@frontmcp/plugin-feature-flags 1.7.2 → 1.8.0

package/adapters/feature-flag-adapter.interface.d.ts

@@ -10,7 +10,17 @@ export interface FeatureFlagAdapter {
     isEnabled(flagKey: string, context: FeatureFlagContext): Promise<boolean>;
     /** Get the variant for a flag (for multi-variate flags). */
     getVariant(flagKey: string, context: FeatureFlagContext): Promise<FeatureFlagVariant>;
-    /** Batch evaluate multiple flags at once. */
+    /**
+     * Batch evaluate multiple flags at once.
+     *
+     * An adapter MAY omit a key it has no opinion on — a flag it has never heard of. An absent
+     * key means "unknown", and the caller applies the ref's `defaultValue`; a key present with
+     * `false` means the flag is genuinely disabled and `defaultValue` does NOT apply. Conflating
+     * the two makes `defaultValue` dead code and makes listing disagree with the execution gate.
+     *
+     * Adapters backed by a remote service (Split.io, LaunchDarkly, Unleash) always have an
+     * opinion, because the service applies its own default — they answer for every key.
+     */
     evaluateFlags(flagKeys: string[], context: FeatureFlagContext): Promise<Map<string, boolean>>;
     /** Destroy the adapter (disconnect, cleanup). */
     destroy(): Promise<void>;

package/adapters/feature-flag-adapter.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"feature-flag-adapter.interface.d.ts","sourceRoot":"","sources":["../../src/adapters/feature-flag-adapter.interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEpF;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B,wDAAwD;IACxD,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1E,4DAA4D;IAC5D,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEtF,6CAA6C;IAC7C,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAE9F,iDAAiD;IACjD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B"}
+{"version":3,"file":"feature-flag-adapter.interface.d.ts","sourceRoot":"","sources":["../../src/adapters/feature-flag-adapter.interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEpF;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B,wDAAwD;IACxD,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1E,4DAA4D;IAC5D,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEtF;;;;;;;;;;OAUG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAE9F,iDAAiD;IACjD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B"}

package/adapters/static.adapter.d.ts

@@ -1,5 +1,5 @@
-import type { FeatureFlagAdapter } from './feature-flag-adapter.interface';
 import type { FeatureFlagContext, FeatureFlagVariant } from '../feature-flag.types';
+import type { FeatureFlagAdapter } from './feature-flag-adapter.interface';
 /**
  * Static/in-memory feature flag adapter.
  * Flags are defined at construction time and don't change.
@@ -10,6 +10,11 @@ export declare class StaticFeatureFlagAdapter implements FeatureFlagAdapter {
     initialize(): Promise<void>;
     isEnabled(flagKey: string, _context: FeatureFlagContext): Promise<boolean>;
     getVariant(flagKey: string, _context: FeatureFlagContext): Promise<FeatureFlagVariant>;
+    /**
+     * A key this adapter has never been configured with is OMITTED rather than reported as
+     * `false`. Only then can the caller tell "the operator disabled it" from "nobody configured
+     * it" and apply the ref's `defaultValue` to the second case only.
+     */
     evaluateFlags(flagKeys: string[], context: FeatureFlagContext): Promise<Map<string, boolean>>;
     destroy(): Promise<void>;
 }

package/adapters/static.adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"static.adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/static.adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEpF;;;GAGG;AACH,qBAAa,wBAAyB,YAAW,kBAAkB;IACjE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+C;gBAEzD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,kBAAkB,CAAC;IAIzD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3B,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAO1E,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAWtF,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQ7F,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAG/B"}
+{"version":3,"file":"static.adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/static.adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAE3E;;;GAGG;AACH,qBAAa,wBAAyB,YAAW,kBAAkB;IACjE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+C;gBAEzD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,kBAAkB,CAAC;IAIzD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3B,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAO1E,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAW5F;;;;OAIG;IACG,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAS7F,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAG/B"}

package/esm/index.mjs

@@ -246,24 +246,14 @@ import {
   DynamicPlugin,
   FlowHooksOf,
   FRONTMCP_CONTEXT,
-  ListToolsHook,
+  FrontMcpContextStorage,
   ListResourcesHook,
+  ListToolsHook,
   Plugin,
   ProviderScope as ProviderScope2,
   ToolHook
 } from "@frontmcp/sdk";
 
-// plugins/plugin-feature-flags/src/feature-flag.symbols.ts
-var FeatureFlagAdapterToken = /* @__PURE__ */ Symbol(
-  "plugin:feature-flags:adapter"
-);
-var FeatureFlagConfigToken = /* @__PURE__ */ Symbol(
-  "plugin:feature-flags:config"
-);
-var FeatureFlagAccessorToken = /* @__PURE__ */ Symbol(
-  "plugin:feature-flags:accessor"
-);
-
 // plugins/plugin-feature-flags/src/adapters/static.adapter.ts
 var StaticFeatureFlagAdapter = class {
   flags;
@@ -288,9 +278,15 @@ var StaticFeatureFlagAdapter = class {
     }
     return { ...flag };
   }
+  /**
+   * A key this adapter has never been configured with is OMITTED rather than reported as
+   * `false`. Only then can the caller tell "the operator disabled it" from "nobody configured
+   * it" and apply the ref's `defaultValue` to the second case only.
+   */
   async evaluateFlags(flagKeys, context) {
     const results = /* @__PURE__ */ new Map();
     for (const key of flagKeys) {
+      if (this.flags[key] === void 0) continue;
       results.set(key, await this.isEnabled(key, context));
     }
     return results;
@@ -299,6 +295,28 @@ var StaticFeatureFlagAdapter = class {
   }
 };
 
+// plugins/plugin-feature-flags/src/feature-flag.context.ts
+function buildFeatureFlagContext(ctx, config) {
+  if (!ctx) return {};
+  const userId = config.userIdResolver ? config.userIdResolver(ctx) : ctx.authInfo?.extra?.["sub"] ?? ctx.authInfo?.extra?.["userId"] ?? ctx.authInfo?.clientId;
+  return {
+    userId: userId ?? void 0,
+    sessionId: ctx.sessionId,
+    attributes: config.attributesResolver ? config.attributesResolver(ctx) : {}
+  };
+}
+
+// plugins/plugin-feature-flags/src/feature-flag.symbols.ts
+var FeatureFlagAdapterToken = /* @__PURE__ */ Symbol(
+  "plugin:feature-flags:adapter"
+);
+var FeatureFlagConfigToken = /* @__PURE__ */ Symbol(
+  "plugin:feature-flags:config"
+);
+var FeatureFlagAccessorToken = /* @__PURE__ */ Symbol(
+  "plugin:feature-flags:accessor"
+);
+
 // plugins/plugin-feature-flags/src/providers/feature-flag-accessor.provider.ts
 import { Provider, ProviderScope } from "@frontmcp/sdk";
 var FeatureFlagAccessor = class {
@@ -362,13 +380,7 @@ var FeatureFlagAccessor = class {
    * Build the FeatureFlagContext from the current FrontMcpContext.
    */
   buildContext() {
-    const userId = this.config.userIdResolver ? this.config.userIdResolver(this.ctx) : this.ctx.authInfo?.extra?.["sub"] ?? this.ctx.authInfo?.extra?.["userId"] ?? this.ctx.authInfo?.clientId;
-    const attributes = this.config.attributesResolver ? this.config.attributesResolver(this.ctx) : {};
-    return {
-      userId: userId ?? void 0,
-      sessionId: this.ctx.sessionId,
-      attributes
-    };
+    return buildFeatureFlagContext(this.ctx, this.config);
   }
 };
 FeatureFlagAccessor = __decorateClass([
@@ -385,6 +397,8 @@ function createFeatureFlagAccessor(adapter, ctx, config) {
 // plugins/plugin-feature-flags/src/feature-flag.plugin.ts
 var ListPromptsHook = FlowHooksOf("prompts:list-prompts");
 var SearchSkillsHook = FlowHooksOf("skills:search");
+var ReadResourceHook = FlowHooksOf("resources:read-resource");
+var GetPromptHook = FlowHooksOf("prompts:get-prompt");
 var FeatureFlagPlugin = class extends DynamicPlugin {
   options;
   constructor(options) {
@@ -448,21 +462,37 @@ var FeatureFlagPlugin = class extends DynamicPlugin {
     flowCtx.state.set("results", filtered);
   }
   async gateToolExecution(flowCtx) {
-    const { tool } = flowCtx.state;
-    if (!tool) return;
-    const ref = tool.metadata?.featureFlag;
+    await this.gateEntryExecution("Tool", flowCtx.state.tool);
+  }
+  async gateResourceRead(flowCtx) {
+    await this.gateEntryExecution("Resource", flowCtx.state.resource);
+  }
+  async gatePromptGet(flowCtx) {
+    await this.gateEntryExecution("Prompt", flowCtx.state.prompt);
+  }
+  /**
+   * Shared execution gate for tools, resources and prompts.
+   *
+   * One implementation on purpose: the advisory existed because the tool path had a gate and
+   * the other two did not, and three copies would drift apart the same way.
+   */
+  async gateEntryExecution(kind, entry) {
+    if (!entry) return;
+    const metadata = entry.metadata;
+    const ref = metadata?.featureFlag;
     if (!ref) return;
-    const adapter = this.get(FeatureFlagAdapterToken);
     const key = typeof ref === "string" ? ref : ref.key;
     const defaultValue = typeof ref === "object" ? ref.defaultValue ?? false : false;
     let enabled;
     try {
-      enabled = await adapter.isEnabled(key, {});
+      const adapter = this.get(FeatureFlagAdapterToken);
+      const results = await adapter.evaluateFlags([key], this.currentFlagContext());
+      enabled = this.isRefEnabled(ref, results);
     } catch {
       enabled = defaultValue;
     }
     if (!enabled) {
-      throw new Error(`Tool "${tool.metadata.name}" is disabled by feature flag "${key}"`);
+      throw new Error(`${kind} "${metadata?.name}" is disabled by feature flag "${key}"`);
     }
   }
   // ─────────────────────────────────────────────────────────────────────────
@@ -489,7 +519,24 @@ var FeatureFlagPlugin = class extends DynamicPlugin {
    */
   async batchEvaluateRefs(adapter, refs) {
     const keys = Array.from(refs.keys());
-    return adapter.evaluateFlags(keys, {});
+    return adapter.evaluateFlags(keys, this.currentFlagContext());
+  }
+  /**
+   * The caller's evaluation context.
+   *
+   * Passing `{}` here asked the adapter "is this flag on for nobody in particular", which a
+   * targeted adapter can answer differently from "is it on for THIS caller" — enabling access
+   * the caller should not have. The context comes from the same `FrontMcpContext` the
+   * context-scoped accessor reads, so hooks and `this.featureFlags` agree.
+   */
+  currentFlagContext() {
+    try {
+      const ctx = this.get(FrontMcpContextStorage)?.getStore();
+      if (!ctx) return {};
+      return buildFeatureFlagContext(ctx, this.options);
+    } catch {
+      return {};
+    }
   }
   /**
    * Determine if a feature flag ref is enabled given adapter results.
@@ -498,9 +545,8 @@ var FeatureFlagPlugin = class extends DynamicPlugin {
    */
   isRefEnabled(ref, flagResults) {
     const key = typeof ref === "string" ? ref : ref.key;
-    const adapterResult = flagResults.get(key);
     const defaultValue = typeof ref === "object" ? ref.defaultValue ?? false : false;
-    if (adapterResult === true) return true;
+    if (flagResults.has(key)) return flagResults.get(key) === true;
     return defaultValue;
   }
 };
@@ -593,6 +639,12 @@ __decorateClass([
 __decorateClass([
   ToolHook.Will("execute", { priority: 50 })
 ], FeatureFlagPlugin.prototype, "gateToolExecution", 1);
+__decorateClass([
+  ReadResourceHook.Will("execute", { priority: 50 })
+], FeatureFlagPlugin.prototype, "gateResourceRead", 1);
+__decorateClass([
+  GetPromptHook.Will("execute", { priority: 50 })
+], FeatureFlagPlugin.prototype, "gatePromptGet", 1);
 FeatureFlagPlugin = __decorateClass([
   Plugin({
     name: "feature-flags",

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-feature-flags",
-  "version": "1.7.2",
+  "version": "1.8.0",
   "description": "Feature flag plugin for FrontMCP - dynamically gate MCP capabilities behind feature flags",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -49,7 +49,7 @@
     }
   },
   "dependencies": {
-    "@frontmcp/sdk": "1.7.2"
+    "@frontmcp/sdk": "1.8.0"
   },
   "peerDependencies": {
     "@launchdarkly/node-server-sdk": "^9.0.0 || ^10.0.0",

package/feature-flag.context.d.ts

@@ -0,0 +1,12 @@
+import type { FrontMcpContext } from '@frontmcp/sdk';
+import type { FeatureFlagContext, FeatureFlagPluginOptions } from './feature-flag.types';
+/**
+ * Build the adapter evaluation context for the current caller.
+ *
+ * Shared by the context-scoped accessor and by the plugin's list/gate hooks. Those hooks used
+ * to pass `{}`, which asks a targeted adapter "is this flag on for nobody in particular" — a
+ * question it can answer differently from "is it on for THIS caller", letting a gate allow
+ * access the caller should not have.
+ */
+export declare function buildFeatureFlagContext(ctx: FrontMcpContext | undefined, config: Pick<FeatureFlagPluginOptions, 'userIdResolver' | 'attributesResolver'>): FeatureFlagContext;
+//# sourceMappingURL=feature-flag.context.d.ts.map

package/feature-flag.context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"feature-flag.context.d.ts","sourceRoot":"","sources":["../src/feature-flag.context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEzF;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,eAAe,GAAG,SAAS,EAChC,MAAM,EAAE,IAAI,CAAC,wBAAwB,EAAE,gBAAgB,GAAG,oBAAoB,CAAC,GAC9E,kBAAkB,CAcpB"}

package/feature-flag.plugin.d.ts

@@ -49,6 +49,28 @@ export default class FeatureFlagPlugin extends DynamicPlugin<FeatureFlagPluginOp
      * This prevents bypassing the list filter via direct tool invocation.
      */
     gateToolExecution(flowCtx: FlowCtxOf<'tools:call-tool'>): Promise<void>;
+    /**
+     * Execution gate: block resources/read when the resource's feature flag is off.
+     *
+     * GHSA-gf7p-j3hr-h5h4: only tools had this gate, so a flagged resource was merely absent
+     * from resources/list and still readable by URI. Hiding a capability from a listing is not
+     * the same as withholding it — clients cache listings and hold URIs from earlier sessions.
+     */
+    gateResourceRead(flowCtx: any): Promise<void>;
+    /**
+     * Execution gate: block prompts/get when the prompt's feature flag is off.
+     *
+     * The same gap as resources (GHSA-gf7p-j3hr-h5h4): filtering prompts/list left the prompt
+     * retrievable by name.
+     */
+    gatePromptGet(flowCtx: any): Promise<void>;
+    /**
+     * Shared execution gate for tools, resources and prompts.
+     *
+     * One implementation on purpose: the advisory existed because the tool path had a gate and
+     * the other two did not, and three copies would drift apart the same way.
+     */
+    private gateEntryExecution;
     /**
      * Collect unique flag keys from items that have a featureFlag metadata.
      */
@@ -57,6 +79,15 @@ export default class FeatureFlagPlugin extends DynamicPlugin<FeatureFlagPluginOp
      * Batch evaluate all collected flag refs via the adapter.
      */
     private batchEvaluateRefs;
+    /**
+     * The caller's evaluation context.
+     *
+     * Passing `{}` here asked the adapter "is this flag on for nobody in particular", which a
+     * targeted adapter can answer differently from "is it on for THIS caller" — enabling access
+     * the caller should not have. The context comes from the same `FrontMcpContext` the
+     * context-scoped accessor reads, so hooks and `this.featureFlags` agree.
+     */
+    private currentFlagContext;
     /**
      * Determine if a feature flag ref is enabled given adapter results.
      * For object-style refs, `defaultValue` acts as a fallback when the adapter

package/feature-flag.plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"feature-flag.plugin.d.ts","sourceRoot":"","sources":["../src/feature-flag.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,SAAS,EAOT,YAAY,EAEb,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EAAE,wBAAwB,EAAE,6BAA6B,EAAkB,MAAM,sBAAsB,CAAC;AAYpH;;;;;;;;;;;;;;;;;;GAkBG;AAaH,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,aAAa,CAAC,wBAAwB,EAAE,6BAA6B,CAAC;IACnH,OAAO,EAAE,wBAAwB,CAAC;gBAEtB,OAAO,EAAE,6BAA6B;IAKlD;;OAEG;IACH,OAAgB,gBAAgB,GAAI,SAAS,6BAA6B,KAAG,YAAY,EAAE,CA0FzF;IAMF;;;OAGG;IAEG,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,kBAAkB,CAAC;IAmB5D;;OAEG;IAEG,mBAAmB,CAAC,OAAO,EAAE,SAAS,CAAC,0BAA0B,CAAC;IAmBxE;;OAEG;IAEG,iBAAiB,CAAC,OAAO,EAAE,GAAG;IAmBpC;;;OAGG;IAEG,kBAAkB,CAAC,OAAO,EAAE,GAAG;IAmBrC;;;OAGG;IAEG,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,iBAAiB,CAAC;IA2B7D;;OAEG;IACH,OAAO,CAAC,eAAe;IAcvB;;OAEG;YACW,iBAAiB;IAQ/B;;;;OAIG;IACH,OAAO,CAAC,YAAY;CAOrB"}
+{"version":3,"file":"feature-flag.plugin.d.ts","sourceRoot":"","sources":["../src/feature-flag.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,SAAS,EAQT,YAAY,EAEb,MAAM,eAAe,CAAC;AAMvB,OAAO,KAAK,EAEV,wBAAwB,EACxB,6BAA6B,EAE9B,MAAM,sBAAsB,CAAC;AAW9B;;;;;;;;;;;;;;;;;;GAkBG;AAaH,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,aAAa,CAAC,wBAAwB,EAAE,6BAA6B,CAAC;IACnH,OAAO,EAAE,wBAAwB,CAAC;gBAEtB,OAAO,EAAE,6BAA6B;IAKlD;;OAEG;IACH,OAAgB,gBAAgB,GAAI,SAAS,6BAA6B,KAAG,YAAY,EAAE,CA0FzF;IAMF;;;OAGG;IAEG,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,kBAAkB,CAAC;IAmB5D;;OAEG;IAEG,mBAAmB,CAAC,OAAO,EAAE,SAAS,CAAC,0BAA0B,CAAC;IAmBxE;;OAEG;IAEG,iBAAiB,CAAC,OAAO,EAAE,GAAG;IAmBpC;;;OAGG;IAEG,kBAAkB,CAAC,OAAO,EAAE,GAAG;IAmBrC;;;OAGG;IAEG,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,iBAAiB,CAAC;IAI7D;;;;;;OAMG;IAEG,gBAAgB,CAAC,OAAO,EAAE,GAAG;IAInC;;;;;OAKG;IAEG,aAAa,CAAC,OAAO,EAAE,GAAG;IAIhC;;;;;OAKG;YACW,kBAAkB;IA+BhC;;OAEG;IACH,OAAO,CAAC,eAAe;IAcvB;;OAEG;YACW,iBAAiB;IAQ/B;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;IAW1B;;;;OAIG;IACH,OAAO,CAAC,YAAY;CAWrB"}

package/index.js

@@ -257,17 +257,6 @@ module.exports = __toCommonJS(index_exports);
 // plugins/plugin-feature-flags/src/feature-flag.plugin.ts
 var import_sdk2 = require("@frontmcp/sdk");
 
-// plugins/plugin-feature-flags/src/feature-flag.symbols.ts
-var FeatureFlagAdapterToken = /* @__PURE__ */ Symbol(
-  "plugin:feature-flags:adapter"
-);
-var FeatureFlagConfigToken = /* @__PURE__ */ Symbol(
-  "plugin:feature-flags:config"
-);
-var FeatureFlagAccessorToken = /* @__PURE__ */ Symbol(
-  "plugin:feature-flags:accessor"
-);
-
 // plugins/plugin-feature-flags/src/adapters/static.adapter.ts
 var StaticFeatureFlagAdapter = class {
   flags;
@@ -292,9 +281,15 @@ var StaticFeatureFlagAdapter = class {
     }
     return { ...flag };
   }
+  /**
+   * A key this adapter has never been configured with is OMITTED rather than reported as
+   * `false`. Only then can the caller tell "the operator disabled it" from "nobody configured
+   * it" and apply the ref's `defaultValue` to the second case only.
+   */
   async evaluateFlags(flagKeys, context) {
     const results = /* @__PURE__ */ new Map();
     for (const key of flagKeys) {
+      if (this.flags[key] === void 0) continue;
       results.set(key, await this.isEnabled(key, context));
     }
     return results;
@@ -303,6 +298,28 @@ var StaticFeatureFlagAdapter = class {
   }
 };
 
+// plugins/plugin-feature-flags/src/feature-flag.context.ts
+function buildFeatureFlagContext(ctx, config) {
+  if (!ctx) return {};
+  const userId = config.userIdResolver ? config.userIdResolver(ctx) : ctx.authInfo?.extra?.["sub"] ?? ctx.authInfo?.extra?.["userId"] ?? ctx.authInfo?.clientId;
+  return {
+    userId: userId ?? void 0,
+    sessionId: ctx.sessionId,
+    attributes: config.attributesResolver ? config.attributesResolver(ctx) : {}
+  };
+}
+
+// plugins/plugin-feature-flags/src/feature-flag.symbols.ts
+var FeatureFlagAdapterToken = /* @__PURE__ */ Symbol(
+  "plugin:feature-flags:adapter"
+);
+var FeatureFlagConfigToken = /* @__PURE__ */ Symbol(
+  "plugin:feature-flags:config"
+);
+var FeatureFlagAccessorToken = /* @__PURE__ */ Symbol(
+  "plugin:feature-flags:accessor"
+);
+
 // plugins/plugin-feature-flags/src/providers/feature-flag-accessor.provider.ts
 var import_sdk = require("@frontmcp/sdk");
 var FeatureFlagAccessor = class {
@@ -366,13 +383,7 @@ var FeatureFlagAccessor = class {
    * Build the FeatureFlagContext from the current FrontMcpContext.
    */
   buildContext() {
-    const userId = this.config.userIdResolver ? this.config.userIdResolver(this.ctx) : this.ctx.authInfo?.extra?.["sub"] ?? this.ctx.authInfo?.extra?.["userId"] ?? this.ctx.authInfo?.clientId;
-    const attributes = this.config.attributesResolver ? this.config.attributesResolver(this.ctx) : {};
-    return {
-      userId: userId ?? void 0,
-      sessionId: this.ctx.sessionId,
-      attributes
-    };
+    return buildFeatureFlagContext(this.ctx, this.config);
   }
 };
 FeatureFlagAccessor = __decorateClass([
@@ -389,6 +400,8 @@ function createFeatureFlagAccessor(adapter, ctx, config) {
 // plugins/plugin-feature-flags/src/feature-flag.plugin.ts
 var ListPromptsHook = (0, import_sdk2.FlowHooksOf)("prompts:list-prompts");
 var SearchSkillsHook = (0, import_sdk2.FlowHooksOf)("skills:search");
+var ReadResourceHook = (0, import_sdk2.FlowHooksOf)("resources:read-resource");
+var GetPromptHook = (0, import_sdk2.FlowHooksOf)("prompts:get-prompt");
 var FeatureFlagPlugin = class extends import_sdk2.DynamicPlugin {
   options;
   constructor(options) {
@@ -452,21 +465,37 @@ var FeatureFlagPlugin = class extends import_sdk2.DynamicPlugin {
     flowCtx.state.set("results", filtered);
   }
   async gateToolExecution(flowCtx) {
-    const { tool } = flowCtx.state;
-    if (!tool) return;
-    const ref = tool.metadata?.featureFlag;
+    await this.gateEntryExecution("Tool", flowCtx.state.tool);
+  }
+  async gateResourceRead(flowCtx) {
+    await this.gateEntryExecution("Resource", flowCtx.state.resource);
+  }
+  async gatePromptGet(flowCtx) {
+    await this.gateEntryExecution("Prompt", flowCtx.state.prompt);
+  }
+  /**
+   * Shared execution gate for tools, resources and prompts.
+   *
+   * One implementation on purpose: the advisory existed because the tool path had a gate and
+   * the other two did not, and three copies would drift apart the same way.
+   */
+  async gateEntryExecution(kind, entry) {
+    if (!entry) return;
+    const metadata = entry.metadata;
+    const ref = metadata?.featureFlag;
     if (!ref) return;
-    const adapter = this.get(FeatureFlagAdapterToken);
     const key = typeof ref === "string" ? ref : ref.key;
     const defaultValue = typeof ref === "object" ? ref.defaultValue ?? false : false;
     let enabled;
     try {
-      enabled = await adapter.isEnabled(key, {});
+      const adapter = this.get(FeatureFlagAdapterToken);
+      const results = await adapter.evaluateFlags([key], this.currentFlagContext());
+      enabled = this.isRefEnabled(ref, results);
     } catch {
       enabled = defaultValue;
     }
     if (!enabled) {
-      throw new Error(`Tool "${tool.metadata.name}" is disabled by feature flag "${key}"`);
+      throw new Error(`${kind} "${metadata?.name}" is disabled by feature flag "${key}"`);
     }
   }
   // ─────────────────────────────────────────────────────────────────────────
@@ -493,7 +522,24 @@ var FeatureFlagPlugin = class extends import_sdk2.DynamicPlugin {
    */
   async batchEvaluateRefs(adapter, refs) {
     const keys = Array.from(refs.keys());
-    return adapter.evaluateFlags(keys, {});
+    return adapter.evaluateFlags(keys, this.currentFlagContext());
+  }
+  /**
+   * The caller's evaluation context.
+   *
+   * Passing `{}` here asked the adapter "is this flag on for nobody in particular", which a
+   * targeted adapter can answer differently from "is it on for THIS caller" — enabling access
+   * the caller should not have. The context comes from the same `FrontMcpContext` the
+   * context-scoped accessor reads, so hooks and `this.featureFlags` agree.
+   */
+  currentFlagContext() {
+    try {
+      const ctx = this.get(import_sdk2.FrontMcpContextStorage)?.getStore();
+      if (!ctx) return {};
+      return buildFeatureFlagContext(ctx, this.options);
+    } catch {
+      return {};
+    }
   }
   /**
    * Determine if a feature flag ref is enabled given adapter results.
@@ -502,9 +548,8 @@ var FeatureFlagPlugin = class extends import_sdk2.DynamicPlugin {
    */
   isRefEnabled(ref, flagResults) {
     const key = typeof ref === "string" ? ref : ref.key;
-    const adapterResult = flagResults.get(key);
     const defaultValue = typeof ref === "object" ? ref.defaultValue ?? false : false;
-    if (adapterResult === true) return true;
+    if (flagResults.has(key)) return flagResults.get(key) === true;
     return defaultValue;
   }
 };
@@ -597,6 +642,12 @@ __decorateClass([
 __decorateClass([
   import_sdk2.ToolHook.Will("execute", { priority: 50 })
 ], FeatureFlagPlugin.prototype, "gateToolExecution", 1);
+__decorateClass([
+  ReadResourceHook.Will("execute", { priority: 50 })
+], FeatureFlagPlugin.prototype, "gateResourceRead", 1);
+__decorateClass([
+  GetPromptHook.Will("execute", { priority: 50 })
+], FeatureFlagPlugin.prototype, "gatePromptGet", 1);
 FeatureFlagPlugin = __decorateClass([
   (0, import_sdk2.Plugin)({
     name: "feature-flags",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-feature-flags",
-  "version": "1.7.2",
+  "version": "1.8.0",
   "description": "Feature flag plugin for FrontMCP - dynamically gate MCP capabilities behind feature flags",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -49,7 +49,7 @@
     }
   },
   "dependencies": {
-    "@frontmcp/sdk": "1.7.2"
+    "@frontmcp/sdk": "1.8.0"
   },
   "peerDependencies": {
     "@launchdarkly/node-server-sdk": "^9.0.0 || ^10.0.0",

package/providers/feature-flag-accessor.provider.d.ts

@@ -1,6 +1,6 @@
 import { FrontMcpContext } from '@frontmcp/sdk';
 import type { FeatureFlagAdapter } from '../adapters/feature-flag-adapter.interface';
-import type { FeatureFlagVariant, FeatureFlagPluginOptions, FeatureFlagRef } from '../feature-flag.types';
+import type { FeatureFlagPluginOptions, FeatureFlagRef, FeatureFlagVariant } from '../feature-flag.types';
 /**
  * Context-scoped accessor for feature flag evaluation.
  * Provides caching and context resolution from FrontMcpContext.

package/providers/feature-flag-accessor.provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"feature-flag-accessor.provider.d.ts","sourceRoot":"","sources":["../../src/providers/feature-flag-accessor.provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA2B,MAAM,eAAe,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,KAAK,EAEV,kBAAkB,EAClB,wBAAwB,EACxB,cAAc,EACf,MAAM,uBAAuB,CAAC;AAE/B;;;GAGG;AACH,qBAKa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4D;gBAEtE,OAAO,EAAE,kBAAkB,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,wBAAwB;IAM/F;;OAEG;IACG,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA4B1E;;OAEG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAK9D;;OAEG;IACG,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAKtE;;OAEG;IACG,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAOvD;;OAEG;IACH,OAAO,CAAC,YAAY;CAerB;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,kBAAkB,EAC3B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,wBAAwB,GAC/B,mBAAmB,CAErB"}
+{"version":3,"file":"feature-flag-accessor.provider.d.ts","sourceRoot":"","sources":["../../src/providers/feature-flag-accessor.provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA2B,MAAM,eAAe,CAAC;AAEzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAErF,OAAO,KAAK,EAEV,wBAAwB,EACxB,cAAc,EACd,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAE/B;;;GAGG;AACH,qBAKa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4D;gBAEtE,OAAO,EAAE,kBAAkB,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,wBAAwB;IAM/F;;OAEG;IACG,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA4B1E;;OAEG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAK9D;;OAEG;IACG,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAKtE;;OAEG;IACG,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAOvD;;OAEG;IACH,OAAO,CAAC,YAAY;CAGrB;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,kBAAkB,EAC3B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,wBAAwB,GAC/B,mBAAmB,CAErB"}