@pugi/cli 0.1.0-beta.9 → 0.1.0-beta.90

package/dist/tools/lsp-tools.js

@@ -1,5 +1,7 @@
+import { callHierarchyAt, codeActionsAt, diagnosticsFor, findDefinition as symbolsFindDefinition, findImplementations, findReferences as symbolsFindReferences, findTypeDefinition, findWorkspaceSymbol, formatFile, hoverSymbol, listDocumentSymbols, renameSymbol, signatureAt, transportFromLspClient, } from '../core/lsp/symbol-tools.js';
 import { gateOnCancellation, OperatorAbortedError } from './file-tools.js';
 import { recordToolCall, recordToolResult } from '../core/session.js';
+import { getGlobalSymbolCache, SymbolCache } from '../core/lsp/symbol-cache.js';
 /** Cap for any single LSP tool's payload size. Keeps model context lean. */
 const LSP_PAYLOAD_CAP_BYTES = 8 * 1024;
 export async function lspHover(ctx, lang, file, line, col) {
@@ -184,6 +186,380 @@ function capDiagnostics(items) {
     }
     return { value: items.slice(0, 1), truncated: true };
 }
+/* ------------------------------------------------------------------------- */
+/* PUGI-78 Phase 1: symbols.* namespace tools (13 categories).               */
+/* ------------------------------------------------------------------------- */
+/**
+ * PUGI-78 Phase 1: symbols.find_definition.
+ *
+ * Pugi reads a whole file (~5-50 KB tokens) every time the model wants
+ * to know "where is foo defined?". The LSP wire here returns ~200 bytes
+ * (file + line + character). Two orders of magnitude reduction in token
+ * cost per refactor turn, hence the BIG-leverage classification in the
+ * spec (10-100x token savings per refactor).
+ *
+ * Failure folds to `lsp_unavailable` when no client is registered for
+ * the inferred language. The agent surface is expected to fall back to
+ * grep when this fires (the tool-preference prompt rule steers it).
+ */
+export async function symbolsFindDefinitionTool(ctx, lang, file, line, col) {
+    const toolCallId = recordToolCall(ctx.session, 'symbols_find_definition', `${lang}:${file}:${line}:${col}`);
+    return guard(ctx, 'symbols_find_definition', toolCallId, async () => {
+        const client = ctx.lspClients?.get(lang);
+        if (!client)
+            return unavailable(lang);
+        const cache = getSymbolCacheFromCtx(ctx);
+        const cwd = workspaceForCache(ctx);
+        const key = SymbolCache.makeKey(lang, cwd, 'find_definition', { file, line, col });
+        const cached = cache?.get(key);
+        if (cached !== undefined) {
+            if (cached === null)
+                return notFound('definition');
+            return { ok: true, value: cached };
+        }
+        const result = await symbolsFindDefinition(transportFromLspClient(client), file, line, col);
+        cache?.set(key, result);
+        if (!result)
+            return notFound('definition');
+        return { ok: true, value: result };
+    });
+}
+/**
+ * PUGI-78 Phase 1: symbols.find_references.
+ *
+ * Returns the flat list of call sites for the symbol at (line, col).
+ * The 200-row cap from the legacy `lspReferences` carries over via
+ * `capSymbolReferences`.
+ */
+export async function symbolsFindReferencesTool(ctx, lang, file, line, col) {
+    const toolCallId = recordToolCall(ctx.session, 'symbols_find_references', `${lang}:${file}:${line}:${col}`);
+    return guard(ctx, 'symbols_find_references', toolCallId, async () => {
+        const client = ctx.lspClients?.get(lang);
+        if (!client)
+            return unavailable(lang);
+        const cache = getSymbolCacheFromCtx(ctx);
+        const cwd = workspaceForCache(ctx);
+        const key = SymbolCache.makeKey(lang, cwd, 'find_references', { file, line, col });
+        const cached = cache?.get(key);
+        if (cached !== undefined) {
+            const capped = capSymbolReferences(cached);
+            return { ok: true, value: capped.value, ...(capped.truncated ? { truncated: true } : {}) };
+        }
+        const result = await symbolsFindReferences(transportFromLspClient(client), file, line, col);
+        cache?.set(key, result);
+        const capped = capSymbolReferences(result);
+        return { ok: true, value: capped.value, ...(capped.truncated ? { truncated: true } : {}) };
+    });
+}
+/**
+ * PUGI-78 Phase 1: symbols.list_in_file.
+ *
+ * Outline view — the document-symbol surface. Returns the flat list of
+ * top-level + nested symbols with their kind. Cache HIT on the same
+ * file across consecutive turns is the common case (the model usually
+ * lists, then dives into a single symbol).
+ */
+export async function symbolsListInFileTool(ctx, lang, file) {
+    const toolCallId = recordToolCall(ctx.session, 'symbols_list_in_file', `${lang}:${file}`);
+    return guard(ctx, 'symbols_list_in_file', toolCallId, async () => {
+        const client = ctx.lspClients?.get(lang);
+        if (!client)
+            return unavailable(lang);
+        const cache = getSymbolCacheFromCtx(ctx);
+        const cwd = workspaceForCache(ctx);
+        const key = SymbolCache.makeKey(lang, cwd, 'list_in_file', { file });
+        const cached = cache?.get(key);
+        if (cached !== undefined) {
+            return { ok: true, value: [...cached] };
+        }
+        const result = await listDocumentSymbols(transportFromLspClient(client), file);
+        cache?.set(key, result);
+        return { ok: true, value: result };
+    });
+}
+/**
+ * PUGI-78 Phase 1: symbols.rename.
+ *
+ * Returns the workspace-edit preview the server proposes. The
+ * dispatcher applies via `apply_patch` in a future ticket; Phase 1 is
+ * read-only — the agent surface gets the affected file list + per-edit
+ * line/character so the model can summarize the change.
+ */
+export async function symbolsRenameTool(ctx, lang, file, line, col, newName) {
+    const toolCallId = recordToolCall(ctx.session, 'symbols_rename', `${lang}:${file}:${line}:${col}:${newName}`);
+    return guard(ctx, 'symbols_rename', toolCallId, async () => {
+        const client = ctx.lspClients?.get(lang);
+        if (!client)
+            return unavailable(lang);
+        // No cache for rename — the edit set depends on the live source
+        // file state. A subsequent rename of the same symbol after the
+        // first applied would otherwise return stale edits.
+        const result = await renameSymbol(transportFromLspClient(client), file, line, col, newName);
+        if (!result)
+            return notFound('rename');
+        return { ok: true, value: result };
+    });
+}
+/**
+ * PUGI-78 Phase 1: symbols.hover.
+ *
+ * Returns the hover content (type info + docstring) at the position.
+ * Body capped at 4 KB so a verbose generic does not blow context.
+ */
+export async function symbolsHoverTool(ctx, lang, file, line, col) {
+    const toolCallId = recordToolCall(ctx.session, 'symbols_hover', `${lang}:${file}:${line}:${col}`);
+    return guard(ctx, 'symbols_hover', toolCallId, async () => {
+        const client = ctx.lspClients?.get(lang);
+        if (!client)
+            return unavailable(lang);
+        const cache = getSymbolCacheFromCtx(ctx);
+        const cwd = workspaceForCache(ctx);
+        const key = SymbolCache.makeKey(lang, cwd, 'hover', { file, line, col });
+        const cached = cache?.get(key);
+        if (cached !== undefined) {
+            if (cached === null)
+                return notFound('hover');
+            const next = {
+                ok: true,
+                value: { content: cached.content, ...(cached.range ? { range: cached.range } : {}) },
+                ...(cached.truncated ? { truncated: true } : {}),
+            };
+            return next;
+        }
+        const result = await hoverSymbol(transportFromLspClient(client), file, line, col);
+        cache?.set(key, result);
+        if (!result)
+            return notFound('hover');
+        return {
+            ok: true,
+            value: { content: result.content, ...(result.range ? { range: result.range } : {}) },
+            ...(result.truncated ? { truncated: true } : {}),
+        };
+    });
+}
+/**
+ * PUGI-78 Phase 1: symbols.signature.
+ *
+ * Function signature at a call site. Returns the active overload's
+ * label, parameters, and active-parameter index.
+ */
+export async function symbolsSignatureTool(ctx, lang, file, line, col) {
+    const toolCallId = recordToolCall(ctx.session, 'symbols_signature', `${lang}:${file}:${line}:${col}`);
+    return guard(ctx, 'symbols_signature', toolCallId, async () => {
+        const client = ctx.lspClients?.get(lang);
+        if (!client)
+            return unavailable(lang);
+        const result = await signatureAt(transportFromLspClient(client), file, line, col);
+        if (!result)
+            return notFound('signature');
+        return { ok: true, value: result };
+    });
+}
+/**
+ * PUGI-78 Phase 1: symbols.workspace_symbols.
+ *
+ * Workspace-wide fuzzy search. The server picks the matching algorithm
+ * (substring / fuzzy / prefix); we forward verbatim.
+ */
+export async function symbolsWorkspaceSymbolsTool(ctx, lang, query) {
+    const toolCallId = recordToolCall(ctx.session, 'symbols_workspace_symbols', `${lang}:${query}`);
+    return guard(ctx, 'symbols_workspace_symbols', toolCallId, async () => {
+        const client = ctx.lspClients?.get(lang);
+        if (!client)
+            return unavailable(lang);
+        const cache = getSymbolCacheFromCtx(ctx);
+        const cwd = workspaceForCache(ctx);
+        const key = SymbolCache.makeKey(lang, cwd, 'workspace_symbols', { query });
+        const cached = cache?.get(key);
+        if (cached !== undefined) {
+            return { ok: true, value: [...cached] };
+        }
+        const result = await findWorkspaceSymbol(transportFromLspClient(client), query);
+        cache?.set(key, result);
+        return { ok: true, value: result };
+    });
+}
+/**
+ * PUGI-78 Phase 1: symbols.call_hierarchy.
+ *
+ * Returns the incoming + outgoing call edges at the symbol position.
+ * The two arrays are independent — a function may have many incoming
+ * callers and zero outgoing calls (a pure leaf), or vice versa.
+ */
+export async function symbolsCallHierarchyTool(ctx, lang, file, line, col) {
+    const toolCallId = recordToolCall(ctx.session, 'symbols_call_hierarchy', `${lang}:${file}:${line}:${col}`);
+    return guard(ctx, 'symbols_call_hierarchy', toolCallId, async () => {
+        const client = ctx.lspClients?.get(lang);
+        if (!client)
+            return unavailable(lang);
+        const cache = getSymbolCacheFromCtx(ctx);
+        const cwd = workspaceForCache(ctx);
+        const key = SymbolCache.makeKey(lang, cwd, 'call_hierarchy', { file, line, col });
+        const cached = cache?.get(key);
+        if (cached !== undefined) {
+            return { ok: true, value: { incoming: [...cached.incoming], outgoing: [...cached.outgoing] } };
+        }
+        const result = await callHierarchyAt(transportFromLspClient(client), file, line, col);
+        cache?.set(key, result);
+        return { ok: true, value: result };
+    });
+}
+/**
+ * PUGI-78 Phase 1: symbols.implementations.
+ *
+ * Implementations of an interface / abstract method. Returns the flat
+ * list of concrete sites.
+ */
+export async function symbolsImplementationsTool(ctx, lang, file, line, col) {
+    const toolCallId = recordToolCall(ctx.session, 'symbols_implementations', `${lang}:${file}:${line}:${col}`);
+    return guard(ctx, 'symbols_implementations', toolCallId, async () => {
+        const client = ctx.lspClients?.get(lang);
+        if (!client)
+            return unavailable(lang);
+        const cache = getSymbolCacheFromCtx(ctx);
+        const cwd = workspaceForCache(ctx);
+        const key = SymbolCache.makeKey(lang, cwd, 'implementations', { file, line, col });
+        const cached = cache?.get(key);
+        if (cached !== undefined) {
+            const capped = capSymbolReferences(cached);
+            return { ok: true, value: capped.value, ...(capped.truncated ? { truncated: true } : {}) };
+        }
+        const result = await findImplementations(transportFromLspClient(client), file, line, col);
+        cache?.set(key, result);
+        const capped = capSymbolReferences(result);
+        return { ok: true, value: capped.value, ...(capped.truncated ? { truncated: true } : {}) };
+    });
+}
+/**
+ * PUGI-78 Phase 1: symbols.type_definition.
+ *
+ * Type definition (vs value definition). Useful for "what type is foo?"
+ * questions when the model has a variable and wants its type declaration.
+ */
+export async function symbolsTypeDefinitionTool(ctx, lang, file, line, col) {
+    const toolCallId = recordToolCall(ctx.session, 'symbols_type_definition', `${lang}:${file}:${line}:${col}`);
+    return guard(ctx, 'symbols_type_definition', toolCallId, async () => {
+        const client = ctx.lspClients?.get(lang);
+        if (!client)
+            return unavailable(lang);
+        const cache = getSymbolCacheFromCtx(ctx);
+        const cwd = workspaceForCache(ctx);
+        const key = SymbolCache.makeKey(lang, cwd, 'type_definition', { file, line, col });
+        const cached = cache?.get(key);
+        if (cached !== undefined) {
+            if (cached === null)
+                return notFound('type_definition');
+            return { ok: true, value: cached };
+        }
+        const result = await findTypeDefinition(transportFromLspClient(client), file, line, col);
+        cache?.set(key, result);
+        if (!result)
+            return notFound('type_definition');
+        return { ok: true, value: result };
+    });
+}
+/**
+ * PUGI-78 Phase 1: symbols.code_actions.
+ *
+ * Quick-fix list at the given range. Server-provided actions include
+ * auto-import, unused-import removal, refactor extractions, etc.
+ */
+export async function symbolsCodeActionsTool(ctx, lang, file, startLine, startChar, endLine, endChar) {
+    const toolCallId = recordToolCall(ctx.session, 'symbols_code_actions', `${lang}:${file}:${startLine}:${startChar}-${endLine}:${endChar}`);
+    return guard(ctx, 'symbols_code_actions', toolCallId, async () => {
+        const client = ctx.lspClients?.get(lang);
+        if (!client)
+            return unavailable(lang);
+        const result = await codeActionsAt(transportFromLspClient(client), file, startLine, startChar, endLine, endChar);
+        return { ok: true, value: result };
+    });
+}
+/**
+ * PUGI-78 Phase 1: symbols.format.
+ *
+ * Formatter — returns the text edits the LSP server would apply for
+ * `textDocument/formatting`. Phase 1 is read-only (returns the edits);
+ * the dispatcher composes + applies in a future ticket.
+ */
+export async function symbolsFormatTool(ctx, lang, file, options) {
+    const toolCallId = recordToolCall(ctx.session, 'symbols_format', `${lang}:${file}`);
+    return guard(ctx, 'symbols_format', toolCallId, async () => {
+        const client = ctx.lspClients?.get(lang);
+        if (!client)
+            return unavailable(lang);
+        const result = await formatFile(transportFromLspClient(client), file, options);
+        return { ok: true, value: result };
+    });
+}
+/**
+ * PUGI-78 Phase 1: symbols.diagnostics.
+ *
+ * Pulls the cached `publishDiagnostics` payload for the file. Mirrors
+ * the legacy `lspDiagnostics` tool but exposed via the namespaced
+ * `symbols.*` surface for discoverability.
+ */
+export async function symbolsDiagnosticsTool(ctx, lang, file) {
+    const toolCallId = recordToolCall(ctx.session, 'symbols_diagnostics', `${lang}:${file}`);
+    return guard(ctx, 'symbols_diagnostics', toolCallId, async () => {
+        const client = ctx.lspClients?.get(lang);
+        if (!client)
+            return unavailable(lang);
+        const result = await diagnosticsFor(transportFromLspClient(client), file);
+        const capped = capDiagnostics(result);
+        return { ok: true, value: capped.value, ...(capped.truncated ? { truncated: true } : {}) };
+    });
+}
+function workspaceForCache(ctx) {
+    // ToolContext exposes `root` (the workspace root). Fall back to a
+    // tagged anonymous workspace when somehow absent so the cache still
+    // keys deterministically.
+    const root = ctx.root;
+    if (typeof root === 'string' && root.length > 0)
+        return root;
+    return '<unknown>';
+}
+function getSymbolCacheFromCtx(ctx) {
+    // The agent dispatcher injects an optional cache via the ctx — when
+    // present we use the dispatcher-scoped cache so test harnesses can
+    // inject a deterministic clock. When absent, we fall back to the
+    // process-global cache.
+    if (ctx.symbolCache)
+        return ctx.symbolCache;
+    return getGlobalSymbolCache();
+}
+function notFound(verb) {
+    return {
+        ok: false,
+        reason: 'lsp_not_found',
+        detail: `LSP returned no ${verb} for the requested position.`,
+    };
+}
+function capSymbolReferences(items) {
+    const COUNT_CAP = 200;
+    if (items.length === 0)
+        return { value: items, truncated: false };
+    const trimmed = items.slice(0, COUNT_CAP);
+    const serialized = JSON.stringify(trimmed);
+    if (Buffer.byteLength(serialized, 'utf8') <= LSP_PAYLOAD_CAP_BYTES && trimmed.length === items.length) {
+        return { value: trimmed, truncated: false };
+    }
+    let upper = trimmed.length;
+    while (upper > 1) {
+        const half = Math.floor(upper / 2);
+        const sub = trimmed.slice(0, half);
+        if (Buffer.byteLength(JSON.stringify(sub), 'utf8') <= LSP_PAYLOAD_CAP_BYTES) {
+            return { value: sub, truncated: true };
+        }
+        upper = half;
+    }
+    return { value: trimmed.slice(0, 1), truncated: true };
+}
 /** Test-only surface so specs can poke truncation directly. */
-export const __test__ = { truncate, capLocations, capDiagnostics, LSP_PAYLOAD_CAP_BYTES };
+export const __test__ = {
+    truncate,
+    capLocations,
+    capDiagnostics,
+    capSymbolReferences,
+    LSP_PAYLOAD_CAP_BYTES,
+};
 //# sourceMappingURL=lsp-tools.js.map

package/dist/tools/mcp-tool.js

@@ -0,0 +1,260 @@
+import { callTool } from '../core/mcp/client.js';
+import { getMcpPermission, setMcpPermission, } from '../core/mcp/permission.js';
+/**
+ * Tool dispatcher for MCP-invoked tools (β4 M1 + M3 + M5).
+ *
+ * Tool names use the `mcp__<server>__<tool>` namespace (double-underscore
+ * separator, mirroring the upstream tool's MCP envelope). The triple-underscore
+ * forms (`mcp__server__tool__sub`) collapse into the third segment when
+ * the upstream server itself uses underscores in its tool names — `split`
+ * on the first two `__` only, so any further `__` in the tool name part
+ * survive intact (e.g. `mcp__github__create_issue` -> server=`github`,
+ * tool=`create_issue`).
+ *
+ * Why double-underscore: native Pugi tools use single-token names
+ * (`read`, `grep`, `edit`, `bash`). The double-underscore prefix
+ * unambiguously segregates the MCP namespace from native names without
+ * needing per-name regex matching at every dispatch site.
+ *
+ * Permission flow:
+ *  1. Server trust gate (handled at registry-load time). If a server is
+ *     not `trusted`, its tools never reach the engine loop.
+ *  2. Per-(server, tool) permission cache (`./mcp/permission.ts`).
+ *     Unset on first dispatch -> caller must prompt. Cached `allow_always`
+ *     auto-passes; cached `deny` auto-refuses.
+ *
+ * This module is the bridge — it parses the namespaced name, finds the
+ * live connection in the registry, consults the cache, and (when
+ * approved) routes through `client.callTool`. Prompting is the executor's
+ * responsibility; this module exposes the cache lookup + dispatch
+ * primitives so the executor stays small.
+ */
+/**
+ * Prefix every MCP tool name carries on the engine-loop wire.
+ */
+export const MCP_TOOL_PREFIX = 'mcp__';
+/**
+ * Parse `mcp__<server>__<tool>` into `{ serverName, toolName }`. Returns
+ * null when the input does not match the namespace — callers use this as
+ * the "is this an MCP tool?" predicate.
+ *
+ * Server names cannot contain `__` by registry validation (they are JSON
+ * object keys); tool names CAN (e.g. `create_issue` has a single `_` but
+ * `read_directory` has none, so the only ambiguity is when an upstream
+ * tool uses double-underscore in its slug — extremely rare, but if it
+ * happens the second `__` boundary still parses correctly because we
+ * split on the FIRST occurrence after the prefix).
+ */
+export function parseMcpToolName(name) {
+    if (!name.startsWith(MCP_TOOL_PREFIX))
+        return null;
+    const tail = name.slice(MCP_TOOL_PREFIX.length);
+    const sep = tail.indexOf('__');
+    if (sep === -1)
+        return null;
+    const serverName = tail.slice(0, sep);
+    const toolName = tail.slice(sep + 2);
+    if (serverName.length === 0 || toolName.length === 0)
+        return null;
+    return { serverName, toolName };
+}
+/**
+ * Build the namespaced tool name from a server + tool pair. Inverse of
+ * `parseMcpToolName`. Used by `buildMcpToolDefs` to emit the schema.
+ */
+export function buildMcpToolName(serverName, toolName) {
+    return `${MCP_TOOL_PREFIX}${serverName}__${toolName}`;
+}
+/**
+ * Build engine-loop tool definitions from every trusted server's
+ * surfaced tools. Empty array when no MCP servers are trusted — the
+ * schema builder can call this unconditionally without checking first.
+ */
+export function buildMcpToolDefs(registry) {
+    if (!registry)
+        return [];
+    const defs = [];
+    for (const state of registry.servers.values()) {
+        if (state.trust !== 'trusted')
+            continue;
+        for (const tool of state.surfacedTools) {
+            defs.push({
+                name: buildMcpToolName(state.name, tool.name),
+                description: descriptionFor(state.name, tool),
+                // The upstream server returns its own JSON Schema in `inputSchema`.
+                // We surface it verbatim — the loop client passes it through to
+                // the model, and the model emits arguments matching the upstream
+                // shape. Default to `{ type: 'object' }` when missing so the
+                // OpenAI-shaped tool envelope still validates.
+                parameters: tool.inputSchema ?? { type: 'object' },
+            });
+        }
+    }
+    // Sort stable so the schema bundle hash (used for caching/audit) is
+    // deterministic regardless of Map iteration order.
+    return defs.sort((a, b) => a.name.localeCompare(b.name));
+}
+function descriptionFor(serverName, tool) {
+    const base = tool.description?.trim() ?? `MCP tool ${tool.name} on server ${serverName}.`;
+    return `[MCP:${serverName}] ${base}`;
+}
+/**
+ * Look up the live connection + tool metadata for a parsed MCP tool name.
+ * Returns null when the server is not trusted, not connected, or does
+ * not expose the named tool. Callers MUST handle null — never throw,
+ * because the model may emit stale tool names after a server restart.
+ */
+export function resolveMcpTool(registry, parsed) {
+    if (!registry)
+        return null;
+    const state = registry.servers.get(parsed.serverName);
+    if (!state || state.trust !== 'trusted' || !state.connection)
+        return null;
+    const tool = state.surfacedTools.find((t) => t.name === parsed.toolName);
+    if (!tool)
+        return null;
+    return { state, connection: state.connection, tool };
+}
+/**
+ * The default prompt — used when no interactive bridge is wired (CI,
+ * non-TTY pipes). Returns `deny` so an unattended run never silently
+ * fires an MCP call the operator never approved. The deny is NOT
+ * persisted, so the next run with a wired prompt still has a chance to
+ * approve.
+ */
+export const defaultNonInteractiveMcpPrompt = async () => 'unset';
+/**
+ * Dispatch one MCP tool call. The flow:
+ *
+ *  1. Parse the namespaced tool name. Return error string when
+ *     malformed — the model sees the error and can self-correct.
+ *  2. Resolve the live connection. Return error when the server is not
+ *     trusted/connected or the tool is unknown.
+ *  3. Consult the permission cache. `deny` short-circuits. `allow_always`
+ *     proceeds. `unset` invokes the prompt; the operator's verdict is
+ *     persisted (allow_always/deny) or used one-shot (allow_once).
+ *  4. Parse the arguments string. Bad JSON -> error string.
+ *  5. Call `client.callTool` and stringify the content for the model.
+ *
+ * Throws ONLY on unrecoverable transport failures (e.g. the connection
+ * died mid-call). Tool-level errors from the upstream server are
+ * surfaced as `[MCP error] <message>` strings so the model can recover.
+ */
+export async function dispatchMcpTool(input) {
+    const parsed = parseMcpToolName(input.name);
+    if (!parsed) {
+        return `[MCP dispatch error] tool name "${input.name}" does not match the ${MCP_TOOL_PREFIX}<server>__<tool> namespace`;
+    }
+    const resolved = resolveMcpTool(input.registry, parsed);
+    if (!resolved) {
+        return `[MCP dispatch error] no trusted+connected server "${parsed.serverName}" exposes a tool named "${parsed.toolName}"`;
+    }
+    let args;
+    try {
+        args = parseArgumentsRaw(input.argumentsRaw);
+    }
+    catch (error) {
+        return `[MCP dispatch error] invalid JSON in arguments for ${input.name}: ${error instanceof Error ? error.message : String(error)}`;
+    }
+    // Permission gate.
+    const cached = getMcpPermission(parsed.serverName, parsed.toolName);
+    let effective = cached;
+    if (cached === 'unset') {
+        const verdict = await input.prompt({
+            serverName: parsed.serverName,
+            toolName: parsed.toolName,
+            toolDescription: resolved.tool.description ?? '',
+            callArguments: args,
+        });
+        effective = verdict;
+        if (verdict === 'allow_always' || verdict === 'deny') {
+            setMcpPermission(parsed.serverName, parsed.toolName, verdict, resolveDecidedBy(input.decidedBy));
+        }
+    }
+    if (effective === 'deny') {
+        return `[MCP refused] operator denied ${parsed.serverName}:${parsed.toolName}`;
+    }
+    if (effective !== 'allow_once' && effective !== 'allow_always') {
+        // Includes `unset` returned by the non-interactive default prompt.
+        return `[MCP refused] no operator approval for ${parsed.serverName}:${parsed.toolName} (run from a TTY to approve)`;
+    }
+    // Dispatch.
+    let result;
+    try {
+        result = await callTool(resolved.connection, parsed.toolName, args, {
+            ...(input.timeoutMs !== undefined ? { timeoutMs: input.timeoutMs } : {}),
+        });
+    }
+    catch (error) {
+        // Transport-level failure (timeout, child died mid-call). Surface
+        // as a recoverable string so the model can degrade gracefully.
+        return `[MCP transport error] ${parsed.serverName}:${parsed.toolName}: ${error instanceof Error ? error.message : String(error)}`;
+    }
+    return renderMcpToolResult(result.content, result.isError, parsed);
+}
+function parseArgumentsRaw(raw) {
+    if (!raw || raw.trim() === '')
+        return {};
+    const parsed = JSON.parse(raw);
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('arguments must be a JSON object');
+    }
+    return parsed;
+}
+function resolveDecidedBy(override) {
+    return (override?.trim() ||
+        process.env.PUGI_TRUSTED_BY?.trim() ||
+        process.env.USER?.trim() ||
+        process.env.USERNAME?.trim() ||
+        'cli');
+}
+/**
+ * Project the MCP `content` payload into a single text string the model
+ * can ingest. MCP servers reply with `content: [{ type: 'text', text }]`
+ * by convention; we concatenate every `type: text` chunk and surface a
+ * `[MCP non-text content]` marker for other content kinds (images,
+ * resource references) which are not yet wired into Pugi's loop.
+ *
+ * `isError: true` from the upstream maps to a `[MCP error] ...` prefix
+ * so the model knows the call failed at the server, not at the
+ * transport.
+ */
+export function renderMcpToolResult(content, isError, parsed) {
+    const text = projectTextContent(content);
+    const prefix = isError ? `[MCP error ${parsed.serverName}:${parsed.toolName}] ` : '';
+    if (text === null) {
+        // Fallback to a JSON dump so the model sees SOMETHING — better than
+        // an opaque empty string when the upstream uses image / resource
+        // content kinds.
+        try {
+            return `${prefix}${JSON.stringify(content)}`;
+        }
+        catch {
+            return `${prefix}[MCP non-serialisable content]`;
+        }
+    }
+    return `${prefix}${text}`;
+}
+function projectTextContent(content) {
+    if (content === null || content === undefined)
+        return '';
+    if (typeof content === 'string')
+        return content;
+    if (!Array.isArray(content))
+        return null;
+    const parts = [];
+    for (const entry of content) {
+        if (entry && typeof entry === 'object' && !Array.isArray(entry)) {
+            const obj = entry;
+            if (obj.type === 'text' && typeof obj.text === 'string') {
+                parts.push(obj.text);
+                continue;
+            }
+        }
+        // Non-text chunk — record a marker so the model knows something was
+        // dropped from the response.
+        parts.push('[MCP non-text content chunk]');
+    }
+    return parts.join('\n');
+}
+//# sourceMappingURL=mcp-tool.js.map