@hansjm10/volt-coding-agent 0.0.0-bootstrap.0 → 0.1.0

package/dist/core/mcp/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../../src/core/mcp/manager.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAQ5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAIxD,OAAO,KAAK,EAEX,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EAEf,uBAAuB,EACvB,gBAAgB,EAEhB,iBAAiB,EAEjB,kBAAkB,EAElB,cAAc,EAEd,gBAAgB,EAChB,cAAc,EACd,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,iBAAiB;IACjC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,aAAa,EAAE,gBAAgB,CAAC;IAChC,aAAa,EAAE,gBAAgB,CAAC;IAChC,WAAW,EAAE,cAAc,CAAC;IAC5B,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAqKD,qBAAa,UAAU;IACtB,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,WAAW,CAAmC;IACtD,OAAO,CAAC,aAAa,CAAmB;IACxC,OAAO,CAAC,WAAW,CAAiB;IACpC,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,UAAU,CAA4B;IAC9C,OAAO,CAAC,iBAAiB,CAAqD;IAC9E,OAAO,CAAC,SAAS,CAAqB;IACtC,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,cAAc,CAA2C;IAEjE,YAAY,OAAO,EAAE,iBAAiB,EAuBrC;IAED,0EAA0E;IAC1E,SAAS,CAAC,QAAQ,EAAE,uBAAuB,GAAG,MAAM,IAAI,CAKvD;IAED,OAAO,CAAC,IAAI;IAUZ,OAAO,CAAC,cAAc;IAYtB,SAAS,IAAI,OAAO,CAEnB;IAED,cAAc,+CAEb;IAED,WAAW,IAAI,gBAAgB,EAAE,CAEhC;IAED,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,gBAAgB,CAEtC;IAED,uBAAuB,IAAI,sBAAsB,EAAE,CA4BlD;IAEK,iBAAiB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3D;IAEK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAE7B;IAEK,kBAAkB,CACvB,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,0BAA0B,EACnC,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,OAAO,CAAC,CAoElB;IAEK,aAAa,CAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAI1D;IAEK,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,YAAY,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAIpG;IAEK,gBAAgB,CACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,GACd,OAAO,CAAC;QAAE,MAAM,EAAE,aAAa,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAC;QAAC,SAAS,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAS3G;IAEK,eAAe,CACpB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GACjE,OAAO,CAAC,OAAO,CAAC,CAwDlB;IAEK,yBAAyB,CAC9B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5D,OAAO,CAAC,OAAO,CAAC,CAelB;IAEK,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBvD;IAED,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAI3G;IAEK,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAC7C,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,YAAY,CAAC;QACrB,aAAa,EAAE,gBAAgB,CAAC;KAChC,CAAC,CAgBD;IAEK,SAAS,CACd,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC;QACV,MAAM,EAAE,YAAY,CAAC;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,cAAc,EAAE,CAAC;QACxB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,OAAO,CAAC;KACf,CAAC,CAoBD;IAED,MAAM,CACL,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,MAAM,GACZ;QAAE,MAAM,EAAE,QAAQ,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,cAAc,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CA6BpF;IAEK,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAyBzF;IAEK,aAAa,CAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC;QAAE,MAAM,EAAE,gBAAgB,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,kBAAkB,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAkB7G;IAEK,YAAY,CACjB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,0BAA0B,EACnC,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,OAAO,CAAC,CAkClB;IAEK,WAAW,CAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC;QAAE,MAAM,EAAE,cAAc,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,gBAAgB,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAiBvG;IAEK,SAAS,CACd,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,0BAA0B,EACnC,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,OAAO,CAAC,CAwClB;IAEK,SAAS,CACd,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,GAAG,OAAO,CAAC,EAChD,OAAO,EAAE,0BAA0B,GACjC,OAAO,CAAC,OAAO,CAAC,CA8BlB;IAEK,QAAQ,CACb,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,0BAA0B,EACnC,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,oBAAoB,CAAC,CAwG/B;IAED,OAAO,CAAC,yBAAyB;YAUnB,gBAAgB;IAQ9B,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,sBAAsB;YAWhB,UAAU;CAmBxB","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport type { CallToolResult, GetPromptResult, ReadResourceResult } from \"@modelcontextprotocol/sdk/types.js\";\nimport type { McpAuditLogger } from \"./audit.ts\";\nimport { getMcpDirectToolName, getServerTimeoutMs, hashMcpServerConfig, serverMatchesToolFilters } from \"./config.ts\";\nimport type { McpConfigWriter } from \"./config-writer.ts\";\nimport type { McpMetadataCache } from \"./metadata-cache.ts\";\nimport {\n\tcompleteMcpOAuthBrowserAuth,\n\ttype McpOAuthPendingDeviceFlow,\n\tpollMcpOAuthDeviceAuth,\n\tstartMcpOAuthBrowserAuth,\n\tstartMcpOAuthDeviceAuth,\n} from \"./oauth-flow.ts\";\nimport type { McpOAuthStore } from \"./oauth-store.ts\";\nimport type { McpOutputStore } from \"./output-store.ts\";\nimport { classifyMcpToolRisk } from \"./safety.ts\";\nimport { searchMcpMetadata } from \"./search.ts\";\nimport { McpServerSupervisor } from \"./server-supervisor.ts\";\nimport type {\n\tMcpCallerSurface,\n\tMcpClientFactory,\n\tMcpDirectToolCandidate,\n\tMcpGatewayCallResult,\n\tMcpGatewayExecutionContext,\n\tMcpGatewayInput,\n\tMcpManagerEvent,\n\tMcpManagerEventListener,\n\tMcpPromptSummary,\n\tMcpRecentCallStatus,\n\tMcpResolvedConfig,\n\tMcpResolvedServerConfig,\n\tMcpResourceSummary,\n\tMcpRisk,\n\tMcpSearchMatch,\n\tMcpServerMetadata,\n\tMcpServerSummary,\n\tMcpToolSummary,\n} from \"./types.ts\";\n\nexport interface McpManagerOptions {\n\tconfig: McpResolvedConfig;\n\tclientFactory: McpClientFactory;\n\tmetadataCache: McpMetadataCache;\n\toutputStore: McpOutputStore;\n\tauditLogger?: McpAuditLogger;\n\tconfigWriter?: McpConfigWriter;\n\toauthStore?: McpOAuthStore;\n\tsessionId?: string;\n\tworkspaceId?: string;\n}\n\nfunction byteLength(value: string): number {\n\treturn Buffer.byteLength(value, \"utf-8\");\n}\n\nfunction compactText(value: string | undefined, maxLength = 220): string {\n\tconst normalized = (value ?? \"\").replace(/\\s+/g, \" \").trim();\n\tif (!normalized) {\n\t\treturn \"\";\n\t}\n\treturn normalized.length <= maxLength ? normalized : `${normalized.slice(0, maxLength - 3)}...`;\n}\n\nfunction parseArguments(input: McpGatewayInput): Record<string, unknown> {\n\tif (input.arguments !== undefined) {\n\t\treturn input.arguments;\n\t}\n\tif (input.argumentsJson !== undefined) {\n\t\tconst parsed = JSON.parse(input.argumentsJson) as unknown;\n\t\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n\t\t\tthrow new Error(\"MCP argumentsJson must parse to an object\");\n\t\t}\n\t\treturn parsed as Record<string, unknown>;\n\t}\n\treturn {};\n}\n\nfunction requireString(value: string | undefined, label: string): string {\n\tconst trimmed = value?.trim();\n\tif (!trimmed) {\n\t\tthrow new Error(`MCP ${label} is required`);\n\t}\n\treturn trimmed;\n}\n\nfunction makeCallId(): string {\n\treturn `mcpcall_${randomUUID().replace(/-/g, \"\")}`;\n}\n\nfunction getCallerSurface(ctx: McpGatewayExecutionContext): McpCallerSurface {\n\tif (ctx.mode === \"tui\") return \"tui\";\n\tif (ctx.mode === \"rpc\") return \"rpc\";\n\tif (ctx.mode === \"print\") return \"print\";\n\tif (ctx.mode === \"json\") return \"json\";\n\treturn \"unknown\";\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isMetadataStale(metadata: McpServerMetadata | undefined, maxAgeMs: number): boolean {\n\tif (!metadata) {\n\t\treturn true;\n\t}\n\tconst lastSeenAt = Date.parse(metadata.lastSeenAt);\n\tif (!Number.isFinite(lastSeenAt)) {\n\t\treturn true;\n\t}\n\treturn Date.now() - lastSeenAt > maxAgeMs;\n}\n\nfunction isDirectToolEnabled(\n\tserverDirectTools: boolean | string[],\n\tsettingsDirectTools: boolean,\n\ttoolName: string,\n): boolean {\n\tif (Array.isArray(serverDirectTools)) {\n\t\treturn serverDirectTools.includes(toolName);\n\t}\n\treturn serverDirectTools || settingsDirectTools;\n}\n\nfunction toToolSummary(\n\tserverId: string,\n\tmetadata: McpServerMetadata,\n\tserver: McpResolvedServerConfig,\n\tsettingsDirectTools: boolean,\n\tstale: boolean,\n): McpToolSummary[] {\n\treturn metadata.tools.map((tool) => ({\n\t\tserver: serverId,\n\t\tname: tool.name,\n\t\t...(tool.title ? { title: tool.title } : {}),\n\t\t...(tool.description ? { description: compactText(tool.description, 800) } : {}),\n\t\trisk: classifyMcpToolRisk(tool),\n\t\tinputSchema: tool.inputSchema,\n\t\t...(tool.outputSchema ? { outputSchema: tool.outputSchema } : {}),\n\t\t...(tool.annotations ? { annotations: tool.annotations } : {}),\n\t\tmetadataHash: metadata.metadataHash,\n\t\tlastSeenAt: metadata.lastSeenAt,\n\t\tstale,\n\t\tdirect: isDirectToolEnabled(server.directTools, settingsDirectTools, tool.name),\n\t}));\n}\n\nfunction contentPartToText(part: unknown): string | undefined {\n\tif (!isRecord(part) || typeof part.type !== \"string\") {\n\t\treturn undefined;\n\t}\n\tif (part.type === \"text\" && typeof part.text === \"string\") {\n\t\treturn part.text;\n\t}\n\tif (part.type === \"image\") {\n\t\tconst mimeType = typeof part.mimeType === \"string\" ? part.mimeType : \"image/unknown\";\n\t\tconst data = typeof part.data === \"string\" ? part.data : \"\";\n\t\treturn `[MCP image: ${mimeType}, ${data.length} base64 chars]`;\n\t}\n\tif (part.type === \"audio\") {\n\t\tconst mimeType = typeof part.mimeType === \"string\" ? part.mimeType : \"audio/unknown\";\n\t\tconst data = typeof part.data === \"string\" ? part.data : \"\";\n\t\treturn `[MCP audio: ${mimeType}, ${data.length} base64 chars]`;\n\t}\n\tif (part.type === \"resource\" && isRecord(part.resource)) {\n\t\tconst resource = part.resource;\n\t\tconst uri = typeof resource.uri === \"string\" ? resource.uri : \"resource\";\n\t\tif (typeof resource.text === \"string\") {\n\t\t\treturn `[MCP resource ${uri}]\\n${resource.text}`;\n\t\t}\n\t\tif (typeof resource.blob === \"string\") {\n\t\t\treturn `[MCP binary resource ${uri}: ${resource.blob.length} base64 chars]`;\n\t\t}\n\t}\n\tif (part.type === \"resource_link\") {\n\t\tconst uri = typeof part.uri === \"string\" ? part.uri : \"\";\n\t\tconst name = typeof part.name === \"string\" ? part.name : \"resource\";\n\t\treturn `[MCP resource link: ${name}${uri ? ` ${uri}` : \"\"}]`;\n\t}\n\treturn `[Unsupported MCP content: ${part.type}]`;\n}\n\nfunction callToolResultToText(result: CallToolResult): string {\n\tconst parts = result.content.map(contentPartToText).filter((part): part is string => part !== undefined);\n\tif (result.structuredContent !== undefined) {\n\t\tparts.push(`Structured content:\\n${JSON.stringify(result.structuredContent, null, 2)}`);\n\t}\n\treturn parts.join(\"\\n\\n\").trim() || \"(no MCP tool output)\";\n}\n\nfunction readResourceResultToText(result: ReadResourceResult): string {\n\treturn result.contents\n\t\t.map((content) => {\n\t\t\tif (\"text\" in content) {\n\t\t\t\treturn `[${content.uri}]\\n${content.text}`;\n\t\t\t}\n\t\t\treturn `[${content.uri}] binary ${content.blob.length} base64 chars`;\n\t\t})\n\t\t.join(\"\\n\\n\");\n}\n\nfunction getPromptResultToText(result: GetPromptResult): string {\n\tconst lines: string[] = [];\n\tif (result.description) {\n\t\tlines.push(result.description);\n\t}\n\tfor (const message of result.messages) {\n\t\tlines.push(`## ${message.role}`);\n\t\tconst content = message.content;\n\t\tconst text = contentPartToText(content);\n\t\tlines.push(text ?? JSON.stringify(content));\n\t}\n\treturn lines.join(\"\\n\\n\").trim();\n}\n\nexport class McpManager {\n\tprivate config: McpResolvedConfig;\n\tprivate supervisors: Map<string, McpServerSupervisor>;\n\tprivate metadataCache: McpMetadataCache;\n\tprivate outputStore: McpOutputStore;\n\tprivate auditLogger: McpAuditLogger | undefined;\n\tprivate configWriter: McpConfigWriter | undefined;\n\tprivate oauthStore: McpOAuthStore | undefined;\n\tprivate pendingDeviceAuth: Map<string, McpOAuthPendingDeviceFlow> = new Map();\n\tprivate sessionId: string | undefined;\n\tprivate workspaceId: string | undefined;\n\tprivate eventListeners: Set<McpManagerEventListener> = new Set();\n\n\tconstructor(options: McpManagerOptions) {\n\t\tthis.config = options.config;\n\t\tthis.metadataCache = options.metadataCache;\n\t\tthis.outputStore = options.outputStore;\n\t\tthis.auditLogger = options.auditLogger;\n\t\tthis.configWriter = options.configWriter;\n\t\tthis.oauthStore = options.oauthStore;\n\t\tthis.sessionId = options.sessionId;\n\t\tthis.workspaceId = options.workspaceId;\n\t\tthis.supervisors = new Map(\n\t\t\tObject.values(this.config.servers).map((server) => [\n\t\t\t\tserver.id,\n\t\t\t\tnew McpServerSupervisor({\n\t\t\t\t\tserver,\n\t\t\t\t\tsettings: this.config.settings,\n\t\t\t\t\tclientFactory: options.clientFactory,\n\t\t\t\t\tmetadataCache: this.metadataCache,\n\t\t\t\t\toauthStore: this.oauthStore,\n\t\t\t\t\tonStateChanged: (supervisor) =>\n\t\t\t\t\t\tthis.emit({ type: \"mcp_server_status_changed\", server: supervisor.getSummary() }),\n\t\t\t\t}),\n\t\t\t]),\n\t\t);\n\t}\n\n\t/** Subscribe to MCP lifecycle events. Returns an unsubscribe function. */\n\tsubscribe(listener: McpManagerEventListener): () => void {\n\t\tthis.eventListeners.add(listener);\n\t\treturn () => {\n\t\t\tthis.eventListeners.delete(listener);\n\t\t};\n\t}\n\n\tprivate emit(event: McpManagerEvent): void {\n\t\tfor (const listener of this.eventListeners) {\n\t\t\ttry {\n\t\t\t\tlistener(event);\n\t\t\t} catch {\n\t\t\t\t// Listener failures must never break MCP operations.\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate emitAuthUpdate(serverId: string, status: string, message?: string): void {\n\t\tconst supervisor = this.supervisors.get(serverId);\n\t\tthis.emit({\n\t\t\ttype: \"mcp_auth_update\",\n\t\t\tserverId,\n\t\t\tstatus,\n\t\t\tauthState: supervisor?.authState ?? \"none\",\n\t\t\t...(message ? { message } : {}),\n\t\t\t...(supervisor ? { server: supervisor.getSummary() } : {}),\n\t\t});\n\t}\n\n\tisEnabled(): boolean {\n\t\treturn this.config.settings.enabled && Object.keys(this.config.servers).length > 0;\n\t}\n\n\tgetDiagnostics() {\n\t\treturn [...this.config.diagnostics];\n\t}\n\n\tlistServers(): McpServerSummary[] {\n\t\treturn Array.from(this.supervisors.values(), (supervisor) => supervisor.getSummary());\n\t}\n\n\tgetServer(id: string): McpServerSummary {\n\t\treturn this.getSupervisor(id).getSummary();\n\t}\n\n\tgetDirectToolCandidates(): McpDirectToolCandidate[] {\n\t\tconst candidates: McpDirectToolCandidate[] = [];\n\t\tfor (const supervisor of this.supervisors.values()) {\n\t\t\tif (!supervisor.server.enabled) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tconst metadata = supervisor.cachedMetadata;\n\t\t\tif (!metadata || this.isSupervisorMetadataStale(supervisor, metadata)) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tfor (const tool of metadata.tools) {\n\t\t\t\tif (\n\t\t\t\t\t!serverMatchesToolFilters(supervisor.server, tool.name) ||\n\t\t\t\t\t!isDirectToolEnabled(supervisor.server.directTools, this.config.settings.directTools, tool.name)\n\t\t\t\t) {\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tcandidates.push({\n\t\t\t\t\tserver: supervisor.server.id,\n\t\t\t\t\ttool,\n\t\t\t\t\trisk: classifyMcpToolRisk(tool),\n\t\t\t\t\tmetadataHash: metadata.metadataHash,\n\t\t\t\t\tlastSeenAt: metadata.lastSeenAt,\n\t\t\t\t\tdirectToolName: getMcpDirectToolName(supervisor.server.id, tool.name),\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t\treturn candidates;\n\t}\n\n\tasync startEagerServers(signal?: AbortSignal): Promise<void> {\n\t\tconst eager = Array.from(this.supervisors.values()).filter(\n\t\t\t(supervisor) =>\n\t\t\t\tsupervisor.server.enabled &&\n\t\t\t\t(supervisor.server.lifecycle === \"eager\" || supervisor.server.lifecycle === \"keep-alive\"),\n\t\t);\n\t\tawait Promise.allSettled(eager.map((supervisor) => supervisor.refreshMetadata(signal)));\n\t}\n\n\tasync dispose(): Promise<void> {\n\t\tawait Promise.allSettled(Array.from(this.supervisors.values(), (supervisor) => supervisor.disconnect()));\n\t}\n\n\tasync handleGatewayInput(\n\t\tinput: McpGatewayInput,\n\t\tcontext: McpGatewayExecutionContext,\n\t\tsignal?: AbortSignal,\n\t): Promise<unknown> {\n\t\tswitch (input.action) {\n\t\t\tcase \"status\":\n\t\t\t\treturn {\n\t\t\t\t\taction: \"status\",\n\t\t\t\t\tenabled: this.isEnabled(),\n\t\t\t\t\tdiagnostics: this.getDiagnostics(),\n\t\t\t\t\tservers: this.listServers(),\n\t\t\t\t};\n\t\t\tcase \"list_servers\":\n\t\t\t\treturn { action: \"list_servers\", servers: this.listServers() };\n\t\t\tcase \"search\":\n\t\t\t\treturn this.search(input.query ?? \"\", input.limit);\n\t\t\tcase \"describe\":\n\t\t\t\treturn this.describe(requireString(input.server, \"server\"), requireString(input.tool, \"tool\"), signal);\n\t\t\tcase \"connect\":\n\t\t\t\treturn this.connectServer(requireString(input.server, \"server\"), signal);\n\t\t\tcase \"disconnect\":\n\t\t\t\treturn this.disconnectServer(requireString(input.server, \"server\"));\n\t\t\tcase \"set_enabled\":\n\t\t\t\tif (typeof input.enabled !== \"boolean\") {\n\t\t\t\t\tthrow new Error(\"MCP enabled boolean is required\");\n\t\t\t\t}\n\t\t\t\treturn this.setServerEnabled(requireString(input.server, \"server\"), input.enabled);\n\t\t\tcase \"auth\":\n\t\t\t\tif (input.code) {\n\t\t\t\t\treturn this.completeServerBrowserAuth(requireString(input.server, \"server\"), {\n\t\t\t\t\t\tredirectUrl: requireString(input.redirectUrl, \"redirectUrl\"),\n\t\t\t\t\t\tcode: input.code,\n\t\t\t\t\t\tstate: input.state,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\treturn this.startServerAuth(requireString(input.server, \"server\"), {\n\t\t\t\t\tflow: input.flow,\n\t\t\t\t\tredirectUrl: input.redirectUrl,\n\t\t\t\t});\n\t\t\tcase \"poll_auth\":\n\t\t\t\treturn this.pollServerAuth(requireString(input.server, \"server\"));\n\t\t\tcase \"cancel_auth\":\n\t\t\t\treturn this.cancelServerAuth(requireString(input.server, \"server\"));\n\t\t\tcase \"logout\":\n\t\t\t\treturn this.logoutServer(requireString(input.server, \"server\"));\n\t\t\tcase \"list_tools\":\n\t\t\t\treturn this.listTools(requireString(input.server, \"server\"), signal);\n\t\t\tcase \"call\":\n\t\t\t\treturn this.callTool(input, context, signal);\n\t\t\tcase \"list_resources\":\n\t\t\t\treturn this.listResources(requireString(input.server, \"server\"), input.cursor, signal);\n\t\t\tcase \"read_resource\":\n\t\t\t\treturn this.readResource(\n\t\t\t\t\trequireString(input.server, \"server\"),\n\t\t\t\t\trequireString(input.resourceUri, \"resourceUri\"),\n\t\t\t\t\tcontext,\n\t\t\t\t\tsignal,\n\t\t\t\t);\n\t\t\tcase \"list_prompts\":\n\t\t\t\treturn this.listPrompts(requireString(input.server, \"server\"), input.cursor, signal);\n\t\t\tcase \"get_prompt\":\n\t\t\t\treturn this.getPrompt(\n\t\t\t\t\trequireString(input.server, \"server\"),\n\t\t\t\t\trequireString(input.prompt, \"prompt\"),\n\t\t\t\t\tinput,\n\t\t\t\t\tcontext,\n\t\t\t\t\tsignal,\n\t\t\t\t);\n\t\t\tcase \"read_cache\":\n\t\t\t\treturn this.readCache(requireString(input.cacheId, \"cacheId\"), input, context);\n\t\t}\n\t}\n\n\tasync connectServer(\n\t\tserverId: string,\n\t\tsignal?: AbortSignal,\n\t): Promise<{ action: \"connect\"; server: McpServerSummary }> {\n\t\tconst supervisor = this.getSupervisor(serverId);\n\t\tawait supervisor.refreshMetadata(signal);\n\t\treturn { action: \"connect\", server: supervisor.getSummary() };\n\t}\n\n\tasync disconnectServer(serverId: string): Promise<{ action: \"disconnect\"; server: McpServerSummary }> {\n\t\tconst supervisor = this.getSupervisor(serverId);\n\t\tawait supervisor.disconnect();\n\t\treturn { action: \"disconnect\", server: supervisor.getSummary() };\n\t}\n\n\tasync setServerEnabled(\n\t\tserverId: string,\n\t\tenabled: boolean,\n\t): Promise<{ action: \"set_enabled\"; server: McpServerSummary; persisted?: { path: string; scope: string } }> {\n\t\tconst supervisor = this.getSupervisor(serverId);\n\t\tif (!this.configWriter) {\n\t\t\tthrow new Error(\"MCP config persistence is not available\");\n\t\t}\n\t\tconst persisted = this.configWriter.setServerEnabled(supervisor.server, enabled);\n\t\tawait supervisor.setEnabled(enabled);\n\t\tthis.emit({ type: \"mcp_servers_changed\", servers: this.listServers() });\n\t\treturn { action: \"set_enabled\", server: supervisor.getSummary(), persisted };\n\t}\n\n\tasync startServerAuth(\n\t\tserverId: string,\n\t\toptions: { flow?: \"browser\" | \"device\"; redirectUrl?: string } = {},\n\t): Promise<unknown> {\n\t\tconst supervisor = this.requireOAuthSupervisor(serverId);\n\t\tif (!this.oauthStore) {\n\t\t\tthrow new Error(\"MCP OAuth storage is not available\");\n\t\t}\n\t\tconst flow = options.flow ?? supervisor.server.auth?.flow ?? \"browser\";\n\t\tif (flow === \"auto\") {\n\t\t\treturn this.startServerAuth(serverId, { ...options, flow: \"browser\" });\n\t\t}\n\t\tif (flow === \"device\") {\n\t\t\tconst { result, pending } = await startMcpOAuthDeviceAuth({\n\t\t\t\tserver: supervisor.server,\n\t\t\t\tstore: this.oauthStore,\n\t\t\t});\n\t\t\tthis.pendingDeviceAuth.set(serverId, pending);\n\t\t\tsupervisor.refreshAuthState();\n\t\t\tthis.emit({\n\t\t\t\ttype: \"mcp_auth_request\",\n\t\t\t\tserverId: supervisor.server.id,\n\t\t\t\tauth: {\n\t\t\t\t\tflow: \"device\",\n\t\t\t\t\tverificationUri: result.verificationUri,\n\t\t\t\t\t...(result.verificationUriComplete ? { verificationUriComplete: result.verificationUriComplete } : {}),\n\t\t\t\t\tuserCode: result.userCode,\n\t\t\t\t\texpiresAt: result.expiresAt,\n\t\t\t\t\tintervalMs: result.intervalMs,\n\t\t\t\t\tmessage: result.message,\n\t\t\t\t},\n\t\t\t});\n\t\t\treturn result;\n\t\t}\n\t\tconst redirectUrl = options.redirectUrl?.trim();\n\t\tif (!redirectUrl) {\n\t\t\tthrow new Error(\"MCP OAuth browser flow requires a redirectUrl\");\n\t\t}\n\t\tconst result = await startMcpOAuthBrowserAuth({\n\t\t\tserver: supervisor.server,\n\t\t\tstore: this.oauthStore,\n\t\t\tredirectUrl,\n\t\t});\n\t\tsupervisor.refreshAuthState();\n\t\tif (result.status === \"pending\") {\n\t\t\tthis.emit({\n\t\t\t\ttype: \"mcp_auth_request\",\n\t\t\t\tserverId: supervisor.server.id,\n\t\t\t\tauth: {\n\t\t\t\t\tflow: \"browser\",\n\t\t\t\t\t...(result.authorizationUrl ? { authorizationUrl: result.authorizationUrl } : {}),\n\t\t\t\t\tredirectUrl: result.redirectUrl,\n\t\t\t\t\tmessage: result.message,\n\t\t\t\t},\n\t\t\t});\n\t\t} else {\n\t\t\tthis.emitAuthUpdate(supervisor.server.id, result.status, result.message);\n\t\t}\n\t\treturn result;\n\t}\n\n\tasync completeServerBrowserAuth(\n\t\tserverId: string,\n\t\toptions: { redirectUrl: string; code: string; state?: string },\n\t): Promise<unknown> {\n\t\tconst supervisor = this.requireOAuthSupervisor(serverId);\n\t\tif (!this.oauthStore) {\n\t\t\tthrow new Error(\"MCP OAuth storage is not available\");\n\t\t}\n\t\tconst result = await completeMcpOAuthBrowserAuth({\n\t\t\tserver: supervisor.server,\n\t\t\tstore: this.oauthStore,\n\t\t\tredirectUrl: options.redirectUrl,\n\t\t\tcode: options.code,\n\t\t\tstate: options.state,\n\t\t});\n\t\tsupervisor.refreshAuthState();\n\t\tthis.emitAuthUpdate(supervisor.server.id, result.status, result.message);\n\t\treturn result;\n\t}\n\n\tasync pollServerAuth(serverId: string): Promise<unknown> {\n\t\tconst supervisor = this.requireOAuthSupervisor(serverId);\n\t\tif (!this.oauthStore) {\n\t\t\tthrow new Error(\"MCP OAuth storage is not available\");\n\t\t}\n\t\tconst pending = this.pendingDeviceAuth.get(serverId);\n\t\tif (!pending) {\n\t\t\tthrow new Error(`No pending MCP OAuth device flow for ${serverId}`);\n\t\t}\n\t\tconst { result, pending: nextPending } = await pollMcpOAuthDeviceAuth({\n\t\t\tserver: supervisor.server,\n\t\t\tstore: this.oauthStore,\n\t\t\tpending,\n\t\t});\n\t\tif (nextPending) {\n\t\t\tthis.pendingDeviceAuth.set(serverId, nextPending);\n\t\t} else {\n\t\t\tthis.pendingDeviceAuth.delete(serverId);\n\t\t}\n\t\tsupervisor.refreshAuthState();\n\t\tif (result.status !== \"pending\") {\n\t\t\tthis.emitAuthUpdate(supervisor.server.id, result.status, result.message);\n\t\t}\n\t\treturn result;\n\t}\n\n\tcancelServerAuth(serverId: string): { action: \"auth\"; server: string; status: \"cancelled\"; message: string } {\n\t\tthis.pendingDeviceAuth.delete(serverId);\n\t\tthis.emitAuthUpdate(serverId, \"cancelled\", \"MCP OAuth flow cancelled.\");\n\t\treturn { action: \"auth\", server: serverId, status: \"cancelled\", message: \"MCP OAuth flow cancelled.\" };\n\t}\n\n\tasync logoutServer(serverId: string): Promise<{\n\t\taction: \"auth\";\n\t\tserver: string;\n\t\tstatus: \"logged_out\";\n\t\tserverSummary: McpServerSummary;\n\t}> {\n\t\tconst supervisor = this.requireOAuthSupervisor(serverId);\n\t\tif (!this.oauthStore) {\n\t\t\tthrow new Error(\"MCP OAuth storage is not available\");\n\t\t}\n\t\tawait supervisor.disconnect();\n\t\tthis.oauthStore.clear(supervisor.server, \"all\");\n\t\tthis.pendingDeviceAuth.delete(serverId);\n\t\tsupervisor.refreshAuthState();\n\t\tthis.emitAuthUpdate(supervisor.server.id, \"logged_out\");\n\t\treturn {\n\t\t\taction: \"auth\",\n\t\t\tserver: serverId,\n\t\t\tstatus: \"logged_out\",\n\t\t\tserverSummary: supervisor.getSummary(),\n\t\t};\n\t}\n\n\tasync listTools(\n\t\tserverId: string,\n\t\tsignal?: AbortSignal,\n\t): Promise<{\n\t\taction: \"list_tools\";\n\t\tserver: string;\n\t\ttools: McpToolSummary[];\n\t\tmetadataHash?: string;\n\t\tstale: boolean;\n\t}> {\n\t\tconst supervisor = this.getSupervisor(serverId);\n\t\tconst metadata = await this.getFreshMetadata(supervisor, signal).catch(() => supervisor.cachedMetadata);\n\t\tif (!metadata) {\n\t\t\treturn { action: \"list_tools\", server: supervisor.server.id, tools: [], stale: true };\n\t\t}\n\t\tconst stale = this.isSupervisorMetadataStale(supervisor, metadata);\n\t\treturn {\n\t\t\taction: \"list_tools\",\n\t\t\tserver: supervisor.server.id,\n\t\t\ttools: toToolSummary(\n\t\t\t\tsupervisor.server.id,\n\t\t\t\tmetadata,\n\t\t\t\tsupervisor.server,\n\t\t\t\tthis.config.settings.directTools,\n\t\t\t\tstale,\n\t\t\t),\n\t\t\tmetadataHash: metadata.metadataHash,\n\t\t\tstale,\n\t\t};\n\t}\n\n\tsearch(\n\t\tquery: string,\n\t\tlimit?: number,\n\t): { action: \"search\"; query: string; matches: McpSearchMatch[]; notices?: string[] } {\n\t\tconst freshMetadata: McpServerMetadata[] = [];\n\t\tconst missingOrStale: string[] = [];\n\t\tfor (const supervisor of this.supervisors.values()) {\n\t\t\tconst metadata = supervisor.cachedMetadata;\n\t\t\tif (!metadata || this.isSupervisorMetadataStale(supervisor, metadata)) {\n\t\t\t\tmissingOrStale.push(supervisor.server.id);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tfreshMetadata.push(metadata);\n\t\t}\n\t\tconst matches = searchMcpMetadata({\n\t\t\tquery,\n\t\t\tlimit,\n\t\t\tservers: this.config.servers,\n\t\t\tmetadata: freshMetadata,\n\t\t});\n\t\treturn {\n\t\t\taction: \"search\",\n\t\t\tquery,\n\t\t\tmatches,\n\t\t\t...(missingOrStale.length > 0\n\t\t\t\t? {\n\t\t\t\t\t\tnotices: [\n\t\t\t\t\t\t\t`Metadata missing or stale for ${missingOrStale.join(\", \")}; use action=connect to refresh.`,\n\t\t\t\t\t\t],\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t};\n\t}\n\n\tasync describe(serverId: string, toolName: string, signal?: AbortSignal): Promise<unknown> {\n\t\tconst supervisor = this.getSupervisor(serverId);\n\t\tconst metadata = await this.getFreshMetadata(supervisor, signal).catch(() => supervisor.cachedMetadata);\n\t\tif (!metadata) {\n\t\t\treturn {\n\t\t\t\taction: \"describe\",\n\t\t\t\tserver: serverId,\n\t\t\t\ttool: toolName,\n\t\t\t\tstatus: \"metadata_missing\",\n\t\t\t\tmessage: `No cached metadata for ${serverId}. Use mcp({\"action\":\"connect\",\"server\":\"${serverId}\"}) first.`,\n\t\t\t};\n\t\t}\n\t\tconst tool = metadata.tools.find((entry) => entry.name === toolName);\n\t\tif (!tool) {\n\t\t\tthrow new Error(`MCP tool not found in cached metadata: ${serverId}.${toolName}`);\n\t\t}\n\t\treturn {\n\t\t\tserver: serverId,\n\t\t\ttool: tool.name,\n\t\t\tdescription: tool.description ?? \"\",\n\t\t\trisk: classifyMcpToolRisk(tool),\n\t\t\tinputSchema: tool.inputSchema,\n\t\t\tannotations: tool.annotations ?? {},\n\t\t\tmetadataHash: metadata.metadataHash,\n\t\t};\n\t}\n\n\tasync listResources(\n\t\tserverId: string,\n\t\tcursor: string | undefined,\n\t\tsignal?: AbortSignal,\n\t): Promise<{ action: \"list_resources\"; server: string; resources: McpResourceSummary[]; nextCursor?: string }> {\n\t\tif (this.config.settings.resources === \"disabled\") {\n\t\t\tthrow new Error(\"MCP resources are disabled by config\");\n\t\t}\n\t\tconst result = await this.getSupervisor(serverId).listResources(cursor, signal);\n\t\treturn {\n\t\t\taction: \"list_resources\",\n\t\t\tserver: serverId,\n\t\t\tresources: result.resources.map((resource) => ({\n\t\t\t\tserver: serverId,\n\t\t\t\turi: resource.uri,\n\t\t\t\tname: resource.name,\n\t\t\t\tdescription: compactText(resource.description),\n\t\t\t\tmimeType: resource.mimeType,\n\t\t\t\tsize: resource.size,\n\t\t\t})),\n\t\t\tnextCursor: result.nextCursor,\n\t\t};\n\t}\n\n\tasync readResource(\n\t\tserverId: string,\n\t\turi: string,\n\t\tcontext: McpGatewayExecutionContext,\n\t\tsignal?: AbortSignal,\n\t): Promise<unknown> {\n\t\tif (this.config.settings.resources === \"disabled\") {\n\t\t\tthrow new Error(\"MCP resources are disabled by config\");\n\t\t}\n\t\tconst startedAt = Date.now();\n\t\ttry {\n\t\t\tconst result = await this.getSupervisor(serverId).readResource(uri, signal);\n\t\t\tconst text = readResourceResultToText(result);\n\t\t\tconst shaped = this.outputStore.shapeOutput(text);\n\t\t\tawait this.writeAudit({\n\t\t\t\tcallerSurface: getCallerSurface(context),\n\t\t\t\tserver: serverId,\n\t\t\t\titem: uri,\n\t\t\t\tkind: \"resource\",\n\t\t\t\trisk: \"read\",\n\t\t\t\tstatus: \"completed\",\n\t\t\t\tdurationMs: Date.now() - startedAt,\n\t\t\t\tresultSize: byteLength(text),\n\t\t\t\tcacheId: shaped.cache?.id,\n\t\t\t});\n\t\t\treturn { action: \"read_resource\", server: serverId, resourceUri: uri, ...shaped };\n\t\t} catch (error) {\n\t\t\tawait this.writeAudit({\n\t\t\t\tcallerSurface: getCallerSurface(context),\n\t\t\t\tserver: serverId,\n\t\t\t\titem: uri,\n\t\t\t\tkind: \"resource\",\n\t\t\t\trisk: \"read\",\n\t\t\t\tstatus: signal?.aborted ? \"cancelled\" : \"failed\",\n\t\t\t\tdurationMs: Date.now() - startedAt,\n\t\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\t});\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync listPrompts(\n\t\tserverId: string,\n\t\tcursor: string | undefined,\n\t\tsignal?: AbortSignal,\n\t): Promise<{ action: \"list_prompts\"; server: string; prompts: McpPromptSummary[]; nextCursor?: string }> {\n\t\tif (this.config.settings.prompts === \"disabled\") {\n\t\t\tthrow new Error(\"MCP prompts are disabled by config\");\n\t\t}\n\t\tconst result = await this.getSupervisor(serverId).listPrompts(cursor, signal);\n\t\treturn {\n\t\t\taction: \"list_prompts\",\n\t\t\tserver: serverId,\n\t\t\tprompts: result.prompts.map((prompt) => ({\n\t\t\t\tserver: serverId,\n\t\t\t\tname: prompt.name,\n\t\t\t\ttitle: prompt.title,\n\t\t\t\tdescription: compactText(prompt.description),\n\t\t\t\targuments: prompt.arguments,\n\t\t\t})),\n\t\t\tnextCursor: result.nextCursor,\n\t\t};\n\t}\n\n\tasync getPrompt(\n\t\tserverId: string,\n\t\tname: string,\n\t\tinput: McpGatewayInput,\n\t\tcontext: McpGatewayExecutionContext,\n\t\tsignal?: AbortSignal,\n\t): Promise<unknown> {\n\t\tif (this.config.settings.prompts === \"disabled\") {\n\t\t\tthrow new Error(\"MCP prompts are disabled by config\");\n\t\t}\n\t\tif (context.caller !== \"user\" && this.config.settings.prompts !== \"model\") {\n\t\t\tthrow new Error('MCP prompt content is not exposed to the model unless settings.prompts is \"model\"');\n\t\t}\n\t\tconst args = parseArguments(input);\n\t\tconst startedAt = Date.now();\n\t\ttry {\n\t\t\tconst result = await this.getSupervisor(serverId).getPrompt(name, args, signal);\n\t\t\tconst text = getPromptResultToText(result);\n\t\t\tconst shaped = this.outputStore.shapeOutput(text);\n\t\t\tawait this.writeAudit({\n\t\t\t\tcallerSurface: getCallerSurface(context),\n\t\t\t\tserver: serverId,\n\t\t\t\titem: name,\n\t\t\t\tkind: \"prompt\",\n\t\t\t\trisk: \"read\",\n\t\t\t\tstatus: \"completed\",\n\t\t\t\tdurationMs: Date.now() - startedAt,\n\t\t\t\tresultSize: byteLength(text),\n\t\t\t\tcacheId: shaped.cache?.id,\n\t\t\t\targuments: args,\n\t\t\t});\n\t\t\treturn { action: \"get_prompt\", server: serverId, prompt: name, ...shaped };\n\t\t} catch (error) {\n\t\t\tawait this.writeAudit({\n\t\t\t\tcallerSurface: getCallerSurface(context),\n\t\t\t\tserver: serverId,\n\t\t\t\titem: name,\n\t\t\t\tkind: \"prompt\",\n\t\t\t\trisk: \"read\",\n\t\t\t\tstatus: signal?.aborted ? \"cancelled\" : \"failed\",\n\t\t\t\tdurationMs: Date.now() - startedAt,\n\t\t\t\targuments: args,\n\t\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\t});\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync readCache(\n\t\tcacheId: string,\n\t\tinput: Pick<McpGatewayInput, \"cursor\" | \"limit\">,\n\t\tcontext: McpGatewayExecutionContext,\n\t): Promise<unknown> {\n\t\tconst startedAt = Date.now();\n\t\ttry {\n\t\t\tconst chunk = this.outputStore.read(cacheId, input);\n\t\t\tawait this.writeAudit({\n\t\t\t\tcallerSurface: getCallerSurface(context),\n\t\t\t\tserver: \"cache\",\n\t\t\t\titem: cacheId,\n\t\t\t\tkind: \"cache\",\n\t\t\t\trisk: \"read\",\n\t\t\t\tstatus: \"completed\",\n\t\t\t\tdurationMs: Date.now() - startedAt,\n\t\t\t\tresultSize: byteLength(chunk.content),\n\t\t\t\tcacheId,\n\t\t\t});\n\t\t\treturn { action: \"read_cache\", ...chunk };\n\t\t} catch (error) {\n\t\t\tawait this.writeAudit({\n\t\t\t\tcallerSurface: getCallerSurface(context),\n\t\t\t\tserver: \"cache\",\n\t\t\t\titem: cacheId,\n\t\t\t\tkind: \"cache\",\n\t\t\t\trisk: \"read\",\n\t\t\t\tstatus: \"failed\",\n\t\t\t\tdurationMs: Date.now() - startedAt,\n\t\t\t\tcacheId,\n\t\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\t});\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync callTool(\n\t\tinput: McpGatewayInput,\n\t\tcontext: McpGatewayExecutionContext,\n\t\tsignal?: AbortSignal,\n\t): Promise<McpGatewayCallResult> {\n\t\tconst serverId = requireString(input.server, \"server\");\n\t\tconst toolName = requireString(input.tool, \"tool\");\n\t\tconst args = parseArguments(input);\n\t\tconst supervisor = this.getSupervisor(serverId);\n\t\tconst metadata = await this.getFreshMetadata(supervisor, signal);\n\t\tconst tool = metadata.tools.find((entry) => entry.name === toolName);\n\t\tif (!tool || !serverMatchesToolFilters(supervisor.server, tool.name)) {\n\t\t\tthrow new Error(`MCP tool not available: ${serverId}.${toolName}`);\n\t\t}\n\t\tconst risk = classifyMcpToolRisk(tool);\n\t\tconst callId = makeCallId();\n\t\tconst startedAt = Date.now();\n\t\tlet status: McpRecentCallStatus = \"completed\";\n\t\tthis.emit({\n\t\t\ttype: \"mcp_call_start\",\n\t\t\tcall: {\n\t\t\t\tid: callId,\n\t\t\t\ttimestamp: new Date(startedAt).toISOString(),\n\t\t\t\tserver: serverId,\n\t\t\t\ttool: toolName,\n\t\t\t\trisk,\n\t\t\t\tstatus: \"started\",\n\t\t\t},\n\t\t});\n\t\ttry {\n\t\t\tconst result = await supervisor.callTool(toolName, args, signal, (progress) =>\n\t\t\t\tthis.emit({\n\t\t\t\t\ttype: \"mcp_call_update\",\n\t\t\t\t\tcall: { id: callId, server: serverId, tool: toolName },\n\t\t\t\t\tprogress,\n\t\t\t\t}),\n\t\t\t);\n\t\t\tconst text = callToolResultToText(result);\n\t\t\tconst shaped = this.outputStore.shapeOutput(text);\n\t\t\tstatus = result.isError ? \"failed\" : \"completed\";\n\t\t\tconst outputBytes = byteLength(text);\n\t\t\tconst recent = {\n\t\t\t\tid: callId,\n\t\t\t\ttimestamp: new Date(startedAt).toISOString(),\n\t\t\t\tserver: serverId,\n\t\t\t\ttool: toolName,\n\t\t\t\trisk,\n\t\t\t\tstatus,\n\t\t\t\tdurationMs: Date.now() - startedAt,\n\t\t\t\toutputBytes,\n\t\t\t\ttruncated: shaped.truncation?.truncated ?? false,\n\t\t\t};\n\t\t\tsupervisor.recordCall(recent);\n\t\t\tthis.emit({\n\t\t\t\ttype: \"mcp_call_end\",\n\t\t\t\tcall: recent,\n\t\t\t\t...(shaped.cache ? { cacheId: shaped.cache.id } : {}),\n\t\t\t});\n\t\t\tawait this.writeAudit({\n\t\t\t\tcallerSurface: getCallerSurface(context),\n\t\t\t\tserver: serverId,\n\t\t\t\titem: toolName,\n\t\t\t\tkind: \"tool\",\n\t\t\t\trisk,\n\t\t\t\tstatus,\n\t\t\t\tdurationMs: recent.durationMs,\n\t\t\t\tresultSize: outputBytes,\n\t\t\t\tcacheId: shaped.cache?.id,\n\t\t\t\targuments: args,\n\t\t\t});\n\t\t\treturn {\n\t\t\t\taction: \"call\",\n\t\t\t\tserver: serverId,\n\t\t\t\ttool: toolName,\n\t\t\t\tstatus: result.isError ? \"failed\" : \"completed\",\n\t\t\t\trisk,\n\t\t\t\tcontent: shaped.content,\n\t\t\t\t...(result.isError ? { isError: true } : {}),\n\t\t\t\t...(shaped.truncation ? { truncation: shaped.truncation } : {}),\n\t\t\t\t...(shaped.cache ? { cache: shaped.cache } : {}),\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tstatus = signal?.aborted ? \"cancelled\" : \"failed\";\n\t\t\tconst durationMs = Date.now() - startedAt;\n\t\t\tconst recent = {\n\t\t\t\tid: callId,\n\t\t\t\ttimestamp: new Date(startedAt).toISOString(),\n\t\t\t\tserver: serverId,\n\t\t\t\ttool: toolName,\n\t\t\t\trisk,\n\t\t\t\tstatus,\n\t\t\t\tdurationMs,\n\t\t\t};\n\t\t\tsupervisor.recordCall(recent);\n\t\t\tthis.emit({ type: \"mcp_call_end\", call: recent });\n\t\t\tawait this.writeAudit({\n\t\t\t\tcallerSurface: getCallerSurface(context),\n\t\t\t\tserver: serverId,\n\t\t\t\titem: toolName,\n\t\t\t\tkind: \"tool\",\n\t\t\t\trisk,\n\t\t\t\tstatus,\n\t\t\t\tdurationMs,\n\t\t\t\targuments: args,\n\t\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\t});\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tprivate isSupervisorMetadataStale(\n\t\tsupervisor: McpServerSupervisor,\n\t\tmetadata: McpServerMetadata | undefined,\n\t): boolean {\n\t\tif (metadata && metadata.configHash !== hashMcpServerConfig(supervisor.server)) {\n\t\t\treturn true;\n\t\t}\n\t\treturn isMetadataStale(metadata, getServerTimeoutMs(supervisor.server, this.config.settings, \"refresh\"));\n\t}\n\n\tprivate async getFreshMetadata(supervisor: McpServerSupervisor, signal?: AbortSignal): Promise<McpServerMetadata> {\n\t\tconst cached = supervisor.cachedMetadata;\n\t\tif (cached && !this.isSupervisorMetadataStale(supervisor, cached)) {\n\t\t\treturn cached;\n\t\t}\n\t\treturn supervisor.refreshMetadata(signal);\n\t}\n\n\tprivate getSupervisor(serverId: string): McpServerSupervisor {\n\t\tconst normalized = serverId.trim().toLowerCase();\n\t\tconst supervisor = this.supervisors.get(normalized) ?? this.supervisors.get(serverId);\n\t\tif (!supervisor) {\n\t\t\tthrow new Error(`MCP server not found: ${serverId}`);\n\t\t}\n\t\treturn supervisor;\n\t}\n\n\tprivate requireOAuthSupervisor(serverId: string): McpServerSupervisor {\n\t\tconst supervisor = this.getSupervisor(serverId);\n\t\tif (supervisor.server.auth?.type !== \"oauth\") {\n\t\t\tthrow new Error(`MCP server does not use OAuth: ${serverId}`);\n\t\t}\n\t\tif (supervisor.server.transport === \"stdio\") {\n\t\t\tthrow new Error(`MCP OAuth is only available for HTTP/SSE servers: ${serverId}`);\n\t\t}\n\t\treturn supervisor;\n\t}\n\n\tprivate async writeAudit(input: {\n\t\tcallerSurface: McpCallerSurface;\n\t\tserver: string;\n\t\titem: string;\n\t\tkind: \"tool\" | \"resource\" | \"prompt\" | \"cache\";\n\t\trisk: McpRisk;\n\t\tstatus: McpRecentCallStatus;\n\t\tdurationMs?: number;\n\t\tresultSize?: number;\n\t\tcacheId?: string;\n\t\targuments?: Record<string, unknown>;\n\t\terror?: string;\n\t}): Promise<void> {\n\t\tawait this.auditLogger?.write({\n\t\t\t...input,\n\t\t\tworkspaceId: this.workspaceId,\n\t\t\tsessionId: this.sessionId,\n\t\t});\n\t}\n}\n"]}