns true if the tool is in the allow list
+     */
+    private isInAlwaysAllowList;
+    /**
+     * Handle tool approval/confirmation flow
+     * Checks allowed list, manages approval modes (event-based, auto-approve, auto-deny),
+     * and handles remember choice logic
+     */
+    private handleToolApproval;
     /**
      * Refresh tool discovery (call when MCP servers change)
+     * Refreshes both MCPManager's cache (server capabilities) and ToolManager's cache (combined tools)
      */
     refresh(): Promise<void>;
+    /**
+     * Get list of pending confirmation requests
+     */
+    getPendingConfirmations(): string[];
+    /**
+     * Cancel a pending confirmation request
+     */
+    cancelConfirmation(approvalId: string): void;
+    /**
+     * Cancel all pending confirmation requests
+     */
+    cancelAllConfirmations(): void;
 }
-
-export { type InternalToolsOptions, ToolManager };
+//# sourceMappingURL=tool-manager.d.ts.map

package/dist/tools/tool-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-manager.d.ts","sourceRoot":"","sources":["../../src/tools/tool-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAGrC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAInE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACjC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBASa,WAAW;IACpB,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,qBAAqB,CAAC,CAAwB;IACtD,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,oBAAoB,CAAwB;IACpD,OAAO,CAAC,YAAY,CAA+C;IACnE,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,YAAY,CAA2B;IAG/C,OAAO,CAAC,aAAa,CAAC,CAAgB;IACtC,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,YAAY,CAAC,CAAoB;IAGzC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAW;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAgB;IAG5D,OAAO,CAAC,UAAU,CAAe;IACjC,OAAO,CAAC,UAAU,CAAkB;gBAGhC,UAAU,EAAE,UAAU,EACtB,eAAe,EAAE,eAAe,EAChC,oBAAoB,EAAE,qBAAqB,EAC3C,YAAY,EAAE,aAAa,GAAG,cAAc,GAAG,WAAW,EAC1D,aAAa,EAAE,aAAa,EAC5B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,oBAAoB;IAwBlC;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAOjC;;OAEG;IACH,gBAAgB,CACZ,aAAa,EAAE,aAAa,EAC5B,cAAc,EAAE,cAAc,EAC9B,YAAY,EAAE,iBAAiB,GAChC,IAAI;IAOP;;OAEG;IACH,OAAO,CAAC,eAAe;IAKvB;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAelC,aAAa,IAAI,UAAU;IAI3B;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAIrC;;;;;;;;;;;;;OAaG;YACW,aAAa;IAwD3B;;;;OAIG;IACG,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAUrC;;;OAGG;IACG,WAAW,CACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IA8InB;;OAEG;IACG,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBjD;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC;QAC1B,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;KACpB,CAAC;IAgCF;;;;OAIG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,SAAS;IAgB/D;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,iBAAiB;IA0BzB;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAS3B;;;;OAIG;YACW,kBAAkB;IAwGhC;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAU9B;;OAEG;IACH,uBAAuB,IAAI,MAAM,EAAE;IAInC;;OAEG;IACH,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAI5C;;OAEG;IACH,sBAAsB,IAAI,IAAI;CAGjC"}