@frontmcp/plugin-codecall 1.7.1 → 1.8.0

package/esm/index.mjs

@@ -1882,6 +1882,125 @@ SearchKnowledgeTool = __decorateClass([
 import { toJSONSchema, z as z6, ZodType } from "@frontmcp/lazy-zod";
 import { Tool as Tool4, ToolContext as ToolContext4 } from "@frontmcp/sdk";
 
+// plugins/plugin-codecall/src/security/codecall-tool-policy.ts
+var BLOCKED_NAMESPACE_PATTERNS = Object.freeze([/^system:/, /^internal:/, /^__/]);
+var ALLOWED = { allowed: true };
+function deny(reason) {
+  return { allowed: false, reason };
+}
+function checkCodeCallToolPolicy(tool, config) {
+  const { name } = tool;
+  const names = [name, ...tool.aliases ?? []].filter((candidate) => !!candidate);
+  if (names.some((candidate) => candidate.startsWith("codecall:"))) {
+    return deny("CodeCall meta-tools are not callable from CodeCall");
+  }
+  for (const candidate of names) {
+    if (BLOCKED_NAMESPACE_PATTERNS.some((pattern) => pattern.test(candidate))) {
+      return deny(`Tool "${candidate}" is in a namespace CodeCall never calls`);
+    }
+  }
+  if (tool.hideFromDiscovery === true) {
+    return deny(`Tool "${name}" is hidden from discovery`);
+  }
+  const enabled = tool.codecall?.enabledInCodeCall;
+  switch (config.mode) {
+    case "codecall_only":
+    case "metadata_driven":
+      if (enabled === false) {
+        return deny(`Tool "${name}" sets enabledInCodeCall: false`);
+      }
+      break;
+    case "codecall_opt_in":
+      if (enabled !== true) {
+        return deny(`Tool "${name}" has not opted in to CodeCall`);
+      }
+      break;
+    default:
+      return deny(`Unknown CodeCall mode: ${String(config.mode)}`);
+  }
+  if (config.includeTools) {
+    const included = config.includeTools({
+      name,
+      appId: tool.appId,
+      source: tool.codecall?.source,
+      description: tool.description,
+      tags: tool.codecall?.tags ?? tool.tags
+    });
+    if (!included) {
+      return deny(`Tool "${name}" is excluded by the includeTools filter`);
+    }
+  }
+  return ALLOWED;
+}
+function denyUnknownTool(name) {
+  return deny(`Tool "${name}" is not available through CodeCall`);
+}
+function resolveCodeCallTool(scope, name) {
+  const typedScope = scope;
+  const alias = /[-_]/.test(name) ? name.includes("_") ? name.replace(/_/g, "-") : name.replace(/-/g, "_") : void 0;
+  const candidates = alias ? [name, alias] : [name];
+  const matches = (entry) => candidates.includes(entry.fullName) || candidates.includes(entry.name);
+  const local = typedScope.tools?.getTools(true)?.find(matches);
+  if (local) return local;
+  const registries = typedScope.providers?.getRegistries?.("AppRegistry") ?? [];
+  for (const registry of registries) {
+    for (const app of registry.getApps()) {
+      if (!app.isRemote) continue;
+      const remote = app.tools.getTools(true).find(matches);
+      if (remote) return remote;
+    }
+  }
+  return void 0;
+}
+function checkDirectCallPolicy(tool, directCalls) {
+  if (!directCalls) return ALLOWED;
+  if (directCalls.enabled === false) {
+    return deny("Direct tool invocation is disabled");
+  }
+  if (directCalls.allowedTools && !directCalls.allowedTools.includes(tool.name)) {
+    return deny(`Tool "${tool.name}" is not in the direct-call allowlist`);
+  }
+  if (directCalls.filter) {
+    const permitted = directCalls.filter({
+      name: tool.name,
+      appId: tool.appId,
+      source: tool.codecall?.source,
+      tags: tool.codecall?.tags ?? tool.tags
+    });
+    if (!permitted) {
+      return deny(`Tool "${tool.name}" is excluded by the directCalls filter`);
+    }
+  }
+  return ALLOWED;
+}
+function checkCodeCallToolAccess(scope, config, name, options = {}) {
+  const entry = resolveCodeCallTool(scope, name);
+  if (!entry) return denyUnknownTool(name);
+  const metadata = entry.metadata;
+  const owner = entry.owner;
+  const policyTool = {
+    // The qualified name is the subject: `call-tool.flow.ts` dispatches `fullName`, so the
+    // policy has to judge the same string the flow will run.
+    name: entry.fullName || entry.name,
+    aliases: [entry.name, name],
+    appId: owner?.kind === "app" ? owner.id : void 0,
+    description: metadata?.description,
+    tags: metadata?.tags,
+    hideFromDiscovery: metadata?.hideFromDiscovery,
+    codecall: metadata?.codecall
+  };
+  const baseDecision = checkCodeCallToolPolicy(policyTool, {
+    // An absent mode means an unparsed/partial config, not a hostile one: fall back to the
+    // schema's own documented default rather than denying every call. An unrecognised mode
+    // still fails closed inside the policy's switch.
+    mode: config.get("mode") ?? "codecall_only",
+    includeTools: config.get("includeTools")
+  });
+  if (!baseDecision.allowed) return baseDecision;
+  if (!options.directCall) return ALLOWED;
+  return checkDirectCallPolicy(policyTool, config.get("directCalls"));
+}
+
 // plugins/plugin-codecall/src/errors/tool-call.errors.ts
 var TOOL_CALL_ERROR_CODES = {
   NOT_FOUND: "NOT_FOUND",
@@ -1962,6 +2081,7 @@ function assertNotSelfReference(toolName) {
 
 // plugins/plugin-codecall/src/utils/build-tool-namespaces.ts
 var IDENT_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+var PROTOTYPE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 var RESERVED_NAMESPACES = /* @__PURE__ */ new Set([
   "console",
   "Math",
@@ -1994,7 +2114,7 @@ var RESERVED_NAMESPACES = /* @__PURE__ */ new Set([
   "mcpNotify"
 ]);
 function buildToolNamespaces(tools, callTool) {
-  const namespaces = {};
+  const namespaces = /* @__PURE__ */ Object.create(null);
   const skipped = [];
   for (const tool of tools) {
     const name = tool?.name;
@@ -2010,11 +2130,15 @@ function buildToolNamespaces(tools, callTool) {
       skipped.push({ name, reason: "invalid-identifier" });
       continue;
     }
+    if (PROTOTYPE_KEYS.has(ns)) {
+      skipped.push({ name, reason: "prototype-key" });
+      continue;
+    }
     if (RESERVED_NAMESPACES.has(ns)) {
       skipped.push({ name, reason: "reserved-namespace" });
       continue;
     }
-    const bucket = namespaces[ns] ?? (namespaces[ns] = {});
+    const bucket = namespaces[ns] ?? (namespaces[ns] = /* @__PURE__ */ Object.create(null));
     if (Object.prototype.hasOwnProperty.call(bucket, method)) {
       skipped.push({ name, reason: "duplicate-method" });
       continue;
@@ -2662,6 +2786,17 @@ function getErrorCode(error) {
   return TOOL_CALL_ERROR_CODES.EXECUTION;
 }
 var ExecuteTool = class extends ToolContext5 {
+  /**
+   * Resolve the server-side CodeCall policy for a tool name (GHSA-6w3j-82v5-6qrr).
+   *
+   * Shares its decision with discovery and with `codecall:invoke`, so the three cannot
+   * diverge. A name matching no registered tool is denied rather than passed through —
+   * otherwise it would skip every metadata-driven check and reach `tools:call-tool`
+   * unexamined.
+   */
+  checkToolPolicy(name) {
+    return checkCodeCallToolAccess(this.scope, this.get(CodeCallConfig), name);
+  }
   async execute(input) {
     const { script, allowedTools } = input;
     const allowedToolSet = allowedTools ? new Set(allowedTools) : null;
@@ -2669,6 +2804,14 @@ var ExecuteTool = class extends ToolContext5 {
       callTool: async (name, toolInput, options) => {
         const throwOnError = options?.throwOnError !== false;
         assertNotSelfReference(name);
+        const decision = this.checkToolPolicy(name);
+        if (!decision.allowed) {
+          const error = createToolCallError(TOOL_CALL_ERROR_CODES.ACCESS_DENIED, name, decision.reason);
+          if (throwOnError) {
+            throw error;
+          }
+          return { success: false, error };
+        }
         if (allowedToolSet && !allowedToolSet.has(name)) {
           const error = createToolCallError(TOOL_CALL_ERROR_CODES.ACCESS_DENIED, name);
           if (throwOnError) {
@@ -2713,6 +2856,7 @@ var ExecuteTool = class extends ToolContext5 {
       getTool: (name) => {
         try {
           if (isBlockedSelfReference(name)) return void 0;
+          if (!this.checkToolPolicy(name).allowed) return void 0;
           if (allowedToolSet && !allowedToolSet.has(name)) return void 0;
           const tools = this.scope.tools.getTools(true);
           const tool = tools.find((t) => t.name === name || t.fullName === name);
@@ -2887,6 +3031,10 @@ var InvokeTool = class extends ToolContext6 {
         `Tool "${toolName}" cannot be invoked directly. CodeCall tools are internal and not accessible via codecall:invoke.`
       );
     }
+    const decision = checkCodeCallToolAccess(this.scope, this.get(CodeCallConfig), toolName, { directCall: true });
+    if (!decision.allowed) {
+      return buildErrorResult(`Tool "${toolName}" is not available. Use codecall:search to discover available tools.`);
+    }
     const request = {
       method: "tools/call",
       params: {

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-codecall",
-  "version": "1.7.1",
+  "version": "1.8.0",
   "description": "CodeCall plugin for FrontMCP - AgentScript-based meta-tools for orchestrating MCP tools",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -49,13 +49,13 @@
   },
   "dependencies": {
     "@enclave-vm/core": "^2.15.2",
-    "@frontmcp/protocol": "1.7.1",
-    "@frontmcp/sdk": "1.7.1",
+    "@frontmcp/protocol": "1.8.0",
+    "@frontmcp/sdk": "1.8.0",
     "vectoriadb": "^2.3.2"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.7.1",
-    "@frontmcp/plugin-cache": "1.7.1"
+    "@frontmcp/lazy-zod": "1.8.0",
+    "@frontmcp/plugin-cache": "1.8.0"
   },
   "devDependencies": {
     "reflect-metadata": "^0.2.2"

package/index.js

@@ -1919,6 +1919,125 @@ SearchKnowledgeTool = __decorateClass([
 var import_lazy_zod6 = require("@frontmcp/lazy-zod");
 var import_sdk6 = require("@frontmcp/sdk");
 
+// plugins/plugin-codecall/src/security/codecall-tool-policy.ts
+var BLOCKED_NAMESPACE_PATTERNS = Object.freeze([/^system:/, /^internal:/, /^__/]);
+var ALLOWED = { allowed: true };
+function deny(reason) {
+  return { allowed: false, reason };
+}
+function checkCodeCallToolPolicy(tool, config) {
+  const { name } = tool;
+  const names = [name, ...tool.aliases ?? []].filter((candidate) => !!candidate);
+  if (names.some((candidate) => candidate.startsWith("codecall:"))) {
+    return deny("CodeCall meta-tools are not callable from CodeCall");
+  }
+  for (const candidate of names) {
+    if (BLOCKED_NAMESPACE_PATTERNS.some((pattern) => pattern.test(candidate))) {
+      return deny(`Tool "${candidate}" is in a namespace CodeCall never calls`);
+    }
+  }
+  if (tool.hideFromDiscovery === true) {
+    return deny(`Tool "${name}" is hidden from discovery`);
+  }
+  const enabled = tool.codecall?.enabledInCodeCall;
+  switch (config.mode) {
+    case "codecall_only":
+    case "metadata_driven":
+      if (enabled === false) {
+        return deny(`Tool "${name}" sets enabledInCodeCall: false`);
+      }
+      break;
+    case "codecall_opt_in":
+      if (enabled !== true) {
+        return deny(`Tool "${name}" has not opted in to CodeCall`);
+      }
+      break;
+    default:
+      return deny(`Unknown CodeCall mode: ${String(config.mode)}`);
+  }
+  if (config.includeTools) {
+    const included = config.includeTools({
+      name,
+      appId: tool.appId,
+      source: tool.codecall?.source,
+      description: tool.description,
+      tags: tool.codecall?.tags ?? tool.tags
+    });
+    if (!included) {
+      return deny(`Tool "${name}" is excluded by the includeTools filter`);
+    }
+  }
+  return ALLOWED;
+}
+function denyUnknownTool(name) {
+  return deny(`Tool "${name}" is not available through CodeCall`);
+}
+function resolveCodeCallTool(scope, name) {
+  const typedScope = scope;
+  const alias = /[-_]/.test(name) ? name.includes("_") ? name.replace(/_/g, "-") : name.replace(/-/g, "_") : void 0;
+  const candidates = alias ? [name, alias] : [name];
+  const matches = (entry) => candidates.includes(entry.fullName) || candidates.includes(entry.name);
+  const local = typedScope.tools?.getTools(true)?.find(matches);
+  if (local) return local;
+  const registries = typedScope.providers?.getRegistries?.("AppRegistry") ?? [];
+  for (const registry of registries) {
+    for (const app of registry.getApps()) {
+      if (!app.isRemote) continue;
+      const remote = app.tools.getTools(true).find(matches);
+      if (remote) return remote;
+    }
+  }
+  return void 0;
+}
+function checkDirectCallPolicy(tool, directCalls) {
+  if (!directCalls) return ALLOWED;
+  if (directCalls.enabled === false) {
+    return deny("Direct tool invocation is disabled");
+  }
+  if (directCalls.allowedTools && !directCalls.allowedTools.includes(tool.name)) {
+    return deny(`Tool "${tool.name}" is not in the direct-call allowlist`);
+  }
+  if (directCalls.filter) {
+    const permitted = directCalls.filter({
+      name: tool.name,
+      appId: tool.appId,
+      source: tool.codecall?.source,
+      tags: tool.codecall?.tags ?? tool.tags
+    });
+    if (!permitted) {
+      return deny(`Tool "${tool.name}" is excluded by the directCalls filter`);
+    }
+  }
+  return ALLOWED;
+}
+function checkCodeCallToolAccess(scope, config, name, options = {}) {
+  const entry = resolveCodeCallTool(scope, name);
+  if (!entry) return denyUnknownTool(name);
+  const metadata = entry.metadata;
+  const owner = entry.owner;
+  const policyTool = {
+    // The qualified name is the subject: `call-tool.flow.ts` dispatches `fullName`, so the
+    // policy has to judge the same string the flow will run.
+    name: entry.fullName || entry.name,
+    aliases: [entry.name, name],
+    appId: owner?.kind === "app" ? owner.id : void 0,
+    description: metadata?.description,
+    tags: metadata?.tags,
+    hideFromDiscovery: metadata?.hideFromDiscovery,
+    codecall: metadata?.codecall
+  };
+  const baseDecision = checkCodeCallToolPolicy(policyTool, {
+    // An absent mode means an unparsed/partial config, not a hostile one: fall back to the
+    // schema's own documented default rather than denying every call. An unrecognised mode
+    // still fails closed inside the policy's switch.
+    mode: config.get("mode") ?? "codecall_only",
+    includeTools: config.get("includeTools")
+  });
+  if (!baseDecision.allowed) return baseDecision;
+  if (!options.directCall) return ALLOWED;
+  return checkDirectCallPolicy(policyTool, config.get("directCalls"));
+}
+
 // plugins/plugin-codecall/src/errors/tool-call.errors.ts
 var TOOL_CALL_ERROR_CODES = {
   NOT_FOUND: "NOT_FOUND",
@@ -1999,6 +2118,7 @@ function assertNotSelfReference(toolName) {
 
 // plugins/plugin-codecall/src/utils/build-tool-namespaces.ts
 var IDENT_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+var PROTOTYPE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 var RESERVED_NAMESPACES = /* @__PURE__ */ new Set([
   "console",
   "Math",
@@ -2031,7 +2151,7 @@ var RESERVED_NAMESPACES = /* @__PURE__ */ new Set([
   "mcpNotify"
 ]);
 function buildToolNamespaces(tools, callTool) {
-  const namespaces = {};
+  const namespaces = /* @__PURE__ */ Object.create(null);
   const skipped = [];
   for (const tool of tools) {
     const name = tool?.name;
@@ -2047,11 +2167,15 @@ function buildToolNamespaces(tools, callTool) {
       skipped.push({ name, reason: "invalid-identifier" });
       continue;
     }
+    if (PROTOTYPE_KEYS.has(ns)) {
+      skipped.push({ name, reason: "prototype-key" });
+      continue;
+    }
     if (RESERVED_NAMESPACES.has(ns)) {
       skipped.push({ name, reason: "reserved-namespace" });
       continue;
     }
-    const bucket = namespaces[ns] ?? (namespaces[ns] = {});
+    const bucket = namespaces[ns] ?? (namespaces[ns] = /* @__PURE__ */ Object.create(null));
     if (Object.prototype.hasOwnProperty.call(bucket, method)) {
       skipped.push({ name, reason: "duplicate-method" });
       continue;
@@ -2699,6 +2823,17 @@ function getErrorCode(error) {
   return TOOL_CALL_ERROR_CODES.EXECUTION;
 }
 var ExecuteTool = class extends import_sdk7.ToolContext {
+  /**
+   * Resolve the server-side CodeCall policy for a tool name (GHSA-6w3j-82v5-6qrr).
+   *
+   * Shares its decision with discovery and with `codecall:invoke`, so the three cannot
+   * diverge. A name matching no registered tool is denied rather than passed through —
+   * otherwise it would skip every metadata-driven check and reach `tools:call-tool`
+   * unexamined.
+   */
+  checkToolPolicy(name) {
+    return checkCodeCallToolAccess(this.scope, this.get(CodeCallConfig), name);
+  }
   async execute(input) {
     const { script, allowedTools } = input;
     const allowedToolSet = allowedTools ? new Set(allowedTools) : null;
@@ -2706,6 +2841,14 @@ var ExecuteTool = class extends import_sdk7.ToolContext {
       callTool: async (name, toolInput, options) => {
         const throwOnError = options?.throwOnError !== false;
         assertNotSelfReference(name);
+        const decision = this.checkToolPolicy(name);
+        if (!decision.allowed) {
+          const error = createToolCallError(TOOL_CALL_ERROR_CODES.ACCESS_DENIED, name, decision.reason);
+          if (throwOnError) {
+            throw error;
+          }
+          return { success: false, error };
+        }
         if (allowedToolSet && !allowedToolSet.has(name)) {
           const error = createToolCallError(TOOL_CALL_ERROR_CODES.ACCESS_DENIED, name);
           if (throwOnError) {
@@ -2750,6 +2893,7 @@ var ExecuteTool = class extends import_sdk7.ToolContext {
       getTool: (name) => {
         try {
           if (isBlockedSelfReference(name)) return void 0;
+          if (!this.checkToolPolicy(name).allowed) return void 0;
           if (allowedToolSet && !allowedToolSet.has(name)) return void 0;
           const tools = this.scope.tools.getTools(true);
           const tool = tools.find((t) => t.name === name || t.fullName === name);
@@ -2924,6 +3068,10 @@ var InvokeTool = class extends import_sdk8.ToolContext {
         `Tool "${toolName}" cannot be invoked directly. CodeCall tools are internal and not accessible via codecall:invoke.`
       );
     }
+    const decision = checkCodeCallToolAccess(this.scope, this.get(CodeCallConfig), toolName, { directCall: true });
+    if (!decision.allowed) {
+      return buildErrorResult(`Tool "${toolName}" is not available. Use codecall:search to discover available tools.`);
+    }
     const request = {
       method: "tools/call",
       params: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-codecall",
-  "version": "1.7.1",
+  "version": "1.8.0",
   "description": "CodeCall plugin for FrontMCP - AgentScript-based meta-tools for orchestrating MCP tools",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -49,13 +49,13 @@
   },
   "dependencies": {
     "@enclave-vm/core": "^2.15.2",
-    "@frontmcp/protocol": "1.7.1",
-    "@frontmcp/sdk": "1.7.1",
+    "@frontmcp/protocol": "1.8.0",
+    "@frontmcp/sdk": "1.8.0",
     "vectoriadb": "^2.3.2"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.7.1",
-    "@frontmcp/plugin-cache": "1.7.1"
+    "@frontmcp/lazy-zod": "1.8.0",
+    "@frontmcp/plugin-cache": "1.8.0"
   },
   "devDependencies": {
     "reflect-metadata": "^0.2.2"

package/security/codecall-tool-policy.d.ts

@@ -0,0 +1,89 @@
+import type { CodeCallMode, CodeCallToolMetadata, DirectCallsFilterFn, IncludeToolsFilterFn } from '../codecall.types';
+/** The subset of a ToolEntry this decision needs, so callers need not pass the whole entry. */
+export interface CodeCallPolicyTool {
+    /** Canonical, most-qualified name — `fullName` where the entry has one. */
+    name: string;
+    /**
+     * Every other name this tool answers to, including the name the caller asked for.
+     *
+     * The namespace rules run over all of them. A tool can carry a bare `name` and a qualified
+     * `fullName` (`wipeConfig` / `system:wipeConfig`), and the flow dispatches the qualified
+     * one — so judging a single spelling lets the other one through.
+     */
+    aliases?: string[];
+    appId?: string;
+    description?: string;
+    tags?: string[];
+    hideFromDiscovery?: boolean;
+    codecall?: CodeCallToolMetadata;
+}
+export interface CodeCallPolicyConfig {
+    mode: CodeCallMode;
+    includeTools?: IncludeToolsFilterFn;
+}
+/** The `directCalls` options, which narrow `codecall:invoke` beyond the base policy. */
+export interface CodeCallDirectCallsConfig {
+    enabled: boolean;
+    allowedTools?: string[];
+    filter?: DirectCallsFilterFn;
+}
+export type CodeCallPolicyDecision = {
+    allowed: true;
+} | {
+    allowed: false;
+    reason: string;
+};
+/**
+ * Decide whether CodeCall may reach `tool`.
+ *
+ * Discovery and execution both call this. A tool the policy denies must be absent from
+ * search results AND rejected at `callTool` — hiding it from search is not authorization.
+ */
+export declare function checkCodeCallToolPolicy(tool: CodeCallPolicyTool, config: CodeCallPolicyConfig): CodeCallPolicyDecision;
+/**
+ * A tool the policy cannot evaluate is denied.
+ *
+ * `callTool` receives a bare string, so a name matching no resolvable tool would otherwise
+ * skip every metadata-driven check above and fall straight through to `tools:call-tool`.
+ */
+export declare function denyUnknownTool(name: string): CodeCallPolicyDecision;
+interface ResolvableEntry {
+    name: string;
+    fullName: string;
+}
+/**
+ * Resolve a tool name exactly as `call-tool.flow.ts` `findTool` does.
+ *
+ * MUST mirror that stage. The policy has to evaluate the same entry the flow will execute:
+ * resolve more narrowly and legitimate remote-app tools get denied; resolve more loosely and
+ * a tool reachable only through the flow's fallback escapes the policy entirely. The flow
+ * applies three steps, and so does this —
+ *   1. the scope registry,
+ *   2. a hyphen <-> underscore alias (issue #408),
+ *   3. remote app registries, for tools whose subscription has not yet propagated.
+ */
+export declare function resolveCodeCallTool<T extends ResolvableEntry>(scope: unknown, name: string): T | undefined;
+/**
+ * Apply the `directCalls` options to a `codecall:invoke` request.
+ *
+ * These options were declared in the plugin schema and read by nothing, so `codecall:invoke`
+ * proxied the entire registry regardless of how an operator configured it. They narrow the
+ * base policy; they never widen it.
+ */
+export declare function checkDirectCallPolicy(tool: CodeCallPolicyTool, directCalls: CodeCallDirectCallsConfig | undefined): CodeCallPolicyDecision;
+interface PolicyConfigReader {
+    get(key: string): unknown;
+}
+/**
+ * Resolve a tool name and decide whether CodeCall may reach it.
+ *
+ * The one entry point for both meta-tools: `codecall:execute` calls it for every `callTool`
+ * and `getTool`, `codecall:invoke` for its single target with `directCall: true`. Sharing it
+ * is the point — the advisory existed because execution and discovery each had their own
+ * answer.
+ */
+export declare function checkCodeCallToolAccess(scope: unknown, config: PolicyConfigReader, name: string, options?: {
+    directCall?: boolean;
+}): CodeCallPolicyDecision;
+export {};
+//# sourceMappingURL=codecall-tool-policy.d.ts.map

package/security/codecall-tool-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codecall-tool-policy.d.ts","sourceRoot":"","sources":["../../src/security/codecall-tool-policy.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAKvH,+FAA+F;AAC/F,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,EAAE,oBAAoB,CAAC;CACjC;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,YAAY,CAAC;IACnB,YAAY,CAAC,EAAE,oBAAoB,CAAC;CACrC;AAED,wFAAwF;AACxF,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAED,MAAM,MAAM,sBAAsB,GAAG;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAQ5F;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,oBAAoB,GAC3B,sBAAsB,CAwDxB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,sBAAsB,CAEpE;AAED,UAAU,eAAe;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAWD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAwB1G;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,EACxB,WAAW,EAAE,yBAAyB,GAAG,SAAS,GACjD,sBAAsB,CAyBxB;AAED,UAAU,kBAAkB;IAC1B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAO,GACrC,sBAAsB,CAmCxB"}

package/security/index.d.ts

@@ -1,3 +1,4 @@
+export * from './codecall-tool-policy';
 export * from './self-reference-guard';
 export * from './tool-access-control.service';
 //# sourceMappingURL=index.d.ts.map

package/security/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAEA,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAEA,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC"}

package/security/tool-access-control.service.d.ts

@@ -58,8 +58,18 @@ export interface ToolAccessDecision {
 /**
  * Tool Access Control Service
  *
- * Provides centralized access control for tool calls within CodeCall.
- * Implements a layered security model:
+ * NOT ON THE ENFORCEMENT PATH. Nothing constructs this service: the plugin declares
+ * `providers: []`, no `ToolAccessPolicy` can be supplied through the plugin options, and
+ * neither `codecall:execute` nor `codecall:invoke` consults it. Its unit tests pass by
+ * constructing it directly, which is exactly how GHSA-6w3j-82v5-6qrr stayed invisible — a
+ * green suite for a control that never ran.
+ *
+ * The policy CodeCall actually enforces lives in `codecall-tool-policy.ts`
+ * (`checkCodeCallToolAccess`), called by both meta-tools. This class is kept only so the
+ * exported types do not disappear from the package's public surface in a security patch;
+ * wiring it in, or removing it, is a follow-up with its own BC note.
+ *
+ * The richer model it offers, unused today:
  *
  * 1. Self-reference blocking (handled separately in self-reference-guard.ts)
  * 2. Default blacklist (always enforced)

package/security/tool-access-control.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-access-control.service.d.ts","sourceRoot":"","sources":["../../src/security/tool-access-control.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,WAAW,GAAG,SAAS,CAAC;AAEnE;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,IAAI,EAAE,cAAc,CAAC;IAErB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IAErB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IAErB;;OAEG;IACH,QAAQ,CAAC,EAAE;QACT,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;IAEF;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACzE;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAeD;;;;;;;;;;;GAWG;AACH,qBAIa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;IAC3C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAW;IACzC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAW;gBAE5B,MAAM,CAAC,EAAE,gBAAgB;IAWrC;;;;;;OAMG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAsCxF,kBAAkB;YAqBlB,kBAAkB;YAelB,gBAAgB;IAS9B;;OAEG;IACH,OAAO,CAAC,OAAO;IAmBf;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IAenB;;OAEG;IACH,SAAS,IAAI,QAAQ,CAAC,gBAAgB,CAAC;CAGxC;AAED,eAAe,wBAAwB,CAAC"}
+{"version":3,"file":"tool-access-control.service.d.ts","sourceRoot":"","sources":["../../src/security/tool-access-control.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAGnD;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,WAAW,GAAG,SAAS,CAAC;AAEnE;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,IAAI,EAAE,cAAc,CAAC;IAErB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IAErB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IAErB;;OAEG;IACH,QAAQ,CAAC,EAAE;QACT,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;IAEF;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACzE;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAeD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAIa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;IAC3C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAW;IACzC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAW;gBAE5B,MAAM,CAAC,EAAE,gBAAgB;IAWrC;;;;;;OAMG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAsCxF,kBAAkB;YAqBlB,kBAAkB;YAelB,gBAAgB;IAS9B;;OAEG;IACH,OAAO,CAAC,OAAO;IAmBf;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IAenB;;OAEG;IACH,SAAS,IAAI,QAAQ,CAAC,gBAAgB,CAAC;CAGxC;AAED,eAAe,wBAAwB,CAAC"}

package/tools/execute.tool.d.ts

@@ -1,6 +1,15 @@
 import { ToolContext } from '@frontmcp/sdk';
 import { type CodeCallExecuteResult, type ExecuteToolInput } from './execute.schema';
 export default class ExecuteTool extends ToolContext {
+    /**
+     * Resolve the server-side CodeCall policy for a tool name (GHSA-6w3j-82v5-6qrr).
+     *
+     * Shares its decision with discovery and with `codecall:invoke`, so the three cannot
+     * diverge. A name matching no registered tool is denied rather than passed through —
+     * otherwise it would skip every metadata-driven check and reach `tools:call-tool`
+     * unexamined.
+     */
+    private checkToolPolicy;
     execute(input: ExecuteToolInput): Promise<CodeCallExecuteResult>;
 }
 //# sourceMappingURL=execute.tool.d.ts.map

package/tools/execute.tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execute.tool.d.ts","sourceRoot":"","sources":["../../src/tools/execute.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,WAAW,EAAE,MAAM,eAAe,CAAC;AAclD,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAyC1B,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,WAAW;IAC5C,OAAO,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAqPvE"}
+{"version":3,"file":"execute.tool.d.ts","sourceRoot":"","sources":["../../src/tools/execute.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,WAAW,EAAE,MAAM,eAAe,CAAC;AAmBlD,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAyC1B,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,WAAW;IAClD;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAIjB,OAAO,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CA4QvE"}

package/tools/invoke.tool.d.ts

@@ -6,6 +6,8 @@ import { InvokeToolInput, InvokeToolOutput } from './invoke.schema';
  *
  * Security Considerations:
  * - Self-reference blocking: Cannot invoke codecall:* tools
+ * - Shares the CodeCall access policy with `codecall:execute`, so a tool withheld from
+ *   scripts is not reachable by naming it here instead (GHSA-6w3j-82v5-6qrr)
  * - All middleware (auth, PII, rate limiting) applies via normal tool execution
  */
 export default class InvokeTool extends ToolContext {

package/tools/invoke.tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invoke.tool.d.ts","sourceRoot":"","sources":["../../src/tools/invoke.tool.ts"],"names":[],"mappings":"AACA,OAAO,EAAQ,WAAW,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EACL,eAAe,EAEf,gBAAgB,EAGjB,MAAM,iBAAiB,CAAC;AAazB;;;;;;;GAOG;AAeH,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,WAAW;IAC3C,OAAO,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAkCjE"}
+{"version":3,"file":"invoke.tool.d.ts","sourceRoot":"","sources":["../../src/tools/invoke.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,WAAW,EAAE,MAAM,eAAe,CAAC;AAIlD,OAAO,EAEL,eAAe,EAEf,gBAAgB,EAEjB,MAAM,iBAAiB,CAAC;AAYzB;;;;;;;;;GASG;AAeH,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,WAAW;IAC3C,OAAO,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC;CA4CjE"}

package/utils/build-tool-namespaces.d.ts

@@ -20,7 +20,7 @@ export type ToolNamespaces = Record<string, ToolNamespace>;
  * Reasons a tool may be skipped during namespace generation. Returned so the
  * caller can surface diagnostics without re-deriving the rules.
  */
-export type NamespaceSkipReason = 'no-namespace-prefix' | 'invalid-identifier' | 'reserved-namespace' | 'duplicate-method';
+export type NamespaceSkipReason = 'no-namespace-prefix' | 'invalid-identifier' | 'reserved-namespace' | 'prototype-key' | 'duplicate-method';
 export interface BuildToolNamespacesResult {
     /** The namespaces object to merge into the VM globals. */
     namespaces: ToolNamespaces;
@@ -37,6 +37,8 @@ export interface BuildToolNamespacesResult {
  * - Tools whose name has no `.` are skipped (still callable via `callTool`).
  * - Tools whose prefix or suffix is not a valid JS identifier are skipped.
  * - Tools whose prefix collides with a reserved global are skipped.
+ * - Tools whose PREFIX is a prototype key (`__proto__`, `constructor`,
+ *   `prototype`) are skipped — they would write onto a JavaScript intrinsic.
  * - First registration wins on duplicate `{ns}.{method}` (subsequent are reported as skipped).
  *
  * The returned methods are thin wrappers that delegate to `callTool` with the

package/utils/build-tool-namespaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-tool-namespaces.d.ts","sourceRoot":"","sources":["../../src/utils/build-tool-namespaces.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AA8CjE;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,eAAe,KACtB,OAAO,CAAC,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;AAEhD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,mFAAmF;AACnF,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAE7G,0FAA0F;AAC1F,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAE3D;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC3B,qBAAqB,GACrB,oBAAoB,GACpB,oBAAoB,GACpB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,yBAAyB;IACxC,0DAA0D;IAC1D,UAAU,EAAE,cAAc,CAAC;IAC3B,+EAA+E;IAC/E,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,mBAAmB,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,aAAa,CAAC,iBAAiB,CAAC,EACvC,QAAQ,EAAE,kBAAkB,GAC3B,yBAAyB,CAqC3B"}
+{"version":3,"file":"build-tool-namespaces.d.ts","sourceRoot":"","sources":["../../src/utils/build-tool-namespaces.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AA2DjE;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,eAAe,KACtB,OAAO,CAAC,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;AAEhD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,mFAAmF;AACnF,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAE7G,0FAA0F;AAC1F,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAE3D;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC3B,qBAAqB,GACrB,oBAAoB,GACpB,oBAAoB,GACpB,eAAe,GACf,kBAAkB,CAAC;AAEvB,MAAM,WAAW,yBAAyB;IACxC,0DAA0D;IAC1D,UAAU,EAAE,cAAc,CAAC;IAC3B,+EAA+E;IAC/E,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,mBAAmB,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,aAAa,CAAC,iBAAiB,CAAC,EACvC,QAAQ,EAAE,kBAAkB,GAC3B,yBAAyB,CAsD3B"}