@frontmcp/plugin-codecall 1.7.2 → 1.8.1

package/esm/index.mjs

@@ -372,9 +372,434 @@ function presetDefaults(preset) {
   }
 }
 
+// plugins/plugin-codecall/src/services/audit-logger.service.ts
+import { Provider as Provider2, ProviderScope as ProviderScope2 } from "@frontmcp/sdk";
+var AUDIT_EVENT_TYPES = {
+  /** Script execution started */
+  EXECUTION_START: "codecall:execution:start",
+  /** Script execution completed successfully */
+  EXECUTION_SUCCESS: "codecall:execution:success",
+  /** Script execution failed */
+  EXECUTION_FAILURE: "codecall:execution:failure",
+  /** Script execution timed out */
+  EXECUTION_TIMEOUT: "codecall:execution:timeout",
+  /** Tool call initiated from script */
+  TOOL_CALL_START: "codecall:tool:call:start",
+  /** Tool call completed successfully */
+  TOOL_CALL_SUCCESS: "codecall:tool:call:success",
+  /** Tool call failed */
+  TOOL_CALL_FAILURE: "codecall:tool:call:failure",
+  /** Self-reference attack blocked */
+  SECURITY_SELF_REFERENCE: "codecall:security:self-reference",
+  /** Tool access denied */
+  SECURITY_ACCESS_DENIED: "codecall:security:access-denied",
+  /** AST validation failed (blocked code pattern) */
+  SECURITY_AST_BLOCKED: "codecall:security:ast-blocked",
+  /** Search performed */
+  SEARCH_PERFORMED: "codecall:search:performed",
+  /** Tool described */
+  DESCRIBE_PERFORMED: "codecall:describe:performed",
+  /** Direct invoke performed */
+  INVOKE_PERFORMED: "codecall:invoke:performed"
+};
+var AuditLoggerService = class {
+  listeners = /* @__PURE__ */ new Set();
+  executionCounter = 0;
+  /**
+   * Subscribe to audit events.
+   *
+   * @param listener - Function to call when events occur
+   * @returns Unsubscribe function
+   */
+  subscribe(listener) {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  }
+  /**
+   * Generate a unique execution ID.
+   */
+  generateExecutionId() {
+    const timestamp = Date.now().toString(36);
+    const counter = (++this.executionCounter).toString(36).padStart(4, "0");
+    const random = Math.random().toString(36).substring(2, 8);
+    return `exec_${timestamp}_${counter}_${random}`;
+  }
+  /**
+   * Log execution start.
+   */
+  logExecutionStart(executionId, script) {
+    this.emit({
+      type: AUDIT_EVENT_TYPES.EXECUTION_START,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      executionId,
+      data: {
+        scriptHash: this.hashScript(script),
+        scriptLength: script.length
+      }
+    });
+  }
+  /**
+   * Log execution success.
+   */
+  logExecutionSuccess(executionId, script, durationMs, toolCallCount) {
+    this.emit({
+      type: AUDIT_EVENT_TYPES.EXECUTION_SUCCESS,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      executionId,
+      durationMs,
+      data: {
+        scriptHash: this.hashScript(script),
+        scriptLength: script.length,
+        toolCallCount
+      }
+    });
+  }
+  /**
+   * Log execution failure.
+   */
+  logExecutionFailure(executionId, script, durationMs, error) {
+    this.emit({
+      type: AUDIT_EVENT_TYPES.EXECUTION_FAILURE,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      executionId,
+      durationMs,
+      data: {
+        scriptHash: this.hashScript(script),
+        scriptLength: script.length,
+        error: this.sanitizeError(error)
+      }
+    });
+  }
+  /**
+   * Log execution timeout.
+   */
+  logExecutionTimeout(executionId, script, durationMs) {
+    this.emit({
+      type: AUDIT_EVENT_TYPES.EXECUTION_TIMEOUT,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      executionId,
+      durationMs,
+      data: {
+        scriptHash: this.hashScript(script),
+        scriptLength: script.length
+      }
+    });
+  }
+  /**
+   * Log tool call start.
+   */
+  logToolCallStart(executionId, toolName, callDepth) {
+    this.emit({
+      type: AUDIT_EVENT_TYPES.TOOL_CALL_START,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      executionId,
+      data: {
+        toolName,
+        callDepth
+      }
+    });
+  }
+  /**
+   * Log tool call success.
+   */
+  logToolCallSuccess(executionId, toolName, callDepth, durationMs) {
+    this.emit({
+      type: AUDIT_EVENT_TYPES.TOOL_CALL_SUCCESS,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      executionId,
+      durationMs,
+      data: {
+        toolName,
+        callDepth
+      }
+    });
+  }
+  /**
+   * Log tool call failure.
+   */
+  logToolCallFailure(executionId, toolName, callDepth, durationMs, errorCode) {
+    this.emit({
+      type: AUDIT_EVENT_TYPES.TOOL_CALL_FAILURE,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      executionId,
+      durationMs,
+      data: {
+        toolName,
+        callDepth,
+        errorCode
+      }
+    });
+  }
+  /**
+   * Log security event: self-reference blocked.
+   */
+  logSecuritySelfReference(executionId, toolName) {
+    this.emit({
+      type: AUDIT_EVENT_TYPES.SECURITY_SELF_REFERENCE,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      executionId,
+      data: {
+        blocked: toolName,
+        reason: "Self-reference attack: attempted to call CodeCall tool from within AgentScript"
+      }
+    });
+  }
+  /**
+   * Log security event: access denied.
+   */
+  logSecurityAccessDenied(executionId, toolName, reason) {
+    this.emit({
+      type: AUDIT_EVENT_TYPES.SECURITY_ACCESS_DENIED,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      executionId,
+      data: {
+        blocked: toolName,
+        reason: this.sanitizeError(reason)
+      }
+    });
+  }
+  /**
+   * Log security event: AST validation blocked.
+   */
+  logSecurityAstBlocked(executionId, pattern, reason) {
+    this.emit({
+      type: AUDIT_EVENT_TYPES.SECURITY_AST_BLOCKED,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      executionId,
+      data: {
+        blocked: pattern,
+        reason: this.sanitizeError(reason)
+      }
+    });
+  }
+  /**
+   * Log search operation.
+   */
+  logSearch(executionId, query, resultCount, durationMs) {
+    this.emit({
+      type: AUDIT_EVENT_TYPES.SEARCH_PERFORMED,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      executionId,
+      durationMs,
+      data: {
+        queryLength: query.length,
+        resultCount
+      }
+    });
+  }
+  /**
+   * Log describe operation.
+   */
+  logDescribe(executionId, toolNames, durationMs) {
+    this.emit({
+      type: AUDIT_EVENT_TYPES.DESCRIBE_PERFORMED,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      executionId,
+      durationMs,
+      data: {
+        toolCount: toolNames.length,
+        toolNames: toolNames.slice(0, 10)
+        // Limit to first 10 for audit
+      }
+    });
+  }
+  /**
+   * Log invoke operation.
+   */
+  logInvoke(executionId, toolName, success, durationMs) {
+    this.emit({
+      type: AUDIT_EVENT_TYPES.INVOKE_PERFORMED,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      executionId,
+      durationMs,
+      data: {
+        toolName,
+        success
+      }
+    });
+  }
+  /**
+   * Emit an audit event to all listeners.
+   */
+  emit(event) {
+    const frozenEvent = Object.freeze({ ...event, data: Object.freeze({ ...event.data }) });
+    for (const listener of this.listeners) {
+      try {
+        listener(frozenEvent);
+      } catch {
+      }
+    }
+  }
+  /**
+   * Create a simple hash of the script for identification.
+   * Uses a fast, non-cryptographic hash for performance.
+   */
+  hashScript(script) {
+    let hash = 0;
+    for (let i = 0; i < script.length; i++) {
+      const char = script.charCodeAt(i);
+      hash = (hash << 5) - hash + char;
+      hash = hash & hash;
+    }
+    return `sh_${(hash >>> 0).toString(16).padStart(8, "0")}`;
+  }
+  /**
+   * Sanitize error messages to remove sensitive information.
+   */
+  sanitizeError(error) {
+    if (!error) return "Unknown error";
+    let sanitized = error.replace(/(?:\/[\w.-]+)+|(?:[A-Za-z]:\\[\w\\.-]+)+/g, "[path]");
+    sanitized = sanitized.replace(/:\d+:\d+/g, "");
+    sanitized = sanitized.replace(/\n\s*at .*/g, "");
+    if (sanitized.length > 200) {
+      sanitized = sanitized.substring(0, 200) + "...";
+    }
+    return sanitized.trim();
+  }
+};
+AuditLoggerService = __decorateClass([
+  Provider2({
+    name: "codecall:audit-logger",
+    scope: ProviderScope2.GLOBAL
+  })
+], AuditLoggerService);
+
 // plugins/plugin-codecall/src/services/tool-search.service.ts
 import { TFIDFVectoria, VectoriaDB } from "vectoriadb";
 
+// plugins/plugin-codecall/src/security/codecall-tool-policy.ts
+var BLOCKED_NAMESPACE_PATTERNS = Object.freeze([/^system:/, /^internal:/, /^__/]);
+var ALLOWED = { allowed: true };
+function deny(reason) {
+  return { allowed: false, reason };
+}
+function codeCallAppIdOf(scope, entry) {
+  const lineage = scope?.tools?.lineageOf?.(entry) ?? [];
+  const owners = entry.owner ? [...lineage, entry.owner] : lineage;
+  return owners.find((owner) => owner.kind === "app")?.id;
+}
+function toCodeCallPolicyTool(entry, requestedName, scope) {
+  const { metadata } = entry;
+  return {
+    name: entry.name || entry.fullName,
+    fullName: entry.fullName,
+    aliases: requestedName ? [requestedName] : void 0,
+    appId: codeCallAppIdOf(scope, entry),
+    description: metadata?.description,
+    tags: metadata?.tags,
+    // `internal` tools refuse every external tools/call, CodeCall's included, so no surface may offer them.
+    hidden: metadata?.hideFromDiscovery === true || metadata?.visibility === "hidden" || metadata?.visibility === "internal",
+    codecall: metadata?.codecall
+  };
+}
+function toToolFilterInfo(tool) {
+  return {
+    name: tool.name,
+    appId: tool.appId,
+    source: tool.codecall?.source,
+    description: tool.description,
+    tags: tool.codecall?.tags ?? tool.tags
+  };
+}
+function ownNamesOf(tool) {
+  return [tool.name, tool.fullName].filter((candidate) => !!candidate);
+}
+function checkCodeCallToolPolicy(tool, config) {
+  const { name } = tool;
+  const spellings = [...ownNamesOf(tool), ...tool.aliases ?? []];
+  if (spellings.some((candidate) => candidate.startsWith("codecall:"))) {
+    return deny("CodeCall meta-tools are not callable from CodeCall");
+  }
+  for (const candidate of spellings) {
+    if (BLOCKED_NAMESPACE_PATTERNS.some((pattern) => pattern.test(candidate))) {
+      return deny(`Tool "${candidate}" is in a namespace CodeCall never calls`);
+    }
+  }
+  if (tool.hidden === true) {
+    return deny(`Tool "${name}" is hidden from discovery`);
+  }
+  const enabled = tool.codecall?.enabledInCodeCall;
+  switch (config.mode) {
+    case "codecall_only":
+    case "metadata_driven":
+      if (enabled === false) {
+        return deny(`Tool "${name}" sets enabledInCodeCall: false`);
+      }
+      break;
+    case "codecall_opt_in":
+      if (enabled !== true) {
+        return deny(`Tool "${name}" has not opted in to CodeCall`);
+      }
+      break;
+    default:
+      return deny(`Unknown CodeCall mode: ${String(config.mode)}`);
+  }
+  if (config.includeTools && !config.includeTools(toToolFilterInfo(tool))) {
+    return deny(`Tool "${name}" is excluded by the includeTools filter`);
+  }
+  return ALLOWED;
+}
+function denyUnknownTool(name) {
+  return deny(`Tool "${name}" is not available through CodeCall`);
+}
+function resolveCodeCallTool(scope, name) {
+  const typedScope = scope;
+  const alias = /[-_]/.test(name) ? name.includes("_") ? name.replace(/_/g, "-") : name.replace(/-/g, "_") : void 0;
+  const candidates = alias ? [name, alias] : [name];
+  const matches = (entry) => candidates.includes(entry.fullName) || candidates.includes(entry.name);
+  const local = typedScope.tools?.getTools(true)?.find(matches);
+  if (local) return local;
+  const registries = typedScope.providers?.getRegistries?.("AppRegistry") ?? [];
+  for (const registry of registries) {
+    for (const app of registry.getApps()) {
+      if (!app.isRemote) continue;
+      const remote = app.tools.getTools(true).find(matches);
+      if (remote) return remote;
+    }
+  }
+  return void 0;
+}
+function checkDirectCallPolicy(tool, directCalls) {
+  if (!directCalls) return ALLOWED;
+  if (directCalls.enabled === false) {
+    return deny("Direct tool invocation is disabled");
+  }
+  const { allowedTools } = directCalls;
+  if (allowedTools && !ownNamesOf(tool).some((ownName) => allowedTools.includes(ownName))) {
+    return deny(`Tool "${tool.name}" is not in the direct-call allowlist`);
+  }
+  if (directCalls.filter && !directCalls.filter(toToolFilterInfo(tool))) {
+    return deny(`Tool "${tool.name}" is excluded by the directCalls filter`);
+  }
+  return ALLOWED;
+}
+function readCodeCallPolicyConfig(config) {
+  return {
+    // An absent mode means an unparsed/partial config, not a hostile one: fall back to the
+    // schema's own documented default rather than denying every call. An unrecognised mode
+    // still fails closed inside the policy's switch.
+    mode: config.get("mode") ?? "codecall_only",
+    includeTools: config.get("includeTools")
+  };
+}
+function checkCodeCallToolAccess(scope, config, name, options = {}) {
+  const entry = resolveCodeCallTool(scope, name);
+  if (!entry) return denyUnknownTool(name);
+  const policyTool = toCodeCallPolicyTool(entry, name, scope);
+  const baseDecision = checkCodeCallToolPolicy(policyTool, readCodeCallPolicyConfig(config));
+  if (!baseDecision.allowed) return baseDecision;
+  if (options.directCall) {
+    const directDecision = checkDirectCallPolicy(
+      policyTool,
+      config.get("directCalls")
+    );
+    if (!directDecision.allowed) return directDecision;
+  }
+  return { allowed: true, entry };
+}
+
 // plugins/plugin-codecall/src/services/synonym-expansion.service.ts
 var DEFAULT_SYNONYM_GROUPS = [
   // ===========================================================================
@@ -1043,62 +1468,12 @@ var ToolSearchService = class _ToolSearchService {
     this.initialized = true;
   }
   /**
-   * Determines if a tool should be indexed in the search database.
-   * Filters based on:
-   * - Excludes codecall:* meta-tools (they should not be searchable)
-   * - Excludes tools with hideFromDiscovery: true (system tools like sendElicitationResult)
-   * - Mode-based filtering (codecall_only, codecall_opt_in, metadata_driven)
-   * - Per-tool metadata.codecall.enabledInCodeCall
-   * - Custom includeTools filter function
+   * Whether a tool belongs in the search index: exactly when CodeCall may execute it.
+   * The decision is `codecall:execute`'s own, so search cannot show a tool execution refuses
+   * or hide one it runs (GHSA-6w3j-82v5-6qrr).
    */
   shouldIndexTool(tool) {
-    const toolName = tool.name || tool.fullName;
-    if (toolName.startsWith("codecall:")) {
-      return false;
-    }
-    if (tool.metadata.hideFromDiscovery === true) {
-      return false;
-    }
-    const codecallMeta = this.getCodeCallMetadata(tool);
-    switch (this.config.mode) {
-      case "codecall_only":
-        if (codecallMeta?.enabledInCodeCall === false) {
-          return false;
-        }
-        break;
-      case "codecall_opt_in":
-        if (codecallMeta?.enabledInCodeCall !== true) {
-          return false;
-        }
-        break;
-      case "metadata_driven":
-        if (codecallMeta?.enabledInCodeCall === false) {
-          return false;
-        }
-        break;
-      default:
-        throw new Error(`Unknown CodeCall mode: ${this.config.mode}`);
-    }
-    if (this.config.includeTools) {
-      const appId = this.extractAppId(tool);
-      const filterInfo = {
-        name: toolName,
-        appId,
-        source: codecallMeta?.source,
-        description: tool.metadata.description,
-        tags: codecallMeta?.tags || tool.metadata.tags
-      };
-      if (!this.config.includeTools(filterInfo)) {
-        return false;
-      }
-    }
-    return true;
-  }
-  /**
-   * Extract CodeCall-specific metadata from a tool.
-   */
-  getCodeCallMetadata(tool) {
-    return tool.metadata?.codecall;
+    return checkCodeCallToolPolicy(toCodeCallPolicyTool(tool, void 0, this.scope), this.config).allowed;
   }
   /**
    * Initializes the search service by indexing all tools from the registry.
@@ -1188,11 +1563,7 @@ var ToolSearchService = class _ToolSearchService {
    * Extracts app ID from tool's owner lineage
    */
   extractAppId(tool) {
-    if (!tool.owner) return void 0;
-    if (tool.owner.kind === "app") {
-      return tool.owner.id;
-    }
-    return void 0;
+    return codeCallAppIdOf(this.scope, tool);
   }
   /**
    * Searches for tools matching the query
@@ -1279,7 +1650,7 @@ var ToolSearchService = class _ToolSearchService {
 
 // plugins/plugin-codecall/src/services/enclave.service.ts
 import { Enclave } from "@enclave-vm/core";
-import { Provider as Provider2, ProviderScope as ProviderScope2 } from "@frontmcp/sdk";
+import { Provider as Provider3, ProviderScope as ProviderScope3 } from "@frontmcp/sdk";
 var ScriptTooLargeError = class extends Error {
   code = "SCRIPT_TOO_LARGE";
   scriptLength;
@@ -1398,15 +1769,23 @@ var EnclaveService = class {
     const error = result.error;
     const timedOut = error.message?.includes("timed out") || error.code === "TIMEOUT";
     if (error.code === "VALIDATION_ERROR") {
+      const issues = error.data?.issues ?? [];
+      const blockedPatterns = [...new Set(issues.map((issue) => issue.code).filter((code) => !!code))];
       return {
         success: false,
         error: {
           message: error.message,
           name: "ValidationError",
-          code: error.code
+          code: error.code,
+          ...blockedPatterns.length > 0 ? { blockedPatterns } : {}
         },
         logs,
-        timedOut: false
+        timedOut: false,
+        stats: {
+          duration: result.stats.duration,
+          toolCallCount: result.stats.toolCallCount,
+          iterationCount: result.stats.iterationCount
+        }
       };
     }
     const errorData = error.data;
@@ -1446,10 +1825,10 @@ var EnclaveService = class {
   }
 };
 EnclaveService = __decorateClass([
-  Provider2({
+  Provider3({
     name: "codecall:enclave",
     description: "Executes AgentScript code in a secure enclave",
-    scope: ProviderScope2.GLOBAL
+    scope: ProviderScope3.GLOBAL
   })
 ], EnclaveService);
 
@@ -1509,6 +1888,9 @@ var SearchTool = class extends ToolContext {
     const { queries, appIds, excludeToolNames = [], topK = 5, minRelevanceScore = 0.3 } = input;
     const searchService = this.get(ToolSearchService);
     const warnings = [];
+    const audit = this.tryGet(AuditLoggerService);
+    const executionId = audit ? audit.generateExecutionId() : "";
+    const startedAt = Date.now();
     const nonExistentExcludedTools = excludeToolNames.filter((toolName) => !searchService.hasTool(toolName));
     if (nonExistentExcludedTools.length > 0) {
       warnings.push({
@@ -1564,6 +1946,7 @@ var SearchTool = class extends ToolContext {
         message: `${lowRelevanceCount} result(s) filtered due to relevance below ${minRelevanceScore}`
       });
     }
+    audit?.logSearch(executionId, queries.join(" "), tools.length, Date.now() - startedAt);
     return {
       tools,
       warnings,
@@ -1594,7 +1977,7 @@ SearchTool = __decorateClass([
 ], SearchTool);
 
 // plugins/plugin-codecall/src/tools/search-skills.tool.ts
-import { Tool as Tool2, ToolContext as ToolContext2 } from "@frontmcp/sdk";
+import { filterServableSkills, Tool as Tool2, ToolContext as ToolContext2 } from "@frontmcp/sdk";
 
 // plugins/plugin-codecall/src/tools/search-skills.schema.ts
 import { z as z3 } from "@frontmcp/lazy-zod";
@@ -1655,7 +2038,7 @@ var SearchSkillsTool = class extends ToolContext2 {
   async execute(input) {
     const { queries, tags, excludeSkillNames = [], topK = 5, minRelevanceScore = 0.1 } = input;
     const skillRegistry = this.scope.skills;
-    const executableSkills = skillRegistry.getExecutableSkills();
+    const executableSkills = await filterServableSkills(this.scope, skillRegistry.getExecutableSkills());
     const executableSet = new Set(executableSkills.map((s) => s.name));
     const totalExecutableSkills = executableSkills.length;
     const warnings = [];
@@ -1746,7 +2129,7 @@ SearchSkillsTool = __decorateClass([
 ], SearchSkillsTool);
 
 // plugins/plugin-codecall/src/tools/search-knowledge.tool.ts
-import { Tool as Tool3, ToolContext as ToolContext3 } from "@frontmcp/sdk";
+import { filterServableSkills as filterServableSkills2, Tool as Tool3, ToolContext as ToolContext3 } from "@frontmcp/sdk";
 
 // plugins/plugin-codecall/src/tools/search-knowledge.schema.ts
 import { z as z4 } from "@frontmcp/lazy-zod";
@@ -1796,7 +2179,7 @@ var SearchKnowledgeTool = class extends ToolContext3 {
   async execute(input) {
     const { queries, tags, excludeSkillNames = [], topK = 5, minRelevanceScore = 0.1 } = input;
     const skillRegistry = this.scope.skills;
-    const knowledgeSkills = skillRegistry.getKnowledgeOnlySkills();
+    const knowledgeSkills = await filterServableSkills2(this.scope, skillRegistry.getKnowledgeOnlySkills());
     const knowledgeSet = new Set(knowledgeSkills.map((s) => s.name));
     const totalKnowledgeSkills = knowledgeSkills.length;
     const warnings = [];
@@ -2384,21 +2767,24 @@ var describeToolOutputSchema = z5.object({
 var DescribeTool = class extends ToolContext4 {
   async execute(input) {
     const { toolNames } = input;
+    const audit = this.tryGet(AuditLoggerService);
+    const executionId = audit ? audit.generateExecutionId() : "";
+    const startedAt = Date.now();
     const tools = [];
     const notFound = [];
-    const allTools = this.scope.tools.getTools(true);
-    const toolMap = new Map(allTools.map((t) => [t.name, t]));
-    const fullNameMap = new Map(allTools.map((t) => [t.fullName, t]));
+    const config = this.get(CodeCallConfig);
     for (const toolName of toolNames) {
       if (isBlockedSelfReference(toolName)) {
         notFound.push(toolName);
         continue;
       }
-      const tool = toolMap.get(toolName) || fullNameMap.get(toolName);
-      if (!tool) {
+      const access = checkCodeCallToolAccess(this.scope, config, toolName);
+      if (!access.allowed) {
+        audit?.logSecurityAccessDenied(executionId, toolName, access.reason);
         notFound.push(toolName);
         continue;
       }
+      const tool = access.entry;
       const appId = this.extractAppId(tool);
       const inputSchema = this.getInputSchema(tool);
       const outputSchema = this.toJsonSchema(tool.rawOutputSchema ?? tool.outputSchema);
@@ -2413,6 +2799,7 @@ var DescribeTool = class extends ToolContext4 {
         usageExamples
       });
     }
+    audit?.logDescribe(executionId, toolNames, Date.now() - startedAt);
     return {
       tools,
       notFound: notFound.length > 0 ? notFound : void 0
@@ -2667,20 +3054,51 @@ function getErrorCode(error) {
   return TOOL_CALL_ERROR_CODES.EXECUTION;
 }
 var ExecuteTool = class extends ToolContext5 {
+  /**
+   * Resolve the server-side CodeCall policy for a tool name (GHSA-6w3j-82v5-6qrr).
+   *
+   * Shares its decision with discovery and with `codecall:invoke`, so the three cannot
+   * diverge. A name matching no registered tool is denied rather than passed through —
+   * otherwise it would skip every metadata-driven check and reach `tools:call-tool`
+   * unexamined.
+   */
+  checkToolPolicy(name) {
+    return checkCodeCallToolAccess(this.scope, this.get(CodeCallConfig), name);
+  }
   async execute(input) {
     const { script, allowedTools } = input;
+    const audit = this.tryGet(AuditLoggerService);
+    const executionId = audit ? audit.generateExecutionId() : "";
+    const callDepth = 1;
+    let toolCallCount = 0;
     const allowedToolSet = allowedTools ? new Set(allowedTools) : null;
     const environment = {
       callTool: async (name, toolInput, options) => {
         const throwOnError = options?.throwOnError !== false;
+        if (isBlockedSelfReference(name)) {
+          audit?.logSecuritySelfReference(executionId, name);
+        }
         assertNotSelfReference(name);
+        const decision = this.checkToolPolicy(name);
+        if (!decision.allowed) {
+          audit?.logSecurityAccessDenied(executionId, name, decision.reason);
+          const error = createToolCallError(TOOL_CALL_ERROR_CODES.ACCESS_DENIED, name, decision.reason);
+          if (throwOnError) {
+            throw error;
+          }
+          return { success: false, error };
+        }
         if (allowedToolSet && !allowedToolSet.has(name)) {
+          audit?.logSecurityAccessDenied(executionId, name, "not in the caller-supplied allowedTools list");
           const error = createToolCallError(TOOL_CALL_ERROR_CODES.ACCESS_DENIED, name);
           if (throwOnError) {
             throw error;
           }
           return { success: false, error };
         }
+        toolCallCount += 1;
+        audit?.logToolCallStart(executionId, name, callDepth);
+        const toolCallStartedAt = Date.now();
         try {
           const request = {
             method: "tools/call",
@@ -2694,6 +3112,13 @@ var ExecuteTool = class extends ToolContext5 {
           };
           const mcpResult = await this.scope.runFlow("tools:call-tool", { request, ctx });
           if (!mcpResult) {
+            audit?.logToolCallFailure(
+              executionId,
+              name,
+              callDepth,
+              Date.now() - toolCallStartedAt,
+              TOOL_CALL_ERROR_CODES.EXECUTION
+            );
             const error = createToolCallError(TOOL_CALL_ERROR_CODES.EXECUTION, name, "Flow returned no result");
             if (throwOnError) {
               throw error;
@@ -2701,6 +3126,7 @@ var ExecuteTool = class extends ToolContext5 {
             return { success: false, error };
           }
           const result = extractResultFromCallToolResult(mcpResult);
+          audit?.logToolCallSuccess(executionId, name, callDepth, Date.now() - toolCallStartedAt);
           if (throwOnError) {
             return result;
           }
@@ -2708,6 +3134,7 @@ var ExecuteTool = class extends ToolContext5 {
         } catch (error) {
           const errorCode = getErrorCode(error);
           const rawMessage = error instanceof Error ? error.message : void 0;
+          audit?.logToolCallFailure(executionId, name, callDepth, Date.now() - toolCallStartedAt, errorCode);
           const sanitizedError = createToolCallError(errorCode, name, rawMessage);
           if (throwOnError) {
             throw sanitizedError;
@@ -2717,11 +3144,17 @@ var ExecuteTool = class extends ToolContext5 {
       },
       getTool: (name) => {
         try {
-          if (isBlockedSelfReference(name)) return void 0;
+          if (isBlockedSelfReference(name)) {
+            audit?.logSecuritySelfReference(executionId, name);
+            return void 0;
+          }
+          const introspectionAccess = this.checkToolPolicy(name);
+          if (!introspectionAccess.allowed) {
+            audit?.logSecurityAccessDenied(executionId, name, introspectionAccess.reason);
+            return void 0;
+          }
           if (allowedToolSet && !allowedToolSet.has(name)) return void 0;
-          const tools = this.scope.tools.getTools(true);
-          const tool = tools.find((t) => t.name === name || t.fullName === name);
-          if (!tool) return void 0;
+          const tool = introspectionAccess.entry;
           return toPlainJson({
             name: tool.name,
             description: tool.metadata?.description,
@@ -2741,8 +3174,11 @@ var ExecuteTool = class extends ToolContext5 {
       }
     };
     try {
-      const registeredTools = this.scope.tools.getTools(true);
-      const { namespaces, skipped } = buildToolNamespaces(registeredTools, environment.callTool);
+      const policyConfig = readCodeCallPolicyConfig(this.get(CodeCallConfig));
+      const callableTools = this.scope.tools.getTools(true).filter(
+        (tool) => checkCodeCallToolPolicy(toCodeCallPolicyTool(tool, void 0, this.scope), policyConfig).allowed
+      );
+      const { namespaces, skipped } = buildToolNamespaces(callableTools, environment.callTool);
       environment.namespaces = namespaces;
       if (skipped.length > 0) {
         this.logger?.debug?.("codecall: tools skipped during namespace generation", {
@@ -2758,9 +3194,14 @@ var ExecuteTool = class extends ToolContext5 {
     }
     const enclaveService = this.get(EnclaveService);
     const config = this.get(CodeCallConfig);
+    const startedAt = Date.now();
+    const elapsed = (reported) => reported ?? Date.now() - startedAt;
+    audit?.logExecutionStart(executionId, script);
     try {
       const executionResult = await enclaveService.execute(script, environment);
+      const durationMs = elapsed(executionResult.stats?.duration);
       if (executionResult.timedOut) {
+        audit?.logExecutionTimeout(executionId, script, durationMs);
         return {
           status: "timeout",
           error: {
@@ -2771,6 +3212,8 @@ var ExecuteTool = class extends ToolContext5 {
       if (!executionResult.success) {
         const error = executionResult.error;
         if (error.code === "VALIDATION_ERROR" || error.name === "ValidationError") {
+          audit?.logSecurityAstBlocked(executionId, error.blockedPatterns?.join(", ") ?? "UNKNOWN", error.message);
+          audit?.logExecutionFailure(executionId, script, durationMs, error.message);
           return {
             status: "illegal_access",
             error: {
@@ -2780,6 +3223,7 @@ var ExecuteTool = class extends ToolContext5 {
           };
         }
         if (error.toolName) {
+          audit?.logExecutionFailure(executionId, script, durationMs, error.message);
           return {
             status: "tool_error",
             error: {
@@ -2792,6 +3236,7 @@ var ExecuteTool = class extends ToolContext5 {
             }
           };
         }
+        audit?.logExecutionFailure(executionId, script, durationMs, error.message);
         return {
           status: "runtime_error",
           error: {
@@ -2802,6 +3247,7 @@ var ExecuteTool = class extends ToolContext5 {
           }
         };
       }
+      audit?.logExecutionSuccess(executionId, script, durationMs, toolCallCount);
       return {
         status: "ok",
         result: executionResult.result,
@@ -2810,6 +3256,7 @@ var ExecuteTool = class extends ToolContext5 {
     } catch (error) {
       const errorName = error instanceof Error ? error.name : "Error";
       const errorMessage = error instanceof Error ? error.message : String(error);
+      audit?.logExecutionFailure(executionId, script, elapsed(), errorMessage);
       const errorStack = error instanceof Error ? error.stack : void 0;
       const errorLoc = error.loc;
       if (errorName === "SyntaxError" || errorMessage?.includes("syntax")) {
@@ -2887,11 +3334,20 @@ function buildErrorResult(message) {
 var InvokeTool = class extends ToolContext6 {
   async execute(input) {
     const { tool: toolName, input: toolInput } = input;
+    const audit = this.tryGet(AuditLoggerService);
+    const executionId = audit ? audit.generateExecutionId() : "";
+    const startedAt = Date.now();
     if (isBlockedSelfReference(toolName)) {
+      audit?.logSecuritySelfReference(executionId, toolName);
       return buildErrorResult(
         `Tool "${toolName}" cannot be invoked directly. CodeCall tools are internal and not accessible via codecall:invoke.`
       );
     }
+    const decision = checkCodeCallToolAccess(this.scope, this.get(CodeCallConfig), toolName, { directCall: true });
+    if (!decision.allowed) {
+      audit?.logSecurityAccessDenied(executionId, toolName, decision.reason);
+      return buildErrorResult(`Tool "${toolName}" is not available. Use codecall:search to discover available tools.`);
+    }
     const request = {
       method: "tools/call",
       params: {
@@ -2904,8 +3360,10 @@ var InvokeTool = class extends ToolContext6 {
     };
     const result = await this.scope.runFlow("tools:call-tool", { request, ctx });
     if (!result) {
+      audit?.logInvoke(executionId, toolName, false, Date.now() - startedAt);
       return buildErrorResult(`Tool "${toolName}" not found. Use codecall:search to discover available tools.`);
     }
+    audit?.logInvoke(executionId, toolName, true, Date.now() - startedAt);
     return result;
   }
 };
@@ -2928,6 +3386,10 @@ InvokeTool = __decorateClass([
 ], InvokeTool);
 
 // plugins/plugin-codecall/src/codecall.plugin.ts
+function auditLogFields(event) {
+  const { executionId, durationMs, data } = event;
+  return durationMs === void 0 ? { executionId, ...data } : { executionId, durationMs, ...data };
+}
 var CodeCallPlugin = class extends DynamicPlugin {
   options;
   cachedLogger;
@@ -2962,6 +3424,21 @@ var CodeCallPlugin = class extends DynamicPlugin {
           return new EnclaveService(cfg);
         }
       },
+      {
+        // GHSA-adjacent: production.mdx promised operators these events and nothing emitted them,
+        // because the service was never registered. The subscription lives here, in the factory,
+        // for a reason: there is no provider teardown hook in the SDK, so subscribing anywhere
+        // per-request would grow the listener Set for the life of the process.
+        name: "codecall:audit-logger",
+        provide: AuditLoggerService,
+        inject: () => [ScopeEntry],
+        useFactory: (scope) => {
+          const audit = new AuditLoggerService();
+          const logger = scope.logger.child("codecall:audit");
+          audit.subscribe((event) => logger.info(event.type, auditLogFields(event)));
+          return audit;
+        }
+      },
       {
         name: "codecall:tool-search",
         provide: ToolSearchService,
@@ -3059,6 +3536,8 @@ CodeCallPlugin = __decorateClass([
   })
 ], CodeCallPlugin);
 export {
+  AUDIT_EVENT_TYPES,
+  AuditLoggerService,
   CodeCallPlugin,
   codeCallDirectCallsOptionsSchema,
   codeCallEmbeddingOptionsSchema,