@hansjm10/volt-coding-agent 0.0.0-bootstrap.0 → 0.1.0

package/dist/core/mcp/manager.js

@@ -0,0 +1,819 @@
+import { randomUUID } from "node:crypto";
+import { getMcpDirectToolName, getServerTimeoutMs, hashMcpServerConfig, serverMatchesToolFilters } from "./config.js";
+import { completeMcpOAuthBrowserAuth, pollMcpOAuthDeviceAuth, startMcpOAuthBrowserAuth, startMcpOAuthDeviceAuth, } from "./oauth-flow.js";
+import { classifyMcpToolRisk } from "./safety.js";
+import { searchMcpMetadata } from "./search.js";
+import { McpServerSupervisor } from "./server-supervisor.js";
+function byteLength(value) {
+    return Buffer.byteLength(value, "utf-8");
+}
+function compactText(value, maxLength = 220) {
+    const normalized = (value ?? "").replace(/\s+/g, " ").trim();
+    if (!normalized) {
+        return "";
+    }
+    return normalized.length <= maxLength ? normalized : `${normalized.slice(0, maxLength - 3)}...`;
+}
+function parseArguments(input) {
+    if (input.arguments !== undefined) {
+        return input.arguments;
+    }
+    if (input.argumentsJson !== undefined) {
+        const parsed = JSON.parse(input.argumentsJson);
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+            throw new Error("MCP argumentsJson must parse to an object");
+        }
+        return parsed;
+    }
+    return {};
+}
+function requireString(value, label) {
+    const trimmed = value?.trim();
+    if (!trimmed) {
+        throw new Error(`MCP ${label} is required`);
+    }
+    return trimmed;
+}
+function makeCallId() {
+    return `mcpcall_${randomUUID().replace(/-/g, "")}`;
+}
+function getCallerSurface(ctx) {
+    if (ctx.mode === "tui")
+        return "tui";
+    if (ctx.mode === "rpc")
+        return "rpc";
+    if (ctx.mode === "print")
+        return "print";
+    if (ctx.mode === "json")
+        return "json";
+    return "unknown";
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isMetadataStale(metadata, maxAgeMs) {
+    if (!metadata) {
+        return true;
+    }
+    const lastSeenAt = Date.parse(metadata.lastSeenAt);
+    if (!Number.isFinite(lastSeenAt)) {
+        return true;
+    }
+    return Date.now() - lastSeenAt > maxAgeMs;
+}
+function isDirectToolEnabled(serverDirectTools, settingsDirectTools, toolName) {
+    if (Array.isArray(serverDirectTools)) {
+        return serverDirectTools.includes(toolName);
+    }
+    return serverDirectTools || settingsDirectTools;
+}
+function toToolSummary(serverId, metadata, server, settingsDirectTools, stale) {
+    return metadata.tools.map((tool) => ({
+        server: serverId,
+        name: tool.name,
+        ...(tool.title ? { title: tool.title } : {}),
+        ...(tool.description ? { description: compactText(tool.description, 800) } : {}),
+        risk: classifyMcpToolRisk(tool),
+        inputSchema: tool.inputSchema,
+        ...(tool.outputSchema ? { outputSchema: tool.outputSchema } : {}),
+        ...(tool.annotations ? { annotations: tool.annotations } : {}),
+        metadataHash: metadata.metadataHash,
+        lastSeenAt: metadata.lastSeenAt,
+        stale,
+        direct: isDirectToolEnabled(server.directTools, settingsDirectTools, tool.name),
+    }));
+}
+function contentPartToText(part) {
+    if (!isRecord(part) || typeof part.type !== "string") {
+        return undefined;
+    }
+    if (part.type === "text" && typeof part.text === "string") {
+        return part.text;
+    }
+    if (part.type === "image") {
+        const mimeType = typeof part.mimeType === "string" ? part.mimeType : "image/unknown";
+        const data = typeof part.data === "string" ? part.data : "";
+        return `[MCP image: ${mimeType}, ${data.length} base64 chars]`;
+    }
+    if (part.type === "audio") {
+        const mimeType = typeof part.mimeType === "string" ? part.mimeType : "audio/unknown";
+        const data = typeof part.data === "string" ? part.data : "";
+        return `[MCP audio: ${mimeType}, ${data.length} base64 chars]`;
+    }
+    if (part.type === "resource" && isRecord(part.resource)) {
+        const resource = part.resource;
+        const uri = typeof resource.uri === "string" ? resource.uri : "resource";
+        if (typeof resource.text === "string") {
+            return `[MCP resource ${uri}]\n${resource.text}`;
+        }
+        if (typeof resource.blob === "string") {
+            return `[MCP binary resource ${uri}: ${resource.blob.length} base64 chars]`;
+        }
+    }
+    if (part.type === "resource_link") {
+        const uri = typeof part.uri === "string" ? part.uri : "";
+        const name = typeof part.name === "string" ? part.name : "resource";
+        return `[MCP resource link: ${name}${uri ? ` ${uri}` : ""}]`;
+    }
+    return `[Unsupported MCP content: ${part.type}]`;
+}
+function callToolResultToText(result) {
+    const parts = result.content.map(contentPartToText).filter((part) => part !== undefined);
+    if (result.structuredContent !== undefined) {
+        parts.push(`Structured content:\n${JSON.stringify(result.structuredContent, null, 2)}`);
+    }
+    return parts.join("\n\n").trim() || "(no MCP tool output)";
+}
+function readResourceResultToText(result) {
+    return result.contents
+        .map((content) => {
+        if ("text" in content) {
+            return `[${content.uri}]\n${content.text}`;
+        }
+        return `[${content.uri}] binary ${content.blob.length} base64 chars`;
+    })
+        .join("\n\n");
+}
+function getPromptResultToText(result) {
+    const lines = [];
+    if (result.description) {
+        lines.push(result.description);
+    }
+    for (const message of result.messages) {
+        lines.push(`## ${message.role}`);
+        const content = message.content;
+        const text = contentPartToText(content);
+        lines.push(text ?? JSON.stringify(content));
+    }
+    return lines.join("\n\n").trim();
+}
+export class McpManager {
+    config;
+    supervisors;
+    metadataCache;
+    outputStore;
+    auditLogger;
+    configWriter;
+    oauthStore;
+    pendingDeviceAuth = new Map();
+    sessionId;
+    workspaceId;
+    eventListeners = new Set();
+    constructor(options) {
+        this.config = options.config;
+        this.metadataCache = options.metadataCache;
+        this.outputStore = options.outputStore;
+        this.auditLogger = options.auditLogger;
+        this.configWriter = options.configWriter;
+        this.oauthStore = options.oauthStore;
+        this.sessionId = options.sessionId;
+        this.workspaceId = options.workspaceId;
+        this.supervisors = new Map(Object.values(this.config.servers).map((server) => [
+            server.id,
+            new McpServerSupervisor({
+                server,
+                settings: this.config.settings,
+                clientFactory: options.clientFactory,
+                metadataCache: this.metadataCache,
+                oauthStore: this.oauthStore,
+                onStateChanged: (supervisor) => this.emit({ type: "mcp_server_status_changed", server: supervisor.getSummary() }),
+            }),
+        ]));
+    }
+    /** Subscribe to MCP lifecycle events. Returns an unsubscribe function. */
+    subscribe(listener) {
+        this.eventListeners.add(listener);
+        return () => {
+            this.eventListeners.delete(listener);
+        };
+    }
+    emit(event) {
+        for (const listener of this.eventListeners) {
+            try {
+                listener(event);
+            }
+            catch {
+                // Listener failures must never break MCP operations.
+            }
+        }
+    }
+    emitAuthUpdate(serverId, status, message) {
+        const supervisor = this.supervisors.get(serverId);
+        this.emit({
+            type: "mcp_auth_update",
+            serverId,
+            status,
+            authState: supervisor?.authState ?? "none",
+            ...(message ? { message } : {}),
+            ...(supervisor ? { server: supervisor.getSummary() } : {}),
+        });
+    }
+    isEnabled() {
+        return this.config.settings.enabled && Object.keys(this.config.servers).length > 0;
+    }
+    getDiagnostics() {
+        return [...this.config.diagnostics];
+    }
+    listServers() {
+        return Array.from(this.supervisors.values(), (supervisor) => supervisor.getSummary());
+    }
+    getServer(id) {
+        return this.getSupervisor(id).getSummary();
+    }
+    getDirectToolCandidates() {
+        const candidates = [];
+        for (const supervisor of this.supervisors.values()) {
+            if (!supervisor.server.enabled) {
+                continue;
+            }
+            const metadata = supervisor.cachedMetadata;
+            if (!metadata || this.isSupervisorMetadataStale(supervisor, metadata)) {
+                continue;
+            }
+            for (const tool of metadata.tools) {
+                if (!serverMatchesToolFilters(supervisor.server, tool.name) ||
+                    !isDirectToolEnabled(supervisor.server.directTools, this.config.settings.directTools, tool.name)) {
+                    continue;
+                }
+                candidates.push({
+                    server: supervisor.server.id,
+                    tool,
+                    risk: classifyMcpToolRisk(tool),
+                    metadataHash: metadata.metadataHash,
+                    lastSeenAt: metadata.lastSeenAt,
+                    directToolName: getMcpDirectToolName(supervisor.server.id, tool.name),
+                });
+            }
+        }
+        return candidates;
+    }
+    async startEagerServers(signal) {
+        const eager = Array.from(this.supervisors.values()).filter((supervisor) => supervisor.server.enabled &&
+            (supervisor.server.lifecycle === "eager" || supervisor.server.lifecycle === "keep-alive"));
+        await Promise.allSettled(eager.map((supervisor) => supervisor.refreshMetadata(signal)));
+    }
+    async dispose() {
+        await Promise.allSettled(Array.from(this.supervisors.values(), (supervisor) => supervisor.disconnect()));
+    }
+    async handleGatewayInput(input, context, signal) {
+        switch (input.action) {
+            case "status":
+                return {
+                    action: "status",
+                    enabled: this.isEnabled(),
+                    diagnostics: this.getDiagnostics(),
+                    servers: this.listServers(),
+                };
+            case "list_servers":
+                return { action: "list_servers", servers: this.listServers() };
+            case "search":
+                return this.search(input.query ?? "", input.limit);
+            case "describe":
+                return this.describe(requireString(input.server, "server"), requireString(input.tool, "tool"), signal);
+            case "connect":
+                return this.connectServer(requireString(input.server, "server"), signal);
+            case "disconnect":
+                return this.disconnectServer(requireString(input.server, "server"));
+            case "set_enabled":
+                if (typeof input.enabled !== "boolean") {
+                    throw new Error("MCP enabled boolean is required");
+                }
+                return this.setServerEnabled(requireString(input.server, "server"), input.enabled);
+            case "auth":
+                if (input.code) {
+                    return this.completeServerBrowserAuth(requireString(input.server, "server"), {
+                        redirectUrl: requireString(input.redirectUrl, "redirectUrl"),
+                        code: input.code,
+                        state: input.state,
+                    });
+                }
+                return this.startServerAuth(requireString(input.server, "server"), {
+                    flow: input.flow,
+                    redirectUrl: input.redirectUrl,
+                });
+            case "poll_auth":
+                return this.pollServerAuth(requireString(input.server, "server"));
+            case "cancel_auth":
+                return this.cancelServerAuth(requireString(input.server, "server"));
+            case "logout":
+                return this.logoutServer(requireString(input.server, "server"));
+            case "list_tools":
+                return this.listTools(requireString(input.server, "server"), signal);
+            case "call":
+                return this.callTool(input, context, signal);
+            case "list_resources":
+                return this.listResources(requireString(input.server, "server"), input.cursor, signal);
+            case "read_resource":
+                return this.readResource(requireString(input.server, "server"), requireString(input.resourceUri, "resourceUri"), context, signal);
+            case "list_prompts":
+                return this.listPrompts(requireString(input.server, "server"), input.cursor, signal);
+            case "get_prompt":
+                return this.getPrompt(requireString(input.server, "server"), requireString(input.prompt, "prompt"), input, context, signal);
+            case "read_cache":
+                return this.readCache(requireString(input.cacheId, "cacheId"), input, context);
+        }
+    }
+    async connectServer(serverId, signal) {
+        const supervisor = this.getSupervisor(serverId);
+        await supervisor.refreshMetadata(signal);
+        return { action: "connect", server: supervisor.getSummary() };
+    }
+    async disconnectServer(serverId) {
+        const supervisor = this.getSupervisor(serverId);
+        await supervisor.disconnect();
+        return { action: "disconnect", server: supervisor.getSummary() };
+    }
+    async setServerEnabled(serverId, enabled) {
+        const supervisor = this.getSupervisor(serverId);
+        if (!this.configWriter) {
+            throw new Error("MCP config persistence is not available");
+        }
+        const persisted = this.configWriter.setServerEnabled(supervisor.server, enabled);
+        await supervisor.setEnabled(enabled);
+        this.emit({ type: "mcp_servers_changed", servers: this.listServers() });
+        return { action: "set_enabled", server: supervisor.getSummary(), persisted };
+    }
+    async startServerAuth(serverId, options = {}) {
+        const supervisor = this.requireOAuthSupervisor(serverId);
+        if (!this.oauthStore) {
+            throw new Error("MCP OAuth storage is not available");
+        }
+        const flow = options.flow ?? supervisor.server.auth?.flow ?? "browser";
+        if (flow === "auto") {
+            return this.startServerAuth(serverId, { ...options, flow: "browser" });
+        }
+        if (flow === "device") {
+            const { result, pending } = await startMcpOAuthDeviceAuth({
+                server: supervisor.server,
+                store: this.oauthStore,
+            });
+            this.pendingDeviceAuth.set(serverId, pending);
+            supervisor.refreshAuthState();
+            this.emit({
+                type: "mcp_auth_request",
+                serverId: supervisor.server.id,
+                auth: {
+                    flow: "device",
+                    verificationUri: result.verificationUri,
+                    ...(result.verificationUriComplete ? { verificationUriComplete: result.verificationUriComplete } : {}),
+                    userCode: result.userCode,
+                    expiresAt: result.expiresAt,
+                    intervalMs: result.intervalMs,
+                    message: result.message,
+                },
+            });
+            return result;
+        }
+        const redirectUrl = options.redirectUrl?.trim();
+        if (!redirectUrl) {
+            throw new Error("MCP OAuth browser flow requires a redirectUrl");
+        }
+        const result = await startMcpOAuthBrowserAuth({
+            server: supervisor.server,
+            store: this.oauthStore,
+            redirectUrl,
+        });
+        supervisor.refreshAuthState();
+        if (result.status === "pending") {
+            this.emit({
+                type: "mcp_auth_request",
+                serverId: supervisor.server.id,
+                auth: {
+                    flow: "browser",
+                    ...(result.authorizationUrl ? { authorizationUrl: result.authorizationUrl } : {}),
+                    redirectUrl: result.redirectUrl,
+                    message: result.message,
+                },
+            });
+        }
+        else {
+            this.emitAuthUpdate(supervisor.server.id, result.status, result.message);
+        }
+        return result;
+    }
+    async completeServerBrowserAuth(serverId, options) {
+        const supervisor = this.requireOAuthSupervisor(serverId);
+        if (!this.oauthStore) {
+            throw new Error("MCP OAuth storage is not available");
+        }
+        const result = await completeMcpOAuthBrowserAuth({
+            server: supervisor.server,
+            store: this.oauthStore,
+            redirectUrl: options.redirectUrl,
+            code: options.code,
+            state: options.state,
+        });
+        supervisor.refreshAuthState();
+        this.emitAuthUpdate(supervisor.server.id, result.status, result.message);
+        return result;
+    }
+    async pollServerAuth(serverId) {
+        const supervisor = this.requireOAuthSupervisor(serverId);
+        if (!this.oauthStore) {
+            throw new Error("MCP OAuth storage is not available");
+        }
+        const pending = this.pendingDeviceAuth.get(serverId);
+        if (!pending) {
+            throw new Error(`No pending MCP OAuth device flow for ${serverId}`);
+        }
+        const { result, pending: nextPending } = await pollMcpOAuthDeviceAuth({
+            server: supervisor.server,
+            store: this.oauthStore,
+            pending,
+        });
+        if (nextPending) {
+            this.pendingDeviceAuth.set(serverId, nextPending);
+        }
+        else {
+            this.pendingDeviceAuth.delete(serverId);
+        }
+        supervisor.refreshAuthState();
+        if (result.status !== "pending") {
+            this.emitAuthUpdate(supervisor.server.id, result.status, result.message);
+        }
+        return result;
+    }
+    cancelServerAuth(serverId) {
+        this.pendingDeviceAuth.delete(serverId);
+        this.emitAuthUpdate(serverId, "cancelled", "MCP OAuth flow cancelled.");
+        return { action: "auth", server: serverId, status: "cancelled", message: "MCP OAuth flow cancelled." };
+    }
+    async logoutServer(serverId) {
+        const supervisor = this.requireOAuthSupervisor(serverId);
+        if (!this.oauthStore) {
+            throw new Error("MCP OAuth storage is not available");
+        }
+        await supervisor.disconnect();
+        this.oauthStore.clear(supervisor.server, "all");
+        this.pendingDeviceAuth.delete(serverId);
+        supervisor.refreshAuthState();
+        this.emitAuthUpdate(supervisor.server.id, "logged_out");
+        return {
+            action: "auth",
+            server: serverId,
+            status: "logged_out",
+            serverSummary: supervisor.getSummary(),
+        };
+    }
+    async listTools(serverId, signal) {
+        const supervisor = this.getSupervisor(serverId);
+        const metadata = await this.getFreshMetadata(supervisor, signal).catch(() => supervisor.cachedMetadata);
+        if (!metadata) {
+            return { action: "list_tools", server: supervisor.server.id, tools: [], stale: true };
+        }
+        const stale = this.isSupervisorMetadataStale(supervisor, metadata);
+        return {
+            action: "list_tools",
+            server: supervisor.server.id,
+            tools: toToolSummary(supervisor.server.id, metadata, supervisor.server, this.config.settings.directTools, stale),
+            metadataHash: metadata.metadataHash,
+            stale,
+        };
+    }
+    search(query, limit) {
+        const freshMetadata = [];
+        const missingOrStale = [];
+        for (const supervisor of this.supervisors.values()) {
+            const metadata = supervisor.cachedMetadata;
+            if (!metadata || this.isSupervisorMetadataStale(supervisor, metadata)) {
+                missingOrStale.push(supervisor.server.id);
+                continue;
+            }
+            freshMetadata.push(metadata);
+        }
+        const matches = searchMcpMetadata({
+            query,
+            limit,
+            servers: this.config.servers,
+            metadata: freshMetadata,
+        });
+        return {
+            action: "search",
+            query,
+            matches,
+            ...(missingOrStale.length > 0
+                ? {
+                    notices: [
+                        `Metadata missing or stale for ${missingOrStale.join(", ")}; use action=connect to refresh.`,
+                    ],
+                }
+                : {}),
+        };
+    }
+    async describe(serverId, toolName, signal) {
+        const supervisor = this.getSupervisor(serverId);
+        const metadata = await this.getFreshMetadata(supervisor, signal).catch(() => supervisor.cachedMetadata);
+        if (!metadata) {
+            return {
+                action: "describe",
+                server: serverId,
+                tool: toolName,
+                status: "metadata_missing",
+                message: `No cached metadata for ${serverId}. Use mcp({"action":"connect","server":"${serverId}"}) first.`,
+            };
+        }
+        const tool = metadata.tools.find((entry) => entry.name === toolName);
+        if (!tool) {
+            throw new Error(`MCP tool not found in cached metadata: ${serverId}.${toolName}`);
+        }
+        return {
+            server: serverId,
+            tool: tool.name,
+            description: tool.description ?? "",
+            risk: classifyMcpToolRisk(tool),
+            inputSchema: tool.inputSchema,
+            annotations: tool.annotations ?? {},
+            metadataHash: metadata.metadataHash,
+        };
+    }
+    async listResources(serverId, cursor, signal) {
+        if (this.config.settings.resources === "disabled") {
+            throw new Error("MCP resources are disabled by config");
+        }
+        const result = await this.getSupervisor(serverId).listResources(cursor, signal);
+        return {
+            action: "list_resources",
+            server: serverId,
+            resources: result.resources.map((resource) => ({
+                server: serverId,
+                uri: resource.uri,
+                name: resource.name,
+                description: compactText(resource.description),
+                mimeType: resource.mimeType,
+                size: resource.size,
+            })),
+            nextCursor: result.nextCursor,
+        };
+    }
+    async readResource(serverId, uri, context, signal) {
+        if (this.config.settings.resources === "disabled") {
+            throw new Error("MCP resources are disabled by config");
+        }
+        const startedAt = Date.now();
+        try {
+            const result = await this.getSupervisor(serverId).readResource(uri, signal);
+            const text = readResourceResultToText(result);
+            const shaped = this.outputStore.shapeOutput(text);
+            await this.writeAudit({
+                callerSurface: getCallerSurface(context),
+                server: serverId,
+                item: uri,
+                kind: "resource",
+                risk: "read",
+                status: "completed",
+                durationMs: Date.now() - startedAt,
+                resultSize: byteLength(text),
+                cacheId: shaped.cache?.id,
+            });
+            return { action: "read_resource", server: serverId, resourceUri: uri, ...shaped };
+        }
+        catch (error) {
+            await this.writeAudit({
+                callerSurface: getCallerSurface(context),
+                server: serverId,
+                item: uri,
+                kind: "resource",
+                risk: "read",
+                status: signal?.aborted ? "cancelled" : "failed",
+                durationMs: Date.now() - startedAt,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            throw error;
+        }
+    }
+    async listPrompts(serverId, cursor, signal) {
+        if (this.config.settings.prompts === "disabled") {
+            throw new Error("MCP prompts are disabled by config");
+        }
+        const result = await this.getSupervisor(serverId).listPrompts(cursor, signal);
+        return {
+            action: "list_prompts",
+            server: serverId,
+            prompts: result.prompts.map((prompt) => ({
+                server: serverId,
+                name: prompt.name,
+                title: prompt.title,
+                description: compactText(prompt.description),
+                arguments: prompt.arguments,
+            })),
+            nextCursor: result.nextCursor,
+        };
+    }
+    async getPrompt(serverId, name, input, context, signal) {
+        if (this.config.settings.prompts === "disabled") {
+            throw new Error("MCP prompts are disabled by config");
+        }
+        if (context.caller !== "user" && this.config.settings.prompts !== "model") {
+            throw new Error('MCP prompt content is not exposed to the model unless settings.prompts is "model"');
+        }
+        const args = parseArguments(input);
+        const startedAt = Date.now();
+        try {
+            const result = await this.getSupervisor(serverId).getPrompt(name, args, signal);
+            const text = getPromptResultToText(result);
+            const shaped = this.outputStore.shapeOutput(text);
+            await this.writeAudit({
+                callerSurface: getCallerSurface(context),
+                server: serverId,
+                item: name,
+                kind: "prompt",
+                risk: "read",
+                status: "completed",
+                durationMs: Date.now() - startedAt,
+                resultSize: byteLength(text),
+                cacheId: shaped.cache?.id,
+                arguments: args,
+            });
+            return { action: "get_prompt", server: serverId, prompt: name, ...shaped };
+        }
+        catch (error) {
+            await this.writeAudit({
+                callerSurface: getCallerSurface(context),
+                server: serverId,
+                item: name,
+                kind: "prompt",
+                risk: "read",
+                status: signal?.aborted ? "cancelled" : "failed",
+                durationMs: Date.now() - startedAt,
+                arguments: args,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            throw error;
+        }
+    }
+    async readCache(cacheId, input, context) {
+        const startedAt = Date.now();
+        try {
+            const chunk = this.outputStore.read(cacheId, input);
+            await this.writeAudit({
+                callerSurface: getCallerSurface(context),
+                server: "cache",
+                item: cacheId,
+                kind: "cache",
+                risk: "read",
+                status: "completed",
+                durationMs: Date.now() - startedAt,
+                resultSize: byteLength(chunk.content),
+                cacheId,
+            });
+            return { action: "read_cache", ...chunk };
+        }
+        catch (error) {
+            await this.writeAudit({
+                callerSurface: getCallerSurface(context),
+                server: "cache",
+                item: cacheId,
+                kind: "cache",
+                risk: "read",
+                status: "failed",
+                durationMs: Date.now() - startedAt,
+                cacheId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            throw error;
+        }
+    }
+    async callTool(input, context, signal) {
+        const serverId = requireString(input.server, "server");
+        const toolName = requireString(input.tool, "tool");
+        const args = parseArguments(input);
+        const supervisor = this.getSupervisor(serverId);
+        const metadata = await this.getFreshMetadata(supervisor, signal);
+        const tool = metadata.tools.find((entry) => entry.name === toolName);
+        if (!tool || !serverMatchesToolFilters(supervisor.server, tool.name)) {
+            throw new Error(`MCP tool not available: ${serverId}.${toolName}`);
+        }
+        const risk = classifyMcpToolRisk(tool);
+        const callId = makeCallId();
+        const startedAt = Date.now();
+        let status = "completed";
+        this.emit({
+            type: "mcp_call_start",
+            call: {
+                id: callId,
+                timestamp: new Date(startedAt).toISOString(),
+                server: serverId,
+                tool: toolName,
+                risk,
+                status: "started",
+            },
+        });
+        try {
+            const result = await supervisor.callTool(toolName, args, signal, (progress) => this.emit({
+                type: "mcp_call_update",
+                call: { id: callId, server: serverId, tool: toolName },
+                progress,
+            }));
+            const text = callToolResultToText(result);
+            const shaped = this.outputStore.shapeOutput(text);
+            status = result.isError ? "failed" : "completed";
+            const outputBytes = byteLength(text);
+            const recent = {
+                id: callId,
+                timestamp: new Date(startedAt).toISOString(),
+                server: serverId,
+                tool: toolName,
+                risk,
+                status,
+                durationMs: Date.now() - startedAt,
+                outputBytes,
+                truncated: shaped.truncation?.truncated ?? false,
+            };
+            supervisor.recordCall(recent);
+            this.emit({
+                type: "mcp_call_end",
+                call: recent,
+                ...(shaped.cache ? { cacheId: shaped.cache.id } : {}),
+            });
+            await this.writeAudit({
+                callerSurface: getCallerSurface(context),
+                server: serverId,
+                item: toolName,
+                kind: "tool",
+                risk,
+                status,
+                durationMs: recent.durationMs,
+                resultSize: outputBytes,
+                cacheId: shaped.cache?.id,
+                arguments: args,
+            });
+            return {
+                action: "call",
+                server: serverId,
+                tool: toolName,
+                status: result.isError ? "failed" : "completed",
+                risk,
+                content: shaped.content,
+                ...(result.isError ? { isError: true } : {}),
+                ...(shaped.truncation ? { truncation: shaped.truncation } : {}),
+                ...(shaped.cache ? { cache: shaped.cache } : {}),
+            };
+        }
+        catch (error) {
+            status = signal?.aborted ? "cancelled" : "failed";
+            const durationMs = Date.now() - startedAt;
+            const recent = {
+                id: callId,
+                timestamp: new Date(startedAt).toISOString(),
+                server: serverId,
+                tool: toolName,
+                risk,
+                status,
+                durationMs,
+            };
+            supervisor.recordCall(recent);
+            this.emit({ type: "mcp_call_end", call: recent });
+            await this.writeAudit({
+                callerSurface: getCallerSurface(context),
+                server: serverId,
+                item: toolName,
+                kind: "tool",
+                risk,
+                status,
+                durationMs,
+                arguments: args,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            throw error;
+        }
+    }
+    isSupervisorMetadataStale(supervisor, metadata) {
+        if (metadata && metadata.configHash !== hashMcpServerConfig(supervisor.server)) {
+            return true;
+        }
+        return isMetadataStale(metadata, getServerTimeoutMs(supervisor.server, this.config.settings, "refresh"));
+    }
+    async getFreshMetadata(supervisor, signal) {
+        const cached = supervisor.cachedMetadata;
+        if (cached && !this.isSupervisorMetadataStale(supervisor, cached)) {
+            return cached;
+        }
+        return supervisor.refreshMetadata(signal);
+    }
+    getSupervisor(serverId) {
+        const normalized = serverId.trim().toLowerCase();
+        const supervisor = this.supervisors.get(normalized) ?? this.supervisors.get(serverId);
+        if (!supervisor) {
+            throw new Error(`MCP server not found: ${serverId}`);
+        }
+        return supervisor;
+    }
+    requireOAuthSupervisor(serverId) {
+        const supervisor = this.getSupervisor(serverId);
+        if (supervisor.server.auth?.type !== "oauth") {
+            throw new Error(`MCP server does not use OAuth: ${serverId}`);
+        }
+        if (supervisor.server.transport === "stdio") {
+            throw new Error(`MCP OAuth is only available for HTTP/SSE servers: ${serverId}`);
+        }
+        return supervisor;
+    }
+    async writeAudit(input) {
+        await this.auditLogger?.write({
+            ...input,
+            workspaceId: this.workspaceId,
+            sessionId: this.sessionId,
+        });
+    }
+}
+//# sourceMappingURL=manager.js.map