@duckmind/dm-linux-x64 0.65.5 → 0.65.7

package/extensions/dm-mcp-adapter/proxy-modes.js

@@ -1,31 +1,50 @@
 import { UrlElicitationRequiredError } from "@modelcontextprotocol/client";
 import { createRequire } from "node:module";
-import { getServerPrefix, isServerDisabled, parseUiPromptHandoff } from "./types.js";
-import { clearFailure, formatMcpConnectionFailure, getFailureAgeSeconds, lazyConnect, markKeepAliveAfterConnect, notifyToolMetadataUpdated, recordFailure, updateMetadataCache, updateServerMetadata, updateStatusBar } from "./init.js";
+import { getServerPrefix, getToolNameCandidates, isServerDisabled, parseUiPromptHandoff, resolveToolPrefix } from "./types.js";
+import { lazyConnect, markKeepAliveAfterConnect, notifyToolMetadataUpdated, updateServerMetadata, updateMetadataCache, getFailureAgeSeconds, updateStatusBar, clearFailure, recordFailure } from "./init.js";
 import { abortable, throwIfAborted } from "./abort.js";
 import { combineAbortSignals, isAbortError } from "./runtime-owner.js";
-import { buildToolMetadata, getToolNames, findToolByName, formatSchema } from "./tool-metadata.js";
+import { buildToolMetadata, getToolNames, formatSchema } from "./tool-metadata.js";
 import { renderTsShape } from "./ts-shape.js";
 import { reconstructPromptMetadata } from "./metadata-cache.js";
-import { resolveMcpResultContent, transformMcpContent, transformMcpResourceContents } from "./tool-registrar.js";
+import { resolveMcpResultContent, transformMcpResourceContents } from "./tool-registrar.js";
 import { guardMcpOutput, guardedMcpDetails, resolveMcpOutputGuardOptions } from "./mcp-output-guard.js";
 import { maybeStartUiSession, summarizeUiSessionResult } from "./ui-session.js";
 import { formatAuthRequiredMessage, formatMcpStatus, normalizeToolArguments, resolveServerUrl, truncateAtWord } from "./utils.js";
-import { authenticate, completeAuthFromInput, startAuth, supportsOAuth } from "./mcp-auth-flow.js";
+import { authenticate, completeAuthFromInput, getAuthStatus, startAuth, supportsOAuth } from "./mcp-auth-flow.js";
 import { SessionRecoveryAuthRequiredError, withSessionRecovery } from "./session-recovery.js";
+import { callToolViaTaskSession } from "./mcp-tasks.js";
 import { paginate, rankSuggestions, rankToolMatches, resolveSearchKeywords } from "./search-ranking.js";
 import { ensureToolCallApproved, isToolCallApprovalRequired } from "./tool-approval.js";
 import { isServerInActiveFailureBackoff } from "./failure-backoff.js";
+import { semanticSearch } from "./semantic-search.js";
 import { getInputRequiredNeedsUiDetails } from "./errors.js";
-import { logger } from "./logger.js";
+import { createJsonSchemaValidator } from "./json-schema-validator.js";
 const require = createRequire(import.meta.url);
+const proxyArgumentValidators = new WeakMap;
 const MAX_REGEX_SEARCH_QUERY_LENGTH = 256;
+function proxyArgumentValidationError(inputSchema, args) {
+  if (!inputSchema || typeof inputSchema !== "object" || Array.isArray(inputSchema))
+    return null;
+  try {
+    let validate = proxyArgumentValidators.get(inputSchema);
+    if (!validate) {
+      validate = createJsonSchemaValidator().getValidator(inputSchema);
+      proxyArgumentValidators.set(inputSchema, validate);
+    }
+    const result = validate(args);
+    return result.valid ? null : result.errorMessage ?? "arguments do not match the advertised input schema";
+  } catch {
+    return null;
+  }
+}
 const INSTRUCTIONS_PREVIEW_LENGTH = 300;
 const REGEX_SAFETY_CHECK_PARAMS = {
   attackTimeout: 50,
   incubationTimeout: 50,
   timeout: 250
 };
+const backgroundAuthWatchers = new WeakMap;
 let nextProgressInvocationId = 1;
 function withUiProgressBridge(options, ui, serverName, toolName) {
   if (!ui)
@@ -57,6 +76,18 @@ function getEnabledToolMatches(state, toolName, exact) {
   }
   return matches;
 }
+function getEnabledOriginalToolMatches(state, toolName) {
+  const matches = [];
+  for (const [server, metadata] of state.toolMetadata) {
+    if (isServerDisabled(state.config.mcpServers[server]))
+      continue;
+    for (const tool of metadata) {
+      if (tool.originalName === toolName)
+        matches.push({ server, tool });
+    }
+  }
+  return matches;
+}
 function serverBackoffResult(state, mode, serverName) {
   const failedAgo = getFailureAgeSeconds(state, serverName) ?? 0;
   const message = `Server "${serverName}" not available (last failed ${failedAgo}s ago)`;
@@ -65,28 +96,55 @@ function serverBackoffResult(state, mode, serverName) {
     details: { mode, error: "server_backoff", server: serverName }
   };
 }
-function getSingleToolMatch(metadata, toolName) {
-  const exactMatches = getToolMatches(metadata, toolName, true);
-  const matches = exactMatches.length > 0 ? exactMatches : getToolMatches(metadata, toolName, false);
-  return matches.length > 1 ? "ambiguous" : matches[0];
+function getCandidateToolMatches(metadata, toolName, serverName, state) {
+  if (!metadata)
+    return [];
+  const prefix = resolveToolPrefix(state.config.mcpServers[serverName], state.config.settings?.toolPrefix);
+  return metadata.filter((tool) => getToolNameCandidates(tool.originalName, serverName, prefix).has(toolName));
 }
-function getServerScopedToolMatch(metadata, toolName) {
+function getCandidateToolMatch(metadata, toolName, serverName, state) {
+  const exact = metadata?.filter((tool) => tool.name === toolName) ?? [];
+  if (exact.length > 0)
+    return exact.length === 1 ? exact[0] : "ambiguous";
+  const candidates = getCandidateToolMatches(metadata, toolName, serverName, state);
+  return candidates.length > 1 ? "ambiguous" : candidates[0];
+}
+function getPrefixedServerScope(state, toolName) {
+  const candidates = Object.entries(state.config.mcpServers).filter(([, definition]) => !isServerDisabled(definition)).map(([name, definition]) => ({
+    name,
+    prefix: getServerPrefix(name, resolveToolPrefix(definition, state.config.settings?.toolPrefix))
+  })).filter(({ prefix }) => prefix.length > 0 && toolName.startsWith(`${prefix}_`)).sort((a, b) => b.prefix.length - a.prefix.length);
+  if (candidates.length === 0)
+    return;
+  const longest = candidates[0].prefix.length;
+  const best = candidates.filter(({ prefix }) => prefix.length === longest);
+  return best.length === 1 ? best[0].name : undefined;
+}
+function getServerScopedToolCandidates(metadata, toolName) {
   if (!metadata)
     return;
   const normalizedName = toolName.replace(/-/g, "_");
-  const matchesByPrecedence = [
-    metadata.filter((tool) => tool.name === toolName),
-    metadata.filter((tool) => tool.originalName === toolName),
-    metadata.filter((tool) => tool.name.replace(/-/g, "_") === normalizedName),
-    metadata.filter((tool) => tool.originalName.replace(/-/g, "_") === normalizedName)
-  ];
-  for (const [precedence, matches] of matchesByPrecedence.entries()) {
-    if (matches.length > 1)
-      return "ambiguous";
-    if (matches.length === 1)
-      return { tool: matches[0], precedence };
-  }
-  return;
+  const exactDisplayedMatches = metadata.filter((tool) => tool.name === toolName);
+  if (exactDisplayedMatches.length > 0)
+    return { tools: exactDisplayedMatches, precedence: 0 };
+  const exactOriginalMatches = metadata.filter((tool) => tool.originalName === toolName);
+  if (exactOriginalMatches.length > 0)
+    return { tools: exactOriginalMatches, precedence: 1 };
+  const normalizedDisplayedMatches = metadata.filter((tool) => tool.name.replace(/-/g, "_") === normalizedName);
+  const normalizedOriginalMatches = metadata.filter((tool) => tool.originalName.replace(/-/g, "_") === normalizedName);
+  const normalizedMatches = new Set([...normalizedDisplayedMatches, ...normalizedOriginalMatches]);
+  if (normalizedMatches.size === 0)
+    return;
+  return {
+    tools: [...normalizedMatches],
+    precedence: normalizedDisplayedMatches.length > 0 ? 2 : 3
+  };
+}
+function getServerScopedToolMatch(metadata, toolName) {
+  const candidates = getServerScopedToolCandidates(metadata, toolName);
+  if (!candidates)
+    return;
+  return candidates.tools.length === 1 ? { tool: candidates.tools[0], precedence: candidates.precedence } : "ambiguous";
 }
 function ambiguousToolResult(mode, toolName) {
   const message = `Tool "${toolName}" matches multiple servers. Specify a server.`;
@@ -95,6 +153,13 @@ function ambiguousToolResult(mode, toolName) {
     details: { mode, error: "ambiguous_tool", requestedTool: toolName, message }
   };
 }
+function ambiguousServerToolResult(mode, toolName, serverName) {
+  const message = `Tool "${toolName}" matches multiple tools on server "${serverName}". Use an exact displayed or upstream tool name; run mcp({ server: "${serverName}" }) to list available tools.`;
+  return {
+    content: [{ type: "text", text: message }],
+    details: { mode, error: "ambiguous_tool", server: serverName, requestedTool: toolName, message }
+  };
+}
 function disabledResult(mode, serverName) {
   const message = `Server "${serverName}" is disabled. Run /mcp enable ${serverName} and /reload to enable it.`;
   return {
@@ -102,6 +167,61 @@ function disabledResult(mode, serverName) {
     details: { mode, error: "server_disabled", server: serverName, message }
   };
 }
+function emitAuthStatus(state, serverName, status, message) {
+  state.ui?.notify(message, status === "authenticated" ? "info" : "error");
+  state.sendMessage?.({
+    customType: "mcp-oauth-status",
+    content: [{ type: "text", text: message }],
+    display: message,
+    details: {
+      server: serverName,
+      status,
+      ...status === "authenticated" ? { nextAction: { connect: serverName } } : {}
+    }
+  }, { triggerTurn: true });
+}
+function ensureBackgroundAuthWatcher(state, serverName, serverUrl, definition) {
+  let watchers = backgroundAuthWatchers.get(state);
+  if (!watchers) {
+    watchers = new Map;
+    backgroundAuthWatchers.set(state, watchers);
+  }
+  if (watchers.has(serverName))
+    return;
+  const authOptions = {
+    authStorageOptions: state.authStorageOptions,
+    runtime: state.oauthRuntime,
+    openAuthorizationUrl: state.openBrowser
+  };
+  const watcher = authenticate(serverName, serverUrl, definition, authOptions).then(async (status) => {
+    throwIfAborted(state.owner.signal);
+    if (status !== "authenticated")
+      throw new Error(`OAuth authentication ended with status: ${status}`);
+    await state.manager.close(serverName);
+    throwIfAborted(state.owner.signal);
+    clearFailure(state, serverName, "auth-background-complete");
+    updateStatusBar(state);
+    emitAuthStatus(state, serverName, "authenticated", `OAuth authentication completed for MCP server "${serverName}". Connect it now to load and verify its tools.`);
+  });
+  watchers.set(serverName, watcher);
+  watcher.catch(async (error) => {
+    if (isAbortError(error, state.owner.signal))
+      return;
+    try {
+      if (await getAuthStatus(serverName, authOptions) === "authenticated")
+        return;
+    } catch (statusError) {
+      if (isAbortError(statusError, state.owner.signal))
+        return;
+    }
+    if (state.owner.signal.aborted)
+      return;
+    emitAuthStatus(state, serverName, "failed", `OAuth authentication failed for MCP server "${serverName}". Start authorization again or inspect trusted logs.`);
+  }).finally(() => {
+    if (watchers?.get(serverName) === watcher)
+      watchers.delete(serverName);
+  });
+}
 function getAuthRequiredMessage(state, serverName, defaultMessage = `Server "${serverName}" requires OAuth authentication. Run mcp({ action: "auth-start", server: "${serverName}" }) to get a browser URL, or /mcp-auth ${serverName} in an interactive local session.`) {
   return formatAuthRequiredMessage(state.config, serverName, defaultMessage);
 }
@@ -131,15 +251,15 @@ function getRedirectDetails(authorizationUrl) {
 }
 function formatManualAuthInstructions(serverName, authorizationUrl) {
   const redirect = getRedirectDetails(authorizationUrl);
-  const redirectNote = redirect.remote ? "The provider uses a pre-registered HTTPS callback. Copy its full URL from the browser address bar, even if the destination page reports an error." : redirect.port ? `The redirect URL will use local port ${redirect.port}. On a remote server it is expected for that localhost page to fail locally; copy the address bar URL anyway.` : "";
+  const redirectNote = redirect.remote ? "The provider uses a pre-registered HTTPS callback. Copy its full URL from the browser address bar, even if the destination page reports an error." : `The adapter is watching${redirect.port ? ` local port ${redirect.port}` : " the local callback"} and will report when authentication completes.`;
   return [
     `MCP OAuth required for "${serverName}".`,
     "",
-    "Open this URL in your local browser:",
+    redirect.remote ? "The adapter is attempting to open this authorization URL in your local browser:" : "The adapter is attempting to open this authorization URL and watching for its callback:",
     "",
     authorizationUrl,
     "",
-    "After approving, copy the full callback URL from your browser address bar and send it back with:",
+    redirect.remote ? "After approving, copy the full callback URL from your browser address bar and send it back with:" : "If the browser does not open or the callback is not detected, open the URL above and complete manually with:",
     `mcp({ action: "auth-complete", server: "${serverName}", args: { redirectUrl: "PASTE_REDIRECT_URL_HERE" } })`,
     "",
     redirect.remote ? "Remote HTTPS callbacks must include the full callback URL so the OAuth state can be checked. JSON-string args remain supported." : 'You can also pass just the `code` query parameter as `args: { code: "PASTE_CODE_HERE" }`. JSON-string args remain supported.',
@@ -384,6 +504,16 @@ export async function executeAuthStart(state, serverName, signal) {
         details: { mode: "auth-start", server: serverName, authenticated: true }
       };
     }
+    if (getRedirectDetails(authorizationUrl).remote) {
+      try {
+        await state.openBrowser(authorizationUrl);
+      } catch (error) {
+        if (isAbortError(error, ownedSignal))
+          throw error;
+      }
+    } else {
+      ensureBackgroundAuthWatcher(state, serverName, serverUrl, definition);
+    }
     return {
       content: [{ type: "text", text: formatManualAuthInstructions(serverName, authorizationUrl) }],
       details: { mode: "auth-start", server: serverName, authorizationUrl }
@@ -431,21 +561,32 @@ export async function executeAuthComplete(state, serverName, input, signal) {
     };
   }
 }
-export function executeDescribe(state, toolName) {
-  const exactMatches = getEnabledToolMatches(state, toolName, true).filter((match) => !isServerInActiveFailureBackoff(state, match.server));
-  if (exactMatches.length > 1)
-    return ambiguousToolResult("describe", toolName);
-  if (exactMatches.length === 0 && getEnabledToolMatches(state, toolName, false).filter((match) => !isServerInActiveFailureBackoff(state, match.server)).length > 1) {
-    return ambiguousToolResult("describe", toolName);
-  }
-  let serverName = exactMatches[0]?.server;
-  let toolMeta = exactMatches[0]?.tool;
+export function executeDescribe(state, toolName, serverOverride) {
+  let serverName;
+  let toolMeta;
   let disabledMatch;
   let failedMatch;
-  if (!toolMeta) {
+  if (serverOverride) {
+    if (!state.config.mcpServers[serverOverride]) {
+      return {
+        content: [{ type: "text", text: `Server "${serverOverride}" not found. Use mcp({}) to see available servers.` }],
+        details: { mode: "describe", error: "server_not_found", server: serverOverride, requestedTool: toolName }
+      };
+    }
+    const match = getServerScopedToolMatch(state.toolMetadata.get(serverOverride), toolName);
+    if (match === "ambiguous")
+      return ambiguousServerToolResult("describe", toolName, serverOverride);
+    if (isServerDisabled(state.config.mcpServers[serverOverride]))
+      return disabledResult("describe", serverOverride);
+    if (isServerInActiveFailureBackoff(state, serverOverride))
+      return serverBackoffResult(state, "describe", serverOverride);
+    serverName = serverOverride;
+    toolMeta = match?.tool;
+  } else {
+    const matches = [];
     for (const [server, metadata] of state.toolMetadata.entries()) {
-      const found = findToolByName(metadata, toolName);
-      if (!found)
+      const candidates = getServerScopedToolCandidates(metadata, toolName);
+      if (!candidates)
         continue;
       if (isServerDisabled(state.config.mcpServers[server])) {
         disabledMatch ??= server;
@@ -455,9 +596,16 @@ export function executeDescribe(state, toolName) {
         failedMatch ??= server;
         continue;
       }
-      serverName = server;
-      toolMeta = found;
-      break;
+      for (const tool of candidates.tools)
+        matches.push({ server, tool, precedence: candidates.precedence });
+    }
+    if (matches.length > 0) {
+      const precedence = Math.min(...matches.map((match) => match.precedence));
+      const bestMatches = matches.filter((match) => match.precedence === precedence);
+      if (bestMatches.length > 1)
+        return ambiguousToolResult("describe", toolName);
+      serverName = bestMatches[0].server;
+      toolMeta = bestMatches[0].tool;
     }
   }
   if (!serverName || !toolMeta) {
@@ -465,11 +613,13 @@ export function executeDescribe(state, toolName) {
       return disabledResult("describe", disabledMatch);
     if (failedMatch)
       return serverBackoffResult(state, "describe", failedMatch);
-    const suggestions = rankSuggestions(state, toolName, 5);
+    const suggestions = rankSuggestions(state, toolName, 5, serverOverride);
     const suggestionText = suggestions.length > 0 ? ` Did you mean: ${suggestions.join(", ")}` : "";
+    const scopeText = serverOverride ? ` on server "${serverOverride}"` : "";
+    const searchHint = serverOverride ? `mcp({ search: "...", server: "${serverOverride}" })` : `mcp({ search: "..." })`;
     return {
-      content: [{ type: "text", text: `Tool "${toolName}" not found. Use mcp({ search: "..." }) to search.${suggestionText}` }],
-      details: { mode: "describe", error: "tool_not_found", requestedTool: toolName, suggestions }
+      content: [{ type: "text", text: `Tool "${toolName}" not found${scopeText}. Use ${searchHint} to search.${suggestionText}` }],
+      details: { mode: "describe", error: "tool_not_found", server: serverOverride, requestedTool: toolName, suggestions }
     };
   }
   const approvalMarker = isToolCallApprovalRequired(state.config, serverName, toolMeta, state.toolMetadata) ? " (requires approval)" : "";
@@ -503,77 +653,12 @@ No parameters defined.`;
     details: { mode: "describe", tool: toolMeta, server: serverName }
   };
 }
-export function executeSearch(state, query, regex, server, includeSchemas, limit = 12, offset = 0) {
-  const showSchemas = includeSchemas !== false;
-  if (server && isServerDisabled(state.config.mcpServers[server]))
-    return disabledResult("search", server);
-  if (server && isServerInActiveFailureBackoff(state, server))
-    return serverBackoffResult(state, "search", server);
-  let matches;
-  if (regex) {
-    let pattern;
-    try {
-      if (query.length > MAX_REGEX_SEARCH_QUERY_LENGTH) {
-        return {
-          content: [{ type: "text", text: `Regex query is too long; maximum length is ${MAX_REGEX_SEARCH_QUERY_LENGTH} characters.` }],
-          details: { mode: "search", error: "query_too_long", query, maxLength: MAX_REGEX_SEARCH_QUERY_LENGTH }
-        };
-      }
-      pattern = new RegExp(query, "i");
-      let safety;
-      try {
-        const { checkSync } = require("recheck");
-        safety = checkSync(query, "i", REGEX_SAFETY_CHECK_PARAMS);
-      } catch (error) {
-        const reason = error instanceof Error ? error.message : String(error);
-        return {
-          content: [{ type: "text", text: "Regex query rejected because safety analysis failed." }],
-          details: { mode: "search", error: "unsafe_pattern", query, reason }
-        };
-      }
-      if (safety.status !== "safe") {
-        return {
-          content: [{ type: "text", text: `Regex query rejected as unsafe (${safety.status}).` }],
-          details: { mode: "search", error: "unsafe_pattern", query, safetyStatus: safety.status }
-        };
-      }
-    } catch {
-      return {
-        content: [{ type: "text", text: `Invalid regex: ${query}` }],
-        details: { mode: "search", error: "invalid_pattern", query }
-      };
-    }
-    matches = [];
-    const globalPrefix = state.config.settings?.toolPrefix ?? "server";
-    for (const [serverName, metadata] of state.toolMetadata.entries()) {
-      const definition = state.config.mcpServers[serverName];
-      if (isServerDisabled(definition))
-        continue;
-      if (isServerInActiveFailureBackoff(state, serverName))
-        continue;
-      if (server && serverName !== server)
-        continue;
-      for (const tool of metadata) {
-        const matched = pattern.test(tool.name) || pattern.test(tool.description) || resolveSearchKeywords(definition, tool.originalName, serverName, globalPrefix).some((keyword) => pattern.test(keyword));
-        if (matched)
-          matches.push({ server: serverName, tool, score: 0 });
-      }
-    }
-  } else if (query.trim().length === 0) {
-    if (!server) {
-      return {
-        content: [{ type: "text", text: "Search query cannot be empty" }],
-        details: { mode: "search", error: "empty_query" }
-      };
-    }
-    matches = (state.toolMetadata.get(server) ?? []).map((tool) => ({ server, tool, score: 0 })).sort((a, b) => a.tool.name.localeCompare(b.tool.name));
-  } else {
-    matches = rankToolMatches(state, query, server);
-  }
+function renderSearchResults(state, query, server, showSchemas, limit, offset, matches, backend) {
   const page = paginate(matches, offset, limit);
   if (page.total === 0) {
     const connectingServers = server ? state.config.mcpServers[server] && state.manager.isConnecting(server) ? [server] : [] : Object.keys(state.config.mcpServers).filter((name) => !isServerDisabled(state.config.mcpServers[name]) && state.manager.isConnecting(name)).sort((a, b) => a.localeCompare(b));
-    const msg = server ? `No tools matching "${query}" in "${server}"` : `No tools matching "${query}"`;
+    const scope = server ? ` in "${server}"` : "";
+    const msg = backend?.requested === "semantic" && backend.used === "semantic" && backend.abstained ? `Jev found no suitable tool for "${query}"${scope}` : `No tools matching "${query}"${scope}`;
     const connectingMessage = connectingServers.length === 1 ? ` Server "${connectingServers[0]}" is still connecting; retry in a moment.` : connectingServers.length > 1 ? ` Servers ${connectingServers.map((name) => `"${name}"`).join(", ")} are still connecting; retry in a moment.` : "";
     return {
       content: [{ type: "text", text: `${msg}${connectingMessage}` }],
@@ -584,6 +669,7 @@ export function executeSearch(state, query, regex, server, includeSchemas, limit
         hasMore: false,
         nextOffset: null,
         query,
+        ...backend ? { backend } : {},
         ...connectingServers.length > 0 ? { connectingServers } : {}
       }
     };
@@ -635,10 +721,103 @@ ${page.items.length} of ${page.total} — offset: ${page.nextOffset} for more
       count: page.total,
       hasMore: page.hasMore,
       nextOffset: page.nextOffset,
-      query
+      query,
+      ...backend ? { backend } : {}
     }
   };
 }
+export function executeSearch(state, query, regex, server, includeSchemas, limit = 12, offset = 0, searchMode = "lexical", signal, semanticEvaluator) {
+  const showSchemas = includeSchemas !== false;
+  if (searchMode !== "lexical" && searchMode !== "semantic") {
+    return {
+      content: [{ type: "text", text: "Search mode must be lexical or semantic." }],
+      details: { mode: "search", error: "invalid_search_mode", query }
+    };
+  }
+  if (server && isServerDisabled(state.config.mcpServers[server]))
+    return disabledResult("search", server);
+  if (server && isServerInActiveFailureBackoff(state, server))
+    return serverBackoffResult(state, "search", server);
+  if (searchMode === "semantic" && regex) {
+    return {
+      content: [{ type: "text", text: "Semantic search cannot be combined with regex search." }],
+      details: { mode: "search", error: "invalid_search_mode", query }
+    };
+  }
+  if (searchMode === "semantic") {
+    return semanticSearch(state, query, server, signal, semanticEvaluator).then((result) => {
+      if (!result.ok) {
+        return {
+          content: [{ type: "text", text: `Semantic search failed: ${result.error.message}` }],
+          details: { mode: "search", error: result.error.code, message: result.error.message, query }
+        };
+      }
+      return renderSearchResults(state, query, server, showSchemas, limit, offset, result.matches, result.backend);
+    });
+  }
+  let matches;
+  if (regex) {
+    let pattern;
+    try {
+      if (query.length > MAX_REGEX_SEARCH_QUERY_LENGTH) {
+        return {
+          content: [{ type: "text", text: `Regex query is too long; maximum length is ${MAX_REGEX_SEARCH_QUERY_LENGTH} characters.` }],
+          details: { mode: "search", error: "query_too_long", query, maxLength: MAX_REGEX_SEARCH_QUERY_LENGTH }
+        };
+      }
+      pattern = new RegExp(query, "i");
+      let safety;
+      try {
+        const { checkSync } = require("recheck");
+        safety = checkSync(query, "i", REGEX_SAFETY_CHECK_PARAMS);
+      } catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        return {
+          content: [{ type: "text", text: "Regex query rejected because safety analysis failed." }],
+          details: { mode: "search", error: "unsafe_pattern", query, reason }
+        };
+      }
+      if (safety.status !== "safe") {
+        return {
+          content: [{ type: "text", text: `Regex query rejected as unsafe (${safety.status}).` }],
+          details: { mode: "search", error: "unsafe_pattern", query, safetyStatus: safety.status }
+        };
+      }
+    } catch {
+      return {
+        content: [{ type: "text", text: `Invalid regex: ${query}` }],
+        details: { mode: "search", error: "invalid_pattern", query }
+      };
+    }
+    matches = [];
+    const globalPrefix = state.config.settings?.toolPrefix ?? "server";
+    for (const [serverName, metadata] of state.toolMetadata.entries()) {
+      const definition = state.config.mcpServers[serverName];
+      if (isServerDisabled(definition))
+        continue;
+      if (isServerInActiveFailureBackoff(state, serverName))
+        continue;
+      if (server && serverName !== server)
+        continue;
+      for (const tool of metadata) {
+        const matched = pattern.test(tool.name) || pattern.test(tool.description) || resolveSearchKeywords(definition, tool.originalName, serverName, globalPrefix).some((keyword) => pattern.test(keyword));
+        if (matched)
+          matches.push({ server: serverName, tool, score: 0 });
+      }
+    }
+  } else if (query.trim().length === 0) {
+    if (!server) {
+      return {
+        content: [{ type: "text", text: "Search query cannot be empty" }],
+        details: { mode: "search", error: "empty_query" }
+      };
+    }
+    matches = (state.toolMetadata.get(server) ?? []).map((tool) => ({ server, tool, score: 0 })).sort((a, b) => a.tool.name.localeCompare(b.tool.name));
+  } else {
+    matches = rankToolMatches(state, query, server);
+  }
+  return renderSearchResults(state, query, server, showSchemas, limit, offset, matches);
+}
 export function executeList(state, server) {
   const definition = state.config.mcpServers[server];
   if (!definition) {
@@ -813,11 +992,7 @@ export async function executeConnect(state, serverName, signal) {
     updateStatusBar(state);
     return executeList(state, serverName);
   } catch (error) {
-    const rawMessage = error instanceof Error ? error.message : String(error);
-    const message = formatMcpConnectionFailure(rawMessage);
-    if (message !== rawMessage) {
-      logger.debug("MCP: manual connection probe diagnostic", { server: serverName, diagnostic: rawMessage });
-    }
+    const message = error instanceof Error ? error.message : String(error);
     if (!isAbortError(error, ownedSignal))
       recordFailure(state, serverName, message);
     updateStatusBar(state);
@@ -827,7 +1002,7 @@ export async function executeConnect(state, serverName, signal) {
     };
   }
 }
-export async function executeCall(state, toolName, args, serverOverride, getPiTools, signal, origin) {
+export async function executeCall(state, toolName, args, serverOverride, getPiTools, signal, origin, internalDelivery) {
   const ownedSignal = combineAbortSignals(state.owner?.signal, signal);
   throwIfAborted(ownedSignal);
   let serverName = serverOverride;
@@ -856,10 +1031,10 @@ export async function executeCall(state, toolName, args, serverOverride, getPiTo
     };
   }
   if (serverName) {
-    const match = getServerScopedToolMatch(state.toolMetadata.get(serverName), toolName);
+    const match = getCandidateToolMatch(state.toolMetadata.get(serverName), toolName, serverName, state);
     if (match === "ambiguous")
-      return ambiguousToolResult("call", toolName);
-    toolMeta = match?.tool;
+      return ambiguousServerToolResult("call", toolName, serverName);
+    toolMeta = match;
     if (isServerDisabled(state.config.mcpServers[serverName])) {
       return disabledCallResult(serverName, toolMeta);
     }
@@ -867,53 +1042,60 @@ export async function executeCall(state, toolName, args, serverOverride, getPiTo
     const exactMatches = getEnabledToolMatches(state, toolName, true);
     if (exactMatches.length > 1)
       return ambiguousToolResult("call", toolName);
-    if (exactMatches.length === 0 && getEnabledToolMatches(state, toolName, false).length > 1) {
-      return ambiguousToolResult("call", toolName);
-    }
-    let disabledMatch;
-    for (const [server, metadata] of state.toolMetadata.entries()) {
-      const found = metadata.find((tool) => tool.name === toolName);
-      if (!found)
-        continue;
-      if (isServerDisabled(state.config.mcpServers[server])) {
-        disabledMatch ??= { serverName: server, toolMeta: found };
-        continue;
+    if (exactMatches.length === 1) {
+      serverName = exactMatches[0].server;
+      toolMeta = exactMatches[0].tool;
+    } else {
+      const originalMatches = getEnabledOriginalToolMatches(state, toolName);
+      if (originalMatches.length > 1)
+        return ambiguousToolResult("call", toolName);
+      if (originalMatches.length === 1) {
+        serverName = originalMatches[0].server;
+        toolMeta = originalMatches[0].tool;
+      } else {
+        const prefixedScope = getPrefixedServerScope(state, toolName);
+        if (prefixedScope) {
+          serverName = prefixedScope;
+          const match = getCandidateToolMatch(state.toolMetadata.get(prefixedScope), toolName, prefixedScope, state);
+          if (match === "ambiguous")
+            return ambiguousServerToolResult("call", toolName, prefixedScope);
+          toolMeta = match;
+        } else {
+          const matches = [];
+          for (const [server, metadata] of state.toolMetadata) {
+            if (isServerDisabled(state.config.mcpServers[server]))
+              continue;
+            for (const tool of getCandidateToolMatches(metadata, toolName, server, state))
+              matches.push({ server, tool });
+          }
+          if (matches.length > 1)
+            return ambiguousToolResult("call", toolName);
+          if (matches.length === 1) {
+            serverName = matches[0].server;
+            toolMeta = matches[0].tool;
+          }
+        }
       }
-      serverName = server;
-      toolMeta = found;
-      break;
     }
-    if (!toolMeta && !disabledMatch) {
-      for (const [server, metadata] of state.toolMetadata.entries()) {
-        const found = findToolByName(metadata, toolName);
-        if (!found)
+    if (!toolMeta) {
+      const disabledMatches = [];
+      for (const [server, metadata] of state.toolMetadata) {
+        if (!isServerDisabled(state.config.mcpServers[server]))
           continue;
-        if (isServerDisabled(state.config.mcpServers[server])) {
-          disabledMatch ??= { serverName: server, toolMeta: found };
-          continue;
-        }
-        serverName = server;
-        toolMeta = found;
-        break;
+        for (const tool of getCandidateToolMatches(metadata, toolName, server, state))
+          disabledMatches.push({ server, tool });
       }
+      if (disabledMatches.length === 1)
+        return disabledCallResult(disabledMatches[0].server, disabledMatches[0].tool);
     }
-    if (!toolMeta && disabledMatch)
-      return disabledCallResult(disabledMatch.serverName, disabledMatch.toolMeta);
   }
   if (serverName && !toolMeta) {
     const connected = await lazyConnect(state, serverName, ownedSignal);
     if (connected) {
-      if (serverOverride) {
-        const match = getServerScopedToolMatch(state.toolMetadata.get(serverName), toolName);
-        if (match === "ambiguous")
-          return ambiguousToolResult("call", toolName);
-        toolMeta = match?.tool;
-      } else {
-        const match = getSingleToolMatch(state.toolMetadata.get(serverName), toolName);
-        if (match === "ambiguous")
-          return ambiguousToolResult("call", toolName);
-        toolMeta = match;
-      }
+      const match = getCandidateToolMatch(state.toolMetadata.get(serverName), toolName, serverName, state);
+      if (match === "ambiguous")
+        return ambiguousServerToolResult("call", toolName, serverName);
+      toolMeta = match;
     } else {
       const needsAuthConnection = state.manager.getConnection(serverName);
       if (needsAuthConnection?.status === "needs-auth") {
@@ -931,12 +1113,12 @@ export async function executeCall(state, toolName, args, serverOverride, getPiTo
             clearFailure(state, serverName);
             const connectedAfterAuth = await lazyConnect(state, serverName, ownedSignal);
             if (connectedAfterAuth) {
-              const match = getServerScopedToolMatch(state.toolMetadata.get(serverName), toolName);
+              const match = getCandidateToolMatch(state.toolMetadata.get(serverName), toolName, serverName, state);
               if (match === "ambiguous")
-                return ambiguousToolResult("call", toolName);
-              toolMeta = match?.tool;
+                return ambiguousServerToolResult("call", toolName, serverName);
+              toolMeta = match;
               if (!toolMeta) {
-                const suggestions = rankSuggestions(state, toolName, 5);
+                const suggestions = rankSuggestions(state, toolName, 5, serverName);
                 const suggestionText = suggestions.length > 0 ? ` Did you mean: ${suggestions.join(", ")}` : "";
                 return {
                   content: [{ type: "text", text: `Tool "${toolName}" not found on "${serverName}" after reconnect.${suggestionText}` }],
@@ -1003,7 +1185,7 @@ export async function executeCall(state, toolName, args, serverOverride, getPiTo
         lazyExactMatches.push({ serverName: configuredServer, toolMeta: exactMatches[0] });
         continue;
       }
-      const fallbackMatches = getToolMatches(metadata, toolName, false);
+      const fallbackMatches = getCandidateToolMatches(metadata, toolName, configuredServer, state);
       if (fallbackMatches.length > 1)
         return ambiguousToolResult("call", toolName);
       if (fallbackMatches.length === 1)
@@ -1033,7 +1215,7 @@ export async function executeCall(state, toolName, args, serverOverride, getPiTo
     } else {
       msg += ` Use mcp({ search: "..." }) to search.`;
     }
-    const suggestions = rankSuggestions(state, toolName, 5);
+    const suggestions = rankSuggestions(state, toolName, 5, serverOverride);
     if (suggestions.length > 0)
       msg += ` Did you mean: ${suggestions.join(", ")}`;
     return {
@@ -1041,7 +1223,7 @@ export async function executeCall(state, toolName, args, serverOverride, getPiTo
       details: { mode: "call", error: "tool_not_found", requestedTool: toolName, hintServer, suggestions }
     };
   }
-  const callIdentity = toolMeta.resourceUri ? { server: serverName, resourceUri: toolMeta.resourceUri } : { server: serverName, tool: toolMeta.originalName };
+  const callIdentity = toolMeta.resourceUri ? { server: serverName, resourceUri: toolMeta.resourceUri } : { server: serverName, tool: toolMeta.originalName, canonicalTool: toolMeta.name };
   let connection = state.manager.getConnection(serverName);
   if (connection?.status === "needs-auth") {
     if (!autoAuthAttempted) {
@@ -1117,21 +1299,14 @@ export async function executeCall(state, toolName, args, serverOverride, getPiTo
         notifyToolMetadataUpdated(state, serverName, "proxy-call-reconnect");
       markKeepAliveAfterConnect(state, serverName);
       updateStatusBar(state);
-      if (serverOverride) {
-        const match = getServerScopedToolMatch(state.toolMetadata.get(serverName), toolName);
-        if (match === "ambiguous")
-          return ambiguousToolResult("call", toolName);
-        toolMeta = match?.tool;
-      } else {
-        const match = getSingleToolMatch(state.toolMetadata.get(serverName), toolName);
-        if (match === "ambiguous")
-          return ambiguousToolResult("call", toolName);
-        toolMeta = match;
-      }
+      const match = getCandidateToolMatch(state.toolMetadata.get(serverName), toolName, serverName, state);
+      if (match === "ambiguous")
+        return ambiguousServerToolResult("call", toolName, serverName);
+      toolMeta = match;
       if (!toolMeta) {
         const available = getToolNames(state, serverName);
         const hint = available.length > 0 ? `Available tools on "${serverName}": ${available.join(", ")}` : `Server "${serverName}" has no tools.`;
-        const suggestions = rankSuggestions(state, toolName, 5);
+        const suggestions = rankSuggestions(state, toolName, 5, serverName);
         const suggestionText = suggestions.length > 0 ? ` Did you mean: ${suggestions.join(", ")}` : "";
         return {
           content: [{ type: "text", text: `Tool "${toolName}" not found on "${serverName}" after reconnect. ${hint}${suggestionText}` }],
@@ -1139,11 +1314,7 @@ export async function executeCall(state, toolName, args, serverOverride, getPiTo
         };
       }
     } catch (error) {
-      const rawMessage = error instanceof Error ? error.message : String(error);
-      const message = formatMcpConnectionFailure(rawMessage);
-      if (message !== rawMessage) {
-        logger.debug("MCP: reconnect probe diagnostic", { server: serverName, diagnostic: rawMessage });
-      }
+      const message = error instanceof Error ? error.message : String(error);
       if (!isAbortError(error, ownedSignal))
         recordFailure(state, serverName, message);
       updateStatusBar(state);
@@ -1157,6 +1328,18 @@ export async function executeCall(state, toolName, args, serverOverride, getPiTo
     return disabledCallResult(serverName, toolMeta);
   }
   const normalizedArgs = toolMeta.resourceUri ? args ?? {} : normalizeToolArguments(args);
+  const validationError = toolMeta.resourceUri ? null : proxyArgumentValidationError(toolMeta.inputSchema, normalizedArgs);
+  if (validationError) {
+    const schemaText = `
+
+Expected parameters:
+${formatSchema(toolMeta.inputSchema)}`;
+    const guarded = await guardMcpOutput([{ type: "text", text: validationError }], { ...resolveMcpOutputGuardOptions(state.config.settings), prefix: "Failed to call tool: ", suffix: schemaText });
+    return {
+      content: guarded.content,
+      details: { mode: "call", error: "call_failed", ...callIdentity, message: validationError, ...guardedMcpDetails(guarded) }
+    };
+  }
   const approval = await ensureToolCallApproved(state, serverName, toolMeta, normalizedArgs, ownedSignal, origin ?? (toolMeta.resourceUri ? "resource" : "proxy"));
   if (approval.ok === false) {
     const denied = approval.reason === "denied";
@@ -1215,6 +1398,12 @@ export async function executeCall(state, toolName, args, serverOverride, getPiTo
         return conn.client.readResource({ uri: toolMeta.resourceUri }, refreshRead ? { ...requestOptions, cacheMode: "refresh" } : requestOptions);
       });
       const content = transformMcpResourceContents(result.contents ?? [], state.owner?.signal);
+      if (internalDelivery) {
+        throwIfAborted(ownedSignal);
+        internalDelivery.onSuccess(content.length > 0 ? content.filter((block) => block.type === "text").map((block) => block.text).join(`
+`) : "(empty resource)");
+        return { content: [], details: { mode: "call", ...callIdentity } };
+      }
       const guarded = await guardMcpOutput(content.length > 0 ? content : [{ type: "text", text: "(empty resource)" }], outputGuardOptions);
       return {
         content: guarded.content,
@@ -1237,6 +1426,15 @@ export async function executeCall(state, toolName, args, serverOverride, getPiTo
       onNeedsAuth: recoverAuthConnection
     }, serverName, async (conn) => {
       await state.manager.ensureListen?.(serverName, conn);
+      if (conn.taskSession) {
+        return await callToolViaTaskSession(conn.taskSession, {
+          name: toolMeta.originalName,
+          args: normalizedArgs ?? {},
+          meta: uiSession?.requestMeta,
+          signal: ownedSignal,
+          requestTimeoutMs: requestOptions?.timeout
+        });
+      }
       return abortable(conn.client.callTool({
         name: toolMeta.originalName,
         arguments: normalizedArgs,
@@ -1245,15 +1443,17 @@ export async function executeCall(state, toolName, args, serverOverride, getPiTo
     });
     if (toolMeta.uiResourceUri) {
       uiSession?.sendToolResult(result);
+    }
+    if (!result.isError && internalDelivery) {
+      throwIfAborted(ownedSignal);
+      internalDelivery.onSuccess(result);
+      return { content: [], details: { mode: "call", ...callIdentity } };
+    }
+    if (toolMeta.uiResourceUri) {
       if (result.isError) {
-        const mcpContent = result.content ?? [];
-        const content = transformMcpContent(mcpContent, state.owner?.signal);
+        const content = resolveMcpResultContent(result, state.owner?.signal);
         const outputContent = content.length > 0 ? content : [{ type: "text", text: "(empty result)" }];
-        const schemaText = toolMeta.inputSchema ? `
-
-Expected parameters:
-${formatSchema(toolMeta.inputSchema)}` : "";
-        const guarded = await guardMcpOutput(outputContent, { ...outputGuardOptions, prefix: "Error: ", suffix: schemaText, emptyTextFallback: "Tool execution failed", rawMcpResult: result });
+        const guarded = await guardMcpOutput(outputContent, { ...outputGuardOptions, prefix: "Error: ", emptyTextFallback: "Tool execution failed", rawMcpResult: result });
         return {
           content: guarded.content,
           details: { mode: "call", error: "tool_error", ...callIdentity, ...guardedMcpDetails(guarded) }
@@ -1278,14 +1478,9 @@ ${uiSummary.message}`, rawMcpResult: result });
       };
     }
     if (result.isError) {
-      const mcpContent = result.content ?? [];
-      const content = transformMcpContent(mcpContent, state.owner?.signal);
+      const content = resolveMcpResultContent(result, state.owner?.signal);
       const outputContent = content.length > 0 ? content : [{ type: "text", text: "(empty result)" }];
-      const schemaText = toolMeta.inputSchema ? `
-
-Expected parameters:
-${formatSchema(toolMeta.inputSchema)}` : "";
-      const guarded = await guardMcpOutput(outputContent, { ...outputGuardOptions, prefix: "Error: ", suffix: schemaText, emptyTextFallback: "Tool execution failed", rawMcpResult: result });
+      const guarded = await guardMcpOutput(outputContent, { ...outputGuardOptions, prefix: "Error: ", emptyTextFallback: "Tool execution failed", rawMcpResult: result });
       return {
         content: guarded.content,
         details: { mode: "call", error: "tool_error", ...callIdentity, ...guardedMcpDetails(guarded) }