@frontmcp/plugin-codecall 1.3.0 → 1.4.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/index.js CHANGED
@@ -53,7 +53,8 @@ __export(index_exports, {
53
53
  module.exports = __toCommonJS(index_exports);
54
54
 
55
55
  // plugins/plugin-codecall/src/codecall.plugin.ts
56
- var import_sdk7 = require("@frontmcp/sdk");
56
+ var import_plugin_cache = __toESM(require("@frontmcp/plugin-cache"));
57
+ var import_sdk9 = require("@frontmcp/sdk");
57
58
 
58
59
  // plugins/plugin-codecall/src/codecall.types.ts
59
60
  var import_lazy_zod = require("@frontmcp/lazy-zod");
@@ -310,6 +311,104 @@ var DEFAULT_PLUGIN_OPTIONS = {
310
311
  };
311
312
  var codeCallPluginOptionsSchema = codeCallPluginOptionsObjectSchema.prefault(DEFAULT_PLUGIN_OPTIONS);
312
313
 
314
+ // plugins/plugin-codecall/src/providers/code-call.config.ts
315
+ var import_sdk = require("@frontmcp/sdk");
316
+ var CodeCallConfig = class extends import_sdk.BaseConfig {
317
+ constructor(options = {}) {
318
+ const parsedConfig = codeCallPluginOptionsSchema.parse(options);
319
+ const resolvedVm = resolveVmOptions(parsedConfig.vm);
320
+ super({ ...parsedConfig, resolvedVm });
321
+ }
322
+ };
323
+ CodeCallConfig = __decorateClass([
324
+ (0, import_sdk.Provider)({
325
+ name: "codecall:config",
326
+ description: "CodeCall plugin configuration with validated defaults",
327
+ scope: import_sdk.ProviderScope.GLOBAL
328
+ })
329
+ ], CodeCallConfig);
330
+ function resolveVmOptions(vmOptions) {
331
+ const preset = vmOptions?.preset ?? "secure";
332
+ const base = presetDefaults(preset);
333
+ return {
334
+ ...base,
335
+ ...vmOptions,
336
+ disabledBuiltins: vmOptions?.disabledBuiltins ?? base.disabledBuiltins,
337
+ disabledGlobals: vmOptions?.disabledGlobals ?? base.disabledGlobals
338
+ };
339
+ }
340
+ function presetDefaults(preset) {
341
+ switch (preset) {
342
+ case "locked_down":
343
+ return {
344
+ preset,
345
+ timeoutMs: 2e3,
346
+ allowLoops: false,
347
+ allowConsole: false,
348
+ maxSteps: 2e3,
349
+ disabledBuiltins: ["eval", "Function", "AsyncFunction"],
350
+ disabledGlobals: [
351
+ "require",
352
+ "process",
353
+ "fetch",
354
+ "setTimeout",
355
+ "setInterval",
356
+ "setImmediate",
357
+ "global",
358
+ "globalThis"
359
+ ],
360
+ maxSanitizeDepth: 10,
361
+ maxSanitizeProperties: 1e3
362
+ };
363
+ case "balanced":
364
+ return {
365
+ preset,
366
+ timeoutMs: 5e3,
367
+ allowLoops: true,
368
+ allowConsole: true,
369
+ maxSteps: 1e4,
370
+ disabledBuiltins: ["eval", "Function", "AsyncFunction"],
371
+ disabledGlobals: ["require", "process", "fetch"],
372
+ maxSanitizeDepth: 50,
373
+ maxSanitizeProperties: 5e3
374
+ };
375
+ case "experimental":
376
+ return {
377
+ preset,
378
+ timeoutMs: 1e4,
379
+ allowLoops: true,
380
+ allowConsole: true,
381
+ maxSteps: 2e4,
382
+ disabledBuiltins: ["eval", "Function", "AsyncFunction"],
383
+ disabledGlobals: ["require", "process"],
384
+ maxSanitizeDepth: 100,
385
+ maxSanitizeProperties: 2e4
386
+ };
387
+ case "secure":
388
+ default:
389
+ return {
390
+ preset: "secure",
391
+ timeoutMs: 3500,
392
+ allowLoops: false,
393
+ allowConsole: true,
394
+ maxSteps: 5e3,
395
+ disabledBuiltins: ["eval", "Function", "AsyncFunction"],
396
+ disabledGlobals: [
397
+ "require",
398
+ "process",
399
+ "fetch",
400
+ "setTimeout",
401
+ "setInterval",
402
+ "setImmediate",
403
+ "global",
404
+ "globalThis"
405
+ ],
406
+ maxSanitizeDepth: 50,
407
+ maxSanitizeProperties: 2e3
408
+ };
409
+ }
410
+ }
411
+
313
412
  // plugins/plugin-codecall/src/services/tool-search.service.ts
314
413
  var import_vectoriadb = require("vectoriadb");
315
414
 
@@ -1216,8 +1315,8 @@ var ToolSearchService = class _ToolSearchService {
1216
1315
  };
1217
1316
 
1218
1317
  // plugins/plugin-codecall/src/services/enclave.service.ts
1219
- var import_sdk = require("@frontmcp/sdk");
1220
1318
  var import_core = require("@enclave-vm/core");
1319
+ var import_sdk2 = require("@frontmcp/sdk");
1221
1320
  var ScriptTooLargeError = class extends Error {
1222
1321
  code = "SCRIPT_TOO_LARGE";
1223
1322
  scriptLength;
@@ -1266,6 +1365,10 @@ var EnclaveService = class {
1266
1365
  maxResolvedSize: this.sidecarOptions.maxResolvedSize,
1267
1366
  allowComposites: this.sidecarOptions.allowComposites
1268
1367
  } : void 0;
1368
+ const RESERVED_GLOBALS = /* @__PURE__ */ new Set(["getTool", "mcpLog", "mcpNotify"]);
1369
+ const safeNamespaces = Object.fromEntries(
1370
+ Object.entries(environment.namespaces ?? {}).filter(([key]) => !RESERVED_GLOBALS.has(key))
1371
+ );
1269
1372
  const enclave = new import_core.Enclave({
1270
1373
  timeout: this.vmOptions.timeoutMs,
1271
1374
  maxToolCalls: this.vmOptions.maxSteps || 100,
@@ -1279,6 +1382,11 @@ var EnclaveService = class {
1279
1382
  // Allow functions in globals since we intentionally provide getTool, mcpLog, mcpNotify, and console
1280
1383
  allowFunctionsInGlobals: true,
1281
1384
  globals: {
1385
+ // Tool namespaces (e.g. `acme.getUser`) flow through here. Spread
1386
+ // FIRST so the runtime reserved globals below are guaranteed
1387
+ // last-wins. Reserved keys have already been stripped above —
1388
+ // belt-and-braces ordering makes the invariant locally obvious.
1389
+ ...safeNamespaces,
1282
1390
  // Provide getTool as a custom global
1283
1391
  getTool: environment.getTool,
1284
1392
  // Provide logging functions if available
@@ -1375,15 +1483,15 @@ var EnclaveService = class {
1375
1483
  }
1376
1484
  };
1377
1485
  EnclaveService = __decorateClass([
1378
- (0, import_sdk.Provider)({
1486
+ (0, import_sdk2.Provider)({
1379
1487
  name: "codecall:enclave",
1380
1488
  description: "Executes AgentScript code in a secure enclave",
1381
- scope: import_sdk.ProviderScope.GLOBAL
1489
+ scope: import_sdk2.ProviderScope.GLOBAL
1382
1490
  })
1383
1491
  ], EnclaveService);
1384
1492
 
1385
1493
  // plugins/plugin-codecall/src/tools/search.tool.ts
1386
- var import_sdk2 = require("@frontmcp/sdk");
1494
+ var import_sdk3 = require("@frontmcp/sdk");
1387
1495
 
1388
1496
  // plugins/plugin-codecall/src/tools/search.schema.ts
1389
1497
  var import_lazy_zod2 = require("@frontmcp/lazy-zod");
@@ -1433,7 +1541,7 @@ var searchToolOutputSchema = import_lazy_zod2.z.object({
1433
1541
  });
1434
1542
 
1435
1543
  // plugins/plugin-codecall/src/tools/search.tool.ts
1436
- var SearchTool = class extends import_sdk2.ToolContext {
1544
+ var SearchTool = class extends import_sdk3.ToolContext {
1437
1545
  async execute(input) {
1438
1546
  const { queries, appIds, excludeToolNames = [], topK = 5, minRelevanceScore = 0.3 } = input;
1439
1547
  const searchService = this.get(ToolSearchService);
@@ -1501,7 +1609,7 @@ var SearchTool = class extends import_sdk2.ToolContext {
1501
1609
  }
1502
1610
  };
1503
1611
  SearchTool = __decorateClass([
1504
- (0, import_sdk2.Tool)({
1612
+ (0, import_sdk3.Tool)({
1505
1613
  name: "codecall:search",
1506
1614
  cache: {
1507
1615
  ttl: 60,
@@ -1522,9 +1630,294 @@ SearchTool = __decorateClass([
1522
1630
  })
1523
1631
  ], SearchTool);
1524
1632
 
1525
- // plugins/plugin-codecall/src/tools/describe.tool.ts
1633
+ // plugins/plugin-codecall/src/tools/search-skills.tool.ts
1634
+ var import_sdk4 = require("@frontmcp/sdk");
1635
+
1636
+ // plugins/plugin-codecall/src/tools/search-skills.schema.ts
1637
+ var import_lazy_zod3 = require("@frontmcp/lazy-zod");
1638
+ var searchSkillsToolDescription = `Search for EXECUTABLE skills. Each result returns the skill's description, tags, and the openapi operation IDs it can call from within AgentScript.
1639
+
1640
+ DECOMPOSE complex requests into atomic queries. AVOID re-searching: use excludeSkillNames.
1641
+
1642
+ INPUT:
1643
+ - queries: string[] (required) - atomic skill descriptions, max 10
1644
+ - tags?: string[] - filter to skills carrying any of these tags
1645
+ - excludeSkillNames?: string[] - skip already-discovered skills
1646
+ - topK?: number (default 5) - results per query
1647
+ - minRelevanceScore?: number (default 0.1) - minimum match threshold
1648
+
1649
+ OUTPUT: Flat deduplicated executable skill list. Each entry includes the operationIds the skill is allowed to call (via the markdown harvester). The agent can use those operationIds directly in execute() AgentScript via the generated namespaces (e.g. acme.getOrder({...})).
1650
+
1651
+ FLOW: searchSkills \u2192 describe \u2192 execute`;
1652
+ var searchSkillsToolInputSchema = {
1653
+ queries: import_lazy_zod3.z.array(import_lazy_zod3.z.string().min(2).max(256)).min(1).max(10).describe("Atomic skill queries. Split complex requests into simple actions."),
1654
+ tags: import_lazy_zod3.z.array(import_lazy_zod3.z.string().min(1).max(64)).max(16).optional().describe("Filter to skills with any of these tags"),
1655
+ excludeSkillNames: import_lazy_zod3.z.array(import_lazy_zod3.z.string()).max(50).optional().describe("Skip already-known skill names"),
1656
+ topK: import_lazy_zod3.z.number().int().positive().max(50).optional().default(5).describe("Results per query (default 5)"),
1657
+ minRelevanceScore: import_lazy_zod3.z.number().min(0).max(1).optional().default(0.1).describe("Minimum relevance threshold (default 0.1)")
1658
+ };
1659
+ var referencedOperationSchema = import_lazy_zod3.z.object({
1660
+ spec: import_lazy_zod3.z.string().describe('OpenAPI spec id (e.g. "acme")'),
1661
+ operationId: import_lazy_zod3.z.string().describe('OpenAPI operation id (e.g. "getOrder")')
1662
+ });
1663
+ var skillSearchHitSchema = import_lazy_zod3.z.object({
1664
+ name: import_lazy_zod3.z.string().describe("Skill name"),
1665
+ description: import_lazy_zod3.z.string().describe("Short description of what the skill does"),
1666
+ tags: import_lazy_zod3.z.array(import_lazy_zod3.z.string()).describe("Tags carried by the skill"),
1667
+ /**
1668
+ * OpenAPI operations the skill is allowed to call. Inlined so the agent
1669
+ * can author AgentScript from a single search response.
1670
+ */
1671
+ operations: import_lazy_zod3.z.array(referencedOperationSchema).describe("OpenAPI operations the skill can call"),
1672
+ /** Decorator-declared tools (for skills built the legacy way). */
1673
+ tools: import_lazy_zod3.z.array(import_lazy_zod3.z.string()).describe("Tool names the skill declares (if any)"),
1674
+ relevanceScore: import_lazy_zod3.z.number().min(0).max(1).describe("Match score (0-1)"),
1675
+ matchedQueries: import_lazy_zod3.z.array(import_lazy_zod3.z.string()).describe("Which queries matched this skill"),
1676
+ source: import_lazy_zod3.z.enum(["local", "external"]).describe("Where the skill was loaded from")
1677
+ });
1678
+ var searchSkillsToolOutputSchema = import_lazy_zod3.z.object({
1679
+ skills: import_lazy_zod3.z.array(skillSearchHitSchema).describe("Deduplicated executable skills, sorted by relevance"),
1680
+ warnings: import_lazy_zod3.z.array(
1681
+ import_lazy_zod3.z.object({
1682
+ type: import_lazy_zod3.z.enum(["no_results", "low_relevance", "excluded_skill_not_found"]).describe("Warning type"),
1683
+ message: import_lazy_zod3.z.string().describe("Warning message"),
1684
+ affectedSkills: import_lazy_zod3.z.array(import_lazy_zod3.z.string()).optional().describe("Affected skill names")
1685
+ })
1686
+ ).describe("Search warnings"),
1687
+ totalExecutableSkills: import_lazy_zod3.z.number().int().nonnegative().describe("Total executable skills available")
1688
+ });
1689
+
1690
+ // plugins/plugin-codecall/src/tools/search-skills.tool.ts
1691
+ var SearchSkillsTool = class extends import_sdk4.ToolContext {
1692
+ async execute(input) {
1693
+ const { queries, tags, excludeSkillNames = [], topK = 5, minRelevanceScore = 0.1 } = input;
1694
+ const skillRegistry = this.scope.skills;
1695
+ const executableSkills = skillRegistry.getExecutableSkills();
1696
+ const executableSet = new Set(executableSkills.map((s) => s.name));
1697
+ const totalExecutableSkills = executableSkills.length;
1698
+ const warnings = [];
1699
+ const nonExistentExcluded = excludeSkillNames.filter((n) => !executableSet.has(n));
1700
+ if (nonExistentExcluded.length > 0) {
1701
+ warnings.push({
1702
+ type: "excluded_skill_not_found",
1703
+ message: `Excluded skills not found: ${nonExistentExcluded.join(", ")}`,
1704
+ affectedSkills: nonExistentExcluded
1705
+ });
1706
+ }
1707
+ const matches = /* @__PURE__ */ new Map();
1708
+ let lowRelevanceCount = 0;
1709
+ const excludedSet = new Set(excludeSkillNames);
1710
+ const perQueryResults = await Promise.all(
1711
+ queries.map(
1712
+ (query) => skillRegistry.search(query, { topK, tags, minScore: minRelevanceScore }).then((results) => ({ query, results }))
1713
+ )
1714
+ );
1715
+ for (const { query, results } of perQueryResults) {
1716
+ for (const result of results) {
1717
+ const name = result.metadata.name;
1718
+ if (!executableSet.has(name)) continue;
1719
+ if (excludedSet.has(name)) continue;
1720
+ if (result.score < minRelevanceScore) {
1721
+ lowRelevanceCount++;
1722
+ continue;
1723
+ }
1724
+ const existing = matches.get(name);
1725
+ if (existing) {
1726
+ existing.matchedQueries.push(query);
1727
+ existing.relevanceScore = Math.max(existing.relevanceScore, result.score);
1728
+ } else {
1729
+ const ops = result.metadata.referencedOperations ?? [];
1730
+ const toolNames = (result.metadata.tools ?? []).map((t) => {
1731
+ if (typeof t === "string") return t;
1732
+ if (typeof t === "object" && t !== null && "name" in t) return t.name;
1733
+ return null;
1734
+ }).filter((n) => typeof n === "string");
1735
+ matches.set(name, {
1736
+ name,
1737
+ description: result.metadata.description,
1738
+ tags: result.metadata.tags ?? [],
1739
+ operations: ops.map((op) => ({ spec: op.spec, operationId: op.operationId })),
1740
+ tools: toolNames,
1741
+ relevanceScore: result.score,
1742
+ matchedQueries: [query],
1743
+ source: result.source
1744
+ });
1745
+ }
1746
+ }
1747
+ }
1748
+ const skills = Array.from(matches.values()).sort((a, b) => b.relevanceScore - a.relevanceScore);
1749
+ if (skills.length === 0) {
1750
+ warnings.push({
1751
+ type: "no_results",
1752
+ message: `No executable skills found for queries: ${queries.join(", ")}${tags?.length ? ` with tags: ${tags.join(", ")}` : ""}`
1753
+ });
1754
+ }
1755
+ if (lowRelevanceCount > 0 && skills.length > 0) {
1756
+ warnings.push({
1757
+ type: "low_relevance",
1758
+ message: `${lowRelevanceCount} result(s) filtered due to relevance below ${minRelevanceScore}`
1759
+ });
1760
+ }
1761
+ return { skills, warnings, totalExecutableSkills };
1762
+ }
1763
+ };
1764
+ SearchSkillsTool = __decorateClass([
1765
+ (0, import_sdk4.Tool)({
1766
+ name: "codecall:searchSkills",
1767
+ cache: {
1768
+ ttl: 60,
1769
+ slideWindow: false
1770
+ },
1771
+ codecall: {
1772
+ enabledInCodeCall: false,
1773
+ visibleInListTools: true
1774
+ },
1775
+ description: searchSkillsToolDescription,
1776
+ inputSchema: searchSkillsToolInputSchema,
1777
+ outputSchema: searchSkillsToolOutputSchema,
1778
+ annotations: {
1779
+ readOnlyHint: true,
1780
+ openWorldHint: true
1781
+ }
1782
+ })
1783
+ ], SearchSkillsTool);
1784
+
1785
+ // plugins/plugin-codecall/src/tools/search-knowledge.tool.ts
1786
+ var import_sdk5 = require("@frontmcp/sdk");
1787
+
1788
+ // plugins/plugin-codecall/src/tools/search-knowledge.schema.ts
1526
1789
  var import_lazy_zod4 = require("@frontmcp/lazy-zod");
1527
- var import_sdk3 = require("@frontmcp/sdk");
1790
+ var searchKnowledgeToolDescription = `Search for KNOWLEDGE-ONLY skills \u2014 domain context the agent should read before deciding what to do. These skills have no tools and no openapi operation refs; they are pure prose / references / examples.
1791
+
1792
+ USE WHEN: the agent needs background to interpret a request, validate eligibility, or recall a procedure that isn't yet executable.
1793
+
1794
+ INPUT:
1795
+ - queries: string[] (required) - atomic context queries, max 10
1796
+ - tags?: string[] - filter to knowledge carrying any of these tags
1797
+ - excludeSkillNames?: string[] - skip already-loaded knowledge
1798
+ - topK?: number (default 5) - results per query
1799
+ - minRelevanceScore?: number (default 0.1) - minimum match threshold
1800
+
1801
+ OUTPUT: Deduplicated knowledge skill list with description + tags. To read the body, follow up with describe(skillName) or the skill:// resource URI.
1802
+
1803
+ FLOW: searchKnowledge \u2192 describe (for body) \u2192 continue with searchSkills`;
1804
+ var searchKnowledgeToolInputSchema = {
1805
+ queries: import_lazy_zod4.z.array(import_lazy_zod4.z.string().min(2).max(256)).min(1).max(10).describe("Atomic context queries."),
1806
+ tags: import_lazy_zod4.z.array(import_lazy_zod4.z.string().min(1).max(64)).max(16).optional().describe("Filter to skills with any of these tags"),
1807
+ excludeSkillNames: import_lazy_zod4.z.array(import_lazy_zod4.z.string()).max(50).optional().describe("Skip already-loaded knowledge skill names"),
1808
+ topK: import_lazy_zod4.z.number().int().positive().max(50).optional().default(5).describe("Results per query (default 5)"),
1809
+ minRelevanceScore: import_lazy_zod4.z.number().min(0).max(1).optional().default(0.1).describe("Minimum relevance threshold (default 0.1)")
1810
+ };
1811
+ var knowledgeHitSchema = import_lazy_zod4.z.object({
1812
+ name: import_lazy_zod4.z.string().describe("Skill name"),
1813
+ description: import_lazy_zod4.z.string().describe("Short description of what the knowledge covers"),
1814
+ tags: import_lazy_zod4.z.array(import_lazy_zod4.z.string()).describe("Tags carried by the skill"),
1815
+ relevanceScore: import_lazy_zod4.z.number().min(0).max(1).describe("Match score (0-1)"),
1816
+ matchedQueries: import_lazy_zod4.z.array(import_lazy_zod4.z.string()).describe("Which queries matched this knowledge"),
1817
+ source: import_lazy_zod4.z.enum(["local", "external"]).describe("Where the skill was loaded from")
1818
+ });
1819
+ var searchKnowledgeToolOutputSchema = import_lazy_zod4.z.object({
1820
+ knowledge: import_lazy_zod4.z.array(knowledgeHitSchema).describe("Deduplicated knowledge skills, sorted by relevance"),
1821
+ warnings: import_lazy_zod4.z.array(
1822
+ import_lazy_zod4.z.object({
1823
+ type: import_lazy_zod4.z.enum(["no_results", "low_relevance", "excluded_skill_not_found"]).describe("Warning type"),
1824
+ message: import_lazy_zod4.z.string().describe("Warning message"),
1825
+ affectedSkills: import_lazy_zod4.z.array(import_lazy_zod4.z.string()).optional().describe("Affected skill names")
1826
+ })
1827
+ ).describe("Search warnings"),
1828
+ totalKnowledgeSkills: import_lazy_zod4.z.number().int().nonnegative().describe("Total knowledge-only skills available")
1829
+ });
1830
+
1831
+ // plugins/plugin-codecall/src/tools/search-knowledge.tool.ts
1832
+ var SearchKnowledgeTool = class extends import_sdk5.ToolContext {
1833
+ async execute(input) {
1834
+ const { queries, tags, excludeSkillNames = [], topK = 5, minRelevanceScore = 0.1 } = input;
1835
+ const skillRegistry = this.scope.skills;
1836
+ const knowledgeSkills = skillRegistry.getKnowledgeOnlySkills();
1837
+ const knowledgeSet = new Set(knowledgeSkills.map((s) => s.name));
1838
+ const totalKnowledgeSkills = knowledgeSkills.length;
1839
+ const warnings = [];
1840
+ const nonExistentExcluded = excludeSkillNames.filter((n) => !knowledgeSet.has(n));
1841
+ if (nonExistentExcluded.length > 0) {
1842
+ warnings.push({
1843
+ type: "excluded_skill_not_found",
1844
+ message: `Excluded knowledge skills not found: ${nonExistentExcluded.join(", ")}`,
1845
+ affectedSkills: nonExistentExcluded
1846
+ });
1847
+ }
1848
+ const matches = /* @__PURE__ */ new Map();
1849
+ let lowRelevanceCount = 0;
1850
+ const excludedSet = new Set(excludeSkillNames);
1851
+ const perQueryResults = await Promise.all(
1852
+ queries.map(
1853
+ (query) => skillRegistry.search(query, { topK, tags, minScore: minRelevanceScore }).then((results) => ({ query, results }))
1854
+ )
1855
+ );
1856
+ for (const { query, results } of perQueryResults) {
1857
+ for (const result of results) {
1858
+ const name = result.metadata.name;
1859
+ if (!knowledgeSet.has(name)) continue;
1860
+ if (excludedSet.has(name)) continue;
1861
+ if (result.score < minRelevanceScore) {
1862
+ lowRelevanceCount++;
1863
+ continue;
1864
+ }
1865
+ const existing = matches.get(name);
1866
+ if (existing) {
1867
+ existing.matchedQueries.push(query);
1868
+ existing.relevanceScore = Math.max(existing.relevanceScore, result.score);
1869
+ } else {
1870
+ matches.set(name, {
1871
+ name,
1872
+ description: result.metadata.description,
1873
+ tags: result.metadata.tags ?? [],
1874
+ relevanceScore: result.score,
1875
+ matchedQueries: [query],
1876
+ source: result.source
1877
+ });
1878
+ }
1879
+ }
1880
+ }
1881
+ const knowledge = Array.from(matches.values()).sort((a, b) => b.relevanceScore - a.relevanceScore);
1882
+ if (knowledge.length === 0) {
1883
+ warnings.push({
1884
+ type: "no_results",
1885
+ message: `No knowledge skills found for queries: ${queries.join(", ")}${tags?.length ? ` with tags: ${tags.join(", ")}` : ""}`
1886
+ });
1887
+ }
1888
+ if (lowRelevanceCount > 0 && knowledge.length > 0) {
1889
+ warnings.push({
1890
+ type: "low_relevance",
1891
+ message: `${lowRelevanceCount} result(s) filtered due to relevance below ${minRelevanceScore}`
1892
+ });
1893
+ }
1894
+ return { knowledge, warnings, totalKnowledgeSkills };
1895
+ }
1896
+ };
1897
+ SearchKnowledgeTool = __decorateClass([
1898
+ (0, import_sdk5.Tool)({
1899
+ name: "codecall:searchKnowledge",
1900
+ cache: {
1901
+ ttl: 60,
1902
+ slideWindow: false
1903
+ },
1904
+ codecall: {
1905
+ enabledInCodeCall: false,
1906
+ visibleInListTools: true
1907
+ },
1908
+ description: searchKnowledgeToolDescription,
1909
+ inputSchema: searchKnowledgeToolInputSchema,
1910
+ outputSchema: searchKnowledgeToolOutputSchema,
1911
+ annotations: {
1912
+ readOnlyHint: true,
1913
+ openWorldHint: true
1914
+ }
1915
+ })
1916
+ ], SearchKnowledgeTool);
1917
+
1918
+ // plugins/plugin-codecall/src/tools/describe.tool.ts
1919
+ var import_lazy_zod6 = require("@frontmcp/lazy-zod");
1920
+ var import_sdk6 = require("@frontmcp/sdk");
1528
1921
 
1529
1922
  // plugins/plugin-codecall/src/errors/tool-call.errors.ts
1530
1923
  var TOOL_CALL_ERROR_CODES = {
@@ -1604,6 +1997,70 @@ function assertNotSelfReference(toolName) {
1604
1997
  }
1605
1998
  }
1606
1999
 
2000
+ // plugins/plugin-codecall/src/utils/build-tool-namespaces.ts
2001
+ var IDENT_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
2002
+ var RESERVED_NAMESPACES = /* @__PURE__ */ new Set([
2003
+ "console",
2004
+ "Math",
2005
+ "JSON",
2006
+ "Object",
2007
+ "Array",
2008
+ "String",
2009
+ "Number",
2010
+ "Boolean",
2011
+ "Promise",
2012
+ "Symbol",
2013
+ "Map",
2014
+ "Set",
2015
+ "WeakMap",
2016
+ "WeakSet",
2017
+ "Date",
2018
+ "Error",
2019
+ "RegExp",
2020
+ "globalThis",
2021
+ "global",
2022
+ "window",
2023
+ "self",
2024
+ "undefined",
2025
+ "null",
2026
+ "true",
2027
+ "false",
2028
+ "callTool",
2029
+ "getTool",
2030
+ "mcpLog",
2031
+ "mcpNotify"
2032
+ ]);
2033
+ function buildToolNamespaces(tools, callTool) {
2034
+ const namespaces = {};
2035
+ const skipped = [];
2036
+ for (const tool of tools) {
2037
+ const name = tool?.name;
2038
+ if (typeof name !== "string" || name.length === 0) continue;
2039
+ const dot = name.indexOf(".");
2040
+ if (dot <= 0 || dot === name.length - 1) {
2041
+ skipped.push({ name, reason: "no-namespace-prefix" });
2042
+ continue;
2043
+ }
2044
+ const ns = name.slice(0, dot);
2045
+ const method = name.slice(dot + 1);
2046
+ if (!IDENT_RE.test(ns) || !IDENT_RE.test(method)) {
2047
+ skipped.push({ name, reason: "invalid-identifier" });
2048
+ continue;
2049
+ }
2050
+ if (RESERVED_NAMESPACES.has(ns)) {
2051
+ skipped.push({ name, reason: "reserved-namespace" });
2052
+ continue;
2053
+ }
2054
+ const bucket = namespaces[ns] ?? (namespaces[ns] = {});
2055
+ if (Object.prototype.hasOwnProperty.call(bucket, method)) {
2056
+ skipped.push({ name, reason: "duplicate-method" });
2057
+ continue;
2058
+ }
2059
+ bucket[method] = (input, options) => callTool(name, input, options);
2060
+ }
2061
+ return { namespaces, skipped };
2062
+ }
2063
+
1607
2064
  // plugins/plugin-codecall/src/utils/describe.utils.ts
1608
2065
  var INTENT_PATTERNS = {
1609
2066
  create: /^(create|add|new|insert|make|append|register|generate|produce|build|construct|provision|instantiate|define|compose|draft)/i,
@@ -1893,7 +2350,7 @@ function extractResultFromCallToolResult(mcpResult) {
1893
2350
  }
1894
2351
 
1895
2352
  // plugins/plugin-codecall/src/tools/describe.schema.ts
1896
- var import_lazy_zod3 = require("@frontmcp/lazy-zod");
2353
+ var import_lazy_zod5 = require("@frontmcp/lazy-zod");
1897
2354
  var import_protocol = require("@frontmcp/protocol");
1898
2355
  var describeToolDescription = `Get input/output schemas for tools from search results.
1899
2356
 
@@ -1903,7 +2360,7 @@ OUTPUT per tool: inputSchema (JSON Schema), outputSchema (JSON Schema), usageExa
1903
2360
  IMPORTANT: If notFound array is non-empty \u2192 re-search with corrected queries.
1904
2361
  FLOW: search \u2192 describe \u2192 execute/invoke`;
1905
2362
  var describeToolInputSchema = {
1906
- toolNames: import_lazy_zod3.z.array(import_lazy_zod3.z.string()).min(1).superRefine((toolNames, ctx) => {
2363
+ toolNames: import_lazy_zod5.z.array(import_lazy_zod5.z.string()).min(1).superRefine((toolNames, ctx) => {
1907
2364
  const seen = /* @__PURE__ */ new Set();
1908
2365
  const duplicates = /* @__PURE__ */ new Set();
1909
2366
  for (const name of toolNames) {
@@ -1914,7 +2371,7 @@ var describeToolInputSchema = {
1914
2371
  }
1915
2372
  if (duplicates.size > 0) {
1916
2373
  ctx.addIssue({
1917
- code: import_lazy_zod3.z.ZodIssueCode.custom,
2374
+ code: import_lazy_zod5.z.ZodIssueCode.custom,
1918
2375
  message: `Duplicate tool names are not allowed: ${Array.from(duplicates).join(", ")}`
1919
2376
  });
1920
2377
  }
@@ -1922,30 +2379,30 @@ var describeToolInputSchema = {
1922
2379
  'Array of unique tool names (from codecall:search results) to fetch their detailed schemas and usage examples. Example: ["users:list", "billing:getInvoice"]'
1923
2380
  )
1924
2381
  };
1925
- var describeToolOutputSchema = import_lazy_zod3.z.object({
1926
- tools: import_lazy_zod3.z.array(
1927
- import_lazy_zod3.z.object({
1928
- name: import_lazy_zod3.z.string().describe("Tool name to be used in callTool() within codecall:execute scripts"),
1929
- appId: import_lazy_zod3.z.string().describe("The app ID this tool belongs to"),
1930
- description: import_lazy_zod3.z.string().describe("Detailed description of what this tool does"),
1931
- inputSchema: import_lazy_zod3.z.record(import_lazy_zod3.z.string(), import_lazy_zod3.z.unknown()).nullable().describe("JSON Schema object describing the tool input parameters"),
1932
- outputSchema: import_lazy_zod3.z.record(import_lazy_zod3.z.string(), import_lazy_zod3.z.unknown()).nullable().describe("JSON Schema object describing the tool output structure"),
2382
+ var describeToolOutputSchema = import_lazy_zod5.z.object({
2383
+ tools: import_lazy_zod5.z.array(
2384
+ import_lazy_zod5.z.object({
2385
+ name: import_lazy_zod5.z.string().describe("Tool name to be used in callTool() within codecall:execute scripts"),
2386
+ appId: import_lazy_zod5.z.string().describe("The app ID this tool belongs to"),
2387
+ description: import_lazy_zod5.z.string().describe("Detailed description of what this tool does"),
2388
+ inputSchema: import_lazy_zod5.z.record(import_lazy_zod5.z.string(), import_lazy_zod5.z.unknown()).nullable().describe("JSON Schema object describing the tool input parameters"),
2389
+ outputSchema: import_lazy_zod5.z.record(import_lazy_zod5.z.string(), import_lazy_zod5.z.unknown()).nullable().describe("JSON Schema object describing the tool output structure"),
1933
2390
  annotations: import_protocol.ToolAnnotationsSchema.optional().describe("MCP tool annotations (metadata)"),
1934
- usageExamples: import_lazy_zod3.z.array(
1935
- import_lazy_zod3.z.object({
1936
- description: import_lazy_zod3.z.string().describe("Description of what this example demonstrates"),
1937
- code: import_lazy_zod3.z.string().describe(
2391
+ usageExamples: import_lazy_zod5.z.array(
2392
+ import_lazy_zod5.z.object({
2393
+ description: import_lazy_zod5.z.string().describe("Description of what this example demonstrates"),
2394
+ code: import_lazy_zod5.z.string().describe(
1938
2395
  'JavaScript code example showing how to call this tool using callTool(). Format: const result = await callTool("tool:name", { ...params });'
1939
2396
  )
1940
2397
  })
1941
2398
  ).max(5).describe("Up to 5 practical examples of how to use this tool in a codecall:execute script")
1942
2399
  })
1943
2400
  ).describe("Array of tool descriptions with schemas and usage examples"),
1944
- notFound: import_lazy_zod3.z.array(import_lazy_zod3.z.string()).optional().describe("Tool names that were requested but not found in the index. Check these for typos.")
2401
+ notFound: import_lazy_zod5.z.array(import_lazy_zod5.z.string()).optional().describe("Tool names that were requested but not found in the index. Check these for typos.")
1945
2402
  });
1946
2403
 
1947
2404
  // plugins/plugin-codecall/src/tools/describe.tool.ts
1948
- var DescribeTool = class extends import_sdk3.ToolContext {
2405
+ var DescribeTool = class extends import_sdk6.ToolContext {
1949
2406
  async execute(input) {
1950
2407
  const { toolNames } = input;
1951
2408
  const tools = [];
@@ -1965,7 +2422,7 @@ var DescribeTool = class extends import_sdk3.ToolContext {
1965
2422
  }
1966
2423
  const appId = this.extractAppId(tool);
1967
2424
  const inputSchema = this.getInputSchema(tool);
1968
- const outputSchema = this.toJsonSchema(tool.outputSchema);
2425
+ const outputSchema = this.toJsonSchema(tool.rawOutputSchema ?? tool.outputSchema);
1969
2426
  const usageExamples = this.generateExamples(tool, inputSchema ?? void 0);
1970
2427
  tools.push({
1971
2428
  name: tool.name,
@@ -1995,8 +2452,8 @@ var DescribeTool = class extends import_sdk3.ToolContext {
1995
2452
  if (tool.inputSchema && typeof tool.inputSchema === "object" && Object.keys(tool.inputSchema).length > 0) {
1996
2453
  try {
1997
2454
  const firstValue = Object.values(tool.inputSchema)[0];
1998
- if (firstValue instanceof import_lazy_zod4.ZodType) {
1999
- return (0, import_lazy_zod4.toJSONSchema)(import_lazy_zod4.z.object(tool.inputSchema));
2455
+ if (firstValue instanceof import_lazy_zod6.ZodType) {
2456
+ return (0, import_lazy_zod6.toJSONSchema)(import_lazy_zod6.z.object(tool.inputSchema));
2000
2457
  }
2001
2458
  } catch {
2002
2459
  }
@@ -2016,9 +2473,9 @@ var DescribeTool = class extends import_sdk3.ToolContext {
2016
2473
  if (!schema) {
2017
2474
  return null;
2018
2475
  }
2019
- if (schema instanceof import_lazy_zod4.ZodType) {
2476
+ if (schema instanceof import_lazy_zod6.ZodType) {
2020
2477
  try {
2021
- return (0, import_lazy_zod4.toJSONSchema)(schema);
2478
+ return (0, import_lazy_zod6.toJSONSchema)(schema);
2022
2479
  } catch {
2023
2480
  return null;
2024
2481
  }
@@ -2026,9 +2483,9 @@ var DescribeTool = class extends import_sdk3.ToolContext {
2026
2483
  if (typeof schema === "object" && schema !== null && !Array.isArray(schema)) {
2027
2484
  const obj = schema;
2028
2485
  const firstValue = Object.values(obj)[0];
2029
- if (firstValue instanceof import_lazy_zod4.ZodType) {
2486
+ if (firstValue instanceof import_lazy_zod6.ZodType) {
2030
2487
  try {
2031
- return (0, import_lazy_zod4.toJSONSchema)(import_lazy_zod4.z.object(obj));
2488
+ return (0, import_lazy_zod6.toJSONSchema)(import_lazy_zod6.z.object(obj));
2032
2489
  } catch {
2033
2490
  return null;
2034
2491
  }
@@ -2091,7 +2548,7 @@ return result;`
2091
2548
  }
2092
2549
  };
2093
2550
  DescribeTool = __decorateClass([
2094
- (0, import_sdk3.Tool)({
2551
+ (0, import_sdk6.Tool)({
2095
2552
  name: "codecall:describe",
2096
2553
  cache: {
2097
2554
  ttl: 60,
@@ -2113,10 +2570,10 @@ DescribeTool = __decorateClass([
2113
2570
  ], DescribeTool);
2114
2571
 
2115
2572
  // plugins/plugin-codecall/src/tools/execute.tool.ts
2116
- var import_sdk5 = require("@frontmcp/sdk");
2573
+ var import_sdk7 = require("@frontmcp/sdk");
2117
2574
 
2118
2575
  // plugins/plugin-codecall/src/tools/execute.schema.ts
2119
- var import_lazy_zod5 = require("@frontmcp/lazy-zod");
2576
+ var import_lazy_zod7 = require("@frontmcp/lazy-zod");
2120
2577
  var MIN_EXECUTE_SCRIPT_LENGTH = 'return callTool("a",{})'.length;
2121
2578
  var executeToolDescription = `Execute AgentScript (safe JS subset) for multi-tool orchestration.
2122
2579
 
@@ -2140,72 +2597,72 @@ ERRORS: NOT_FOUND | VALIDATION | EXECUTION | TIMEOUT | ACCESS_DENIED
2140
2597
  STATUS: ok | syntax_error | illegal_access | runtime_error | tool_error | timeout
2141
2598
  LIMITS: 10K iter/loop, 30s timeout, 100 calls max`;
2142
2599
  var executeToolInputSchema = {
2143
- script: import_lazy_zod5.z.string().min(MIN_EXECUTE_SCRIPT_LENGTH).max(100 * 1024).describe(
2600
+ script: import_lazy_zod7.z.string().min(MIN_EXECUTE_SCRIPT_LENGTH).max(100 * 1024).describe(
2144
2601
  "JavaScript code to execute in the sandbox. Must return a value (implicitly or via explicit return). Use callTool(name, input) to invoke tools."
2145
2602
  ),
2146
- allowedTools: import_lazy_zod5.z.array(import_lazy_zod5.z.string()).optional().describe(
2603
+ allowedTools: import_lazy_zod7.z.array(import_lazy_zod7.z.string()).optional().describe(
2147
2604
  'Optional whitelist of tool names that can be called from this script. If not provided, all indexed tools are available. Example: ["users:list", "billing:getInvoice"]'
2148
2605
  )
2149
2606
  };
2150
- var syntaxErrorPayloadSchema = import_lazy_zod5.z.object({
2151
- message: import_lazy_zod5.z.string(),
2152
- location: import_lazy_zod5.z.object({
2153
- line: import_lazy_zod5.z.number(),
2154
- column: import_lazy_zod5.z.number()
2607
+ var syntaxErrorPayloadSchema = import_lazy_zod7.z.object({
2608
+ message: import_lazy_zod7.z.string(),
2609
+ location: import_lazy_zod7.z.object({
2610
+ line: import_lazy_zod7.z.number(),
2611
+ column: import_lazy_zod7.z.number()
2155
2612
  }).optional()
2156
2613
  });
2157
- var illegalAccessErrorPayloadSchema = import_lazy_zod5.z.object({
2158
- message: import_lazy_zod5.z.string(),
2159
- kind: import_lazy_zod5.z.union([
2160
- import_lazy_zod5.z.literal("IllegalBuiltinAccess"),
2161
- import_lazy_zod5.z.literal("DisallowedGlobal"),
2162
- import_lazy_zod5.z.string()
2614
+ var illegalAccessErrorPayloadSchema = import_lazy_zod7.z.object({
2615
+ message: import_lazy_zod7.z.string(),
2616
+ kind: import_lazy_zod7.z.union([
2617
+ import_lazy_zod7.z.literal("IllegalBuiltinAccess"),
2618
+ import_lazy_zod7.z.literal("DisallowedGlobal"),
2619
+ import_lazy_zod7.z.string()
2163
2620
  // same as your original type: 'A' | 'B' | string
2164
2621
  ])
2165
2622
  });
2166
- var runtimeErrorPayloadSchema = import_lazy_zod5.z.object({
2167
- source: import_lazy_zod5.z.literal("script"),
2168
- message: import_lazy_zod5.z.string(),
2169
- name: import_lazy_zod5.z.string().optional(),
2170
- stack: import_lazy_zod5.z.string().optional()
2623
+ var runtimeErrorPayloadSchema = import_lazy_zod7.z.object({
2624
+ source: import_lazy_zod7.z.literal("script"),
2625
+ message: import_lazy_zod7.z.string(),
2626
+ name: import_lazy_zod7.z.string().optional(),
2627
+ stack: import_lazy_zod7.z.string().optional()
2171
2628
  });
2172
- var toolErrorPayloadSchema = import_lazy_zod5.z.object({
2173
- source: import_lazy_zod5.z.literal("tool"),
2174
- toolName: import_lazy_zod5.z.string(),
2175
- toolInput: import_lazy_zod5.z.unknown(),
2176
- message: import_lazy_zod5.z.string(),
2177
- code: import_lazy_zod5.z.string().optional(),
2178
- details: import_lazy_zod5.z.unknown().optional()
2629
+ var toolErrorPayloadSchema = import_lazy_zod7.z.object({
2630
+ source: import_lazy_zod7.z.literal("tool"),
2631
+ toolName: import_lazy_zod7.z.string(),
2632
+ toolInput: import_lazy_zod7.z.unknown(),
2633
+ message: import_lazy_zod7.z.string(),
2634
+ code: import_lazy_zod7.z.string().optional(),
2635
+ details: import_lazy_zod7.z.unknown().optional()
2179
2636
  });
2180
- var timeoutErrorPayloadSchema = import_lazy_zod5.z.object({
2181
- message: import_lazy_zod5.z.string()
2637
+ var timeoutErrorPayloadSchema = import_lazy_zod7.z.object({
2638
+ message: import_lazy_zod7.z.string()
2182
2639
  });
2183
- var codeCallOkResultSchema = import_lazy_zod5.z.object({
2184
- status: import_lazy_zod5.z.literal("ok"),
2185
- result: import_lazy_zod5.z.unknown(),
2186
- logs: import_lazy_zod5.z.array(import_lazy_zod5.z.string()).optional()
2640
+ var codeCallOkResultSchema = import_lazy_zod7.z.object({
2641
+ status: import_lazy_zod7.z.literal("ok"),
2642
+ result: import_lazy_zod7.z.unknown(),
2643
+ logs: import_lazy_zod7.z.array(import_lazy_zod7.z.string()).optional()
2187
2644
  });
2188
- var codeCallSyntaxErrorResultSchema = import_lazy_zod5.z.object({
2189
- status: import_lazy_zod5.z.literal("syntax_error"),
2645
+ var codeCallSyntaxErrorResultSchema = import_lazy_zod7.z.object({
2646
+ status: import_lazy_zod7.z.literal("syntax_error"),
2190
2647
  error: syntaxErrorPayloadSchema
2191
2648
  });
2192
- var codeCallIllegalAccessResultSchema = import_lazy_zod5.z.object({
2193
- status: import_lazy_zod5.z.literal("illegal_access"),
2649
+ var codeCallIllegalAccessResultSchema = import_lazy_zod7.z.object({
2650
+ status: import_lazy_zod7.z.literal("illegal_access"),
2194
2651
  error: illegalAccessErrorPayloadSchema
2195
2652
  });
2196
- var codeCallRuntimeErrorResultSchema = import_lazy_zod5.z.object({
2197
- status: import_lazy_zod5.z.literal("runtime_error"),
2653
+ var codeCallRuntimeErrorResultSchema = import_lazy_zod7.z.object({
2654
+ status: import_lazy_zod7.z.literal("runtime_error"),
2198
2655
  error: runtimeErrorPayloadSchema
2199
2656
  });
2200
- var codeCallToolErrorResultSchema = import_lazy_zod5.z.object({
2201
- status: import_lazy_zod5.z.literal("tool_error"),
2657
+ var codeCallToolErrorResultSchema = import_lazy_zod7.z.object({
2658
+ status: import_lazy_zod7.z.literal("tool_error"),
2202
2659
  error: toolErrorPayloadSchema
2203
2660
  });
2204
- var codeCallTimeoutResultSchema = import_lazy_zod5.z.object({
2205
- status: import_lazy_zod5.z.literal("timeout"),
2661
+ var codeCallTimeoutResultSchema = import_lazy_zod7.z.object({
2662
+ status: import_lazy_zod7.z.literal("timeout"),
2206
2663
  error: timeoutErrorPayloadSchema
2207
2664
  });
2208
- var executeToolOutputSchema = import_lazy_zod5.z.discriminatedUnion("status", [
2665
+ var executeToolOutputSchema = import_lazy_zod7.z.discriminatedUnion("status", [
2209
2666
  codeCallOkResultSchema,
2210
2667
  codeCallSyntaxErrorResultSchema,
2211
2668
  codeCallIllegalAccessResultSchema,
@@ -2214,104 +2671,6 @@ var executeToolOutputSchema = import_lazy_zod5.z.discriminatedUnion("status", [
2214
2671
  codeCallTimeoutResultSchema
2215
2672
  ]);
2216
2673
 
2217
- // plugins/plugin-codecall/src/providers/code-call.config.ts
2218
- var import_sdk4 = require("@frontmcp/sdk");
2219
- var CodeCallConfig = class extends import_sdk4.BaseConfig {
2220
- constructor(options = {}) {
2221
- const parsedConfig = codeCallPluginOptionsSchema.parse(options);
2222
- const resolvedVm = resolveVmOptions(parsedConfig.vm);
2223
- super({ ...parsedConfig, resolvedVm });
2224
- }
2225
- };
2226
- CodeCallConfig = __decorateClass([
2227
- (0, import_sdk4.Provider)({
2228
- name: "codecall:config",
2229
- description: "CodeCall plugin configuration with validated defaults",
2230
- scope: import_sdk4.ProviderScope.GLOBAL
2231
- })
2232
- ], CodeCallConfig);
2233
- function resolveVmOptions(vmOptions) {
2234
- const preset = vmOptions?.preset ?? "secure";
2235
- const base = presetDefaults(preset);
2236
- return {
2237
- ...base,
2238
- ...vmOptions,
2239
- disabledBuiltins: vmOptions?.disabledBuiltins ?? base.disabledBuiltins,
2240
- disabledGlobals: vmOptions?.disabledGlobals ?? base.disabledGlobals
2241
- };
2242
- }
2243
- function presetDefaults(preset) {
2244
- switch (preset) {
2245
- case "locked_down":
2246
- return {
2247
- preset,
2248
- timeoutMs: 2e3,
2249
- allowLoops: false,
2250
- allowConsole: false,
2251
- maxSteps: 2e3,
2252
- disabledBuiltins: ["eval", "Function", "AsyncFunction"],
2253
- disabledGlobals: [
2254
- "require",
2255
- "process",
2256
- "fetch",
2257
- "setTimeout",
2258
- "setInterval",
2259
- "setImmediate",
2260
- "global",
2261
- "globalThis"
2262
- ],
2263
- maxSanitizeDepth: 10,
2264
- maxSanitizeProperties: 1e3
2265
- };
2266
- case "balanced":
2267
- return {
2268
- preset,
2269
- timeoutMs: 5e3,
2270
- allowLoops: true,
2271
- allowConsole: true,
2272
- maxSteps: 1e4,
2273
- disabledBuiltins: ["eval", "Function", "AsyncFunction"],
2274
- disabledGlobals: ["require", "process", "fetch"],
2275
- maxSanitizeDepth: 50,
2276
- maxSanitizeProperties: 5e3
2277
- };
2278
- case "experimental":
2279
- return {
2280
- preset,
2281
- timeoutMs: 1e4,
2282
- allowLoops: true,
2283
- allowConsole: true,
2284
- maxSteps: 2e4,
2285
- disabledBuiltins: ["eval", "Function", "AsyncFunction"],
2286
- disabledGlobals: ["require", "process"],
2287
- maxSanitizeDepth: 100,
2288
- maxSanitizeProperties: 2e4
2289
- };
2290
- case "secure":
2291
- default:
2292
- return {
2293
- preset: "secure",
2294
- timeoutMs: 3500,
2295
- allowLoops: false,
2296
- allowConsole: true,
2297
- maxSteps: 5e3,
2298
- disabledBuiltins: ["eval", "Function", "AsyncFunction"],
2299
- disabledGlobals: [
2300
- "require",
2301
- "process",
2302
- "fetch",
2303
- "setTimeout",
2304
- "setInterval",
2305
- "setImmediate",
2306
- "global",
2307
- "globalThis"
2308
- ],
2309
- maxSanitizeDepth: 50,
2310
- maxSanitizeProperties: 2e3
2311
- };
2312
- }
2313
- }
2314
-
2315
2674
  // plugins/plugin-codecall/src/tools/execute.tool.ts
2316
2675
  function getErrorCode(error) {
2317
2676
  if (!(error instanceof Error)) {
@@ -2328,7 +2687,7 @@ function getErrorCode(error) {
2328
2687
  }
2329
2688
  return TOOL_CALL_ERROR_CODES.EXECUTION;
2330
2689
  }
2331
- var ExecuteTool = class extends import_sdk5.ToolContext {
2690
+ var ExecuteTool = class extends import_sdk7.ToolContext {
2332
2691
  async execute(input) {
2333
2692
  const { script, allowedTools } = input;
2334
2693
  const allowedToolSet = allowedTools ? new Set(allowedTools) : null;
@@ -2400,6 +2759,22 @@ var ExecuteTool = class extends import_sdk5.ToolContext {
2400
2759
  this.logger?.debug("Notification sent", { event, payload });
2401
2760
  }
2402
2761
  };
2762
+ try {
2763
+ const registeredTools = this.scope.tools.getTools(true);
2764
+ const { namespaces, skipped } = buildToolNamespaces(registeredTools, environment.callTool);
2765
+ environment.namespaces = namespaces;
2766
+ if (skipped.length > 0) {
2767
+ this.logger?.debug?.("codecall: tools skipped during namespace generation", {
2768
+ count: skipped.length,
2769
+ // Cap the debug payload so a huge skip list doesn't bloat logs.
2770
+ sample: skipped.slice(0, 25)
2771
+ });
2772
+ }
2773
+ } catch (error) {
2774
+ this.logger?.warn?.("codecall: failed to build tool namespaces", {
2775
+ error: error instanceof Error ? error.message : String(error)
2776
+ });
2777
+ }
2403
2778
  const enclaveService = this.get(EnclaveService);
2404
2779
  const config = this.get(CodeCallConfig);
2405
2780
  try {
@@ -2478,7 +2853,7 @@ var ExecuteTool = class extends import_sdk5.ToolContext {
2478
2853
  }
2479
2854
  };
2480
2855
  ExecuteTool = __decorateClass([
2481
- (0, import_sdk5.Tool)({
2856
+ (0, import_sdk7.Tool)({
2482
2857
  name: "codecall:execute",
2483
2858
  cache: {
2484
2859
  ttl: 0,
@@ -2496,10 +2871,10 @@ ExecuteTool = __decorateClass([
2496
2871
  ], ExecuteTool);
2497
2872
 
2498
2873
  // plugins/plugin-codecall/src/tools/invoke.tool.ts
2499
- var import_sdk6 = require("@frontmcp/sdk");
2874
+ var import_sdk8 = require("@frontmcp/sdk");
2500
2875
 
2501
2876
  // plugins/plugin-codecall/src/tools/invoke.schema.ts
2502
- var import_lazy_zod6 = require("@frontmcp/lazy-zod");
2877
+ var import_lazy_zod8 = require("@frontmcp/lazy-zod");
2503
2878
  var import_protocol2 = require("@frontmcp/protocol");
2504
2879
  var invokeToolDescription = `Call ONE tool directly. Returns standard MCP CallToolResult.
2505
2880
 
@@ -2512,10 +2887,10 @@ ERRORS: tool_not_found (\u2192 re-search) | validation_error | execution_error |
2512
2887
 
2513
2888
  FLOW: search \u2192 describe \u2192 invoke`;
2514
2889
  var invokeToolInputSchema = {
2515
- tool: import_lazy_zod6.z.string().describe(
2890
+ tool: import_lazy_zod8.z.string().describe(
2516
2891
  'The name of the tool to invoke (e.g., "users:getById", "billing:getInvoice"). Must be a tool you discovered via codecall:search.'
2517
2892
  ),
2518
- input: import_lazy_zod6.z.record(import_lazy_zod6.z.string(), import_lazy_zod6.z.unknown()).describe(
2893
+ input: import_lazy_zod8.z.record(import_lazy_zod8.z.string(), import_lazy_zod8.z.unknown()).describe(
2519
2894
  "The input parameters for the tool. Structure must match the tool's input schema (check codecall:describe for schema details)."
2520
2895
  )
2521
2896
  };
@@ -2528,7 +2903,7 @@ function buildErrorResult(message) {
2528
2903
  isError: true
2529
2904
  };
2530
2905
  }
2531
- var InvokeTool = class extends import_sdk6.ToolContext {
2906
+ var InvokeTool = class extends import_sdk8.ToolContext {
2532
2907
  async execute(input) {
2533
2908
  const { tool: toolName, input: toolInput } = input;
2534
2909
  if (isBlockedSelfReference(toolName)) {
@@ -2554,7 +2929,7 @@ var InvokeTool = class extends import_sdk6.ToolContext {
2554
2929
  }
2555
2930
  };
2556
2931
  InvokeTool = __decorateClass([
2557
- (0, import_sdk6.Tool)({
2932
+ (0, import_sdk8.Tool)({
2558
2933
  name: "codecall:invoke",
2559
2934
  cache: {
2560
2935
  ttl: 0,
@@ -2572,13 +2947,12 @@ InvokeTool = __decorateClass([
2572
2947
  ], InvokeTool);
2573
2948
 
2574
2949
  // plugins/plugin-codecall/src/codecall.plugin.ts
2575
- var import_plugin_cache = __toESM(require("@frontmcp/plugin-cache"));
2576
- var CodeCallPlugin = class extends import_sdk7.DynamicPlugin {
2950
+ var CodeCallPlugin = class extends import_sdk9.DynamicPlugin {
2577
2951
  options;
2578
2952
  cachedLogger;
2579
2953
  getLogger() {
2580
2954
  if (!this.cachedLogger) {
2581
- this.cachedLogger = this.get(import_sdk7.FrontMcpLogger).child("CodeCall");
2955
+ this.cachedLogger = this.get(import_sdk9.FrontMcpLogger).child("CodeCall");
2582
2956
  }
2583
2957
  return this.cachedLogger;
2584
2958
  }
@@ -2610,7 +2984,7 @@ var CodeCallPlugin = class extends import_sdk7.DynamicPlugin {
2610
2984
  {
2611
2985
  name: "codecall:tool-search",
2612
2986
  provide: ToolSearchService,
2613
- inject: () => [import_sdk7.ScopeEntry],
2987
+ inject: () => [import_sdk9.ScopeEntry],
2614
2988
  useFactory: async (scope) => {
2615
2989
  return new ToolSearchService(
2616
2990
  {
@@ -2649,7 +3023,6 @@ var CodeCallPlugin = class extends import_sdk7.DynamicPlugin {
2649
3023
  * @param mode - The current CodeCall mode
2650
3024
  * @returns true if tool should be visible
2651
3025
  */
2652
- // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ToolEntry generics vary across call sites
2653
3026
  shouldShowInListTools(tool, mode) {
2654
3027
  if (this.isCodeCallTool(tool)) {
2655
3028
  return true;
@@ -2681,29 +3054,27 @@ var CodeCallPlugin = class extends import_sdk7.DynamicPlugin {
2681
3054
  * Check if a tool is a CodeCall meta-tool.
2682
3055
  * CodeCall meta-tools always remain visible.
2683
3056
  */
2684
- // eslint-disable-next-line @typescript-eslint/no-explicit-any
2685
3057
  isCodeCallTool(tool) {
2686
3058
  const name = tool.name || tool.fullName;
2687
- return name.startsWith("codecall:");
3059
+ return typeof name === "string" && name.startsWith("codecall:");
2688
3060
  }
2689
3061
  /**
2690
3062
  * Extract CodeCall-specific metadata from a tool.
2691
3063
  */
2692
- // eslint-disable-next-line @typescript-eslint/no-explicit-any
2693
3064
  getCodeCallMetadata(tool) {
2694
3065
  return tool.metadata?.["codecall"];
2695
3066
  }
2696
3067
  };
2697
3068
  __decorateClass([
2698
- import_sdk7.ListToolsHook.Did("resolveConflicts", { priority: 1e3 })
3069
+ import_sdk9.ListToolsHook.Did("resolveConflicts", { priority: 1e3 })
2699
3070
  ], CodeCallPlugin.prototype, "adjustListTools", 1);
2700
3071
  CodeCallPlugin = __decorateClass([
2701
- (0, import_sdk7.Plugin)({
3072
+ (0, import_sdk9.Plugin)({
2702
3073
  name: "codecall",
2703
3074
  description: "CodeCall plugin: AgentScript-based meta-tools for orchestrating MCP tools",
2704
3075
  providers: [],
2705
3076
  plugins: [import_plugin_cache.default],
2706
- tools: [SearchTool, DescribeTool, ExecuteTool, InvokeTool]
3077
+ tools: [SearchTool, SearchSkillsTool, SearchKnowledgeTool, DescribeTool, ExecuteTool, InvokeTool]
2707
3078
  })
2708
3079
  ], CodeCallPlugin);
2709
3080
  // Annotate the CommonJS export names for ESM import in node: