@duckmind/dm-windows-x64 0.61.4 → 0.61.9

package/extensions/dm-subagents/src/runs/shared/mcp-direct-tool-allowlist.js

@@ -2,10 +2,17 @@ import { createHash } from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { findConfiguredProjectRoot } from "../../agents/agents.js";
 import { getAgentDir, getProjectConfigDir } from "../../shared/utils.js";
+import { isMcpServerDefinition, loadAgentPluginMcpServers, loadPackageMcpServers } from "./mcp-config-sources.js";
+import {
+  normalizeMcpDirectToolSelectors,
+  parseMcpDirectToolSelectors,
+  planMcpDirectToolGrant
+} from "./mcp-direct-tool-grant.js";
+export { formatUnresolvedMcpDirectToolSelectors } from "./mcp-direct-tool-grant.js";
 const CACHE_VERSION = 1;
 const CACHE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
-const BUILTIN_TOOL_NAMES = new Set(["read", "bash", "edit", "write", "grep", "find", "ls", "mcp"]);
 const GENERIC_GLOBAL_CONFIG_PATH = path.join(os.homedir(), ".config", "mcp", "mcp.json");
 const IMPORT_PATHS = {
   cursor: [path.join(os.homedir(), ".cursor", "mcp.json")],
@@ -19,18 +26,41 @@ const IMPORT_PATHS = {
   windsurf: [path.join(os.homedir(), ".windsurf", "mcp.json")],
   vscode: [".vscode/mcp.json"]
 };
-export function resolveMcpDirectToolNames(mcpDirectTools, cwd = process.cwd()) {
-  if (!mcpDirectTools?.length)
-    return [];
-  try {
-    const config = loadMcpConfig(cwd);
-    const cache = loadMetadataCache();
-    if (!cache)
-      return [];
-    return resolveDirectToolNames(config, cache, getToolPrefix(config.settings?.toolPrefix), mcpDirectTools);
-  } catch {
-    return [];
+export const MCP_RUNTIME_SNAPSHOT_EVENT = "dm-mcp-adapter:runtime-snapshot:v1";
+export const MCP_RUNTIME_SNAPSHOT_VERSION = 1;
+export function resolveMcpDirectToolResolution(mcpDirectTools, cwd = process.cwd(), runtimeSnapshotHost, configOverride) {
+  const selectors = normalizeMcpDirectToolSelectors(mcpDirectTools);
+  if (selectors.length === 0)
+    return { selections: [], unresolvedSelectors: [] };
+  const config = configOverride ?? loadMcpConfig(cwd);
+  const { servers: selectedServers, tools: selectedTools } = parseMcpDirectToolSelectors(selectors);
+  const runtimeSelectionServers = new Set([...selectedServers, ...selectedTools.keys()]);
+  const runtimeServers = resolveRuntimeMcpServers(config, runtimeSelectionServers, runtimeSnapshotHost);
+  const resolvedConfig = Object.keys(runtimeServers).length > 0 ? mergeConfigs(config, { mcpServers: runtimeServers }) : config;
+  validateSelectedServerDefinitions(resolvedConfig, selectors);
+  const cache = loadMetadataCache();
+  if (!cache)
+    return { selections: [], unresolvedSelectors: selectors };
+  const validMetadata = {};
+  for (const [serverName, definition] of Object.entries(resolvedConfig.mcpServers)) {
+    const serverCache = cache.servers[serverName];
+    if (isServerCacheValid(serverCache, definition))
+      validMetadata[serverName] = serverCache;
   }
+  const grant = planMcpDirectToolGrant({
+    selectors,
+    servers: resolvedConfig.mcpServers,
+    metadata: validMetadata,
+    toolPrefix: resolvedConfig.settings?.toolPrefix
+  });
+  return {
+    selections: grant.selections,
+    unresolvedSelectors: grant.unresolvedSelectors,
+    ...Object.keys(runtimeServers).length > 0 ? { mcpConfig: resolvedConfig, runtimeServerNames: Object.keys(runtimeServers) } : {}
+  };
+}
+export function resolveMcpDirectToolSelections(mcpDirectTools, cwd = process.cwd(), runtimeSnapshotHost) {
+  return resolveMcpDirectToolResolution(mcpDirectTools, cwd, runtimeSnapshotHost).selections;
 }
 function loadMetadataCache() {
   const cachePath = path.join(getAgentDir(), "mcp-cache.json");
@@ -40,28 +70,106 @@ function loadMetadataCache() {
   } catch {
     return null;
   }
-  if (!parsed || typeof parsed !== "object")
-    return null;
-  const raw = parsed;
-  if (raw.version !== CACHE_VERSION || !raw.servers || typeof raw.servers !== "object" || Array.isArray(raw.servers)) {
+  if (!isRecord(parsed) || parsed.version !== CACHE_VERSION || !isRecord(parsed.servers))
     return null;
+  const servers = {};
+  for (const [name, value] of Object.entries(parsed.servers)) {
+    const entry = parseServerCacheEntry(value);
+    if (entry)
+      servers[name] = entry;
+  }
+  return { version: CACHE_VERSION, servers };
+}
+function parseServerCacheEntry(value) {
+  if (!isRecord(value))
+    return;
+  if (value.configHash !== undefined && typeof value.configHash !== "string")
+    return;
+  if (value.cachedAt !== undefined && (typeof value.cachedAt !== "number" || !Number.isFinite(value.cachedAt)))
+    return;
+  if (value.tools !== undefined && !Array.isArray(value.tools))
+    return;
+  if (value.resources !== undefined && !Array.isArray(value.resources))
+    return;
+  const tools = value.tools?.map(parseCachedTool);
+  const resources = value.resources?.map(parseCachedResource);
+  if (tools && !tools.every((entry) => entry !== undefined))
+    return;
+  if (resources && !resources.every((entry) => entry !== undefined))
+    return;
+  return {
+    ...value.configHash !== undefined ? { configHash: value.configHash } : {},
+    ...value.cachedAt !== undefined ? { cachedAt: value.cachedAt } : {},
+    ...tools ? { tools } : {},
+    ...resources ? { resources } : {}
+  };
+}
+function parseCachedTool(value) {
+  if (!isRecord(value) || value.name !== undefined && typeof value.name !== "string")
+    return;
+  return value.name === undefined ? {} : { name: value.name };
+}
+function parseCachedResource(value) {
+  if (!isRecord(value))
+    return;
+  if (value.uri !== undefined && typeof value.uri !== "string")
+    return;
+  if (value.name !== undefined && typeof value.name !== "string")
+    return;
+  return {
+    ...value.uri !== undefined ? { uri: value.uri } : {},
+    ...value.name !== undefined ? { name: value.name } : {}
+  };
+}
+function resolveRuntimeMcpServers(config, selectedServers, runtimeSnapshotHost) {
+  if (!runtimeSnapshotHost)
+    return {};
+  const runtimeServers = {};
+  for (const serverName of selectedServers) {
+    if (Object.hasOwn(config.mcpServers, serverName))
+      continue;
+    try {
+      const snapshot = getRuntimeMcpServerSnapshot(runtimeSnapshotHost, serverName);
+      runtimeServers[serverName] = snapshot.definition;
+    } catch {}
   }
-  return raw;
+  return runtimeServers;
+}
+function getRuntimeMcpServerSnapshot(host, name) {
+  const request = {
+    version: MCP_RUNTIME_SNAPSHOT_VERSION,
+    name
+  };
+  host.events.emit(MCP_RUNTIME_SNAPSHOT_EVENT, request);
+  if (!request.result)
+    throw new Error("dm-mcp-adapter is not installed for this DM instance");
+  if (!request.result.ok)
+    throw request.result.error;
+  const snapshot = request.result.snapshot;
+  if (!snapshot || snapshot.name !== name || snapshot.runtime !== true || snapshot.persisted !== false || !isMcpServerDefinition(snapshot.definition)) {
+    throw new Error(`Invalid MCP runtime snapshot for server "${name}"`);
+  }
+  return snapshot;
 }
 function loadMcpConfig(cwd) {
+  const resolvedCwd = path.resolve(cwd);
+  const projectRoot = findConfiguredProjectRoot(resolvedCwd) ?? resolvedCwd;
   let config = { mcpServers: {} };
-  for (const sourcePath of getConfigPaths(cwd)) {
+  for (const sourcePath of getConfigPaths(projectRoot)) {
     const loaded = readConfig(sourcePath);
     if (!loaded)
       continue;
-    config = mergeConfigs(config, expandImports(loaded, cwd));
+    config = mergeConfigs(config, expandImports(loaded, projectRoot));
   }
-  return config;
+  const packageServers = loadPackageMcpServers(projectRoot);
+  const pluginServers = loadAgentPluginMcpServers(config.settings?.agentPluginPaths, projectRoot);
+  const packageOnlyServers = Object.fromEntries(Object.entries(packageServers).filter(([name]) => !Object.hasOwn(pluginServers, name)));
+  return mergeConfigs({ mcpServers: packageOnlyServers }, mergeConfigs({ mcpServers: pluginServers }, config));
 }
-function getConfigPaths(cwd) {
+function getConfigPaths(projectRoot) {
   const piGlobalPath = path.join(getAgentDir(), "mcp.json");
-  const projectPath = path.resolve(cwd, ".mcp.json");
-  const projectPiPath = path.resolve(getProjectConfigDir(cwd), "mcp.json");
+  const projectPath = path.resolve(projectRoot, ".mcp.json");
+  const projectPiPath = path.resolve(getProjectConfigDir(projectRoot), "mcp.json");
   const sources = [];
   if (GENERIC_GLOBAL_CONFIG_PATH !== piGlobalPath)
     sources.push(GENERIC_GLOBAL_CONFIG_PATH);
@@ -82,15 +190,32 @@ function readConfig(configPath) {
   return validateConfig(parsed);
 }
 function validateConfig(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw))
+  if (!isRecord(raw))
     return { mcpServers: {} };
   const obj = raw;
   const servers = obj.mcpServers ?? obj["mcp-servers"] ?? {};
   return {
-    mcpServers: servers && typeof servers === "object" && !Array.isArray(servers) ? servers : {},
+    mcpServers: parseServerEntries(servers),
     imports: Array.isArray(obj.imports) ? obj.imports.filter((value) => isImportKind(value)) : undefined,
-    settings: obj.settings && typeof obj.settings === "object" && !Array.isArray(obj.settings) ? obj.settings : undefined
+    settings: parseSettings(obj.settings)
+  };
+}
+function parseServerEntries(value) {
+  if (!isRecord(value))
+    return {};
+  return Object.fromEntries(Object.entries(value).filter((entry) => isMcpServerDefinition(entry[1])));
+}
+function parseSettings(value) {
+  if (!isRecord(value))
+    return;
+  const toolPrefix = value.toolPrefix === "server" || value.toolPrefix === "short" || value.toolPrefix === "none" ? value.toolPrefix : undefined;
+  const directTools = typeof value.directTools === "boolean" ? value.directTools : undefined;
+  const settings = {
+    ...toolPrefix ? { toolPrefix } : {},
+    ...directTools !== undefined ? { directTools } : {},
+    ...value.agentPluginPaths !== undefined ? { agentPluginPaths: value.agentPluginPaths } : {}
   };
+  return Object.keys(settings).length ? settings : undefined;
 }
 function mergeConfigs(base, next) {
   const imports = [...base.imports ?? [], ...next.imports ?? []];
@@ -134,74 +259,22 @@ function resolveImportPath(importKind, cwd) {
   return null;
 }
 function extractServers(config, kind) {
-  if (!config || typeof config !== "object" || Array.isArray(config))
+  if (!isRecord(config))
     return {};
   const obj = config;
   const servers = kind === "cursor" || kind === "windsurf" || kind === "vscode" ? obj.mcpServers ?? obj["mcp-servers"] : obj.mcpServers;
-  return servers && typeof servers === "object" && !Array.isArray(servers) ? servers : {};
+  return parseServerEntries(servers);
 }
-function resolveDirectToolNames(config, cache, prefix, envOverride) {
-  const names = [];
-  const seenNames = new Set;
-  const { servers: selectedServers, tools: selectedTools } = parseSelections(envOverride);
-  for (const [serverName, definition] of Object.entries(config.mcpServers)) {
-    const serverCache = cache.servers[serverName];
-    if (!isServerCacheValid(serverCache, definition))
-      continue;
-    const toolFilter = selectedServers.has(serverName) ? true : selectedTools.get(serverName);
-    if (!toolFilter)
-      continue;
-    for (const tool of Array.isArray(serverCache.tools) ? serverCache.tools : []) {
-      if (typeof tool?.name !== "string" || !tool.name)
-        continue;
-      if (toolFilter !== true && !toolFilter.has(tool.name))
-        continue;
-      if (isToolExcluded(tool.name, serverName, prefix, definition.excludeTools))
-        continue;
-      const prefixedName = formatToolName(tool.name, serverName, prefix);
-      if (BUILTIN_TOOL_NAMES.has(prefixedName) || seenNames.has(prefixedName))
-        continue;
-      seenNames.add(prefixedName);
-      names.push(prefixedName);
-    }
-    if (definition.exposeResources === false)
-      continue;
-    for (const resource of Array.isArray(serverCache.resources) ? serverCache.resources : []) {
-      if (typeof resource?.name !== "string" || !resource.name || typeof resource.uri !== "string" || !resource.uri)
-        continue;
-      const baseName = `get_${resourceNameToToolName(resource.name)}`;
-      if (toolFilter !== true && !toolFilter.has(baseName))
-        continue;
-      if (isToolExcluded(baseName, serverName, prefix, definition.excludeTools))
-        continue;
-      const prefixedName = formatToolName(baseName, serverName, prefix);
-      if (BUILTIN_TOOL_NAMES.has(prefixedName) || seenNames.has(prefixedName))
-        continue;
-      seenNames.add(prefixedName);
-      names.push(prefixedName);
-    }
-  }
-  return names;
-}
-function parseSelections(selections) {
-  const servers = new Set;
-  const tools = new Map;
-  for (let item of selections) {
-    item = item.replace(/\/+$/, "");
-    if (item.includes("/")) {
-      const [server, tool] = item.split("/", 2);
-      if (server && tool) {
-        if (!tools.has(server))
-          tools.set(server, new Set);
-        tools.get(server).add(tool);
-      } else if (server) {
-        servers.add(server);
-      }
-    } else if (item) {
-      servers.add(item);
-    }
+export function resolveMcpDirectToolNames(mcpDirectTools, cwd = process.cwd()) {
+  return resolveMcpDirectToolSelections(mcpDirectTools, cwd).map((selection) => selection.name);
+}
+function validateSelectedServerDefinitions(config, selectors) {
+  const { servers, tools } = parseMcpDirectToolSelectors(selectors);
+  for (const serverName of new Set([...servers, ...tools.keys()])) {
+    const definition = config.mcpServers[serverName];
+    if (definition)
+      computeMcpServerHash(definition);
   }
-  return { servers, tools };
 }
 function isServerCacheValid(entry, definition) {
   if (!entry || entry.configHash !== computeMcpServerHash(definition))
@@ -214,72 +287,74 @@ export function computeMcpServerHash(definition) {
   const identity = {
     command: definition.command,
     args: definition.args,
+    socket: resolveConfigPath(definition.socket),
     env: interpolateEnvRecord(definition.env),
     cwd: resolveConfigPath(definition.cwd),
-    url: definition.url,
+    url: resolveServerUrl(definition),
     headers: interpolateEnvRecord(definition.headers),
+    requestHeadersCommand: definition.requestHeadersCommand ? {
+      command: interpolateEnvVars(definition.requestHeadersCommand.command),
+      args: definition.requestHeadersCommand.args?.map(interpolateEnvVars),
+      env: interpolateEnvRecord(definition.requestHeadersCommand.env),
+      timeoutMs: definition.requestHeadersCommand.timeoutMs
+    } : undefined,
     auth: definition.auth,
     bearerToken: resolveBearerToken(definition),
     bearerTokenEnv: definition.bearerTokenEnv,
     exposeResources: definition.exposeResources,
-    excludeTools: definition.excludeTools
+    includeTools: definition.includeTools,
+    excludeTools: definition.excludeTools,
+    protocolVersion: definition.protocolVersion
   };
   return createHash("sha256").update(stableStringify(identity)).digest("hex");
 }
-function getToolPrefix(value) {
-  return value === "none" || value === "short" || value === "server" ? value : "server";
-}
 function isImportKind(value) {
   return typeof value === "string" && Object.hasOwn(IMPORT_PATHS, value);
 }
-function getServerPrefix(serverName, mode) {
-  if (mode === "none")
-    return "";
-  if (mode === "short") {
-    const short = serverName.replace(/-?mcp$/i, "").replace(/-/g, "_");
-    return short || "mcp";
-  }
-  return serverName.replace(/-/g, "_");
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function formatToolName(toolName, serverName, prefix) {
-  const serverPrefix = getServerPrefix(serverName, prefix);
-  return serverPrefix ? `${serverPrefix}_${toolName}` : toolName;
+function interpolateEnvRecord(values) {
+  if (!values)
+    return;
+  return Object.fromEntries(Object.entries(values).map(([key, value]) => [key, interpolateSecretExpression(value)]));
 }
-function isToolExcluded(toolName, serverName, prefix, excludeTools) {
-  if (!Array.isArray(excludeTools) || excludeTools.length === 0)
-    return false;
-  const candidates = new Set([
-    normalizeToolName(toolName),
-    normalizeToolName(formatToolName(toolName, serverName, prefix)),
-    normalizeToolName(formatToolName(toolName, serverName, "server")),
-    normalizeToolName(formatToolName(toolName, serverName, "short"))
-  ]);
-  return excludeTools.some((excluded) => typeof excluded === "string" && candidates.has(normalizeToolName(excluded)));
-}
-function normalizeToolName(value) {
-  return value.replace(/-/g, "_");
-}
-function resourceNameToToolName(name) {
-  let result = name.replace(/[^a-zA-Z0-9]/g, "_").replace(/_+/g, "_").replace(/^_+/, "").replace(/_+$/, "").toLowerCase();
-  if (!result || /^\d/.test(result))
-    result = `resource${result ? `_${result}` : ""}`;
-  return result;
+function interpolateEnvVars(value) {
+  return value.replace(/\$\{(\w+)\}/g, (_, name) => process.env[name] ?? "").replace(/\$env:(\w+)/g, (_, name) => process.env[name] ?? "").replace(/\{env:(\w+)\}/g, (_, name) => process.env[name] ?? "");
 }
-function interpolateEnvRecord(values) {
-  if (!values || typeof values !== "object" || Array.isArray(values))
+function interpolateSecretExpression(value) {
+  if (value.startsWith("!!"))
+    return interpolateEnvVars(value.slice(1));
+  return value.startsWith("!") ? value : interpolateEnvVars(value);
+}
+function getMissingEnvVars(value) {
+  const missing = new Set;
+  for (const match of value.matchAll(/\$\{(\w+)\}|\$env:(\w+)|\{env:(\w+)\}/g)) {
+    const name = match[1] ?? match[2] ?? match[3];
+    if (name && process.env[name] === undefined)
+      missing.add(name);
+  }
+  return [...missing];
+}
+function resolveServerUrl(definition) {
+  if (definition.url == null)
     return;
-  const resolved = {};
-  for (const [key, value] of Object.entries(values)) {
-    if (typeof value === "string")
-      resolved[key] = interpolateEnvVars(value);
+  if (typeof definition.url !== "string")
+    throw new Error("MCP server URL must be a string");
+  const missing = getMissingEnvVars(definition.url);
+  if (missing.length > 0) {
+    throw new Error(`Missing environment variable${missing.length === 1 ? "" : "s"} in MCP server URL: ${missing.join(", ")}`);
+  }
+  const resolved = interpolateEnvVars(definition.url);
+  try {
+    new URL(resolved);
+  } catch (error) {
+    throw new Error(`Invalid MCP server URL after environment interpolation: ${resolved}`, { cause: error });
   }
   return resolved;
 }
-function interpolateEnvVars(value) {
-  return value.replace(/\$\{(\w+)\}/g, (_, name) => process.env[name] ?? "").replace(/\$env:(\w+)/g, (_, name) => process.env[name] ?? "");
-}
 function resolveConfigPath(value) {
-  if (typeof value !== "string")
+  if (value === undefined)
     return;
   const resolved = interpolateEnvVars(value);
   if (resolved === "~")
@@ -289,9 +364,9 @@ function resolveConfigPath(value) {
   return resolved;
 }
 function resolveBearerToken(definition) {
-  if (typeof definition.bearerToken === "string")
-    return interpolateEnvVars(definition.bearerToken);
-  return typeof definition.bearerTokenEnv === "string" ? process.env[definition.bearerTokenEnv] : undefined;
+  if (definition.bearerToken !== undefined)
+    return interpolateSecretExpression(definition.bearerToken);
+  return definition.bearerTokenEnv ? process.env[definition.bearerTokenEnv] : undefined;
 }
 function stableStringify(value) {
   if (value === null || value === undefined || typeof value !== "object") {

package/extensions/dm-subagents/src/runs/shared/mcp-direct-tool-grant.js

@@ -0,0 +1,131 @@
+const BUILTIN_TOOL_NAMES = new Set(["read", "bash", "edit", "write", "grep", "find", "ls", "mcp"]);
+export function normalizeMcpDirectToolSelectors(selectors) {
+  return [...new Set((selectors ?? []).map((selector) => selector.replace(/\/+$/, "")).filter(Boolean))];
+}
+export function parseMcpDirectToolSelectors(selectors) {
+  const servers = new Set;
+  const tools = new Map;
+  for (const item of selectors) {
+    if (item.includes("/")) {
+      const [server, tool] = item.split("/", 2);
+      if (server && tool) {
+        if (!tools.has(server))
+          tools.set(server, new Set);
+        tools.get(server).add(tool);
+      } else if (server) {
+        servers.add(server);
+      }
+    } else if (item) {
+      servers.add(item);
+    }
+  }
+  return { servers, tools };
+}
+export function planMcpDirectToolGrant(input) {
+  const selectors = normalizeMcpDirectToolSelectors(input.selectors);
+  if (selectors.length === 0)
+    return { selections: [], unresolvedSelectors: [] };
+  const { servers: selectedServers, tools: selectedTools } = parseMcpDirectToolSelectors(selectors);
+  const selections = [];
+  const seenNames = new Set;
+  const prefix = normalizeMcpToolPrefix(input.toolPrefix);
+  for (const [serverName, server] of Object.entries(input.servers)) {
+    const metadata = input.metadata[serverName];
+    if (!metadata)
+      continue;
+    const toolFilter = selectedServers.has(serverName) ? true : selectedTools.get(serverName);
+    if (!toolFilter)
+      continue;
+    for (const tool of Array.isArray(metadata.tools) ? metadata.tools : []) {
+      if (typeof tool?.name !== "string" || !tool.name)
+        continue;
+      if (toolFilter !== true && !toolFilter.has(tool.name))
+        continue;
+      if (!isToolAllowed(tool.name, serverName, prefix, server.includeTools, server.excludeTools))
+        continue;
+      const name = formatToolName(tool.name, serverName, prefix);
+      if (BUILTIN_TOOL_NAMES.has(name) || seenNames.has(name))
+        continue;
+      seenNames.add(name);
+      selections.push({ name, selector: `${serverName}/${tool.name}` });
+    }
+    if (server.exposeResources === false)
+      continue;
+    for (const resource of Array.isArray(metadata.resources) ? metadata.resources : []) {
+      if (typeof resource?.name !== "string" || !resource.name || typeof resource.uri !== "string" || !resource.uri)
+        continue;
+      const baseName = `get_${resourceNameToToolName(resource.name)}`;
+      if (toolFilter !== true && !toolFilter.has(baseName))
+        continue;
+      if (!isToolAllowed(baseName, serverName, prefix, server.includeTools, server.excludeTools))
+        continue;
+      const name = formatToolName(baseName, serverName, prefix);
+      if (BUILTIN_TOOL_NAMES.has(name) || seenNames.has(name))
+        continue;
+      seenNames.add(name);
+      selections.push({ name, selector: `${serverName}/${baseName}` });
+    }
+  }
+  const unresolvedSelectors = selectors.filter((selector) => selector.includes("/") ? !selections.some((selection) => selection.selector === selector) : !selections.some((selection) => selection.selector.startsWith(`${selector}/`)));
+  return { selections, unresolvedSelectors };
+}
+export function normalizeMcpToolPrefix(value) {
+  return value === "none" || value === "short" || value === "server" ? value : "server";
+}
+export function formatUnresolvedMcpDirectToolSelectors(selectors) {
+  return `Unresolved MCP direct-tool selectors: ${selectors.join(", ")}. Direct MCP tools require a matching configured server and fresh metadata cache; runtime-registered servers require a host/dm-mcp-adapter handoff before child launch.`;
+}
+function getServerPrefix(serverName, mode) {
+  if (mode === "none")
+    return "";
+  if (mode === "short")
+    return serverName.replace(/-?mcp$/i, "") || "mcp";
+  return serverName;
+}
+function formatToolName(toolName, serverName, prefix) {
+  const serverPrefix = getServerPrefix(serverName, prefix);
+  return serverPrefix ? `${serverPrefix}_${toolName}` : toolName;
+}
+function isToolAllowed(toolName, serverName, prefix, includeTools, excludeTools) {
+  const candidates = toolNameCandidates(toolName, serverName, prefix);
+  return (!Array.isArray(includeTools) || includeTools.length === 0 || matchesToolPatterns(candidates, includeTools)) && !matchesToolPatterns(candidates, excludeTools);
+}
+function toolNameCandidates(toolName, serverName, prefix) {
+  return new Set([
+    toolName,
+    `mcp_${toolName}`,
+    formatToolName(toolName, serverName, prefix),
+    formatToolName(toolName, serverName, "server"),
+    formatToolName(toolName, serverName, "short"),
+    formatToolName(toolName, serverName, "none")
+  ]);
+}
+function matchesToolPatterns(candidates, patterns) {
+  if (!Array.isArray(patterns) || patterns.length === 0)
+    return false;
+  for (const pattern of patterns) {
+    if (typeof pattern !== "string")
+      continue;
+    const normalizedPattern = normalizeToolName(pattern);
+    const matcher = normalizedPattern.includes("*") || normalizedPattern.includes("?") ? globToRegExp(normalizedPattern) : undefined;
+    for (const candidate of candidates) {
+      const normalizedCandidate = normalizeToolName(candidate);
+      if (matcher ? matcher.test(normalizedCandidate) : normalizedCandidate === normalizedPattern)
+        return true;
+    }
+  }
+  return false;
+}
+function globToRegExp(pattern) {
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
+  return new RegExp(`^${escaped}$`);
+}
+function normalizeToolName(value) {
+  return value.replace(/-/g, "_");
+}
+function resourceNameToToolName(name) {
+  let result = name.replace(/[^a-zA-Z0-9]/g, "_").replace(/_+/g, "_").replace(/^_+/, "").replace(/_+$/, "").toLowerCase();
+  if (!result || /^\d/.test(result))
+    result = `resource${result ? `_${result}` : ""}`;
+  return result;
+}