@frontmcp/plugin-codecall 1.8.2 → 1.8.3

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-codecall",
-  "version": "1.8.2",
+  "version": "1.8.3",
   "description": "CodeCall plugin for FrontMCP - AgentScript-based meta-tools for orchestrating MCP tools",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -48,14 +48,14 @@
     }
   },
   "dependencies": {
-    "@enclave-vm/core": "^2.15.2",
-    "@frontmcp/protocol": "1.8.2",
-    "@frontmcp/sdk": "1.8.2",
+    "@enclave-vm/core": "^2.15.3",
+    "@frontmcp/protocol": "1.8.3",
+    "@frontmcp/sdk": "1.8.3",
     "vectoriadb": "^2.3.2"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.2",
-    "@frontmcp/plugin-cache": "1.8.2"
+    "@frontmcp/lazy-zod": "1.8.3",
+    "@frontmcp/plugin-cache": "1.8.3"
   },
   "devDependencies": {
     "reflect-metadata": "^0.2.2"

package/index.js

@@ -413,6 +413,46 @@ function presetDefaults(preset) {
 
 // plugins/plugin-codecall/src/services/audit-logger.service.ts
 var import_sdk2 = require("@frontmcp/sdk");
+
+// plugins/plugin-codecall/src/utils/client-error-message.ts
+var EMBEDDED_STACK_FRAME_RE = /\n[ \t]*at\s[^\n]*/g;
+var QUOTED_PATH_RE = /(['"`])((?:~?\/|[A-Za-z]:[\\/]|\\\\)[^\s'"`\\/][^'"`\n]*)\1/g;
+var URL_RE = /\b[A-Za-z][A-Za-z0-9+.-]{1,31}:\/\/(?:[^\s'"`<>,;]|[,;](?!~?\/|[A-Za-z]:[\\/]|\\\\))*/g;
+var QUERY_PATH_VALUE_RE = /([?&][^=&#]*=)(?:~?\/|[A-Za-z]:[\\/]|\\\\)[^&#]*/g;
+var POSIX_SEGMENT = String.raw`[^\s/\\'"\x60<>|,;:()\[\]{}]+`;
+var WINDOWS_SEGMENT = String.raw`[^\s/\\'"\x60<>|,;:*?]+`;
+function segments(segment, separator) {
+  const spaced = `${segment}(?: ${segment}){0,2}`;
+  return `(?:(?:${spaced}${separator})+(?:${segment})?|${segment})`;
+}
+var UNQUOTED_PATH_RE = new RegExp(
+  [
+    String.raw`(?<![\w.~/\\)\]-])~?/+${segments(POSIX_SEGMENT, "/+")}`,
+    String.raw`(?<![\w\\/])[A-Za-z]:[\\/]+${segments(WINDOWS_SEGMENT, String.raw`[\\/]+`)}?`,
+    String.raw`(?<![\w\\])\\\\${segments(WINDOWS_SEGMENT, String.raw`[\\/]+`)}`
+  ].join("|"),
+  "g"
+);
+function redactPaths(text) {
+  return text.replace(QUOTED_PATH_RE, "$1[path]$1").replace(UNQUOTED_PATH_RE, "[path]");
+}
+function toClientErrorMessage(message) {
+  if (!message) return "";
+  return redactAbsolutePaths(message.replace(EMBEDDED_STACK_FRAME_RE, ""));
+}
+function redactAbsolutePaths(text) {
+  let result = "";
+  let last = 0;
+  for (const match of text.matchAll(URL_RE)) {
+    const start = match.index ?? 0;
+    result += redactPaths(text.slice(last, start));
+    result += /^file:/i.test(match[0]) ? "[path]" : match[0].replace(QUERY_PATH_VALUE_RE, "$1[path]");
+    last = start + match[0].length;
+  }
+  return result + redactPaths(text.slice(last));
+}
+
+// plugins/plugin-codecall/src/services/audit-logger.service.ts
 var AUDIT_EVENT_TYPES = {
   /** Script execution started */
   EXECUTION_START: "codecall:execution:start",
@@ -689,9 +729,8 @@ var AuditLoggerService = class {
    */
   sanitizeError(error) {
     if (!error) return "Unknown error";
-    let sanitized = error.replace(/(?:\/[\w.-]+)+|(?:[A-Za-z]:\\[\w\\.-]+)+/g, "[path]");
+    let sanitized = toClientErrorMessage(error);
     sanitized = sanitized.replace(/:\d+:\d+/g, "");
-    sanitized = sanitized.replace(/\n\s*at .*/g, "");
     if (sanitized.length > 200) {
       sanitized = sanitized.substring(0, 200) + "...";
     }
@@ -710,6 +749,10 @@ var import_vectoriadb = require("vectoriadb");
 
 // plugins/plugin-codecall/src/security/codecall-tool-policy.ts
 var BLOCKED_NAMESPACE_PATTERNS = Object.freeze([/^system:/, /^internal:/, /^__/]);
+function isOfferedToCaller(availableWhen, surface) {
+  const offered = availableWhen?.surface;
+  return offered === void 0 || surface === void 0 || offered.includes(surface);
+}
 var ALLOWED = { allowed: true };
 function deny(reason) {
   return { allowed: false, reason };
@@ -730,16 +773,46 @@ function toCodeCallPolicyTool(entry, requestedName, scope) {
     tags: metadata?.tags,
     // `internal` tools refuse every external tools/call, CodeCall's included, so no surface may offer them.
     hidden: metadata?.hideFromDiscovery === true || metadata?.visibility === "hidden" || metadata?.visibility === "internal",
-    codecall: metadata?.codecall
+    codecall: metadata?.codecall,
+    annotations: metadata?.annotations,
+    metadata
   };
 }
+function isPlainData(value) {
+  if (Array.isArray(value)) return true;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function readOnlyCopy(value, copies) {
+  if (typeof value !== "object" || value === null || !isPlainData(value)) return value;
+  const existing = copies.get(value);
+  if (existing !== void 0) return existing;
+  const copy = Array.isArray(value) ? [] : Object.create(Object.getPrototypeOf(value));
+  copies.set(value, copy);
+  for (const key of Reflect.ownKeys(value)) {
+    if (!Object.prototype.propertyIsEnumerable.call(value, key)) continue;
+    Object.defineProperty(copy, key, {
+      value: readOnlyCopy(Reflect.get(value, key), copies),
+      enumerable: true,
+      writable: true,
+      configurable: true
+    });
+  }
+  return Object.freeze(copy);
+}
 function toToolFilterInfo(tool) {
+  const copies = /* @__PURE__ */ new WeakMap();
+  const annotations = readOnlyCopy(tool.annotations, copies);
+  const metadata = tool.metadata ? readOnlyCopy({ ...tool.metadata, ...annotations ? { annotations: tool.annotations } : {} }, copies) : void 0;
   return {
     name: tool.name,
+    fullName: tool.fullName,
     appId: tool.appId,
     source: tool.codecall?.source,
     description: tool.description,
-    tags: tool.codecall?.tags ?? tool.tags
+    tags: readOnlyCopy(tool.codecall?.tags ?? tool.tags, copies),
+    annotations,
+    metadata
   };
 }
 function ownNamesOf(tool) {
@@ -826,6 +899,9 @@ function readCodeCallPolicyConfig(config) {
 function checkCodeCallToolAccess(scope, config, name, options = {}) {
   const entry = resolveCodeCallTool(scope, name);
   if (!entry) return denyUnknownTool(name);
+  if (!isOfferedToCaller(entry.metadata?.availableWhen, options.surface)) {
+    return deny(`Tool "${name}" is not offered on the caller's surface "${options.surface}"`);
+  }
   const policyTool = toCodeCallPolicyTool(entry, name, scope);
   const baseDecision = checkCodeCallToolPolicy(policyTool, readCodeCallPolicyConfig(config));
   if (!baseDecision.allowed) return baseDecision;
@@ -1359,6 +1435,8 @@ var ToolSearchService = class _ToolSearchService {
   subscriptionReject = null;
   retryTimeoutId = null;
   disposed = false;
+  /** `availableWhen` of each indexed tool, by indexed name, for per-caller surface filtering. */
+  availabilityByTool = /* @__PURE__ */ new Map();
   constructor(config = {}, scope) {
     this.scope = scope;
     const embeddingOptions = config.embeddingOptions || {
@@ -1468,6 +1546,7 @@ var ToolSearchService = class _ToolSearchService {
    */
   async handleToolChange(tools) {
     this.vectorDB.clear();
+    this.availabilityByTool = /* @__PURE__ */ new Map();
     if (tools.length === 0) {
       this.initialized = true;
       return;
@@ -1482,6 +1561,7 @@ var ToolSearchService = class _ToolSearchService {
       return;
     }
     const documents = filteredTools.map((tool) => {
+      this.availabilityByTool.set(tool.name, tool.metadata.availableWhen);
       const searchableText = this.extractSearchableText(tool);
       const appId = this.extractAppId(tool);
       const toolName = tool.name;
@@ -1610,12 +1690,15 @@ var ToolSearchService = class _ToolSearchService {
    */
   async search(query, options = {}) {
     await this.ensureSubscribed();
-    const { topK = this.config.defaultTopK, appIds, excludeToolNames = [] } = options;
+    const { topK = this.config.defaultTopK, appIds, excludeToolNames = [], surface } = options;
     const minScore = this.config.defaultSimilarityThreshold;
     const filter = (metadata) => {
       if (excludeToolNames.includes(metadata.toolName)) {
         return false;
       }
+      if (!isOfferedToCaller(metadata.toolInstance.metadata.availableWhen, surface)) {
+        return false;
+      }
       if (appIds && appIds.length > 0) {
         if (!metadata.appId || !appIds.includes(metadata.appId)) {
           return false;
@@ -1647,9 +1730,12 @@ var ToolSearchService = class _ToolSearchService {
     }
   }
   /**
-   * Gets the total number of indexed tools
+   * Gets the total number of indexed tools, or of those a caller on `surface` may reach
    */
-  getTotalCount() {
+  getTotalCount(surface) {
+    if (surface !== void 0) {
+      return this.getAllToolNames().filter((toolName) => this.hasTool(toolName, surface)).length;
+    }
     if (this.vectorDB instanceof import_vectoriadb.VectoriaDB) {
       return this.vectorDB.size();
     } else {
@@ -1657,20 +1743,18 @@ var ToolSearchService = class _ToolSearchService {
     }
   }
   /**
-   * Checks if a tool exists in the index
+   * Checks if a tool exists in the index, for a caller on `surface` when given
    */
-  hasTool(toolName) {
-    if (this.vectorDB instanceof import_vectoriadb.VectoriaDB) {
-      return this.vectorDB.has(toolName);
-    } else {
-      return this.vectorDB.hasDocument(toolName);
-    }
+  hasTool(toolName, surface) {
+    const indexed = this.vectorDB instanceof import_vectoriadb.VectoriaDB ? this.vectorDB.has(toolName) : this.vectorDB.hasDocument(toolName);
+    return indexed && isOfferedToCaller(this.availabilityByTool.get(toolName), surface);
   }
   /**
    * Clears the entire index
    */
   clear() {
     this.vectorDB.clear();
+    this.availabilityByTool = /* @__PURE__ */ new Map();
     this.initialized = false;
   }
   /**
@@ -1690,6 +1774,135 @@ var ToolSearchService = class _ToolSearchService {
 // plugins/plugin-codecall/src/services/enclave.service.ts
 var import_core = require("@enclave-vm/core");
 var import_sdk3 = require("@frontmcp/sdk");
+
+// plugins/plugin-codecall/src/utils/build-tool-namespaces.ts
+var IDENT_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+var PROTOTYPE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var RESERVED_NAMESPACES = /* @__PURE__ */ new Set([
+  "console",
+  "Math",
+  "JSON",
+  "Object",
+  "Array",
+  "String",
+  "Number",
+  "Boolean",
+  "Promise",
+  "Symbol",
+  "Map",
+  "Set",
+  "WeakMap",
+  "WeakSet",
+  "Date",
+  "Error",
+  "RegExp",
+  "globalThis",
+  "global",
+  "window",
+  "self",
+  "undefined",
+  "null",
+  "true",
+  "false",
+  "callTool",
+  "getTool",
+  "mcpLog",
+  "mcpNotify"
+]);
+var UNBINDABLE_NAMESPACES = new Set(
+  [
+    // Reserved words and strict-mode restricted bindings
+    "break case catch class const continue debugger default delete do else enum export extends finally for",
+    "function if import in instanceof new return super switch this throw try typeof var void while with yield",
+    "let static implements interface package private protected public await eval arguments NaN Infinity",
+    // AgentScript globals
+    "parallel isNaN isFinite parseInt parseFloat encodeURI encodeURIComponent decodeURI decodeURIComponent",
+    // Identifiers the AgentScript validator refuses
+    "process require module exports Buffer Function AsyncFunction GeneratorFunction Reflect Proxy TypeError",
+    "ReferenceError SyntaxError RangeError URIError EvalError AggregateError fetch XMLHttpRequest WebSocket",
+    "localStorage sessionStorage indexedDB crypto performance structuredClone AbortController AbortSignal",
+    "MessageChannel MessagePort BroadcastChannel TextEncoder TextDecoder Intl setTimeout setInterval",
+    "setImmediate clearTimeout clearInterval clearImmediate queueMicrotask WebAssembly Worker SharedWorker",
+    "ServiceWorker WeakRef FinalizationRegistry BigInt Atomics SharedArrayBuffer ArrayBuffer DataView"
+  ].join(" ").split(" ")
+);
+function buildToolNamespaces(tools) {
+  const namespaces = /* @__PURE__ */ Object.create(null);
+  const skipped = [];
+  for (const tool of tools) {
+    const name = tool?.name;
+    if (typeof name !== "string" || name.length === 0) continue;
+    const dot = name.indexOf(".");
+    if (dot <= 0 || dot === name.length - 1) {
+      skipped.push({ name, reason: "no-namespace-prefix" });
+      continue;
+    }
+    const ns = name.slice(0, dot);
+    const method = name.slice(dot + 1);
+    if (!IDENT_RE.test(ns) || !IDENT_RE.test(method)) {
+      skipped.push({ name, reason: "invalid-identifier" });
+      continue;
+    }
+    if (PROTOTYPE_KEYS.has(ns) || PROTOTYPE_KEYS.has(method)) {
+      skipped.push({ name, reason: "prototype-key" });
+      continue;
+    }
+    if (RESERVED_NAMESPACES.has(ns) || UNBINDABLE_NAMESPACES.has(ns) || ns.startsWith("__")) {
+      skipped.push({ name, reason: "reserved-namespace" });
+      continue;
+    }
+    const bucket = namespaces[ns] ?? (namespaces[ns] = /* @__PURE__ */ Object.create(null));
+    if (Object.prototype.hasOwnProperty.call(bucket, method)) {
+      skipped.push({ name, reason: "duplicate-method" });
+      continue;
+    }
+    bucket[method] = name;
+  }
+  return { namespaces, skipped };
+}
+var NAMESPACE_CALL_HELPER = "__codecallNamespaceCall";
+var NAMESPACE_CALL_HELPER_SOURCE = `const ${NAMESPACE_CALL_HELPER} = async (toolName, run, options) => { if (options && options.throwOnError === false) { try { return { success: true, data: await run() }; } catch (error) { return { success: false, error: { message: error && error.message, toolName: toolName } }; } } return await run(); };`;
+function mentionsIdentifier(script, identifier) {
+  let from = 0;
+  for (; ; ) {
+    const at = script.indexOf(identifier, from);
+    if (at === -1) return false;
+    from = at + 1;
+    const before = at > 0 ? script[at - 1] : "";
+    const after = script[at + identifier.length] ?? "";
+    if (/[A-Za-z0-9_$'"`]/.test(before) || /[A-Za-z0-9_$]/.test(after)) continue;
+    if (before === "." && script.slice(Math.max(0, at - 3), at) !== "...") continue;
+    return true;
+  }
+}
+function wrapScriptWithToolNamespaces(script, namespaces) {
+  if (!namespaces) return script;
+  const declarations = [];
+  for (const ns of Object.keys(namespaces)) {
+    if (!IDENT_RE.test(ns) || RESERVED_NAMESPACES.has(ns) || UNBINDABLE_NAMESPACES.has(ns) || ns.startsWith("__")) {
+      continue;
+    }
+    if (PROTOTYPE_KEYS.has(ns) || !mentionsIdentifier(script, ns)) continue;
+    const methods = namespaces[ns];
+    const entries = [];
+    for (const method of Object.keys(methods)) {
+      const toolName = methods[method];
+      if (!IDENT_RE.test(method) || PROTOTYPE_KEYS.has(method) || toolName !== `${ns}.${method}`) continue;
+      const literal = JSON.stringify(toolName);
+      entries.push(
+        `${JSON.stringify(method)}: (input, options) => ${NAMESPACE_CALL_HELPER}(${literal}, () => callTool(${literal}, input === undefined ? {} : input), options)`
+      );
+    }
+    if (entries.length > 0) {
+      declarations.push(`const ${ns} = { ${entries.join(", ")} };`);
+    }
+  }
+  if (declarations.length === 0) return script;
+  return `${NAMESPACE_CALL_HELPER_SOURCE} ${declarations.join(" ")} return await (async () => {${script}
+})();`;
+}
+
+// plugins/plugin-codecall/src/services/enclave.service.ts
 var ScriptTooLargeError = class extends Error {
   code = "SCRIPT_TOO_LARGE";
   scriptLength;
@@ -1738,10 +1951,7 @@ var EnclaveService = class {
       maxResolvedSize: this.sidecarOptions.maxResolvedSize,
       allowComposites: this.sidecarOptions.allowComposites
     } : void 0;
-    const RESERVED_GLOBALS = /* @__PURE__ */ new Set(["getTool", "mcpLog", "mcpNotify"]);
-    const safeNamespaces = Object.fromEntries(
-      Object.entries(environment.namespaces ?? {}).filter(([key]) => !RESERVED_GLOBALS.has(key))
-    );
+    const source = wrapScriptWithToolNamespaces(code, environment.toolNamespaces);
     const enclave = new import_core.Enclave({
       timeout: this.vmOptions.timeoutMs,
       maxToolCalls: this.vmOptions.maxSteps || 100,
@@ -1755,11 +1965,6 @@ var EnclaveService = class {
       // Allow functions in globals since we intentionally provide getTool, mcpLog, mcpNotify, and console
       allowFunctionsInGlobals: true,
       globals: {
-        // Tool namespaces (e.g. `acme.getUser`) flow through here. Spread
-        // FIRST so the runtime reserved globals below are guaranteed
-        // last-wins. Reserved keys have already been stripped above —
-        // belt-and-braces ordering makes the invariant locally obvious.
-        ...safeNamespaces,
         // Provide getTool as a custom global
         getTool: environment.getTool,
         // Provide logging functions if available
@@ -1782,7 +1987,7 @@ var EnclaveService = class {
       }
     });
     try {
-      const result = await enclave.run(code);
+      const result = await enclave.run(source);
       return this.mapEnclaveResult(result, logs);
     } finally {
       enclave.dispose();
@@ -1930,7 +2135,10 @@ var SearchTool = class extends import_sdk4.ToolContext {
     const audit = this.tryGet(AuditLoggerService);
     const executionId = audit ? audit.generateExecutionId() : "";
     const startedAt = Date.now();
-    const nonExistentExcludedTools = excludeToolNames.filter((toolName) => !searchService.hasTool(toolName));
+    const surface = (0, import_sdk4.getCallSurface)();
+    const nonExistentExcludedTools = excludeToolNames.filter(
+      (toolName) => !searchService.hasTool(toolName, surface)
+    );
     if (nonExistentExcludedTools.length > 0) {
       warnings.push({
         type: "excluded_tool_not_found",
@@ -1944,7 +2152,8 @@ var SearchTool = class extends import_sdk4.ToolContext {
       const searchResults = await searchService.search(query, {
         topK,
         appIds,
-        excludeToolNames
+        excludeToolNames,
+        surface
       });
       for (const result of searchResults) {
         if (result.relevanceScore < minRelevanceScore) {
@@ -1989,7 +2198,7 @@ var SearchTool = class extends import_sdk4.ToolContext {
     return {
       tools,
       warnings,
-      totalAvailableTools: searchService.getTotalCount()
+      totalAvailableTools: searchService.getTotalCount(surface)
     };
   }
 };
@@ -2340,11 +2549,10 @@ function getSanitizedMessage(code, toolName, rawMessage) {
   }
 }
 function sanitizeValidationMessage(message) {
-  let sanitized = message.replace(/(?:\/[\w.-]+)+|(?:[A-Za-z]:\\[\w\\.-]+)+/g, "[path]");
+  let sanitized = toClientErrorMessage(message);
   sanitized = sanitized.replace(/\bat line \d+/gi, "");
   sanitized = sanitized.replace(/\bline \d+/gi, "");
   sanitized = sanitized.replace(/:\d+:\d+/g, "");
-  sanitized = sanitized.replace(/\n\s*at .*/g, "");
   if (sanitized.length > 200) {
     sanitized = sanitized.substring(0, 200) + "...";
   }
@@ -2382,75 +2590,6 @@ function assertNotSelfReference(toolName) {
   }
 }
 
-// plugins/plugin-codecall/src/utils/build-tool-namespaces.ts
-var IDENT_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
-var PROTOTYPE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
-var RESERVED_NAMESPACES = /* @__PURE__ */ new Set([
-  "console",
-  "Math",
-  "JSON",
-  "Object",
-  "Array",
-  "String",
-  "Number",
-  "Boolean",
-  "Promise",
-  "Symbol",
-  "Map",
-  "Set",
-  "WeakMap",
-  "WeakSet",
-  "Date",
-  "Error",
-  "RegExp",
-  "globalThis",
-  "global",
-  "window",
-  "self",
-  "undefined",
-  "null",
-  "true",
-  "false",
-  "callTool",
-  "getTool",
-  "mcpLog",
-  "mcpNotify"
-]);
-function buildToolNamespaces(tools, callTool) {
-  const namespaces = /* @__PURE__ */ Object.create(null);
-  const skipped = [];
-  for (const tool of tools) {
-    const name = tool?.name;
-    if (typeof name !== "string" || name.length === 0) continue;
-    const dot = name.indexOf(".");
-    if (dot <= 0 || dot === name.length - 1) {
-      skipped.push({ name, reason: "no-namespace-prefix" });
-      continue;
-    }
-    const ns = name.slice(0, dot);
-    const method = name.slice(dot + 1);
-    if (!IDENT_RE.test(ns) || !IDENT_RE.test(method)) {
-      skipped.push({ name, reason: "invalid-identifier" });
-      continue;
-    }
-    if (PROTOTYPE_KEYS.has(ns)) {
-      skipped.push({ name, reason: "prototype-key" });
-      continue;
-    }
-    if (RESERVED_NAMESPACES.has(ns)) {
-      skipped.push({ name, reason: "reserved-namespace" });
-      continue;
-    }
-    const bucket = namespaces[ns] ?? (namespaces[ns] = /* @__PURE__ */ Object.create(null));
-    if (Object.prototype.hasOwnProperty.call(bucket, method)) {
-      skipped.push({ name, reason: "duplicate-method" });
-      continue;
-    }
-    bucket[method] = (input, options) => callTool(name, input, options);
-  }
-  return { namespaces, skipped };
-}
-
 // plugins/plugin-codecall/src/utils/describe.utils.ts
 var INTENT_PATTERNS = {
   create: /^(create|add|new|insert|make|append|register|generate|produce|build|construct|provision|instantiate|define|compose|draft)/i,
@@ -2812,12 +2951,13 @@ var DescribeTool = class extends import_sdk7.ToolContext {
     const tools = [];
     const notFound = [];
     const config = this.get(CodeCallConfig);
+    const surface = (0, import_sdk7.getCallSurface)();
     for (const toolName of toolNames) {
       if (isBlockedSelfReference(toolName)) {
         notFound.push(toolName);
         continue;
       }
-      const access = checkCodeCallToolAccess(this.scope, config, toolName);
+      const access = checkCodeCallToolAccess(this.scope, config, toolName, { surface });
       if (!access.allowed) {
         audit?.logSecurityAccessDenied(executionId, toolName, access.reason);
         notFound.push(toolName);
@@ -3029,6 +3169,7 @@ var runtimeErrorPayloadSchema = import_lazy_zod7.z.object({
   source: import_lazy_zod7.z.literal("script"),
   message: import_lazy_zod7.z.string(),
   name: import_lazy_zod7.z.string().optional(),
+  /** @deprecated Never set: stack traces name server files, so results don't carry them. */
   stack: import_lazy_zod7.z.string().optional()
 });
 var toolErrorPayloadSchema = import_lazy_zod7.z.object({
@@ -3037,6 +3178,7 @@ var toolErrorPayloadSchema = import_lazy_zod7.z.object({
   toolInput: import_lazy_zod7.z.unknown(),
   message: import_lazy_zod7.z.string(),
   code: import_lazy_zod7.z.string().optional(),
+  /** @deprecated Never set: the enclave's error data is not sanitized for clients. */
   details: import_lazy_zod7.z.unknown().optional()
 });
 var timeoutErrorPayloadSchema = import_lazy_zod7.z.object({
@@ -3101,11 +3243,12 @@ var ExecuteTool = class extends import_sdk8.ToolContext {
    * otherwise it would skip every metadata-driven check and reach `tools:call-tool`
    * unexamined.
    */
-  checkToolPolicy(name) {
-    return checkCodeCallToolAccess(this.scope, this.get(CodeCallConfig), name);
+  checkToolPolicy(name, surface) {
+    return checkCodeCallToolAccess(this.scope, this.get(CodeCallConfig), name, { surface });
   }
   async execute(input) {
     const { script, allowedTools } = input;
+    const callerSurface = (0, import_sdk8.getCallSurface)();
     const audit = this.tryGet(AuditLoggerService);
     const executionId = audit ? audit.generateExecutionId() : "";
     const callDepth = 1;
@@ -3118,7 +3261,7 @@ var ExecuteTool = class extends import_sdk8.ToolContext {
           audit?.logSecuritySelfReference(executionId, name);
         }
         assertNotSelfReference(name);
-        const decision = this.checkToolPolicy(name);
+        const decision = this.checkToolPolicy(name, callerSurface);
         if (!decision.allowed) {
           audit?.logSecurityAccessDenied(executionId, name, decision.reason);
           const error = createToolCallError(TOOL_CALL_ERROR_CODES.ACCESS_DENIED, name, decision.reason);
@@ -3147,7 +3290,8 @@ var ExecuteTool = class extends import_sdk8.ToolContext {
             }
           };
           const ctx = {
-            authInfo: this.authInfo
+            authInfo: this.authInfo,
+            surface: callerSurface
           };
           const mcpResult = await this.scope.runFlow("tools:call-tool", { request, ctx });
           if (!mcpResult) {
@@ -3187,7 +3331,7 @@ var ExecuteTool = class extends import_sdk8.ToolContext {
             audit?.logSecuritySelfReference(executionId, name);
             return void 0;
           }
-          const introspectionAccess = this.checkToolPolicy(name);
+          const introspectionAccess = this.checkToolPolicy(name, callerSurface);
           if (!introspectionAccess.allowed) {
             audit?.logSecurityAccessDenied(executionId, name, introspectionAccess.reason);
             return void 0;
@@ -3217,8 +3361,8 @@ var ExecuteTool = class extends import_sdk8.ToolContext {
       const callableTools = this.scope.tools.getTools(true).filter(
         (tool) => checkCodeCallToolPolicy(toCodeCallPolicyTool(tool, void 0, this.scope), policyConfig).allowed
       );
-      const { namespaces, skipped } = buildToolNamespaces(callableTools, environment.callTool);
-      environment.namespaces = namespaces;
+      const { namespaces, skipped } = buildToolNamespaces(callableTools);
+      environment.toolNamespaces = namespaces;
       if (skipped.length > 0) {
         this.logger?.debug?.("codecall: tools skipped during namespace generation", {
           count: skipped.length,
@@ -3269,9 +3413,9 @@ var ExecuteTool = class extends import_sdk8.ToolContext {
               source: "tool",
               toolName: error.toolName,
               toolInput: error.toolInput,
-              message: error.message,
-              code: error.code,
-              details: error.details
+              message: toClientErrorMessage(error.message),
+              code: error.code
+              // No `details`: the enclave's error data is not sanitized for clients.
             }
           };
         }
@@ -3280,9 +3424,8 @@ var ExecuteTool = class extends import_sdk8.ToolContext {
           status: "runtime_error",
           error: {
             source: "script",
-            message: error.message,
-            name: error.name,
-            stack: error.stack
+            message: toClientErrorMessage(error.message),
+            name: error.name
           }
         };
       }
@@ -3296,13 +3439,12 @@ var ExecuteTool = class extends import_sdk8.ToolContext {
       const errorName = error instanceof Error ? error.name : "Error";
       const errorMessage = error instanceof Error ? error.message : String(error);
       audit?.logExecutionFailure(executionId, script, elapsed(), errorMessage);
-      const errorStack = error instanceof Error ? error.stack : void 0;
       const errorLoc = error.loc;
       if (errorName === "SyntaxError" || errorMessage?.includes("syntax")) {
         return {
           status: "syntax_error",
           error: {
-            message: errorMessage || "Syntax error in script",
+            message: toClientErrorMessage(errorMessage) || "Syntax error in script",
             location: errorLoc ? { line: errorLoc.line, column: errorLoc.column } : void 0
           }
         };
@@ -3311,9 +3453,8 @@ var ExecuteTool = class extends import_sdk8.ToolContext {
         status: "runtime_error",
         error: {
           source: "script",
-          message: errorMessage || "An unexpected error occurred during script execution",
-          name: errorName,
-          stack: errorStack
+          message: toClientErrorMessage(errorMessage) || "An unexpected error occurred during script execution",
+          name: errorName
         }
       };
     }
@@ -3382,7 +3523,11 @@ var InvokeTool = class extends import_sdk9.ToolContext {
         `Tool "${toolName}" cannot be invoked directly. CodeCall tools are internal and not accessible via codecall:invoke.`
       );
     }
-    const decision = checkCodeCallToolAccess(this.scope, this.get(CodeCallConfig), toolName, { directCall: true });
+    const surface = (0, import_sdk9.getCallSurface)();
+    const decision = checkCodeCallToolAccess(this.scope, this.get(CodeCallConfig), toolName, {
+      directCall: true,
+      surface
+    });
     if (!decision.allowed) {
       audit?.logSecurityAccessDenied(executionId, toolName, decision.reason);
       return buildErrorResult(`Tool "${toolName}" is not available. Use codecall:search to discover available tools.`);
@@ -3395,7 +3540,8 @@ var InvokeTool = class extends import_sdk9.ToolContext {
       }
     };
     const ctx = {
-      authInfo: this.authInfo
+      authInfo: this.authInfo,
+      surface
     };
     const result = await this.scope.runFlow("tools:call-tool", { request, ctx });
     if (!result) {