@frontmcp/plugin-codecall 1.8.2 → 1.8.4

package/index.js

@@ -413,6 +413,46 @@ function presetDefaults(preset) {
 
 // plugins/plugin-codecall/src/services/audit-logger.service.ts
 var import_sdk2 = require("@frontmcp/sdk");
+
+// plugins/plugin-codecall/src/utils/client-error-message.ts
+var EMBEDDED_STACK_FRAME_RE = /\n[ \t]*at\s[^\n]*/g;
+var QUOTED_PATH_RE = /(['"`])((?:~?\/|[A-Za-z]:[\\/]|\\\\)[^\s'"`\\/][^'"`\n]*)\1/g;
+var URL_RE = /\b[A-Za-z][A-Za-z0-9+.-]{1,31}:\/\/(?:[^\s'"`<>,;]|[,;](?!~?\/|[A-Za-z]:[\\/]|\\\\))*/g;
+var QUERY_PATH_VALUE_RE = /([?&][^=&#]*=)(?:~?\/|[A-Za-z]:[\\/]|\\\\)[^&#]*/g;
+var POSIX_SEGMENT = String.raw`[^\s/\\'"\x60<>|,;:()\[\]{}]+`;
+var WINDOWS_SEGMENT = String.raw`[^\s/\\'"\x60<>|,;:*?]+`;
+function segments(segment, separator) {
+  const spaced = `${segment}(?: ${segment}){0,2}`;
+  return `(?:(?:${spaced}${separator})+(?:${segment})?|${segment})`;
+}
+var UNQUOTED_PATH_RE = new RegExp(
+  [
+    String.raw`(?<![\w.~/\\)\]-])~?/+${segments(POSIX_SEGMENT, "/+")}`,
+    String.raw`(?<![\w\\/])[A-Za-z]:[\\/]+${segments(WINDOWS_SEGMENT, String.raw`[\\/]+`)}?`,
+    String.raw`(?<![\w\\])\\\\${segments(WINDOWS_SEGMENT, String.raw`[\\/]+`)}`
+  ].join("|"),
+  "g"
+);
+function redactPaths(text) {
+  return text.replace(QUOTED_PATH_RE, "$1[path]$1").replace(UNQUOTED_PATH_RE, "[path]");
+}
+function toClientErrorMessage(message) {
+  if (!message) return "";
+  return redactAbsolutePaths(message.replace(EMBEDDED_STACK_FRAME_RE, ""));
+}
+function redactAbsolutePaths(text) {
+  let result = "";
+  let last = 0;
+  for (const match of text.matchAll(URL_RE)) {
+    const start = match.index ?? 0;
+    result += redactPaths(text.slice(last, start));
+    result += /^file:/i.test(match[0]) ? "[path]" : match[0].replace(QUERY_PATH_VALUE_RE, "$1[path]");
+    last = start + match[0].length;
+  }
+  return result + redactPaths(text.slice(last));
+}
+
+// plugins/plugin-codecall/src/services/audit-logger.service.ts
 var AUDIT_EVENT_TYPES = {
   /** Script execution started */
   EXECUTION_START: "codecall:execution:start",
@@ -689,9 +729,8 @@ var AuditLoggerService = class {
    */
   sanitizeError(error) {
     if (!error) return "Unknown error";
-    let sanitized = error.replace(/(?:\/[\w.-]+)+|(?:[A-Za-z]:\\[\w\\.-]+)+/g, "[path]");
+    let sanitized = toClientErrorMessage(error);
     sanitized = sanitized.replace(/:\d+:\d+/g, "");
-    sanitized = sanitized.replace(/\n\s*at .*/g, "");
     if (sanitized.length > 200) {
       sanitized = sanitized.substring(0, 200) + "...";
     }
@@ -710,6 +749,10 @@ var import_vectoriadb = require("vectoriadb");
 
 // plugins/plugin-codecall/src/security/codecall-tool-policy.ts
 var BLOCKED_NAMESPACE_PATTERNS = Object.freeze([/^system:/, /^internal:/, /^__/]);
+function isOfferedToCaller(availableWhen, surface) {
+  const offered = availableWhen?.surface;
+  return offered === void 0 || surface === void 0 || offered.includes(surface);
+}
 var ALLOWED = { allowed: true };
 function deny(reason) {
   return { allowed: false, reason };
@@ -730,16 +773,46 @@ function toCodeCallPolicyTool(entry, requestedName, scope) {
     tags: metadata?.tags,
     // `internal` tools refuse every external tools/call, CodeCall's included, so no surface may offer them.
     hidden: metadata?.hideFromDiscovery === true || metadata?.visibility === "hidden" || metadata?.visibility === "internal",
-    codecall: metadata?.codecall
+    codecall: metadata?.codecall,
+    annotations: metadata?.annotations,
+    metadata
   };
 }
+function isPlainData(value) {
+  if (Array.isArray(value)) return true;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function readOnlyCopy(value, copies) {
+  if (typeof value !== "object" || value === null || !isPlainData(value)) return value;
+  const existing = copies.get(value);
+  if (existing !== void 0) return existing;
+  const copy = Array.isArray(value) ? [] : Object.create(Object.getPrototypeOf(value));
+  copies.set(value, copy);
+  for (const key of Reflect.ownKeys(value)) {
+    if (!Object.prototype.propertyIsEnumerable.call(value, key)) continue;
+    Object.defineProperty(copy, key, {
+      value: readOnlyCopy(Reflect.get(value, key), copies),
+      enumerable: true,
+      writable: true,
+      configurable: true
+    });
+  }
+  return Object.freeze(copy);
+}
 function toToolFilterInfo(tool) {
+  const copies = /* @__PURE__ */ new WeakMap();
+  const annotations = readOnlyCopy(tool.annotations, copies);
+  const metadata = tool.metadata ? readOnlyCopy({ ...tool.metadata, ...annotations ? { annotations: tool.annotations } : {} }, copies) : void 0;
   return {
     name: tool.name,
+    fullName: tool.fullName,
     appId: tool.appId,
     source: tool.codecall?.source,
     description: tool.description,
-    tags: tool.codecall?.tags ?? tool.tags
+    tags: readOnlyCopy(tool.codecall?.tags ?? tool.tags, copies),
+    annotations,
+    metadata
   };
 }
 function ownNamesOf(tool) {
@@ -826,6 +899,9 @@ function readCodeCallPolicyConfig(config) {
 function checkCodeCallToolAccess(scope, config, name, options = {}) {
   const entry = resolveCodeCallTool(scope, name);
   if (!entry) return denyUnknownTool(name);
+  if (!isOfferedToCaller(entry.metadata?.availableWhen, options.surface)) {
+    return deny(`Tool "${name}" is not offered on the caller's surface "${options.surface}"`);
+  }
   const policyTool = toCodeCallPolicyTool(entry, name, scope);
   const baseDecision = checkCodeCallToolPolicy(policyTool, readCodeCallPolicyConfig(config));
   if (!baseDecision.allowed) return baseDecision;
@@ -1359,6 +1435,8 @@ var ToolSearchService = class _ToolSearchService {
   subscriptionReject = null;
   retryTimeoutId = null;
   disposed = false;
+  /** `availableWhen` of each indexed tool, by indexed name, for per-caller surface filtering. */
+  availabilityByTool = /* @__PURE__ */ new Map();
   constructor(config = {}, scope) {
     this.scope = scope;
     const embeddingOptions = config.embeddingOptions || {
@@ -1468,6 +1546,7 @@ var ToolSearchService = class _ToolSearchService {
    */
   async handleToolChange(tools) {
     this.vectorDB.clear();
+    this.availabilityByTool = /* @__PURE__ */ new Map();
     if (tools.length === 0) {
       this.initialized = true;
       return;
@@ -1482,6 +1561,7 @@ var ToolSearchService = class _ToolSearchService {
       return;
     }
     const documents = filteredTools.map((tool) => {
+      this.availabilityByTool.set(tool.name, tool.metadata.availableWhen);
       const searchableText = this.extractSearchableText(tool);
       const appId = this.extractAppId(tool);
       const toolName = tool.name;
@@ -1610,12 +1690,15 @@ var ToolSearchService = class _ToolSearchService {
    */
   async search(query, options = {}) {
     await this.ensureSubscribed();
-    const { topK = this.config.defaultTopK, appIds, excludeToolNames = [] } = options;
+    const { topK = this.config.defaultTopK, appIds, excludeToolNames = [], surface } = options;
     const minScore = this.config.defaultSimilarityThreshold;
     const filter = (metadata) => {
       if (excludeToolNames.includes(metadata.toolName)) {
         return false;
       }
+      if (!isOfferedToCaller(metadata.toolInstance.metadata.availableWhen, surface)) {
+        return false;
+      }
       if (appIds && appIds.length > 0) {
         if (!metadata.appId || !appIds.includes(metadata.appId)) {
           return false;
@@ -1647,9 +1730,12 @@ var ToolSearchService = class _ToolSearchService {
     }
   }
   /**
-   * Gets the total number of indexed tools
+   * Gets the total number of indexed tools, or of those a caller on `surface` may reach
    */
-  getTotalCount() {
+  getTotalCount(surface) {
+    if (surface !== void 0) {
+      return this.getAllToolNames().filter((toolName) => this.hasTool(toolName, surface)).length;
+    }
     if (this.vectorDB instanceof import_vectoriadb.VectoriaDB) {
       return this.vectorDB.size();
     } else {
@@ -1657,20 +1743,18 @@ var ToolSearchService = class _ToolSearchService {
     }
   }
   /**
-   * Checks if a tool exists in the index
+   * Checks if a tool exists in the index, for a caller on `surface` when given
    */
-  hasTool(toolName) {
-    if (this.vectorDB instanceof import_vectoriadb.VectoriaDB) {
-      return this.vectorDB.has(toolName);
-    } else {
-      return this.vectorDB.hasDocument(toolName);
-    }
+  hasTool(toolName, surface) {
+    const indexed = this.vectorDB instanceof import_vectoriadb.VectoriaDB ? this.vectorDB.has(toolName) : this.vectorDB.hasDocument(toolName);
+    return indexed && isOfferedToCaller(this.availabilityByTool.get(toolName), surface);
   }
   /**
    * Clears the entire index
    */
   clear() {
     this.vectorDB.clear();
+    this.availabilityByTool = /* @__PURE__ */ new Map();
     this.initialized = false;
   }
   /**
@@ -1690,6 +1774,159 @@ var ToolSearchService = class _ToolSearchService {
 // plugins/plugin-codecall/src/services/enclave.service.ts
 var import_core = require("@enclave-vm/core");
 var import_sdk3 = require("@frontmcp/sdk");
+
+// plugins/plugin-codecall/src/utils/build-tool-namespaces.ts
+var IDENT_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+var PROTOTYPE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var RESERVED_NAMESPACES = /* @__PURE__ */ new Set([
+  "console",
+  "Math",
+  "JSON",
+  "Object",
+  "Array",
+  "String",
+  "Number",
+  "Boolean",
+  "Promise",
+  "Symbol",
+  "Map",
+  "Set",
+  "WeakMap",
+  "WeakSet",
+  "Date",
+  "Error",
+  "RegExp",
+  "globalThis",
+  "global",
+  "window",
+  "self",
+  "undefined",
+  "null",
+  "true",
+  "false",
+  "callTool",
+  "getTool",
+  "mcpLog",
+  "mcpNotify"
+]);
+var UNBINDABLE_NAMESPACES = new Set(
+  [
+    // Reserved words and strict-mode restricted bindings
+    "break case catch class const continue debugger default delete do else enum export extends finally for",
+    "function if import in instanceof new return super switch this throw try typeof var void while with yield",
+    "let static implements interface package private protected public await eval arguments NaN Infinity",
+    // AgentScript globals
+    "parallel isNaN isFinite parseInt parseFloat encodeURI encodeURIComponent decodeURI decodeURIComponent",
+    // Identifiers the AgentScript validator refuses
+    "process require module exports Buffer Function AsyncFunction GeneratorFunction Reflect Proxy TypeError",
+    "ReferenceError SyntaxError RangeError URIError EvalError AggregateError fetch XMLHttpRequest WebSocket",
+    "localStorage sessionStorage indexedDB crypto performance structuredClone AbortController AbortSignal",
+    "MessageChannel MessagePort BroadcastChannel TextEncoder TextDecoder Intl setTimeout setInterval",
+    "setImmediate clearTimeout clearInterval clearImmediate queueMicrotask WebAssembly Worker SharedWorker",
+    "ServiceWorker WeakRef FinalizationRegistry BigInt Atomics SharedArrayBuffer ArrayBuffer DataView",
+    "importScripts ShadowRealm Iterator AsyncIterator"
+  ].join(" ").split(" ")
+);
+var UNCALLABLE_METHODS = new Set(
+  [
+    "process require module exports Buffer eval Function AsyncFunction GeneratorFunction arguments RegExp",
+    "Promise Symbol Proxy Reflect Error TypeError ReferenceError SyntaxError RangeError URIError EvalError",
+    "AggregateError fetch XMLHttpRequest WebSocket localStorage sessionStorage indexedDB crypto performance",
+    "structuredClone AbortController AbortSignal MessageChannel MessagePort BroadcastChannel TextEncoder",
+    "TextDecoder Intl setTimeout setInterval setImmediate clearTimeout clearInterval clearImmediate",
+    "queueMicrotask WebAssembly Worker SharedWorker ServiceWorker WeakMap WeakSet WeakRef FinalizationRegistry",
+    "Map Set Atomics SharedArrayBuffer importScripts ShadowRealm Iterator AsyncIterator"
+  ].join(" ").split(" ")
+);
+var SANDBOX_TOOL_NAME_RE = /^[a-zA-Z][a-zA-Z0-9:._-]*$/;
+var MAX_SANDBOX_TOOL_NAME_LENGTH = 256;
+function isBindableNamespace(ns, reservedGlobals) {
+  return IDENT_RE.test(ns) && !PROTOTYPE_KEYS.has(ns) && !ns.startsWith("__") && !RESERVED_NAMESPACES.has(ns) && !UNBINDABLE_NAMESPACES.has(ns) && !reservedGlobals.has(ns);
+}
+function isBindableMethod(ns, method, toolName) {
+  return IDENT_RE.test(method) && !PROTOTYPE_KEYS.has(method) && !method.startsWith("__") && !UNCALLABLE_METHODS.has(method) && toolName === `${ns}.${method}` && toolName.length <= MAX_SANDBOX_TOOL_NAME_LENGTH && SANDBOX_TOOL_NAME_RE.test(toolName);
+}
+function buildToolNamespaces(tools) {
+  const namespaces = /* @__PURE__ */ Object.create(null);
+  const skipped = [];
+  for (const tool of tools) {
+    const name = tool?.name;
+    if (typeof name !== "string" || name.length === 0) continue;
+    const dot = name.indexOf(".");
+    if (dot <= 0 || dot === name.length - 1) {
+      skipped.push({ name, reason: "no-namespace-prefix" });
+      continue;
+    }
+    const ns = name.slice(0, dot);
+    const method = name.slice(dot + 1);
+    if (!IDENT_RE.test(ns) || !IDENT_RE.test(method)) {
+      skipped.push({ name, reason: "invalid-identifier" });
+      continue;
+    }
+    if (PROTOTYPE_KEYS.has(ns) || PROTOTYPE_KEYS.has(method)) {
+      skipped.push({ name, reason: "prototype-key" });
+      continue;
+    }
+    if (RESERVED_NAMESPACES.has(ns) || UNBINDABLE_NAMESPACES.has(ns) || ns.startsWith("__")) {
+      skipped.push({ name, reason: "reserved-namespace" });
+      continue;
+    }
+    if (!isBindableMethod(ns, method, name)) {
+      skipped.push({ name, reason: "unsupported-name" });
+      continue;
+    }
+    const bucket = namespaces[ns] ?? (namespaces[ns] = /* @__PURE__ */ Object.create(null));
+    if (Object.prototype.hasOwnProperty.call(bucket, method)) {
+      skipped.push({ name, reason: "duplicate-method" });
+      continue;
+    }
+    bucket[method] = name;
+  }
+  return { namespaces, skipped };
+}
+function toSandboxToolNamespaces(namespaces, reservedGlobals = []) {
+  if (!namespaces) return void 0;
+  const reserved = new Set(reservedGlobals);
+  const bindable = /* @__PURE__ */ Object.create(null);
+  let count = 0;
+  for (const ns of Object.keys(namespaces)) {
+    if (!isBindableNamespace(ns, reserved)) continue;
+    const methods = namespaces[ns];
+    const bucket = /* @__PURE__ */ Object.create(null);
+    let methodCount = 0;
+    for (const method of Object.keys(methods)) {
+      const toolName = methods[method];
+      if (typeof toolName !== "string" || !isBindableMethod(ns, method, toolName)) continue;
+      bucket[method] = toolName;
+      methodCount += 1;
+    }
+    if (methodCount > 0) {
+      bindable[ns] = bucket;
+      count += 1;
+    }
+  }
+  return count > 0 ? bindable : void 0;
+}
+
+// plugins/plugin-codecall/src/services/enclave.service.ts
+function toolFailureMessage(error, toolName) {
+  if (typeof error === "string" && error) return error;
+  const message = error?.message;
+  return typeof message === "string" && message ? message : `Tool call failed: ${toolName}`;
+}
+function toolFailureName(error) {
+  const name = error && typeof error === "object" ? error.name : void 0;
+  return typeof name === "string" && name ? name.slice(0, 128) : "ToolError";
+}
+var PARSE_FAILURE_PREFIX = "Failed to parse AgentScript code: ";
+var PARSE_POSITION_RE = /\((\d+):(\d+)\)$/;
+function parseFailureOf(message) {
+  const match = PARSE_POSITION_RE.exec(message);
+  const line = match ? Number(match[1]) - 1 : 0;
+  if (!match || line < 1) return { message };
+  const column = Number(match[2]);
+  return { message: `${message.slice(0, match.index)}(${line}:${column})`, location: { line, column } };
+}
 var ScriptTooLargeError = class extends Error {
   code = "SCRIPT_TOO_LARGE";
   scriptLength;
@@ -1727,8 +1964,20 @@ var EnclaveService = class {
         throw new ScriptTooLargeError(code.length, maxLength);
       }
     }
+    const toolFailures = [];
     const toolHandler = async (toolName, args) => {
-      return environment.callTool(toolName, args);
+      try {
+        return await environment.callTool(toolName, args);
+      } catch (error) {
+        const code2 = error?.code;
+        toolFailures.push({
+          toolName,
+          name: toolFailureName(error),
+          message: toolFailureMessage(error, toolName),
+          ...typeof code2 === "string" ? { code: code2 } : {}
+        });
+        throw error;
+      }
     };
     const sidecar = this.sidecarOptions.enabled ? {
       enabled: true,
@@ -1738,11 +1987,29 @@ var EnclaveService = class {
       maxResolvedSize: this.sidecarOptions.maxResolvedSize,
       allowComposites: this.sidecarOptions.allowComposites
     } : void 0;
-    const RESERVED_GLOBALS = /* @__PURE__ */ new Set(["getTool", "mcpLog", "mcpNotify"]);
-    const safeNamespaces = Object.fromEntries(
-      Object.entries(environment.namespaces ?? {}).filter(([key]) => !RESERVED_GLOBALS.has(key))
-    );
-    const enclave = new import_core.Enclave({
+    const { mcpLog, mcpNotify } = environment;
+    const globals = {
+      // Provide getTool as a custom global
+      getTool: environment.getTool,
+      // Provide logging functions if available
+      ...mcpLog ? {
+        mcpLog: (level, message, metadata) => {
+          mcpLog(level, message, metadata);
+          logs.push(`[mcp:${level}] ${message}`);
+        }
+      } : {},
+      ...mcpNotify ? {
+        mcpNotify: (event, payload) => {
+          mcpNotify(event, payload);
+          logs.push(`[notify] ${event}`);
+        }
+      } : {}
+      // Note: enclave-vm v2.0.0+ provides its own __safe_console internally with rate limiting
+      // and output size limits. Passing console in globals causes "Cannot redefine property"
+      // errors due to Double VM architecture. Console output from user scripts goes to stdout
+      // via enclave's internal console, not to this logs array. Only mcpLog/mcpNotify are captured.
+    };
+    const options = {
       timeout: this.vmOptions.timeoutMs,
       maxToolCalls: this.vmOptions.maxSteps || 100,
       maxIterations: 1e4,
@@ -1752,38 +2019,20 @@ var EnclaveService = class {
       validate: true,
       transform: true,
       sidecar,
+      // Error stacks name no host file, whatever stage raised them.
+      sanitizeStackTraces: true,
       // Allow functions in globals since we intentionally provide getTool, mcpLog, mcpNotify, and console
       allowFunctionsInGlobals: true,
-      globals: {
-        // Tool namespaces (e.g. `acme.getUser`) flow through here. Spread
-        // FIRST so the runtime reserved globals below are guaranteed
-        // last-wins. Reserved keys have already been stripped above —
-        // belt-and-braces ordering makes the invariant locally obvious.
-        ...safeNamespaces,
-        // Provide getTool as a custom global
-        getTool: environment.getTool,
-        // Provide logging functions if available
-        ...environment.mcpLog ? {
-          mcpLog: (level, message, metadata) => {
-            environment.mcpLog(level, message, metadata);
-            logs.push(`[mcp:${level}] ${message}`);
-          }
-        } : {},
-        ...environment.mcpNotify ? {
-          mcpNotify: (event, payload) => {
-            environment.mcpNotify(event, payload);
-            logs.push(`[notify] ${event}`);
-          }
-        } : {}
-        // Note: enclave-vm v2.0.0+ provides its own __safe_console internally with rate limiting
-        // and output size limits. Passing console in globals causes "Cannot redefine property"
-        // errors due to Double VM architecture. Console output from user scripts goes to stdout
-        // via enclave's internal console, not to this logs array. Only mcpLog/mcpNotify are captured.
-      }
-    });
+      globals,
+      // Tool namespaces (`acme.getUser()` for a tool named `acme.getUser`) are built by the sandbox
+      // itself: a method call is exactly `callTool('acme.getUser', args, options)`, with the
+      // sandbox's tool-call cap, rate limit, suspicious-sequence checks and `throwOnError`.
+      toolNamespaces: toSandboxToolNamespaces(environment.toolNamespaces, Object.keys(globals))
+    };
+    const enclave = createEnclave(options);
     try {
       const result = await enclave.run(code);
-      return this.mapEnclaveResult(result, logs);
+      return this.mapEnclaveResult(result, logs, toolFailures);
     } finally {
       enclave.dispose();
     }
@@ -1791,58 +2040,56 @@ var EnclaveService = class {
   /**
    * Map Enclave ExecutionResult to EnclaveExecutionResult
    */
-  mapEnclaveResult(result, logs) {
+  mapEnclaveResult(result, logs, toolFailures = []) {
+    const stats = {
+      duration: result.stats.duration,
+      toolCallCount: result.stats.toolCallCount,
+      iterationCount: result.stats.iterationCount
+    };
     if (result.success) {
+      return { success: true, result: result.value, logs, timedOut: false, stats };
+    }
+    const error = result.error ?? { name: "Error", message: "Script execution failed" };
+    if (error.code === "ENCLAVE_ERROR" && error.message?.startsWith(PARSE_FAILURE_PREFIX)) {
+      const { message, location } = parseFailureOf(error.message);
       return {
-        success: true,
-        result: result.value,
+        success: false,
+        error: { message, name: "SyntaxError", code: "SYNTAX_ERROR", ...location ? { location } : {} },
         logs,
         timedOut: false,
-        stats: {
-          duration: result.stats.duration,
-          toolCallCount: result.stats.toolCallCount,
-          iterationCount: result.stats.iterationCount
-        }
+        stats
       };
     }
-    const error = result.error;
-    const timedOut = error.message?.includes("timed out") || error.code === "TIMEOUT";
-    if (error.code === "VALIDATION_ERROR") {
-      const issues = error.data?.issues ?? [];
-      const blockedPatterns = [...new Set(issues.map((issue) => issue.code).filter((code) => !!code))];
+    const toolFailure = [...toolFailures].reverse().find((failure) => failure.message === error.message && failure.name === error.name);
+    if (toolFailure) {
       return {
         success: false,
         error: {
           message: error.message,
-          name: "ValidationError",
-          code: error.code,
-          ...blockedPatterns.length > 0 ? { blockedPatterns } : {}
+          name: error.name,
+          ...toolFailure.code ? { code: toolFailure.code } : {},
+          toolName: toolFailure.toolName
         },
         logs,
         timedOut: false,
-        stats: {
-          duration: result.stats.duration,
-          toolCallCount: result.stats.toolCallCount,
-          iterationCount: result.stats.iterationCount
-        }
+        stats
       };
     }
-    const errorData = error.data;
-    const toolName = errorData?.["toolName"];
-    if (toolName) {
+    const timedOut = error.message?.includes("timed out") || error.code === "TIMEOUT";
+    if (error.code === "VALIDATION_ERROR") {
+      const issues = error.data?.issues ?? [];
+      const blockedPatterns = [...new Set(issues.map((issue) => issue.code).filter((code) => !!code))];
       return {
         success: false,
         error: {
           message: error.message,
-          name: error.name,
-          stack: error.stack,
+          name: "ValidationError",
           code: error.code,
-          toolName,
-          toolInput: errorData?.["toolInput"],
-          details: errorData?.["details"]
+          ...blockedPatterns.length > 0 ? { blockedPatterns } : {}
         },
         logs,
-        timedOut
+        timedOut: false,
+        stats
       };
     }
     return {
@@ -1855,11 +2102,7 @@ var EnclaveService = class {
       },
       logs,
       timedOut,
-      stats: {
-        duration: result.stats.duration,
-        toolCallCount: result.stats.toolCallCount,
-        iterationCount: result.stats.iterationCount
-      }
+      stats
     };
   }
 };
@@ -1870,6 +2113,16 @@ EnclaveService = __decorateClass([
     scope: import_sdk3.ProviderScope.GLOBAL
   })
 ], EnclaveService);
+function createEnclave(options) {
+  try {
+    return new import_core.Enclave(options);
+  } catch (error) {
+    if (!options.toolNamespaces || !(error instanceof TypeError) || !error.message.startsWith("Invalid toolNamespaces")) {
+      throw error;
+    }
+    return new import_core.Enclave({ ...options, toolNamespaces: void 0 });
+  }
+}
 
 // plugins/plugin-codecall/src/tools/search.tool.ts
 var import_sdk4 = require("@frontmcp/sdk");
@@ -1930,7 +2183,10 @@ var SearchTool = class extends import_sdk4.ToolContext {
     const audit = this.tryGet(AuditLoggerService);
     const executionId = audit ? audit.generateExecutionId() : "";
     const startedAt = Date.now();
-    const nonExistentExcludedTools = excludeToolNames.filter((toolName) => !searchService.hasTool(toolName));
+    const surface = (0, import_sdk4.getCallSurface)();
+    const nonExistentExcludedTools = excludeToolNames.filter(
+      (toolName) => !searchService.hasTool(toolName, surface)
+    );
     if (nonExistentExcludedTools.length > 0) {
       warnings.push({
         type: "excluded_tool_not_found",
@@ -1944,7 +2200,8 @@ var SearchTool = class extends import_sdk4.ToolContext {
       const searchResults = await searchService.search(query, {
         topK,
         appIds,
-        excludeToolNames
+        excludeToolNames,
+        surface
       });
       for (const result of searchResults) {
         if (result.relevanceScore < minRelevanceScore) {
@@ -1989,7 +2246,7 @@ var SearchTool = class extends import_sdk4.ToolContext {
     return {
       tools,
       warnings,
-      totalAvailableTools: searchService.getTotalCount()
+      totalAvailableTools: searchService.getTotalCount(surface)
     };
   }
 };
@@ -2340,11 +2597,10 @@ function getSanitizedMessage(code, toolName, rawMessage) {
   }
 }
 function sanitizeValidationMessage(message) {
-  let sanitized = message.replace(/(?:\/[\w.-]+)+|(?:[A-Za-z]:\\[\w\\.-]+)+/g, "[path]");
+  let sanitized = toClientErrorMessage(message);
   sanitized = sanitized.replace(/\bat line \d+/gi, "");
   sanitized = sanitized.replace(/\bline \d+/gi, "");
   sanitized = sanitized.replace(/:\d+:\d+/g, "");
-  sanitized = sanitized.replace(/\n\s*at .*/g, "");
   if (sanitized.length > 200) {
     sanitized = sanitized.substring(0, 200) + "...";
   }
@@ -2382,75 +2638,6 @@ function assertNotSelfReference(toolName) {
   }
 }
 
-// plugins/plugin-codecall/src/utils/build-tool-namespaces.ts
-var IDENT_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
-var PROTOTYPE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
-var RESERVED_NAMESPACES = /* @__PURE__ */ new Set([
-  "console",
-  "Math",
-  "JSON",
-  "Object",
-  "Array",
-  "String",
-  "Number",
-  "Boolean",
-  "Promise",
-  "Symbol",
-  "Map",
-  "Set",
-  "WeakMap",
-  "WeakSet",
-  "Date",
-  "Error",
-  "RegExp",
-  "globalThis",
-  "global",
-  "window",
-  "self",
-  "undefined",
-  "null",
-  "true",
-  "false",
-  "callTool",
-  "getTool",
-  "mcpLog",
-  "mcpNotify"
-]);
-function buildToolNamespaces(tools, callTool) {
-  const namespaces = /* @__PURE__ */ Object.create(null);
-  const skipped = [];
-  for (const tool of tools) {
-    const name = tool?.name;
-    if (typeof name !== "string" || name.length === 0) continue;
-    const dot = name.indexOf(".");
-    if (dot <= 0 || dot === name.length - 1) {
-      skipped.push({ name, reason: "no-namespace-prefix" });
-      continue;
-    }
-    const ns = name.slice(0, dot);
-    const method = name.slice(dot + 1);
-    if (!IDENT_RE.test(ns) || !IDENT_RE.test(method)) {
-      skipped.push({ name, reason: "invalid-identifier" });
-      continue;
-    }
-    if (PROTOTYPE_KEYS.has(ns)) {
-      skipped.push({ name, reason: "prototype-key" });
-      continue;
-    }
-    if (RESERVED_NAMESPACES.has(ns)) {
-      skipped.push({ name, reason: "reserved-namespace" });
-      continue;
-    }
-    const bucket = namespaces[ns] ?? (namespaces[ns] = /* @__PURE__ */ Object.create(null));
-    if (Object.prototype.hasOwnProperty.call(bucket, method)) {
-      skipped.push({ name, reason: "duplicate-method" });
-      continue;
-    }
-    bucket[method] = (input, options) => callTool(name, input, options);
-  }
-  return { namespaces, skipped };
-}
-
 // plugins/plugin-codecall/src/utils/describe.utils.ts
 var INTENT_PATTERNS = {
   create: /^(create|add|new|insert|make|append|register|generate|produce|build|construct|provision|instantiate|define|compose|draft)/i,
@@ -2812,12 +2999,13 @@ var DescribeTool = class extends import_sdk7.ToolContext {
     const tools = [];
     const notFound = [];
     const config = this.get(CodeCallConfig);
+    const surface = (0, import_sdk7.getCallSurface)();
     for (const toolName of toolNames) {
       if (isBlockedSelfReference(toolName)) {
         notFound.push(toolName);
         continue;
       }
-      const access = checkCodeCallToolAccess(this.scope, config, toolName);
+      const access = checkCodeCallToolAccess(this.scope, config, toolName, { surface });
       if (!access.allowed) {
         audit?.logSecurityAccessDenied(executionId, toolName, access.reason);
         notFound.push(toolName);
@@ -3029,6 +3217,7 @@ var runtimeErrorPayloadSchema = import_lazy_zod7.z.object({
   source: import_lazy_zod7.z.literal("script"),
   message: import_lazy_zod7.z.string(),
   name: import_lazy_zod7.z.string().optional(),
+  /** @deprecated Never set: stack traces name server files, so results don't carry them. */
   stack: import_lazy_zod7.z.string().optional()
 });
 var toolErrorPayloadSchema = import_lazy_zod7.z.object({
@@ -3037,6 +3226,7 @@ var toolErrorPayloadSchema = import_lazy_zod7.z.object({
   toolInput: import_lazy_zod7.z.unknown(),
   message: import_lazy_zod7.z.string(),
   code: import_lazy_zod7.z.string().optional(),
+  /** @deprecated Never set: the enclave's error data is not sanitized for clients. */
   details: import_lazy_zod7.z.unknown().optional()
 });
 var timeoutErrorPayloadSchema = import_lazy_zod7.z.object({
@@ -3101,11 +3291,12 @@ var ExecuteTool = class extends import_sdk8.ToolContext {
    * otherwise it would skip every metadata-driven check and reach `tools:call-tool`
    * unexamined.
    */
-  checkToolPolicy(name) {
-    return checkCodeCallToolAccess(this.scope, this.get(CodeCallConfig), name);
+  checkToolPolicy(name, surface) {
+    return checkCodeCallToolAccess(this.scope, this.get(CodeCallConfig), name, { surface });
   }
   async execute(input) {
     const { script, allowedTools } = input;
+    const callerSurface = (0, import_sdk8.getCallSurface)();
     const audit = this.tryGet(AuditLoggerService);
     const executionId = audit ? audit.generateExecutionId() : "";
     const callDepth = 1;
@@ -3118,7 +3309,7 @@ var ExecuteTool = class extends import_sdk8.ToolContext {
           audit?.logSecuritySelfReference(executionId, name);
         }
         assertNotSelfReference(name);
-        const decision = this.checkToolPolicy(name);
+        const decision = this.checkToolPolicy(name, callerSurface);
         if (!decision.allowed) {
           audit?.logSecurityAccessDenied(executionId, name, decision.reason);
           const error = createToolCallError(TOOL_CALL_ERROR_CODES.ACCESS_DENIED, name, decision.reason);
@@ -3147,7 +3338,8 @@ var ExecuteTool = class extends import_sdk8.ToolContext {
             }
           };
           const ctx = {
-            authInfo: this.authInfo
+            authInfo: this.authInfo,
+            surface: callerSurface
           };
           const mcpResult = await this.scope.runFlow("tools:call-tool", { request, ctx });
           if (!mcpResult) {
@@ -3187,7 +3379,7 @@ var ExecuteTool = class extends import_sdk8.ToolContext {
             audit?.logSecuritySelfReference(executionId, name);
             return void 0;
           }
-          const introspectionAccess = this.checkToolPolicy(name);
+          const introspectionAccess = this.checkToolPolicy(name, callerSurface);
           if (!introspectionAccess.allowed) {
             audit?.logSecurityAccessDenied(executionId, name, introspectionAccess.reason);
             return void 0;
@@ -3217,8 +3409,8 @@ var ExecuteTool = class extends import_sdk8.ToolContext {
       const callableTools = this.scope.tools.getTools(true).filter(
         (tool) => checkCodeCallToolPolicy(toCodeCallPolicyTool(tool, void 0, this.scope), policyConfig).allowed
       );
-      const { namespaces, skipped } = buildToolNamespaces(callableTools, environment.callTool);
-      environment.namespaces = namespaces;
+      const { namespaces, skipped } = buildToolNamespaces(callableTools);
+      environment.toolNamespaces = namespaces;
       if (skipped.length > 0) {
         this.logger?.debug?.("codecall: tools skipped during namespace generation", {
           count: skipped.length,
@@ -3250,6 +3442,16 @@ var ExecuteTool = class extends import_sdk8.ToolContext {
       }
       if (!executionResult.success) {
         const error = executionResult.error;
+        if (error.code === "SYNTAX_ERROR") {
+          audit?.logExecutionFailure(executionId, script, durationMs, error.message);
+          return {
+            status: "syntax_error",
+            error: {
+              message: toClientErrorMessage(error.message) || "Syntax error in script",
+              ...error.location ? { location: error.location } : {}
+            }
+          };
+        }
         if (error.code === "VALIDATION_ERROR" || error.name === "ValidationError") {
           audit?.logSecurityAstBlocked(executionId, error.blockedPatterns?.join(", ") ?? "UNKNOWN", error.message);
           audit?.logExecutionFailure(executionId, script, durationMs, error.message);
@@ -3269,9 +3471,9 @@ var ExecuteTool = class extends import_sdk8.ToolContext {
               source: "tool",
               toolName: error.toolName,
               toolInput: error.toolInput,
-              message: error.message,
-              code: error.code,
-              details: error.details
+              message: toClientErrorMessage(error.message),
+              code: error.code
+              // No `details`: the enclave's error data is not sanitized for clients.
             }
           };
         }
@@ -3280,9 +3482,8 @@ var ExecuteTool = class extends import_sdk8.ToolContext {
           status: "runtime_error",
           error: {
             source: "script",
-            message: error.message,
-            name: error.name,
-            stack: error.stack
+            message: toClientErrorMessage(error.message),
+            name: error.name
           }
         };
       }
@@ -3296,13 +3497,12 @@ var ExecuteTool = class extends import_sdk8.ToolContext {
       const errorName = error instanceof Error ? error.name : "Error";
       const errorMessage = error instanceof Error ? error.message : String(error);
       audit?.logExecutionFailure(executionId, script, elapsed(), errorMessage);
-      const errorStack = error instanceof Error ? error.stack : void 0;
       const errorLoc = error.loc;
       if (errorName === "SyntaxError" || errorMessage?.includes("syntax")) {
         return {
           status: "syntax_error",
           error: {
-            message: errorMessage || "Syntax error in script",
+            message: toClientErrorMessage(errorMessage) || "Syntax error in script",
             location: errorLoc ? { line: errorLoc.line, column: errorLoc.column } : void 0
           }
         };
@@ -3311,9 +3511,8 @@ var ExecuteTool = class extends import_sdk8.ToolContext {
         status: "runtime_error",
         error: {
           source: "script",
-          message: errorMessage || "An unexpected error occurred during script execution",
-          name: errorName,
-          stack: errorStack
+          message: toClientErrorMessage(errorMessage) || "An unexpected error occurred during script execution",
+          name: errorName
         }
       };
     }
@@ -3382,7 +3581,11 @@ var InvokeTool = class extends import_sdk9.ToolContext {
         `Tool "${toolName}" cannot be invoked directly. CodeCall tools are internal and not accessible via codecall:invoke.`
       );
     }
-    const decision = checkCodeCallToolAccess(this.scope, this.get(CodeCallConfig), toolName, { directCall: true });
+    const surface = (0, import_sdk9.getCallSurface)();
+    const decision = checkCodeCallToolAccess(this.scope, this.get(CodeCallConfig), toolName, {
+      directCall: true,
+      surface
+    });
     if (!decision.allowed) {
       audit?.logSecurityAccessDenied(executionId, toolName, decision.reason);
       return buildErrorResult(`Tool "${toolName}" is not available. Use codecall:search to discover available tools.`);
@@ -3395,7 +3598,8 @@ var InvokeTool = class extends import_sdk9.ToolContext {
       }
     };
     const ctx = {
-      authInfo: this.authInfo
+      authInfo: this.authInfo,
+      surface
     };
     const result = await this.scope.runFlow("tools:call-tool", { request, ctx });
     if (!result) {