@things-factory/ai-client-base 10.1.25 → 10.1.28

package/server/service/assistant/registry-assistant.test.ts

@@ -13,6 +13,7 @@
  */
 import { registryAssistantChat } from './registry-assistant'
 import { clearToolRegistry, registerToolCategory } from '../tool-registry/index.js'
+import { toolCallContextFixture } from '../testing/tool-call-context.js'
 import type { AIToolCall, AIToolChatResult } from '../types.js'
 
 const TC = (name: string, args: any = {}, id = 't1'): AIToolCall =>
@@ -60,6 +61,7 @@ beforeEach(() => {
         kind: 'write',
         name: 'addComponent',
         description: 'adds a component to the document',
+        privilege: { category: 'board', privilege: 'mutation' },
         schema: { type: 'object', properties: {} },
         builder: () => {
           ran.push({ name: 'addComponent', args: {}, context: null })
@@ -74,7 +76,7 @@ beforeEach(() => {
     guidance: 'Never state a quantity you did not read.',
     specs: [
       {
-        kind: 'external',
+        kind: 'read',
         name: 'readOrderState',
         description: 'reads live order state',
         schema: { type: 'object', properties: {} },
@@ -85,6 +87,40 @@ beforeEach(() => {
       }
     ]
   } as any)
+
+  /*
+   * A category whose tools change something outside the conversation, each behind the same
+   * privilege its GraphQL door uses. This is the shape of board-import's `materializeImportSession`,
+   * which creates a Board.
+   */
+  registerToolCategory({
+    name: 'board-import',
+    guidance: 'Create a board only after the user confirms.',
+    specs: [
+      {
+        kind: 'read',
+        name: 'getImportSession',
+        description: 'reads an import session',
+        privilege: { category: 'board-import', privilege: 'query' },
+        schema: { type: 'object', properties: {} },
+        builder: (args: any, context: any) => {
+          ran.push({ name: 'getImportSession', args, context })
+          return { status: 'completed' }
+        }
+      },
+      {
+        kind: 'external',
+        name: 'materializeImportSession',
+        description: 'creates a board from an import session',
+        privilege: { category: 'board-import', privilege: 'mutation' },
+        schema: { type: 'object', properties: {} },
+        builder: (args: any, context: any) => {
+          ran.push({ name: 'materializeImportSession', args, context })
+          return { boardId: 'b-1' }
+        }
+      }
+    ]
+  } as any)
 })
 
 const input = (over: any = {}) => ({
@@ -98,7 +134,7 @@ const input = (over: any = {}) => ({
 describe('what the model is offered', () => {
   it('★ only the kinds that answer — a write tool is not offered to a surface with no document', async () => {
     const { client, seen } = recordingClient()
-    await registryAssistantChat(input({ client }))
+    await registryAssistantChat(input({ client, toolCategories: ['figure-authoring', 'plant-ops'] }))
 
     const offered = seen[0].tools.map(tool => tool.name)
     expect(offered).toEqual(expect.arrayContaining(['listFigures', 'readOrderState']))
@@ -147,7 +183,7 @@ describe('running a tool', () => {
     const { client } = recordingClient([okResult(undefined, [TC('listFigures', { q: 'roller' })]), okResult('two of them')])
 
     const result = await registryAssistantChat(
-      input({ client, hostContext: { surface: 'figure-modeller', figureId: 'fig-1' } })
+      input({ client, toolCategories: ['figure-authoring'], hostContext: { surface: 'figure-modeller', figureId: 'fig-1' } })
     )
 
     expect(ran).toHaveLength(1)
@@ -158,10 +194,12 @@ describe('running a tool', () => {
     expect(result.reply).toContain('two of them')
   })
 
+
   it('★ a write tool call is not executed — the same set decides offering and dispatch', async () => {
     const { client } = recordingClient([okResult(undefined, [TC('addComponent')]), okResult('cannot do that')])
 
-    await registryAssistantChat(input({ client }))
+    /* The category is allowed; the kind is what keeps the write out. */
+    await registryAssistantChat(input({ client, toolCategories: ['figure-authoring'] }))
 
     expect(ran.map(one => one.name)).not.toContain('addComponent')
   })
@@ -175,6 +213,95 @@ describe('running a tool', () => {
   })
 })
 
+describe('what a tool is handed (A3)', () => {
+  it('★ exactly the shared shape — state and host side by side', async () => {
+    const { client } = recordingClient([okResult(undefined, [TC('listFigures')]), okResult('ok')])
+    const state = { domain: { id: 'dom-1' }, user: { id: 'u-1' } }
+
+    await registryAssistantChat(input({ client, state, toolCategories: ['figure-authoring'], hostContext: { figureId: 'fig-1' } }))
+
+    expect(ran[0].context).toEqual(toolCallContextFixture({ domainId: 'dom-1', userId: 'u-1', host: { figureId: 'fig-1' } }))
+    expect(ran[0].context.state).not.toHaveProperty('host')
+  })
+
+  it('★ host is an empty object when the surface sent none — a tool never reads it off undefined', async () => {
+    const { client } = recordingClient([okResult(undefined, [TC('listFigures')]), okResult('ok')])
+
+    await registryAssistantChat(input({ client, toolCategories: ['figure-authoring'] }))
+
+    expect(ran[0].context.host).toEqual({})
+  })
+})
+
+describe('who may use a tool (A1)', () => {
+  const grantAll = async () => true
+  const denyAll = async () => false
+
+  it('★ omitting the category list offers nothing and runs nothing', async () => {
+    const { client, seen } = recordingClient([okResult(undefined, [TC('listFigures')]), okResult('done')])
+
+    await registryAssistantChat(input({ client, toolAccess: grantAll }))
+
+    expect(seen[0].tools).toEqual([])
+    expect(ran).toHaveLength(0)
+  })
+
+  it('★ a tool that changes something outside is not offered here, even with the privilege', async () => {
+    const { client, seen } = recordingClient([okResult(undefined, [TC('materializeImportSession')]), okResult('done')])
+
+    await registryAssistantChat(input({ client, toolCategories: ['board-import'], toolAccess: grantAll }))
+
+    expect(seen[0].tools.map((t: any) => t.name)).not.toContain('materializeImportSession')
+    expect(ran.map(one => one.name)).not.toContain('materializeImportSession')
+  })
+
+  it('★ a tool behind a privilege the caller lacks is neither offered nor run when called by name', async () => {
+    const { client, seen } = recordingClient([okResult(undefined, [TC('getImportSession')]), okResult('done')])
+
+    await registryAssistantChat(input({ client, toolCategories: ['board-import'], toolAccess: denyAll }))
+
+    expect(seen[0].tools.map((t: any) => t.name)).not.toContain('getImportSession')
+    expect(ran.map(one => one.name)).not.toContain('getImportSession')
+  })
+
+  it('★ with no access check at all, a tool behind a privilege stays closed', async () => {
+    const { client, seen } = recordingClient([okResult(undefined, [TC('getImportSession')]), okResult('done')])
+
+    await registryAssistantChat(input({ client, toolCategories: ['board-import'] }))
+
+    expect(seen[0].tools.map((t: any) => t.name)).not.toContain('getImportSession')
+    expect(ran.map(one => one.name)).not.toContain('getImportSession')
+  })
+
+  it('the access check is asked with the privilege the tool declares, and a grant opens the tool', async () => {
+    const asked: any[] = []
+    const { client, seen } = recordingClient([okResult(undefined, [TC('getImportSession')]), okResult('done')])
+
+    await registryAssistantChat(
+      input({
+        client,
+        toolCategories: ['board-import'],
+        toolAccess: async (privilege: any) => {
+          asked.push(privilege)
+          return privilege.privilege === 'query'
+        }
+      })
+    )
+
+    expect(asked).toContainEqual({ category: 'board-import', privilege: 'query' })
+    expect(seen[0].tools.map((t: any) => t.name)).toContain('getImportSession')
+    expect(ran.map(one => one.name)).toContain('getImportSession')
+  })
+
+  it('guidance of a category whose every tool is withheld is not read to the model', async () => {
+    const { client, seen } = recordingClient()
+
+    await registryAssistantChat(input({ client, toolCategories: ['board-import'], toolAccess: denyAll }))
+
+    expect(seen[0].options.systemPrompt).not.toContain('Create a board only after the user confirms.')
+  })
+})
+
 describe('a client that cannot call tools', () => {
   it('★ refuses instead of answering from nothing', async () => {
     await expect(registryAssistantChat(input({ client: {} as any }))).rejects.toThrow(/cannot call tools/)

package/server/service/assistant/registry-assistant.ts

@@ -9,28 +9,24 @@
  * operato-figure hit exactly that: the dock was mounted, the tools were registered, and the only
  * mutation that could run them lived in a package figure does not load.
  *
- * ── Read and external only ─────────────────────────────────────────────────────
+ * ── Read only ──────────────────────────────────────────────────────────────────
  * A registry category may also carry `write` and `action` tools. Those produce edit ops for a
  * document the host owns, and a host with no document cannot apply them. Offering them here would
  * declare a door with no road behind it — the model would call one and the call would go nowhere.
- * So this runner offers, and dispatches, `read` and `external` only. A host that owns a document
- * keeps assembling its own conversation, as board-ai does.
+ * `external` tools change something outside the conversation (board-import's
+ * `materializeImportSession` creates a Board) and this door has no confirm-and-apply step, so they
+ * are not offered either (A1, 2026-09-17). This runner offers, and dispatches, `read` only.
  *
  * The gate answers from the same list the definitions are built from, so what is offered and what
  * may be dispatched cannot drift apart.
  */
 import type { AIClient, AIMessage } from '../types.js'
-import { getCategoryGuidance, getToolSpecsFor, type ToolCategoryFilter, type ToolSpec } from '../tool-registry/index.js'
+import { narrowToolScope, resolveToolScope, toolScopeGuidance, type ToolAccessCheck } from './tool-scope.js'
 import { assistantChat, type AssistantChatResult } from './assistant-chat.js'
 import { summarizeToolResult } from './summarize.js'
 import type { GroundingSources } from '../utils/index.js'
+import type { ToolCallContext } from '../tool-registry/types.js'
 
-/** What a registry tool is handed when it runs. `state` is the caller's koa state. */
-export interface RegistryToolCallContext {
-  state: any
-  /** What this surface is looking at — the host passes it through; tools read it as `host`. */
-  host?: any
-}
 
 export interface RegistryAssistantInput {
   /** Provider client. Must implement `chatWithTools`. */
@@ -40,12 +36,17 @@ export interface RegistryAssistantInput {
   /** Who the assistant is and what this surface is. The host owns this prose. */
   systemPrompt: string
   /**
-   * Categories this conversation may use. Omit to allow every registered category.
-   *
-   * An empty array is not the same as omitting: it allows nothing, and the conversation runs with
-   * no tools at all. That is a legitimate surface (plain chat), so it is not corrected here.
+   * Categories this conversation may use. **Omitting it allows nothing** — the same as an empty
+   * list, a plain conversation with no tools (A1, 2026-09-17). It used to mean every registered
+   * category, which is how a Board-creating tool reached any conversation.
    */
   toolCategories?: string[]
+  /**
+   * Answers whether the caller holds a tool's declared privilege. Without it, every tool that
+   * declares a privilege stays closed. The host builds it from the request — this package does
+   * not know auth.
+   */
+  toolAccess?: ToolAccessCheck
   /** Passed to tools as `context.host`. Client-supplied — never used for authorization. */
   hostContext?: any
   /** Caller's koa state (domain, user, tx). Tools that read the database need it. */
@@ -55,6 +56,8 @@ export interface RegistryAssistantInput {
   maxTokens?: number
   /** Make the model call a tool before it may answer. For surfaces that report live state. */
   requireToolOnFirstTurn?: boolean
+  /** The request's translator — the stop notice is then in the reader's language. */
+  t?: (key: string, params?: Record<string, any>) => string
   /** Texts the answer is allowed to draw identifiers from, besides the tool results. */
   groundingSources?: Omit<GroundingSources, 'toolResults'>
 }
@@ -64,11 +67,6 @@ export interface RegistryAssistantResult extends AssistantChatResult<unknown> {
   offeredTools: string[]
 }
 
-/** `read` and `external` are the two kinds that answer a question without changing a document. */
-function answeringSpecs(filter: ToolCategoryFilter): ToolSpec[] {
-  return getToolSpecsFor(filter).filter(spec => spec.kind === 'read' || spec.kind === 'external')
-}
-
 /**
  * Run one turn of a conversation whose only tools come from the registry.
  *
@@ -82,8 +80,17 @@ export async function registryAssistantChat(input: RegistryAssistantInput): Prom
     throw new Error('[registry-assistant] the configured AI client cannot call tools, so this conversation cannot run')
   }
 
-  const filter: ToolCategoryFilter = toolCategories
-  const specs = answeringSpecs(filter)
+  /*
+   * Only `read` is offered here. `external` means the tool changes something outside the
+   * conversation (board-import's `materializeImportSession` creates a Board); this door answers
+   * questions and has no confirm-and-apply step, so a tool with an effect does not go through it
+   * even when the caller holds the privilege.
+   */
+  const scope = narrowToolScope(
+    await resolveToolScope(toolCategories, input.toolAccess),
+    spec => spec.kind === 'read'
+  )
+  const specs = scope.specs
   const byName = new Map(specs.map(spec => [spec.name, spec]))
 
   const tools = specs.map(spec => ({
@@ -96,12 +103,12 @@ export async function registryAssistantChat(input: RegistryAssistantInput): Prom
    * The rules for using a tool belong to whoever registered it. Collect only the exposed ones, so
    * a surface never reads instructions for a category it cannot call.
    */
-  const guidance = getCategoryGuidance(filter)
+  const guidance = toolScopeGuidance(scope)
   const prompt = guidance.length > 0 ? `${systemPrompt}\n\n${guidance.join('\n\n')}` : systemPrompt
 
-  const toolContext: RegistryToolCallContext = { state, host: hostContext }
+  const toolContext: ToolCallContext = { state, host: hostContext ?? {} }
 
-  const result = await assistantChat<RegistryToolCallContext, unknown>({
+  const result = await assistantChat<ToolCallContext, unknown>({
     initialConversation: messages,
     tools,
     options: {
@@ -130,7 +137,8 @@ export async function registryAssistantChat(input: RegistryAssistantInput): Prom
       toolCallToOp: () => null,
       summarizeToolResult
     },
-    groundingSources: input.groundingSources
+    groundingSources: input.groundingSources,
+    t: input.t
   })
 
   return { ...result, offeredTools: tools.map(tool => tool.name) }

package/server/service/assistant/tool-scope.ts

@@ -0,0 +1,86 @@
+/*
+ * Which registered tools one conversation may use — decided once per request, before anything is
+ * offered, so offering and dispatch read the same list.
+ *
+ * ── Two questions, one list ───────────────────────────────────────────────────────
+ *   Which categories did this surface ask for?     `toolCategories`
+ *   Which of their tools may this caller use?      each spec's `privilege`, asked of `access`
+ *
+ * **Nothing asked means nothing offered.** Omitting the category list used to mean "every
+ * registered category"; that default is the one that opened board-import's Board-creating tool to
+ * any conversation. An absent answer leans to the closed side (ADR-0047 ② · ADR-0053).
+ *
+ * **No access check means privileged tools stay closed.** A caller that cannot say who is asking
+ * gets only the tools that need no privilege.
+ *
+ * The permission check itself belongs to auth, which this package does not depend on, so the host
+ * hands it in (`ai-assistant` builds it from the request state).
+ */
+import { getToolCategories, type ToolCategoryFilter } from '../tool-registry/index.js'
+import type { ToolPrivilege, ToolSpec } from '../tool-registry/types.js'
+
+/** Answers "may this caller use a door guarded by this privilege". */
+export type ToolAccessCheck = (privilege: ToolPrivilege) => Promise<boolean>
+
+export interface ScopedCategory {
+  readonly name: string
+  readonly guidance: string
+  /** The tools of this category this caller may use. Never empty — a category with none is left out. */
+  readonly specs: ReadonlyArray<ToolSpec>
+}
+
+export interface ToolScope {
+  /** Categories with at least one usable tool, in registration order. */
+  readonly categories: ReadonlyArray<ScopedCategory>
+  /** Every usable tool, flat. Offering and dispatch both read this. */
+  readonly specs: ReadonlyArray<ToolSpec>
+}
+
+export const EMPTY_TOOL_SCOPE: ToolScope = Object.freeze({ categories: [], specs: [] })
+
+const privilegeKey = (p: ToolPrivilege) => [p.category, p.privilege, !!p.owner, !!p.super].join('|')
+
+export async function resolveToolScope(requested: ToolCategoryFilter, access?: ToolAccessCheck): Promise<ToolScope> {
+  if (!requested || requested.length === 0) return EMPTY_TOOL_SCOPE
+
+  /* One check per distinct privilege — a category of ten read tools asks once. */
+  const answers = new Map<string, Promise<boolean>>()
+  const mayUse = (spec: ToolSpec): Promise<boolean> => {
+    const privilege = spec.privilege
+    if (!privilege) return Promise.resolve(true)
+    if (!access) return Promise.resolve(false)
+    const key = privilegeKey(privilege)
+    if (!answers.has(key)) answers.set(key, access(privilege).catch(() => false))
+    return answers.get(key)!
+  }
+
+  const categories: ScopedCategory[] = []
+  for (const category of getToolCategories()) {
+    if (!requested.includes(category.name)) continue
+    const allowed = await Promise.all(category.specs.map(mayUse))
+    const specs = category.specs.filter((_, i) => allowed[i])
+    if (specs.length > 0) categories.push({ name: category.name, guidance: String(category.guidance ?? '').trim(), specs })
+  }
+  return fromCategories(categories)
+}
+
+/**
+ * Keep only the tools a surface can run — e.g. a surface with no document keeps `read`. A category
+ * left with nothing drops out, so its guidance is not read to a model that cannot call it.
+ */
+export function narrowToolScope(scope: ToolScope, keep: (spec: ToolSpec) => boolean): ToolScope {
+  return fromCategories(
+    scope.categories
+      .map(category => ({ ...category, specs: category.specs.filter(keep) }))
+      .filter(category => category.specs.length > 0)
+  )
+}
+
+/** The rules of the categories in scope, for the system prompt. */
+export function toolScopeGuidance(scope: ToolScope): string[] {
+  return scope.categories.map(category => category.guidance).filter(Boolean)
+}
+
+function fromCategories(categories: ScopedCategory[]): ToolScope {
+  return { categories, specs: categories.flatMap(category => category.specs) }
+}

package/server/service/capability.test.ts

@@ -0,0 +1,52 @@
+/*
+ * What this guards: a screen can ask whether this deployment has an AI, instead of finding out by
+ * pressing a button that fails.
+ *
+ * The defect this replaces: twin decided the same question from whether a mutation had thrown once.
+ * The mutation stopped being called, the flag stayed true, and deployments with no provider showed
+ * the button anyway (standard A7-a).
+ */
+const mockConfigGet = jest.fn()
+jest.mock('@things-factory/env', () => ({ config: { get: (...args: any[]) => mockConfigGet(...args) } }))
+
+import { aiCapability } from './capability'
+import { registerAIProvider, setDefaultAIClient } from './factory'
+
+beforeEach(() => {
+  mockConfigGet.mockReset()
+  setDefaultAIClient(undefined as any)
+})
+
+it('★ a configured deployment says so, and names what answers', () => {
+  mockConfigGet.mockReturnValue(null)
+  setDefaultAIClient({ id: 'anthropic:claude-sonnet-5' } as any)
+
+  expect(aiCapability()).toEqual({ state: 'configured', provider: 'anthropic', model: 'claude-sonnet-5' })
+})
+
+it('★ no configuration at all is "not configured", with the reason — never silence', () => {
+  mockConfigGet.mockReturnValue(null)
+
+  expect(aiCapability()).toEqual({ state: 'not-configured', reason: 'no-config' })
+})
+
+it('a configuration naming a provider nobody registered says which one', () => {
+  mockConfigGet.mockReturnValue({ provider: 'nonesuch', model: 'x' })
+
+  expect(aiCapability()).toEqual({ state: 'not-configured', provider: 'nonesuch', reason: 'unknown-provider' })
+})
+
+it('a configuration with no provider field is its own reason', () => {
+  mockConfigGet.mockReturnValue({ model: 'x' })
+
+  expect(aiCapability()).toEqual({ state: 'not-configured', reason: 'no-provider' })
+})
+
+it('★ a provider whose adapter throws is not configured — it does not throw at the caller', () => {
+  registerAIProvider('explodes', () => {
+    throw new Error('no api key')
+  })
+  mockConfigGet.mockReturnValue({ provider: 'explodes', model: 'x' })
+
+  expect(aiCapability()).toEqual({ state: 'not-configured', provider: 'explodes', model: 'x', reason: 'no-adapter' })
+})

package/server/service/capability.ts

@@ -0,0 +1,58 @@
+/**
+ * Is there an AI on this deployment, and what is missing — asked before anything is tried.
+ *
+ * The twin had a button that asked the assistant, and whether to show it was decided by whether a
+ * now-dead mutation had failed once. When the dock moved to the neutral door nothing called that
+ * mutation any more, so the answer was "configured" forever: the button appeared on deployments
+ * with no provider at all and failed when pressed (standard A7-a).
+ *
+ * A capability is read, not discovered by failing (ADR-0042 decision ②). It lives here because the
+ * provider configuration does, and the answer has three states — the third is the one a screen
+ * must not fold away: **not asked yet** is not "configured".
+ */
+import { config as envConfig } from '@things-factory/env'
+
+import { getDefaultAIClient, listRegisteredProviders } from './factory.js'
+
+export type AiCapabilityState = 'configured' | 'not-configured'
+
+export interface AiCapability {
+  state: AiCapabilityState
+  /** Which provider answers, when one does — for the person reading a boot log, not for a screen. */
+  provider?: string
+  /** The default model this deployment would use. */
+  model?: string
+  /** Why it is not configured, as a code: no-config · no-provider · unknown-provider · no-adapter. */
+  reason?: string
+}
+
+/**
+ * What this server can do, as of now.
+ *
+ * Creating the client is what proves a provider adapter is loaded and the configuration parses, so
+ * this asks for it. It never throws: a deployment with no AI is a normal deployment.
+ */
+export function aiCapability(): AiCapability {
+  const client = safeDefaultClient()
+  if (client) {
+    const [provider, model] = String(client.id ?? '').split(':')
+    return { state: 'configured', provider: provider || undefined, model: model || undefined }
+  }
+
+  const cfg = envConfig.get('aiClient', null) as { provider?: string; model?: string } | null
+  if (!cfg) return { state: 'not-configured', reason: 'no-config' }
+  if (!cfg.provider) return { state: 'not-configured', reason: 'no-provider' }
+  if (!listRegisteredProviders().includes(cfg.provider)) {
+    return { state: 'not-configured', provider: cfg.provider, reason: 'unknown-provider' }
+  }
+  return { state: 'not-configured', provider: cfg.provider, model: cfg.model, reason: 'no-adapter' }
+}
+
+function safeDefaultClient() {
+  try {
+    return getDefaultAIClient()
+  } catch {
+    /* A broken configuration is "not configured", and it is the reason below that says which. */
+    return undefined
+  }
+}

package/server/service/index.ts

@@ -6,3 +6,6 @@ export * from './tool-registry/index.js'
 export * from './agentic-loop/index.js'
 export * from './assistant/index.js'
 export * from './analysis-contract.js'
+/* 「이 배포에 AI 가 있나」 — 시도해서 알아내지 않고 먼저 읽는다(표준 A7-a). */
+export * from './capability.js'
+export * from './testing/tool-call-context.js'

package/server/service/testing/tool-call-context.ts

@@ -0,0 +1,28 @@
+/*
+ * The one way a test builds what a registered tool is handed (A3, 2026-09-17).
+ *
+ * The twin's space tools read `ctx.state.host` while the door passed `ctx.host`, and their tests
+ * stayed green because each test wrote its own context in the shape the tool expected. A fixture
+ * owned by each test agrees with its tool by construction. This one is owned by the package that
+ * defines the neutral door, and that door's tests check it hands tools exactly this shape — so a tool
+ * test built on it fails when the tool reads a field no door fills.
+ */
+import type { ToolCallContext, ToolCallMode } from '../tool-registry/types.js'
+
+export interface ToolCallContextFixtureInput {
+  domainId?: string
+  userId?: string
+  /** Extra request-state fields a tool reads (e.g. `tx`). Merged after domain and user. */
+  state?: Record<string, any>
+  host?: Record<string, any>
+  mode?: ToolCallMode
+}
+
+export function toolCallContextFixture(input: ToolCallContextFixtureInput = {}): ToolCallContext {
+  const context: ToolCallContext = {
+    state: { domain: { id: input.domainId ?? 'domain-test' }, user: { id: input.userId ?? 'user-test' }, ...(input.state ?? {}) },
+    host: input.host ?? {}
+  }
+  if (input.mode) context.mode = input.mode
+  return context
+}

package/server/service/tool-registry/index.ts

@@ -13,15 +13,17 @@ export {
   getToolKind,
   hasTool,
   getCategorySpecs,
-  clearToolRegistry
+  clearToolRegistry,
+  getToolRegistryWarnings
 } from './registry'
 
 /* 대화별 노출 제한 타입은 registry 소유(정의가 거기 있다). */
-export type { ToolCategoryFilter } from './registry'
+export type { ToolCategoryFilter, ToolRegistryWarning } from './registry'
 
 export type {
   ToolSpec,
   ToolSpecBase,
+  ToolPrivilege,
   ReadToolSpec,
   WriteToolSpec,
   ActionToolSpec,
@@ -33,5 +35,7 @@ export type {
   ExternalToolBuilder,
   ReadToolContext,
   WriteToolContext,
-  ExternalToolContext
+  ExternalToolContext,
+  ToolCallContext,
+  ToolCallMode
 } from './types'