@frontmcp/plugin-codecall 1.8.7 → 1.9.1-rc.1

package/index.js

@@ -56,7 +56,7 @@ module.exports = __toCommonJS(index_exports);
 
 // plugins/plugin-codecall/src/codecall.plugin.ts
 var import_plugin_cache = __toESM(require("@frontmcp/plugin-cache"));
-var import_sdk10 = require("@frontmcp/sdk");
+var import_sdk11 = require("@frontmcp/sdk");
 
 // plugins/plugin-codecall/src/codecall.types.ts
 var import_lazy_zod = require("@frontmcp/lazy-zod");
@@ -411,8 +411,186 @@ function presetDefaults(preset) {
   }
 }
 
-// plugins/plugin-codecall/src/services/audit-logger.service.ts
+// plugins/plugin-codecall/src/security/codecall-dispatch.ts
 var import_sdk2 = require("@frontmcp/sdk");
+var CODECALL_DISPATCH = /* @__PURE__ */ Symbol("frontmcp.codecall.dispatch");
+function asCodeCallDispatch(ctx) {
+  return Object.defineProperty(ctx, CODECALL_DISPATCH, { value: true, enumerable: false });
+}
+function isInProcessDispatch(ctx) {
+  if ((0, import_sdk2.getRunningTool)()) return true;
+  if (typeof ctx !== "object" || ctx === null) return false;
+  const marks = ctx;
+  return marks[CODECALL_DISPATCH] === true || marks.internalCall === true;
+}
+
+// plugins/plugin-codecall/src/security/codecall-tool-policy.ts
+var BLOCKED_NAMESPACE_PATTERNS = Object.freeze([/^system:/, /^internal:/, /^__/]);
+function isOfferedToCaller(availableWhen, surface) {
+  const offered = availableWhen?.surface;
+  return offered === void 0 || surface === void 0 || offered.includes(surface);
+}
+var ALLOWED = { allowed: true };
+function deny(reason) {
+  return { allowed: false, reason };
+}
+function codeCallAppIdOf(scope, entry) {
+  const lineage = scope?.tools?.lineageOf?.(entry) ?? [];
+  const owners = entry.owner ? [...lineage, entry.owner] : lineage;
+  return owners.find((owner) => owner.kind === "app")?.id;
+}
+function toCodeCallPolicyTool(entry, requestedName, scope) {
+  const { metadata } = entry;
+  return {
+    name: entry.name || entry.fullName,
+    fullName: entry.fullName,
+    aliases: requestedName ? [requestedName] : void 0,
+    appId: codeCallAppIdOf(scope, entry),
+    description: metadata?.description,
+    tags: metadata?.tags,
+    // `internal` tools refuse every external tools/call, CodeCall's included, so no surface may offer them.
+    hidden: metadata?.hideFromDiscovery === true || metadata?.visibility === "hidden" || metadata?.visibility === "internal",
+    codecall: metadata?.codecall,
+    annotations: metadata?.annotations,
+    metadata
+  };
+}
+function isPlainData(value) {
+  if (Array.isArray(value)) return true;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function readOnlyCopy(value, copies) {
+  if (typeof value !== "object" || value === null || !isPlainData(value)) return value;
+  const existing = copies.get(value);
+  if (existing !== void 0) return existing;
+  const copy = Array.isArray(value) ? [] : Object.create(Object.getPrototypeOf(value));
+  copies.set(value, copy);
+  for (const key of Reflect.ownKeys(value)) {
+    if (!Object.prototype.propertyIsEnumerable.call(value, key)) continue;
+    Object.defineProperty(copy, key, {
+      value: readOnlyCopy(Reflect.get(value, key), copies),
+      enumerable: true,
+      writable: true,
+      configurable: true
+    });
+  }
+  return Object.freeze(copy);
+}
+function toToolFilterInfo(tool) {
+  const copies = /* @__PURE__ */ new WeakMap();
+  const annotations = readOnlyCopy(tool.annotations, copies);
+  const metadata = tool.metadata ? readOnlyCopy({ ...tool.metadata, ...annotations ? { annotations: tool.annotations } : {} }, copies) : void 0;
+  return {
+    name: tool.name,
+    fullName: tool.fullName,
+    appId: tool.appId,
+    source: tool.codecall?.source,
+    description: tool.description,
+    tags: readOnlyCopy(tool.codecall?.tags ?? tool.tags, copies),
+    annotations,
+    metadata
+  };
+}
+function ownNamesOf(tool) {
+  return [tool.name, tool.fullName].filter((candidate) => !!candidate);
+}
+function checkCodeCallToolPolicy(tool, config) {
+  const { name } = tool;
+  const spellings = [...ownNamesOf(tool), ...tool.aliases ?? []];
+  if (spellings.some((candidate) => candidate.startsWith("codecall:"))) {
+    return deny("CodeCall meta-tools are not callable from CodeCall");
+  }
+  for (const candidate of spellings) {
+    if (BLOCKED_NAMESPACE_PATTERNS.some((pattern) => pattern.test(candidate))) {
+      return deny(`Tool "${candidate}" is in a namespace CodeCall never calls`);
+    }
+  }
+  if (tool.hidden === true) {
+    return deny(`Tool "${name}" is hidden from discovery`);
+  }
+  const enabled = tool.codecall?.enabledInCodeCall;
+  switch (config.mode) {
+    case "codecall_only":
+    case "metadata_driven":
+      if (enabled === false) {
+        return deny(`Tool "${name}" sets enabledInCodeCall: false`);
+      }
+      break;
+    case "codecall_opt_in":
+      if (enabled !== true) {
+        return deny(`Tool "${name}" has not opted in to CodeCall`);
+      }
+      break;
+    default:
+      return deny(`Unknown CodeCall mode: ${String(config.mode)}`);
+  }
+  if (config.includeTools && !config.includeTools(toToolFilterInfo(tool))) {
+    return deny(`Tool "${name}" is excluded by the includeTools filter`);
+  }
+  return ALLOWED;
+}
+function denyUnknownTool(name) {
+  return deny(`Tool "${name}" is not available through CodeCall`);
+}
+function resolveCodeCallTool(scope, name) {
+  const typedScope = scope;
+  const alias = /[-_]/.test(name) ? name.includes("_") ? name.replace(/_/g, "-") : name.replace(/-/g, "_") : void 0;
+  const candidates = alias ? [name, alias] : [name];
+  const matches = (entry) => candidates.includes(entry.fullName) || candidates.includes(entry.name);
+  const local = typedScope.tools?.getTools(true)?.find(matches);
+  if (local) return local;
+  const registries = typedScope.providers?.getRegistries?.("AppRegistry") ?? [];
+  for (const registry of registries) {
+    for (const app of registry.getApps()) {
+      if (!app.isRemote) continue;
+      const remote = app.tools.getTools(true).find(matches);
+      if (remote) return remote;
+    }
+  }
+  return void 0;
+}
+function checkDirectCallPolicy(tool, directCalls) {
+  if (!directCalls) return ALLOWED;
+  if (directCalls.enabled === false) {
+    return deny("Direct tool invocation is disabled");
+  }
+  const { allowedTools } = directCalls;
+  if (allowedTools && !ownNamesOf(tool).some((ownName) => allowedTools.includes(ownName))) {
+    return deny(`Tool "${tool.name}" is not in the direct-call allowlist`);
+  }
+  if (directCalls.filter && !directCalls.filter(toToolFilterInfo(tool))) {
+    return deny(`Tool "${tool.name}" is excluded by the directCalls filter`);
+  }
+  return ALLOWED;
+}
+function readCodeCallPolicyConfig(config) {
+  return {
+    // An absent mode means an unparsed/partial config, not a hostile one: fall back to the
+    // schema's own documented default rather than denying every call. An unrecognised mode
+    // still fails closed inside the policy's switch.
+    mode: config.get("mode") ?? "codecall_only",
+    includeTools: config.get("includeTools")
+  };
+}
+function checkCodeCallToolAccess(scope, config, name, options = {}) {
+  const entry = resolveCodeCallTool(scope, name);
+  if (!entry) return denyUnknownTool(name);
+  if (!isOfferedToCaller(entry.metadata?.availableWhen, options.surface)) {
+    return deny(`Tool "${name}" is not offered on the caller's surface "${options.surface}"`);
+  }
+  const policyTool = toCodeCallPolicyTool(entry, name, scope);
+  const baseDecision = checkCodeCallToolPolicy(policyTool, readCodeCallPolicyConfig(config));
+  if (!baseDecision.allowed) return baseDecision;
+  if (options.directCall) {
+    const directDecision = checkDirectCallPolicy(
+      policyTool,
+      config.get("directCalls")
+    );
+    if (!directDecision.allowed) return directDecision;
+  }
+  return { allowed: true, entry };
+}
 
 // plugins/plugin-codecall/src/utils/client-error-message.ts
 var EMBEDDED_STACK_FRAME_RE = /\n[ \t]*at\s[^\n]*/g;
@@ -452,7 +630,85 @@ function redactAbsolutePaths(text) {
   return result + redactPaths(text.slice(last));
 }
 
+// plugins/plugin-codecall/src/errors/tool-call.errors.ts
+var TOOL_CALL_ERROR_CODES = {
+  NOT_FOUND: "NOT_FOUND",
+  VALIDATION: "VALIDATION",
+  EXECUTION: "EXECUTION",
+  TIMEOUT: "TIMEOUT",
+  ACCESS_DENIED: "ACCESS_DENIED",
+  SELF_REFERENCE: "SELF_REFERENCE"
+};
+function createToolCallError(code, toolName, rawMessage) {
+  const sanitizedMessage = getSanitizedMessage(code, toolName, rawMessage);
+  return Object.freeze({
+    code,
+    message: sanitizedMessage,
+    toolName
+  });
+}
+function getSanitizedMessage(code, toolName, rawMessage) {
+  switch (code) {
+    case TOOL_CALL_ERROR_CODES.NOT_FOUND:
+      return `Tool "${toolName}" was not found`;
+    case TOOL_CALL_ERROR_CODES.VALIDATION:
+      return rawMessage ? sanitizeValidationMessage(rawMessage) : `Input validation failed for tool "${toolName}"`;
+    case TOOL_CALL_ERROR_CODES.EXECUTION:
+      return `Tool "${toolName}" execution failed`;
+    case TOOL_CALL_ERROR_CODES.TIMEOUT:
+      return `Tool "${toolName}" execution timed out`;
+    case TOOL_CALL_ERROR_CODES.ACCESS_DENIED:
+      return `Access denied for tool "${toolName}"`;
+    case TOOL_CALL_ERROR_CODES.SELF_REFERENCE:
+      return `Cannot call CodeCall tools from within AgentScript`;
+    default:
+      return `An error occurred while calling "${toolName}"`;
+  }
+}
+function sanitizeValidationMessage(message) {
+  let sanitized = toClientErrorMessage(message);
+  sanitized = sanitized.replace(/\bat line \d+/gi, "");
+  sanitized = sanitized.replace(/\bline \d+/gi, "");
+  sanitized = sanitized.replace(/:\d+:\d+/g, "");
+  if (sanitized.length > 200) {
+    sanitized = sanitized.substring(0, 200) + "...";
+  }
+  return sanitized.trim();
+}
+var SelfReferenceError = class extends Error {
+  code = TOOL_CALL_ERROR_CODES.SELF_REFERENCE;
+  toolName;
+  constructor(toolName) {
+    super(`Self-reference attack: Attempted to call CodeCall tool "${toolName}" from within AgentScript`);
+    this.name = "SelfReferenceError";
+    this.toolName = toolName;
+    Object.freeze(this);
+  }
+};
+
+// plugins/plugin-codecall/src/security/self-reference-guard.ts
+var CODECALL_TOOL_PREFIX = "codecall:";
+var BLOCKED_CODECALL_TOOLS = Object.freeze(
+  /* @__PURE__ */ new Set(["codecall:search", "codecall:describe", "codecall:execute", "codecall:invoke"])
+);
+function isBlockedSelfReference(toolName) {
+  const normalizedName = toolName.toLowerCase().trim();
+  if (normalizedName.startsWith(CODECALL_TOOL_PREFIX)) {
+    return true;
+  }
+  if (BLOCKED_CODECALL_TOOLS.has(toolName)) {
+    return true;
+  }
+  return false;
+}
+function assertNotSelfReference(toolName) {
+  if (isBlockedSelfReference(toolName)) {
+    throw new SelfReferenceError(toolName);
+  }
+}
+
 // plugins/plugin-codecall/src/services/audit-logger.service.ts
+var import_sdk3 = require("@frontmcp/sdk");
 var AUDIT_EVENT_TYPES = {
   /** Script execution started */
   EXECUTION_START: "codecall:execution:start",
@@ -664,256 +920,88 @@ var AuditLoggerService = class {
       durationMs,
       data: {
         queryLength: query.length,
-        resultCount
-      }
-    });
-  }
-  /**
-   * Log describe operation.
-   */
-  logDescribe(executionId, toolNames, durationMs) {
-    this.emit({
-      type: AUDIT_EVENT_TYPES.DESCRIBE_PERFORMED,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      executionId,
-      durationMs,
-      data: {
-        toolCount: toolNames.length,
-        toolNames: toolNames.slice(0, 10)
-        // Limit to first 10 for audit
-      }
-    });
-  }
-  /**
-   * Log invoke operation.
-   */
-  logInvoke(executionId, toolName, success, durationMs) {
-    this.emit({
-      type: AUDIT_EVENT_TYPES.INVOKE_PERFORMED,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      executionId,
-      durationMs,
-      data: {
-        toolName,
-        success
-      }
-    });
-  }
-  /**
-   * Emit an audit event to all listeners.
-   */
-  emit(event) {
-    const frozenEvent = Object.freeze({ ...event, data: Object.freeze({ ...event.data }) });
-    for (const listener of this.listeners) {
-      try {
-        listener(frozenEvent);
-      } catch {
-      }
-    }
-  }
-  /**
-   * Create a simple hash of the script for identification.
-   * Uses a fast, non-cryptographic hash for performance.
-   */
-  hashScript(script) {
-    let hash = 0;
-    for (let i = 0; i < script.length; i++) {
-      const char = script.charCodeAt(i);
-      hash = (hash << 5) - hash + char;
-      hash = hash & hash;
-    }
-    return `sh_${(hash >>> 0).toString(16).padStart(8, "0")}`;
-  }
-  /**
-   * Sanitize error messages to remove sensitive information.
-   */
-  sanitizeError(error) {
-    if (!error) return "Unknown error";
-    let sanitized = toClientErrorMessage(error);
-    sanitized = sanitized.replace(/:\d+:\d+/g, "");
-    if (sanitized.length > 200) {
-      sanitized = sanitized.substring(0, 200) + "...";
-    }
-    return sanitized.trim();
-  }
-};
-AuditLoggerService = __decorateClass([
-  (0, import_sdk2.Provider)({
-    name: "codecall:audit-logger",
-    scope: import_sdk2.ProviderScope.GLOBAL
-  })
-], AuditLoggerService);
-
-// plugins/plugin-codecall/src/services/tool-search.service.ts
-var import_vectoriadb = require("vectoriadb");
-
-// plugins/plugin-codecall/src/security/codecall-tool-policy.ts
-var BLOCKED_NAMESPACE_PATTERNS = Object.freeze([/^system:/, /^internal:/, /^__/]);
-function isOfferedToCaller(availableWhen, surface) {
-  const offered = availableWhen?.surface;
-  return offered === void 0 || surface === void 0 || offered.includes(surface);
-}
-var ALLOWED = { allowed: true };
-function deny(reason) {
-  return { allowed: false, reason };
-}
-function codeCallAppIdOf(scope, entry) {
-  const lineage = scope?.tools?.lineageOf?.(entry) ?? [];
-  const owners = entry.owner ? [...lineage, entry.owner] : lineage;
-  return owners.find((owner) => owner.kind === "app")?.id;
-}
-function toCodeCallPolicyTool(entry, requestedName, scope) {
-  const { metadata } = entry;
-  return {
-    name: entry.name || entry.fullName,
-    fullName: entry.fullName,
-    aliases: requestedName ? [requestedName] : void 0,
-    appId: codeCallAppIdOf(scope, entry),
-    description: metadata?.description,
-    tags: metadata?.tags,
-    // `internal` tools refuse every external tools/call, CodeCall's included, so no surface may offer them.
-    hidden: metadata?.hideFromDiscovery === true || metadata?.visibility === "hidden" || metadata?.visibility === "internal",
-    codecall: metadata?.codecall,
-    annotations: metadata?.annotations,
-    metadata
-  };
-}
-function isPlainData(value) {
-  if (Array.isArray(value)) return true;
-  const proto = Object.getPrototypeOf(value);
-  return proto === Object.prototype || proto === null;
-}
-function readOnlyCopy(value, copies) {
-  if (typeof value !== "object" || value === null || !isPlainData(value)) return value;
-  const existing = copies.get(value);
-  if (existing !== void 0) return existing;
-  const copy = Array.isArray(value) ? [] : Object.create(Object.getPrototypeOf(value));
-  copies.set(value, copy);
-  for (const key of Reflect.ownKeys(value)) {
-    if (!Object.prototype.propertyIsEnumerable.call(value, key)) continue;
-    Object.defineProperty(copy, key, {
-      value: readOnlyCopy(Reflect.get(value, key), copies),
-      enumerable: true,
-      writable: true,
-      configurable: true
-    });
-  }
-  return Object.freeze(copy);
-}
-function toToolFilterInfo(tool) {
-  const copies = /* @__PURE__ */ new WeakMap();
-  const annotations = readOnlyCopy(tool.annotations, copies);
-  const metadata = tool.metadata ? readOnlyCopy({ ...tool.metadata, ...annotations ? { annotations: tool.annotations } : {} }, copies) : void 0;
-  return {
-    name: tool.name,
-    fullName: tool.fullName,
-    appId: tool.appId,
-    source: tool.codecall?.source,
-    description: tool.description,
-    tags: readOnlyCopy(tool.codecall?.tags ?? tool.tags, copies),
-    annotations,
-    metadata
-  };
-}
-function ownNamesOf(tool) {
-  return [tool.name, tool.fullName].filter((candidate) => !!candidate);
-}
-function checkCodeCallToolPolicy(tool, config) {
-  const { name } = tool;
-  const spellings = [...ownNamesOf(tool), ...tool.aliases ?? []];
-  if (spellings.some((candidate) => candidate.startsWith("codecall:"))) {
-    return deny("CodeCall meta-tools are not callable from CodeCall");
-  }
-  for (const candidate of spellings) {
-    if (BLOCKED_NAMESPACE_PATTERNS.some((pattern) => pattern.test(candidate))) {
-      return deny(`Tool "${candidate}" is in a namespace CodeCall never calls`);
-    }
-  }
-  if (tool.hidden === true) {
-    return deny(`Tool "${name}" is hidden from discovery`);
-  }
-  const enabled = tool.codecall?.enabledInCodeCall;
-  switch (config.mode) {
-    case "codecall_only":
-    case "metadata_driven":
-      if (enabled === false) {
-        return deny(`Tool "${name}" sets enabledInCodeCall: false`);
-      }
-      break;
-    case "codecall_opt_in":
-      if (enabled !== true) {
-        return deny(`Tool "${name}" has not opted in to CodeCall`);
+        resultCount
       }
-      break;
-    default:
-      return deny(`Unknown CodeCall mode: ${String(config.mode)}`);
-  }
-  if (config.includeTools && !config.includeTools(toToolFilterInfo(tool))) {
-    return deny(`Tool "${name}" is excluded by the includeTools filter`);
-  }
-  return ALLOWED;
-}
-function denyUnknownTool(name) {
-  return deny(`Tool "${name}" is not available through CodeCall`);
-}
-function resolveCodeCallTool(scope, name) {
-  const typedScope = scope;
-  const alias = /[-_]/.test(name) ? name.includes("_") ? name.replace(/_/g, "-") : name.replace(/-/g, "_") : void 0;
-  const candidates = alias ? [name, alias] : [name];
-  const matches = (entry) => candidates.includes(entry.fullName) || candidates.includes(entry.name);
-  const local = typedScope.tools?.getTools(true)?.find(matches);
-  if (local) return local;
-  const registries = typedScope.providers?.getRegistries?.("AppRegistry") ?? [];
-  for (const registry of registries) {
-    for (const app of registry.getApps()) {
-      if (!app.isRemote) continue;
-      const remote = app.tools.getTools(true).find(matches);
-      if (remote) return remote;
-    }
+    });
   }
-  return void 0;
-}
-function checkDirectCallPolicy(tool, directCalls) {
-  if (!directCalls) return ALLOWED;
-  if (directCalls.enabled === false) {
-    return deny("Direct tool invocation is disabled");
+  /**
+   * Log describe operation.
+   */
+  logDescribe(executionId, toolNames, durationMs) {
+    this.emit({
+      type: AUDIT_EVENT_TYPES.DESCRIBE_PERFORMED,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      executionId,
+      durationMs,
+      data: {
+        toolCount: toolNames.length,
+        toolNames: toolNames.slice(0, 10)
+        // Limit to first 10 for audit
+      }
+    });
   }
-  const { allowedTools } = directCalls;
-  if (allowedTools && !ownNamesOf(tool).some((ownName) => allowedTools.includes(ownName))) {
-    return deny(`Tool "${tool.name}" is not in the direct-call allowlist`);
+  /**
+   * Log invoke operation.
+   */
+  logInvoke(executionId, toolName, success, durationMs) {
+    this.emit({
+      type: AUDIT_EVENT_TYPES.INVOKE_PERFORMED,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      executionId,
+      durationMs,
+      data: {
+        toolName,
+        success
+      }
+    });
   }
-  if (directCalls.filter && !directCalls.filter(toToolFilterInfo(tool))) {
-    return deny(`Tool "${tool.name}" is excluded by the directCalls filter`);
+  /**
+   * Emit an audit event to all listeners.
+   */
+  emit(event) {
+    const frozenEvent = Object.freeze({ ...event, data: Object.freeze({ ...event.data }) });
+    for (const listener of this.listeners) {
+      try {
+        listener(frozenEvent);
+      } catch {
+      }
+    }
   }
-  return ALLOWED;
-}
-function readCodeCallPolicyConfig(config) {
-  return {
-    // An absent mode means an unparsed/partial config, not a hostile one: fall back to the
-    // schema's own documented default rather than denying every call. An unrecognised mode
-    // still fails closed inside the policy's switch.
-    mode: config.get("mode") ?? "codecall_only",
-    includeTools: config.get("includeTools")
-  };
-}
-function checkCodeCallToolAccess(scope, config, name, options = {}) {
-  const entry = resolveCodeCallTool(scope, name);
-  if (!entry) return denyUnknownTool(name);
-  if (!isOfferedToCaller(entry.metadata?.availableWhen, options.surface)) {
-    return deny(`Tool "${name}" is not offered on the caller's surface "${options.surface}"`);
+  /**
+   * Create a simple hash of the script for identification.
+   * Uses a fast, non-cryptographic hash for performance.
+   */
+  hashScript(script) {
+    let hash = 0;
+    for (let i = 0; i < script.length; i++) {
+      const char = script.charCodeAt(i);
+      hash = (hash << 5) - hash + char;
+      hash = hash & hash;
+    }
+    return `sh_${(hash >>> 0).toString(16).padStart(8, "0")}`;
   }
-  const policyTool = toCodeCallPolicyTool(entry, name, scope);
-  const baseDecision = checkCodeCallToolPolicy(policyTool, readCodeCallPolicyConfig(config));
-  if (!baseDecision.allowed) return baseDecision;
-  if (options.directCall) {
-    const directDecision = checkDirectCallPolicy(
-      policyTool,
-      config.get("directCalls")
-    );
-    if (!directDecision.allowed) return directDecision;
+  /**
+   * Sanitize error messages to remove sensitive information.
+   */
+  sanitizeError(error) {
+    if (!error) return "Unknown error";
+    let sanitized = toClientErrorMessage(error);
+    sanitized = sanitized.replace(/:\d+:\d+/g, "");
+    if (sanitized.length > 200) {
+      sanitized = sanitized.substring(0, 200) + "...";
+    }
+    return sanitized.trim();
   }
-  return { allowed: true, entry };
-}
+};
+AuditLoggerService = __decorateClass([
+  (0, import_sdk3.Provider)({
+    name: "codecall:audit-logger",
+    scope: import_sdk3.ProviderScope.GLOBAL
+  })
+], AuditLoggerService);
+
+// plugins/plugin-codecall/src/services/tool-search.service.ts
+var import_vectoriadb = require("vectoriadb");
 
 // plugins/plugin-codecall/src/services/synonym-expansion.service.ts
 var DEFAULT_SYNONYM_GROUPS = [
@@ -1773,7 +1861,7 @@ var ToolSearchService = class _ToolSearchService {
 
 // plugins/plugin-codecall/src/services/enclave.service.ts
 var import_core = require("@enclave-vm/core");
-var import_sdk3 = require("@frontmcp/sdk");
+var import_sdk4 = require("@frontmcp/sdk");
 
 // plugins/plugin-codecall/src/utils/build-tool-namespaces.ts
 var IDENT_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
@@ -2224,10 +2312,10 @@ var EnclaveService = class {
   }
 };
 EnclaveService = __decorateClass([
-  (0, import_sdk3.Provider)({
+  (0, import_sdk4.Provider)({
     name: "codecall:enclave",
     description: "Executes AgentScript code in a secure enclave",
-    scope: import_sdk3.ProviderScope.GLOBAL
+    scope: import_sdk4.ProviderScope.GLOBAL
   })
 ], EnclaveService);
 function createEnclave(options) {
@@ -2242,7 +2330,7 @@ function createEnclave(options) {
 }
 
 // plugins/plugin-codecall/src/tools/search.tool.ts
-var import_sdk4 = require("@frontmcp/sdk");
+var import_sdk5 = require("@frontmcp/sdk");
 
 // plugins/plugin-codecall/src/tools/search.schema.ts
 var import_lazy_zod2 = require("@frontmcp/lazy-zod");
@@ -2292,7 +2380,7 @@ var searchToolOutputSchema = import_lazy_zod2.z.object({
 });
 
 // plugins/plugin-codecall/src/tools/search.tool.ts
-var SearchTool = class extends import_sdk4.ToolContext {
+var SearchTool = class extends import_sdk5.ToolContext {
   async execute(input) {
     const { queries, appIds, excludeToolNames = [], topK = 5, minRelevanceScore = 0.3 } = input;
     const searchService = this.get(ToolSearchService);
@@ -2300,7 +2388,7 @@ var SearchTool = class extends import_sdk4.ToolContext {
     const audit = this.tryGet(AuditLoggerService);
     const executionId = audit ? audit.generateExecutionId() : "";
     const startedAt = Date.now();
-    const surface = (0, import_sdk4.getCallSurface)();
+    const surface = (0, import_sdk5.getCallSurface)();
     const nonExistentExcludedTools = excludeToolNames.filter(
       (toolName) => !searchService.hasTool(toolName, surface)
     );
@@ -2368,7 +2456,7 @@ var SearchTool = class extends import_sdk4.ToolContext {
   }
 };
 SearchTool = __decorateClass([
-  (0, import_sdk4.Tool)({
+  (0, import_sdk5.Tool)({
     name: "codecall:search",
     cache: {
       ttl: 60,
@@ -2390,7 +2478,7 @@ SearchTool = __decorateClass([
 ], SearchTool);
 
 // plugins/plugin-codecall/src/tools/search-skills.tool.ts
-var import_sdk5 = require("@frontmcp/sdk");
+var import_sdk6 = require("@frontmcp/sdk");
 
 // plugins/plugin-codecall/src/tools/search-skills.schema.ts
 var import_lazy_zod3 = require("@frontmcp/lazy-zod");
@@ -2447,11 +2535,11 @@ var searchSkillsToolOutputSchema = import_lazy_zod3.z.object({
 });
 
 // plugins/plugin-codecall/src/tools/search-skills.tool.ts
-var SearchSkillsTool = class extends import_sdk5.ToolContext {
+var SearchSkillsTool = class extends import_sdk6.ToolContext {
   async execute(input) {
     const { queries, tags, excludeSkillNames = [], topK = 5, minRelevanceScore = 0.1 } = input;
     const skillRegistry = this.scope.skills;
-    const executableSkills = await (0, import_sdk5.filterServableSkills)(this.scope, skillRegistry.getExecutableSkills());
+    const executableSkills = await (0, import_sdk6.filterServableSkills)(this.scope, skillRegistry.getExecutableSkills());
     const executableSet = new Set(executableSkills.map((s) => s.name));
     const totalExecutableSkills = executableSkills.length;
     const warnings = [];
@@ -2521,7 +2609,7 @@ var SearchSkillsTool = class extends import_sdk5.ToolContext {
   }
 };
 SearchSkillsTool = __decorateClass([
-  (0, import_sdk5.Tool)({
+  (0, import_sdk6.Tool)({
     name: "codecall:searchSkills",
     cache: {
       ttl: 60,
@@ -2542,7 +2630,7 @@ SearchSkillsTool = __decorateClass([
 ], SearchSkillsTool);
 
 // plugins/plugin-codecall/src/tools/search-knowledge.tool.ts
-var import_sdk6 = require("@frontmcp/sdk");
+var import_sdk7 = require("@frontmcp/sdk");
 
 // plugins/plugin-codecall/src/tools/search-knowledge.schema.ts
 var import_lazy_zod4 = require("@frontmcp/lazy-zod");
@@ -2588,11 +2676,11 @@ var searchKnowledgeToolOutputSchema = import_lazy_zod4.z.object({
 });
 
 // plugins/plugin-codecall/src/tools/search-knowledge.tool.ts
-var SearchKnowledgeTool = class extends import_sdk6.ToolContext {
+var SearchKnowledgeTool = class extends import_sdk7.ToolContext {
   async execute(input) {
     const { queries, tags, excludeSkillNames = [], topK = 5, minRelevanceScore = 0.1 } = input;
     const skillRegistry = this.scope.skills;
-    const knowledgeSkills = await (0, import_sdk6.filterServableSkills)(this.scope, skillRegistry.getKnowledgeOnlySkills());
+    const knowledgeSkills = await (0, import_sdk7.filterServableSkills)(this.scope, skillRegistry.getKnowledgeOnlySkills());
     const knowledgeSet = new Set(knowledgeSkills.map((s) => s.name));
     const totalKnowledgeSkills = knowledgeSkills.length;
     const warnings = [];
@@ -2654,7 +2742,7 @@ var SearchKnowledgeTool = class extends import_sdk6.ToolContext {
   }
 };
 SearchKnowledgeTool = __decorateClass([
-  (0, import_sdk6.Tool)({
+  (0, import_sdk7.Tool)({
     name: "codecall:searchKnowledge",
     cache: {
       ttl: 60,
@@ -2676,84 +2764,7 @@ SearchKnowledgeTool = __decorateClass([
 
 // plugins/plugin-codecall/src/tools/describe.tool.ts
 var import_lazy_zod6 = require("@frontmcp/lazy-zod");
-var import_sdk7 = require("@frontmcp/sdk");
-
-// plugins/plugin-codecall/src/errors/tool-call.errors.ts
-var TOOL_CALL_ERROR_CODES = {
-  NOT_FOUND: "NOT_FOUND",
-  VALIDATION: "VALIDATION",
-  EXECUTION: "EXECUTION",
-  TIMEOUT: "TIMEOUT",
-  ACCESS_DENIED: "ACCESS_DENIED",
-  SELF_REFERENCE: "SELF_REFERENCE"
-};
-function createToolCallError(code, toolName, rawMessage) {
-  const sanitizedMessage = getSanitizedMessage(code, toolName, rawMessage);
-  return Object.freeze({
-    code,
-    message: sanitizedMessage,
-    toolName
-  });
-}
-function getSanitizedMessage(code, toolName, rawMessage) {
-  switch (code) {
-    case TOOL_CALL_ERROR_CODES.NOT_FOUND:
-      return `Tool "${toolName}" was not found`;
-    case TOOL_CALL_ERROR_CODES.VALIDATION:
-      return rawMessage ? sanitizeValidationMessage(rawMessage) : `Input validation failed for tool "${toolName}"`;
-    case TOOL_CALL_ERROR_CODES.EXECUTION:
-      return `Tool "${toolName}" execution failed`;
-    case TOOL_CALL_ERROR_CODES.TIMEOUT:
-      return `Tool "${toolName}" execution timed out`;
-    case TOOL_CALL_ERROR_CODES.ACCESS_DENIED:
-      return `Access denied for tool "${toolName}"`;
-    case TOOL_CALL_ERROR_CODES.SELF_REFERENCE:
-      return `Cannot call CodeCall tools from within AgentScript`;
-    default:
-      return `An error occurred while calling "${toolName}"`;
-  }
-}
-function sanitizeValidationMessage(message) {
-  let sanitized = toClientErrorMessage(message);
-  sanitized = sanitized.replace(/\bat line \d+/gi, "");
-  sanitized = sanitized.replace(/\bline \d+/gi, "");
-  sanitized = sanitized.replace(/:\d+:\d+/g, "");
-  if (sanitized.length > 200) {
-    sanitized = sanitized.substring(0, 200) + "...";
-  }
-  return sanitized.trim();
-}
-var SelfReferenceError = class extends Error {
-  code = TOOL_CALL_ERROR_CODES.SELF_REFERENCE;
-  toolName;
-  constructor(toolName) {
-    super(`Self-reference attack: Attempted to call CodeCall tool "${toolName}" from within AgentScript`);
-    this.name = "SelfReferenceError";
-    this.toolName = toolName;
-    Object.freeze(this);
-  }
-};
-
-// plugins/plugin-codecall/src/security/self-reference-guard.ts
-var CODECALL_TOOL_PREFIX = "codecall:";
-var BLOCKED_CODECALL_TOOLS = Object.freeze(
-  /* @__PURE__ */ new Set(["codecall:search", "codecall:describe", "codecall:execute", "codecall:invoke"])
-);
-function isBlockedSelfReference(toolName) {
-  const normalizedName = toolName.toLowerCase().trim();
-  if (normalizedName.startsWith(CODECALL_TOOL_PREFIX)) {
-    return true;
-  }
-  if (BLOCKED_CODECALL_TOOLS.has(toolName)) {
-    return true;
-  }
-  return false;
-}
-function assertNotSelfReference(toolName) {
-  if (isBlockedSelfReference(toolName)) {
-    throw new SelfReferenceError(toolName);
-  }
-}
+var import_sdk8 = require("@frontmcp/sdk");
 
 // plugins/plugin-codecall/src/utils/describe.utils.ts
 var INTENT_PATTERNS = {
@@ -3215,7 +3226,7 @@ var describeToolOutputSchema = import_lazy_zod5.z.object({
 });
 
 // plugins/plugin-codecall/src/tools/describe.tool.ts
-var DescribeTool = class extends import_sdk7.ToolContext {
+var DescribeTool = class extends import_sdk8.ToolContext {
   async execute(input) {
     const { toolNames } = input;
     const audit = this.tryGet(AuditLoggerService);
@@ -3224,7 +3235,7 @@ var DescribeTool = class extends import_sdk7.ToolContext {
     const tools = [];
     const notFound = [];
     const config = this.get(CodeCallConfig);
-    const surface = (0, import_sdk7.getCallSurface)();
+    const surface = (0, import_sdk8.getCallSurface)();
     for (const toolName of toolNames) {
       if (isBlockedSelfReference(toolName)) {
         notFound.push(toolName);
@@ -3368,7 +3379,7 @@ return result;`
   }
 };
 DescribeTool = __decorateClass([
-  (0, import_sdk7.Tool)({
+  (0, import_sdk8.Tool)({
     name: "codecall:describe",
     cache: {
       ttl: 60,
@@ -3390,7 +3401,7 @@ DescribeTool = __decorateClass([
 ], DescribeTool);
 
 // plugins/plugin-codecall/src/tools/execute.tool.ts
-var import_sdk8 = require("@frontmcp/sdk");
+var import_sdk9 = require("@frontmcp/sdk");
 
 // plugins/plugin-codecall/src/tools/execute.schema.ts
 var import_lazy_zod7 = require("@frontmcp/lazy-zod");
@@ -3513,7 +3524,7 @@ function getErrorCode(error) {
   }
   return TOOL_CALL_ERROR_CODES.EXECUTION;
 }
-var ExecuteTool = class extends import_sdk8.ToolContext {
+var ExecuteTool = class extends import_sdk9.ToolContext {
   /**
    * Resolve the server-side CodeCall policy for a tool name (GHSA-6w3j-82v5-6qrr).
    *
@@ -3527,7 +3538,7 @@ var ExecuteTool = class extends import_sdk8.ToolContext {
   }
   async execute(input) {
     const { script, allowedTools } = input;
-    const callerSurface = (0, import_sdk8.getCallSurface)();
+    const callerSurface = (0, import_sdk9.getCallSurface)();
     const audit = this.tryGet(AuditLoggerService);
     const executionId = audit ? audit.generateExecutionId() : "";
     const callDepth = 1;
@@ -3568,10 +3579,10 @@ var ExecuteTool = class extends import_sdk8.ToolContext {
               arguments: toolInput
             }
           };
-          const ctx = {
+          const ctx = asCodeCallDispatch({
             authInfo: this.authInfo,
             surface: callerSurface
-          };
+          });
           const mcpResult = await this.scope.runFlow("tools:call-tool", { request, ctx });
           if (!mcpResult) {
             audit?.logToolCallFailure(
@@ -3750,7 +3761,7 @@ var ExecuteTool = class extends import_sdk8.ToolContext {
   }
 };
 ExecuteTool = __decorateClass([
-  (0, import_sdk8.Tool)({
+  (0, import_sdk9.Tool)({
     name: "codecall:execute",
     cache: {
       ttl: 0,
@@ -3768,7 +3779,7 @@ ExecuteTool = __decorateClass([
 ], ExecuteTool);
 
 // plugins/plugin-codecall/src/tools/invoke.tool.ts
-var import_sdk9 = require("@frontmcp/sdk");
+var import_sdk10 = require("@frontmcp/sdk");
 
 // plugins/plugin-codecall/src/tools/invoke.schema.ts
 var import_lazy_zod8 = require("@frontmcp/lazy-zod");
@@ -3800,7 +3811,7 @@ function buildErrorResult(message) {
     isError: true
   };
 }
-var InvokeTool = class extends import_sdk9.ToolContext {
+var InvokeTool = class extends import_sdk10.ToolContext {
   async execute(input) {
     const { tool: toolName, input: toolInput } = input;
     const audit = this.tryGet(AuditLoggerService);
@@ -3812,7 +3823,7 @@ var InvokeTool = class extends import_sdk9.ToolContext {
         `Tool "${toolName}" cannot be invoked directly. CodeCall tools are internal and not accessible via codecall:invoke.`
       );
     }
-    const surface = (0, import_sdk9.getCallSurface)();
+    const surface = (0, import_sdk10.getCallSurface)();
     const decision = checkCodeCallToolAccess(this.scope, this.get(CodeCallConfig), toolName, {
       directCall: true,
       surface
@@ -3828,10 +3839,10 @@ var InvokeTool = class extends import_sdk9.ToolContext {
         arguments: toolInput
       }
     };
-    const ctx = {
+    const ctx = asCodeCallDispatch({
       authInfo: this.authInfo,
       surface
-    };
+    });
     const result = await this.scope.runFlow("tools:call-tool", { request, ctx });
     if (!result) {
       audit?.logInvoke(executionId, toolName, false, Date.now() - startedAt);
@@ -3842,7 +3853,7 @@ var InvokeTool = class extends import_sdk9.ToolContext {
   }
 };
 InvokeTool = __decorateClass([
-  (0, import_sdk9.Tool)({
+  (0, import_sdk10.Tool)({
     name: "codecall:invoke",
     cache: {
       ttl: 0,
@@ -3864,12 +3875,16 @@ function auditLogFields(event) {
   const { executionId, durationMs, data } = event;
   return durationMs === void 0 ? { executionId, ...data } : { executionId, durationMs, ...data };
 }
-var CodeCallPlugin = class extends import_sdk10.DynamicPlugin {
+function callContextOf(flowCtx) {
+  const rawInput = flowCtx.rawInput;
+  return typeof rawInput === "object" && rawInput !== null ? rawInput.ctx : void 0;
+}
+var CodeCallPlugin = class extends import_sdk11.DynamicPlugin {
   options;
   cachedLogger;
   getLogger() {
     if (!this.cachedLogger) {
-      this.cachedLogger = this.get(import_sdk10.FrontMcpLogger).child("CodeCall");
+      this.cachedLogger = this.get(import_sdk11.FrontMcpLogger).child("CodeCall");
     }
     return this.cachedLogger;
   }
@@ -3905,7 +3920,7 @@ var CodeCallPlugin = class extends import_sdk10.DynamicPlugin {
         // per-request would grow the listener Set for the life of the process.
         name: "codecall:audit-logger",
         provide: AuditLoggerService,
-        inject: () => [import_sdk10.ScopeEntry],
+        inject: () => [import_sdk11.ScopeEntry],
         useFactory: (scope) => {
           const audit = new AuditLoggerService();
           const logger = scope.logger.child("codecall:audit");
@@ -3916,7 +3931,7 @@ var CodeCallPlugin = class extends import_sdk10.DynamicPlugin {
       {
         name: "codecall:tool-search",
         provide: ToolSearchService,
-        inject: () => [import_sdk10.ScopeEntry],
+        inject: () => [import_sdk11.ScopeEntry],
         useFactory: async (scope) => {
           return new ToolSearchService(
             {
@@ -3939,12 +3954,32 @@ var CodeCallPlugin = class extends import_sdk10.DynamicPlugin {
       logger.verbose("adjustListTools: no tools to filter, returning early");
       return;
     }
-    const filteredTools = resolvedTools.filter(({ tool }) => {
-      return this.shouldShowInListTools(tool, this.options.mode);
-    });
+    const scope = this.tryGetScope();
+    const filteredTools = resolvedTools.filter(
+      ({ tool }) => !this.judges(scope, { tool }) || this.shouldShowInListTools(tool, this.options.mode)
+    );
     logger.verbose("adjustListTools: tools after filter", { count: filteredTools.length });
     flowCtx.state.set("resolvedTools", filteredTools);
   }
+  async refuseDirectCallOfHiddenTool(flowCtx) {
+    const { tool } = flowCtx.state;
+    if (!tool || tool.owner?.kind === "scope") return;
+    if (this.shouldShowInListTools(tool, this.options.mode)) return;
+    if (isInProcessDispatch(callContextOf(flowCtx))) return;
+    this.getLogger().verbose("refused a direct tools/call of a tool CodeCall hides", { tool: tool.fullName });
+    throw new import_sdk11.ToolNotFoundError(flowCtx.state.input?.name ?? tool.name);
+  }
+  /** Whether this instance's direct-call gate runs for the tool, so the listing hides only what that gate refuses. */
+  judges(scope, entry) {
+    return !scope?.hooks || (0, import_sdk11.isEntryGatedBy)(scope, entry, this);
+  }
+  tryGetScope() {
+    try {
+      return this.get(import_sdk11.ScopeEntry);
+    } catch {
+      return void 0;
+    }
+  }
   /**
    * Determine if a tool should be visible in list_tools based on mode.
    *
@@ -3998,10 +4033,13 @@ var CodeCallPlugin = class extends import_sdk10.DynamicPlugin {
   }
 };
 __decorateClass([
-  import_sdk10.ListToolsHook.Did("resolveConflicts", { priority: 1e3 })
+  import_sdk11.ListToolsHook.Did("resolveConflicts", { priority: 1e3 })
 ], CodeCallPlugin.prototype, "adjustListTools", 1);
+__decorateClass([
+  import_sdk11.ToolHook.Did("findTool", { priority: 10, appliesTo: "uncovered-apps" })
+], CodeCallPlugin.prototype, "refuseDirectCallOfHiddenTool", 1);
 CodeCallPlugin = __decorateClass([
-  (0, import_sdk10.Plugin)({
+  (0, import_sdk11.Plugin)({
     name: "codecall",
     description: "CodeCall plugin: AgentScript-based meta-tools for orchestrating MCP tools",
     providers: [],