@firfi/huly-mcp 0.43.0 → 0.44.1

package/dist/index.cjs

@@ -82690,7 +82690,7 @@ var require_connection2 = __commonJS({
     });
     module2.exports = __toCommonJS2(connection_exports);
     var import_analytics = require_lib3();
-    var import_client88 = __toESM2(require_lib7());
+    var import_client89 = __toESM2(require_lib7());
     var import_core105 = __toESM2(require_lib5());
     var import_platform4 = __toESM2(require_lib());
     var import_rpc = require_lib19();
@@ -82801,7 +82801,7 @@ var require_connection2 = __commonJS({
           }
           if (!this.closed) {
             void this.sendRequest({
-              method: import_client88.pingConst,
+              method: import_client89.pingConst,
               params: [],
               once: true,
               handleResult: /* @__PURE__ */ __name(async (result) => {
@@ -82834,7 +82834,7 @@ var require_connection2 = __commonJS({
         }
       }
       isConnected() {
-        return this.websocket != null && this.websocket.readyState === import_client88.ClientSocketReadyState.OPEN && this.helloReceived;
+        return this.websocket != null && this.websocket.readyState === import_client89.ClientSocketReadyState.OPEN && this.helloReceived;
       }
       delay = 0;
       onConnectHandlers = [];
@@ -82974,8 +82974,8 @@ var require_connection2 = __commonJS({
           }
           return;
         }
-        if (resp.result === import_client88.pingConst) {
-          void this.sendRequest({ method: import_client88.pingConst, params: [] }).catch((err) => {
+        if (resp.result === import_client89.pingConst) {
+          void this.sendRequest({ method: import_client89.pingConst, params: [] }).catch((err) => {
             this.ctx.error("failed to send ping", { err });
           });
           return;
@@ -83067,15 +83067,15 @@ var require_connection2 = __commonJS({
         }
       }
       checkArrayBufferPing(data) {
-        if (data.byteLength === import_client88.pingConst.length || data.byteLength === import_client88.pongConst.length) {
+        if (data.byteLength === import_client89.pingConst.length || data.byteLength === import_client89.pongConst.length) {
           const text = new TextDecoder().decode(data);
-          if (text === import_client88.pingConst) {
-            void this.sendRequest({ method: import_client88.pingConst, params: [] }).catch((err) => {
+          if (text === import_client89.pingConst) {
+            void this.sendRequest({ method: import_client89.pingConst, params: [] }).catch((err) => {
               this.ctx.error("failed to send ping", { err });
             });
             return true;
           }
-          if (text === import_client88.pongConst) {
+          if (text === import_client89.pongConst) {
             this.pingResponse = Date.now();
             return true;
           }
@@ -83085,7 +83085,7 @@ var require_connection2 = __commonJS({
       openConnection(ctx, socketId) {
         this.binaryMode = false;
         this.helloReceived = false;
-        const clientSocketFactory = this.opt?.socketFactory ?? (0, import_platform4.getMetadata)(import_client88.default.metadata.ClientSocketFactory) ?? ((url4) => {
+        const clientSocketFactory = this.opt?.socketFactory ?? (0, import_platform4.getMetadata)(import_client89.default.metadata.ClientSocketFactory) ?? ((url4) => {
           const s = new WebSocket(url4);
           return s;
         });
@@ -83120,12 +83120,12 @@ var require_connection2 = __commonJS({
           if (this.websocket !== wsocket) {
             return;
           }
-          if (event.data === import_client88.pongConst) {
+          if (event.data === import_client89.pongConst) {
             this.pingResponse = Date.now();
             return;
           }
-          if (event.data === import_client88.pingConst) {
-            void this.sendRequest({ method: import_client88.pingConst, params: [] }).catch((err) => {
+          if (event.data === import_client89.pingConst) {
+            void this.sendRequest({ method: import_client89.pingConst, params: [] }).catch((err) => {
               this.ctx.error("failed to send ping", { err });
             });
             return;
@@ -83190,8 +83190,8 @@ var require_connection2 = __commonJS({
           if (this.websocket !== wsocket) {
             return;
           }
-          const useBinary = this.opt?.useBinaryProtocol ?? (0, import_platform4.getMetadata)(import_client88.default.metadata.UseBinaryProtocol) ?? true;
-          this.compressionMode = this.opt?.useProtocolCompression ?? (0, import_platform4.getMetadata)(import_client88.default.metadata.UseProtocolCompression) ?? false;
+          const useBinary = this.opt?.useBinaryProtocol ?? (0, import_platform4.getMetadata)(import_client89.default.metadata.UseBinaryProtocol) ?? true;
+          this.compressionMode = this.opt?.useProtocolCompression ?? (0, import_platform4.getMetadata)(import_client89.default.metadata.UseProtocolCompression) ?? false;
           const helloRequest = {
             method: "hello",
             params: [],
@@ -83237,13 +83237,13 @@ var require_connection2 = __commonJS({
             if (w instanceof Promise) {
               await w;
             }
-            if (data.method !== import_client88.pingConst) {
+            if (data.method !== import_client89.pingConst) {
               this.requests.set(id, promise4);
             }
             promise4.sendData = () => {
-              if (this.websocket?.readyState === import_client88.ClientSocketReadyState.OPEN) {
+              if (this.websocket?.readyState === import_client89.ClientSocketReadyState.OPEN) {
                 promise4.startTime = Date.now();
-                if (data.method !== import_client88.pingConst) {
+                if (data.method !== import_client89.pingConst) {
                   const dta = this.rpcHandler.serialize(
                     {
                       method: data.method,
@@ -83256,7 +83256,7 @@ var require_connection2 = __commonJS({
                   );
                   this.websocket?.send(dta);
                 } else {
-                  this.websocket?.send(import_client88.pingConst);
+                  this.websocket?.send(import_client89.pingConst);
                 }
               }
             };
@@ -83270,7 +83270,7 @@ var require_connection2 = __commonJS({
               };
             }
             promise4.sendData();
-            if (data.method !== import_client88.pingConst) {
+            if (data.method !== import_client89.pingConst) {
               return await promise4.promise;
             }
           },
@@ -83436,7 +83436,7 @@ var require_lib20 = __commonJS({
       default: () => index_default
     });
     module2.exports = __toCommonJS2(index_exports2);
-    var import_client88 = __toESM2(require_lib7());
+    var import_client89 = __toESM2(require_lib7());
     var import_core105 = __toESM2(require_lib5());
     var import_platform4 = __toESM2(require_lib());
     var import_connection = require_connection2();
@@ -83480,8 +83480,8 @@ var require_lib20 = __commonJS({
       return {
         function: {
           GetClient: /* @__PURE__ */ __name(async (token, endpoint, opt) => {
-            const filterModel = (0, import_platform4.getMetadata)(import_client88.default.metadata.FilterModel) ?? "none";
-            const extraFilter = (0, import_platform4.getMetadata)(import_client88.default.metadata.ExtraFilter) ?? [];
+            const filterModel = (0, import_platform4.getMetadata)(import_client89.default.metadata.FilterModel) ?? "none";
+            const extraFilter = (0, import_platform4.getMetadata)(import_client89.default.metadata.ExtraFilter) ?? [];
             const handler = /* @__PURE__ */ __name(async (handler2) => {
               const url4 = (0, import_core105.concatLink)(endpoint, `/${token}`);
               const upgradeHandler = /* @__PURE__ */ __name((...txes) => {
@@ -83509,7 +83509,7 @@ var require_lib20 = __commonJS({
                 throw new Error("Workspace or account not found in token");
               }
               const newOpt = { ...opt };
-              const connectTimeout = opt?.connectionTimeout ?? (0, import_platform4.getMetadata)(import_client88.default.metadata.ConnectionTimeout);
+              const connectTimeout = opt?.connectionTimeout ?? (0, import_platform4.getMetadata)(import_client89.default.metadata.ConnectionTimeout);
               let connectPromise;
               if ((connectTimeout ?? 0) > 0) {
                 connectPromise = new Promise((resolve2, reject) => {
@@ -83561,7 +83561,7 @@ var require_lib20 = __commonJS({
     function returnUITxes(txes, extraFilter) {
       const configs = /* @__PURE__ */ new Map();
       (0, import_core105.fillConfiguration)(txes, configs);
-      const allowedPlugins = [...(0, import_platform4.getPlugins)(), ...(0, import_platform4.getMetadata)(import_client88.default.metadata.ExtraPlugins) ?? []];
+      const allowedPlugins = [...(0, import_platform4.getPlugins)(), ...(0, import_platform4.getMetadata)(import_client89.default.metadata.ExtraPlugins) ?? []];
       const excludedPlugins = Array.from(configs.values()).filter(
         (it) => !it.enabled || !allowedPlugins.includes(it.pluginId) || extraFilter.includes(it.pluginId)
       );
@@ -83609,7 +83609,7 @@ var require_lib20 = __commonJS({
     }
     __name(returnClientTxes, "returnClientTxes");
     function createModelPersistence(workspace2) {
-      const overrideStore = (0, import_platform4.getMetadata)(import_client88.default.metadata.OverridePersistenceStore);
+      const overrideStore = (0, import_platform4.getMetadata)(import_client89.default.metadata.OverridePersistenceStore);
       if (overrideStore !== void 0) {
         return overrideStore;
       }
@@ -83706,7 +83706,7 @@ var require_client6 = __commonJS({
     });
     module2.exports = __toCommonJS2(client_exports);
     var import_account_client2 = require_lib6();
-    var import_client88 = __toESM2(require_lib7());
+    var import_client89 = __toESM2(require_lib7());
     var import_core105 = require_lib5();
     var import_platform4 = require_lib();
     var import_config10 = require_config();
@@ -83732,9 +83732,9 @@ var require_client6 = __commonJS({
     }
     __name(connect, "connect");
     async function createClient(url4, endpoint, token, workspaceUuid, account, config3, options) {
-      (0, import_platform4.addLocation)(import_client88.clientId, () => Promise.resolve().then(() => __toESM(require_lib20())));
+      (0, import_platform4.addLocation)(import_client89.clientId, () => Promise.resolve().then(() => __toESM(require_lib20())));
       const { socketFactory, connectionTimeout } = options;
-      const clientFactory = await (0, import_platform4.getResource)(import_client88.default.function.GetClient);
+      const clientFactory = await (0, import_platform4.getResource)(import_client89.default.function.GetClient);
       const connection = await clientFactory(token, endpoint, {
         socketFactory,
         connectionTimeout
@@ -84855,11 +84855,11 @@ var require_storage2 = __commonJS({
     var __toCommonJS2 = (mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod);
     var storage_exports = {};
     __export2(storage_exports, {
-      connectStorage: () => import_client88.connectStorage,
-      createStorageClient: () => import_client88.createStorageClient
+      connectStorage: () => import_client89.connectStorage,
+      createStorageClient: () => import_client89.createStorageClient
     });
     module2.exports = __toCommonJS2(storage_exports);
-    var import_client88 = require_client7();
+    var import_client89 = require_client7();
     __reExport2(storage_exports, require_error3(), module2.exports);
     __reExport2(storage_exports, require_types8(), module2.exports);
   }
@@ -116881,10 +116881,10 @@ var require_code3 = __commonJS({
       return schemaMap ? Object.keys(schemaMap).filter((p) => p !== "__proto__") : [];
     }
     exports2.allSchemaProperties = allSchemaProperties;
-    function schemaProperties(it, schemaMap) {
+    function schemaProperties2(it, schemaMap) {
       return allSchemaProperties(schemaMap).filter((p) => !(0, util_1.alwaysValidSchema)(it, schemaMap[p]));
     }
-    exports2.schemaProperties = schemaProperties;
+    exports2.schemaProperties = schemaProperties2;
     function callValidateCode({ schemaCode, data, it: { gen: gen6, topSchemaRef, schemaPath, errorPath }, it }, func2, context6, passSchema) {
       const dataAndSchema = passSchema ? (0, codegen_1._)`${schemaCode}, ${data}, ${topSchemaRef}${schemaPath}` : data;
       const valCxt = [
@@ -158122,6 +158122,16 @@ var InvalidStatusError = class extends Schema_exports.TaggedError()(
     return `Invalid status '${this.status}' for project '${this.project}'`;
   }
 };
+var IssueReferenceError = class extends Schema_exports.TaggedError()(
+  "IssueReferenceError",
+  {
+    reason: Schema_exports.String
+  }
+) {
+  get message() {
+    return `Invalid issue references: ${this.reason}`;
+  }
+};
 var CommentNotFoundError = class extends Schema_exports.TaggedError()(
   "CommentNotFoundError",
   {
@@ -158263,6 +158273,7 @@ var HulyDomainError = Schema_exports.Union(
   ViewletNotFoundError,
   ViewletIdentifierAmbiguousError,
   IssueNotFoundError,
+  IssueReferenceError,
   ProjectNotFoundError,
   InvalidStatusError,
   ContactChannelConflictError,
@@ -169336,6 +169347,7 @@ var createErrorResponse = (text, errorCode, errorTag, warnings = []) => {
 };
 var INVALID_PARAMS_TAGS = /* @__PURE__ */ new Set([
   "IssueNotFoundError",
+  "IssueReferenceError",
   "ApprovalRequestNotFoundError",
   "ApprovalRequestTargetNotFoundError",
   "ApprovalRequestInvalidApprovalThresholdError",
@@ -171243,6 +171255,38 @@ var ToolsetsContextSchema = Schema_exports.Struct({
   totalRegisteredToolCount: Count,
   builtinTools: Schema_exports.Array(Schema_exports.Literal("get_version", "get_huly_context"))
 });
+var ToolScopeContextSchema = Schema_exports.Struct({
+  active: Schema_exports.Boolean,
+  requestedToolsets: Schema_exports.Array(NonEmptyTrimmedString2),
+  enabledToolsets: Schema_exports.Array(NonEmptyTrimmedString2),
+  ignoredToolsets: Schema_exports.Array(NonEmptyTrimmedString2),
+  requestedTools: Schema_exports.Array(NonEmptyTrimmedString2),
+  enabledTools: Schema_exports.Array(NonEmptyTrimmedString2),
+  ignoredTools: Schema_exports.Array(NonEmptyTrimmedString2),
+  availableCategories: Schema_exports.Array(NonEmptyTrimmedString2),
+  visibleRegisteredToolCount: Count,
+  totalRegisteredToolCount: Count,
+  builtinTools: Schema_exports.Array(Schema_exports.Literal("get_version", "get_huly_context"))
+});
+var ToolExposureContextSchema = Schema_exports.Struct({
+  configuredMode: Schema_exports.Literal("auto", "native", "proxy"),
+  resolvedMode: Schema_exports.Literal("native", "proxy"),
+  clientKind: Schema_exports.Literal(
+    "claude-code",
+    "claude-ai",
+    "cursor",
+    "windsurf",
+    "github-copilot",
+    "codex",
+    "opencode",
+    "unknown"
+  ),
+  proxyOutputStrict: Schema_exports.Boolean,
+  visibleToolCount: Count,
+  nativeVisibleToolCount: Count,
+  proxyCandidateToolCount: Count,
+  proxyToolNames: Schema_exports.Array(NonEmptyTrimmedString2)
+});
 var GetHulyContextResultSchema = Schema_exports.Struct({
   package: Schema_exports.Struct({
     name: Schema_exports.Literal("@firfi/huly-mcp"),
@@ -171258,7 +171302,9 @@ var GetHulyContextResultSchema = Schema_exports.Struct({
   huly: HulyRuntimeContextSchema,
   auth: AuthContextSchema,
   configSources: ConfigSourcesSchema,
-  toolsets: ToolsetsContextSchema
+  toolsets: ToolsetsContextSchema,
+  toolScope: ToolScopeContextSchema,
+  toolExposure: ToolExposureContextSchema
 });
 var getHulyContextResultJsonSchema = JSONSchema_exports.make(GetHulyContextResultSchema);
 
@@ -172816,7 +172862,7 @@ var CreateIssueParamsSchema = Schema_exports.Struct({
     description: "Issue title"
   }),
   description: Schema_exports.optional(Schema_exports.String.annotations({
-    description: "Issue description (markdown supported)"
+    description: "Issue description in markdown. Markdown links to current-workspace Huly browse URLs with _class, _id, and label become native Huly references. External URLs and other-workspace browse URLs stay normal links."
   })),
   priority: Schema_exports.optional(IssuePrioritySchema.annotations({
     description: "Issue priority (urgent, high, medium, low, no-priority)"
@@ -172865,7 +172911,9 @@ var UpdateIssueParamsSchema = Schema_exports.Struct({
   title: Schema_exports.optional(NonEmptyString2.annotations({
     description: "New issue title"
   })),
-  description: Schema_exports.optional(clearableText("New issue description (markdown supported).")),
+  description: Schema_exports.optional(clearableText(
+    "New issue description in markdown. Markdown links to current-workspace Huly browse URLs with _class, _id, and label become native Huly references. External URLs and other-workspace browse URLs stay normal links."
+  )),
   priority: Schema_exports.optional(IssuePrioritySchema.annotations({
     description: "New issue priority"
   })),
@@ -181591,25 +181639,8 @@ var parseUpdateDriveFileCommentParams = Schema_exports.decodeUnknown(UpdateDrive
 var parseDeleteDriveFileCommentParams = Schema_exports.decodeUnknown(DeleteDriveFileCommentParamsSchema);
 var parseListDriveFileActivityParams = Schema_exports.decodeUnknown(ListDriveFileActivityParamsSchema);
 
-// src/huly/diagnostics.ts
-var Diagnostics = class extends Context_exports.Tag("@hulymcp/Diagnostics")() {
-};
-var warningLogText = (warning) => `Agent-visible tool warning [${warning.code}]: ${warning.message}`;
-var makeDiagnosticsScope = Effect_exports.gen(function* () {
-  const warningsRef = yield* Ref_exports.make([]);
-  return {
-    service: {
-      warnAgent: (warning) => Ref_exports.update(warningsRef, (warnings) => [...warnings, warning]).pipe(
-        Effect_exports.zipRight(Effect_exports.logWarning(warningLogText(warning)))
-      ),
-      trail: (message) => Effect_exports.logInfo(`Diagnostic trail: ${message}`)
-    },
-    drainWarnings: Ref_exports.get(warningsRef)
-  };
-});
-
 // src/version.ts
-var VERSION = true ? "0.43.0" : "0.0.0-dev";
+var VERSION = true ? "0.44.1" : "0.0.0-dev";
 
 // src/mcp/json-schema-refs.ts
 var isJsonObject = (value3) => typeof value3 === "object" && value3 !== null && !Array.isArray(value3);
@@ -181630,6 +181661,25 @@ var collectJsonSchemaDefinitions = (value3) => {
   return mergeDefinitionRecords([...nestedDefinitions, ownDefinitions]);
 };
 var omitJsonSchemaDocumentMetadata = (schema) => Object.fromEntries(Object.entries(schema).filter(([key]) => key !== "$defs" && key !== "$schema"));
+var EFFECT_PSEUDO_ID_PREFIX = "/schemas/";
+var isCollidingSchemaId = (key, value3) => key === "$id" && typeof value3 === "string" && value3.startsWith(EFFECT_PSEUDO_ID_PREFIX);
+var stripCollidingSchemaIds = (value3) => {
+  if (Array.isArray(value3)) return value3.map(stripCollidingSchemaIds);
+  if (!isJsonObject(value3)) return value3;
+  return Object.fromEntries(
+    Object.entries(value3).filter(([key, nested6]) => !isCollidingSchemaId(key, nested6)).map(([key, nested6]) => [key, stripCollidingSchemaIds(nested6)])
+  );
+};
+var stripCollidingSchemaIdsRecord = (record4) => {
+  const stripped = stripCollidingSchemaIds(record4);
+  return isJsonObject(stripped) ? stripped : record4;
+};
+var stripCollidingSchemaIdsProperties = (properties) => Object.fromEntries(
+  Object.entries(properties).map(([key, value3]) => {
+    const stripped = stripCollidingSchemaIds(value3);
+    return [key, isJsonObject(stripped) ? stripped : value3];
+  })
+);
 
 // src/mcp/tool-output-schema.ts
 var toolWarningCodeEnum = [...ToolWarningCodeSchema.literals];
@@ -181669,6 +181719,70 @@ var wrapResultOutputSchema = (resultSchema) => {
 var createToolOutputSchema = (resultSchema) => wrapResultOutputSchema(JSONSchema_exports.make(resultSchema));
 var hulyContextToolOutputSchema = wrapResultOutputSchema(getHulyContextResultJsonSchema);
 
+// src/mcp/tool-scope.ts
+var normalizeCsv = (raw) => {
+  const normalized = raw.split(",").map((part) => part.trim().toLowerCase()).filter((part) => part !== "");
+  return [...new Set(normalized)];
+};
+var orderedCategories = (definitions) => [...new Set(definitions.map((definition) => definition.category))];
+var knownValueMap = (values4) => new Map(values4.map((value3) => [value3, value3]));
+var resolveRequested = (requested, known, unknownMessage, writeError2) => requested.reduce((acc, name) => {
+  const knownValue = known.get(name);
+  if (knownValue !== void 0) {
+    return {
+      ...acc,
+      enabled: [...acc.enabled, knownValue]
+    };
+  }
+  writeError2(unknownMessage(name));
+  return {
+    ...acc,
+    ignored: [...acc.ignored, name]
+  };
+}, {
+  enabled: [],
+  ignored: []
+});
+var resolveToolScope = (rawEnv, definitions, writeError2) => {
+  const requestedToolsets = normalizeCsv(rawEnv.toolsets);
+  const requestedTools = normalizeCsv(rawEnv.tools);
+  const availableCategories = orderedCategories(definitions);
+  const knownCategories = knownValueMap(availableCategories);
+  const knownToolNames = knownValueMap(definitions.map((definition) => definition.name));
+  const toolsets = resolveRequested(
+    requestedToolsets,
+    knownCategories,
+    (category) => `Warning: unknown toolset category "${category}", ignoring. Valid categories: ${availableCategories.join(", ")}`,
+    writeError2
+  );
+  const tools = resolveRequested(
+    requestedTools,
+    knownToolNames,
+    (tool) => `Warning: unknown tool name "${tool}", ignoring.`,
+    writeError2
+  );
+  const filteringActive = requestedToolsets.length > 0 || requestedTools.length > 0;
+  const enabledCategories = new Set(toolsets.enabled);
+  const enabledToolNames = new Set(tools.enabled);
+  const visibleRegisteredToolCount = filteringActive ? definitions.filter(
+    (definition) => enabledCategories.has(definition.category) || enabledToolNames.has(definition.name)
+  ).length : definitions.length;
+  return {
+    filteringActive,
+    requestedToolsets,
+    enabledToolsets: toolsets.enabled,
+    ignoredToolsets: toolsets.ignored,
+    requestedTools,
+    enabledTools: tools.enabled,
+    ignoredTools: tools.ignored,
+    enabledCategories,
+    enabledToolNames,
+    availableCategories,
+    visibleRegisteredToolCount,
+    totalRegisteredToolCount: definitions.length
+  };
+};
+
 // src/huly/operations/activity-messages.ts
 var import_core11 = __toESM(require_lib5(), 1);
 
@@ -182886,17 +183000,30 @@ var listDirectMessages = (params) => Effect_exports.gen(function* () {
 var import_core19 = __toESM(require_lib5(), 1);
 var import_rank = __toESM(require_lib37(), 1);
 
-// src/huly/operations/document-native-references.ts
+// src/huly/operations/native-reference-markup.ts
 var malformedReferenceList = (entries2) => entries2.map((entry) => `'${entry}'`).join(", ");
+var renderMarkdownWithNativeReferencesForWrite = (content, urls, fieldName) => {
+  const rendered = markdownToMarkupStringWithHulyLinks(content, urls);
+  if (rendered.malformedReferences.length > 0) {
+    return {
+      _tag: "malformed",
+      reason: `malformed Huly native reference links in ${fieldName}: ${malformedReferenceList(rendered.malformedReferences)}`
+    };
+  }
+  return {
+    _tag: "success",
+    rendered: { markup: rendered.markup, format: "markup" }
+  };
+};
+
+// src/huly/operations/document-native-references.ts
 var renderDocumentContentForWrite = (content) => Effect_exports.gen(function* () {
   const client = yield* HulyClient;
-  const rendered = markdownToMarkupStringWithHulyLinks(content, client.markupUrlConfig);
-  if (rendered.malformedReferences.length > 0) {
-    return yield* new DocumentReferenceError({
-      reason: `malformed Huly native reference links in content: ${malformedReferenceList(rendered.malformedReferences)}`
-    });
+  const rendered = renderMarkdownWithNativeReferencesForWrite(content, client.markupUrlConfig, "content");
+  if (rendered._tag === "malformed") {
+    return yield* new DocumentReferenceError({ reason: rendered.reason });
   }
-  return { markup: rendered.markup, format: "markup" };
+  return rendered.rendered;
 });
 
 // src/huly/operations/documents-shared.ts
@@ -183410,6 +183537,25 @@ var deleteDocument = (params) => Effect_exports.gen(function* () {
 
 // src/huly/operations/issues-shared.ts
 var import_tracker = __toESM(require_lib41(), 1);
+
+// src/huly/diagnostics.ts
+var Diagnostics = class extends Context_exports.Tag("@hulymcp/Diagnostics")() {
+};
+var warningLogText = (warning) => `Agent-visible tool warning [${warning.code}]: ${warning.message}`;
+var makeDiagnosticsScope = Effect_exports.gen(function* () {
+  const warningsRef = yield* Ref_exports.make([]);
+  return {
+    service: {
+      warnAgent: (warning) => Ref_exports.update(warningsRef, (warnings) => [...warnings, warning]).pipe(
+        Effect_exports.zipRight(Effect_exports.logWarning(warningLogText(warning)))
+      ),
+      trail: (message) => Effect_exports.logInfo(`Diagnostic trail: ${message}`)
+    },
+    drainWarnings: Ref_exports.get(warningsRef)
+  };
+});
+
+// src/huly/operations/issues-shared.ts
 var zeroAsUnset = (value3) => value3 > 0 ? PositiveNumber.make(value3) : void 0;
 var findProject = (projectIdentifier) => Effect_exports.gen(function* () {
   const client = yield* HulyClient;
@@ -183795,6 +183941,36 @@ var listMentions = (params) => Effect_exports.gen(function* () {
 });
 
 // src/mcp/tools/registry.ts
+var ToolName = Schema_exports.NonEmptyTrimmedString.pipe(Schema_exports.brand("ToolName")).annotations({
+  identifier: "ToolName",
+  title: "ToolName",
+  description: "Exact MCP tool name registered by this server."
+});
+var ToolDescription = Schema_exports.NonEmptyTrimmedString.pipe(Schema_exports.brand("ToolDescription")).annotations({
+  identifier: "ToolDescription",
+  title: "ToolDescription",
+  description: "Human-readable MCP tool description."
+});
+var ToolCategory = Schema_exports.NonEmptyTrimmedString.pipe(Schema_exports.brand("ToolCategory")).annotations({
+  identifier: "ToolCategory",
+  title: "ToolCategory",
+  description: "MCP tool category used for toolset filtering and proxy discovery."
+});
+var makeToolName = (value3) => ToolName.make(value3);
+var makeToolDescription = (value3) => ToolDescription.make(value3);
+var makeToolCategory = (value3) => ToolCategory.make(value3);
+var parseToolName = (input) => {
+  const decoded = Schema_exports.decodeUnknownEither(ToolName)(input);
+  return Either_exports.isRight(decoded) ? decoded.right : void 0;
+};
+var createToolDefinition = (spec) => ({
+  name: makeToolName(spec.name),
+  description: makeToolDescription(spec.description),
+  inputSchema: spec.inputSchema,
+  outputSchema: spec.outputSchema,
+  category: makeToolCategory(spec.category),
+  ...spec.annotations === void 0 ? {} : { annotations: spec.annotations }
+});
 var deriveTitle = (name) => name.split("_").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
 var READ_PREFIXES = ["list_", "get_", "describe_", "search_", "fulltext_", "download_", "preview_"];
 var CREATE_PREFIXES = ["create_", "add_", "upload_", "send_", "log_"];
@@ -183864,7 +184040,7 @@ var isEmptyStructUnionSchema = (schema) => {
 var requiresArgumentsObject = (tool) => isToolInputSchema(tool.inputSchema) && (hasRequiredFields(tool.inputSchema) || unionVariants(tool.inputSchema).some(hasRequiredFields));
 var isNoArgumentTool = (tool) => isToolInputSchema(tool.inputSchema) && !requiresArgumentsObject(tool) && (!hasDeclaredProperties(tool.inputSchema) && tool.inputSchema.additionalProperties === false || isEmptyStructUnionSchema(tool.inputSchema));
 var encodeOutput = (schema, result) => Schema_exports.encodeUnknownSync(schema)(result);
-var stripResultSchema = (spec) => ({
+var stripResultSchema = (spec) => createToolDefinition({
   name: spec.name,
   description: spec.description,
   inputSchema: spec.inputSchema,
@@ -196563,6 +196739,16 @@ var getIssue = (params) => Effect_exports.gen(function* () {
   );
 });
 
+// src/huly/operations/issue-native-references.ts
+var renderIssueDescriptionForWrite = (description) => Effect_exports.gen(function* () {
+  const client = yield* HulyClient;
+  const rendered = renderMarkdownWithNativeReferencesForWrite(description, client.markupUrlConfig, "description");
+  if (rendered._tag === "malformed") {
+    return yield* new IssueReferenceError({ reason: rendered.reason });
+  }
+  return rendered.rendered;
+});
+
 // src/huly/operations/issues-write-shared.ts
 var resolveAssignee = (client, assigneeIdentifier) => Effect_exports.gen(function* () {
   const person = yield* findPersonByEmailOrName(client, assigneeIdentifier);
@@ -196654,24 +196840,32 @@ var updateIssue = (params) => Effect_exports.gen(function* () {
     params.project
   );
   const descriptionUpdatedInPlace = params.description !== void 0 && textContentOrClear(params.description) !== void 0 && Boolean(issue2.description);
+  const descriptionUpdateEntry = (operations) => coveredUpdateEntry("description", operations);
   const updateEntries = {
     title: Effect_exports.succeed(coveredUpdateEntry("title", params.title === void 0 ? {} : { title: params.title })),
     description: Effect_exports.gen(function* () {
-      if (params.description === void 0) return coveredUpdateEntry("description", {});
+      if (params.description === void 0) return descriptionUpdateEntry({});
       const description = textContentOrClear(params.description);
-      if (description === void 0) return coveredUpdateEntry("description", { description: null });
+      if (description === void 0) return descriptionUpdateEntry({ description: null });
+      const renderedDescription = yield* renderIssueDescriptionForWrite(description);
       if (issue2.description) {
-        yield* client.updateMarkup(tracker.class.Issue, issue2._id, "description", description, "markdown");
-        return coveredUpdateEntry("description", {});
+        yield* client.updateMarkup(
+          tracker.class.Issue,
+          issue2._id,
+          "description",
+          renderedDescription.markup,
+          renderedDescription.format
+        );
+        return descriptionUpdateEntry({});
       }
       const descriptionMarkupRef = yield* client.uploadMarkup(
         tracker.class.Issue,
         issue2._id,
         "description",
-        description,
-        "markdown"
+        renderedDescription.markup,
+        renderedDescription.format
       );
-      return coveredUpdateEntry("description", { description: descriptionMarkupRef });
+      return descriptionUpdateEntry({ description: descriptionMarkupRef });
     }),
     priority: Effect_exports.succeed(
       coveredUpdateEntry(
@@ -196752,6 +196946,7 @@ var createIssue = (params) => Effect_exports.gen(function* () {
   const taskTypeStatusRef = taskTypeWorkflow === void 0 ? void 0 : yield* chooseStatusForTaskType(taskTypeWorkflow, params.status, void 0, params.project);
   const statusRef = taskTypeStatusRef !== void 0 ? taskTypeStatusRef : params.status !== void 0 ? yield* resolveStatusByName(statuses, params.status, params.project) : defaultStatusId !== void 0 ? defaultStatusId : yield* Effect_exports.fail(new InvalidStatusError({ status: "(default)", project: params.project }));
   const assigneeRef = params.assignee !== void 0 ? (yield* resolveAssignee(client, params.assignee))._id : null;
+  const renderedDescription = params.description !== void 0 && params.description.trim() !== "" ? yield* renderIssueDescriptionForWrite(params.description) : void 0;
   const parentIssueParam = params.parentIssue;
   const { attachedTo, attachedToClass, collection, parents } = parentIssueParam !== void 0 ? yield* Effect_exports.gen(function* () {
     const parentIssue = yield* findIssueInProject(client, project3, parentIssueParam);
@@ -196790,13 +196985,13 @@ var createIssue = (params) => Effect_exports.gen(function* () {
     { sort: { rank: import_core60.SortingOrder.Descending } }
   );
   const rank = (0, import_rank5.makeRank)(lastIssue?.rank, void 0);
-  const descriptionMarkupRef = params.description !== void 0 && params.description.trim() !== "" ? yield* client.uploadMarkup(
+  const descriptionMarkupRef = renderedDescription === void 0 ? null : yield* client.uploadMarkup(
     tracker.class.Issue,
     issueId,
     "description",
-    params.description,
-    "markdown"
-  ) : null;
+    renderedDescription.markup,
+    renderedDescription.format
+  );
   const priority = stringToPriority(params.priority ?? DEFAULT_ISSUE_PRIORITY);
   const identifier2 = `${project3.identifier}-${sequence}`;
   const issueData = {
@@ -197482,7 +197677,7 @@ var issueTools = [
   defineTool(
     {
       name: "create_issue",
-      description: "Create a new issue in a Huly project. Optionally set taskType by ID or display name; it is resolved within the target project's project type, and status is validated against that task type's workflow. Use list_task_types or get_project_type to discover valid task types and statuses. Optionally create as a sub-issue by specifying parentIssue. Description supports markdown formatting. Returns the created issue identifier.",
+      description: "Create a new issue in a Huly project. Optionally set taskType by ID or display name; it is resolved within the target project's project type, and status is validated against that task type's workflow. Use list_task_types or get_project_type to discover valid task types and statuses. Optionally create as a sub-issue by specifying parentIssue. Description supports markdown formatting; markdown links to current-workspace Huly browse URLs with _class, _id, and label become native references, while external URLs stay normal links. Returns the created issue identifier.",
       category: CATEGORY21,
       inputSchema: createIssueParamsJsonSchema,
       resultSchema: CreateIssueResultSchema
@@ -197493,7 +197688,7 @@ var issueTools = [
   defineTool(
     {
       name: "update_issue",
-      description: "Update fields on an existing Huly issue. Optionally set taskType by ID or display name; it is resolved within the target project's project type, and the status is preserved only when valid for the new task type. Use list_task_types or get_project_type to discover valid task types and statuses. Only provided fields are modified. Description updates support markdown.",
+      description: "Update fields on an existing Huly issue. Optionally set taskType by ID or display name; it is resolved within the target project's project type, and the status is preserved only when valid for the new task type. Use list_task_types or get_project_type to discover valid task types and statuses. Only provided fields are modified. Description updates support markdown; markdown links to current-workspace Huly browse URLs with _class, _id, and label become native references, while external URLs stay normal links.",
       category: CATEGORY21,
       inputSchema: updateIssueParamsJsonSchema,
       resultSchema: UpdateIssueResultSchema
@@ -207218,14 +207413,20 @@ var buildRegistry = (tools) => {
     }
   };
 };
-var createFilteredRegistry = (categories) => buildRegistry(allTools.filter((t) => categories.has(t.category)));
 var toolRegistry = buildRegistry(allTools);
+var createScopedRegistry = (scope5) => {
+  if (!scope5.filteringActive) return toolRegistry;
+  return buildRegistry(
+    allTools.filter((t) => scope5.categories.has(t.category) || scope5.toolNames.has(t.name))
+  );
+};
 var TOOL_DEFINITIONS = Object.fromEntries(toolRegistry.tools);
 
 // src/mcp/huly-context-tool.ts
 var NPM_PACKAGE_NAME = "@firfi/huly-mcp";
-var VERSION_TOOL_NAME = "get_version";
-var GET_HULY_CONTEXT_TOOL_NAME = "get_huly_context";
+var BUILTIN_TOOL_NAME_LITERALS = ["get_version", "get_huly_context"];
+var VERSION_TOOL_NAME = makeToolName(BUILTIN_TOOL_NAME_LITERALS[0]);
+var GET_HULY_CONTEXT_TOOL_NAME = makeToolName(BUILTIN_TOOL_NAME_LITERALS[1]);
 var emptyInputSchema = { type: "object", properties: {}, additionalProperties: false };
 var VersionToolResultSchema = Schema_exports.Struct({
   current: NonEmptyString2,
@@ -207233,7 +207434,9 @@ var VersionToolResultSchema = Schema_exports.Struct({
 });
 var versionToolDefinition = {
   name: VERSION_TOOL_NAME,
-  description: "Returns the current version of this Huly MCP server and the latest version available on npm.",
+  description: makeToolDescription(
+    "Returns the current version of this Huly MCP server and the latest version available on npm."
+  ),
   inputSchema: emptyInputSchema,
   outputSchema: createToolOutputSchema(VersionToolResultSchema),
   annotations: {
@@ -207246,7 +207449,9 @@ var versionToolDefinition = {
 };
 var getHulyContextToolDefinition = {
   name: GET_HULY_CONTEXT_TOOL_NAME,
-  description: "Returns sanitized runtime and configuration context for this Huly MCP session, including package version, transport, auth mode, Huly URL origin/host, workspace, timeout, and toolset filtering. Does not connect to Huly. Secret values such as tokens, passwords, and credential headers are never returned.",
+  description: makeToolDescription(
+    "Returns sanitized runtime and configuration context for this Huly MCP session, including package version, transport, auth mode, Huly URL origin/host, workspace, timeout, native tool scope filtering, and resolved native/proxy tool exposure. Does not connect to Huly. Secret values such as tokens, passwords, and credential headers are never returned."
+  ),
   inputSchema: emptyInputSchema,
   outputSchema: hulyContextToolOutputSchema,
   annotations: {
@@ -207257,104 +207462,73 @@ var getHulyContextToolDefinition = {
     openWorldHint: false
   }
 };
-var parseToolsets = (raw, writeError2) => {
-  if (raw === void 0 || raw.trim() === "") {
-    return {
-      enabledCategories: void 0,
-      requestedCategories: [],
-      ignoredCategories: []
-    };
-  }
-  const requested = raw.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
-  const parsed = requested.reduce((acc, category) => {
-    if (CATEGORY_NAMES.has(category)) {
-      return {
-        ...acc,
-        enabledCategories: [...acc.enabledCategories, category]
-      };
-    }
-    writeError2(
-      `Warning: unknown toolset category "${category}", ignoring. Valid categories: ${[...CATEGORY_NAMES].join(", ")}`
-    );
-    return {
-      ...acc,
-      ignoredCategories: [...acc.ignoredCategories, category]
-    };
-  }, {
-    enabledCategories: [],
-    ignoredCategories: []
-  });
-  const enabled2 = new Set(parsed.enabledCategories);
-  return {
-    enabledCategories: enabled2.size > 0 ? enabled2 : void 0,
-    requestedCategories: requested,
-    ignoredCategories: parsed.ignoredCategories
-  };
-};
-var builtinToolNames = [VERSION_TOOL_NAME, GET_HULY_CONTEXT_TOOL_NAME];
+var builtinToolNames = BUILTIN_TOOL_NAME_LITERALS;
 var nonEmptyOrDefault = (value3, fallback) => {
   const trimmed2 = value3?.trim();
   return trimmed2 === void 0 || trimmed2 === "" ? fallback : trimmed2;
 };
-var buildHulyContext = (config3, registry2, toolsetSummary, runtimeConfig) => ({
-  package: {
-    name: NPM_PACKAGE_NAME,
-    version: nonEmptyOrDefault(VERSION, "0.0.0-dev")
-  },
-  transport: {
-    type: config3.transport,
-    ...config3.transport === "http" ? {
-      http: {
-        host: nonEmptyOrDefault(config3.httpHost, "127.0.0.1"),
-        port: config3.httpPort ?? DEFAULT_HTTP_PORT
-      }
-    } : {}
-  },
-  huly: runtimeConfig.huly,
-  auth: runtimeConfig.auth,
-  configSources: runtimeConfig.configSources,
-  toolsets: {
-    filteringActive: toolsetSummary.enabledCategories !== void 0,
-    requestedCategories: toolsetSummary.requestedCategories,
-    enabledCategories: toolsetSummary.enabledCategories === void 0 ? [] : [...toolsetSummary.enabledCategories],
-    ignoredCategories: toolsetSummary.ignoredCategories,
-    availableCategories: [...CATEGORY_NAMES],
-    visibleRegisteredToolCount: Count.make(registry2.definitions.length),
-    totalRegisteredToolCount: Count.make(toolRegistry.definitions.length),
-    builtinTools: builtinToolNames
-  }
-});
-
-// src/mcp/input-schema-compat.ts
-var ROOT_COMPOSITION_KEYS = /* @__PURE__ */ new Set(["anyOf", "oneOf", "allOf"]);
-var isRecord3 = (value3) => typeof value3 === "object" && value3 !== null && !Array.isArray(value3);
-var mergeObjectFields = (sources) => {
-  const merged = sources.reduce(
-    (acc, source) => isRecord3(source) ? { ...source, ...acc } : acc,
-    {}
-  );
-  return Object.keys(merged).length > 0 ? merged : void 0;
-};
-var rootCompositionBranches = (schema) => [...ROOT_COMPOSITION_KEYS].flatMap((key) => {
-  const branches = Reflect.get(schema, key);
-  return Array.isArray(branches) ? branches.filter(isRecord3) : [];
-});
-var schemaAndCompositionDescendants = (schema) => [
-  schema,
-  ...rootCompositionBranches(schema).flatMap(schemaAndCompositionDescendants)
-];
-var mergedSchemaField = (schema, field) => mergeObjectFields(schemaAndCompositionDescendants(schema).map((branch) => Reflect.get(branch, field)));
-var toClientCompatibleInputSchema = (schema) => {
-  const rootFields = Object.fromEntries(
-    Object.entries(schema).filter(([key]) => key !== "type" && !ROOT_COMPOSITION_KEYS.has(key))
-  );
-  const properties = mergedSchemaField(schema, "properties");
-  const defs = collectJsonSchemaDefinitions(schema);
+var defaultToolExposureContext = (registry2) => ({
+  configuredMode: "auto",
+  resolvedMode: "native",
+  clientKind: "unknown",
+  proxyOutputStrict: false,
+  visibleToolCount: builtinToolNames.length + registry2.definitions.length,
+  nativeVisibleToolCount: registry2.definitions.length,
+  proxyCandidateToolCount: toolRegistry.definitions.length,
+  proxyToolNames: []
+});
+var buildHulyContext = (config3, registry2, toolScope, runtimeConfig, exposureContext = defaultToolExposureContext(registry2)) => {
+  const toolExposure = {
+    configuredMode: exposureContext.configuredMode,
+    resolvedMode: exposureContext.resolvedMode,
+    clientKind: exposureContext.clientKind,
+    proxyOutputStrict: exposureContext.proxyOutputStrict,
+    visibleToolCount: Count.make(exposureContext.visibleToolCount),
+    nativeVisibleToolCount: Count.make(exposureContext.nativeVisibleToolCount),
+    proxyCandidateToolCount: Count.make(exposureContext.proxyCandidateToolCount),
+    proxyToolNames: exposureContext.proxyToolNames
+  };
   return {
-    ...rootFields,
-    type: "object",
-    ...properties === void 0 ? {} : { properties },
-    ...defs === void 0 ? {} : { $defs: defs }
+    package: {
+      name: NPM_PACKAGE_NAME,
+      version: nonEmptyOrDefault(VERSION, "0.0.0-dev")
+    },
+    transport: {
+      type: config3.transport,
+      ...config3.transport === "http" ? {
+        http: {
+          host: nonEmptyOrDefault(config3.httpHost, "127.0.0.1"),
+          port: config3.httpPort ?? DEFAULT_HTTP_PORT
+        }
+      } : {}
+    },
+    huly: runtimeConfig.huly,
+    auth: runtimeConfig.auth,
+    configSources: runtimeConfig.configSources,
+    toolsets: {
+      filteringActive: toolScope.filteringActive,
+      requestedCategories: toolScope.requestedToolsets,
+      enabledCategories: toolScope.enabledToolsets,
+      ignoredCategories: toolScope.ignoredToolsets,
+      availableCategories: toolScope.availableCategories,
+      visibleRegisteredToolCount: Count.make(registry2.definitions.length),
+      totalRegisteredToolCount: Count.make(toolScope.totalRegisteredToolCount),
+      builtinTools: builtinToolNames
+    },
+    toolScope: {
+      active: toolScope.filteringActive,
+      requestedToolsets: toolScope.requestedToolsets,
+      enabledToolsets: toolScope.enabledToolsets,
+      ignoredToolsets: toolScope.ignoredToolsets,
+      requestedTools: toolScope.requestedTools,
+      enabledTools: toolScope.enabledTools,
+      ignoredTools: toolScope.ignoredTools,
+      availableCategories: toolScope.availableCategories,
+      visibleRegisteredToolCount: Count.make(registry2.definitions.length),
+      totalRegisteredToolCount: Count.make(toolScope.totalRegisteredToolCount),
+      builtinTools: builtinToolNames
+    },
+    toolExposure
   };
 };
 
@@ -207617,12 +207791,7 @@ var readHulyResource = (uri) => Effect_exports.try({
   Effect_exports.flatMap(readParsedHulyResource)
 );
 
-// src/mcp/protocol-handlers.ts
-var DRAIN_POLL_MS = 50;
-var DRAIN_TIMEOUT_MS2 = 3e4;
-var NPM_FETCH_TIMEOUT_MS = 5e3;
-var NPM_PACKAGE_NAME2 = "@firfi/huly-mcp";
-var computeOutputBytes = (response) => response.content.reduce((sum2, c) => sum2 + c.text.length, 0);
+// src/mcp/protocol-resource-handlers.ts
 var withResourceWarnings = (result, warnings) => warnings.length === 0 ? result : {
   ...result,
   _meta: {
@@ -207630,6 +207799,777 @@ var withResourceWarnings = (result, warnings) => warnings.length === 0 ? result
     warnings
   }
 };
+var createResourceClientResolutionError = (uri, _error) => new McpError(
+  ErrorCode.InternalError,
+  `Failed to initialize Huly clients while reading resource "${uri}". Verify Huly URL, workspace, and authentication configuration.`
+);
+var createResourceListClientResolutionError = (_error) => new McpError(
+  ErrorCode.InternalError,
+  "Failed to initialize Huly clients while listing resources. Verify Huly URL, workspace, and authentication configuration."
+);
+var isConfigValidationFailure = (error2) => {
+  if (error2 instanceof ConfigValidationError) return true;
+  if (!Runtime_exports.isFiberFailure(error2)) return false;
+  return Chunk_exports.toArray(Cause_exports.failures(error2[Runtime_exports.FiberFailureCauseId])).some(
+    (failure) => failure instanceof ConfigValidationError
+  );
+};
+var resolveResourceClientsOrThrow = async (resolveClients, mapError7) => {
+  try {
+    return await resolveClients();
+  } catch (e) {
+    throw mapError7(e);
+  }
+};
+var throwResourceReadError = (uri, cause3) => {
+  const failures3 = Chunk_exports.toArray(Cause_exports.failures(cause3));
+  const failure = failures3[0];
+  if (failure instanceof McpError) throw failure;
+  throw new McpError(ErrorCode.InternalError, `Failed to read Huly resource "${uri}"`);
+};
+var throwResourceListError = (cause3) => {
+  const failures3 = Chunk_exports.toArray(Cause_exports.failures(cause3));
+  const failure = failures3[0];
+  if (failure instanceof McpError) throw failure;
+  throw new McpError(ErrorCode.InternalError, "Failed to list Huly resources");
+};
+var createResourceProtocolHandlers = (input) => {
+  const listResourcesHandler = async () => {
+    input.enter();
+    try {
+      let clients;
+      try {
+        clients = await input.resolveClients();
+      } catch (e) {
+        if (isConfigValidationFailure(e)) return { resources: [] };
+        throw createResourceListClientResolutionError(e);
+      }
+      const resourceList = await Effect_exports.runPromiseExit(
+        listResources().pipe(
+          Effect_exports.provideService(HulyClient, clients.hulyClient)
+        )
+      );
+      if (Exit_exports.isSuccess(resourceList)) return resourceList.value;
+      return throwResourceListError(resourceList.cause);
+    } finally {
+      input.leave();
+    }
+  };
+  const readResource = async (request3) => {
+    input.enter();
+    try {
+      const { uri } = request3.params;
+      const clients = await resolveResourceClientsOrThrow(
+        input.resolveClients,
+        (error2) => createResourceClientResolutionError(uri, error2)
+      );
+      const diagnosticsScope = await Effect_exports.runPromise(makeDiagnosticsScope);
+      const resourceRead = await Effect_exports.runPromiseExit(
+        readHulyResource(uri).pipe(
+          Effect_exports.provideService(HulyClient, clients.hulyClient),
+          Effect_exports.provideService(Diagnostics, diagnosticsScope.service)
+        )
+      );
+      const warnings = await Effect_exports.runPromise(diagnosticsScope.drainWarnings);
+      if (Exit_exports.isSuccess(resourceRead)) return withResourceWarnings(resourceRead.value, warnings);
+      return throwResourceReadError(uri, resourceRead.cause);
+    } finally {
+      input.leave();
+    }
+  };
+  return {
+    listResources: listResourcesHandler,
+    readResource
+  };
+};
+
+// src/mcp/input-schema-compat.ts
+var ROOT_COMPOSITION_KEYS = /* @__PURE__ */ new Set(["anyOf", "oneOf", "allOf"]);
+var isRecord3 = (value3) => typeof value3 === "object" && value3 !== null && !Array.isArray(value3);
+var mergeObjectFields = (sources) => {
+  const merged = sources.reduce(
+    (acc, source) => isRecord3(source) ? { ...source, ...acc } : acc,
+    {}
+  );
+  return Object.keys(merged).length > 0 ? merged : void 0;
+};
+var rootCompositionBranches = (schema) => [...ROOT_COMPOSITION_KEYS].flatMap((key) => {
+  const branches = Reflect.get(schema, key);
+  return Array.isArray(branches) ? branches.filter(isRecord3) : [];
+});
+var schemaAndCompositionDescendants = (schema) => [
+  schema,
+  ...rootCompositionBranches(schema).flatMap(schemaAndCompositionDescendants)
+];
+var mergedSchemaField = (schema, field) => mergeObjectFields(schemaAndCompositionDescendants(schema).map((branch) => Reflect.get(branch, field)));
+var toClientCompatibleInputSchema = (schema) => {
+  const rootFields = Object.fromEntries(
+    Object.entries(schema).filter(([key]) => key !== "type" && !ROOT_COMPOSITION_KEYS.has(key))
+  );
+  const properties = mergedSchemaField(schema, "properties");
+  const defs = collectJsonSchemaDefinitions(schema);
+  return {
+    ...rootFields,
+    type: "object",
+    ...properties === void 0 ? {} : { properties },
+    ...defs === void 0 ? {} : { $defs: defs }
+  };
+};
+
+// src/mcp/proxy-tool-catalog.ts
+var SEARCH_DEFAULT_LIMIT = 10;
+var SEARCH_MAX_LIMIT = 50;
+var ToolSearchQuery = Schema_exports.NonEmptyTrimmedString.pipe(Schema_exports.brand("ToolSearchQuery"));
+var ToolParameterName = Schema_exports.NonEmptyTrimmedString.pipe(Schema_exports.brand("ToolParameterName"));
+var SearchToolLimit = Schema_exports.Number.pipe(
+  Schema_exports.int(),
+  Schema_exports.positive(),
+  Schema_exports.lessThanOrEqualTo(SEARCH_MAX_LIMIT),
+  Schema_exports.brand("SearchToolLimit")
+);
+var makeSearchToolLimit = (value3) => SearchToolLimit.make(value3);
+var SEARCH_DEFAULT_LIMIT_VALUE = makeSearchToolLimit(SEARCH_DEFAULT_LIMIT);
+var isRecord4 = (value3) => typeof value3 === "object" && value3 !== null && !Array.isArray(value3);
+var stringArray = (value3) => Array.isArray(value3) && value3.every((item) => typeof item === "string") ? value3 : [];
+var parseToolParameterName = (value3) => {
+  const decoded = Schema_exports.decodeUnknownEither(ToolParameterName)(value3);
+  return Either_exports.isRight(decoded) ? decoded.right : void 0;
+};
+var schemaProperties = (schema) => {
+  const properties = isRecord4(schema) ? schema.properties : void 0;
+  return isRecord4(properties) ? Object.keys(properties).map(parseToolParameterName).filter((name) => name !== void 0) : [];
+};
+var schemaRequired = (schema) => isRecord4(schema) ? stringArray(schema.required) : [];
+var toolParamSummary = (tool) => {
+  const required4 = new Set(schemaRequired(tool.inputSchema));
+  const properties = schemaProperties(tool.inputSchema);
+  return {
+    requiredParams: properties.filter((name) => required4.has(name)),
+    optionalParams: properties.filter((name) => !required4.has(name))
+  };
+};
+var categoryDescriptionEntry = (category, description) => [
+  makeToolCategory(category),
+  makeToolDescription(description)
+];
+var CATEGORY_DESCRIPTIONS = new Map([
+  categoryDescriptionEntry(
+    "projects",
+    "Project discovery, project metadata, project target preferences, and project-level settings."
+  ),
+  categoryDescriptionEntry(
+    "issues",
+    "Issue tracking: create, read, update, move, delete, relate, label, and organize Huly issues."
+  ),
+  categoryDescriptionEntry("labels", "Issue and workspace labels for classification and filtering."),
+  categoryDescriptionEntry("tags", "Generic tags that can be created, updated, attached, detached, and listed."),
+  categoryDescriptionEntry("tag-categories", "Tag category administration and tag grouping metadata."),
+  categoryDescriptionEntry(
+    "templates",
+    "Issue and message templates, including template fields, categories, children, and rendering."
+  ),
+  categoryDescriptionEntry("comments", "Comments and discussion content attached to Huly objects."),
+  categoryDescriptionEntry(
+    "collaborators",
+    "Collaborator discovery and participation metadata for documents and other shared objects."
+  ),
+  categoryDescriptionEntry("milestones", "Issue milestone lifecycle and milestone assignment."),
+  categoryDescriptionEntry(
+    "documents",
+    "Teamspaces and documents: create, read, edit, snapshot, inline comment, and delete document content."
+  ),
+  categoryDescriptionEntry(
+    "drive",
+    "Drive spaces, folders, files, versions, comments, and drive membership administration."
+  ),
+  categoryDescriptionEntry(
+    "associations",
+    "Generic associations and relations between Huly documents, issues, cards, and raw objects."
+  ),
+  categoryDescriptionEntry(
+    "inventory",
+    "Inventory products, categories, variants, product media, comments, and attachments."
+  ),
+  categoryDescriptionEntry(
+    "spaces",
+    "Generic Huly spaces, space types, space permissions, members, owners, roles, and preferences."
+  ),
+  categoryDescriptionEntry(
+    "sdk-discovery",
+    "SDK and model discovery helpers for Huly platform classes, attributes, mixins, and enums."
+  ),
+  categoryDescriptionEntry("storage", "Storage diagnostics and storage-backed object helpers."),
+  categoryDescriptionEntry(
+    "attachments",
+    "Issue, document, and generic attachment upload, download, pinning, updating, and deletion."
+  ),
+  categoryDescriptionEntry(
+    "contacts",
+    "People, employees, organizations, contact channels, channel providers, and contact ownership."
+  ),
+  categoryDescriptionEntry(
+    "channels",
+    "Messaging: channels, direct messages, group messages, thread replies, reactions, and saved messages."
+  ),
+  categoryDescriptionEntry(
+    "boards",
+    "Board administration, board labels, board cards, board views, menus, and archive workflows."
+  ),
+  categoryDescriptionEntry("views", "Saved and filtered views across boards and other view-capable Huly modules."),
+  categoryDescriptionEntry("cards", "Generic cards, card spaces, card relations, master tags, and card metadata."),
+  categoryDescriptionEntry("leads", "CRM funnels and leads discovery."),
+  categoryDescriptionEntry(
+    "recruiting",
+    "Recruiting vacancies, applicants, reviews, opinions, candidate skills, and recruiting media."
+  ),
+  categoryDescriptionEntry("custom-fields", "Custom field definitions and custom field values on Huly documents."),
+  categoryDescriptionEntry(
+    "calendar",
+    "Calendar events, recurring events, schedules, meeting rooms, and availability."
+  ),
+  categoryDescriptionEntry(
+    "time tracking",
+    "Time tracking, work logs, time reports, detailed time summaries, and estimates."
+  ),
+  categoryDescriptionEntry("planner", "Planner todos, schedules, work slots, priorities, and completion workflows."),
+  categoryDescriptionEntry(
+    "preferences",
+    "User and project preferences, notification preferences, and preference diagnostics."
+  ),
+  categoryDescriptionEntry(
+    "approvals",
+    "Approval request lifecycle, approval comments, approve/reject/cancel actions, and approval status."
+  ),
+  categoryDescriptionEntry("search", "Workspace-wide full-text and structured search across Huly content."),
+  categoryDescriptionEntry("activity", "Activity timelines and activity messages for Huly objects."),
+  categoryDescriptionEntry(
+    "notifications",
+    "Inbox notifications, notification counts, read state, and notification actions."
+  ),
+  categoryDescriptionEntry("user-statuses", "User status and online/presence status discovery."),
+  categoryDescriptionEntry("virtual-office", "Virtual office rooms, members, presence, and office room state."),
+  categoryDescriptionEntry(
+    "processes",
+    "Huly process definitions, executions, process cards, and process state transitions."
+  ),
+  categoryDescriptionEntry(
+    "workspace",
+    "Workspace metadata, members, settings, access links, invites, and administrative context."
+  ),
+  categoryDescriptionEntry(
+    "task-management",
+    "Task management project types, task types, issue statuses, workflow references, and process setup."
+  ),
+  categoryDescriptionEntry(
+    "test-management",
+    "Test management projects, suites, cases, plans, runs, results, and plan execution."
+  )
+]);
+var categoryDescription = (category) => CATEGORY_DESCRIPTIONS.get(category) ?? ToolDescription.make(`Huly ${category} tools.`);
+var listCategories = (registry2) => {
+  const counts = /* @__PURE__ */ new Map();
+  for (const tool of registry2.definitions) {
+    counts.set(tool.category, (counts.get(tool.category) ?? 0) + 1);
+  }
+  return createSuccessResponse({
+    categories: [...counts.entries()].map(([name, toolCount]) => ({
+      name,
+      description: categoryDescription(name),
+      toolCount: Count.make(toolCount)
+    }))
+  });
+};
+var queryTokens = (query) => query.toLowerCase().split(/[^a-z0-9]+/u).filter((token) => token !== "");
+var tokenHitCount = (tokens, text) => {
+  const lower = text.toLowerCase();
+  return tokens.filter((token) => lower.includes(token)).length;
+};
+var toolScore = (tool, tokens, normalizedQuery) => {
+  const params = toolParamSummary(tool);
+  const paramText = [...params.requiredParams, ...params.optionalParams].join(" ");
+  const categoryText = `${tool.category} ${categoryDescription(tool.category)}`;
+  const exactScore = tool.name.toLowerCase() === normalizedQuery ? 1e4 : 0;
+  return exactScore + tokenHitCount(tokens, tool.name) * 1e3 + tokenHitCount(tokens, categoryText) * 100 + tokenHitCount(tokens, tool.description) * 10 + tokenHitCount(tokens, paramText);
+};
+var searchToolDefinitions = (registry2, query, limit = SEARCH_DEFAULT_LIMIT_VALUE) => {
+  const normalizedQuery = query.trim().toLowerCase();
+  const tokens = queryTokens(normalizedQuery);
+  if (tokens.length === 0) return [];
+  return registry2.definitions.map((tool, index) => ({ index, score: toolScore(tool, tokens, normalizedQuery), tool })).filter((match16) => match16.score > 0).sort((a, b) => b.score - a.score || a.index - b.index).slice(0, limit).map((match16) => match16.tool);
+};
+
+// src/mcp/proxy-tools.ts
+var LIST_TOOL_CATEGORIES_TOOL_NAME = ToolName.make("list_tool_categories");
+var SEARCH_TOOLS_TOOL_NAME = ToolName.make("search_tools");
+var GET_TOOL_SCHEMA_TOOL_NAME = ToolName.make("get_tool_schema");
+var INVOKE_TOOL_TOOL_NAME = ToolName.make("invoke_tool");
+var PROXY_TOOL_CATEGORY = makeToolCategory("proxy");
+var PROXY_TOOL_NAMES = [
+  LIST_TOOL_CATEGORIES_TOOL_NAME,
+  SEARCH_TOOLS_TOOL_NAME,
+  GET_TOOL_SCHEMA_TOOL_NAME,
+  INVOKE_TOOL_TOOL_NAME
+];
+var EmptyProxyParamsSchema = Schema_exports.Record({ key: Schema_exports.String, value: Schema_exports.Never });
+var SearchToolsParamsSchema = Schema_exports.Struct({
+  query: ToolSearchQuery,
+  limit: Schema_exports.optionalWith(SearchToolLimit, { exact: true })
+});
+var ToolNameParamsSchema = Schema_exports.Struct({
+  toolName: ToolName
+});
+var InvokeToolParamsSchema = Schema_exports.Struct({
+  toolName: ToolName,
+  arguments: Schema_exports.optionalWith(Schema_exports.Unknown, { exact: true })
+});
+var ProxyToolCategorySchema = Schema_exports.Struct({
+  name: ToolCategory,
+  description: ToolDescription,
+  toolCount: Count
+});
+var ListToolCategoriesResultSchema = Schema_exports.Struct({
+  categories: Schema_exports.Array(ProxyToolCategorySchema)
+});
+var ToolSearchMatchSchema = Schema_exports.Struct({
+  name: ToolName,
+  category: ToolCategory,
+  description: ToolDescription,
+  requiredParams: Schema_exports.Array(ToolParameterName),
+  optionalParams: Schema_exports.Array(ToolParameterName)
+});
+var SearchToolsResultSchema = Schema_exports.Struct({
+  matches: Schema_exports.Array(ToolSearchMatchSchema)
+});
+var ToolAnnotationsSchema2 = Schema_exports.Struct({
+  title: Schema_exports.optionalWith(Schema_exports.NonEmptyTrimmedString, { exact: true }),
+  readOnlyHint: Schema_exports.optionalWith(Schema_exports.Boolean, { exact: true }),
+  destructiveHint: Schema_exports.optionalWith(Schema_exports.Boolean, { exact: true }),
+  idempotentHint: Schema_exports.optionalWith(Schema_exports.Boolean, { exact: true }),
+  openWorldHint: Schema_exports.optionalWith(Schema_exports.Boolean, { exact: true })
+});
+var GetToolSchemaResultSchema = Schema_exports.Struct({
+  name: ToolName,
+  category: ToolCategory,
+  description: ToolDescription,
+  inputSchema: Schema_exports.Unknown,
+  outputSchema: Schema_exports.Unknown,
+  annotations: ToolAnnotationsSchema2
+});
+var InvokeToolResultSchema = Schema_exports.Struct({
+  toolName: ToolName,
+  result: Schema_exports.Unknown,
+  warnings: Schema_exports.optionalWith(Schema_exports.Array(Schema_exports.Unknown), { exact: true })
+});
+var emptyInputSchema2 = {
+  type: "object",
+  properties: {},
+  additionalProperties: false
+};
+var searchToolsInputSchema = {
+  type: "object",
+  properties: {
+    query: {
+      type: "string",
+      minLength: 1,
+      description: "Search text matched against Huly tool names, categories, descriptions, and parameter names."
+    },
+    limit: {
+      type: "integer",
+      minimum: 1,
+      maximum: SEARCH_MAX_LIMIT,
+      description: "Maximum number of matches to return. Defaults to 10 and cannot exceed 50."
+    }
+  },
+  required: ["query"],
+  additionalProperties: false
+};
+var toolNameInputSchema = {
+  type: "object",
+  properties: {
+    toolName: {
+      type: "string",
+      minLength: 1,
+      description: "Exact Huly tool name from search_tools or list_tool_categories results."
+    }
+  },
+  required: ["toolName"],
+  additionalProperties: false
+};
+var invokeToolInputSchema = {
+  type: "object",
+  properties: {
+    toolName: {
+      type: "string",
+      minLength: 1,
+      description: "Exact Huly tool name to invoke through the proxy."
+    },
+    arguments: {
+      description: "Arguments object for the target Huly tool. Use {} when the target tool accepts no parameters."
+    }
+  },
+  required: ["toolName"],
+  additionalProperties: false
+};
+var readOnlyProxyAnnotations = (title) => ({
+  title,
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: false
+});
+var proxyToolDefinitions = [
+  createToolDefinition({
+    name: LIST_TOOL_CATEGORIES_TOOL_NAME,
+    description: "Lists Huly tool categories available through this proxy. Use this first when you need a broad map of capabilities before searching for a specific Huly tool.",
+    inputSchema: emptyInputSchema2,
+    outputSchema: createToolOutputSchema(ListToolCategoriesResultSchema),
+    category: PROXY_TOOL_CATEGORY,
+    annotations: readOnlyProxyAnnotations("List Tool Categories")
+  }),
+  createToolDefinition({
+    name: SEARCH_TOOLS_TOOL_NAME,
+    description: "Searches the current proxy-visible Huly tool catalog by tool name, category, description, and parameter names. Returns exact tool names plus required and optional parameter names for single-call follow-up with get_tool_schema or invoke_tool.",
+    inputSchema: searchToolsInputSchema,
+    outputSchema: createToolOutputSchema(SearchToolsResultSchema),
+    category: PROXY_TOOL_CATEGORY,
+    annotations: readOnlyProxyAnnotations("Search Tools")
+  }),
+  createToolDefinition({
+    name: GET_TOOL_SCHEMA_TOOL_NAME,
+    description: "Returns the exact input and output schema for one proxy-visible Huly tool. Use this before invoke_tool when you are not certain about required argument names or result shape.",
+    inputSchema: toolNameInputSchema,
+    outputSchema: createToolOutputSchema(GetToolSchemaResultSchema),
+    category: PROXY_TOOL_CATEGORY,
+    annotations: readOnlyProxyAnnotations("Get Tool Schema")
+  }),
+  createToolDefinition({
+    name: INVOKE_TOOL_TOOL_NAME,
+    description: "Invokes one proxy-visible Huly tool by exact name with its arguments. This tool can call read or write Huly operations; check get_tool_schema and the target tool annotations when safety matters.",
+    inputSchema: invokeToolInputSchema,
+    outputSchema: createToolOutputSchema(InvokeToolResultSchema),
+    category: PROXY_TOOL_CATEGORY,
+    annotations: {
+      title: "Invoke Tool",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: false
+    }
+  })
+];
+var isProxyToolName = (name) => PROXY_TOOL_NAMES.some((toolName) => toolName === name);
+var decodeOrError = (schema, input, toolName) => {
+  const decoded = Schema_exports.decodeUnknownEither(schema)(input ?? {});
+  if (Either_exports.isRight(decoded)) return decoded.right;
+  return mapParseErrorToMcp(decoded.left, toolName);
+};
+var isRecord5 = (value3) => typeof value3 === "object" && value3 !== null && !Array.isArray(value3);
+var isMcpToolResponse = (value3) => isRecord5(value3) && Array.isArray(value3.content);
+var searchTools2 = (registry2, args2) => {
+  const params = decodeOrError(SearchToolsParamsSchema, args2, SEARCH_TOOLS_TOOL_NAME);
+  if (isMcpToolResponse(params)) return params;
+  const limit = params.limit ?? SEARCH_DEFAULT_LIMIT_VALUE;
+  const matches = searchToolDefinitions(registry2, params.query, limit).map((tool) => {
+    const paramSummary = toolParamSummary(tool);
+    return {
+      name: tool.name,
+      category: tool.category,
+      description: tool.description,
+      requiredParams: paramSummary.requiredParams,
+      optionalParams: paramSummary.optionalParams
+    };
+  });
+  return createSuccessResponse({ matches });
+};
+var getToolSchema = (registry2, args2) => {
+  const params = decodeOrError(ToolNameParamsSchema, args2, GET_TOOL_SCHEMA_TOOL_NAME);
+  if (isMcpToolResponse(params)) return params;
+  const tool = registry2.tools.get(params.toolName);
+  if (tool === void 0) return createUnknownToolError(params.toolName);
+  return createSuccessResponse({
+    name: tool.name,
+    category: tool.category,
+    description: tool.description,
+    inputSchema: tool.inputSchema,
+    outputSchema: tool.outputSchema,
+    annotations: resolveAnnotations(tool)
+  });
+};
+var invokeTool = async (registry2, args2, clients) => {
+  const params = decodeOrError(InvokeToolParamsSchema, args2, INVOKE_TOOL_TOOL_NAME);
+  if (isMcpToolResponse(params)) return params;
+  if (!registry2.tools.has(params.toolName)) return createUnknownToolError(params.toolName);
+  const response = await registry2.handleToolCall(
+    params.toolName,
+    params.arguments,
+    clients.hulyClient,
+    clients.storageClient,
+    clients.workspaceClient
+  );
+  if (response === null) return createUnknownToolError(params.toolName);
+  if (response.isError === true) return response;
+  const warnings = response.structuredContent?.warnings ?? [];
+  return createSuccessResponse(
+    {
+      toolName: params.toolName,
+      result: response.structuredContent?.result ?? response.content,
+      ...warnings.length === 0 ? {} : { warnings }
+    },
+    warnings
+  );
+};
+var handleProxyToolCall = async (input) => {
+  switch (input.toolName) {
+    case LIST_TOOL_CATEGORIES_TOOL_NAME: {
+      const params = decodeOrError(EmptyProxyParamsSchema, input.args, LIST_TOOL_CATEGORIES_TOOL_NAME);
+      if (isMcpToolResponse(params)) return params;
+      return listCategories(input.proxyCandidateRegistry);
+    }
+    case SEARCH_TOOLS_TOOL_NAME:
+      return searchTools2(input.proxyCandidateRegistry, input.args);
+    case GET_TOOL_SCHEMA_TOOL_NAME:
+      return getToolSchema(input.proxyCandidateRegistry, input.args);
+    case INVOKE_TOOL_TOOL_NAME:
+      if (input.clients === void 0) {
+        return createInvalidParamsError("invoke_tool requires initialized Huly clients.", "ProxyClientsMissing");
+      }
+      return invokeTool(input.proxyCandidateRegistry, input.args, input.clients);
+    default:
+      return createUnknownToolError(input.toolName);
+  }
+};
+
+// src/mcp/tool-mode.ts
+var ToolExposureModeSchema = Schema_exports.Literal("native", "proxy");
+var ToolModeConfigSchema = Schema_exports.Literal("auto", "native", "proxy");
+var ProxyOutputStrictEnvSchema = Schema_exports.Literal("true", "false");
+var decodeToolExposureMode = Schema_exports.decodeUnknownSync(ToolExposureModeSchema);
+var NATIVE_TOOL_EXPOSURE_MODE = decodeToolExposureMode("native");
+var PROXY_TOOL_EXPOSURE_MODE = decodeToolExposureMode("proxy");
+var ToolExposureConfigSchema = Schema_exports.Struct({
+  configuredMode: ToolModeConfigSchema,
+  proxyOutputStrict: Schema_exports.Boolean
+});
+var ToolExposureEnvSchema = Schema_exports.Struct({
+  hulyToolMode: Schema_exports.optionalWith(Schema_exports.String, { exact: true }),
+  proxyOutputStrict: Schema_exports.optionalWith(Schema_exports.String, { exact: true })
+});
+var DEFAULT_TOOL_EXPOSURE_CONFIG = ToolExposureConfigSchema.make({
+  configuredMode: "auto",
+  proxyOutputStrict: false
+});
+var isUnknownRecord = (input) => typeof input === "object" && input !== null && !Array.isArray(input);
+var envShapeFailure = (input) => {
+  if (isUnknownRecord(input)) {
+    if ("hulyToolMode" in input && input.hulyToolMode !== void 0 && typeof input.hulyToolMode !== "string") {
+      return {
+        _tag: "Failure",
+        field: "HULY_TOOL_MODE",
+        message: "Configuration error: HULY_TOOL_MODE must be a string when set."
+      };
+    }
+    if ("proxyOutputStrict" in input && input.proxyOutputStrict !== void 0 && typeof input.proxyOutputStrict !== "string") {
+      return {
+        _tag: "Failure",
+        field: "PROXY_OUTPUT_STRICT",
+        message: "Configuration error: PROXY_OUTPUT_STRICT must be a string when set."
+      };
+    }
+  }
+  return {
+    _tag: "Failure",
+    field: "HULY_TOOL_MODE",
+    message: "Configuration error: HULY_TOOL_MODE and PROXY_OUTPUT_STRICT must be string environment values."
+  };
+};
+var ClientKindSchema = Schema_exports.Literal(
+  "claude-code",
+  "claude-ai",
+  "cursor",
+  "windsurf",
+  "github-copilot",
+  "codex",
+  "opencode",
+  "unknown"
+);
+var DEFAULT_MODE_BY_CLIENT_KIND = {
+  "claude-code": NATIVE_TOOL_EXPOSURE_MODE,
+  "claude-ai": PROXY_TOOL_EXPOSURE_MODE,
+  cursor: PROXY_TOOL_EXPOSURE_MODE,
+  windsurf: PROXY_TOOL_EXPOSURE_MODE,
+  "github-copilot": PROXY_TOOL_EXPOSURE_MODE,
+  codex: PROXY_TOOL_EXPOSURE_MODE,
+  opencode: PROXY_TOOL_EXPOSURE_MODE,
+  unknown: PROXY_TOOL_EXPOSURE_MODE
+};
+var McpClientName = Schema_exports.Trim.pipe(Schema_exports.nonEmptyString(), Schema_exports.brand("McpClientName")).annotations({
+  identifier: "McpClientName",
+  title: "McpClientName",
+  description: "Trimmed MCP client name from initialize or request metadata."
+});
+var McpClientInfoLikeSchema = Schema_exports.Struct({
+  name: Schema_exports.optionalWith(McpClientName, { exact: true })
+});
+var trimmedLower = (value3) => value3.trim().toLowerCase();
+var parseConfiguredMode = (raw) => {
+  if (raw === void 0) {
+    return { _tag: "Success", value: DEFAULT_TOOL_EXPOSURE_CONFIG.configuredMode };
+  }
+  const normalized = trimmedLower(raw);
+  const decoded = Schema_exports.decodeUnknownEither(ToolModeConfigSchema)(normalized);
+  if (Either_exports.isRight(decoded)) return { _tag: "Success", value: decoded.right };
+  return {
+    _tag: "Failure",
+    field: "HULY_TOOL_MODE",
+    message: `Configuration error: HULY_TOOL_MODE must be one of auto, native, or proxy; received "${raw}".`
+  };
+};
+var parseProxyOutputStrict = (raw) => {
+  if (raw === void 0) return { _tag: "Success", value: false };
+  const normalized = trimmedLower(raw);
+  const decoded = Schema_exports.decodeUnknownEither(ProxyOutputStrictEnvSchema)(normalized);
+  if (Either_exports.isRight(decoded)) return { _tag: "Success", value: decoded.right === "true" };
+  return {
+    _tag: "Failure",
+    field: "PROXY_OUTPUT_STRICT",
+    message: `Configuration error: PROXY_OUTPUT_STRICT must be true or false; received "${raw}".`
+  };
+};
+var parseToolExposureConfig = (input) => {
+  const decodedEnv = Schema_exports.decodeUnknownEither(ToolExposureEnvSchema)(input);
+  if (Either_exports.isLeft(decodedEnv)) return envShapeFailure(input);
+  const env = decodedEnv.right;
+  const configuredMode = parseConfiguredMode(env.hulyToolMode);
+  if (configuredMode._tag === "Failure") return configuredMode;
+  const proxyOutputStrict = parseProxyOutputStrict(env.proxyOutputStrict);
+  if (proxyOutputStrict._tag === "Failure") return proxyOutputStrict;
+  return {
+    _tag: "Success",
+    value: ToolExposureConfigSchema.make({
+      configuredMode: configuredMode.value,
+      proxyOutputStrict: proxyOutputStrict.value
+    })
+  };
+};
+var parseMcpClientInfo = (input) => {
+  const decoded = Schema_exports.decodeUnknownEither(McpClientInfoLikeSchema)(input);
+  return Either_exports.isRight(decoded) ? decoded.right : void 0;
+};
+var rawClientName = (clientInfo) => {
+  const name = clientInfo?.name?.toLowerCase();
+  if (name === void 0 || name === "") return "";
+  return name;
+};
+var withoutRemoteSuffix = (name) => name.replace(/\s*\([^)]*\)\s*$/, "").trim();
+var makeClientKind = Schema_exports.decodeUnknownSync(ClientKindSchema);
+var classifyMcpClient = (clientInfo) => {
+  const rawName = rawClientName(clientInfo);
+  if (rawName === "claude-code") return makeClientKind("claude-code");
+  const name = withoutRemoteSuffix(rawName);
+  if (name === "claude-code") return makeClientKind("unknown");
+  if (name === "claude-ai") return makeClientKind("claude-ai");
+  if (name === "cursor-vscode" || name.startsWith("cursor")) return makeClientKind("cursor");
+  if (name.startsWith("windsurf") || name.startsWith("cascade")) return makeClientKind("windsurf");
+  if (name.startsWith("github-copilot") || name.startsWith("copilot") || name.startsWith("visual studio code") || name.startsWith("visual-studio-code")) {
+    return makeClientKind("github-copilot");
+  }
+  if (name.startsWith("codex") || name.startsWith("openai-codex")) return makeClientKind("codex");
+  if (name.startsWith("opencode")) return makeClientKind("opencode");
+  return makeClientKind("unknown");
+};
+var resolveToolExposureMode = (input) => {
+  if (input.configuredMode !== "auto") return input.configuredMode;
+  return DEFAULT_MODE_BY_CLIENT_KIND[classifyMcpClient(input.clientInfo)];
+};
+
+// src/mcp/protocol-tool-exposure.ts
+var BUILTIN_TOOL_COUNT = 2;
+var DEFAULT_HANDLER_EXPOSURE_CONFIG = {
+  configuredMode: "native",
+  proxyOutputStrict: false
+};
+var emptyToolRegistry = {
+  tools: /* @__PURE__ */ new Map(),
+  definitions: [],
+  handleToolCall: async () => null
+};
+var isObjectPropertyEntry = (entry) => {
+  const value3 = entry[1];
+  return typeof value3 === "object" && value3 !== null;
+};
+var objectProperties = (properties) => {
+  if (properties === void 0) return void 0;
+  return Object.entries(properties).filter(isObjectPropertyEntry).reduce(
+    (acc, [key, value3]) => ({ ...acc, [key]: value3 }),
+    {}
+  );
+};
+var toProtocolObjectSchema = (schema) => {
+  const { properties, required: required4, ...rest } = schema;
+  const convertedProperties = objectProperties(properties);
+  return {
+    ...stripCollidingSchemaIdsRecord(rest),
+    type: "object",
+    ...convertedProperties === void 0 ? {} : { properties: stripCollidingSchemaIdsProperties(convertedProperties) },
+    ...required4 === void 0 ? {} : { required: [...required4] }
+  };
+};
+var normalizeRegistries = (registry2) => "fullRegistry" in registry2 ? registry2 : { fullRegistry: registry2, scopedNativeRegistry: registry2 };
+var defaultExposureOptions = () => ({
+  exposureConfig: DEFAULT_HANDLER_EXPOSURE_CONFIG,
+  toolScopeFilteringActive: false,
+  currentClientInfo: () => void 0
+});
+var resolveProxyCandidateRegistry = (registries, options) => {
+  if (!options.exposureConfig.proxyOutputStrict) return registries.fullRegistry;
+  return options.toolScopeFilteringActive ? registries.scopedNativeRegistry : registries.fullRegistry;
+};
+var resolveProtocolExposure = (registries, options) => {
+  const clientInfo = options.currentClientInfo();
+  const clientKind = classifyMcpClient(clientInfo);
+  const resolvedMode = resolveToolExposureMode({
+    configuredMode: options.exposureConfig.configuredMode,
+    ...clientInfo === void 0 ? {} : { clientInfo }
+  });
+  const proxyCandidateRegistry = resolveProxyCandidateRegistry(registries, options);
+  const visibleNativeRegistry = resolvedMode === "native" ? registries.scopedNativeRegistry : options.toolScopeFilteringActive && !options.exposureConfig.proxyOutputStrict ? registries.scopedNativeRegistry : emptyToolRegistry;
+  const visibleToolCount = BUILTIN_TOOL_COUNT + visibleNativeRegistry.definitions.length + (resolvedMode === "proxy" ? proxyToolDefinitions.length : 0);
+  return {
+    context: {
+      configuredMode: options.exposureConfig.configuredMode,
+      resolvedMode,
+      clientKind,
+      proxyOutputStrict: options.exposureConfig.proxyOutputStrict,
+      visibleToolCount,
+      nativeVisibleToolCount: visibleNativeRegistry.definitions.length,
+      proxyCandidateToolCount: proxyCandidateRegistry.definitions.length,
+      proxyToolNames: resolvedMode === "proxy" ? PROXY_TOOL_NAMES : []
+    },
+    visibleNativeRegistry,
+    proxyCandidateRegistry
+  };
+};
+var toListedTool = (tool) => ({
+  name: tool.name,
+  description: tool.description,
+  inputSchema: toProtocolObjectSchema(tool.inputSchema),
+  ...tool.outputSchema === void 0 ? {} : { outputSchema: toProtocolObjectSchema(tool.outputSchema) },
+  ...tool.annotations === void 0 ? {} : { annotations: tool.annotations }
+});
+var toListedHulyTool = (tool) => toListedTool({
+  name: tool.name,
+  description: tool.description,
+  inputSchema: toClientCompatibleInputSchema(tool.inputSchema),
+  outputSchema: tool.outputSchema,
+  annotations: resolveAnnotations(tool)
+});
+
+// src/mcp/protocol-handlers.ts
+var DRAIN_POLL_MS = 50;
+var DRAIN_TIMEOUT_MS2 = 3e4;
+var NPM_FETCH_TIMEOUT_MS = 5e3;
+var NPM_PACKAGE_NAME2 = "@firfi/huly-mcp";
+var computeOutputBytes = (response) => response.content.reduce((sum2, c) => sum2 + c.text.length, 0);
 var deriveEditMode = (name, args2) => {
   if (name !== "edit_document" || args2 === void 0) return void 0;
   if (typeof args2 !== "object" || args2 === null || Array.isArray(args2)) return void 0;
@@ -207671,63 +208611,15 @@ var fetchLatestNpmVersion = async (fetchImpl = fetch) => {
     return "unknown";
   }
 };
-var isObjectPropertyEntry = (entry) => {
-  const value3 = entry[1];
-  return typeof value3 === "object" && value3 !== null;
-};
-var objectProperties = (properties) => {
-  if (properties === void 0) return void 0;
-  return Object.entries(properties).filter(isObjectPropertyEntry).reduce(
-    (acc, [key, value3]) => ({ ...acc, [key]: value3 }),
-    {}
-  );
-};
-var toProtocolObjectSchema = (schema) => {
-  const { properties, required: required4, ...rest } = schema;
-  const convertedProperties = objectProperties(properties);
-  return {
-    ...rest,
-    type: "object",
-    ...convertedProperties === void 0 ? {} : { properties: convertedProperties },
-    ...required4 === void 0 ? {} : { required: [...required4] }
+var isRecord6 = (value3) => typeof value3 === "object" && value3 !== null && !Array.isArray(value3);
+var createMcpProtocolHandlers = (resolveClients, telemetry, registry2, getHulyContext, clock3 = liveNowClock, fetchLatestVersion = fetchLatestNpmVersion, exposureOptions = {}) => {
+  const registries = normalizeRegistries(registry2);
+  const defaults = defaultExposureOptions();
+  const protocolExposureOptions = {
+    exposureConfig: exposureOptions.exposureConfig ?? defaults.exposureConfig,
+    currentClientInfo: exposureOptions.currentClientInfo ?? defaults.currentClientInfo,
+    toolScopeFilteringActive: exposureOptions.toolScopeFilteringActive ?? defaults.toolScopeFilteringActive
   };
-};
-var createResourceClientResolutionError = (uri, _error) => new McpError(
-  ErrorCode.InternalError,
-  `Failed to initialize Huly clients while reading resource "${uri}". Verify Huly URL, workspace, and authentication configuration.`
-);
-var createResourceListClientResolutionError = (_error) => new McpError(
-  ErrorCode.InternalError,
-  "Failed to initialize Huly clients while listing resources. Verify Huly URL, workspace, and authentication configuration."
-);
-var isConfigValidationFailure = (error2) => {
-  if (error2 instanceof ConfigValidationError) return true;
-  if (!Runtime_exports.isFiberFailure(error2)) return false;
-  return Chunk_exports.toArray(Cause_exports.failures(error2[Runtime_exports.FiberFailureCauseId])).some(
-    (failure) => failure instanceof ConfigValidationError
-  );
-};
-var shouldReturnEmptyResourceListOnClientResolutionFailure = (error2, _getHulyContext) => isConfigValidationFailure(error2);
-var resolveResourceClientsOrThrow = async (resolveClients, mapError7) => {
-  try {
-    return await resolveClients();
-  } catch (e) {
-    throw mapError7(e);
-  }
-};
-var throwResourceReadError = (uri, cause3) => {
-  const failures3 = Chunk_exports.toArray(Cause_exports.failures(cause3));
-  const failure = failures3[0];
-  if (failure instanceof McpError) throw failure;
-  throw new McpError(ErrorCode.InternalError, `Failed to read Huly resource "${uri}"`);
-};
-var throwResourceListError = (cause3) => {
-  const failures3 = Chunk_exports.toArray(Cause_exports.failures(cause3));
-  const failure = failures3[0];
-  if (failure instanceof McpError) throw failure;
-  throw new McpError(ErrorCode.InternalError, "Failed to list Huly resources");
-};
-var createMcpProtocolHandlers = (resolveClients, telemetry, registry2, getHulyContext, clock3 = liveNowClock, fetchLatestVersion = fetchLatestNpmVersion) => {
   let inflight = 0;
   const drainInflight = createDrainInflight(() => inflight, clock3);
   const enter = () => {
@@ -207737,29 +208629,24 @@ var createMcpProtocolHandlers = (resolveClients, telemetry, registry2, getHulyCo
     inflight--;
   };
   const listTools = async () => {
-    telemetry.firstListTools();
+    const exposure = resolveProtocolExposure(registries, protocolExposureOptions);
+    telemetry.firstListTools({
+      clientKind: exposure.context.clientKind,
+      resolvedMode: exposure.context.resolvedMode
+    });
     return {
       tools: [
-        versionToolDefinition,
-        getHulyContextToolDefinition,
-        ...registry2.definitions.map((tool) => ({
-          name: tool.name,
-          description: tool.description,
-          inputSchema: toClientCompatibleInputSchema(tool.inputSchema),
-          outputSchema: tool.outputSchema,
-          annotations: resolveAnnotations(tool)
-        }))
-      ].map((tool) => ({
-        ...tool,
-        inputSchema: toProtocolObjectSchema(tool.inputSchema),
-        outputSchema: toProtocolObjectSchema(tool.outputSchema)
-      }))
+        ...[versionToolDefinition, getHulyContextToolDefinition].map(toListedTool),
+        ...exposure.context.resolvedMode === "proxy" ? proxyToolDefinitions.map(toListedHulyTool) : [],
+        ...exposure.visibleNativeRegistry.definitions.map(toListedHulyTool)
+      ]
     };
   };
   const callTool = async (request3) => {
     enter();
     try {
       const { arguments: args2, name } = request3.params;
+      const exposure = resolveProtocolExposure(registries, protocolExposureOptions);
       const start3 = clock3.currentTimeMillis();
       const inputBytes = JSON.stringify(args2 ?? {}).length;
       const returnError = (errorResponse, editMode2) => {
@@ -207767,6 +208654,8 @@ var createMcpProtocolHandlers = (resolveClients, telemetry, registry2, getHulyCo
         telemetry.toolCalled({
           toolName: name,
           status: "error",
+          clientKind: exposure.context.clientKind,
+          resolvedMode: exposure.context.resolvedMode,
           errorTag: errorResponse._meta?.errorTag,
           durationMs: durationMs2,
           inputBytes,
@@ -207776,7 +208665,7 @@ var createMcpProtocolHandlers = (resolveClients, telemetry, registry2, getHulyCo
         return toMcpResponse(errorResponse);
       };
       if (name === VERSION_TOOL_NAME) {
-        if (!isEmptyArgumentsObject(args2)) return returnError(createUnexpectedArgumentsError(name));
+        if (!isEmptyArgumentsObject(args2)) return returnError(createUnexpectedArgumentsError(VERSION_TOOL_NAME));
         const latest = await fetchLatestVersion();
         let versionResult;
         try {
@@ -207789,6 +208678,8 @@ var createMcpProtocolHandlers = (resolveClients, telemetry, registry2, getHulyCo
         telemetry.toolCalled({
           toolName: name,
           status: "success",
+          clientKind: exposure.context.clientKind,
+          resolvedMode: exposure.context.resolvedMode,
           durationMs: durationMs2,
           inputBytes,
           outputBytes: computeOutputBytes(versionResponse)
@@ -207796,10 +208687,12 @@ var createMcpProtocolHandlers = (resolveClients, telemetry, registry2, getHulyCo
         return toMcpResponse(versionResponse);
       }
       if (name === GET_HULY_CONTEXT_TOOL_NAME) {
-        if (!isEmptyArgumentsObject(args2)) return returnError(createUnexpectedArgumentsError(name));
+        if (!isEmptyArgumentsObject(args2)) {
+          return returnError(createUnexpectedArgumentsError(GET_HULY_CONTEXT_TOOL_NAME));
+        }
         let context6;
         try {
-          context6 = validateHulyContextResult(getHulyContext());
+          context6 = validateHulyContextResult(getHulyContext(exposure.context));
         } catch {
           return returnError(mapDomainErrorToMcp(new HulyError({ message: "Failed to build Huly context" })));
         }
@@ -207808,21 +208701,68 @@ var createMcpProtocolHandlers = (resolveClients, telemetry, registry2, getHulyCo
         telemetry.toolCalled({
           toolName: name,
           status: "success",
+          clientKind: exposure.context.clientKind,
+          resolvedMode: exposure.context.resolvedMode,
           durationMs: durationMs2,
           inputBytes,
           outputBytes: computeOutputBytes(contextResponse)
         });
         return toMcpResponse(contextResponse);
       }
-      const tool = registry2.tools.get(name);
+      if (isProxyToolName(name)) {
+        if (exposure.context.resolvedMode !== "proxy") return returnError(createUnknownToolError(name));
+        const editMode2 = name === INVOKE_TOOL_TOOL_NAME && isRecord6(args2) && typeof args2.toolName === "string" ? deriveEditMode(args2.toolName, args2.arguments) : void 0;
+        let clients2;
+        if (name === INVOKE_TOOL_TOOL_NAME) {
+          try {
+            clients2 = await resolveClients();
+          } catch (e) {
+            const errorResponse = mapDomainErrorToMcp(
+              new HulyError({
+                message: `Failed to initialize Huly clients: ${e instanceof Error ? e.message : String(e)}`
+              })
+            );
+            return returnError(errorResponse, editMode2);
+          }
+        }
+        const response2 = await handleProxyToolCall({
+          toolName: name,
+          args: args2,
+          proxyCandidateRegistry: exposure.proxyCandidateRegistry,
+          ...clients2 === void 0 ? {} : {
+            clients: {
+              hulyClient: clients2.hulyClient,
+              storageClient: clients2.storageClient,
+              ...clients2.workspaceClient === void 0 ? {} : { workspaceClient: clients2.workspaceClient }
+            }
+          }
+        });
+        const durationMs2 = clock3.currentTimeMillis() - start3;
+        telemetry.toolCalled({
+          toolName: name,
+          status: response2.isError === true ? "error" : "success",
+          clientKind: exposure.context.clientKind,
+          resolvedMode: exposure.context.resolvedMode,
+          errorTag: response2._meta?.errorTag,
+          durationMs: durationMs2,
+          inputBytes,
+          outputBytes: computeOutputBytes(response2),
+          editMode: editMode2
+        });
+        return toMcpResponse(response2);
+      }
+      const hulyToolName = parseToolName(name);
+      if (hulyToolName === void 0) return returnError(createUnknownToolError(name));
+      const nativeCallRegistry = exposure.visibleNativeRegistry.tools.has(hulyToolName) ? exposure.visibleNativeRegistry : exposure.context.resolvedMode === "proxy" ? exposure.proxyCandidateRegistry : exposure.visibleNativeRegistry;
+      const tool = nativeCallRegistry.tools.get(hulyToolName);
       if (tool === void 0) return returnError(createUnknownToolError(name));
       if (isNoArgumentTool(tool) && !isEmptyArgumentsObject(args2)) {
-        return returnError(createUnexpectedArgumentsError(name));
+        return returnError(createUnexpectedArgumentsError(hulyToolName));
       }
       if (args2 === void 0 && requiresArgumentsObject(tool)) {
-        return returnError(createMissingArgumentsError(name));
+        return returnError(createMissingArgumentsError(hulyToolName));
       }
-      const editMode = deriveEditMode(name, args2);
+      const editMode = deriveEditMode(hulyToolName, args2);
       let clients;
       try {
         clients = await resolveClients();
@@ -207832,8 +208772,8 @@ var createMcpProtocolHandlers = (resolveClients, telemetry, registry2, getHulyCo
         );
         return returnError(errorResponse, editMode);
       }
-      const response = await registry2.handleToolCall(
-        name,
+      const response = await nativeCallRegistry.handleToolCall(
+        hulyToolName,
         args2,
         clients.hulyClient,
         clients.storageClient,
@@ -207842,8 +208782,10 @@ var createMcpProtocolHandlers = (resolveClients, telemetry, registry2, getHulyCo
       const durationMs = clock3.currentTimeMillis() - start3;
       if (response === null) return returnError(createUnknownToolError(name), editMode);
       telemetry.toolCalled({
-        toolName: name,
+        toolName: hulyToolName,
         status: response.isError === true ? "error" : "success",
+        clientKind: exposure.context.clientKind,
+        resolvedMode: exposure.context.resolvedMode,
         errorTag: response._meta?.errorTag,
         durationMs,
         inputBytes,
@@ -207855,55 +208797,13 @@ var createMcpProtocolHandlers = (resolveClients, telemetry, registry2, getHulyCo
       leave();
     }
   };
-  const listResourcesHandler = async () => {
-    enter();
-    try {
-      let clients;
-      try {
-        clients = await resolveClients();
-      } catch (e) {
-        if (shouldReturnEmptyResourceListOnClientResolutionFailure(e, getHulyContext)) return { resources: [] };
-        throw createResourceListClientResolutionError(e);
-      }
-      const resourceList = await Effect_exports.runPromiseExit(
-        listResources().pipe(
-          Effect_exports.provideService(HulyClient, clients.hulyClient)
-        )
-      );
-      if (Exit_exports.isSuccess(resourceList)) return resourceList.value;
-      return throwResourceListError(resourceList.cause);
-    } finally {
-      leave();
-    }
-  };
-  const readResource = async (request3) => {
-    enter();
-    try {
-      const { uri } = request3.params;
-      const clients = await resolveResourceClientsOrThrow(
-        resolveClients,
-        (error2) => createResourceClientResolutionError(uri, error2)
-      );
-      const diagnosticsScope = await Effect_exports.runPromise(makeDiagnosticsScope);
-      const resourceRead = await Effect_exports.runPromiseExit(
-        readHulyResource(uri).pipe(
-          Effect_exports.provideService(HulyClient, clients.hulyClient),
-          Effect_exports.provideService(Diagnostics, diagnosticsScope.service)
-        )
-      );
-      const warnings = await Effect_exports.runPromise(diagnosticsScope.drainWarnings);
-      if (Exit_exports.isSuccess(resourceRead)) return withResourceWarnings(resourceRead.value, warnings);
-      return throwResourceReadError(uri, resourceRead.cause);
-    } finally {
-      leave();
-    }
-  };
+  const resourceHandlers = createResourceProtocolHandlers({ resolveClients, enter, leave });
   return {
     listTools,
     callTool,
-    listResources: listResourcesHandler,
+    listResources: resourceHandlers.listResources,
     listResourceTemplates,
-    readResource,
+    readResource: resourceHandlers.readResource,
     serverDiscover: () => ({
       resultType: "complete",
       supportedVersions: ["2026-07-28"],
@@ -213547,9 +214447,25 @@ var createDefaultMcpSdkServer = () => new Server(
 );
 
 // src/mcp/create-mcp-server.ts
-var createMcpServer = (resolveClients, telemetry, registry2, getHulyContext, createServer = createDefaultMcpSdkServer) => {
+var currentClientInfoFromServer = (server) => {
+  const maybeServer = server;
+  return parseMcpClientInfo(maybeServer.getClientVersion?.());
+};
+var createMcpServer = (resolveClients, telemetry, registry2, getHulyContext, createServer = createDefaultMcpSdkServer, exposureOptions = {}) => {
   const server = createServer();
-  const handlers = createMcpProtocolHandlers(resolveClients, telemetry, registry2, getHulyContext);
+  const currentClientInfo = () => exposureOptions.currentClientInfo?.() ?? currentClientInfoFromServer(server);
+  const handlers = createMcpProtocolHandlers(
+    resolveClients,
+    telemetry,
+    registry2,
+    getHulyContext,
+    void 0,
+    void 0,
+    {
+      ...exposureOptions,
+      currentClientInfo
+    }
+  );
   server.setRequestHandler(ListToolsRequestSchema, handlers.listTools);
   server.setRequestHandler(CallToolRequestSchema, handlers.callTool);
   server.setRequestHandler(ListResourcesRequestSchema, handlers.listResources);
@@ -217407,11 +218323,19 @@ var createPostHogTelemetry = (debug, dependencies = defaultDependencies) => {
         }
       });
     },
-    firstListTools: () => {
+    firstListTools: (props) => {
       if (listToolsSent) return;
       listToolsSent = true;
-      debugLog("[telemetry] first_list_tools");
-      capture2({ event: "first_list_tools" });
+      debugLog(`[telemetry] first_list_tools: ${JSON.stringify(props ?? {})}`);
+      capture2(
+        props === void 0 ? { event: "first_list_tools" } : {
+          event: "first_list_tools",
+          properties: {
+            client_kind: props.clientKind,
+            resolved_mode: props.resolvedMode
+          }
+        }
+      );
     },
     toolCalled: (props) => {
       debugLog(`[telemetry] tool_called: ${JSON.stringify(props)}`);
@@ -217421,6 +218345,8 @@ var createPostHogTelemetry = (debug, dependencies = defaultDependencies) => {
           tool_name: props.toolName,
           status: props.status,
           duration_ms: props.durationMs,
+          ...props.clientKind !== void 0 && { client_kind: props.clientKind },
+          ...props.resolvedMode !== void 0 && { resolved_mode: props.resolvedMode },
           ...props.errorTag !== void 0 && { error_tag: props.errorTag },
           ...props.inputBytes !== void 0 && { input_bytes: props.inputBytes },
           ...props.outputBytes !== void 0 && { output_bytes: props.outputBytes },
@@ -217479,6 +218405,23 @@ var McpServerError = class extends Schema_exports.TaggedError()(
 var defaultWriteError = (message) => {
   console.error(message);
 };
+var parseToolExposureConfigEffect = (env) => {
+  const parsed = parseToolExposureConfig(env);
+  if (parsed._tag === "Success") return Effect_exports.succeed(parsed.value);
+  return Effect_exports.fail(new McpServerError({ message: parsed.message }));
+};
+var isRecord7 = (value3) => typeof value3 === "object" && value3 !== null && !Array.isArray(value3);
+var clientInfoFromMcp2026Request = (req) => {
+  const body = req.body;
+  if (!isRecord7(body) || !isRecord7(body.params) || !isRecord7(body.params._meta)) return void 0;
+  const clientInfo = body.params._meta["io.modelcontextprotocol/clientInfo"];
+  return parseMcpClientInfo(clientInfo);
+};
+var clientInfoFromLegacyHttpRequest = (req) => {
+  const body = req.body;
+  if (!isRecord7(body) || !isRecord7(body.params)) return void 0;
+  return parseMcpClientInfo(body.params.clientInfo) ?? clientInfoFromMcp2026Request(req);
+};
 var McpServerService = class _McpServerService extends Context_exports.Tag("@hulymcp/McpServer")() {
   static layer(config3) {
     return Layer_exports.effect(
@@ -217487,16 +218430,51 @@ var McpServerService = class _McpServerService extends Context_exports.Tag("@hul
         const telemetry = yield* TelemetryService;
         const writeError2 = config3.writeError ?? defaultWriteError;
         const toolsetsRaw = yield* Effect_exports.orElseSucceed(Config_exports.string("TOOLSETS"), () => "");
-        const toolsetSummary = parseToolsets(toolsetsRaw || void 0, writeError2);
-        const enabledCategories = toolsetSummary.enabledCategories;
-        const toolsets = enabledCategories ? [...enabledCategories] : null;
-        const registry2 = enabledCategories ? createFilteredRegistry(enabledCategories) : toolRegistry;
+        const toolsRaw = yield* Effect_exports.orElseSucceed(Config_exports.string("TOOLS"), () => "");
+        const hulyToolModeRaw = yield* Effect_exports.orElseSucceed(
+          Config_exports.string("HULY_TOOL_MODE"),
+          () => void 0
+        );
+        const proxyOutputStrictRaw = yield* Effect_exports.orElseSucceed(
+          Config_exports.string("PROXY_OUTPUT_STRICT"),
+          () => void 0
+        );
+        const exposureConfig = yield* parseToolExposureConfigEffect({
+          ...hulyToolModeRaw === void 0 ? {} : { hulyToolMode: hulyToolModeRaw },
+          ...proxyOutputStrictRaw === void 0 ? {} : { proxyOutputStrict: proxyOutputStrictRaw }
+        });
+        const toolScope = resolveToolScope(
+          {
+            toolsets: toolsetsRaw,
+            tools: toolsRaw
+          },
+          toolRegistry.definitions,
+          writeError2
+        );
+        const toolsets = toolScope.filteringActive ? toolScope.enabledToolsets : null;
+        const scopedNativeRegistry = createScopedRegistry({
+          filteringActive: toolScope.filteringActive,
+          categories: toolScope.enabledCategories,
+          toolNames: toolScope.enabledToolNames
+        });
+        const registries = {
+          fullRegistry: toolRegistry,
+          scopedNativeRegistry
+        };
         const getRuntimeConfigContext = config3.getRuntimeConfigContext ?? (() => sanitizeHulyRuntimeConfigFromEnv(process.env));
-        const getHulyContext = (runtimeConfig) => buildHulyContext(config3, registry2, toolsetSummary, runtimeConfig);
+        const getHulyContext = (runtimeConfig, toolExposure) => buildHulyContext(config3, scopedNativeRegistry, toolScope, runtimeConfig, toolExposure);
+        const sdkExposureOptions = {
+          exposureConfig,
+          toolScopeFilteringActive: toolScope.filteringActive
+        };
+        const requestExposureOptions = (currentClientInfo) => ({
+          ...sdkExposureOptions,
+          currentClientInfo
+        });
         telemetry.sessionStart({
           transport: config3.transport,
           authMethod: config3.authMethod ?? "password",
-          toolCount: registry2.definitions.length,
+          toolCount: scopedNativeRegistry.definitions.length,
           toolsets
         });
         const flushTelemetry = Effect_exports.ignore(
@@ -217516,9 +218494,10 @@ var McpServerService = class _McpServerService extends Context_exports.Tag("@hul
               const [stdioServer, drainInflight] = createMcpServer(
                 config3.resolveClients,
                 telemetry,
-                registry2,
-                () => getHulyContext(getRuntimeConfigContext()),
-                config3.createServer
+                registries,
+                (toolExposure) => getHulyContext(getRuntimeConfigContext(), toolExposure),
+                config3.createServer,
+                sdkExposureOptions
               );
               yield* Ref_exports.set(serverRef, stdioServer);
               const transport = config3.createStdioTransport?.() ?? new StdioServerTransport();
@@ -217575,9 +218554,10 @@ var McpServerService = class _McpServerService extends Context_exports.Tag("@hul
                   return createMcpServer(
                     requestResolveClients,
                     telemetry,
-                    registry2,
-                    () => getHulyContext(requestRuntimeConfig),
-                    config3.createServer
+                    registries,
+                    (toolExposure) => getHulyContext(requestRuntimeConfig, toolExposure),
+                    config3.createServer,
+                    requestExposureOptions(() => clientInfoFromLegacyHttpRequest(req))
                   )[0];
                 },
                 config3.httpTransportDependencies,
@@ -217586,8 +218566,11 @@ var McpServerService = class _McpServerService extends Context_exports.Tag("@hul
                   return createMcpProtocolHandlers(
                     requestResolveClients,
                     telemetry,
-                    registry2,
-                    () => getHulyContext(requestRuntimeConfig)
+                    registries,
+                    (toolExposure) => getHulyContext(requestRuntimeConfig, toolExposure),
+                    void 0,
+                    void 0,
+                    requestExposureOptions(() => clientInfoFromMcp2026Request(req))
                   );
                 }
               ).pipe(