@stigmer/runner 3.10.0 → 3.11.1-dev.20260812192248

package/dist/shared/mcp-manager.d.ts

@@ -4,7 +4,13 @@
  * Wraps @langchain/mcp-adapters MultiServerMCPClient with:
  * - Conversion from ResolvedMcpServer[] to the SDK's Connection config
  * - Proper async cleanup via close()
- * - Tool filtering based on discovered capabilities
+ * - Input-schema sanitization of unicode-invalid regex patterns
+ *   (issue #420; semantics in shared/mcp-schema-sanitizer.ts) — a vendor
+ *   pattern that cannot compile under the /u flag must not leave its tool
+ *   permanently uncallable
+ * - Tool filtering by each server's effective enabled_tools allow-list
+ *   (issue #350; semantics in shared/mcp-enabled-tools.ts) — the model only
+ *   ever sees the tools the agent's manifest enables
  *
  * Transport policy (stdio is local-runner-only) is enforced upstream at
  * resolution time by shared/mcp-transport-guard.ts — servers reaching
@@ -16,10 +22,10 @@
  * (HOME, LOGNAME, PATH, SHELL, TERM, USER — getDefaultEnvironment in
  * @modelcontextprotocol/sdk, merged under whatever we pass). The
  * runner's own process env is never passed: it carries runner-internal
- * credentials (STIGMER_TOKEN, STIGMER_RUNNER_HITL_SECRET,
- * CURSOR_API_KEY, LLM provider keys) that no third-party MCP subprocess
- * may see. A declared-empty env and an undeclared env are deliberately
- * equivalent — both yield the SDK base environment.
+ * credentials (enumerated in runner-credential-keys.ts) that no
+ * third-party MCP subprocess may see. A declared-empty env and an
+ * undeclared env are deliberately equivalent — both yield the SDK base
+ * environment.
  *
  * The Cursor execution path does NOT use this manager — it passes MCP
  * configs directly to the Cursor SDK via toCursorMcpConfig(). This

package/dist/shared/mcp-manager.js

@@ -4,7 +4,13 @@
  * Wraps @langchain/mcp-adapters MultiServerMCPClient with:
  * - Conversion from ResolvedMcpServer[] to the SDK's Connection config
  * - Proper async cleanup via close()
- * - Tool filtering based on discovered capabilities
+ * - Input-schema sanitization of unicode-invalid regex patterns
+ *   (issue #420; semantics in shared/mcp-schema-sanitizer.ts) — a vendor
+ *   pattern that cannot compile under the /u flag must not leave its tool
+ *   permanently uncallable
+ * - Tool filtering by each server's effective enabled_tools allow-list
+ *   (issue #350; semantics in shared/mcp-enabled-tools.ts) — the model only
+ *   ever sees the tools the agent's manifest enables
  *
  * Transport policy (stdio is local-runner-only) is enforced upstream at
  * resolution time by shared/mcp-transport-guard.ts — servers reaching
@@ -16,10 +22,10 @@
  * (HOME, LOGNAME, PATH, SHELL, TERM, USER — getDefaultEnvironment in
  * @modelcontextprotocol/sdk, merged under whatever we pass). The
  * runner's own process env is never passed: it carries runner-internal
- * credentials (STIGMER_TOKEN, STIGMER_RUNNER_HITL_SECRET,
- * CURSOR_API_KEY, LLM provider keys) that no third-party MCP subprocess
- * may see. A declared-empty env and an undeclared env are deliberately
- * equivalent — both yield the SDK base environment.
+ * credentials (enumerated in runner-credential-keys.ts) that no
+ * third-party MCP subprocess may see. A declared-empty env and an
+ * undeclared env are deliberately equivalent — both yield the SDK base
+ * environment.
  *
  * The Cursor execution path does NOT use this manager — it passes MCP
  * configs directly to the Cursor SDK via toCursorMcpConfig(). This
@@ -28,6 +34,8 @@
  * toMcpClientConfig too.
  */
 import { MultiServerMCPClient } from "@langchain/mcp-adapters";
+import { filterToolsByEnabledTools } from "./mcp-enabled-tools.js";
+import { sanitizeSchemaPatterns } from "./mcp-schema-sanitizer.js";
 /**
  * Convert harness-agnostic ResolvedMcpServer[] into the
  * MultiServerMCPClient connection config format.
@@ -76,10 +84,41 @@ export async function connectMcpServers(servers) {
         return { client, tools: [], serverToolMap: {} };
     }
     const client = new MultiServerMCPClient(connectionConfig);
-    const serverToolMap = await client.initializeConnections();
+    const discoveredToolMap = await client.initializeConnections();
+    // Drop unicode-invalid regex patterns from every discovered tool's input
+    // schema BEFORE anything downstream holds a reference (issue #420):
+    // @langchain/core re-validates against tool.schema on every invocation,
+    // so one vendor pattern that cannot compile under the /u flag would
+    // otherwise make its tool permanently uncallable. Semantics and the
+    // loosen-never-tighten invariant live in shared/mcp-schema-sanitizer.ts.
+    for (const [slug, discovered] of Object.entries(discoveredToolMap)) {
+        for (const tool of discovered) {
+            const droppedPatterns = sanitizeSchemaPatterns(tool.schema);
+            if (droppedPatterns.length > 0) {
+                console.warn(`[MCP] Server '${slug}' tool '${tool.name}': dropped ` +
+                    `${droppedPatterns.length} regex pattern(s) that cannot compile ` +
+                    `under the unicode flag — the tool stays callable, the server ` +
+                    `still validates its own inputs (issue #420): ` +
+                    droppedPatterns
+                        .map((d) => `${d.location} ${JSON.stringify(d.pattern)}` +
+                        (d.compilesWithoutUnicodeFlag ? "" : " (invalid without /u too)"))
+                        .join(", "));
+            }
+        }
+    }
+    // Enforce each server's effective enabled_tools allow-list (issue #350)
+    // HERE, before anything downstream sees the tools: the parent tool list,
+    // the approval gate's toolServerMap, and the sub-agent McpAccess filter
+    // (whose subset-of-parent check is only real against a narrowed map) all
+    // derive from this result. Servers without a restriction (enabledTools
+    // absent — including synthesized attachments) pass through untouched.
+    const enabledBySlug = new Map(servers.map((s) => [s.slug, s.enabledTools]));
+    const serverToolMap = {};
     const tools = [];
-    for (const serverTools of Object.values(serverToolMap)) {
-        tools.push(...serverTools);
+    for (const [slug, discovered] of Object.entries(discoveredToolMap)) {
+        const filtered = filterToolsByEnabledTools(slug, discovered, enabledBySlug.get(slug));
+        serverToolMap[slug] = filtered;
+        tools.push(...filtered);
     }
     console.log(`[MCP] Connected ${Object.keys(serverToolMap).length} server(s), ` +
         `${tools.length} tool(s) total: ${Object.entries(serverToolMap)

package/dist/shared/mcp-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-manager.js","sourceRoot":"","sources":["../../src/shared/mcp-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAK/D;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA4B;IAE5B,MAAM,MAAM,GAA+B,EAAE,CAAC;IAE9C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,SAAS;YAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxD,OAAO,CAAC,GAAG,CACT,iBAAiB,MAAM,CAAC,IAAI,qCAAqC;oBACjE,mEAAmE;oBACnE,2CAA2C,CAC5C,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG;gBACpB,SAAS,EAAE,OAAO;gBAClB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;gBACvB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,GAAG,EAAE,MAAM,CAAC,GAAG;aAChB,CAAC;QACJ,CAAC;aAAM,IAAI,MAAM,CAAC,cAAc,KAAK,MAAM,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;YAC/E,IAAI,CAAC,MAAM,CAAC,GAAG;gBAAE,SAAS;YAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG;gBACpB,SAAS,EAAE,MAAM;gBACjB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAQD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA4B;IAE5B,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAEpD,IAAI,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC;QAC5C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,qBAAqB,EAAE,CAAC;IAE3D,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,CAAC,GAAG,CACT,mBAAmB,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,cAAc;QAClE,GAAG,KAAK,CAAC,MAAM,mBAAmB,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC;aAC5D,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;aAC1C,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"mcp-manager.js","sourceRoot":"","sources":["../../src/shared/mcp-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAI/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAEnE;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA4B;IAE5B,MAAM,MAAM,GAA+B,EAAE,CAAC;IAE9C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,SAAS;YAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxD,OAAO,CAAC,GAAG,CACT,iBAAiB,MAAM,CAAC,IAAI,qCAAqC;oBACjE,mEAAmE;oBACnE,2CAA2C,CAC5C,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG;gBACpB,SAAS,EAAE,OAAO;gBAClB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;gBACvB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,GAAG,EAAE,MAAM,CAAC,GAAG;aAChB,CAAC;QACJ,CAAC;aAAM,IAAI,MAAM,CAAC,cAAc,KAAK,MAAM,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;YAC/E,IAAI,CAAC,MAAM,CAAC,GAAG;gBAAE,SAAS;YAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG;gBACpB,SAAS,EAAE,MAAM;gBACjB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAQD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA4B;IAE5B,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAEpD,IAAI,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC;QAC5C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,MAAM,MAAM,CAAC,qBAAqB,EAAE,CAAC;IAE/D,yEAAyE;IACzE,oEAAoE;IACpE,wEAAwE;IACxE,oEAAoE;IACpE,oEAAoE;IACpE,yEAAyE;IACzE,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACnE,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,eAAe,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5D,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,OAAO,CAAC,IAAI,CACV,iBAAiB,IAAI,WAAW,IAAI,CAAC,IAAI,aAAa;oBACtD,GAAG,eAAe,CAAC,MAAM,wCAAwC;oBACjE,+DAA+D;oBAC/D,+CAA+C;oBAC/C,eAAe;yBACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT,GAAG,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;wBAC5C,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAClE;yBACA,IAAI,CAAC,IAAI,CAAC,CACd,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAC7C,CAAC;IACF,MAAM,aAAa,GAA4C,EAAE,CAAC;IAClE,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACnE,MAAM,QAAQ,GAAG,yBAAyB,CACxC,IAAI,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAC1C,CAAC;QACF,aAAa,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,CAAC,GAAG,CACT,mBAAmB,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,cAAc;QAClE,GAAG,KAAK,CAAC,MAAM,mBAAmB,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC;aAC5D,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;aAC1C,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AAC1C,CAAC"}

package/dist/shared/mcp-resolver.d.ts

@@ -10,7 +10,7 @@
  * A behavioral change here (like the transport guard) must be mirrored
  * there until the two are consolidated.
  */
-import type { McpServerUsage } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
+import type { McpServerUsage, ToolApprovalOverride } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
 import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
 import type { ToolApprovalPolicy } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/spec_pb";
 import type { StigmerClient } from "../client/stigmer-client.js";
@@ -33,6 +33,28 @@ export interface ResolvedMcpServer {
     toolApprovals: ToolApprovalPolicy[];
     pinnedToolApprovals: ToolApprovalPolicy[];
     discoveredCapabilitiesEmpty: boolean;
+    /**
+     * The EFFECTIVE tool allow-list for this server (issue #350): the usage's
+     * enabled_tools, falling back to the server's default_enabled_tools when
+     * the usage's list is empty (see shared/mcp-enabled-tools.ts). Absent when
+     * unrestricted — which keeps synthesized attachment servers (built without
+     * a usage) and the discovery path unfiltered by construction. Enforced at
+     * connect time by connectMcpServers (shared/mcp-manager.ts).
+     */
+    enabledTools?: string[];
+    /**
+     * Layer-3 per-agent approval overrides from the usage that resolved this
+     * server (issue #349): riding the resolved server is what SCOPES an
+     * override to its own server — a flat cross-server list is how an
+     * override once leaked onto (or silently un-gated) a same-named tool on
+     * another server. Deliberately REQUIRED, not optional: empty means "no
+     * overrides", and every construction site — including the near-duplicate
+     * Cursor resolver and the synthesized attachments, which have no usage
+     * and therefore no layer 3 — must say so explicitly, so a forgotten
+     * mirror cannot compile. Consumed by mergeApprovalPolicies
+     * (shared/approval-policy.ts).
+     */
+    toolApprovalOverrides: ToolApprovalOverride[];
 }
 export interface McpResolutionResult {
     resolvedServers: ResolvedMcpServer[];
@@ -46,6 +68,21 @@ export interface McpResolutionResult {
  *        whole resolution — never degraded to a skipped server.
  */
 export declare function resolveMcpServers(client: StigmerClient, usages: McpServerUsage[], envVars: Record<string, string>, transportPosture: McpTransportPosture): Promise<McpResolutionResult>;
-export declare function mcpServerToResolved(server: McpServer, slug: string, envVars: Record<string, string>): ResolvedMcpServer | null;
+export declare function mcpServerToResolved(server: McpServer, slug: string, envVars: Record<string, string>, usageEnabledTools?: readonly string[], usageToolApprovalOverrides?: ToolApprovalOverride[]): ResolvedMcpServer | null;
 export declare function extractMcpServerSlugs(usages: McpServerUsage[]): string[];
+/**
+ * Merge MCP server usages from agent (base) and session (overlay).
+ *
+ * Replicates session_context_merge.py::merge_mcp_server_usages():
+ * - Agent-level usages are the base set
+ * - Session-level usages extend or override by mcp_server_ref.slug
+ * - If both reference the same slug, session-level takes precedence —
+ *   the WHOLE usage, including enabled_tools and approval overrides
+ *
+ * Shared by both harnesses (blueprint-resolver.ts for Cursor,
+ * execute-deep-agent/setup.ts for the native harness) so a duplicate slug
+ * resolves identically everywhere: exactly one usage per server, whose
+ * enabled_tools is the one the enforcement filter honors.
+ */
+export declare function mergeMcpServerUsages(agentUsages: McpServerUsage[], sessionUsages: McpServerUsage[]): McpServerUsage[];
 export { PlaceholderResolutionError } from "./placeholder-resolver.js";

package/dist/shared/mcp-resolver.js

@@ -12,6 +12,7 @@
  */
 import { assertTransportAllowed, McpTransportError, } from "./mcp-transport-guard.js";
 import { resolveHeaders, resolvePlaceholders, filterEnvToDeclaredKeys, PlaceholderResolutionError, } from "./placeholder-resolver.js";
+import { effectiveEnabledTools } from "./mcp-enabled-tools.js";
 /**
  * Fetch McpServer resources and resolve into intermediate format.
  *
@@ -29,7 +30,7 @@ export async function resolveMcpServers(client, usages, envVars, transportPostur
         try {
             const mcpServer = await client.getMcpServerByReference(ref);
             const serverEnv = filterEnvToDeclaredKeys(mcpServer.spec?.env, envVars, ref.slug);
-            const server = mcpServerToResolved(mcpServer, ref.slug, serverEnv);
+            const server = mcpServerToResolved(mcpServer, ref.slug, serverEnv, usage.enabledTools, usage.toolApprovalOverrides ?? []);
             if (server) {
                 assertTransportAllowed(server.slug, server.connectionType, transportPosture);
                 resolved.push(server);
@@ -51,7 +52,7 @@ export async function resolveMcpServers(client, usages, envVars, transportPostur
     }
     return { resolvedServers: resolved };
 }
-export function mcpServerToResolved(server, slug, envVars) {
+export function mcpServerToResolved(server, slug, envVars, usageEnabledTools, usageToolApprovalOverrides = []) {
     const spec = server.spec;
     if (!spec)
         return null;
@@ -65,6 +66,13 @@ export function mcpServerToResolved(server, slug, envVars) {
         toolApprovals,
         pinnedToolApprovals,
         discoveredCapabilitiesEmpty,
+        // Callers without a usage (the discovery activity) pass nothing, so the
+        // default_enabled_tools fallback still applies but a per-agent
+        // restriction cannot: discovery must see the server's full toolset.
+        enabledTools: effectiveEnabledTools(usageEnabledTools, spec.defaultEnabledTools),
+        // Same no-usage rule for layer 3: discovery has no agent context, so no
+        // per-agent overrides exist — defaulting to [] keeps that structural.
+        toolApprovalOverrides: usageToolApprovalOverrides,
     };
     switch (spec.serverType.case) {
         case "stdio": {
@@ -109,5 +117,33 @@ export function extractMcpServerSlugs(usages) {
         .map((u) => u.mcpServerRef?.slug)
         .filter((s) => !!s);
 }
+/**
+ * Merge MCP server usages from agent (base) and session (overlay).
+ *
+ * Replicates session_context_merge.py::merge_mcp_server_usages():
+ * - Agent-level usages are the base set
+ * - Session-level usages extend or override by mcp_server_ref.slug
+ * - If both reference the same slug, session-level takes precedence —
+ *   the WHOLE usage, including enabled_tools and approval overrides
+ *
+ * Shared by both harnesses (blueprint-resolver.ts for Cursor,
+ * execute-deep-agent/setup.ts for the native harness) so a duplicate slug
+ * resolves identically everywhere: exactly one usage per server, whose
+ * enabled_tools is the one the enforcement filter honors.
+ */
+export function mergeMcpServerUsages(agentUsages, sessionUsages) {
+    const bySlug = new Map();
+    for (const usage of agentUsages) {
+        const slug = usage.mcpServerRef?.slug;
+        if (slug)
+            bySlug.set(slug, usage);
+    }
+    for (const usage of sessionUsages) {
+        const slug = usage.mcpServerRef?.slug;
+        if (slug)
+            bySlug.set(slug, usage);
+    }
+    return [...bySlug.values()];
+}
 export { PlaceholderResolutionError } from "./placeholder-resolver.js";
 //# sourceMappingURL=mcp-resolver.js.map

package/dist/shared/mcp-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-resolver.js","sourceRoot":"","sources":["../../src/shared/mcp-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAElB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AA0BnC;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAqB,EACrB,MAAwB,EACxB,OAA+B,EAC/B,gBAAqC;IAErC,MAAM,QAAQ,GAAwB,EAAE,CAAC;IAEzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,CAAC;QAC/B,IAAI,CAAC,GAAG,EAAE,IAAI;YAAE,SAAS;QAEzB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC5D,MAAM,SAAS,GAAG,uBAAuB,CACvC,SAAS,CAAC,IAAI,EAAE,GAAG,EACnB,OAAO,EACP,GAAG,CAAC,IAAI,CACT,CAAC;YACF,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACnE,IAAI,MAAM,EAAE,CAAC;gBACX,sBAAsB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;gBAC7E,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBACrC,gEAAgE;gBAChE,iEAAiE;gBACjE,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,GAAG,YAAY,0BAA0B,EAAE,CAAC;gBAC9C,OAAO,CAAC,KAAK,CACX,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CACpD,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CACV,gCAAgC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CACnG,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAiB,EACjB,IAAY,EACZ,OAA+B;IAE/B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,MAAM,aAAa,GAAG,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC;IAClD,MAAM,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,IAAI,EAAE,CAAC;IAC3D,MAAM,2BAA2B,GAAG,CAAC,MAAM,EAAE,sBAAsB;WAC9D,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;eAC/C,MAAM,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IAErE,MAAM,IAAI,GAAG;QACX,aAAa;QACb,mBAAmB;QACnB,2BAA2B;KAC5B,CAAC;IAEF,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAC7B,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YACpC,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAChC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;gBACxC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CACxB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,CACrD;gBACH,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,IAAI;gBACJ,cAAc,EAAE,OAAO;gBACvB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,YAAY;gBAClB,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;gBACjE,GAAG,EAAE,KAAK,CAAC,UAAU,IAAI,SAAS;gBAClC,GAAG,IAAI;aACR,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC3B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YACnF,MAAM,QAAQ,GAAG,UAAU;gBACzB,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC;gBACzE,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,IAAI;gBACJ,cAAc,EAAE,MAAM;gBACtB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,OAAO,EAAE,QAAQ;gBACjB,GAAG,IAAI;aACR,CAAC;QACJ,CAAC;QACD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAwB;IAC5D,OAAO,MAAM;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC;SAChC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"mcp-resolver.js","sourceRoot":"","sources":["../../src/shared/mcp-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAElB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAgD/D;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAqB,EACrB,MAAwB,EACxB,OAA+B,EAC/B,gBAAqC;IAErC,MAAM,QAAQ,GAAwB,EAAE,CAAC;IAEzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,CAAC;QAC/B,IAAI,CAAC,GAAG,EAAE,IAAI;YAAE,SAAS;QAEzB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC5D,MAAM,SAAS,GAAG,uBAAuB,CACvC,SAAS,CAAC,IAAI,EAAE,GAAG,EACnB,OAAO,EACP,GAAG,CAAC,IAAI,CACT,CAAC;YACF,MAAM,MAAM,GAAG,mBAAmB,CAChC,SAAS,EACT,GAAG,CAAC,IAAI,EACR,SAAS,EACT,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAClC,CAAC;YACF,IAAI,MAAM,EAAE,CAAC;gBACX,sBAAsB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;gBAC7E,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBACrC,gEAAgE;gBAChE,iEAAiE;gBACjE,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,IAAI,GAAG,YAAY,0BAA0B,EAAE,CAAC;gBAC9C,OAAO,CAAC,KAAK,CACX,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CACpD,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CACV,gCAAgC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CACnG,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAiB,EACjB,IAAY,EACZ,OAA+B,EAC/B,iBAAqC,EACrC,6BAAqD,EAAE;IAEvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,MAAM,aAAa,GAAG,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC;IAClD,MAAM,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,IAAI,EAAE,CAAC;IAC3D,MAAM,2BAA2B,GAAG,CAAC,MAAM,EAAE,sBAAsB;WAC9D,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;eAC/C,MAAM,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IAErE,MAAM,IAAI,GAAG;QACX,aAAa;QACb,mBAAmB;QACnB,2BAA2B;QAC3B,wEAAwE;QACxE,+DAA+D;QAC/D,oEAAoE;QACpE,YAAY,EAAE,qBAAqB,CAAC,iBAAiB,EAAE,IAAI,CAAC,mBAAmB,CAAC;QAChF,wEAAwE;QACxE,sEAAsE;QACtE,qBAAqB,EAAE,0BAA0B;KAClD,CAAC;IAEF,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAC7B,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YACpC,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAChC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;gBACxC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CACxB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,CACrD;gBACH,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,IAAI;gBACJ,cAAc,EAAE,OAAO;gBACvB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,YAAY;gBAClB,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;gBACjE,GAAG,EAAE,KAAK,CAAC,UAAU,IAAI,SAAS;gBAClC,GAAG,IAAI;aACR,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC3B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YACnF,MAAM,QAAQ,GAAG,UAAU;gBACzB,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC;gBACzE,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,IAAI;gBACJ,cAAc,EAAE,MAAM;gBACtB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,OAAO,EAAE,QAAQ;gBACjB,GAAG,IAAI;aACR,CAAC;QACJ,CAAC;QACD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAwB;IAC5D,OAAO,MAAM;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC;SAChC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAA6B,EAC7B,aAA+B;IAE/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEjD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC;QACtC,IAAI,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC;QACtC,IAAI,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/shared/mcp-schema-sanitizer.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Unicode-flag regex sanitization for MCP tool input schemas (issue #420).
+ *
+ * Why this exists: real-world MCP servers ship JSON-schema `pattern` values
+ * that are legal as plain ECMAScript regexes but invalid under the unicode
+ * flag (PayPal's `^https\:\/\/` — `\:` is an invalid escape under /u).
+ * @langchain/core validates tool input on EVERY call with
+ * @cfworker/json-schema, which compiles patterns via `new RegExp(p, "u")`
+ * at exactly two uncaught sites: the `pattern` keyword and each
+ * `patternProperties` key. One bad vendor pattern therefore makes the tool
+ * permanently uncallable on the deep-agent path — every invocation dies
+ * with a cryptic SyntaxError before the tool is ever reached. (The third
+ * /u compile site, `format: "regex"`, validates instance values inside a
+ * try/catch and fails gracefully — not a crash surface.)
+ *
+ * The fix: at the deep-agent connect funnel (mcp-manager.ts
+ * connectMcpServers), drop every pattern that cannot compile under /u.
+ * Dropping is deliberate — rewriting to a /u-safe equivalent would need an
+ * Annex-B-aware regex transpiler, disproportionate machinery for what is
+ * best-effort client-side validation; the MCP server still validates its
+ * own inputs server-side. This mirrors the loosening posture of
+ * @langchain/mcp-adapters' own schema pipeline (dereferenceJsonSchema →
+ * simplifyJsonSchemaForLLM), which already normalizes schemas for this
+ * exact validator.
+ *
+ * THE INVARIANT: sanitization may only ever LOOSEN validation, never
+ * tighten it. Dropping a `patternProperties` entry naively would violate
+ * this — @cfworker marks pattern-matched keys as "evaluated" and routes
+ * unevaluated keys into the `additionalProperties` / `unevaluatedProperties`
+ * checks, so under `additionalProperties: false` the drop would flip a
+ * crash into a false REJECTION of valid inputs. Whenever a
+ * `patternProperties` entry is dropped, any restrictive
+ * `additionalProperties` / `unevaluatedProperties` at that schema level is
+ * therefore relaxed too.
+ *
+ * Scope: this sanitizer serves the EXECUTION path only. Discovery
+ * (activities/discover-mcp-server.ts) persists tool schemas verbatim from
+ * listTools — deliberately: the stored schema is the vendor's truth for
+ * display, and discovery never invokes tools, so it cannot hit the crash.
+ * Do not "extend" sanitization there.
+ */
+/** One dropped regex constraint, for the caller's log line. */
+export interface DroppedPattern {
+    /** JSON-pointer-style path of the dropped constraint within the schema. */
+    location: string;
+    /** The pattern source that failed to compile under the unicode flag. */
+    pattern: string;
+    /**
+     * True when the pattern compiles WITHOUT the /u flag — vendor sloppiness
+     * (Annex B legacy syntax), the oss#420 class. False means the regex is
+     * broken outright; either way validation could only crash, so both drop.
+     */
+    compilesWithoutUnicodeFlag: boolean;
+}
+/**
+ * Drop unicode-invalid regex patterns from a JSON schema, in place.
+ *
+ * Walks only schema positions (the recursion set is @cfworker's own
+ * validated-keyword list), so a property literally NAMED "pattern" under
+ * `properties` is never touched. The walker handles composition keywords
+ * (anyOf/allOf/oneOf/not/if-then-else) even though the adapter's
+ * simplifyJsonSchemaForLLM currently strips them, and carries a visited-set
+ * cycle guard even though the adapter's $ref inlining currently guarantees
+ * an acyclic result — correctness here must not depend on another
+ * package's internals holding across dependency bumps.
+ *
+ * Returns the dropped constraints (empty for clean schemas — the common
+ * case, which this walk leaves byte-identical).
+ */
+export declare function sanitizeSchemaPatterns(schema: unknown): DroppedPattern[];

package/dist/shared/mcp-schema-sanitizer.js

@@ -0,0 +1,197 @@
+/**
+ * Unicode-flag regex sanitization for MCP tool input schemas (issue #420).
+ *
+ * Why this exists: real-world MCP servers ship JSON-schema `pattern` values
+ * that are legal as plain ECMAScript regexes but invalid under the unicode
+ * flag (PayPal's `^https\:\/\/` — `\:` is an invalid escape under /u).
+ * @langchain/core validates tool input on EVERY call with
+ * @cfworker/json-schema, which compiles patterns via `new RegExp(p, "u")`
+ * at exactly two uncaught sites: the `pattern` keyword and each
+ * `patternProperties` key. One bad vendor pattern therefore makes the tool
+ * permanently uncallable on the deep-agent path — every invocation dies
+ * with a cryptic SyntaxError before the tool is ever reached. (The third
+ * /u compile site, `format: "regex"`, validates instance values inside a
+ * try/catch and fails gracefully — not a crash surface.)
+ *
+ * The fix: at the deep-agent connect funnel (mcp-manager.ts
+ * connectMcpServers), drop every pattern that cannot compile under /u.
+ * Dropping is deliberate — rewriting to a /u-safe equivalent would need an
+ * Annex-B-aware regex transpiler, disproportionate machinery for what is
+ * best-effort client-side validation; the MCP server still validates its
+ * own inputs server-side. This mirrors the loosening posture of
+ * @langchain/mcp-adapters' own schema pipeline (dereferenceJsonSchema →
+ * simplifyJsonSchemaForLLM), which already normalizes schemas for this
+ * exact validator.
+ *
+ * THE INVARIANT: sanitization may only ever LOOSEN validation, never
+ * tighten it. Dropping a `patternProperties` entry naively would violate
+ * this — @cfworker marks pattern-matched keys as "evaluated" and routes
+ * unevaluated keys into the `additionalProperties` / `unevaluatedProperties`
+ * checks, so under `additionalProperties: false` the drop would flip a
+ * crash into a false REJECTION of valid inputs. Whenever a
+ * `patternProperties` entry is dropped, any restrictive
+ * `additionalProperties` / `unevaluatedProperties` at that schema level is
+ * therefore relaxed too.
+ *
+ * Scope: this sanitizer serves the EXECUTION path only. Discovery
+ * (activities/discover-mcp-server.ts) persists tool schemas verbatim from
+ * listTools — deliberately: the stored schema is the vendor's truth for
+ * display, and discovery never invokes tools, so it cannot hit the crash.
+ * Do not "extend" sanitization there.
+ */
+/** Keywords whose value is a single subschema. */
+const SINGLE_SCHEMA_KEYWORDS = [
+    "additionalProperties",
+    "unevaluatedProperties",
+    "propertyNames",
+    "items",
+    "additionalItems",
+    "unevaluatedItems",
+    "contains",
+    "not",
+    "if",
+    "then",
+    "else",
+];
+/** Keywords whose value is an array of subschemas. */
+const SCHEMA_ARRAY_KEYWORDS = ["anyOf", "allOf", "oneOf", "prefixItems"];
+/** Keywords whose value is an object mapping names to subschemas. */
+const SCHEMA_MAP_KEYWORDS = [
+    "properties",
+    "patternProperties",
+    "dependentSchemas",
+    "$defs",
+    "definitions",
+];
+function compilesUnderUnicodeFlag(pattern) {
+    try {
+        new RegExp(pattern, "u");
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function compilesWithoutUnicodeFlag(pattern) {
+    try {
+        new RegExp(pattern);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** JSON-pointer token escaping (RFC 6901): `~` → `~0`, `/` → `~1`. */
+function pointerToken(token) {
+    return token.replace(/~/g, "~0").replace(/\//g, "~1");
+}
+/**
+ * Drop unicode-invalid regex patterns from a JSON schema, in place.
+ *
+ * Walks only schema positions (the recursion set is @cfworker's own
+ * validated-keyword list), so a property literally NAMED "pattern" under
+ * `properties` is never touched. The walker handles composition keywords
+ * (anyOf/allOf/oneOf/not/if-then-else) even though the adapter's
+ * simplifyJsonSchemaForLLM currently strips them, and carries a visited-set
+ * cycle guard even though the adapter's $ref inlining currently guarantees
+ * an acyclic result — correctness here must not depend on another
+ * package's internals holding across dependency bumps.
+ *
+ * Returns the dropped constraints (empty for clean schemas — the common
+ * case, which this walk leaves byte-identical).
+ */
+export function sanitizeSchemaPatterns(schema) {
+    const dropped = [];
+    if (!isPlainObject(schema))
+        return dropped;
+    walkSchema(schema, "", dropped, new Set());
+    return dropped;
+}
+function recordDrop(dropped, location, pattern) {
+    dropped.push({
+        location,
+        pattern,
+        compilesWithoutUnicodeFlag: compilesWithoutUnicodeFlag(pattern),
+    });
+}
+function walkSchema(node, path, dropped, seen) {
+    if (seen.has(node))
+        return;
+    seen.add(node);
+    if (typeof node.pattern === "string" && !compilesUnderUnicodeFlag(node.pattern)) {
+        recordDrop(dropped, `${path}/pattern`, node.pattern);
+        delete node.pattern;
+    }
+    if (isPlainObject(node.patternProperties)) {
+        const patternProperties = node.patternProperties;
+        let droppedEntry = false;
+        for (const key of Object.keys(patternProperties)) {
+            if (compilesUnderUnicodeFlag(key))
+                continue;
+            recordDrop(dropped, `${path}/patternProperties/${pointerToken(key)}`, key);
+            delete patternProperties[key];
+            droppedEntry = true;
+        }
+        if (droppedEntry) {
+            // Never-tighten: keys the dropped pattern used to match would now
+            // fall through to these checks and could be falsely rejected.
+            if (node.additionalProperties !== undefined && node.additionalProperties !== true) {
+                delete node.additionalProperties;
+            }
+            if (node.unevaluatedProperties !== undefined && node.unevaluatedProperties !== true) {
+                delete node.unevaluatedProperties;
+            }
+            if (Object.keys(patternProperties).length === 0) {
+                delete node.patternProperties;
+            }
+        }
+    }
+    for (const keyword of SINGLE_SCHEMA_KEYWORDS) {
+        const value = node[keyword];
+        if (isPlainObject(value)) {
+            walkSchema(value, `${path}/${keyword}`, dropped, seen);
+        }
+    }
+    for (const keyword of SCHEMA_ARRAY_KEYWORDS) {
+        const value = node[keyword];
+        if (!Array.isArray(value))
+            continue;
+        value.forEach((entry, index) => {
+            if (isPlainObject(entry)) {
+                walkSchema(entry, `${path}/${keyword}/${index}`, dropped, seen);
+            }
+        });
+    }
+    for (const keyword of SCHEMA_MAP_KEYWORDS) {
+        const value = node[keyword];
+        if (!isPlainObject(value))
+            continue;
+        for (const [name, entry] of Object.entries(value)) {
+            if (isPlainObject(entry)) {
+                walkSchema(entry, `${path}/${keyword}/${pointerToken(name)}`, dropped, seen);
+            }
+        }
+    }
+    // Draft-07 `items` tuple form and `dependencies` schema form — both
+    // keywords are dual-shaped, so the typed loops above miss these arms.
+    if (Array.isArray(node.items)) {
+        node.items.forEach((entry, index) => {
+            if (isPlainObject(entry)) {
+                walkSchema(entry, `${path}/items/${index}`, dropped, seen);
+            }
+        });
+    }
+    if (isPlainObject(node.dependencies)) {
+        for (const [name, entry] of Object.entries(node.dependencies)) {
+            // Array-valued entries are dependentRequired (property names, not
+            // schemas) — only schema-valued entries are walked.
+            if (isPlainObject(entry)) {
+                walkSchema(entry, `${path}/dependencies/${pointerToken(name)}`, dropped, seen);
+            }
+        }
+    }
+}
+//# sourceMappingURL=mcp-schema-sanitizer.js.map

package/dist/shared/mcp-schema-sanitizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-schema-sanitizer.js","sourceRoot":"","sources":["../../src/shared/mcp-schema-sanitizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAgBH,kDAAkD;AAClD,MAAM,sBAAsB,GAAG;IAC7B,sBAAsB;IACtB,uBAAuB;IACvB,eAAe;IACf,OAAO;IACP,iBAAiB;IACjB,kBAAkB;IAClB,UAAU;IACV,KAAK;IACL,IAAI;IACJ,MAAM;IACN,MAAM;CACE,CAAC;AAEX,sDAAsD;AACtD,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,CAAU,CAAC;AAElF,qEAAqE;AACrE,MAAM,mBAAmB,GAAG;IAC1B,YAAY;IACZ,mBAAmB;IACnB,kBAAkB;IAClB,OAAO;IACP,aAAa;CACL,CAAC;AAEX,SAAS,wBAAwB,CAAC,OAAe;IAC/C,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAe;IACjD,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,sEAAsE;AACtE,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAe;IACpD,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC;IAC3C,UAAU,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,OAAyB,EAAE,QAAgB,EAAE,OAAe;IAC9E,OAAO,CAAC,IAAI,CAAC;QACX,QAAQ;QACR,OAAO;QACP,0BAA0B,EAAE,0BAA0B,CAAC,OAAO,CAAC;KAChE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CACjB,IAA6B,EAC7B,IAAY,EACZ,OAAyB,EACzB,IAAiB;IAEjB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO;IAC3B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEf,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChF,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC1C,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACjD,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACjD,IAAI,wBAAwB,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5C,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,sBAAsB,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAC3E,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;YAC9B,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,kEAAkE;YAClE,8DAA8D;YAC9D,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,IAAI,IAAI,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;gBAClF,OAAO,IAAI,CAAC,oBAAoB,CAAC;YACnC,CAAC;YACD,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,IAAI,IAAI,CAAC,qBAAqB,KAAK,IAAI,EAAE,CAAC;gBACpF,OAAO,IAAI,CAAC,qBAAqB,CAAC;YACpC,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChD,OAAO,IAAI,CAAC,iBAAiB,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,UAAU,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7B,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,UAAU,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAClE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,UAAU,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,sEAAsE;IACtE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAClC,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,UAAU,CAAC,KAAK,EAAE,GAAG,IAAI,UAAU,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9D,kEAAkE;YAClE,oDAAoD;YACpD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,UAAU,CAAC,KAAK,EAAE,GAAG,IAAI,iBAAiB,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/shared/model-client.d.ts

@@ -6,10 +6,11 @@
  * (e.g. "claude-haiku-4-5-20251001") before a client is built — so no
  * activity can bypass the translation and 404 the provider.
  *
- * Layering: `llm-proxy.ts` stays pure routing utilities (no LangChain
- * dependency); this module is the LangChain-aware layer above it that owns
- * the resolve -> infer-provider -> strip-prefix -> proxy-wire -> construct
- * sequence that used to be copy-pasted across every LLM activity.
+ * Layering: `llm-proxy.ts` and `llm-backend.ts` stay pure routing utilities
+ * (no LangChain dependency); this module is the LangChain-aware layer above
+ * them that owns the resolve -> infer-provider -> strip-prefix ->
+ * proxy-or-backend-wire -> construct sequence that used to be copy-pasted
+ * across every LLM activity.
  */
 import type { BaseChatModel } from "@langchain/core/language_models/chat_models";
 import { type LlmProvider } from "./llm-proxy.js";
@@ -33,13 +34,25 @@ export interface BuildChatModelOptions {
      * stays the caller's decision to avoid silently changing behavior.
      */
     readonly maxTokens?: number;
+    /**
+     * Per-request bound. When omitted, defaults to the operator's
+     * STIGMER_LLM_REQUEST_TIMEOUT_MS — resolved HERE, not per caller, so no
+     * call site can drop the bound by forgetting to plumb it (the sub-agent
+     * factory did exactly that; stigmer/stigmer#468). An explicit value wins.
+     */
     readonly timeoutMs?: number;
     readonly maxRetries?: number;
 }
 export interface BuiltChatModel {
     readonly model: BaseChatModel;
     readonly provider: LlmProvider;
-    /** The resolved id actually handed to the provider. */
+    /**
+     * The canonical provider API id the registry resolved to — what pricing
+     * and usage metrics key on. A backend adapter may translate it for the
+     * wire (Vertex separates the snapshot date with `@`), but the translated
+     * form never leaves the adapter: this field stays canonical (the
+     * canonical-id invariant in design decision 001-provider-backends).
+     */
     readonly apiModelId: string;
 }
 /**