@duckmind/dm-darwin-x64 0.66.4 → 0.66.6

package/extensions/dm-mcp-adapter/mcp-code.js

@@ -2,16 +2,24 @@ import { formatWithOptions } from "node:util";
 import { Worker } from "node:worker_threads";
 import { throwIfAborted } from "./abort.js";
 import { guardMcpOutput, guardedMcpDetails, resolveMcpOutputGuardOptions } from "./mcp-output-guard.js";
+import { loadMcpScriptWasm, resolveMcpScriptQuickJsUrl } from "./mcp-script-wasm.js";
 import { evaluateJev, validateJevSettings } from "./jev-client.js";
-import { executeCall } from "./proxy-modes.js";
+import { executeCall, findTools, resolveDescribeTarget, unscopedCallReachesServer } from "./proxy-modes.js";
 import { combineAbortSignals } from "./runtime-owner.js";
-import { paginate, rankSuggestions, rankToolMatches } from "./search-ranking.js";
-import { semanticSearch } from "./semantic-search.js";
-import { isServerInActiveFailureBackoff } from "./failure-backoff.js";
-import { findToolByName, formatSchema, hasSchemaDescriptions } from "./tool-metadata.js";
+import { paginate } from "./search-ranking.js";
+import { formatSchema, hasSchemaDescriptions } from "./tool-metadata.js";
 import { renderTsShape } from "./ts-shape.js";
+import { getObservedOutput, renderOutputShape } from "./output-shape.js";
 export const DEFAULT_MCP_SCRIPT_TIMEOUT_MS = 30000;
 const MCP_SCRIPT_INTERMEDIATE_MAX_BYTES = 16 * 1024 * 1024;
+const MCP_SCRIPT_OUTPUT_MAX_BYTES = 16 * 1024 * 1024;
+const SEEN_FIELDS_MAX_CHARS = 8 * 1024;
+const EMPTY_RETURNS = new Set(["[]", "{}", "null", ""]);
+const observedTarget = (state, observed, path, server) => {
+  const scope = unscopedCallReachesServer(state, path, server) ? "" : `, { server: ${JSON.stringify(server)} }`;
+  const call = `(await tools.call(${JSON.stringify(path)}, args${scope}))`;
+  return observed.source === "structuredContent" ? `${call}.data.structuredContent` : `JSON.parse(${call}.data.content[0].text)`;
+};
 
 class McpScriptTimeoutError extends Error {
   constructor(timeoutMs) {
@@ -65,6 +73,16 @@ function textFromContent(content) {
   return content.filter((block) => block.type === "text").map((block) => block.text).join(`
 `);
 }
+function resultErrorMessage(result) {
+  return typeof result.details.message === "string" ? result.details.message : textFromContent(result.content);
+}
+function scriptScopeMessage(code, path, server, retry) {
+  if (code === "server_not_found")
+    return `Server "${String(server)}" not found. Use the server from a tools.search hit.`;
+  if (code !== "ambiguous_tool")
+    return;
+  return typeof server === "string" ? `Tool "${path}" matches multiple tools on server "${server}". Use an exact path from tools.search({ query: "", server: ${JSON.stringify(server)} }).` : `Tool "${path}" matches multiple servers. Pass the server from tools.search: ${retry}.`;
+}
 function abortReasonError(reason) {
   return reason instanceof Error ? reason : new Error(String(reason ?? "MCP request aborted"));
 }
@@ -75,7 +93,13 @@ function parseWorkerMessage(value) {
   if (message.type === "emit" && "block" in message)
     return { type: "emit", block: message.block };
   if (message.type === "call" && typeof message.id === "number" && typeof message.path === "string") {
-    return "args" in message ? { type: "call", id: message.id, path: message.path, args: message.args } : { type: "call", id: message.id, path: message.path };
+    return {
+      type: "call",
+      id: message.id,
+      path: message.path,
+      ..."args" in message ? { args: message.args } : {},
+      ...typeof message.server === "string" ? { server: message.server } : {}
+    };
   }
   if (message.type === "evaluate" && typeof message.id === "number" && "input" in message) {
     return { type: "evaluate", id: message.id, input: message.input };
@@ -94,6 +118,7 @@ function parseWorkerMessage(value) {
 export async function runMcpScript(state, code, timeoutMs = DEFAULT_MCP_SCRIPT_TIMEOUT_MS, getPiTools, signal, jevEvaluator = evaluateJev, semanticEvaluator) {
   const resolvedTimeoutMs = Number.isFinite(timeoutMs) && timeoutMs > 0 ? Math.floor(timeoutMs) : DEFAULT_MCP_SCRIPT_TIMEOUT_MS;
   const output = [];
+  let outputBytes = 0;
   const externalSignal = combineAbortSignals(state.owner?.signal, signal);
   const timeoutController = new AbortController;
   const callSignal = combineAbortSignals(externalSignal, timeoutController.signal);
@@ -105,6 +130,8 @@ export async function runMcpScript(state, code, timeoutMs = DEFAULT_MCP_SCRIPT_T
   }));
   let callsSnapshot;
   let intermediateBytes = 0;
+  const calledTools = new Map;
+  let returnedEmpty = false;
   const reserveIntermediateBytes = (dataJson) => {
     const bytes = Buffer.byteLength(dataJson, "utf8");
     if (bytes > MCP_SCRIPT_INTERMEDIATE_MAX_BYTES - intermediateBytes)
@@ -112,11 +139,11 @@ export async function runMcpScript(state, code, timeoutMs = DEFAULT_MCP_SCRIPT_T
     intermediateBytes += bytes;
     return true;
   };
-  const callTool = async (path, args) => {
+  const callTool = async (path, args, server) => {
     const startedAt = Date.now();
     const index = calls.push({ operation: "call", path, ok: false, error: "incomplete", durationMs: 0, startedAt }) - 1;
     let dataJson;
-    const result = await executeCall(state, path, args, undefined, getPiTools, callSignal, "script", {
+    const result = await executeCall(state, path, args, server, getPiTools, callSignal, "script", {
       onSuccess(data) {
         dataJson = JSON.stringify(data);
       }
@@ -127,7 +154,7 @@ export async function runMcpScript(state, code, timeoutMs = DEFAULT_MCP_SCRIPT_T
     if (details.error !== undefined) {
       const errorCode = String(details.error);
       const suggestions = Array.isArray(details.suggestions) ? details.suggestions.filter((suggestion) => typeof suggestion === "string") : [];
-      const message = errorCode === "tool_not_found" ? `Tool "${path}" not found. Use await tools.search({ query: "..." }) inside mcpScript.${suggestions.length > 0 ? ` Did you mean: ${suggestions.join(", ")}` : ""}` : typeof details.message === "string" ? details.message : textFromContent(result.content);
+      const message = errorCode === "tool_not_found" ? `Tool "${path}" not found. Use await tools.search({ query: "..." }) inside mcpScript.${suggestions.length > 0 ? ` Did you mean: ${suggestions.join(", ")}` : ""}` : scriptScopeMessage(errorCode, path, details.server, "tools.call(path, args, { server })") ?? resultErrorMessage(result);
       calls[index] = { operation: "call", path, ok: false, error: errorCode, durationMs: Date.now() - startedAt, startedAt };
       return {
         envelope: { ok: false, error: { code: errorCode, message } }
@@ -147,6 +174,10 @@ export async function runMcpScript(state, code, timeoutMs = DEFAULT_MCP_SCRIPT_T
       };
     }
     calls[index] = { operation: "call", path, ok: true, durationMs: Date.now() - startedAt, startedAt };
+    if (typeof details.server === "string" && typeof details.tool === "string") {
+      const calledPath = typeof details.canonicalTool === "string" ? details.canonicalTool : path;
+      calledTools.set(JSON.stringify([details.server, calledPath]), { path: calledPath, server: details.server, tool: details.tool });
+    }
     return { dataJson };
   };
   const jevSettings = validateJevSettings(state.config.settings?.jev);
@@ -222,33 +253,28 @@ export async function runMcpScript(state, code, timeoutMs = DEFAULT_MCP_SCRIPT_T
     const index = calls.push({ operation: "search", query, ok: false, error: "incomplete", durationMs: 0, startedAt }) - 1;
     let error;
     try {
-      if (input?.searchMode !== undefined && input.searchMode !== "lexical" && input.searchMode !== "semantic") {
-        error = "invalid_search_mode";
-        return { items: [], total: 0, hasMore: false, nextOffset: null, error: { code: "invalid_search_mode", message: "Search mode must be lexical or semantic." } };
-      }
-      if (query.trim() === "" && input?.searchMode !== "semantic") {
-        return { items: [], total: 0, hasMore: false, nextOffset: null };
+      const outcome = await findTools(state, {
+        query,
+        regex: input?.regex === true,
+        server: typeof input?.server === "string" ? input.server : undefined,
+        searchMode: input?.searchMode,
+        signal: callSignal,
+        semanticEvaluator: async (semanticState, semanticInput, options) => {
+          const rejected = admitEvaluation(semanticInput);
+          if (rejected)
+            return rejected;
+          const envelope = await (semanticEvaluator ?? evaluateJev)(semanticState, semanticInput, options);
+          return chargeEvaluationTokens(envelope);
+        },
+        observedSources: [...observedSources]
+      });
+      if ("error" in outcome) {
+        error = String(outcome.error.details.error);
+        return { items: [], total: 0, hasMore: false, nextOffset: null, error: { code: error, message: resultErrorMessage(outcome.error) } };
       }
-      const server = typeof input?.server === "string" ? input.server : undefined;
       const limit = typeof input?.limit === "number" ? input.limit : 12;
       const offset = typeof input?.offset === "number" ? input.offset : 0;
-      const searchMode = input?.searchMode === "semantic" ? "semantic" : "lexical";
-      if (searchMode === "semantic" && input?.regex === true) {
-        error = "invalid_search_mode";
-        return { items: [], total: 0, hasMore: false, nextOffset: null, error: { code: "invalid_search_mode", message: "Semantic search cannot be combined with regex search." } };
-      }
-      const semantic = searchMode === "semantic" ? await semanticSearch(state, query, server, callSignal, async (semanticState, semanticInput, options) => {
-        const rejected = admitEvaluation(semanticInput);
-        if (rejected)
-          return rejected;
-        const envelope = await (semanticEvaluator ?? evaluateJev)(semanticState, semanticInput, options);
-        return chargeEvaluationTokens(envelope);
-      }, [...observedSources]) : undefined;
-      if (semantic && !semantic.ok) {
-        error = semantic.error.code;
-        return { items: [], total: 0, hasMore: false, nextOffset: null, error: semantic.error };
-      }
-      const page = paginate(semantic?.matches ?? rankToolMatches(state, query, server), offset, limit);
+      const page = paginate(outcome.matches, offset, limit);
       return {
         ...page,
         items: page.items.map(({ server: matchServer, tool, score }) => ({
@@ -258,7 +284,7 @@ export async function runMcpScript(state, code, timeoutMs = DEFAULT_MCP_SCRIPT_T
           ...tool.description ? { description: tool.description } : {},
           score
         })),
-        ...semantic ? { backend: semantic.backend } : {}
+        ...outcome.backend ? { backend: outcome.backend } : {}
       };
     } catch (caught) {
       error = caught;
@@ -272,36 +298,42 @@ export async function runMcpScript(state, code, timeoutMs = DEFAULT_MCP_SCRIPT_T
     const path = typeof input?.path === "string" ? input.path : "";
     let error;
     try {
-      for (const [server, metadata] of state.toolMetadata) {
-        if (isServerInActiveFailureBackoff(state, server))
-          continue;
-        const tool = findToolByName(metadata, path);
-        if (!tool)
-          continue;
-        const inputShape = tool.inputSchema ? renderTsShape(tool.inputSchema) : null;
-        const inputTypeScript = inputShape ?? (tool.inputSchema ? formatSchema(tool.inputSchema) : null);
+      const target = resolveDescribeTarget(state, path, typeof input?.server === "string" ? input.server : undefined);
+      if ("error" in target) {
+        const details = target.error.details;
+        const code = String(details.error);
+        error = code;
         return {
-          path: tool.name,
-          name: tool.originalName,
-          server,
-          ...tool.description ? { description: tool.description } : {},
-          ...inputTypeScript ? { inputTypeScript } : {},
-          ...inputShape && hasSchemaDescriptions(tool.inputSchema) ? { inputGuidance: formatSchema(tool.inputSchema) } : {},
-          ...tool.outputSchema !== undefined ? {
-            outputSchemaTarget: "data.structuredContent",
-            outputSchema: tool.outputSchema
-          } : {}
+          path,
+          error: {
+            code,
+            message: code === "tool_not_found" ? `Tool not found: ${path}` : scriptScopeMessage(code, path, details.server, "tools.describe({ path, server })") ?? resultErrorMessage(target.error),
+            suggestions: Array.isArray(details.suggestions) ? details.suggestions : []
+          }
         };
       }
-      const suggestions = path ? rankSuggestions(state, path, 5) : [];
-      error = "tool_not_found";
+      const { server, tool } = target;
+      const inputShape = tool.inputSchema ? renderTsShape(tool.inputSchema) : null;
+      const inputTypeScript = inputShape ?? (tool.inputSchema ? formatSchema(tool.inputSchema) : null);
+      const observed = tool.resourceUri ? undefined : getObservedOutput(state, server, tool);
       return {
-        path,
-        error: {
-          code: "tool_not_found",
-          message: `Tool not found: ${path}`,
-          suggestions
-        }
+        path: tool.name,
+        name: tool.originalName,
+        server,
+        ...tool.description ? { description: tool.description } : {},
+        ...inputTypeScript ? { inputTypeScript } : {},
+        ...inputShape && hasSchemaDescriptions(tool.inputSchema) ? { inputGuidance: formatSchema(tool.inputSchema) } : {},
+        ...tool.outputSchema !== undefined ? {
+          outputSchemaTarget: "data.structuredContent",
+          outputSchema: tool.outputSchema
+        } : {},
+        ...tool.annotations ? { annotations: tool.annotations } : {},
+        ...observed ? {
+          observedOutput: {
+            target: observedTarget(state, observed, tool.name, server),
+            typeScript: renderOutputShape(observed.shape)
+          }
+        } : {}
       };
     } catch (caught) {
       error = caught;
@@ -315,30 +347,77 @@ export async function runMcpScript(state, code, timeoutMs = DEFAULT_MCP_SCRIPT_T
   let removeAbortListener = () => {};
   let errorCode;
   let errorMessage;
-  try {
-    if (externalSignal?.aborted) {
-      throw abortReasonError(externalSignal.reason);
+  const interrupt = new SharedArrayBuffer(4);
+  const interruptView = new Int32Array(interrupt);
+  const timeoutError = new McpScriptTimeoutError(resolvedTimeoutMs);
+  const timeout = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      callsSnapshot = snapshotCalls();
+      timeoutController.abort(timeoutError);
+      Atomics.store(interruptView, 0, 1);
+      worker?.terminate();
+      reject(timeoutError);
+    }, resolvedTimeoutMs);
+  });
+  const aborted = externalSignal ? new Promise((_resolve, reject) => {
+    const onAbort = () => {
+      callsSnapshot = snapshotCalls();
+      Atomics.store(interruptView, 0, 1);
+      worker?.terminate();
+      reject(abortReasonError(externalSignal.reason));
+    };
+    if (externalSignal.aborted)
+      onAbort();
+    else {
+      externalSignal.addEventListener("abort", onAbort, { once: true });
+      removeAbortListener = () => externalSignal.removeEventListener("abort", onAbort);
     }
+  }) : new Promise(() => {});
+  try {
+    const wasm = await Promise.race([loadMcpScriptWasm(), timeout, aborted]);
     worker = new Worker(new URL("./mcp-script-worker.mjs", import.meta.url), {
-      workerData: { code },
+      workerData: { code, wasm, quickjsUrl: resolveMcpScriptQuickJsUrl(), interrupt, outputMaxBytes: MCP_SCRIPT_OUTPUT_MAX_BYTES },
       env: {},
       trackUnmanagedFds: false
     });
     const activeWorker = worker;
     const execution = new Promise((resolve, reject) => {
       let completed = false;
+      const retainOutput = (value) => {
+        const block = toContentBlock(value);
+        const bytes = Buffer.byteLength(JSON.stringify(block), "utf8");
+        if (bytes > MCP_SCRIPT_OUTPUT_MAX_BYTES - outputBytes)
+          return false;
+        outputBytes += bytes;
+        output.push(block);
+        return true;
+      };
+      const rejectOutputBudget = () => {
+        completed = true;
+        const error = new Error("mcpScript output exceeds the 16 MiB per-script budget");
+        callsSnapshot = snapshotCalls();
+        timeoutController.abort(error);
+        Atomics.store(interruptView, 0, 1);
+        activeWorker.terminate();
+        reject(error);
+      };
       activeWorker.on("message", (value) => {
         const message = parseWorkerMessage(value);
         if (!message || completed)
           return;
         if (message.type === "emit") {
-          output.push(toContentBlock(message.block));
+          if (!retainOutput(message.block))
+            rejectOutputBudget();
           return;
         }
         if (message.type === "done") {
+          if ("returnBlock" in message && !retainOutput(message.returnBlock)) {
+            rejectOutputBudget();
+            return;
+          }
+          const returned = message.returnBlock;
+          returnedEmpty = returned?.type === "text" && typeof returned.text === "string" && EMPTY_RETURNS.has(returned.text.trim());
           completed = true;
-          if ("returnBlock" in message)
-            output.push(toContentBlock(message.returnBlock));
           resolve();
           return;
         }
@@ -350,7 +429,7 @@ export async function runMcpScript(state, code, timeoutMs = DEFAULT_MCP_SCRIPT_T
         (async () => {
           let payload;
           if (message.type === "call") {
-            payload = await callTool(message.path, message.args);
+            payload = await callTool(message.path, message.args, message.server);
           } else if (message.type === "evaluate") {
             payload = await evaluate(message.input);
           } else if (message.type === "search") {
@@ -370,24 +449,6 @@ export async function runMcpScript(state, code, timeoutMs = DEFAULT_MCP_SCRIPT_T
           reject(new Error(`mcpScript worker exited with code ${code}`));
       });
     });
-    const timeoutError = new McpScriptTimeoutError(resolvedTimeoutMs);
-    const timeout = new Promise((_resolve, reject) => {
-      timer = setTimeout(() => {
-        callsSnapshot = snapshotCalls();
-        timeoutController.abort(timeoutError);
-        activeWorker.terminate();
-        reject(timeoutError);
-      }, resolvedTimeoutMs);
-    });
-    const aborted = externalSignal ? new Promise((_resolve, reject) => {
-      const onAbort = () => {
-        callsSnapshot = snapshotCalls();
-        activeWorker.terminate();
-        reject(abortReasonError(externalSignal.reason));
-      };
-      externalSignal.addEventListener("abort", onAbort, { once: true });
-      removeAbortListener = () => externalSignal.removeEventListener("abort", onAbort);
-    }) : new Promise(() => {});
     await Promise.race([execution, timeout, aborted]);
   } catch (error) {
     if (error instanceof McpScriptTimeoutError) {
@@ -406,9 +467,35 @@ export async function runMcpScript(state, code, timeoutMs = DEFAULT_MCP_SCRIPT_T
     removeAbortListener();
     callsSnapshot ??= snapshotCalls();
     timeoutController.abort(new Error("mcpScript finished"));
+    Atomics.store(interruptView, 0, 1);
     await worker?.terminate();
   }
-  const guarded = await guardMcpOutput(output.length > 0 ? [...output] : [{ type: "text", text: "(no output)" }], resolveMcpOutputGuardOptions(state.config.settings));
+  let seenFields;
+  if (errorCode === "timeout" || errorCode === "script_error" || returnedEmpty || output.length === 0) {
+    const sections = [];
+    let chars = 0;
+    for (const { path, server, tool } of calledTools.values()) {
+      const meta = state.toolMetadata.get(server)?.find((entry) => entry.originalName === tool && !entry.resourceUri);
+      const observed = meta && getObservedOutput(state, server, meta);
+      if (!observed)
+        continue;
+      const section = `${observedTarget(state, observed, path, server)} is:
+${renderOutputShape(observed.shape)}`;
+      if (chars + section.length > SEEN_FIELDS_MAX_CHARS)
+        break;
+      chars += section.length;
+      sections.push(section);
+    }
+    if (sections.length > 0) {
+      seenFields = `
+
+[Result fields seen from the tools this script called (names and types only, not a contract):
+${sections.join(`
+
+`)}]`;
+    }
+  }
+  const guarded = await guardMcpOutput(output.length > 0 ? [...output] : [{ type: "text", text: "(no output)" }], { ...resolveMcpOutputGuardOptions(state.config.settings), ...seenFields ? { footer: seenFields } : {} });
   return {
     content: guarded.content,
     details: {

package/extensions/dm-mcp-adapter/mcp-keyring-helper.cjs

@@ -1,4 +1,4 @@
-var __filename = "/Users/que/Projects/dm-release-494/source/dm-mono/packages/coding-agent/dist/extensions/dm-mcp-adapter/mcp-keyring-helper.cjs";
+var __filename = "/Users/que/Projects/dm/dm-mono/packages/coding-agent/dist/extensions/dm-mcp-adapter/mcp-keyring-helper.cjs";
 const { createRequire } = require("node:module");
 const { dirname, join } = require("node:path");
 const requireFromHere = createRequire(__filename);

package/extensions/dm-mcp-adapter/mcp-oauth-provider.js

@@ -42,6 +42,7 @@ function toOAuthTokens(tokens) {
     result.issuer = tokens.issuer;
   return result;
 }
+const DEFAULT_OAUTH_CALLBACK_HOST = "127.0.0.1";
 const DEFAULT_OAUTH_CALLBACK_PORT = 19876;
 const DEFAULT_OAUTH_CALLBACK_PATH = "/callback";
 let configuredOAuthCallbackPort = DEFAULT_OAUTH_CALLBACK_PORT;
@@ -187,7 +188,7 @@ export class McpOAuthProvider {
     }
     this.authFetch = createOAuthFetch(serverUrl, undefined, runtimeSignal);
     this.flowState = initialState;
-    this.redirectUrlSnapshot = config.grantType === "client_credentials" ? undefined : config.redirectUri ?? `http://localhost:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`;
+    this.redirectUrlSnapshot = config.grantType === "client_credentials" ? undefined : config.redirectUri ?? `http://${DEFAULT_OAUTH_CALLBACK_HOST}:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`;
   }
   setAuthFetch(fetchFn) {
     this.authFetch = fetchFn;
@@ -531,4 +532,4 @@ export class McpOAuthProvider {
   }
 }
 
-export { DEFAULT_OAUTH_CALLBACK_PORT, DEFAULT_OAUTH_CALLBACK_PATH };
+export { DEFAULT_OAUTH_CALLBACK_HOST, DEFAULT_OAUTH_CALLBACK_PORT, DEFAULT_OAUTH_CALLBACK_PATH };

package/extensions/dm-mcp-adapter/mcp-output-guard.js

@@ -11,6 +11,7 @@ import {
 export const DEFAULT_MCP_OUTPUT_MAX_BYTES = DEFAULT_MAX_BYTES;
 export const DEFAULT_MCP_OUTPUT_MAX_LINES = DEFAULT_MAX_LINES;
 export const DEFAULT_MCP_DETAILS_MAX_BYTES = 16 * 1024;
+const SCRIPT_PIPE_HINT_MIN_BYTES = 8 * 1024;
 const CONTENT_SUMMARY_LIMIT = 20;
 const KEY_PREVIEW_LIMIT = 20;
 const KEY_MAX_BYTES = 120;
@@ -26,6 +27,14 @@ export function resolveMcpOutputGuardOptions(settings) {
     detailsMaxBytes: positiveInt(tuning?.detailsMaxBytes) ?? DEFAULT_MCP_DETAILS_MAX_BYTES
   };
 }
+export function scriptPipeHint(scriptTool, content) {
+  if (scriptTool !== true)
+    return {};
+  const bytes = content.reduce((total, block) => total + (block.type === "text" ? byteLength(block.text) : 0), 0);
+  return bytes >= SCRIPT_PIPE_HINT_MIN_BYTES ? { footer: `
+
+[Use mcpScript to pass this result to another MCP call without copying it through the conversation.]` } : {};
+}
 export function guardedMcpDetails(guarded) {
   return {
     ...guarded.mcpResult !== undefined ? { mcpResult: guarded.mcpResult } : {},
@@ -38,10 +47,11 @@ export async function guardMcpOutput(content, options = {}) {
   const detailsMaxBytes = options.detailsMaxBytes ?? DEFAULT_MCP_DETAILS_MAX_BYTES;
   const prefix = options.prefix ?? "";
   const suffix = options.suffix ?? "";
+  const footer = options.footer ?? "";
   const normalizedContent = withEmptyTextFallback(content.length > 0 ? sanitizeContent(content) : [{ type: "text", text: options.emptyTextFallback ?? "(empty result)" }], options.emptyTextFallback);
   if (options.enabled === false) {
     return {
-      content: addAffixes(normalizedContent, prefix, suffix),
+      content: addAffixes(normalizedContent, prefix, `${suffix}${footer}`),
       ...options.rawMcpResult !== undefined ? { mcpResult: options.rawMcpResult } : {}
     };
   }
@@ -49,13 +59,17 @@ export async function guardMcpOutput(content, options = {}) {
   const textOutput = normalizedContent.filter((block) => block.type === "text").map((block) => block.text).join(`
 `);
   const composedOutput = `${prefix}${textOutput}${suffix}`;
-  const truncation = truncateHead(composedOutput, { maxBytes, maxLines });
-  let guardedContent = addAffixes(normalizedContent, prefix, suffix);
+  const truncation = truncateHead(`${composedOutput}${footer}`, { maxBytes, maxLines });
+  let guardedContent = addAffixes(normalizedContent, prefix, `${suffix}${footer}`);
   let outputGuard;
   if (truncation.truncated) {
     const { path: fullOutputPath, error: writeError } = await saveArtifact("output", composedOutput);
     const initialNotice = formatTruncationNotice(truncation, fullOutputPath, writeError);
-    const previewBudget = reserveBudget(maxBytes, maxLines, initialNotice);
+    const noticeWithFooter = textStats(`
+
+${initialNotice}${footer}`);
+    const keptFooter = noticeWithFooter.bytes < maxBytes && noticeWithFooter.lines < maxLines ? footer : "";
+    const previewBudget = reserveBudget(maxBytes, maxLines, `${initialNotice}${keptFooter}`);
     const preview = truncateHead(composedOutput, {
       maxBytes: previewBudget.maxBytes,
       maxLines: previewBudget.maxLines
@@ -63,7 +77,7 @@ export async function guardMcpOutput(content, options = {}) {
     const notice = formatTruncationNotice({ ...truncation, outputLines: preview.outputLines, outputBytes: preview.outputBytes }, fullOutputPath, writeError);
     const finalText = `${preview.content}
 
-${notice}`;
+${notice}${keptFooter}`;
     const finalStats = textStats(finalText);
     guardedContent = [{ type: "text", text: finalText }, ...imageBlocks];
     outputGuard = {