@dexto/core 1.1.11 → 1.2.0

package/dist/tools/schemas.js

@@ -1,5 +1,6 @@
+import "../chunk-C6A6W6XS.js";
 import { z } from "zod";
-import { INTERNAL_TOOL_NAMES } from "./internal-tools/registry.js";
+import { INTERNAL_TOOL_NAMES } from "./internal-tools/constants.js";
 const TOOL_CONFIRMATION_MODES = ["event-based", "auto-approve", "auto-deny"];
 const ALLOWED_TOOLS_STORAGE_TYPES = ["memory", "storage"];
 const DEFAULT_TOOL_CONFIRMATION_MODE = "event-based";
@@ -7,6 +8,14 @@ const DEFAULT_ALLOWED_TOOLS_STORAGE = "storage";
 const InternalToolsSchema = z.array(z.enum(INTERNAL_TOOL_NAMES).describe("Available internal tool names")).default([]).describe(
   `Array of internal tool names to enable. Empty array = disabled. Available tools: ${INTERNAL_TOOL_NAMES.join(", ")}`
 );
+const ToolPoliciesSchema = z.object({
+  alwaysAllow: z.array(z.string()).default([]).describe(
+    'Tools that never require approval (low-risk). Use full qualified names (e.g., "internal--ask_user", "mcp--filesystem--read_file")'
+  ),
+  alwaysDeny: z.array(z.string()).default([]).describe(
+    'Tools that are always denied (high-risk). Takes precedence over alwaysAllow. Use full qualified names (e.g., "mcp--filesystem--delete_file")'
+  )
+}).strict().default({ alwaysAllow: [], alwaysDeny: [] }).describe("Static tool policies for allow/deny lists");
 const ToolConfirmationConfigSchema = z.object({
   mode: z.enum(TOOL_CONFIRMATION_MODES).default(DEFAULT_TOOL_CONFIRMATION_MODE).describe(
     "Tool confirmation mode: event-based (interactive), auto-approve (all tools), auto-deny (no tools)"
@@ -16,6 +25,9 @@ const ToolConfirmationConfigSchema = z.object({
   ),
   allowedToolsStorage: z.enum(ALLOWED_TOOLS_STORAGE_TYPES).default(DEFAULT_ALLOWED_TOOLS_STORAGE).describe(
     "Storage type for remembered tool approvals: memory (session-only) or storage (persistent)"
+  ),
+  toolPolicies: ToolPoliciesSchema.optional().describe(
+    "Static tool policies for fine-grained allow/deny control. Deny list takes precedence over allow list."
   )
 }).strict().describe("Tool confirmation and approval configuration");
 export {
@@ -24,5 +36,6 @@ export {
   DEFAULT_TOOL_CONFIRMATION_MODE,
   InternalToolsSchema,
   TOOL_CONFIRMATION_MODES,
-  ToolConfirmationConfigSchema
+  ToolConfirmationConfigSchema,
+  ToolPoliciesSchema
 };

package/dist/tools/tool-manager.cjs

@@ -1,8 +1,15 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __knownSymbol = (name, symbol) => (symbol = Symbol[name]) ? symbol : Symbol.for("Symbol." + name);
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -16,6 +23,44 @@ var __copyProps = (to, from, except, desc) => {
   return to;
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __decoratorStart = (base) => [, , , __create(base?.[__knownSymbol("metadata")] ?? null)];
+var __decoratorStrings = ["class", "method", "getter", "setter", "accessor", "field", "value", "get", "set"];
+var __expectFn = (fn) => fn !== void 0 && typeof fn !== "function" ? __typeError("Function expected") : fn;
+var __decoratorContext = (kind, name, done, metadata, fns) => ({ kind: __decoratorStrings[kind], name, metadata, addInitializer: (fn) => done._ ? __typeError("Already initialized") : fns.push(__expectFn(fn || null)) });
+var __decoratorMetadata = (array, target) => __defNormalProp(target, __knownSymbol("metadata"), array[3]);
+var __runInitializers = (array, flags, self, value) => {
+  for (var i = 0, fns = array[flags >> 1], n = fns && fns.length; i < n; i++) flags & 1 ? fns[i].call(self) : value = fns[i].call(self, value);
+  return value;
+};
+var __decorateElement = (array, flags, name, decorators, target, extra) => {
+  var fn, it, done, ctx, access, k = flags & 7, s = !!(flags & 8), p = !!(flags & 16);
+  var j = k > 3 ? array.length + 1 : k ? s ? 1 : 2 : 0, key = __decoratorStrings[k + 5];
+  var initializers = k > 3 && (array[j - 1] = []), extraInitializers = array[j] || (array[j] = []);
+  var desc = k && (!p && !s && (target = target.prototype), k < 5 && (k > 3 || !p) && __getOwnPropDesc(k < 4 ? target : { get [name]() {
+    return __privateGet(this, extra);
+  }, set [name](x) {
+    return __privateSet(this, extra, x);
+  } }, name));
+  k ? p && k < 4 && __name(extra, (k > 2 ? "set " : k > 1 ? "get " : "") + name) : __name(target, name);
+  for (var i = decorators.length - 1; i >= 0; i--) {
+    ctx = __decoratorContext(k, name, done = {}, array[3], extraInitializers);
+    if (k) {
+      ctx.static = s, ctx.private = p, access = ctx.access = { has: p ? (x) => __privateIn(target, x) : (x) => name in x };
+      if (k ^ 3) access.get = p ? (x) => (k ^ 1 ? __privateGet : __privateMethod)(x, target, k ^ 4 ? extra : desc.get) : (x) => x[name];
+      if (k > 2) access.set = p ? (x, y) => __privateSet(x, target, y, k ^ 4 ? extra : desc.set) : (x, y) => x[name] = y;
+    }
+    it = (0, decorators[i])(k ? k < 4 ? p ? extra : desc[key] : k > 4 ? void 0 : { get: desc.get, set: desc.set } : target, ctx), done._ = 1;
+    if (k ^ 4 || it === void 0) __expectFn(it) && (k > 4 ? initializers.unshift(it) : k ? p ? extra = it : desc[key] = it : target = it);
+    else if (typeof it !== "object" || it === null) __typeError("Object expected");
+    else __expectFn(fn = it.get) && (desc.get = fn), __expectFn(fn = it.set) && (desc.set = fn), __expectFn(fn = it.init) && initializers.unshift(fn);
+  }
+  return k || __decoratorMetadata(array, target), desc && __defProp(target, name, desc), p ? k ^ 4 ? extra : desc : target;
+};
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateIn = (member, obj) => Object(obj) !== obj ? __typeError('Cannot use the "in" operator on this value') : member.has(obj);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
 var tool_manager_exports = {};
 __export(tool_manager_exports, {
   ToolManager: () => ToolManager
@@ -25,13 +70,25 @@ var import_provider = require("./internal-tools/provider.js");
 var import_errors = require("./errors.js");
 var import_logger = require("../logger/index.js");
 var import_types2 = require("../approval/types.js");
-class ToolManager {
+var import_decorators = require("../telemetry/decorators.js");
+var _ToolManager_decorators, _init;
+_ToolManager_decorators = [(0, import_decorators.InstrumentClass)({
+  prefix: "tool",
+  excludeMethods: [
+    "setPluginManager",
+    "setStateManager",
+    "getApprovalManager",
+    "getAllowedToolsProvider"
+  ]
+})];
+let _ToolManager = class _ToolManager {
   mcpManager;
   internalToolsProvider;
   approvalManager;
   allowedToolsProvider;
   approvalMode;
   agentEventBus;
+  toolPolicies;
   // Plugin support - set after construction to avoid circular dependencies
   pluginManager;
   sessionManager;
@@ -42,12 +99,13 @@ class ToolManager {
   // Tool caching for performance
   toolsCache = {};
   cacheValid = false;
-  constructor(mcpManager, approvalManager, allowedToolsProvider, approvalMode, agentEventBus, options) {
+  constructor(mcpManager, approvalManager, allowedToolsProvider, approvalMode, agentEventBus, toolPolicies, options) {
     this.mcpManager = mcpManager;
     this.approvalManager = approvalManager;
     this.allowedToolsProvider = allowedToolsProvider;
     this.approvalMode = approvalMode;
     this.agentEventBus = agentEventBus;
+    this.toolPolicies = toolPolicies;
     if (options?.internalToolsConfig && options.internalToolsConfig.length > 0) {
       this.internalToolsProvider = new import_provider.InternalToolsProvider(
         options.internalToolsServices || {},
@@ -111,6 +169,16 @@ class ToolManager {
   /**
    * Build all tools from sources with universal prefixing
    * ALL tools get prefixed by their source - no exceptions
+   *
+   * TODO: Rethink tool naming convention for more consistency
+   * Current issue: MCP tools have dynamic naming based on conflicts:
+   * - No conflict: mcp--toolName
+   * - With conflict: mcp--serverName--toolName
+   * This makes policy configuration fragile. Consider:
+   * 1. Always including server name: mcp--serverName--toolName (breaking change)
+   * 2. Using a different delimiter pattern that's more predictable
+   * 3. Providing a tool discovery command to help users find exact names
+   * Related: Tool policies now support dual matching (exact + suffix) as a workaround
    */
   async buildAllTools() {
     const allTools = {};
@@ -133,7 +201,7 @@ class ToolManager {
       internalTools = {};
     }
     for (const [toolName, toolDef] of Object.entries(internalTools)) {
-      const qualifiedName = `${ToolManager.INTERNAL_TOOL_PREFIX}${toolName}`;
+      const qualifiedName = `${_ToolManager.INTERNAL_TOOL_PREFIX}${toolName}`;
       allTools[qualifiedName] = {
         ...toolDef,
         name: qualifiedName,
@@ -141,7 +209,7 @@ class ToolManager {
       };
     }
     for (const [toolName, toolDef] of Object.entries(mcpTools)) {
-      const qualifiedName = `${ToolManager.MCP_TOOL_PREFIX}${toolName}`;
+      const qualifiedName = `${_ToolManager.MCP_TOOL_PREFIX}${toolName}`;
       allTools[qualifiedName] = {
         ...toolDef,
         name: qualifiedName,
@@ -152,7 +220,7 @@ class ToolManager {
     const mcpCount = Object.keys(mcpTools).length;
     const internalCount = Object.keys(internalTools).length;
     import_logger.logger.debug(
-      `\u{1F527} Unified tool discovery: ${totalTools} total tools (${mcpCount} MCP \u2192 ${ToolManager.MCP_TOOL_PREFIX}*, ${internalCount} internal \u2192 ${ToolManager.INTERNAL_TOOL_PREFIX}*)`
+      `\u{1F527} Unified tool discovery: ${totalTools} total tools (${mcpCount} MCP \u2192 ${_ToolManager.MCP_TOOL_PREFIX}*, ${internalCount} internal \u2192 ${_ToolManager.INTERNAL_TOOL_PREFIX}*)`
     );
     return allTools;
   }
@@ -203,17 +271,17 @@ class ToolManager {
     }
     try {
       let result;
-      if (toolName.startsWith(ToolManager.MCP_TOOL_PREFIX)) {
+      if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
         import_logger.logger.debug(`\u{1F527} Detected MCP tool: '${toolName}'`);
-        const actualToolName = toolName.substring(ToolManager.MCP_TOOL_PREFIX.length);
+        const actualToolName = toolName.substring(_ToolManager.MCP_TOOL_PREFIX.length);
         if (actualToolName.length === 0) {
           throw import_errors.ToolError.invalidName(toolName, "tool name cannot be empty after prefix");
         }
         import_logger.logger.debug(`\u{1F3AF} MCP routing: '${toolName}' -> '${actualToolName}'`);
         result = await this.mcpManager.executeTool(actualToolName, args, sessionId);
-      } else if (toolName.startsWith(ToolManager.INTERNAL_TOOL_PREFIX)) {
+      } else if (toolName.startsWith(_ToolManager.INTERNAL_TOOL_PREFIX)) {
         import_logger.logger.debug(`\u{1F527} Detected internal tool: '${toolName}'`);
-        const actualToolName = toolName.substring(ToolManager.INTERNAL_TOOL_PREFIX.length);
+        const actualToolName = toolName.substring(_ToolManager.INTERNAL_TOOL_PREFIX.length);
         if (actualToolName.length === 0) {
           throw import_errors.ToolError.invalidName(toolName, "tool name cannot be empty after prefix");
         }
@@ -230,7 +298,7 @@ class ToolManager {
         import_logger.logger.debug(`\u{1F527} Detected tool without proper prefix: '${toolName}'`);
         const stats = await this.getToolStats();
         import_logger.logger.error(
-          `\u274C Tool missing source prefix: '${toolName}' (expected '${ToolManager.MCP_TOOL_PREFIX}*' or '${ToolManager.INTERNAL_TOOL_PREFIX}*')`
+          `\u274C Tool missing source prefix: '${toolName}' (expected '${_ToolManager.MCP_TOOL_PREFIX}*' or '${_ToolManager.INTERNAL_TOOL_PREFIX}*')`
         );
         import_logger.logger.debug(`Available: ${stats.mcp} MCP tools, ${stats.internal} internal tools`);
         throw import_errors.ToolError.notFound(toolName);
@@ -288,12 +356,12 @@ class ToolManager {
    * Check if a tool exists (must have proper source prefix)
    */
   async hasTool(toolName) {
-    if (toolName.startsWith(ToolManager.MCP_TOOL_PREFIX)) {
-      const actualToolName = toolName.substring(ToolManager.MCP_TOOL_PREFIX.length);
+    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+      const actualToolName = toolName.substring(_ToolManager.MCP_TOOL_PREFIX.length);
       return this.mcpManager.getToolClient(actualToolName) !== void 0;
     }
-    if (toolName.startsWith(ToolManager.INTERNAL_TOOL_PREFIX)) {
-      const actualToolName = toolName.substring(ToolManager.INTERNAL_TOOL_PREFIX.length);
+    if (toolName.startsWith(_ToolManager.INTERNAL_TOOL_PREFIX)) {
+      const actualToolName = toolName.substring(_ToolManager.INTERNAL_TOOL_PREFIX.length);
       return this.internalToolsProvider?.hasTool(actualToolName) ?? false;
     }
     return false;
@@ -335,20 +403,86 @@ class ToolManager {
    * @returns The source of the tool
    */
   getToolSource(toolName) {
-    if (toolName.startsWith(ToolManager.MCP_TOOL_PREFIX) && toolName.length > ToolManager.MCP_TOOL_PREFIX.length) {
+    if (toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX) && toolName.length > _ToolManager.MCP_TOOL_PREFIX.length) {
       return "mcp";
     }
-    if (toolName.startsWith(ToolManager.INTERNAL_TOOL_PREFIX) && toolName.length > ToolManager.INTERNAL_TOOL_PREFIX.length) {
+    if (toolName.startsWith(_ToolManager.INTERNAL_TOOL_PREFIX) && toolName.length > _ToolManager.INTERNAL_TOOL_PREFIX.length) {
       return "internal";
     }
     return "unknown";
   }
+  /**
+   * Check if a tool matches a policy pattern
+   * Supports both exact matching and suffix matching for MCP tools with server prefixes
+   *
+   * Examples:
+   * - Policy "mcp--read_file" matches "mcp--read_file" (exact)
+   * - Policy "mcp--read_file" matches "mcp--filesystem--read_file" (suffix)
+   * - Policy "internal--ask_user" matches "internal--ask_user" (exact only)
+   *
+   * @param toolName The fully qualified tool name (e.g., "mcp--filesystem--read_file")
+   * @param policyPattern The policy pattern to match against (e.g., "mcp--read_file")
+   * @returns true if the tool matches the policy pattern
+   */
+  matchesToolPolicy(toolName, policyPattern) {
+    if (toolName === policyPattern) {
+      return true;
+    }
+    if (policyPattern.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+      const baseName = policyPattern.substring(_ToolManager.MCP_TOOL_PREFIX.length);
+      if (toolName.endsWith(`--${baseName}`) && toolName.startsWith(_ToolManager.MCP_TOOL_PREFIX)) {
+        return true;
+      }
+    }
+    return false;
+  }
+  /**
+   * Check if a tool is in the static alwaysDeny list
+   * Supports both exact and suffix matching (e.g., "mcp--read_file" matches "mcp--server--read_file")
+   * @param toolName The fully qualified tool name to check
+   * @returns true if the tool is in the deny list
+   */
+  isInAlwaysDenyList(toolName) {
+    if (!this.toolPolicies?.alwaysDeny) {
+      return false;
+    }
+    return this.toolPolicies.alwaysDeny.some(
+      (pattern) => this.matchesToolPolicy(toolName, pattern)
+    );
+  }
+  /**
+   * Check if a tool is in the static alwaysAllow list
+   * Supports both exact and suffix matching (e.g., "mcp--read_file" matches "mcp--server--read_file")
+   * @param toolName The fully qualified tool name to check
+   * @returns true if the tool is in the allow list
+   */
+  isInAlwaysAllowList(toolName) {
+    if (!this.toolPolicies?.alwaysAllow) {
+      return false;
+    }
+    return this.toolPolicies.alwaysAllow.some(
+      (pattern) => this.matchesToolPolicy(toolName, pattern)
+    );
+  }
   /**
    * Handle tool approval/confirmation flow
    * Checks allowed list, manages approval modes (event-based, auto-approve, auto-deny),
    * and handles remember choice logic
    */
   async handleToolApproval(toolName, args, sessionId) {
+    if (this.isInAlwaysDenyList(toolName)) {
+      import_logger.logger.info(
+        `Tool '${toolName}' is in static deny list \u2013 blocking execution (session: ${sessionId ?? "global"})`
+      );
+      import_logger.logger.debug(`\u{1F6AB} Tool execution blocked by policy: ${toolName}`);
+      throw import_errors.ToolError.executionDenied(toolName, sessionId);
+    }
+    if (this.isInAlwaysAllowList(toolName)) {
+      import_logger.logger.info(
+        `Tool '${toolName}' is in static allow list \u2013 skipping confirmation (session: ${sessionId ?? "global"})`
+      );
+      return;
+    }
     const isAllowed = await this.allowedToolsProvider.isToolAllowed(toolName, sessionId);
     if (isAllowed) {
       import_logger.logger.info(
@@ -378,9 +512,10 @@ class ToolManager {
       const response = await this.approvalManager.requestToolConfirmation(requestData);
       const rememberChoice = response.data && "rememberChoice" in response.data ? response.data.rememberChoice : false;
       if (response.status === import_types2.ApprovalStatus.APPROVED && rememberChoice) {
-        await this.allowedToolsProvider.allowTool(toolName, response.sessionId);
+        const allowSessionId = sessionId ?? response.sessionId;
+        await this.allowedToolsProvider.allowTool(toolName, allowSessionId);
         import_logger.logger.info(
-          `Tool '${toolName}' added to allowed tools for session '${response.sessionId ?? "global"}' (remember choice selected)`
+          `Tool '${toolName}' added to allowed tools for session '${allowSessionId ?? "global"}' (remember choice selected)`
         );
       }
       const approved = response.status === import_types2.ApprovalStatus.APPROVED;
@@ -428,7 +563,11 @@ class ToolManager {
   cancelAllConfirmations() {
     this.approvalManager.cancelAllApprovals();
   }
-}
+};
+_init = __decoratorStart(null);
+_ToolManager = __decorateElement(_init, 0, "ToolManager", _ToolManager_decorators, _ToolManager);
+__runInitializers(_init, 1, _ToolManager);
+let ToolManager = _ToolManager;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ToolManager

package/dist/tools/tool-manager.d.ts

@@ -1,6 +1,6 @@
 import { MCPManager } from '../mcp/manager.js';
 import { InternalToolsServices } from './internal-tools/registry.js';
-import type { InternalToolsConfig } from './schemas.js';
+import type { InternalToolsConfig, ToolPolicies } from './schemas.js';
 import { ToolSet } from './types.js';
 import type { AgentEventBus } from '../events/index.js';
 import type { ApprovalManager } from '../approval/manager.js';
@@ -33,6 +33,13 @@ export interface InternalToolsOptions {
  * LLMService → ToolManager → [MCPManager, InternalToolsProvider]
  *                ↓
  *          ApprovalManager (for confirmations)
+ *
+ * TODO (Telemetry): Add OpenTelemetry metrics collection
+ *   - Tool execution counters (by tool name, source: MCP/internal)
+ *   - Tool execution latency histograms
+ *   - Tool success/failure rate counters
+ *   - Tool approval/denial counters
+ *   See feature-plans/telemetry.md for details
  */
 export declare class ToolManager {
     private mcpManager;
@@ -41,6 +48,7 @@ export declare class ToolManager {
     private allowedToolsProvider;
     private approvalMode;
     private agentEventBus;
+    private toolPolicies;
     private pluginManager?;
     private sessionManager?;
     private stateManager?;
@@ -48,7 +56,7 @@ export declare class ToolManager {
     private static readonly INTERNAL_TOOL_PREFIX;
     private toolsCache;
     private cacheValid;
-    constructor(mcpManager: MCPManager, approvalManager: ApprovalManager, allowedToolsProvider: IAllowedToolsProvider, approvalMode: 'event-based' | 'auto-approve' | 'auto-deny', agentEventBus: AgentEventBus, options?: InternalToolsOptions);
+    constructor(mcpManager: MCPManager, approvalManager: ApprovalManager, allowedToolsProvider: IAllowedToolsProvider, approvalMode: 'event-based' | 'auto-approve' | 'auto-deny', agentEventBus: AgentEventBus, toolPolicies?: ToolPolicies, options?: InternalToolsOptions);
     /**
      * Initialize the ToolManager and its components
      */
@@ -74,6 +82,16 @@ export declare class ToolManager {
     /**
      * Build all tools from sources with universal prefixing
      * ALL tools get prefixed by their source - no exceptions
+     *
+     * TODO: Rethink tool naming convention for more consistency
+     * Current issue: MCP tools have dynamic naming based on conflicts:
+     * - No conflict: mcp--toolName
+     * - With conflict: mcp--serverName--toolName
+     * This makes policy configuration fragile. Consider:
+     * 1. Always including server name: mcp--serverName--toolName (breaking change)
+     * 2. Using a different delimiter pattern that's more predictable
+     * 3. Providing a tool discovery command to help users find exact names
+     * Related: Tool policies now support dual matching (exact + suffix) as a workaround
      */
     private buildAllTools;
     /**
@@ -105,6 +123,34 @@ export declare class ToolManager {
      * @returns The source of the tool
      */
     getToolSource(toolName: string): 'mcp' | 'internal' | 'unknown';
+    /**
+     * Check if a tool matches a policy pattern
+     * Supports both exact matching and suffix matching for MCP tools with server prefixes
+     *
+     * Examples:
+     * - Policy "mcp--read_file" matches "mcp--read_file" (exact)
+     * - Policy "mcp--read_file" matches "mcp--filesystem--read_file" (suffix)
+     * - Policy "internal--ask_user" matches "internal--ask_user" (exact only)
+     *
+     * @param toolName The fully qualified tool name (e.g., "mcp--filesystem--read_file")
+     * @param policyPattern The policy pattern to match against (e.g., "mcp--read_file")
+     * @returns true if the tool matches the policy pattern
+     */
+    private matchesToolPolicy;
+    /**
+     * Check if a tool is in the static alwaysDeny list
+     * Supports both exact and suffix matching (e.g., "mcp--read_file" matches "mcp--server--read_file")
+     * @param toolName The fully qualified tool name to check
+     * @returns true if the tool is in the deny list
+     */
+    private isInAlwaysDenyList;
+    /**
+     * Check if a tool is in the static alwaysAllow list
+     * Supports both exact and suffix matching (e.g., "mcp--read_file" matches "mcp--server--read_file")
+     * @param toolName The fully qualified tool name to check
+     * @returns true if the tool is in the allow list
+     */
+    private isInAlwaysAllowList;
     /**
      * Handle tool approval/confirmation flow
      * Checks allowed list, manages approval modes (event-based, auto-approve, auto-deny),

package/dist/tools/tool-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-manager.d.ts","sourceRoot":"","sources":["../../src/tools/tool-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAGrC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAGnE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACjC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,WAAW;IACpB,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,qBAAqB,CAAC,CAAwB;IACtD,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,oBAAoB,CAAwB;IACpD,OAAO,CAAC,YAAY,CAA+C;IACnE,OAAO,CAAC,aAAa,CAAgB;IAGrC,OAAO,CAAC,aAAa,CAAC,CAAgB;IACtC,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,YAAY,CAAC,CAAoB;IAGzC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAW;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAgB;IAG5D,OAAO,CAAC,UAAU,CAAe;IACjC,OAAO,CAAC,UAAU,CAAkB;gBAGhC,UAAU,EAAE,UAAU,EACtB,eAAe,EAAE,eAAe,EAChC,oBAAoB,EAAE,qBAAqB,EAC3C,YAAY,EAAE,aAAa,GAAG,cAAc,GAAG,WAAW,EAC1D,aAAa,EAAE,aAAa,EAC5B,OAAO,CAAC,EAAE,oBAAoB;IAuBlC;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAOjC;;OAEG;IACH,gBAAgB,CACZ,aAAa,EAAE,aAAa,EAC5B,cAAc,EAAE,cAAc,EAC9B,YAAY,EAAE,iBAAiB,GAChC,IAAI;IAOP;;OAEG;IACH,OAAO,CAAC,eAAe;IAKvB;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAelC,aAAa,IAAI,UAAU;IAI3B;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAIrC;;;OAGG;YACW,aAAa;IAwD3B;;;;OAIG;IACG,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAUrC;;;OAGG;IACG,WAAW,CACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IA8InB;;OAEG;IACG,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBjD;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC;QAC1B,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;KACpB,CAAC;IAgCF;;;;OAIG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,SAAS;IAgB/D;;;;OAIG;YACW,kBAAkB;IAmFhC;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAU9B;;OAEG;IACH,uBAAuB,IAAI,MAAM,EAAE;IAInC;;OAEG;IACH,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAI5C;;OAEG;IACH,sBAAsB,IAAI,IAAI;CAGjC"}
+{"version":3,"file":"tool-manager.d.ts","sourceRoot":"","sources":["../../src/tools/tool-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAGrC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAInE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACjC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBASa,WAAW;IACpB,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,qBAAqB,CAAC,CAAwB;IACtD,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,oBAAoB,CAAwB;IACpD,OAAO,CAAC,YAAY,CAA+C;IACnE,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,YAAY,CAA2B;IAG/C,OAAO,CAAC,aAAa,CAAC,CAAgB;IACtC,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,YAAY,CAAC,CAAoB;IAGzC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAW;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAgB;IAG5D,OAAO,CAAC,UAAU,CAAe;IACjC,OAAO,CAAC,UAAU,CAAkB;gBAGhC,UAAU,EAAE,UAAU,EACtB,eAAe,EAAE,eAAe,EAChC,oBAAoB,EAAE,qBAAqB,EAC3C,YAAY,EAAE,aAAa,GAAG,cAAc,GAAG,WAAW,EAC1D,aAAa,EAAE,aAAa,EAC5B,YAAY,CAAC,EAAE,YAAY,EAC3B,OAAO,CAAC,EAAE,oBAAoB;IAwBlC;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAOjC;;OAEG;IACH,gBAAgB,CACZ,aAAa,EAAE,aAAa,EAC5B,cAAc,EAAE,cAAc,EAC9B,YAAY,EAAE,iBAAiB,GAChC,IAAI;IAOP;;OAEG;IACH,OAAO,CAAC,eAAe;IAKvB;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAelC,aAAa,IAAI,UAAU;IAI3B;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAIrC;;;;;;;;;;;;;OAaG;YACW,aAAa;IAwD3B;;;;OAIG;IACG,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAUrC;;;OAGG;IACG,WAAW,CACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IA8InB;;OAEG;IACG,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBjD;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC;QAC1B,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;KACpB,CAAC;IAgCF;;;;OAIG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,SAAS;IAgB/D;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,iBAAiB;IA0BzB;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAS3B;;;;OAIG;YACW,kBAAkB;IAwGhC;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAU9B;;OAEG;IACH,uBAAuB,IAAI,MAAM,EAAE;IAInC;;OAEG;IACH,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAI5C;;OAEG;IACH,sBAAsB,IAAI,IAAI;CAGjC"}