@frontmcp/plugins 0.4.1 → 0.5.1

package/src/codecall/codecall.plugin.d.ts

@@ -0,0 +1,41 @@
+import { DynamicPlugin, FlowCtxOf, ProviderType } from '@frontmcp/sdk';
+import { CodeCallPluginOptions, CodeCallPluginOptionsInput } from './codecall.types';
+export default class CodeCallPlugin extends DynamicPlugin<CodeCallPluginOptions, CodeCallPluginOptionsInput> {
+    options: CodeCallPluginOptions;
+    constructor(options?: CodeCallPluginOptionsInput);
+    /**
+     * Dynamic providers allow you to configure the plugin with custom options
+     * without touching the plugin decorator.
+     */
+    static dynamicProviders(options: CodeCallPluginOptionsInput): ProviderType[];
+    /**
+     * Hook into list_tools to enforce CodeCall modes:
+     *
+     * Modes:
+     * - codecall_only: Hide all tools from list_tools except CodeCall meta-tools.
+     *                  All other tools must be discovered via codecall:search.
+     * - codecall_opt_in: Show all tools in list_tools. Tools opt-in to CodeCall via metadata.
+     * - metadata_driven: Use per-tool metadata.codecall to control visibility in list_tools.
+     *
+     * CodeCall meta-tools (codecall:search, codecall:describe, codecall:execute, codecall:invoke)
+     * are ALWAYS visible regardless of mode.
+     */
+    adjustListTools(flowCtx: FlowCtxOf<'tools:list-tools'>): Promise<void>;
+    /**
+     * Determine if a tool should be visible in list_tools based on mode.
+     *
+     * @param tool - The tool entry to check
+     * @param mode - The current CodeCall mode
+     * @returns true if tool should be visible
+     */
+    private shouldShowInListTools;
+    /**
+     * Check if a tool is a CodeCall meta-tool.
+     * CodeCall meta-tools always remain visible.
+     */
+    private isCodeCallTool;
+    /**
+     * Extract CodeCall-specific metadata from a tool.
+     */
+    private getCodeCallMetadata;
+}

package/src/codecall/codecall.plugin.js

@@ -0,0 +1,152 @@
+"use strict";
+// file: libs/plugins/src/codecall/codecall.plugin.ts
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+const sdk_1 = require("@frontmcp/sdk");
+const codecall_types_1 = require("./codecall.types");
+const services_1 = require("./services");
+const tools_1 = require("./tools");
+const code_call_config_1 = tslib_1.__importDefault(require("./providers/code-call.config"));
+const enclave_service_1 = tslib_1.__importDefault(require("./services/enclave.service"));
+const cache_1 = tslib_1.__importDefault(require("../cache"));
+let CodeCallPlugin = class CodeCallPlugin extends sdk_1.DynamicPlugin {
+    options;
+    constructor(options = {}) {
+        super();
+        // Parse options with Zod schema to apply all defaults
+        this.options = codecall_types_1.codeCallPluginOptionsSchema.parse(options);
+        console.log('[CodeCall] Plugin initialized with mode:', this.options.mode);
+    }
+    /**
+     * Dynamic providers allow you to configure the plugin with custom options
+     * without touching the plugin decorator.
+     */
+    static dynamicProviders(options) {
+        // Parse options with Zod schema to apply all defaults
+        const parsedOptions = codecall_types_1.codeCallPluginOptionsSchema.parse(options);
+        // Create config instance
+        const config = new code_call_config_1.default(parsedOptions);
+        return [
+            {
+                name: 'codecall:config',
+                provide: code_call_config_1.default,
+                useValue: config,
+            },
+            {
+                name: 'codecall:enclave',
+                provide: enclave_service_1.default,
+                inject: () => [code_call_config_1.default],
+                useFactory: async (cfg) => {
+                    return new enclave_service_1.default(cfg);
+                },
+            },
+            {
+                name: 'codecall:tool-search',
+                provide: services_1.ToolSearchService,
+                inject: () => [sdk_1.ScopeEntry],
+                useFactory: async (scope) => {
+                    return new services_1.ToolSearchService({
+                        embeddingOptions: parsedOptions.embedding,
+                        mode: parsedOptions.mode,
+                        includeTools: parsedOptions['includeTools'],
+                    }, scope);
+                },
+            },
+        ];
+    }
+    /**
+     * Hook into list_tools to enforce CodeCall modes:
+     *
+     * Modes:
+     * - codecall_only: Hide all tools from list_tools except CodeCall meta-tools.
+     *                  All other tools must be discovered via codecall:search.
+     * - codecall_opt_in: Show all tools in list_tools. Tools opt-in to CodeCall via metadata.
+     * - metadata_driven: Use per-tool metadata.codecall to control visibility in list_tools.
+     *
+     * CodeCall meta-tools (codecall:search, codecall:describe, codecall:execute, codecall:invoke)
+     * are ALWAYS visible regardless of mode.
+     */
+    async adjustListTools(flowCtx) {
+        const { resolvedTools } = flowCtx.state;
+        console.log('[CodeCall] adjustListTools hook called, mode:', this.options.mode);
+        console.log('[CodeCall] Tools before filter:', resolvedTools?.length ?? 0);
+        if (!resolvedTools || resolvedTools.length === 0) {
+            console.log('[CodeCall] No tools to filter, returning early');
+            return;
+        }
+        // Filter tools based on mode
+        const filteredTools = resolvedTools.filter(({ tool }) => {
+            return this.shouldShowInListTools(tool, this.options.mode);
+        });
+        console.log('[CodeCall] Tools after filter:', filteredTools.length);
+        // Update the state with filtered tools
+        flowCtx.state.set('resolvedTools', filteredTools);
+    }
+    /**
+     * Determine if a tool should be visible in list_tools based on mode.
+     *
+     * @param tool - The tool entry to check
+     * @param mode - The current CodeCall mode
+     * @returns true if tool should be visible
+     */
+    shouldShowInListTools(tool, mode) {
+        // CodeCall meta-tools are ALWAYS visible
+        if (this.isCodeCallTool(tool)) {
+            return true;
+        }
+        // Get tool's CodeCall metadata
+        const codecallMeta = this.getCodeCallMetadata(tool);
+        switch (mode) {
+            case 'codecall_only':
+                // In codecall_only mode, only CodeCall meta-tools and tools with
+                // explicit visibleInListTools=true are shown
+                return codecallMeta?.visibleInListTools === true;
+            case 'codecall_opt_in':
+                // In opt_in mode, all tools are shown (they opt-in to CodeCall execution via metadata)
+                return true;
+            case 'metadata_driven':
+                // In metadata_driven mode, use per-tool metadata
+                // Default: show unless explicitly hidden
+                if (codecallMeta?.visibleInListTools === false) {
+                    return false;
+                }
+                // If visibleInListTools is true or undefined, show the tool
+                return true;
+            default:
+                // Unknown mode - default to showing the tool (fail-open for UX)
+                return true;
+        }
+    }
+    /**
+     * Check if a tool is a CodeCall meta-tool.
+     * CodeCall meta-tools always remain visible.
+     */
+    isCodeCallTool(tool) {
+        const name = tool.name || tool.fullName;
+        return name.startsWith('codecall:');
+    }
+    /**
+     * Extract CodeCall-specific metadata from a tool.
+     */
+    getCodeCallMetadata(tool) {
+        return tool.metadata?.codecall;
+    }
+};
+tslib_1.__decorate([
+    sdk_1.ListToolsHook.Did('resolveConflicts', { priority: 1000 }),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], CodeCallPlugin.prototype, "adjustListTools", null);
+CodeCallPlugin = tslib_1.__decorate([
+    (0, sdk_1.Plugin)({
+        name: 'codecall',
+        description: 'CodeCall plugin: AgentScript-based meta-tools for orchestrating MCP tools',
+        providers: [],
+        plugins: [cache_1.default],
+        tools: [tools_1.SearchTool, tools_1.DescribeTool, tools_1.ExecuteTool, tools_1.InvokeTool],
+    }),
+    tslib_1.__metadata("design:paramtypes", [Object])
+], CodeCallPlugin);
+exports.default = CodeCallPlugin;
+//# sourceMappingURL=codecall.plugin.js.map

package/src/codecall/codecall.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codecall.plugin.js","sourceRoot":"","sources":["../../../src/codecall/codecall.plugin.ts"],"names":[],"mappings":";AAAA,qDAAqD;;;AAErD,uCAAqH;AAErH,qDAM0B;AAC1B,yCAA+C;AAE/C,mCAA4E;AAE5E,4FAA0D;AAC1D,yFAAwD;AACxD,6DAAmC;AASpB,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,mBAAgE;IAC1G,OAAO,CAAwB;IAE/B,YAAY,UAAsC,EAAE;QAClD,KAAK,EAAE,CAAC;QACR,sDAAsD;QACtD,IAAI,CAAC,OAAO,GAAG,4CAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,0CAA0C,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,CAAC;IAED;;;OAGG;IACH,MAAM,CAAU,gBAAgB,CAAC,OAAmC;QAClE,sDAAsD;QACtD,MAAM,aAAa,GAAG,4CAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEjE,yBAAyB;QACzB,MAAM,MAAM,GAAG,IAAI,0BAAc,CAAC,aAAa,CAAC,CAAC;QAEjD,OAAO;YACL;gBACE,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,0BAAc;gBACvB,QAAQ,EAAE,MAAM;aACjB;YACD;gBACE,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,yBAAc;gBACvB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,0BAAc,CAAC;gBAC9B,UAAU,EAAE,KAAK,EAAE,GAAmB,EAAE,EAAE;oBACxC,OAAO,IAAI,yBAAc,CAAC,GAAG,CAAC,CAAC;gBACjC,CAAC;aACF;YACD;gBACE,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,4BAAiB;gBAC1B,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,gBAAU,CAAC;gBAC1B,UAAU,EAAE,KAAK,EAAE,KAAiB,EAAE,EAAE;oBACtC,OAAO,IAAI,4BAAiB,CAC1B;wBACE,gBAAgB,EAAE,aAAa,CAAC,SAAS;wBACzC,IAAI,EAAE,aAAa,CAAC,IAAI;wBACxB,YAAY,EAAE,aAAa,CAAC,cAAc,CAAC;qBAC5C,EACD,KAAK,CACN,CAAC;gBACJ,CAAC;aACF;SACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IAEG,AAAN,KAAK,CAAC,eAAe,CAAC,OAAsC;QAC1D,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,+CAA+C,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC;QAE3E,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,6BAA6B;QAC7B,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;YACtD,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,gCAAgC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAEpE,uCAAuC;QACvC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;OAMG;IACK,qBAAqB,CAAC,IAAmC,EAAE,IAAkB;QACnF,yCAAyC;QACzC,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,+BAA+B;QAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAEpD,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,eAAe;gBAClB,iEAAiE;gBACjE,6CAA6C;gBAC7C,OAAO,YAAY,EAAE,kBAAkB,KAAK,IAAI,CAAC;YAEnD,KAAK,iBAAiB;gBACpB,uFAAuF;gBACvF,OAAO,IAAI,CAAC;YAEd,KAAK,iBAAiB;gBACpB,iDAAiD;gBACjD,yCAAyC;gBACzC,IAAI,YAAY,EAAE,kBAAkB,KAAK,KAAK,EAAE,CAAC;oBAC/C,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,4DAA4D;gBAC5D,OAAO,IAAI,CAAC;YAEd;gBACE,gEAAgE;gBAChE,OAAO,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,cAAc,CAAC,IAAmC;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC;QACxC,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,IAAmC;QAC7D,OAAQ,IAAI,CAAC,QAAgB,EAAE,QAA4C,CAAC;IAC9E,CAAC;CACF,CAAA;AA7EO;IADL,mBAAa,CAAC,GAAG,CAAC,kBAAkB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;;;qDAoBzD;AArFkB,cAAc;IAPlC,IAAA,YAAM,EAAC;QACN,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,2EAA2E;QACxF,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,CAAC,eAAW,CAAC;QACtB,KAAK,EAAE,CAAC,kBAAU,EAAE,oBAAY,EAAE,mBAAW,EAAE,kBAAU,CAAC;KAC3D,CAAC;;GACmB,cAAc,CA+IlC;kBA/IoB,cAAc","sourcesContent":["// file: libs/plugins/src/codecall/codecall.plugin.ts\n\nimport { DynamicPlugin, FlowCtxOf, ListToolsHook, Plugin, ProviderType, ScopeEntry, ToolEntry } from '@frontmcp/sdk';\n\nimport {\n  CodeCallMode,\n  CodeCallPluginOptions,\n  CodeCallPluginOptionsInput,\n  CodeCallToolMetadata,\n  codeCallPluginOptionsSchema,\n} from './codecall.types';\nimport { ToolSearchService } from './services';\n\nimport { SearchTool, DescribeTool, ExecuteTool, InvokeTool } from './tools';\n\nimport CodeCallConfig from './providers/code-call.config';\nimport EnclaveService from './services/enclave.service';\nimport CachePlugin from '../cache';\n\n@Plugin({\n  name: 'codecall',\n  description: 'CodeCall plugin: AgentScript-based meta-tools for orchestrating MCP tools',\n  providers: [],\n  plugins: [CachePlugin],\n  tools: [SearchTool, DescribeTool, ExecuteTool, InvokeTool],\n})\nexport default class CodeCallPlugin extends DynamicPlugin<CodeCallPluginOptions, CodeCallPluginOptionsInput> {\n  options: CodeCallPluginOptions;\n\n  constructor(options: CodeCallPluginOptionsInput = {}) {\n    super();\n    // Parse options with Zod schema to apply all defaults\n    this.options = codeCallPluginOptionsSchema.parse(options);\n    console.log('[CodeCall] Plugin initialized with mode:', this.options.mode);\n  }\n\n  /**\n   * Dynamic providers allow you to configure the plugin with custom options\n   * without touching the plugin decorator.\n   */\n  static override dynamicProviders(options: CodeCallPluginOptionsInput): ProviderType[] {\n    // Parse options with Zod schema to apply all defaults\n    const parsedOptions = codeCallPluginOptionsSchema.parse(options);\n\n    // Create config instance\n    const config = new CodeCallConfig(parsedOptions);\n\n    return [\n      {\n        name: 'codecall:config',\n        provide: CodeCallConfig,\n        useValue: config,\n      },\n      {\n        name: 'codecall:enclave',\n        provide: EnclaveService,\n        inject: () => [CodeCallConfig],\n        useFactory: async (cfg: CodeCallConfig) => {\n          return new EnclaveService(cfg);\n        },\n      },\n      {\n        name: 'codecall:tool-search',\n        provide: ToolSearchService,\n        inject: () => [ScopeEntry],\n        useFactory: async (scope: ScopeEntry) => {\n          return new ToolSearchService(\n            {\n              embeddingOptions: parsedOptions.embedding,\n              mode: parsedOptions.mode,\n              includeTools: parsedOptions['includeTools'],\n            },\n            scope,\n          );\n        },\n      },\n    ];\n  }\n\n  /**\n   * Hook into list_tools to enforce CodeCall modes:\n   *\n   * Modes:\n   * - codecall_only: Hide all tools from list_tools except CodeCall meta-tools.\n   *                  All other tools must be discovered via codecall:search.\n   * - codecall_opt_in: Show all tools in list_tools. Tools opt-in to CodeCall via metadata.\n   * - metadata_driven: Use per-tool metadata.codecall to control visibility in list_tools.\n   *\n   * CodeCall meta-tools (codecall:search, codecall:describe, codecall:execute, codecall:invoke)\n   * are ALWAYS visible regardless of mode.\n   */\n  @ListToolsHook.Did('resolveConflicts', { priority: 1000 })\n  async adjustListTools(flowCtx: FlowCtxOf<'tools:list-tools'>) {\n    const { resolvedTools } = flowCtx.state;\n    console.log('[CodeCall] adjustListTools hook called, mode:', this.options.mode);\n    console.log('[CodeCall] Tools before filter:', resolvedTools?.length ?? 0);\n\n    if (!resolvedTools || resolvedTools.length === 0) {\n      console.log('[CodeCall] No tools to filter, returning early');\n      return;\n    }\n\n    // Filter tools based on mode\n    const filteredTools = resolvedTools.filter(({ tool }) => {\n      return this.shouldShowInListTools(tool, this.options.mode);\n    });\n\n    console.log('[CodeCall] Tools after filter:', filteredTools.length);\n\n    // Update the state with filtered tools\n    flowCtx.state.set('resolvedTools', filteredTools);\n  }\n\n  /**\n   * Determine if a tool should be visible in list_tools based on mode.\n   *\n   * @param tool - The tool entry to check\n   * @param mode - The current CodeCall mode\n   * @returns true if tool should be visible\n   */\n  private shouldShowInListTools(tool: ToolEntry<any, any, any, any>, mode: CodeCallMode): boolean {\n    // CodeCall meta-tools are ALWAYS visible\n    if (this.isCodeCallTool(tool)) {\n      return true;\n    }\n\n    // Get tool's CodeCall metadata\n    const codecallMeta = this.getCodeCallMetadata(tool);\n\n    switch (mode) {\n      case 'codecall_only':\n        // In codecall_only mode, only CodeCall meta-tools and tools with\n        // explicit visibleInListTools=true are shown\n        return codecallMeta?.visibleInListTools === true;\n\n      case 'codecall_opt_in':\n        // In opt_in mode, all tools are shown (they opt-in to CodeCall execution via metadata)\n        return true;\n\n      case 'metadata_driven':\n        // In metadata_driven mode, use per-tool metadata\n        // Default: show unless explicitly hidden\n        if (codecallMeta?.visibleInListTools === false) {\n          return false;\n        }\n        // If visibleInListTools is true or undefined, show the tool\n        return true;\n\n      default:\n        // Unknown mode - default to showing the tool (fail-open for UX)\n        return true;\n    }\n  }\n\n  /**\n   * Check if a tool is a CodeCall meta-tool.\n   * CodeCall meta-tools always remain visible.\n   */\n  private isCodeCallTool(tool: ToolEntry<any, any, any, any>): boolean {\n    const name = tool.name || tool.fullName;\n    return name.startsWith('codecall:');\n  }\n\n  /**\n   * Extract CodeCall-specific metadata from a tool.\n   */\n  private getCodeCallMetadata(tool: ToolEntry<any, any, any, any>): CodeCallToolMetadata | undefined {\n    return (tool.metadata as any)?.codecall as CodeCallToolMetadata | undefined;\n  }\n}\n"]}

package/src/codecall/codecall.symbol.d.ts

@@ -0,0 +1,106 @@
+import { CodeCallVmPreset } from './codecall.types';
+import type { ToolCallResult, CallToolOptions } from './errors';
+export interface CodeCallAstValidationIssue {
+    kind: 'IllegalBuiltinAccess' | 'DisallowedGlobal' | 'DisallowedLoop' | 'ParseError';
+    message: string;
+    location?: {
+        line: number;
+        column: number;
+    };
+    identifier?: string;
+}
+export interface CodeCallAstValidationResult {
+    ok: boolean;
+    issues: CodeCallAstValidationIssue[];
+    transformedCode?: string;
+}
+/**
+ * Interface for the AST validator service
+ */
+export interface CodeCallAstValidator {
+    /**
+     * Validate a JavaScript script before execution
+     */
+    validate(script: string): Promise<CodeCallAstValidationResult>;
+}
+/**
+ * Resolved VM options with all defaults applied.
+ * Plugins compute this once and pass into providers.
+ */
+export interface ResolvedCodeCallVmOptions {
+    preset: CodeCallVmPreset;
+    timeoutMs: number;
+    allowLoops: boolean;
+    maxSteps?: number;
+    disabledBuiltins: string[];
+    disabledGlobals: string[];
+    allowConsole: boolean;
+}
+/**
+ * Environment available to code running inside the VM.
+ * The plugin is responsible for wiring this to the underlying tool pipeline.
+ */
+export interface CodeCallVmEnvironment {
+    /**
+     * Call a tool from within AgentScript.
+     *
+     * @param name - Tool name (e.g., 'users:list')
+     * @param input - Tool input arguments
+     * @param options - Optional behavior configuration
+     * @param options.throwOnError - When true (default), throws on error.
+     *                               When false, returns { success, data, error }.
+     *
+     * SECURITY NOTES:
+     * - Cannot call 'codecall:*' tools (self-reference blocked)
+     * - Errors are sanitized - no stack traces or internal details exposed
+     * - Security guard errors (self-reference, access control) are NEVER catchable
+     */
+    callTool: <TInput, TResult>(name: string, input: TInput, options?: CallToolOptions) => Promise<TResult | ToolCallResult<TResult>>;
+    getTool: (name: string) => {
+        name: string;
+        description?: string;
+        inputSchema: unknown;
+        outputSchema?: unknown | null;
+    } | undefined;
+    console?: Console;
+    mcpLog?: (level: 'debug' | 'info' | 'warn' | 'error', message: string, metadata?: Record<string, unknown>) => void;
+    mcpNotify?: (event: string, payload: Record<string, unknown>) => void;
+}
+/**
+ * Result from a tool search query
+ */
+export interface ToolSearchResult {
+    toolName: string;
+    appId?: string;
+    description: string;
+    relevanceScore: number;
+}
+/**
+ * Options for searching tools
+ */
+export interface ToolSearchOptions {
+    topK?: number;
+    appIds?: string[];
+    excludeToolNames?: string[];
+}
+/**
+ * Interface for the tool search service
+ */
+export interface ToolSearch {
+    /**
+     * Search for tools matching the query
+     */
+    search(query: string, options?: ToolSearchOptions): Promise<ToolSearchResult[]>;
+    /**
+     * Check if a tool exists in the index
+     */
+    hasTool(toolName: string): boolean;
+    /**
+     * Get the total number of indexed tools
+     */
+    getTotalCount(): number;
+    /**
+     * Initialize the search index with tools
+     */
+    initialize(): Promise<void>;
+}

package/src/codecall/codecall.symbol.js

@@ -0,0 +1,4 @@
+"use strict";
+// file: libs/plugins/src/codecall/codecall.symbol.ts
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=codecall.symbol.js.map

package/src/codecall/codecall.symbol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codecall.symbol.js","sourceRoot":"","sources":["../../../src/codecall/codecall.symbol.ts"],"names":[],"mappings":";AAAA,qDAAqD","sourcesContent":["// file: libs/plugins/src/codecall/codecall.symbol.ts\n\nimport { CodeCallVmPreset } from './codecall.types';\nimport type { ToolCallResult, CallToolOptions } from './errors';\n\nexport interface CodeCallAstValidationIssue {\n  kind: 'IllegalBuiltinAccess' | 'DisallowedGlobal' | 'DisallowedLoop' | 'ParseError';\n  message: string;\n  location?: { line: number; column: number };\n  identifier?: string;\n}\n\nexport interface CodeCallAstValidationResult {\n  ok: boolean;\n  issues: CodeCallAstValidationIssue[];\n  transformedCode?: string;\n}\n\n/**\n * Interface for the AST validator service\n */\nexport interface CodeCallAstValidator {\n  /**\n   * Validate a JavaScript script before execution\n   */\n  validate(script: string): Promise<CodeCallAstValidationResult>;\n}\n\n/**\n * Resolved VM options with all defaults applied.\n * Plugins compute this once and pass into providers.\n */\nexport interface ResolvedCodeCallVmOptions {\n  preset: CodeCallVmPreset;\n  timeoutMs: number;\n  allowLoops: boolean;\n  maxSteps?: number;\n  disabledBuiltins: string[];\n  disabledGlobals: string[];\n  allowConsole: boolean;\n}\n\n/**\n * Environment available to code running inside the VM.\n * The plugin is responsible for wiring this to the underlying tool pipeline.\n */\nexport interface CodeCallVmEnvironment {\n  /**\n   * Call a tool from within AgentScript.\n   *\n   * @param name - Tool name (e.g., 'users:list')\n   * @param input - Tool input arguments\n   * @param options - Optional behavior configuration\n   * @param options.throwOnError - When true (default), throws on error.\n   *                               When false, returns { success, data, error }.\n   *\n   * SECURITY NOTES:\n   * - Cannot call 'codecall:*' tools (self-reference blocked)\n   * - Errors are sanitized - no stack traces or internal details exposed\n   * - Security guard errors (self-reference, access control) are NEVER catchable\n   */\n  callTool: <TInput, TResult>(\n    name: string,\n    input: TInput,\n    options?: CallToolOptions,\n  ) => Promise<TResult | ToolCallResult<TResult>>;\n\n  getTool: (name: string) =>\n    | {\n        name: string;\n        description?: string;\n        inputSchema: unknown;\n        outputSchema?: unknown | null;\n      }\n    | undefined;\n\n  console?: Console;\n\n  mcpLog?: (level: 'debug' | 'info' | 'warn' | 'error', message: string, metadata?: Record<string, unknown>) => void;\n\n  mcpNotify?: (event: string, payload: Record<string, unknown>) => void;\n}\n\n/**\n * Result from a tool search query\n */\nexport interface ToolSearchResult {\n  toolName: string;\n  appId?: string;\n  description: string;\n  relevanceScore: number;\n}\n\n/**\n * Options for searching tools\n */\nexport interface ToolSearchOptions {\n  topK?: number;\n  appIds?: string[];\n  excludeToolNames?: string[];\n}\n\n/**\n * Interface for the tool search service\n */\nexport interface ToolSearch {\n  /**\n   * Search for tools matching the query\n   */\n  search(query: string, options?: ToolSearchOptions): Promise<ToolSearchResult[]>;\n\n  /**\n   * Check if a tool exists in the index\n   */\n  hasTool(toolName: string): boolean;\n\n  /**\n   * Get the total number of indexed tools\n   */\n  getTotalCount(): number;\n\n  /**\n   * Initialize the search index with tools\n   */\n  initialize(): Promise<void>;\n}\n"]}

package/src/codecall/codecall.types.d.ts

@@ -0,0 +1,289 @@
+import { z } from 'zod';
+/**
+ * Tool info passed to the directCalls filter function
+ */
+export interface DirectCallsFilterToolInfo {
+    name: string;
+    appId?: string;
+    source?: string;
+    tags?: string[];
+}
+/**
+ * Tool info passed to the includeTools filter function
+ */
+export interface IncludeToolsFilterToolInfo {
+    name: string;
+    appId?: string;
+    source?: string;
+    description?: string;
+    tags?: string[];
+}
+/**
+ * Function type for directCalls filter
+ */
+export type DirectCallsFilterFn = (tool: DirectCallsFilterToolInfo) => boolean;
+/**
+ * Function type for includeTools filter
+ */
+export type IncludeToolsFilterFn = (tool: IncludeToolsFilterToolInfo) => boolean;
+export declare const codeCallModeSchema: z.ZodDefault<z.ZodEnum<{
+    codecall_only: "codecall_only";
+    codecall_opt_in: "codecall_opt_in";
+    metadata_driven: "metadata_driven";
+}>>;
+export declare const codeCallVmPresetSchema: z.ZodDefault<z.ZodEnum<{
+    locked_down: "locked_down";
+    secure: "secure";
+    balanced: "balanced";
+    experimental: "experimental";
+}>>;
+export declare const codeCallVmOptionsSchema: z.ZodDefault<z.ZodObject<{
+    preset: z.ZodDefault<z.ZodEnum<{
+        locked_down: "locked_down";
+        secure: "secure";
+        balanced: "balanced";
+        experimental: "experimental";
+    }>>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    allowLoops: z.ZodOptional<z.ZodBoolean>;
+    maxSteps: z.ZodOptional<z.ZodNumber>;
+    disabledBuiltins: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    disabledGlobals: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    allowConsole: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>>;
+export declare const codeCallDirectCallsOptionsSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    filter: z.ZodOptional<z.ZodCustom<DirectCallsFilterFn, DirectCallsFilterFn>>;
+}, z.core.$strip>;
+export declare const embeddingStrategySchema: z.ZodDefault<z.ZodEnum<{
+    tfidf: "tfidf";
+    ml: "ml";
+}>>;
+export declare const synonymExpansionConfigSchema: z.ZodDefault<z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    additionalSynonyms: z.ZodOptional<z.ZodArray<z.ZodArray<z.ZodString>>>;
+    replaceDefaults: z.ZodDefault<z.ZodBoolean>;
+    maxExpansionsPerTerm: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>>;
+export declare const codeCallEmbeddingOptionsSchema: z.ZodDefault<z.ZodObject<{
+    strategy: z.ZodDefault<z.ZodEnum<{
+        tfidf: "tfidf";
+        ml: "ml";
+    }>>;
+    modelName: z.ZodDefault<z.ZodString>;
+    cacheDir: z.ZodDefault<z.ZodString>;
+    useHNSW: z.ZodDefault<z.ZodBoolean>;
+    synonymExpansion: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        additionalSynonyms: z.ZodOptional<z.ZodArray<z.ZodArray<z.ZodString>>>;
+        replaceDefaults: z.ZodDefault<z.ZodBoolean>;
+        maxExpansionsPerTerm: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>]>>>;
+}, z.core.$strip>>;
+export declare const codeCallSidecarOptionsSchema: z.ZodDefault<z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    maxTotalSize: z.ZodOptional<z.ZodNumber>;
+    maxReferenceSize: z.ZodOptional<z.ZodNumber>;
+    extractionThreshold: z.ZodOptional<z.ZodNumber>;
+    maxResolvedSize: z.ZodOptional<z.ZodNumber>;
+    allowComposites: z.ZodOptional<z.ZodBoolean>;
+    maxScriptLengthWhenDisabled: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+}, z.core.$strip>>;
+declare const codeCallPluginOptionsObjectSchema: z.ZodObject<{
+    mode: z.ZodDefault<z.ZodEnum<{
+        codecall_only: "codecall_only";
+        codecall_opt_in: "codecall_opt_in";
+        metadata_driven: "metadata_driven";
+    }>>;
+    topK: z.ZodDefault<z.ZodNumber>;
+    maxDefinitions: z.ZodDefault<z.ZodNumber>;
+    includeTools: z.ZodOptional<z.ZodCustom<IncludeToolsFilterFn, IncludeToolsFilterFn>>;
+    directCalls: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodBoolean;
+        allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        filter: z.ZodOptional<z.ZodCustom<DirectCallsFilterFn, DirectCallsFilterFn>>;
+    }, z.core.$strip>>;
+    vm: z.ZodDefault<z.ZodObject<{
+        preset: z.ZodDefault<z.ZodEnum<{
+            locked_down: "locked_down";
+            secure: "secure";
+            balanced: "balanced";
+            experimental: "experimental";
+        }>>;
+        timeoutMs: z.ZodOptional<z.ZodNumber>;
+        allowLoops: z.ZodOptional<z.ZodBoolean>;
+        maxSteps: z.ZodOptional<z.ZodNumber>;
+        disabledBuiltins: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        disabledGlobals: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        allowConsole: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    embedding: z.ZodDefault<z.ZodObject<{
+        strategy: z.ZodDefault<z.ZodEnum<{
+            tfidf: "tfidf";
+            ml: "ml";
+        }>>;
+        modelName: z.ZodDefault<z.ZodString>;
+        cacheDir: z.ZodDefault<z.ZodString>;
+        useHNSW: z.ZodDefault<z.ZodBoolean>;
+        synonymExpansion: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            additionalSynonyms: z.ZodOptional<z.ZodArray<z.ZodArray<z.ZodString>>>;
+            replaceDefaults: z.ZodDefault<z.ZodBoolean>;
+            maxExpansionsPerTerm: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>]>>>;
+    }, z.core.$strip>>;
+    sidecar: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        maxTotalSize: z.ZodOptional<z.ZodNumber>;
+        maxReferenceSize: z.ZodOptional<z.ZodNumber>;
+        extractionThreshold: z.ZodOptional<z.ZodNumber>;
+        maxResolvedSize: z.ZodOptional<z.ZodNumber>;
+        allowComposites: z.ZodOptional<z.ZodBoolean>;
+        maxScriptLengthWhenDisabled: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const codeCallPluginOptionsSchema: z.ZodPrefault<z.ZodObject<{
+    mode: z.ZodDefault<z.ZodEnum<{
+        codecall_only: "codecall_only";
+        codecall_opt_in: "codecall_opt_in";
+        metadata_driven: "metadata_driven";
+    }>>;
+    topK: z.ZodDefault<z.ZodNumber>;
+    maxDefinitions: z.ZodDefault<z.ZodNumber>;
+    includeTools: z.ZodOptional<z.ZodCustom<IncludeToolsFilterFn, IncludeToolsFilterFn>>;
+    directCalls: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodBoolean;
+        allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        filter: z.ZodOptional<z.ZodCustom<DirectCallsFilterFn, DirectCallsFilterFn>>;
+    }, z.core.$strip>>;
+    vm: z.ZodDefault<z.ZodObject<{
+        preset: z.ZodDefault<z.ZodEnum<{
+            locked_down: "locked_down";
+            secure: "secure";
+            balanced: "balanced";
+            experimental: "experimental";
+        }>>;
+        timeoutMs: z.ZodOptional<z.ZodNumber>;
+        allowLoops: z.ZodOptional<z.ZodBoolean>;
+        maxSteps: z.ZodOptional<z.ZodNumber>;
+        disabledBuiltins: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        disabledGlobals: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        allowConsole: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    embedding: z.ZodDefault<z.ZodObject<{
+        strategy: z.ZodDefault<z.ZodEnum<{
+            tfidf: "tfidf";
+            ml: "ml";
+        }>>;
+        modelName: z.ZodDefault<z.ZodString>;
+        cacheDir: z.ZodDefault<z.ZodString>;
+        useHNSW: z.ZodDefault<z.ZodBoolean>;
+        synonymExpansion: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            additionalSynonyms: z.ZodOptional<z.ZodArray<z.ZodArray<z.ZodString>>>;
+            replaceDefaults: z.ZodDefault<z.ZodBoolean>;
+            maxExpansionsPerTerm: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>]>>>;
+    }, z.core.$strip>>;
+    sidecar: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        maxTotalSize: z.ZodOptional<z.ZodNumber>;
+        maxReferenceSize: z.ZodOptional<z.ZodNumber>;
+        extractionThreshold: z.ZodOptional<z.ZodNumber>;
+        maxResolvedSize: z.ZodOptional<z.ZodNumber>;
+        allowComposites: z.ZodOptional<z.ZodBoolean>;
+        maxScriptLengthWhenDisabled: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>>;
+export type CodeCallMode = z.infer<typeof codeCallModeSchema>;
+export type CodeCallVmPreset = z.infer<typeof codeCallVmPresetSchema>;
+export type CodeCallVmOptions = z.infer<typeof codeCallVmOptionsSchema>;
+export type CodeCallDirectCallsOptions = z.infer<typeof codeCallDirectCallsOptionsSchema>;
+export type EmbeddingStrategy = z.infer<typeof embeddingStrategySchema>;
+export type SynonymExpansionConfig = z.infer<typeof synonymExpansionConfigSchema>;
+export type CodeCallSidecarOptions = z.infer<typeof codeCallSidecarOptionsSchema>;
+export type CodeCallEmbeddingOptions = z.infer<typeof codeCallEmbeddingOptionsSchema>;
+export type CodeCallEmbeddingOptionsInput = z.input<typeof codeCallEmbeddingOptionsSchema>;
+/**
+ * Resolved options type (after parsing with defaults applied).
+ * Use this for internal plugin logic where all defaults are guaranteed.
+ */
+export type CodeCallPluginOptions = z.infer<typeof codeCallPluginOptionsSchema>;
+/**
+ * Input options type (what users provide to init()).
+ * All fields with defaults are optional.
+ */
+export type CodeCallPluginOptionsInput = z.input<typeof codeCallPluginOptionsObjectSchema>;
+/**
+ * Per-tool metadata used by CodeCall.
+ * This maps to `metadata.codecall` on tools.
+ */
+export interface CodeCallToolMetadata {
+    /**
+     * If true, this tool stays visible in `list_tools`
+     * even when CodeCall is hiding most tools.
+     */
+    visibleInListTools?: boolean;
+    /**
+     * Whether this tool can be used via CodeCall.
+     * Semantics depend on CodeCallMode (see README).
+     */
+    enabledInCodeCall?: boolean;
+    /** Optional extra indexing hints */
+    appId?: string;
+    source?: string;
+    tags?: string[];
+}
+export type CodeCallSearchInput = {
+    query: string;
+    topK?: number;
+    filter?: {
+        appIds?: string[];
+        tags?: string[];
+        includeOpenApi?: boolean;
+        includeInline?: boolean;
+    };
+};
+export type CodeCallSearchResult = {
+    tools: {
+        name: string;
+        description: string;
+        appId?: string;
+        source?: string;
+        score: number;
+    }[];
+};
+export type CodeCallDescribeInput = {
+    tools: string[];
+    max?: number;
+};
+export type CodeCallDescribeResult = {
+    tools: {
+        name: string;
+        description: string;
+        inputSchema: unknown;
+        outputSchema?: unknown | null;
+        examples?: {
+            input: unknown;
+            output?: unknown;
+        }[];
+    }[];
+};
+export type CodeCallExecuteInput = {
+    script: string;
+    /**
+     * Arbitrary, readonly context exposed as `codecallContext`.
+     */
+    context?: Record<string, unknown>;
+};
+declare global {
+    interface ExtendFrontMcpToolMetadata {
+        /**
+         * CodeCall-specific metadata, attached via `@Tool({ metadata: { codecall: ... } })`
+         * or whatever your decorator mapping is.
+         */
+        codecall?: CodeCallToolMetadata;
+    }
+}
+export {};