@frontmcp/plugin-codecall 1.8.3 → 1.8.4

package/codecall.symbol.d.ts

@@ -62,6 +62,9 @@ export interface CodeCallVmEnvironment {
      * @param options - Optional behavior configuration
      * @param options.throwOnError - When true (default), throws on error.
      *                               When false, returns { success, data, error }.
+     *                               The sandbox calls it without options: it applies a script's
+     *                               `{ throwOnError: false }` itself, for `callTool()` and
+     *                               namespace methods alike, so it needs the throw.
      *
      * SECURITY NOTES:
      * - Cannot call 'codecall:*' tools (self-reference blocked)
@@ -83,12 +86,11 @@ export interface CodeCallVmEnvironment {
     /**
      * Optional dotted-tool-name namespaces, as data: `{ acme: { getUser: 'acme.getUser' } }`.
      *
-     * The enclave service writes them into the script as AgentScript objects whose methods
-     * call `callTool('acme.getUser', input)` inside the sandbox, so AgentScript can call
-     * `await acme.getUser({...})` and every such call still passes the sandbox's tool-call
-     * cap, rate limit and suspicious-sequence checks (they are never host functions). Tools
-     * whose names cannot be expressed as `{validIdent}.{validIdent}` remain reachable only
-     * via `callTool`.
+     * The enclave service hands them to the sandbox as its `toolNamespaces`, which builds the
+     * objects itself, so AgentScript can call `await acme.getUser({...})` and every such call is a
+     * `callTool('acme.getUser', …)` inside the sandbox: it passes the tool-call cap, rate limit
+     * and suspicious-sequence checks (they are never host functions). Tools whose names the
+     * sandbox can't bind remain reachable only via `callTool`.
      */
     toolNamespaces?: Record<string, Record<string, string>>;
 }

package/codecall.symbol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codecall.symbol.d.ts","sourceRoot":"","sources":["../src/codecall.symbol.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAEhE,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,sBAAsB,GAAG,kBAAkB,GAAG,gBAAgB,GAAG,YAAY,CAAC;IACpF,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,0BAA0B,EAAE,CAAC;IACrC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;CAChE;AAED;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,gBAAgB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC9C;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;;;;;OAaG;IACH,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EACxB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,eAAe,KACtB,OAAO,CAAC,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhD;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,uBAAuB,GAAG,SAAS,CAAC;IAE/D,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAEnH,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAEtE;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACzD;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,4FAA4F;IAC5F,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAEhF;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAErD;;OAEG;IACH,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAExC;;OAEG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B"}
+{"version":3,"file":"codecall.symbol.d.ts","sourceRoot":"","sources":["../src/codecall.symbol.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAEhE,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,sBAAsB,GAAG,kBAAkB,GAAG,gBAAgB,GAAG,YAAY,CAAC;IACpF,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,0BAA0B,EAAE,CAAC;IACrC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;CAChE;AAED;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,gBAAgB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC9C;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EACxB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,eAAe,KACtB,OAAO,CAAC,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhD;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,uBAAuB,GAAG,SAAS,CAAC;IAE/D,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAEnH,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAEtE;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACzD;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,4FAA4F;IAC5F,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAEhF;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAErD;;OAEG;IACH,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAExC;;OAEG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B"}

package/esm/index.mjs

@@ -1733,7 +1733,9 @@ var ToolSearchService = class _ToolSearchService {
 };
 
 // plugins/plugin-codecall/src/services/enclave.service.ts
-import { Enclave } from "@enclave-vm/core";
+import {
+  Enclave
+} from "@enclave-vm/core";
 import { Provider as Provider3, ProviderScope as ProviderScope3 } from "@frontmcp/sdk";
 
 // plugins/plugin-codecall/src/utils/build-tool-namespaces.ts
@@ -1784,9 +1786,29 @@ var UNBINDABLE_NAMESPACES = new Set(
     "localStorage sessionStorage indexedDB crypto performance structuredClone AbortController AbortSignal",
     "MessageChannel MessagePort BroadcastChannel TextEncoder TextDecoder Intl setTimeout setInterval",
     "setImmediate clearTimeout clearInterval clearImmediate queueMicrotask WebAssembly Worker SharedWorker",
-    "ServiceWorker WeakRef FinalizationRegistry BigInt Atomics SharedArrayBuffer ArrayBuffer DataView"
+    "ServiceWorker WeakRef FinalizationRegistry BigInt Atomics SharedArrayBuffer ArrayBuffer DataView",
+    "importScripts ShadowRealm Iterator AsyncIterator"
+  ].join(" ").split(" ")
+);
+var UNCALLABLE_METHODS = new Set(
+  [
+    "process require module exports Buffer eval Function AsyncFunction GeneratorFunction arguments RegExp",
+    "Promise Symbol Proxy Reflect Error TypeError ReferenceError SyntaxError RangeError URIError EvalError",
+    "AggregateError fetch XMLHttpRequest WebSocket localStorage sessionStorage indexedDB crypto performance",
+    "structuredClone AbortController AbortSignal MessageChannel MessagePort BroadcastChannel TextEncoder",
+    "TextDecoder Intl setTimeout setInterval setImmediate clearTimeout clearInterval clearImmediate",
+    "queueMicrotask WebAssembly Worker SharedWorker ServiceWorker WeakMap WeakSet WeakRef FinalizationRegistry",
+    "Map Set Atomics SharedArrayBuffer importScripts ShadowRealm Iterator AsyncIterator"
   ].join(" ").split(" ")
 );
+var SANDBOX_TOOL_NAME_RE = /^[a-zA-Z][a-zA-Z0-9:._-]*$/;
+var MAX_SANDBOX_TOOL_NAME_LENGTH = 256;
+function isBindableNamespace(ns, reservedGlobals) {
+  return IDENT_RE.test(ns) && !PROTOTYPE_KEYS.has(ns) && !ns.startsWith("__") && !RESERVED_NAMESPACES.has(ns) && !UNBINDABLE_NAMESPACES.has(ns) && !reservedGlobals.has(ns);
+}
+function isBindableMethod(ns, method, toolName) {
+  return IDENT_RE.test(method) && !PROTOTYPE_KEYS.has(method) && !method.startsWith("__") && !UNCALLABLE_METHODS.has(method) && toolName === `${ns}.${method}` && toolName.length <= MAX_SANDBOX_TOOL_NAME_LENGTH && SANDBOX_TOOL_NAME_RE.test(toolName);
+}
 function buildToolNamespaces(tools) {
   const namespaces = /* @__PURE__ */ Object.create(null);
   const skipped = [];
@@ -1812,6 +1834,10 @@ function buildToolNamespaces(tools) {
       skipped.push({ name, reason: "reserved-namespace" });
       continue;
     }
+    if (!isBindableMethod(ns, method, name)) {
+      skipped.push({ name, reason: "unsupported-name" });
+      continue;
+    }
     const bucket = namespaces[ns] ?? (namespaces[ns] = /* @__PURE__ */ Object.create(null));
     if (Object.prototype.hasOwnProperty.call(bucket, method)) {
       skipped.push({ name, reason: "duplicate-method" });
@@ -1821,49 +1847,49 @@ function buildToolNamespaces(tools) {
   }
   return { namespaces, skipped };
 }
-var NAMESPACE_CALL_HELPER = "__codecallNamespaceCall";
-var NAMESPACE_CALL_HELPER_SOURCE = `const ${NAMESPACE_CALL_HELPER} = async (toolName, run, options) => { if (options && options.throwOnError === false) { try { return { success: true, data: await run() }; } catch (error) { return { success: false, error: { message: error && error.message, toolName: toolName } }; } } return await run(); };`;
-function mentionsIdentifier(script, identifier) {
-  let from = 0;
-  for (; ; ) {
-    const at = script.indexOf(identifier, from);
-    if (at === -1) return false;
-    from = at + 1;
-    const before = at > 0 ? script[at - 1] : "";
-    const after = script[at + identifier.length] ?? "";
-    if (/[A-Za-z0-9_$'"`]/.test(before) || /[A-Za-z0-9_$]/.test(after)) continue;
-    if (before === "." && script.slice(Math.max(0, at - 3), at) !== "...") continue;
-    return true;
-  }
-}
-function wrapScriptWithToolNamespaces(script, namespaces) {
-  if (!namespaces) return script;
-  const declarations = [];
+function toSandboxToolNamespaces(namespaces, reservedGlobals = []) {
+  if (!namespaces) return void 0;
+  const reserved = new Set(reservedGlobals);
+  const bindable = /* @__PURE__ */ Object.create(null);
+  let count = 0;
   for (const ns of Object.keys(namespaces)) {
-    if (!IDENT_RE.test(ns) || RESERVED_NAMESPACES.has(ns) || UNBINDABLE_NAMESPACES.has(ns) || ns.startsWith("__")) {
-      continue;
-    }
-    if (PROTOTYPE_KEYS.has(ns) || !mentionsIdentifier(script, ns)) continue;
+    if (!isBindableNamespace(ns, reserved)) continue;
     const methods = namespaces[ns];
-    const entries = [];
+    const bucket = /* @__PURE__ */ Object.create(null);
+    let methodCount = 0;
     for (const method of Object.keys(methods)) {
       const toolName = methods[method];
-      if (!IDENT_RE.test(method) || PROTOTYPE_KEYS.has(method) || toolName !== `${ns}.${method}`) continue;
-      const literal = JSON.stringify(toolName);
-      entries.push(
-        `${JSON.stringify(method)}: (input, options) => ${NAMESPACE_CALL_HELPER}(${literal}, () => callTool(${literal}, input === undefined ? {} : input), options)`
-      );
+      if (typeof toolName !== "string" || !isBindableMethod(ns, method, toolName)) continue;
+      bucket[method] = toolName;
+      methodCount += 1;
     }
-    if (entries.length > 0) {
-      declarations.push(`const ${ns} = { ${entries.join(", ")} };`);
+    if (methodCount > 0) {
+      bindable[ns] = bucket;
+      count += 1;
     }
   }
-  if (declarations.length === 0) return script;
-  return `${NAMESPACE_CALL_HELPER_SOURCE} ${declarations.join(" ")} return await (async () => {${script}
-})();`;
+  return count > 0 ? bindable : void 0;
 }
 
 // plugins/plugin-codecall/src/services/enclave.service.ts
+function toolFailureMessage(error, toolName) {
+  if (typeof error === "string" && error) return error;
+  const message = error?.message;
+  return typeof message === "string" && message ? message : `Tool call failed: ${toolName}`;
+}
+function toolFailureName(error) {
+  const name = error && typeof error === "object" ? error.name : void 0;
+  return typeof name === "string" && name ? name.slice(0, 128) : "ToolError";
+}
+var PARSE_FAILURE_PREFIX = "Failed to parse AgentScript code: ";
+var PARSE_POSITION_RE = /\((\d+):(\d+)\)$/;
+function parseFailureOf(message) {
+  const match = PARSE_POSITION_RE.exec(message);
+  const line = match ? Number(match[1]) - 1 : 0;
+  if (!match || line < 1) return { message };
+  const column = Number(match[2]);
+  return { message: `${message.slice(0, match.index)}(${line}:${column})`, location: { line, column } };
+}
 var ScriptTooLargeError = class extends Error {
   code = "SCRIPT_TOO_LARGE";
   scriptLength;
@@ -1901,8 +1927,20 @@ var EnclaveService = class {
         throw new ScriptTooLargeError(code.length, maxLength);
       }
     }
+    const toolFailures = [];
     const toolHandler = async (toolName, args) => {
-      return environment.callTool(toolName, args);
+      try {
+        return await environment.callTool(toolName, args);
+      } catch (error) {
+        const code2 = error?.code;
+        toolFailures.push({
+          toolName,
+          name: toolFailureName(error),
+          message: toolFailureMessage(error, toolName),
+          ...typeof code2 === "string" ? { code: code2 } : {}
+        });
+        throw error;
+      }
     };
     const sidecar = this.sidecarOptions.enabled ? {
       enabled: true,
@@ -1912,8 +1950,29 @@ var EnclaveService = class {
       maxResolvedSize: this.sidecarOptions.maxResolvedSize,
       allowComposites: this.sidecarOptions.allowComposites
     } : void 0;
-    const source = wrapScriptWithToolNamespaces(code, environment.toolNamespaces);
-    const enclave = new Enclave({
+    const { mcpLog, mcpNotify } = environment;
+    const globals = {
+      // Provide getTool as a custom global
+      getTool: environment.getTool,
+      // Provide logging functions if available
+      ...mcpLog ? {
+        mcpLog: (level, message, metadata) => {
+          mcpLog(level, message, metadata);
+          logs.push(`[mcp:${level}] ${message}`);
+        }
+      } : {},
+      ...mcpNotify ? {
+        mcpNotify: (event, payload) => {
+          mcpNotify(event, payload);
+          logs.push(`[notify] ${event}`);
+        }
+      } : {}
+      // Note: enclave-vm v2.0.0+ provides its own __safe_console internally with rate limiting
+      // and output size limits. Passing console in globals causes "Cannot redefine property"
+      // errors due to Double VM architecture. Console output from user scripts goes to stdout
+      // via enclave's internal console, not to this logs array. Only mcpLog/mcpNotify are captured.
+    };
+    const options = {
       timeout: this.vmOptions.timeoutMs,
       maxToolCalls: this.vmOptions.maxSteps || 100,
       maxIterations: 1e4,
@@ -1923,33 +1982,20 @@ var EnclaveService = class {
       validate: true,
       transform: true,
       sidecar,
+      // Error stacks name no host file, whatever stage raised them.
+      sanitizeStackTraces: true,
       // Allow functions in globals since we intentionally provide getTool, mcpLog, mcpNotify, and console
       allowFunctionsInGlobals: true,
-      globals: {
-        // Provide getTool as a custom global
-        getTool: environment.getTool,
-        // Provide logging functions if available
-        ...environment.mcpLog ? {
-          mcpLog: (level, message, metadata) => {
-            environment.mcpLog(level, message, metadata);
-            logs.push(`[mcp:${level}] ${message}`);
-          }
-        } : {},
-        ...environment.mcpNotify ? {
-          mcpNotify: (event, payload) => {
-            environment.mcpNotify(event, payload);
-            logs.push(`[notify] ${event}`);
-          }
-        } : {}
-        // Note: enclave-vm v2.0.0+ provides its own __safe_console internally with rate limiting
-        // and output size limits. Passing console in globals causes "Cannot redefine property"
-        // errors due to Double VM architecture. Console output from user scripts goes to stdout
-        // via enclave's internal console, not to this logs array. Only mcpLog/mcpNotify are captured.
-      }
-    });
+      globals,
+      // Tool namespaces (`acme.getUser()` for a tool named `acme.getUser`) are built by the sandbox
+      // itself: a method call is exactly `callTool('acme.getUser', args, options)`, with the
+      // sandbox's tool-call cap, rate limit, suspicious-sequence checks and `throwOnError`.
+      toolNamespaces: toSandboxToolNamespaces(environment.toolNamespaces, Object.keys(globals))
+    };
+    const enclave = createEnclave(options);
     try {
-      const result = await enclave.run(source);
-      return this.mapEnclaveResult(result, logs);
+      const result = await enclave.run(code);
+      return this.mapEnclaveResult(result, logs, toolFailures);
     } finally {
       enclave.dispose();
     }
@@ -1957,58 +2003,56 @@ var EnclaveService = class {
   /**
    * Map Enclave ExecutionResult to EnclaveExecutionResult
    */
-  mapEnclaveResult(result, logs) {
+  mapEnclaveResult(result, logs, toolFailures = []) {
+    const stats = {
+      duration: result.stats.duration,
+      toolCallCount: result.stats.toolCallCount,
+      iterationCount: result.stats.iterationCount
+    };
     if (result.success) {
+      return { success: true, result: result.value, logs, timedOut: false, stats };
+    }
+    const error = result.error ?? { name: "Error", message: "Script execution failed" };
+    if (error.code === "ENCLAVE_ERROR" && error.message?.startsWith(PARSE_FAILURE_PREFIX)) {
+      const { message, location } = parseFailureOf(error.message);
       return {
-        success: true,
-        result: result.value,
+        success: false,
+        error: { message, name: "SyntaxError", code: "SYNTAX_ERROR", ...location ? { location } : {} },
         logs,
         timedOut: false,
-        stats: {
-          duration: result.stats.duration,
-          toolCallCount: result.stats.toolCallCount,
-          iterationCount: result.stats.iterationCount
-        }
+        stats
       };
     }
-    const error = result.error;
-    const timedOut = error.message?.includes("timed out") || error.code === "TIMEOUT";
-    if (error.code === "VALIDATION_ERROR") {
-      const issues = error.data?.issues ?? [];
-      const blockedPatterns = [...new Set(issues.map((issue) => issue.code).filter((code) => !!code))];
+    const toolFailure = [...toolFailures].reverse().find((failure) => failure.message === error.message && failure.name === error.name);
+    if (toolFailure) {
       return {
         success: false,
         error: {
           message: error.message,
-          name: "ValidationError",
-          code: error.code,
-          ...blockedPatterns.length > 0 ? { blockedPatterns } : {}
+          name: error.name,
+          ...toolFailure.code ? { code: toolFailure.code } : {},
+          toolName: toolFailure.toolName
         },
         logs,
         timedOut: false,
-        stats: {
-          duration: result.stats.duration,
-          toolCallCount: result.stats.toolCallCount,
-          iterationCount: result.stats.iterationCount
-        }
+        stats
       };
     }
-    const errorData = error.data;
-    const toolName = errorData?.["toolName"];
-    if (toolName) {
+    const timedOut = error.message?.includes("timed out") || error.code === "TIMEOUT";
+    if (error.code === "VALIDATION_ERROR") {
+      const issues = error.data?.issues ?? [];
+      const blockedPatterns = [...new Set(issues.map((issue) => issue.code).filter((code) => !!code))];
       return {
         success: false,
         error: {
           message: error.message,
-          name: error.name,
-          stack: error.stack,
+          name: "ValidationError",
           code: error.code,
-          toolName,
-          toolInput: errorData?.["toolInput"],
-          details: errorData?.["details"]
+          ...blockedPatterns.length > 0 ? { blockedPatterns } : {}
         },
         logs,
-        timedOut
+        timedOut: false,
+        stats
       };
     }
     return {
@@ -2021,11 +2065,7 @@ var EnclaveService = class {
       },
       logs,
       timedOut,
-      stats: {
-        duration: result.stats.duration,
-        toolCallCount: result.stats.toolCallCount,
-        iterationCount: result.stats.iterationCount
-      }
+      stats
     };
   }
 };
@@ -2036,6 +2076,16 @@ EnclaveService = __decorateClass([
     scope: ProviderScope3.GLOBAL
   })
 ], EnclaveService);
+function createEnclave(options) {
+  try {
+    return new Enclave(options);
+  } catch (error) {
+    if (!options.toolNamespaces || !(error instanceof TypeError) || !error.message.startsWith("Invalid toolNamespaces")) {
+      throw error;
+    }
+    return new Enclave({ ...options, toolNamespaces: void 0 });
+  }
+}
 
 // plugins/plugin-codecall/src/tools/search.tool.ts
 import { getCallSurface, Tool, ToolContext } from "@frontmcp/sdk";
@@ -3355,6 +3405,16 @@ var ExecuteTool = class extends ToolContext5 {
       }
       if (!executionResult.success) {
         const error = executionResult.error;
+        if (error.code === "SYNTAX_ERROR") {
+          audit?.logExecutionFailure(executionId, script, durationMs, error.message);
+          return {
+            status: "syntax_error",
+            error: {
+              message: toClientErrorMessage(error.message) || "Syntax error in script",
+              ...error.location ? { location: error.location } : {}
+            }
+          };
+        }
         if (error.code === "VALIDATION_ERROR" || error.name === "ValidationError") {
           audit?.logSecurityAstBlocked(executionId, error.blockedPatterns?.join(", ") ?? "UNKNOWN", error.message);
           audit?.logExecutionFailure(executionId, script, durationMs, error.message);

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-codecall",
-  "version": "1.8.3",
+  "version": "1.8.4",
   "description": "CodeCall plugin for FrontMCP - AgentScript-based meta-tools for orchestrating MCP tools",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -49,13 +49,13 @@
   },
   "dependencies": {
     "@enclave-vm/core": "^2.15.3",
-    "@frontmcp/protocol": "1.8.3",
-    "@frontmcp/sdk": "1.8.3",
+    "@frontmcp/protocol": "1.8.4",
+    "@frontmcp/sdk": "1.8.4",
     "vectoriadb": "^2.3.2"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.3",
-    "@frontmcp/plugin-cache": "1.8.3"
+    "@frontmcp/lazy-zod": "1.8.4",
+    "@frontmcp/plugin-cache": "1.8.4"
   },
   "devDependencies": {
     "reflect-metadata": "^0.2.2"

package/index.js

@@ -1823,9 +1823,29 @@ var UNBINDABLE_NAMESPACES = new Set(
     "localStorage sessionStorage indexedDB crypto performance structuredClone AbortController AbortSignal",
     "MessageChannel MessagePort BroadcastChannel TextEncoder TextDecoder Intl setTimeout setInterval",
     "setImmediate clearTimeout clearInterval clearImmediate queueMicrotask WebAssembly Worker SharedWorker",
-    "ServiceWorker WeakRef FinalizationRegistry BigInt Atomics SharedArrayBuffer ArrayBuffer DataView"
+    "ServiceWorker WeakRef FinalizationRegistry BigInt Atomics SharedArrayBuffer ArrayBuffer DataView",
+    "importScripts ShadowRealm Iterator AsyncIterator"
   ].join(" ").split(" ")
 );
+var UNCALLABLE_METHODS = new Set(
+  [
+    "process require module exports Buffer eval Function AsyncFunction GeneratorFunction arguments RegExp",
+    "Promise Symbol Proxy Reflect Error TypeError ReferenceError SyntaxError RangeError URIError EvalError",
+    "AggregateError fetch XMLHttpRequest WebSocket localStorage sessionStorage indexedDB crypto performance",
+    "structuredClone AbortController AbortSignal MessageChannel MessagePort BroadcastChannel TextEncoder",
+    "TextDecoder Intl setTimeout setInterval setImmediate clearTimeout clearInterval clearImmediate",
+    "queueMicrotask WebAssembly Worker SharedWorker ServiceWorker WeakMap WeakSet WeakRef FinalizationRegistry",
+    "Map Set Atomics SharedArrayBuffer importScripts ShadowRealm Iterator AsyncIterator"
+  ].join(" ").split(" ")
+);
+var SANDBOX_TOOL_NAME_RE = /^[a-zA-Z][a-zA-Z0-9:._-]*$/;
+var MAX_SANDBOX_TOOL_NAME_LENGTH = 256;
+function isBindableNamespace(ns, reservedGlobals) {
+  return IDENT_RE.test(ns) && !PROTOTYPE_KEYS.has(ns) && !ns.startsWith("__") && !RESERVED_NAMESPACES.has(ns) && !UNBINDABLE_NAMESPACES.has(ns) && !reservedGlobals.has(ns);
+}
+function isBindableMethod(ns, method, toolName) {
+  return IDENT_RE.test(method) && !PROTOTYPE_KEYS.has(method) && !method.startsWith("__") && !UNCALLABLE_METHODS.has(method) && toolName === `${ns}.${method}` && toolName.length <= MAX_SANDBOX_TOOL_NAME_LENGTH && SANDBOX_TOOL_NAME_RE.test(toolName);
+}
 function buildToolNamespaces(tools) {
   const namespaces = /* @__PURE__ */ Object.create(null);
   const skipped = [];
@@ -1851,6 +1871,10 @@ function buildToolNamespaces(tools) {
       skipped.push({ name, reason: "reserved-namespace" });
       continue;
     }
+    if (!isBindableMethod(ns, method, name)) {
+      skipped.push({ name, reason: "unsupported-name" });
+      continue;
+    }
     const bucket = namespaces[ns] ?? (namespaces[ns] = /* @__PURE__ */ Object.create(null));
     if (Object.prototype.hasOwnProperty.call(bucket, method)) {
       skipped.push({ name, reason: "duplicate-method" });
@@ -1860,49 +1884,49 @@ function buildToolNamespaces(tools) {
   }
   return { namespaces, skipped };
 }
-var NAMESPACE_CALL_HELPER = "__codecallNamespaceCall";
-var NAMESPACE_CALL_HELPER_SOURCE = `const ${NAMESPACE_CALL_HELPER} = async (toolName, run, options) => { if (options && options.throwOnError === false) { try { return { success: true, data: await run() }; } catch (error) { return { success: false, error: { message: error && error.message, toolName: toolName } }; } } return await run(); };`;
-function mentionsIdentifier(script, identifier) {
-  let from = 0;
-  for (; ; ) {
-    const at = script.indexOf(identifier, from);
-    if (at === -1) return false;
-    from = at + 1;
-    const before = at > 0 ? script[at - 1] : "";
-    const after = script[at + identifier.length] ?? "";
-    if (/[A-Za-z0-9_$'"`]/.test(before) || /[A-Za-z0-9_$]/.test(after)) continue;
-    if (before === "." && script.slice(Math.max(0, at - 3), at) !== "...") continue;
-    return true;
-  }
-}
-function wrapScriptWithToolNamespaces(script, namespaces) {
-  if (!namespaces) return script;
-  const declarations = [];
+function toSandboxToolNamespaces(namespaces, reservedGlobals = []) {
+  if (!namespaces) return void 0;
+  const reserved = new Set(reservedGlobals);
+  const bindable = /* @__PURE__ */ Object.create(null);
+  let count = 0;
   for (const ns of Object.keys(namespaces)) {
-    if (!IDENT_RE.test(ns) || RESERVED_NAMESPACES.has(ns) || UNBINDABLE_NAMESPACES.has(ns) || ns.startsWith("__")) {
-      continue;
-    }
-    if (PROTOTYPE_KEYS.has(ns) || !mentionsIdentifier(script, ns)) continue;
+    if (!isBindableNamespace(ns, reserved)) continue;
     const methods = namespaces[ns];
-    const entries = [];
+    const bucket = /* @__PURE__ */ Object.create(null);
+    let methodCount = 0;
     for (const method of Object.keys(methods)) {
       const toolName = methods[method];
-      if (!IDENT_RE.test(method) || PROTOTYPE_KEYS.has(method) || toolName !== `${ns}.${method}`) continue;
-      const literal = JSON.stringify(toolName);
-      entries.push(
-        `${JSON.stringify(method)}: (input, options) => ${NAMESPACE_CALL_HELPER}(${literal}, () => callTool(${literal}, input === undefined ? {} : input), options)`
-      );
+      if (typeof toolName !== "string" || !isBindableMethod(ns, method, toolName)) continue;
+      bucket[method] = toolName;
+      methodCount += 1;
     }
-    if (entries.length > 0) {
-      declarations.push(`const ${ns} = { ${entries.join(", ")} };`);
+    if (methodCount > 0) {
+      bindable[ns] = bucket;
+      count += 1;
     }
   }
-  if (declarations.length === 0) return script;
-  return `${NAMESPACE_CALL_HELPER_SOURCE} ${declarations.join(" ")} return await (async () => {${script}
-})();`;
+  return count > 0 ? bindable : void 0;
 }
 
 // plugins/plugin-codecall/src/services/enclave.service.ts
+function toolFailureMessage(error, toolName) {
+  if (typeof error === "string" && error) return error;
+  const message = error?.message;
+  return typeof message === "string" && message ? message : `Tool call failed: ${toolName}`;
+}
+function toolFailureName(error) {
+  const name = error && typeof error === "object" ? error.name : void 0;
+  return typeof name === "string" && name ? name.slice(0, 128) : "ToolError";
+}
+var PARSE_FAILURE_PREFIX = "Failed to parse AgentScript code: ";
+var PARSE_POSITION_RE = /\((\d+):(\d+)\)$/;
+function parseFailureOf(message) {
+  const match = PARSE_POSITION_RE.exec(message);
+  const line = match ? Number(match[1]) - 1 : 0;
+  if (!match || line < 1) return { message };
+  const column = Number(match[2]);
+  return { message: `${message.slice(0, match.index)}(${line}:${column})`, location: { line, column } };
+}
 var ScriptTooLargeError = class extends Error {
   code = "SCRIPT_TOO_LARGE";
   scriptLength;
@@ -1940,8 +1964,20 @@ var EnclaveService = class {
         throw new ScriptTooLargeError(code.length, maxLength);
       }
     }
+    const toolFailures = [];
     const toolHandler = async (toolName, args) => {
-      return environment.callTool(toolName, args);
+      try {
+        return await environment.callTool(toolName, args);
+      } catch (error) {
+        const code2 = error?.code;
+        toolFailures.push({
+          toolName,
+          name: toolFailureName(error),
+          message: toolFailureMessage(error, toolName),
+          ...typeof code2 === "string" ? { code: code2 } : {}
+        });
+        throw error;
+      }
     };
     const sidecar = this.sidecarOptions.enabled ? {
       enabled: true,
@@ -1951,8 +1987,29 @@ var EnclaveService = class {
       maxResolvedSize: this.sidecarOptions.maxResolvedSize,
       allowComposites: this.sidecarOptions.allowComposites
     } : void 0;
-    const source = wrapScriptWithToolNamespaces(code, environment.toolNamespaces);
-    const enclave = new import_core.Enclave({
+    const { mcpLog, mcpNotify } = environment;
+    const globals = {
+      // Provide getTool as a custom global
+      getTool: environment.getTool,
+      // Provide logging functions if available
+      ...mcpLog ? {
+        mcpLog: (level, message, metadata) => {
+          mcpLog(level, message, metadata);
+          logs.push(`[mcp:${level}] ${message}`);
+        }
+      } : {},
+      ...mcpNotify ? {
+        mcpNotify: (event, payload) => {
+          mcpNotify(event, payload);
+          logs.push(`[notify] ${event}`);
+        }
+      } : {}
+      // Note: enclave-vm v2.0.0+ provides its own __safe_console internally with rate limiting
+      // and output size limits. Passing console in globals causes "Cannot redefine property"
+      // errors due to Double VM architecture. Console output from user scripts goes to stdout
+      // via enclave's internal console, not to this logs array. Only mcpLog/mcpNotify are captured.
+    };
+    const options = {
       timeout: this.vmOptions.timeoutMs,
       maxToolCalls: this.vmOptions.maxSteps || 100,
       maxIterations: 1e4,
@@ -1962,33 +2019,20 @@ var EnclaveService = class {
       validate: true,
       transform: true,
       sidecar,
+      // Error stacks name no host file, whatever stage raised them.
+      sanitizeStackTraces: true,
       // Allow functions in globals since we intentionally provide getTool, mcpLog, mcpNotify, and console
       allowFunctionsInGlobals: true,
-      globals: {
-        // Provide getTool as a custom global
-        getTool: environment.getTool,
-        // Provide logging functions if available
-        ...environment.mcpLog ? {
-          mcpLog: (level, message, metadata) => {
-            environment.mcpLog(level, message, metadata);
-            logs.push(`[mcp:${level}] ${message}`);
-          }
-        } : {},
-        ...environment.mcpNotify ? {
-          mcpNotify: (event, payload) => {
-            environment.mcpNotify(event, payload);
-            logs.push(`[notify] ${event}`);
-          }
-        } : {}
-        // Note: enclave-vm v2.0.0+ provides its own __safe_console internally with rate limiting
-        // and output size limits. Passing console in globals causes "Cannot redefine property"
-        // errors due to Double VM architecture. Console output from user scripts goes to stdout
-        // via enclave's internal console, not to this logs array. Only mcpLog/mcpNotify are captured.
-      }
-    });
+      globals,
+      // Tool namespaces (`acme.getUser()` for a tool named `acme.getUser`) are built by the sandbox
+      // itself: a method call is exactly `callTool('acme.getUser', args, options)`, with the
+      // sandbox's tool-call cap, rate limit, suspicious-sequence checks and `throwOnError`.
+      toolNamespaces: toSandboxToolNamespaces(environment.toolNamespaces, Object.keys(globals))
+    };
+    const enclave = createEnclave(options);
     try {
-      const result = await enclave.run(source);
-      return this.mapEnclaveResult(result, logs);
+      const result = await enclave.run(code);
+      return this.mapEnclaveResult(result, logs, toolFailures);
     } finally {
       enclave.dispose();
     }
@@ -1996,58 +2040,56 @@ var EnclaveService = class {
   /**
    * Map Enclave ExecutionResult to EnclaveExecutionResult
    */
-  mapEnclaveResult(result, logs) {
+  mapEnclaveResult(result, logs, toolFailures = []) {
+    const stats = {
+      duration: result.stats.duration,
+      toolCallCount: result.stats.toolCallCount,
+      iterationCount: result.stats.iterationCount
+    };
     if (result.success) {
+      return { success: true, result: result.value, logs, timedOut: false, stats };
+    }
+    const error = result.error ?? { name: "Error", message: "Script execution failed" };
+    if (error.code === "ENCLAVE_ERROR" && error.message?.startsWith(PARSE_FAILURE_PREFIX)) {
+      const { message, location } = parseFailureOf(error.message);
       return {
-        success: true,
-        result: result.value,
+        success: false,
+        error: { message, name: "SyntaxError", code: "SYNTAX_ERROR", ...location ? { location } : {} },
         logs,
         timedOut: false,
-        stats: {
-          duration: result.stats.duration,
-          toolCallCount: result.stats.toolCallCount,
-          iterationCount: result.stats.iterationCount
-        }
+        stats
       };
     }
-    const error = result.error;
-    const timedOut = error.message?.includes("timed out") || error.code === "TIMEOUT";
-    if (error.code === "VALIDATION_ERROR") {
-      const issues = error.data?.issues ?? [];
-      const blockedPatterns = [...new Set(issues.map((issue) => issue.code).filter((code) => !!code))];
+    const toolFailure = [...toolFailures].reverse().find((failure) => failure.message === error.message && failure.name === error.name);
+    if (toolFailure) {
       return {
         success: false,
         error: {
           message: error.message,
-          name: "ValidationError",
-          code: error.code,
-          ...blockedPatterns.length > 0 ? { blockedPatterns } : {}
+          name: error.name,
+          ...toolFailure.code ? { code: toolFailure.code } : {},
+          toolName: toolFailure.toolName
         },
         logs,
         timedOut: false,
-        stats: {
-          duration: result.stats.duration,
-          toolCallCount: result.stats.toolCallCount,
-          iterationCount: result.stats.iterationCount
-        }
+        stats
       };
     }
-    const errorData = error.data;
-    const toolName = errorData?.["toolName"];
-    if (toolName) {
+    const timedOut = error.message?.includes("timed out") || error.code === "TIMEOUT";
+    if (error.code === "VALIDATION_ERROR") {
+      const issues = error.data?.issues ?? [];
+      const blockedPatterns = [...new Set(issues.map((issue) => issue.code).filter((code) => !!code))];
       return {
         success: false,
         error: {
           message: error.message,
-          name: error.name,
-          stack: error.stack,
+          name: "ValidationError",
           code: error.code,
-          toolName,
-          toolInput: errorData?.["toolInput"],
-          details: errorData?.["details"]
+          ...blockedPatterns.length > 0 ? { blockedPatterns } : {}
         },
         logs,
-        timedOut
+        timedOut: false,
+        stats
       };
     }
     return {
@@ -2060,11 +2102,7 @@ var EnclaveService = class {
       },
       logs,
       timedOut,
-      stats: {
-        duration: result.stats.duration,
-        toolCallCount: result.stats.toolCallCount,
-        iterationCount: result.stats.iterationCount
-      }
+      stats
     };
   }
 };
@@ -2075,6 +2113,16 @@ EnclaveService = __decorateClass([
     scope: import_sdk3.ProviderScope.GLOBAL
   })
 ], EnclaveService);
+function createEnclave(options) {
+  try {
+    return new import_core.Enclave(options);
+  } catch (error) {
+    if (!options.toolNamespaces || !(error instanceof TypeError) || !error.message.startsWith("Invalid toolNamespaces")) {
+      throw error;
+    }
+    return new import_core.Enclave({ ...options, toolNamespaces: void 0 });
+  }
+}
 
 // plugins/plugin-codecall/src/tools/search.tool.ts
 var import_sdk4 = require("@frontmcp/sdk");
@@ -3394,6 +3442,16 @@ var ExecuteTool = class extends import_sdk8.ToolContext {
       }
       if (!executionResult.success) {
         const error = executionResult.error;
+        if (error.code === "SYNTAX_ERROR") {
+          audit?.logExecutionFailure(executionId, script, durationMs, error.message);
+          return {
+            status: "syntax_error",
+            error: {
+              message: toClientErrorMessage(error.message) || "Syntax error in script",
+              ...error.location ? { location: error.location } : {}
+            }
+          };
+        }
         if (error.code === "VALIDATION_ERROR" || error.name === "ValidationError") {
           audit?.logSecurityAstBlocked(executionId, error.blockedPatterns?.join(", ") ?? "UNKNOWN", error.message);
           audit?.logExecutionFailure(executionId, script, durationMs, error.message);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-codecall",
-  "version": "1.8.3",
+  "version": "1.8.4",
   "description": "CodeCall plugin for FrontMCP - AgentScript-based meta-tools for orchestrating MCP tools",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -49,13 +49,13 @@
   },
   "dependencies": {
     "@enclave-vm/core": "^2.15.3",
-    "@frontmcp/protocol": "1.8.3",
-    "@frontmcp/sdk": "1.8.3",
+    "@frontmcp/protocol": "1.8.4",
+    "@frontmcp/sdk": "1.8.4",
     "vectoriadb": "^2.3.2"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.3",
-    "@frontmcp/plugin-cache": "1.8.3"
+    "@frontmcp/lazy-zod": "1.8.4",
+    "@frontmcp/plugin-cache": "1.8.4"
   },
   "devDependencies": {
     "reflect-metadata": "^0.2.2"

package/services/enclave.service.d.ts

@@ -14,6 +14,11 @@ export interface EnclaveExecutionResult {
         toolName?: string;
         toolInput?: unknown;
         details?: unknown;
+        /** For a script that doesn't parse (`code: 'SYNTAX_ERROR'`): where, in the script's own lines. */
+        location?: {
+            line: number;
+            column: number;
+        };
         /**
          * Distinct AST-validation issue codes, for the `codecall:security:ast-blocked` audit event.
          *

package/services/enclave.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enclave.service.d.ts","sourceRoot":"","sources":["../../src/services/enclave.service.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,qBAAqB,EAA6B,MAAM,oBAAoB,CAAC;AAE3F,OAAO,KAAK,cAAc,MAAM,+BAA+B,CAAC;AAGhE;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB;;;;;WAKG;QACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED;;;;;;;;GAQG;AACH;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CASpD;AAOD,MAAM,CAAC,OAAO,OAAO,cAAc;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA4B;IACtD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAyB;gBAE5C,MAAM,EAAE,cAAc;IAOlC;;;;;;;OAOG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAsFhG;;OAEG;IACH,OAAO,CAAC,gBAAgB;CAgFzB"}
+{"version":3,"file":"enclave.service.d.ts","sourceRoot":"","sources":["../../src/services/enclave.service.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,qBAAqB,EAA6B,MAAM,oBAAoB,CAAC;AAE3F,OAAO,KAAK,cAAc,MAAM,+BAA+B,CAAC;AAGhE;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,kGAAkG;QAClG,QAAQ,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5C;;;;;WAKG;QACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAkDD;;;;;;;;GAQG;AACH;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CASpD;AAOD,MAAM,CAAC,OAAO,OAAO,cAAc;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA4B;IACtD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAyB;gBAE5C,MAAM,EAAE,cAAc;IAOlC;;;;;;;OAOG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAwGhG;;OAEG;IACH,OAAO,CAAC,gBAAgB;CAsFzB"}

package/tools/execute.tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execute.tool.d.ts","sourceRoot":"","sources":["../../src/tools/execute.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAwB,WAAW,EAAkB,MAAM,eAAe,CAAC;AAwBlF,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAyC1B,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,WAAW;IAClD;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAIjB,OAAO,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAgVvE"}
+{"version":3,"file":"execute.tool.d.ts","sourceRoot":"","sources":["../../src/tools/execute.tool.ts"],"names":[],"mappings":"AAEA,OAAO,EAAwB,WAAW,EAAkB,MAAM,eAAe,CAAC;AAwBlF,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAyC1B,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,WAAW;IAClD;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAIjB,OAAO,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CA4VvE"}

package/utils/build-tool-namespaces.d.ts

@@ -13,9 +13,9 @@ export type ToolNamespaces = Record<string, ToolNamespace>;
  * Reasons a tool may be skipped during namespace generation. Returned so the
  * caller can surface diagnostics without re-deriving the rules.
  */
-export type NamespaceSkipReason = 'no-namespace-prefix' | 'invalid-identifier' | 'reserved-namespace' | 'prototype-key' | 'duplicate-method';
+export type NamespaceSkipReason = 'no-namespace-prefix' | 'invalid-identifier' | 'reserved-namespace' | 'prototype-key' | 'unsupported-name' | 'duplicate-method';
 export interface BuildToolNamespacesResult {
-    /** The namespaces a script may use, as plain data. Render them with `wrapScriptWithToolNamespaces`. */
+    /** The namespaces a script may use, as plain data (the sandbox's `toolNamespaces`). */
     namespaces: ToolNamespaces;
     /** Tools that were skipped, with the reason. Useful for logs / lint output. */
     skipped: Array<{
@@ -32,25 +32,22 @@ export interface BuildToolNamespacesResult {
  * - Tools whose prefix collides with a reserved global or word are skipped.
  * - Tools whose prefix or suffix is a prototype key (`__proto__`, `constructor`,
  *   `prototype`) are skipped.
+ * - Methods AgentScript refuses as property names (`fetch`, `Map`, `__x`), and tool names the
+ *   sandbox can't carry (outside letters, digits, `:`, `.`, `_` and `-`, or not starting with a
+ *   letter), are skipped.
  * - First registration wins on duplicate `{ns}.{method}` (subsequent are reported as skipped).
  *
- * The result is plain data (method → tool name). The namespace functions themselves are
- * written in AgentScript by `wrapScriptWithToolNamespaces`, so every call they make is a
- * `callTool()` inside the sandbox and goes through the sandbox's tool-call cap, rate limit
- * and suspicious-sequence checks, exactly like a direct `callTool()`.
+ * The result is plain data (method → tool name), handed to the sandbox as its `toolNamespaces`
+ * (see `toSandboxToolNamespaces`): the sandbox builds the namespace objects itself, and a method
+ * call `ns.method(args, options)` is exactly `callTool('ns.method', args, options)`, with the
+ * sandbox's tool-call cap, rate limit, suspicious-sequence checks and `throwOnError` handling.
  */
 export declare function buildToolNamespaces(tools: ReadonlyArray<NamespaceableTool>): BuildToolNamespacesResult;
 /**
- * Make the namespaces available to `script`, as AgentScript.
- *
- * Each namespace becomes a `const` object whose methods call `callTool('<ns>.<method>', input)`
- * inside the sandbox, so the enclave counts, rate-limits and pattern-checks them like any
- * other `callTool()`. (1.8.2 injected them as host functions, which reached the tool
- * pipeline without passing any of those checks.) The user's script runs in a nested async
- * function, so it can still declare its own variables with the same names.
- *
- * Only namespaces the script mentions are emitted; a script that uses none is returned as is.
- * Everything is emitted on the script's first line, so line numbers in parse errors are kept.
+ * The namespaces to hand the sandbox as its `toolNamespaces`: every namespace and method it can
+ * bind, next to custom globals named `reservedGlobals` (`getTool`, `mcpLog`, ...). Rechecks what
+ * `buildToolNamespaces` guarantees, since the sandbox refuses the whole configuration, and so fails
+ * every script, over a single name it can't bind. Returns undefined when nothing is left.
  */
-export declare function wrapScriptWithToolNamespaces(script: string, namespaces: ToolNamespaces | undefined): string;
+export declare function toSandboxToolNamespaces(namespaces: ToolNamespaces | undefined, reservedGlobals?: Iterable<string>): ToolNamespaces | undefined;
 //# sourceMappingURL=build-tool-namespaces.d.ts.map

package/utils/build-tool-namespaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-tool-namespaces.d.ts","sourceRoot":"","sources":["../../src/utils/build-tool-namespaces.ts"],"names":[],"mappings":"AA2DA;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,qGAAqG;AACrG,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEnD,+FAA+F;AAC/F,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAE3D;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC3B,qBAAqB,GACrB,oBAAoB,GACpB,oBAAoB,GACpB,eAAe,GACf,kBAAkB,CAAC;AAEvB,MAAM,WAAW,yBAAyB;IACxC,uGAAuG;IACvG,UAAU,EAAE,cAAc,CAAC;IAC3B,+EAA+E;IAC/E,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,mBAAmB,CAAA;KAAE,CAAC,CAAC;CAC/D;AA4BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,CAAC,iBAAiB,CAAC,GAAG,yBAAyB,CAiDtG;AAgCD;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,GAAG,SAAS,GAAG,MAAM,CA0B3G"}
+{"version":3,"file":"build-tool-namespaces.d.ts","sourceRoot":"","sources":["../../src/utils/build-tool-namespaces.ts"],"names":[],"mappings":"AA2DA;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,qGAAqG;AACrG,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEnD,+FAA+F;AAC/F,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAE3D;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC3B,qBAAqB,GACrB,oBAAoB,GACpB,oBAAoB,GACpB,eAAe,GACf,kBAAkB,GAClB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,yBAAyB;IACxC,uFAAuF;IACvF,UAAU,EAAE,cAAc,CAAC;IAC3B,+EAA+E;IAC/E,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,mBAAmB,CAAA;KAAE,CAAC,CAAC;CAC/D;AAiFD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,CAAC,iBAAiB,CAAC,GAAG,yBAAyB,CAsDtG;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,cAAc,GAAG,SAAS,EACtC,eAAe,GAAE,QAAQ,CAAC,MAAM,CAAM,GACrC,cAAc,GAAG,SAAS,CAsB5B"}