@frontmcp/plugin-codecall 1.8.7 → 1.9.0

package/esm/index.mjs

@@ -14,9 +14,12 @@ import CachePlugin from "@frontmcp/plugin-cache";
 import {
   DynamicPlugin,
   FrontMcpLogger,
+  isEntryGatedBy,
   ListToolsHook,
   Plugin,
-  ScopeEntry
+  ScopeEntry,
+  ToolHook,
+  ToolNotFoundError
 } from "@frontmcp/sdk";
 
 // plugins/plugin-codecall/src/codecall.types.ts
@@ -372,8 +375,186 @@ function presetDefaults(preset) {
   }
 }
 
-// plugins/plugin-codecall/src/services/audit-logger.service.ts
-import { Provider as Provider2, ProviderScope as ProviderScope2 } from "@frontmcp/sdk";
+// plugins/plugin-codecall/src/security/codecall-dispatch.ts
+import { getRunningTool } from "@frontmcp/sdk";
+var CODECALL_DISPATCH = /* @__PURE__ */ Symbol("frontmcp.codecall.dispatch");
+function asCodeCallDispatch(ctx) {
+  return Object.defineProperty(ctx, CODECALL_DISPATCH, { value: true, enumerable: false });
+}
+function isInProcessDispatch(ctx) {
+  if (getRunningTool()) return true;
+  if (typeof ctx !== "object" || ctx === null) return false;
+  const marks = ctx;
+  return marks[CODECALL_DISPATCH] === true || marks.internalCall === true;
+}
+
+// plugins/plugin-codecall/src/security/codecall-tool-policy.ts
+var BLOCKED_NAMESPACE_PATTERNS = Object.freeze([/^system:/, /^internal:/, /^__/]);
+function isOfferedToCaller(availableWhen, surface) {
+  const offered = availableWhen?.surface;
+  return offered === void 0 || surface === void 0 || offered.includes(surface);
+}
+var ALLOWED = { allowed: true };
+function deny(reason) {
+  return { allowed: false, reason };
+}
+function codeCallAppIdOf(scope, entry) {
+  const lineage = scope?.tools?.lineageOf?.(entry) ?? [];
+  const owners = entry.owner ? [...lineage, entry.owner] : lineage;
+  return owners.find((owner) => owner.kind === "app")?.id;
+}
+function toCodeCallPolicyTool(entry, requestedName, scope) {
+  const { metadata } = entry;
+  return {
+    name: entry.name || entry.fullName,
+    fullName: entry.fullName,
+    aliases: requestedName ? [requestedName] : void 0,
+    appId: codeCallAppIdOf(scope, entry),
+    description: metadata?.description,
+    tags: metadata?.tags,
+    // `internal` tools refuse every external tools/call, CodeCall's included, so no surface may offer them.
+    hidden: metadata?.hideFromDiscovery === true || metadata?.visibility === "hidden" || metadata?.visibility === "internal",
+    codecall: metadata?.codecall,
+    annotations: metadata?.annotations,
+    metadata
+  };
+}
+function isPlainData(value) {
+  if (Array.isArray(value)) return true;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function readOnlyCopy(value, copies) {
+  if (typeof value !== "object" || value === null || !isPlainData(value)) return value;
+  const existing = copies.get(value);
+  if (existing !== void 0) return existing;
+  const copy = Array.isArray(value) ? [] : Object.create(Object.getPrototypeOf(value));
+  copies.set(value, copy);
+  for (const key of Reflect.ownKeys(value)) {
+    if (!Object.prototype.propertyIsEnumerable.call(value, key)) continue;
+    Object.defineProperty(copy, key, {
+      value: readOnlyCopy(Reflect.get(value, key), copies),
+      enumerable: true,
+      writable: true,
+      configurable: true
+    });
+  }
+  return Object.freeze(copy);
+}
+function toToolFilterInfo(tool) {
+  const copies = /* @__PURE__ */ new WeakMap();
+  const annotations = readOnlyCopy(tool.annotations, copies);
+  const metadata = tool.metadata ? readOnlyCopy({ ...tool.metadata, ...annotations ? { annotations: tool.annotations } : {} }, copies) : void 0;
+  return {
+    name: tool.name,
+    fullName: tool.fullName,
+    appId: tool.appId,
+    source: tool.codecall?.source,
+    description: tool.description,
+    tags: readOnlyCopy(tool.codecall?.tags ?? tool.tags, copies),
+    annotations,
+    metadata
+  };
+}
+function ownNamesOf(tool) {
+  return [tool.name, tool.fullName].filter((candidate) => !!candidate);
+}
+function checkCodeCallToolPolicy(tool, config) {
+  const { name } = tool;
+  const spellings = [...ownNamesOf(tool), ...tool.aliases ?? []];
+  if (spellings.some((candidate) => candidate.startsWith("codecall:"))) {
+    return deny("CodeCall meta-tools are not callable from CodeCall");
+  }
+  for (const candidate of spellings) {
+    if (BLOCKED_NAMESPACE_PATTERNS.some((pattern) => pattern.test(candidate))) {
+      return deny(`Tool "${candidate}" is in a namespace CodeCall never calls`);
+    }
+  }
+  if (tool.hidden === true) {
+    return deny(`Tool "${name}" is hidden from discovery`);
+  }
+  const enabled = tool.codecall?.enabledInCodeCall;
+  switch (config.mode) {
+    case "codecall_only":
+    case "metadata_driven":
+      if (enabled === false) {
+        return deny(`Tool "${name}" sets enabledInCodeCall: false`);
+      }
+      break;
+    case "codecall_opt_in":
+      if (enabled !== true) {
+        return deny(`Tool "${name}" has not opted in to CodeCall`);
+      }
+      break;
+    default:
+      return deny(`Unknown CodeCall mode: ${String(config.mode)}`);
+  }
+  if (config.includeTools && !config.includeTools(toToolFilterInfo(tool))) {
+    return deny(`Tool "${name}" is excluded by the includeTools filter`);
+  }
+  return ALLOWED;
+}
+function denyUnknownTool(name) {
+  return deny(`Tool "${name}" is not available through CodeCall`);
+}
+function resolveCodeCallTool(scope, name) {
+  const typedScope = scope;
+  const alias = /[-_]/.test(name) ? name.includes("_") ? name.replace(/_/g, "-") : name.replace(/-/g, "_") : void 0;
+  const candidates = alias ? [name, alias] : [name];
+  const matches = (entry) => candidates.includes(entry.fullName) || candidates.includes(entry.name);
+  const local = typedScope.tools?.getTools(true)?.find(matches);
+  if (local) return local;
+  const registries = typedScope.providers?.getRegistries?.("AppRegistry") ?? [];
+  for (const registry of registries) {
+    for (const app of registry.getApps()) {
+      if (!app.isRemote) continue;
+      const remote = app.tools.getTools(true).find(matches);
+      if (remote) return remote;
+    }
+  }
+  return void 0;
+}
+function checkDirectCallPolicy(tool, directCalls) {
+  if (!directCalls) return ALLOWED;
+  if (directCalls.enabled === false) {
+    return deny("Direct tool invocation is disabled");
+  }
+  const { allowedTools } = directCalls;
+  if (allowedTools && !ownNamesOf(tool).some((ownName) => allowedTools.includes(ownName))) {
+    return deny(`Tool "${tool.name}" is not in the direct-call allowlist`);
+  }
+  if (directCalls.filter && !directCalls.filter(toToolFilterInfo(tool))) {
+    return deny(`Tool "${tool.name}" is excluded by the directCalls filter`);
+  }
+  return ALLOWED;
+}
+function readCodeCallPolicyConfig(config) {
+  return {
+    // An absent mode means an unparsed/partial config, not a hostile one: fall back to the
+    // schema's own documented default rather than denying every call. An unrecognised mode
+    // still fails closed inside the policy's switch.
+    mode: config.get("mode") ?? "codecall_only",
+    includeTools: config.get("includeTools")
+  };
+}
+function checkCodeCallToolAccess(scope, config, name, options = {}) {
+  const entry = resolveCodeCallTool(scope, name);
+  if (!entry) return denyUnknownTool(name);
+  if (!isOfferedToCaller(entry.metadata?.availableWhen, options.surface)) {
+    return deny(`Tool "${name}" is not offered on the caller's surface "${options.surface}"`);
+  }
+  const policyTool = toCodeCallPolicyTool(entry, name, scope);
+  const baseDecision = checkCodeCallToolPolicy(policyTool, readCodeCallPolicyConfig(config));
+  if (!baseDecision.allowed) return baseDecision;
+  if (options.directCall) {
+    const directDecision = checkDirectCallPolicy(
+      policyTool,
+      config.get("directCalls")
+    );
+    if (!directDecision.allowed) return directDecision;
+  }
+  return { allowed: true, entry };
+}
 
 // plugins/plugin-codecall/src/utils/client-error-message.ts
 var EMBEDDED_STACK_FRAME_RE = /\n[ \t]*at\s[^\n]*/g;
@@ -413,7 +594,85 @@ function redactAbsolutePaths(text) {
   return result + redactPaths(text.slice(last));
 }
 
+// plugins/plugin-codecall/src/errors/tool-call.errors.ts
+var TOOL_CALL_ERROR_CODES = {
+  NOT_FOUND: "NOT_FOUND",
+  VALIDATION: "VALIDATION",
+  EXECUTION: "EXECUTION",
+  TIMEOUT: "TIMEOUT",
+  ACCESS_DENIED: "ACCESS_DENIED",
+  SELF_REFERENCE: "SELF_REFERENCE"
+};
+function createToolCallError(code, toolName, rawMessage) {
+  const sanitizedMessage = getSanitizedMessage(code, toolName, rawMessage);
+  return Object.freeze({
+    code,
+    message: sanitizedMessage,
+    toolName
+  });
+}
+function getSanitizedMessage(code, toolName, rawMessage) {
+  switch (code) {
+    case TOOL_CALL_ERROR_CODES.NOT_FOUND:
+      return `Tool "${toolName}" was not found`;
+    case TOOL_CALL_ERROR_CODES.VALIDATION:
+      return rawMessage ? sanitizeValidationMessage(rawMessage) : `Input validation failed for tool "${toolName}"`;
+    case TOOL_CALL_ERROR_CODES.EXECUTION:
+      return `Tool "${toolName}" execution failed`;
+    case TOOL_CALL_ERROR_CODES.TIMEOUT:
+      return `Tool "${toolName}" execution timed out`;
+    case TOOL_CALL_ERROR_CODES.ACCESS_DENIED:
+      return `Access denied for tool "${toolName}"`;
+    case TOOL_CALL_ERROR_CODES.SELF_REFERENCE:
+      return `Cannot call CodeCall tools from within AgentScript`;
+    default:
+      return `An error occurred while calling "${toolName}"`;
+  }
+}
+function sanitizeValidationMessage(message) {
+  let sanitized = toClientErrorMessage(message);
+  sanitized = sanitized.replace(/\bat line \d+/gi, "");
+  sanitized = sanitized.replace(/\bline \d+/gi, "");
+  sanitized = sanitized.replace(/:\d+:\d+/g, "");
+  if (sanitized.length > 200) {
+    sanitized = sanitized.substring(0, 200) + "...";
+  }
+  return sanitized.trim();
+}
+var SelfReferenceError = class extends Error {
+  code = TOOL_CALL_ERROR_CODES.SELF_REFERENCE;
+  toolName;
+  constructor(toolName) {
+    super(`Self-reference attack: Attempted to call CodeCall tool "${toolName}" from within AgentScript`);
+    this.name = "SelfReferenceError";
+    this.toolName = toolName;
+    Object.freeze(this);
+  }
+};
+
+// plugins/plugin-codecall/src/security/self-reference-guard.ts
+var CODECALL_TOOL_PREFIX = "codecall:";
+var BLOCKED_CODECALL_TOOLS = Object.freeze(
+  /* @__PURE__ */ new Set(["codecall:search", "codecall:describe", "codecall:execute", "codecall:invoke"])
+);
+function isBlockedSelfReference(toolName) {
+  const normalizedName = toolName.toLowerCase().trim();
+  if (normalizedName.startsWith(CODECALL_TOOL_PREFIX)) {
+    return true;
+  }
+  if (BLOCKED_CODECALL_TOOLS.has(toolName)) {
+    return true;
+  }
+  return false;
+}
+function assertNotSelfReference(toolName) {
+  if (isBlockedSelfReference(toolName)) {
+    throw new SelfReferenceError(toolName);
+  }
+}
+
 // plugins/plugin-codecall/src/services/audit-logger.service.ts
+import { Provider as Provider2, ProviderScope as ProviderScope2 } from "@frontmcp/sdk";
 var AUDIT_EVENT_TYPES = {
   /** Script execution started */
   EXECUTION_START: "codecall:execution:start",
@@ -708,174 +967,6 @@ AuditLoggerService = __decorateClass([
 // plugins/plugin-codecall/src/services/tool-search.service.ts
 import { TFIDFVectoria, VectoriaDB } from "vectoriadb";
 
-// plugins/plugin-codecall/src/security/codecall-tool-policy.ts
-var BLOCKED_NAMESPACE_PATTERNS = Object.freeze([/^system:/, /^internal:/, /^__/]);
-function isOfferedToCaller(availableWhen, surface) {
-  const offered = availableWhen?.surface;
-  return offered === void 0 || surface === void 0 || offered.includes(surface);
-}
-var ALLOWED = { allowed: true };
-function deny(reason) {
-  return { allowed: false, reason };
-}
-function codeCallAppIdOf(scope, entry) {
-  const lineage = scope?.tools?.lineageOf?.(entry) ?? [];
-  const owners = entry.owner ? [...lineage, entry.owner] : lineage;
-  return owners.find((owner) => owner.kind === "app")?.id;
-}
-function toCodeCallPolicyTool(entry, requestedName, scope) {
-  const { metadata } = entry;
-  return {
-    name: entry.name || entry.fullName,
-    fullName: entry.fullName,
-    aliases: requestedName ? [requestedName] : void 0,
-    appId: codeCallAppIdOf(scope, entry),
-    description: metadata?.description,
-    tags: metadata?.tags,
-    // `internal` tools refuse every external tools/call, CodeCall's included, so no surface may offer them.
-    hidden: metadata?.hideFromDiscovery === true || metadata?.visibility === "hidden" || metadata?.visibility === "internal",
-    codecall: metadata?.codecall,
-    annotations: metadata?.annotations,
-    metadata
-  };
-}
-function isPlainData(value) {
-  if (Array.isArray(value)) return true;
-  const proto = Object.getPrototypeOf(value);
-  return proto === Object.prototype || proto === null;
-}
-function readOnlyCopy(value, copies) {
-  if (typeof value !== "object" || value === null || !isPlainData(value)) return value;
-  const existing = copies.get(value);
-  if (existing !== void 0) return existing;
-  const copy = Array.isArray(value) ? [] : Object.create(Object.getPrototypeOf(value));
-  copies.set(value, copy);
-  for (const key of Reflect.ownKeys(value)) {
-    if (!Object.prototype.propertyIsEnumerable.call(value, key)) continue;
-    Object.defineProperty(copy, key, {
-      value: readOnlyCopy(Reflect.get(value, key), copies),
-      enumerable: true,
-      writable: true,
-      configurable: true
-    });
-  }
-  return Object.freeze(copy);
-}
-function toToolFilterInfo(tool) {
-  const copies = /* @__PURE__ */ new WeakMap();
-  const annotations = readOnlyCopy(tool.annotations, copies);
-  const metadata = tool.metadata ? readOnlyCopy({ ...tool.metadata, ...annotations ? { annotations: tool.annotations } : {} }, copies) : void 0;
-  return {
-    name: tool.name,
-    fullName: tool.fullName,
-    appId: tool.appId,
-    source: tool.codecall?.source,
-    description: tool.description,
-    tags: readOnlyCopy(tool.codecall?.tags ?? tool.tags, copies),
-    annotations,
-    metadata
-  };
-}
-function ownNamesOf(tool) {
-  return [tool.name, tool.fullName].filter((candidate) => !!candidate);
-}
-function checkCodeCallToolPolicy(tool, config) {
-  const { name } = tool;
-  const spellings = [...ownNamesOf(tool), ...tool.aliases ?? []];
-  if (spellings.some((candidate) => candidate.startsWith("codecall:"))) {
-    return deny("CodeCall meta-tools are not callable from CodeCall");
-  }
-  for (const candidate of spellings) {
-    if (BLOCKED_NAMESPACE_PATTERNS.some((pattern) => pattern.test(candidate))) {
-      return deny(`Tool "${candidate}" is in a namespace CodeCall never calls`);
-    }
-  }
-  if (tool.hidden === true) {
-    return deny(`Tool "${name}" is hidden from discovery`);
-  }
-  const enabled = tool.codecall?.enabledInCodeCall;
-  switch (config.mode) {
-    case "codecall_only":
-    case "metadata_driven":
-      if (enabled === false) {
-        return deny(`Tool "${name}" sets enabledInCodeCall: false`);
-      }
-      break;
-    case "codecall_opt_in":
-      if (enabled !== true) {
-        return deny(`Tool "${name}" has not opted in to CodeCall`);
-      }
-      break;
-    default:
-      return deny(`Unknown CodeCall mode: ${String(config.mode)}`);
-  }
-  if (config.includeTools && !config.includeTools(toToolFilterInfo(tool))) {
-    return deny(`Tool "${name}" is excluded by the includeTools filter`);
-  }
-  return ALLOWED;
-}
-function denyUnknownTool(name) {
-  return deny(`Tool "${name}" is not available through CodeCall`);
-}
-function resolveCodeCallTool(scope, name) {
-  const typedScope = scope;
-  const alias = /[-_]/.test(name) ? name.includes("_") ? name.replace(/_/g, "-") : name.replace(/-/g, "_") : void 0;
-  const candidates = alias ? [name, alias] : [name];
-  const matches = (entry) => candidates.includes(entry.fullName) || candidates.includes(entry.name);
-  const local = typedScope.tools?.getTools(true)?.find(matches);
-  if (local) return local;
-  const registries = typedScope.providers?.getRegistries?.("AppRegistry") ?? [];
-  for (const registry of registries) {
-    for (const app of registry.getApps()) {
-      if (!app.isRemote) continue;
-      const remote = app.tools.getTools(true).find(matches);
-      if (remote) return remote;
-    }
-  }
-  return void 0;
-}
-function checkDirectCallPolicy(tool, directCalls) {
-  if (!directCalls) return ALLOWED;
-  if (directCalls.enabled === false) {
-    return deny("Direct tool invocation is disabled");
-  }
-  const { allowedTools } = directCalls;
-  if (allowedTools && !ownNamesOf(tool).some((ownName) => allowedTools.includes(ownName))) {
-    return deny(`Tool "${tool.name}" is not in the direct-call allowlist`);
-  }
-  if (directCalls.filter && !directCalls.filter(toToolFilterInfo(tool))) {
-    return deny(`Tool "${tool.name}" is excluded by the directCalls filter`);
-  }
-  return ALLOWED;
-}
-function readCodeCallPolicyConfig(config) {
-  return {
-    // An absent mode means an unparsed/partial config, not a hostile one: fall back to the
-    // schema's own documented default rather than denying every call. An unrecognised mode
-    // still fails closed inside the policy's switch.
-    mode: config.get("mode") ?? "codecall_only",
-    includeTools: config.get("includeTools")
-  };
-}
-function checkCodeCallToolAccess(scope, config, name, options = {}) {
-  const entry = resolveCodeCallTool(scope, name);
-  if (!entry) return denyUnknownTool(name);
-  if (!isOfferedToCaller(entry.metadata?.availableWhen, options.surface)) {
-    return deny(`Tool "${name}" is not offered on the caller's surface "${options.surface}"`);
-  }
-  const policyTool = toCodeCallPolicyTool(entry, name, scope);
-  const baseDecision = checkCodeCallToolPolicy(policyTool, readCodeCallPolicyConfig(config));
-  if (!baseDecision.allowed) return baseDecision;
-  if (options.directCall) {
-    const directDecision = checkDirectCallPolicy(
-      policyTool,
-      config.get("directCalls")
-    );
-    if (!directDecision.allowed) return directDecision;
-  }
-  return { allowed: true, entry };
-}
-
 // plugins/plugin-codecall/src/services/synonym-expansion.service.ts
 var DEFAULT_SYNONYM_GROUPS = [
   // ===========================================================================
@@ -2641,83 +2732,6 @@ SearchKnowledgeTool = __decorateClass([
 import { toJSONSchema, z as z6, ZodType } from "@frontmcp/lazy-zod";
 import { getCallSurface as getCallSurface2, Tool as Tool4, ToolContext as ToolContext4 } from "@frontmcp/sdk";
 
-// plugins/plugin-codecall/src/errors/tool-call.errors.ts
-var TOOL_CALL_ERROR_CODES = {
-  NOT_FOUND: "NOT_FOUND",
-  VALIDATION: "VALIDATION",
-  EXECUTION: "EXECUTION",
-  TIMEOUT: "TIMEOUT",
-  ACCESS_DENIED: "ACCESS_DENIED",
-  SELF_REFERENCE: "SELF_REFERENCE"
-};
-function createToolCallError(code, toolName, rawMessage) {
-  const sanitizedMessage = getSanitizedMessage(code, toolName, rawMessage);
-  return Object.freeze({
-    code,
-    message: sanitizedMessage,
-    toolName
-  });
-}
-function getSanitizedMessage(code, toolName, rawMessage) {
-  switch (code) {
-    case TOOL_CALL_ERROR_CODES.NOT_FOUND:
-      return `Tool "${toolName}" was not found`;
-    case TOOL_CALL_ERROR_CODES.VALIDATION:
-      return rawMessage ? sanitizeValidationMessage(rawMessage) : `Input validation failed for tool "${toolName}"`;
-    case TOOL_CALL_ERROR_CODES.EXECUTION:
-      return `Tool "${toolName}" execution failed`;
-    case TOOL_CALL_ERROR_CODES.TIMEOUT:
-      return `Tool "${toolName}" execution timed out`;
-    case TOOL_CALL_ERROR_CODES.ACCESS_DENIED:
-      return `Access denied for tool "${toolName}"`;
-    case TOOL_CALL_ERROR_CODES.SELF_REFERENCE:
-      return `Cannot call CodeCall tools from within AgentScript`;
-    default:
-      return `An error occurred while calling "${toolName}"`;
-  }
-}
-function sanitizeValidationMessage(message) {
-  let sanitized = toClientErrorMessage(message);
-  sanitized = sanitized.replace(/\bat line \d+/gi, "");
-  sanitized = sanitized.replace(/\bline \d+/gi, "");
-  sanitized = sanitized.replace(/:\d+:\d+/g, "");
-  if (sanitized.length > 200) {
-    sanitized = sanitized.substring(0, 200) + "...";
-  }
-  return sanitized.trim();
-}
-var SelfReferenceError = class extends Error {
-  code = TOOL_CALL_ERROR_CODES.SELF_REFERENCE;
-  toolName;
-  constructor(toolName) {
-    super(`Self-reference attack: Attempted to call CodeCall tool "${toolName}" from within AgentScript`);
-    this.name = "SelfReferenceError";
-    this.toolName = toolName;
-    Object.freeze(this);
-  }
-};
-
-// plugins/plugin-codecall/src/security/self-reference-guard.ts
-var CODECALL_TOOL_PREFIX = "codecall:";
-var BLOCKED_CODECALL_TOOLS = Object.freeze(
-  /* @__PURE__ */ new Set(["codecall:search", "codecall:describe", "codecall:execute", "codecall:invoke"])
-);
-function isBlockedSelfReference(toolName) {
-  const normalizedName = toolName.toLowerCase().trim();
-  if (normalizedName.startsWith(CODECALL_TOOL_PREFIX)) {
-    return true;
-  }
-  if (BLOCKED_CODECALL_TOOLS.has(toolName)) {
-    return true;
-  }
-  return false;
-}
-function assertNotSelfReference(toolName) {
-  if (isBlockedSelfReference(toolName)) {
-    throw new SelfReferenceError(toolName);
-  }
-}
-
 // plugins/plugin-codecall/src/utils/describe.utils.ts
 var INTENT_PATTERNS = {
   create: /^(create|add|new|insert|make|append|register|generate|produce|build|construct|provision|instantiate|define|compose|draft)/i,
@@ -3531,10 +3545,10 @@ var ExecuteTool = class extends ToolContext5 {
               arguments: toolInput
             }
           };
-          const ctx = {
+          const ctx = asCodeCallDispatch({
             authInfo: this.authInfo,
             surface: callerSurface
-          };
+          });
           const mcpResult = await this.scope.runFlow("tools:call-tool", { request, ctx });
           if (!mcpResult) {
             audit?.logToolCallFailure(
@@ -3791,10 +3805,10 @@ var InvokeTool = class extends ToolContext6 {
         arguments: toolInput
       }
     };
-    const ctx = {
+    const ctx = asCodeCallDispatch({
       authInfo: this.authInfo,
       surface
-    };
+    });
     const result = await this.scope.runFlow("tools:call-tool", { request, ctx });
     if (!result) {
       audit?.logInvoke(executionId, toolName, false, Date.now() - startedAt);
@@ -3827,6 +3841,10 @@ function auditLogFields(event) {
   const { executionId, durationMs, data } = event;
   return durationMs === void 0 ? { executionId, ...data } : { executionId, durationMs, ...data };
 }
+function callContextOf(flowCtx) {
+  const rawInput = flowCtx.rawInput;
+  return typeof rawInput === "object" && rawInput !== null ? rawInput.ctx : void 0;
+}
 var CodeCallPlugin = class extends DynamicPlugin {
   options;
   cachedLogger;
@@ -3902,12 +3920,32 @@ var CodeCallPlugin = class extends DynamicPlugin {
       logger.verbose("adjustListTools: no tools to filter, returning early");
       return;
     }
-    const filteredTools = resolvedTools.filter(({ tool }) => {
-      return this.shouldShowInListTools(tool, this.options.mode);
-    });
+    const scope = this.tryGetScope();
+    const filteredTools = resolvedTools.filter(
+      ({ tool }) => !this.judges(scope, { tool }) || this.shouldShowInListTools(tool, this.options.mode)
+    );
     logger.verbose("adjustListTools: tools after filter", { count: filteredTools.length });
     flowCtx.state.set("resolvedTools", filteredTools);
   }
+  async refuseDirectCallOfHiddenTool(flowCtx) {
+    const { tool } = flowCtx.state;
+    if (!tool || tool.owner?.kind === "scope") return;
+    if (this.shouldShowInListTools(tool, this.options.mode)) return;
+    if (isInProcessDispatch(callContextOf(flowCtx))) return;
+    this.getLogger().verbose("refused a direct tools/call of a tool CodeCall hides", { tool: tool.fullName });
+    throw new ToolNotFoundError(flowCtx.state.input?.name ?? tool.name);
+  }
+  /** Whether this instance's direct-call gate runs for the tool, so the listing hides only what that gate refuses. */
+  judges(scope, entry) {
+    return !scope?.hooks || isEntryGatedBy(scope, entry, this);
+  }
+  tryGetScope() {
+    try {
+      return this.get(ScopeEntry);
+    } catch {
+      return void 0;
+    }
+  }
   /**
    * Determine if a tool should be visible in list_tools based on mode.
    *
@@ -3963,6 +4001,9 @@ var CodeCallPlugin = class extends DynamicPlugin {
 __decorateClass([
   ListToolsHook.Did("resolveConflicts", { priority: 1e3 })
 ], CodeCallPlugin.prototype, "adjustListTools", 1);
+__decorateClass([
+  ToolHook.Did("findTool", { priority: 10, appliesTo: "uncovered-apps" })
+], CodeCallPlugin.prototype, "refuseDirectCallOfHiddenTool", 1);
 CodeCallPlugin = __decorateClass([
   Plugin({
     name: "codecall",

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-codecall",
-  "version": "1.8.7",
+  "version": "1.9.0",
   "description": "CodeCall plugin for FrontMCP - AgentScript-based meta-tools for orchestrating MCP tools",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -50,14 +50,14 @@
   "dependencies": {
     "@enclave-vm/ast": "^2.15.3",
     "@enclave-vm/core": "^2.15.3",
-    "@frontmcp/protocol": "1.8.7",
-    "@frontmcp/sdk": "1.8.7",
+    "@frontmcp/protocol": "1.9.0",
+    "@frontmcp/sdk": "1.9.0",
     "acorn": "^8.15.0",
     "vectoriadb": "^2.3.2"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.7",
-    "@frontmcp/plugin-cache": "1.8.7"
+    "@frontmcp/lazy-zod": "1.9.0",
+    "@frontmcp/plugin-cache": "1.9.0"
   },
   "devDependencies": {
     "reflect-metadata": "^0.2.2"