@lvy-jsd/dsh-tool-manager 0.2.0 → 0.4.0

package/src/exempt.ts

@@ -0,0 +1,148 @@
+// File-based exemption list for dsh-tool-manager.
+//
+// An exempt session is never narrowed: a route whose tool list is handed to an
+// external client once at session start (Claude Code, say) cannot load a tool
+// that was hidden from the first request, so hiding anything there only loses
+// tools. The provider list originally came from `exemptProviders` in
+// cordis.patch.yml, which a user cannot edit from the browser and which is
+// awkward to change per session.
+//
+// This file replaces it: when <DSH_HOME>/tool-manager/exempt.json exists it wins
+// over the plugin config, the same way the settings file does. Two entry forms
+// are supported, because they answer different questions:
+//
+//   { "providers": ["claude-code"], "sessions": ["s_abc123"] }
+//
+//   providers  model routes never narrowed, for every session (durable)
+//   sessions   one session exempted for its remaining lifetime, e.g. while the
+//              user checks whether a client handles lazy loading (temporary)
+//
+// Sessions are matched against the agent's session id and, as a fallback, the
+// agent id, so an entry can be removed by hand without knowing which of the two
+// the host populated.
+
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { dirname, join } from 'node:path'
+import type { Logger } from './types.js'
+
+/** An exemption list: routes and sessions. Both may be empty. */
+export interface ExemptConfig {
+  providers: string[]
+  sessions: string[]
+}
+
+/** Where the exemption file lives unless a deployment points elsewhere. */
+export function defaultExemptFile(): string {
+  const dshHome = process.env.DSH_HOME || join(homedir(), '.config', 'deepseek-harness')
+  return join(dshHome, 'tool-manager', 'exempt.json')
+}
+
+/** Keep only non-empty strings; a number or object in the file is a typo, not a name. */
+function pickNames(value: unknown): string[] {
+  if (!Array.isArray(value)) return []
+  return value.filter((name): name is string => typeof name === 'string' && name.trim().length > 0).map((name) => name.trim())
+}
+
+/** The whole file, with unknown keys dropped. */
+export function pickExempt(raw: unknown): ExemptConfig {
+  if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) return { providers: [], sessions: [] }
+  const record = raw as Record<string, unknown>
+  // `providers` is required: a file that omits it says "no route is exempt",
+  // not "keep the old config list", because the file is the override.
+  return { providers: pickNames(record.providers), sessions: pickNames(record.sessions) }
+}
+
+/** Read the exemption file; missing or corrupt is "no opinion", never a crash. */
+export function readExemptFile(file: string, logger?: Logger): ExemptConfig | undefined {
+  let text: string
+  try {
+    text = readFileSync(file, 'utf8')
+  } catch (caught) {
+    const error = caught as NodeJS.ErrnoException
+    // ENOENT is the normal first run: no file means the plugin config decides.
+    if (error.code !== 'ENOENT') logger?.warn?.(`tool-manager: ignoring unreadable exemptions ${file}: ${error.message}`)
+    return undefined
+  }
+  try {
+    return pickExempt(JSON.parse(text))
+  } catch (caught) {
+    // A corrupt file must not silently restore the config list: the user
+    // intended the file to be in charge, so report and treat it as "no exempt".
+    logger?.warn?.(`tool-manager: unreadable exemptions ${file}: ${(caught as Error).message}`)
+    return { providers: [], sessions: [] }
+  }
+}
+
+/** Write the file atomically, so a crash cannot leave a half-written list. */
+export function writeExemptFile(file: string, config: ExemptConfig, logger?: Logger): void {
+  mkdirSync(dirname(file), { recursive: true })
+  const tmp = `${file}.tmp`
+  try {
+    writeFileSync(tmp, `${JSON.stringify({ providers: config.providers, sessions: config.sessions }, null, 2)}\n`)
+    renameSync(tmp, file)
+  } catch (caught) {
+    logger?.warn?.(`tool-manager: writing exemptions ${file} failed: ${(caught as Error).message}`)
+    throw caught
+  }
+}
+
+/** Why a session is exempt, for the panel to show. */
+export interface ExemptReason {
+  exempt: boolean
+  /** 'file:provider' | 'file:session' | 'config:provider' | '' */
+  source: string
+}
+
+export interface ExemptStore {
+  /** File the store reads and writes; the file itself is the override switch. */
+  file: string
+  /** True when the file exists, so the config provider list is ignored. */
+  present(): boolean
+  /** The lists in force: the file when it exists, else the plugin config. */
+  effective(): ExemptConfig
+  /** Why one session is exempt, if it is. */
+  reasonFor(provider: string | undefined, sessionId: string | undefined): ExemptReason
+  /** Add or remove one session, writing the file. Returns the lists in force. */
+  setSession(sessionId: string, exempt: boolean): ExemptConfig
+  /** Re-read the file, for after an external edit. Returns the lists in force. */
+  reload(): ExemptConfig
+}
+
+/**
+ * Exemption store over one file, with the plugin config as the fallback layer.
+ * The file wins as a whole rather than per key: an operator writing the file
+ * means it, and a partial merge would leave entries they cannot see.
+ */
+export function createExemptStore({ file, configProviders = [], logger }: { file: string, configProviders?: readonly string[], logger?: Logger }): ExemptStore {
+  let fromFile = readExemptFile(file, logger)
+  const effective = (): ExemptConfig => fromFile ?? { providers: [...configProviders], sessions: [] }
+  return {
+    file,
+    present: () => fromFile !== undefined,
+    effective,
+    reasonFor(provider, sessionId) {
+      const current = effective()
+      if (provider !== undefined && current.providers.includes(provider)) {
+        return { exempt: true, source: fromFile !== undefined ? 'file:provider' : 'config:provider' }
+      }
+      if (sessionId !== undefined && current.sessions.includes(sessionId)) return { exempt: true, source: 'file:session' }
+      return { exempt: false, source: '' }
+    },
+    setSession(sessionId, exempt) {
+      // Editing starts from what is in force, so the first panel click writes a
+      // file that keeps the exemptions the user could already see.
+      const current = effective()
+      const sessions = new Set(current.sessions)
+      if (exempt) sessions.add(sessionId)
+      else sessions.delete(sessionId)
+      fromFile = { providers: [...current.providers], sessions: [...sessions] }
+      writeExemptFile(file, fromFile, logger)
+      return effective()
+    },
+    reload() {
+      fromFile = readExemptFile(file, logger)
+      return effective()
+    },
+  }
+}

package/src/index.ts

@@ -10,9 +10,14 @@
 
 import { defineTool } from '@deepseek-ai/dsh-tools'
 import { buildCatalog, resolveTarget, toolsUnder, UNCATEGORIZED } from './catalog.js'
+import { createMetadataStore, defaultMetadataFile } from './metadata.js'
+import { createExemptStore, defaultExemptFile } from './exempt.js'
+import { defaultManifestFile, syncManifest } from './manifest.js'
+import { createSettingsStore, defaultSettingsFile } from './settings.js'
 import { createVisibilityController } from './visibility.js'
 import { createRegistries, readManifestAnnotations, listPluginPackages } from './service.js'
-import type { Agent, Annotation, Catalog, CatalogNode, CoreConfig, Disposer, HostContext, Logger, RiskGate, SerializedState, ToolCatalogService, ToolEntry, ToolSchema } from './types.js'
+import { registerRouter } from './router/index.js'
+import type { Agent, Annotation, Catalog, CatalogNode, CoreConfig, Disposer, HostContext, Logger, RiskGate, SerializedState, ToolCatalogService, ToolEntry, ToolMeta, ToolSchema } from './types.js'
 
 export type * from './types.js'
 export { buildCatalog, resolveTarget, toolsUnder, estimateTokens, summary, shortName, structuralGroup, DEFAULT_CATEGORIES, UNCATEGORIZED, MISC_GROUP, OVERRIDE_PRIORITY } from './catalog.js'
@@ -25,6 +30,12 @@ export const inject = ['tools']
 
 export const ENTRY_TOOLS = ['tools_ls', 'tools_load', 'tools_unload']
 
+// Host transports that are not capabilities: never listed, loaded or restricted.
+// `run_code` carries every call in DSH's PTC mode; the host refuses to restrict
+// it and adds it to the view after all restrictions, so treating it as a hidden
+// tool would block PTC mode outright.
+export const HOST_RESERVED = ['run_code']
+
 // Always visible and never listed in the directory. Names the host does not
 // have are ignored, so this list survives DSH renames. Config `pinned` adds to
 // it; config `unpin` removes from it.
@@ -57,13 +68,45 @@ function pad(text: string, width: number): string {
 
 export function apply(ctx: HostContext, config: CoreConfig = {}) {
   const logger: Logger = (typeof ctx.logger === 'function' ? ctx.logger('tool-manager') : ctx.logger) ?? console
+  // Values a UI may edit live in their own file, which wins per key over the
+  // plugin config: an operator editing cordis.patch.yml must not have a stale
+  // panel overwrite it on the next click, and a panel edit must not be undone
+  // by the next restart.
+  const settings = createSettingsStore({
+    file: config.settingsFile ?? defaultSettingsFile(),
+    base: { pinned: config.pinned, unpin: config.unpin, highRisk: config.highRisk },
+    logger,
+  })
+  // Panel-edited tool metadata (group, category, risk, summary). Applied after
+  // every other annotation, so an edit corrects a package declaration instead of
+  // being overruled by it.
+  const metadata = createMetadataStore({ file: config.metadataFile ?? defaultMetadataFile(), logger })
   // Model routes whose tool list is handed to an external client once per
   // session and never refreshed (Claude Code receives DSH tools through an MCP
   // bridge at startup). Narrowing such a session hides tools it can then never
   // load, and the client already lazy-loads schemas itself (ToolSearch), so
-  // these agents are left unrestricted. Config `exemptProviders` replaces the
-  // default list; [] restricts every route.
-  const exemptProviders = new Set(config.exemptProviders ?? ['claude-code'])
+  // these agents are left unrestricted.
+  //
+  // The list in force comes from the exemption file when it exists, else from
+  // config `exemptProviders` (default ["claude-code"]; [] restricts every
+  // route). A file entry can also name a single session id, so one session can
+  // be exempted without touching the route it uses.
+  const exemptions = createExemptStore({
+    file: config.exemptFile ?? defaultExemptFile(),
+    configProviders: config.exemptProviders ?? ['claude-code'],
+    logger,
+  })
+
+  /** Session id used to match a per-session exemption, with the agent id as fallback. */
+  function sessionIdOf(agent: Agent): string | undefined {
+    const id = agent?.session?.id ?? agent?.id
+    return id === undefined || id === null || id === '' ? undefined : String(id)
+  }
+
+  /** Why this agent is not narrowed, if it is not. */
+  function exemptionOf(agent: Agent) {
+    return exemptions.reasonFor(providerOf(agent), sessionIdOf(agent))
+  }
 
   /** The route an agent's next request will use: latest model/selection, else its options. */
   const selectionScan = new WeakMap<object, { seq: number, provider: string | undefined }>() // session -> incremental scan
@@ -92,12 +135,75 @@ export function apply(ctx: HostContext, config: CoreConfig = {}) {
   const riskGates = new Set<{ name: string }>()
 
   const pinnedSet = () => {
-    const set = new Set([...DEFAULT_PINNED, ...(config.pinned ?? [])])
-    for (const n of config.unpin ?? []) set.delete(n)
+    const current = settings.effective()
+    const set = new Set([...DEFAULT_PINNED, ...current.pinned])
+    for (const n of current.unpin) set.delete(n)
     for (const n of ENTRY_TOOLS) set.add(n)
     return set
   }
 
+  /**
+   * Configuration as one object for UIs. `extraPinned`/`unpinned` show the
+   * settings file, so the panel edits exactly what it displays; `pinned` is the
+   * resulting always-on set, defaults and entry tools included.
+   */
+  function configSnapshot() {
+    const current = settings.effective()
+    return {
+      pinned: [...pinnedSet()],
+      entryTools: [...ENTRY_TOOLS],
+      extraPinned: [...current.pinned],
+      unpinned: [...current.unpin],
+      highRisk: [...current.highRisk],
+      exemptProviders: [...exemptions.effective().providers],
+      exemptSessions: [...exemptions.effective().sessions],
+      exemptFile: exemptions.file,
+      hasExemptFile: exemptions.present(),
+      defaults: [...DEFAULT_PINNED],
+      settingsFile: settings.file,
+      // An empty file is not an override, so count keys rather than existence.
+      hasSettings: Object.keys(settings.stored()).length > 0,
+    }
+  }
+
+  /**
+   * One tool's metadata plus every layer behind it, so the panel can show what
+   * is declared, what was edited, and what the model actually gets. A tool that
+   * is pinned away or not registered is reported as missing rather than absent,
+   * so the UI can explain why there is nothing to edit.
+   */
+  function toolMetaSnapshot(name: string) {
+    const entry = getCatalog().tools.get(name)
+    const declared: ToolMeta = { ...annotationForLayers(name) }
+    return {
+      name,
+      found: entry !== undefined,
+      effective: entry?.annotation ?? declared,
+      edited: metadata.get(name) ?? {},
+      declared,
+      group: entry?.group ?? declared.group ?? '',
+      category: entry?.category ?? declared.category ?? '',
+      summary: entry?.summary ?? declared.summary ?? '',
+      highRisk: entry?.highRisk === true,
+      path: entry ? `/${entry.category}/${entry.group}/${entry.short}` : '',
+      missing: entry === undefined,
+    }
+  }
+
+  /**
+   * The declared metadata only: package.json first, runtime annotate() after,
+   * with panel edits left out so the UI can tell the two apart.
+   */
+  function annotationForLayers(name: string): ToolMeta {
+    manifestAnnotations ??= readManifestAnnotations(ctx, logger)
+    const merged: ToolMeta = {}
+    for (const annotation of [...manifestAnnotations, ...registries.annotations]) {
+      const hit = typeof annotation.match === 'string' ? annotation.match === name : annotation.match.test(name)
+      if (hit) Object.assign(merged, annotation.meta)
+    }
+    return merged
+  }
+
   // --- catalog -----------------------------------------------------------------
   // The directory is built per agent: global tools plus tools registered in the
   // agent's ancestor scopes (its preset). In the DSH web profile most tools
@@ -140,7 +246,7 @@ export function apply(ctx: HostContext, config: CoreConfig = {}) {
     for (const a of agent ? [agent] : visibility.agents()) {
       for (const s of inheritedSchemas(a)) if (!byName.has(s.name)) byName.set(s.name, s)
     }
-    const schemas = [...byName.values()].filter((s) => !pinned.has(s.name))
+    const schemas = [...byName.values()].filter((s) => !pinned.has(s.name) && !HOST_RESERVED.includes(s.name))
     const key = schemas.map((s) => s.name).sort().join('\n')
     const cached = catalogs.get(key)
     if (cached) return cached
@@ -148,12 +254,19 @@ export function apply(ctx: HostContext, config: CoreConfig = {}) {
     manifestAnnotations ??= readManifestAnnotations(ctx, logger)
     const catalog = buildCatalog(schemas, {
       classifiers: [...registries.classifiers],
-      // Package declarations first, runtime annotate() after, so runtime wins.
-      annotations: [...manifestAnnotations, ...registries.annotations],
+      // Package declarations first, runtime annotate() after, so runtime wins —
+      // and panel edits last of all, so they win over both.
+      annotations: [...manifestAnnotations, ...registries.annotations, ...metadata.annotations()],
       categories: Object.fromEntries(registries.categories),
-      highRisk: config.highRisk ?? [],
+      highRisk: settings.effective().highRisk,
     })
     catalogs.set(key, catalog)
+    // A client that receives its tool list once per session cannot discover the
+    // directory by asking, so it gets the index as a file instead. Written here,
+    // after every rebuild, so it cannot drift from what tools_load would answer.
+    // An empty path turns it off.
+    const manifestFile = config.manifestFile ?? defaultManifestFile()
+    if (manifestFile) syncManifest(catalog, manifestFile, logger)
     ctx.emit('tool-catalog/after-rebuild', { catalog })
     return catalog
   }
@@ -166,10 +279,7 @@ export function apply(ctx: HostContext, config: CoreConfig = {}) {
     // The catalog is rebuilt lazily after any registry change.
     invalidate,
     onStateChange: (agent, state) => ctx.emit('tool-catalog/state-changed', { agent, state }),
-    isExempt: (agent) => {
-      const provider = providerOf(agent)
-      return provider !== undefined && exemptProviders.has(provider)
-    },
+    isExempt: (agent) => exemptionOf(agent).exempt,
     logger,
   })
 
@@ -236,8 +346,11 @@ export function apply(ctx: HostContext, config: CoreConfig = {}) {
     /** Replace an agent's loaded state (e.g. restored after a restart). */
     importState: (agent: Agent, state: Partial<SerializedState>) => visibility.importState(agent, state),
     allowFor: (agent: Agent) => visibility.allowFor(agent),
+    deniedFor: (agent: Agent) => [...deniedFor(agent)],
     /** True when the agent's model route is in `exemptProviders` (never narrowed). */
     isExempt: (agent: Agent) => visibility.isExempt(agent),
+    /** Why an agent is exempt, so the panel can label a route-wide exemption. */
+    exemptionOf: (agent: Agent) => exemptionOf(agent),
     /**
      * Load/unload on behalf of an agent, through the same path as the entry
      * tools (hooks, vetoes, risk gates and persistence all apply). Returns the
@@ -255,14 +368,69 @@ export function apply(ctx: HostContext, config: CoreConfig = {}) {
         return { agent, id: String(agent.id), parentId: parent ? String(parent.id) : null }
       })
     },
-    /** Effective configuration, for UI display. */
-    config: () => ({
-      pinned: [...pinnedSet()],
-      entryTools: [...ENTRY_TOOLS],
-      extraPinned: config.pinned ?? [],
-      unpinned: config.unpin ?? [],
-      highRisk: config.highRisk ?? [],
-    }),
+    /** Effective configuration, for UI display and editing. */
+    config: () => configSnapshot(),
+    /**
+     * Persist UI-edited settings and apply them at once. The catalog is rebuilt
+     * because a changed always-on or high-risk list changes every directory.
+     */
+    updateConfig(patch) {
+      settings.update(patch)
+      invalidate()
+      visibility.refresh()
+      ctx.emit('tool-catalog/settings-changed', { config: configSnapshot() })
+      return configSnapshot()
+    },
+    /** Re-read the settings file, for after an external edit. */
+    reloadConfig() {
+      settings.reload()
+      invalidate()
+      visibility.refresh()
+      ctx.emit('tool-catalog/settings-changed', { config: configSnapshot() })
+      return configSnapshot()
+    },
+    /**
+     * Exempt one session from narrowing, or stop exempting it. Written to the
+     * exemption file, so the choice survives a restart and is reversible by
+     * editing or deleting that one file.
+     */
+    setExemptSession(sessionId: string, exempt: boolean) {
+      exemptions.setSession(String(sessionId), exempt)
+      // An exemption installs or lifts a restriction, so re-apply it now.
+      visibility.refresh()
+      ctx.emit('tool-catalog/settings-changed', { config: configSnapshot() })
+      return configSnapshot()
+    },
+    /** Re-read the exemption file, for after an external edit. */
+    reloadExempt() {
+      exemptions.reload()
+      visibility.refresh()
+      ctx.emit('tool-catalog/settings-changed', { config: configSnapshot() })
+      return configSnapshot()
+    },
+    /** Metadata of one tool, with the layers that decide each field. */
+    toolMeta: (name: string) => toolMetaSnapshot(String(name)),
+    /**
+     * Edit metadata from the panel. The store wins over the package
+     * declaration, and the catalog is rebuilt so the Directory tab moves the
+     * tool at once.
+     */
+    updateToolMeta(name, meta) {
+      metadata.set(String(name), meta)
+      invalidate()
+      visibility.refresh()
+      ctx.emit('tool-catalog/metadata-changed', { name: String(name) })
+      return toolMetaSnapshot(String(name))
+    },
+    /** Drop every edited field of one tool, falling back to its declaration. */
+    clearToolMeta(name) {
+      metadata.clear(String(name))
+      invalidate()
+      visibility.refresh()
+      ctx.emit('tool-catalog/metadata-changed', { name: String(name) })
+      return toolMetaSnapshot(String(name))
+    },
+    metadataFile: () => metadata.file,
     /** Enabled plugin packages on this host: `{ name, dir, manifest }[]`. */
     packages: () => listPluginPackages(ctx),
     /** Registered extension points, so a UI can show what is active. */
@@ -307,6 +475,14 @@ export function apply(ctx: HostContext, config: CoreConfig = {}) {
   } satisfies ToolCatalogService
   ctx.provide('toolCatalog', service)
 
+  // --- the retrieval + routing layer ---------------------------------------------
+  //
+  // The router reuses the toolCatalog service just provided: it indexes the same
+  // catalog, loads through the same path, and reports the same token budget. It
+  // adds tools_find / tools_route / skills_find / skills_route on top of the
+  // directory tools above.
+  registerRouter(ctx, config, service)
+
   // --- direct calls of a hidden tool -----------------------------------------------
   //
   // A tool this plugin hid is still a registered tool: the model may call it by
@@ -358,19 +534,46 @@ export function apply(ctx: HostContext, config: CoreConfig = {}) {
     return undefined
   }
 
+  // --- tools another layer hides ---------------------------------------------------
+  // Our allowlist intersects with every other restriction on the agent (MCP
+  // connector governance, its per-session injection, other plugins), so a tool
+  // can be pinned or loaded here and still never reach the model. The host's
+  // final view tells them apart; without it nothing is reported.
+  function deniedFor(agent: Agent | undefined): Set<string> {
+    const allow = agent ? visibility.allowFor(agent) : null
+    if (!agent || !allow || typeof ctx.tools.view !== 'function') return new Set()
+    let visible: { has(name: string): boolean } | undefined
+    try {
+      visible = ctx.tools.view(agent).visible
+    } catch {
+      return new Set()
+    }
+    if (!visible) return new Set()
+    const cat = getCatalog(agent)
+    return new Set(allow.filter((name) => cat.tools.has(name) && !visible!.has(name)))
+  }
+
+  const warnedDenied = new Set<string>()
+  function warnDenied(names: readonly string[]) {
+    const fresh = names.filter((name) => !warnedDenied.has(name))
+    if (!fresh.length) return
+    for (const name of fresh) warnedDenied.add(name)
+    logger?.warn?.(`tool-manager: loaded but hidden by another restriction: ${fresh.join(', ')}. If these are MCP tools, check the connector's governance rules and set the connection to "always inject" (per-session injection narrows on top of this plugin).`)
+  }
+
   // --- listing -------------------------------------------------------------------
   function visibleSetFor(agent: Agent | undefined): Set<string> | null {
     const allow = agent ? visibility.allowFor(agent) : null
     return allow ? new Set(allow) : null
   }
 
-  function toolLine(tool: ToolEntry, visible: Set<string> | null, withPath = false): string {
+  function toolLine(tool: ToolEntry, visible: Set<string> | null, denied: Set<string>, withPath = false): string {
     const marks = `${visible?.has(tool.name) ? '*' : ' '}${tool.highRisk ? '!' : ' '}`
     const label = withPath ? `/${tool.category}/${tool.group}/${tool.short}` : tool.short
-    return `  ${marks} ${pad(label, withPath ? 48 : 34)}${pad(fmtTokens(tool.tokens), 11)}${tool.summary}`
+    return `  ${marks} ${pad(label, withPath ? 48 : 34)}${pad(fmtTokens(tool.tokens), 11)}${denied.has(tool.name) ? '[denied] ' : ''}${tool.summary}`
   }
 
-  function listing(cat: Catalog, node: CatalogNode, visible: Set<string> | null): string {
+  function listing(cat: Catalog, node: CatalogNode, visible: Set<string> | null, denied: Set<string> = new Set()): string {
     const count = (tools: readonly ToolEntry[]) => ({
       n: tools.length,
       loaded: tools.filter((t) => visible?.has(t.name)).length,
@@ -378,7 +581,7 @@ export function apply(ctx: HostContext, config: CoreConfig = {}) {
     })
     const lines: string[] = []
     if (node.kind === 'root') {
-      lines.push('/  (categories; * = loaded, ! = high risk; tools_ls with query searches everything)')
+      lines.push('/  (categories; * = loaded, ! = high risk, [denied] = loaded but blocked by another plugin; tools_ls with query searches everything)')
       for (const category of cat.categories.values()) {
         const c = count(category.groups.flatMap((g) => g.tools))
         if (c.n === 0 && category.name !== UNCATEGORIZED) continue
@@ -392,10 +595,10 @@ export function apply(ctx: HostContext, config: CoreConfig = {}) {
       }
     } else if (node.kind === 'group') {
       lines.push(`/${node.group.category}/${node.group.name}/`)
-      for (const tool of node.group.tools) lines.push(toolLine(tool, visible))
+      for (const tool of node.group.tools) lines.push(toolLine(tool, visible, denied))
     } else if (node.kind === 'tool') {
       const t = node.tool
-      lines.push(`/${t.category}/${t.group}/${t.short}`, `  name: ${t.name}`, `  ${t.summary}`, `  schema ${fmtTokens(t.tokens)}${t.highRisk ? ' · high risk: load it on its own' : ''}${visible?.has(t.name) ? ' · loaded' : ''}`)
+      lines.push(`/${t.category}/${t.group}/${t.short}`, `  name: ${t.name}`, `  ${t.summary}`, `  schema ${fmtTokens(t.tokens)}${t.highRisk ? ' · high risk: load it on its own' : ''}${visible?.has(t.name) ? ' · loaded' : ''}${denied.has(t.name) ? ' · denied by another plugin (e.g. an MCP connector rule): not callable' : ''}`)
     }
     return lines.join('\n')
   }
@@ -410,11 +613,11 @@ export function apply(ctx: HostContext, config: CoreConfig = {}) {
     })
   }
 
-  function search(cat: Catalog, node: CatalogNode, query: string, visible: Set<string> | null): string {
+  function search(cat: Catalog, node: CatalogNode, query: string, visible: Set<string> | null, denied: Set<string> = new Set()): string {
     const hits = matchingTools(cat, node, query)
     if (!hits.length) return `No tools match "${query}".`
     const shown = hits.slice(0, 40)
-    return [`${hits.length} match(es) for "${query}" (load by path or full name):`, ...shown.map((t) => toolLine(t, visible, true)), hits.length > shown.length ? `  … ${hits.length - shown.length} more; narrow the query or the path` : ''].filter(Boolean).join('\n')
+    return [`${hits.length} match(es) for "${query}" (load by path or full name):`, ...shown.map((t) => toolLine(t, visible, denied, true)), hits.length > shown.length ? `  … ${hits.length - shown.length} more; narrow the query or the path` : ''].filter(Boolean).join('\n')
   }
 
   function agentOf(exec: { agent?: unknown } | undefined): Agent {
@@ -483,10 +686,15 @@ export function apply(ctx: HostContext, config: CoreConfig = {}) {
     const after = visibility.allowFor(agent) ?? []
     const added = after.filter((n) => !before.has(n))
     ctx.emit('tool-catalog/after-load', { agent, targets, added })
-    const tokens = added.reduce((sum, n) => sum + (cat.tools.get(n)?.tokens ?? 0), 0)
+    const denied = deniedFor(agent)
+    const blocked = added.filter((n) => denied.has(n))
+    const callable = added.filter((n) => !denied.has(n))
+    if (blocked.length) warnDenied(blocked)
+    const tokens = callable.reduce((sum, n) => sum + (cat.tools.get(n)?.tokens ?? 0), 0)
     return [
-      added.length ? `Loaded ${added.length} tool(s), ${fmtTokens(tokens)}; callable from your next step:` : 'Nothing new loaded.',
-      ...added.map((n) => `  ${n}`),
+      callable.length ? `Loaded ${callable.length} tool(s), ${fmtTokens(tokens)}; callable from your next step:` : 'Nothing new loaded.',
+      ...callable.map((n) => `  ${n}`),
+      ...(blocked.length ? [`Denied by another plugin (e.g. an MCP connector rule), not callable even when loaded: ${blocked.join(', ')}`] : []),
       ...notes,
     ].join('\n')
   }
@@ -548,8 +756,10 @@ export function apply(ctx: HostContext, config: CoreConfig = {}) {
       const cat = getCatalog(exec?.agent as Agent | undefined)
       const node = resolveTarget(cat, args.path ?? '/', [...registries.resolvers])
       if (node.kind === 'missing') return `No such path: ${node.target}. Start from tools_ls("/") or search with tools_ls({query}).`
-      const visible = visibleSetFor(exec?.agent as Agent | undefined)
-      return args.query ? search(cat, node, args.query, visible) : listing(cat, node, visible)
+      const agent = exec?.agent as Agent | undefined
+      const visible = visibleSetFor(agent)
+      const denied = deniedFor(agent)
+      return args.query ? search(cat, node, args.query, visible, denied) : listing(cat, node, visible, denied)
     },
   }))