@tokenoftrust/cli 2.2.9 → 2.2.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.2.9",
+  "version": "2.2.11",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/clone.mjs

@@ -17,8 +17,8 @@
  * every store-only step. The checkout records its kind in local git config so
  * `tot git-credential` re-mints it the same way.
  *
- * This is the SAME MCP code path a developer gets when they switch to a tenant:
- * sign-in → client_switch(tenant) → tenant_checkout, where the MCP derives your
+ * This is the SAME MCP code path a developer's agent takes: sign-in →
+ * tenant_checkout({ tenant }) — the tenant named on the call, no client_switch — where the MCP derives your
  * per-tenant Git user and mints a FRESH, single-active, repo-scoped push
  * credential (a later clone for the same tenant rotates it). `tot` performs NO
  * privileged forge work itself — the MCP owns that. ("checkout" survives only as
@@ -238,9 +238,8 @@ export async function run(argv, ctx, deps = {}) {
       return 0;
     }
 
-    console.error(`~ client_switch → ${args.tenant}`);
     console.error(
-      `~ tenant_checkout (tag=${args.tag}) — MCP mints a fresh repo-scoped credential`,
+      `~ tenant_checkout (tenant=${args.tenant}) — MCP mints a fresh repo-scoped credential`,
     );
     const res = await checkoutTenant(client, {
       tenant: args.tenant,
@@ -308,7 +307,7 @@ function reportFailure(e, redact) {
 /**
  * `tot clone <alias> [dir]` for a read-only alias (the agency kit). Only the steps a
  * non-store repo needs: sign-in, the read mint, the token-free clone, the helper. No store
- * listing, client_switch, identity_bind, tenant_checkout, tenant inference, `.nvmrc` or
+ * listing, identity_bind, tenant_checkout, tenant inference, `.nvmrc` or
  * `tot dev` guidance.
  */
 async function runReadOnlyAlias(alias, args, { env, createClient, establish, signIn, cloneDeps }) {
@@ -376,23 +375,13 @@ export function checkoutPointsAtEntitlement(checkout) {
  *   cloned: boolean, dir: string|null, head: string|null }>}
  */
 export async function checkoutTenant(client, { tenant, tag = "main", cloneDir = null, redact = (s) => s }) {
-  // tenant_checkout is the SOLE AUTHORITATIVE checkout decision. The pin's refusal may be
-  // entirely expected: a staff human checking out a merchant tenant under a staff-preview
-  // authorization holds no client grant on it, so the pin MUST refuse while the checkout
-  // legitimately succeeds. `tot git-credential` mints through this same function, so
-  // treating the pin as fatal breaks every fetch and push in such a checkout, not only the
-  // clone. scopeToTenant remembers that expected refusal as `pinRefusal` and throws at once
-  // on any other pin failure (a broken session must not masquerade as an authorization
-  // problem).
-  //
-  // Two uses of the remembered refusal are BOTH wrong, and the second is the dangerous one:
-  //   - discarding it loses the only good explanation when a tenant genuinely is not yours;
-  //   - letting it OVERRIDE a checkout denial replaces an authoritative answer ("your staff
-  //     authorization expired / was revoked / does not cover this resource") with grant
-  //     guidance that sends you chasing the wrong thing entirely.
-  // So an expected pin refusal may never speak over a checkout denial (see below).
+  // tenant_checkout is the SOLE AUTHORITATIVE checkout decision, and it names the tenant
+  // (scopeToTenant injects it), so the server checks out that held tenant directly — or
+  // answers for a staff-preview authorization, or refuses naming the tenants the session
+  // holds. No client_switch is sent: it writes a selection shared by every windowless
+  // session on this login, so it can lose to another session's switch before the checkout
+  // lands, and it moves that other session's selection too.
   const scoped = await scopeToTenant(client, tenant, { redact });
-  const expectedSwitchRefusal = scoped.pinRefusal;
   // vc-app-binding safety-net (08-18, §5): ensure THIS developer is bound to the
   // storefront version-control app BEFORE checkout, so tenant_checkout can resolve
   // `appForCaller` for them instead of 403-ing "No version-control app is bound." The
@@ -409,45 +398,18 @@ export async function checkoutTenant(client, { tenant, tag = "main", cloneDir =
   } catch {
     /* fail-open — see above */
   }
-  let checkout;
-  try {
-    checkout = await scoped.callTool("tenant_checkout", { tag });
-  } catch (e) {
-    // A THROWN checkout is not a denial — it never rendered an authorization decision. Only
-    // here may the expected switch refusal speak, because it is the only explanation either
-    // call produced.
-    if (expectedSwitchRefusal) {
-      throw new CliError(redact(String(expectedSwitchRefusal?.message || expectedSwitchRefusal)), {
-        next:
-          "confirm you're entitled to this store — `tot grants` lists what your session can " +
-          "act on, and `tot login` refreshes a grant issued after you signed in. " +
-          ACCESS_EXPLAIN_HINT(tenant),
-        cause: expectedSwitchRefusal,
-      });
-    }
-    throw e;
-  }
+  const checkout = await scoped.callTool("tenant_checkout", { tag });
 
   // A non-checkout result (not provisioned / not entitled / failed) must surface
   // the MCP's human message + a concrete next step, NEVER a raw JSON.stringify
   // dump (James's 2026-07-19 first-experience failure).
   const err = checkoutError(checkout);
   if (err) {
-    // AUTHORITATIVE: the checkout rendered a decision, so it is the answer — even when the
-    // switch also refused. Substituting grant guidance here is what would tell someone whose
-    // staff authorization had EXPIRED to go looking at their grants. Only when the checkout's
-    // OWN denial points at entitlement does the switch refusal ride below it: for an invited
-    // developer it is the one that names the cause (the store is not among the tenants their
-    // session resolved), and dropping it left only a downstream "Over-scoped" that reads like
-    // a selection error.
-    if (expectedSwitchRefusal && checkoutPointsAtEntitlement(checkout)) {
-      const switchMessage = String(expectedSwitchRefusal?.message || expectedSwitchRefusal);
-      throw new CliError(
-        redact(`${err.message}\n  client_switch also refused: ${switchMessage}`),
-        { next: `${err.next} ${ACCESS_EXPLAIN_HINT(tenant)}`, cause: expectedSwitchRefusal },
-      );
-    }
-    throw new CliError(redact(err.message), { next: err.next });
+    // AUTHORITATIVE: the checkout rendered a decision, so it is the answer. When that denial
+    // points at entitlement (the store is not among the tenants the session holds), the
+    // access_explain route rides below it: it names the exact broken step for an invitee.
+    const next = checkoutPointsAtEntitlement(checkout) ? `${err.next} ${ACCESS_EXPLAIN_HINT(tenant)}` : err.next;
+    throw new CliError(redact(err.message), { next });
   }
   const gitRemote = checkout.gitRemote;
   const cloneUrl = checkout.cloneUrl ?? null;

package/src/commands/dev.mjs

@@ -760,65 +760,127 @@ export function pinnedPublicCacheDir(cacheRoot, version) {
 }
 
 /**
- * List the installed package dirs that could carry a platform-native binary,
- * normalised so a scoped package reads as `@scope+name` (mirroring pnpm's virtual
- * store naming) regardless of the on-disk layout. Prefers the pnpm virtual store
- * (`node_modules/.pnpm/*`); falls back to a shallow `node_modules` scan (one level
- * into `@scope/`) for an npm/flat install. Best-effort — returns [] on any error.
+ * List the installed packages that could carry a platform-native binary, as
+ * `{ key, pkgJson }`: `key` is normalised so a scoped package reads as
+ * `@scope+name` (pnpm's virtual-store naming) regardless of the on-disk layout,
+ * and `pkgJson` is where that package's own manifest lives. Prefers the pnpm
+ * virtual store (`node_modules/.pnpm/<name>@<ver>/node_modules/<name>`); falls back
+ * to a shallow `node_modules` scan (one level into `@scope/`) for an npm/flat
+ * install. Best-effort — returns [] on any error.
  */
 function collectNativePackageDirs(runnerDir) {
-  const pnpmDir = join(runnerDir, "node_modules", ".pnpm");
-  if (existsSync(pnpmDir)) return readdirSync(pnpmDir);
   const nm = join(runnerDir, "node_modules");
+  const pnpmDir = join(nm, ".pnpm");
+  if (existsSync(pnpmDir)) {
+    return readdirSync(pnpmDir).map((entry) => {
+      const m = /^(@[^+]+)\+([^@]+)@/.exec(entry) || /^([^@]+)@/.exec(entry);
+      const pkgName = !m ? null : m[2] !== undefined ? `${m[1]}/${m[2]}` : m[1];
+      return {
+        key: entry,
+        pkgJson: pkgName ? join(pnpmDir, entry, "node_modules", pkgName, "package.json") : null,
+      };
+    });
+  }
   if (!existsSync(nm)) return [];
-  const names = [];
+  const out = [];
   for (const e of readdirSync(nm, { withFileTypes: true })) {
     if (e.name.startsWith("@") && e.isDirectory()) {
-      for (const s of readdirSync(join(nm, e.name))) names.push(`${e.name}+${s}`);
+      for (const s of readdirSync(join(nm, e.name))) {
+        out.push({ key: `${e.name}+${s}`, pkgJson: join(nm, e.name, s, "package.json") });
+      }
     } else {
-      names.push(e.name);
+      out.push({ key: e.name, pkgJson: join(nm, e.name, "package.json") });
     }
   }
-  return names;
+  return out;
 }
 
 /**
- * True unless the installed renderer is POISONED for this host's CPU arch — the
- * "the dev server didn't come up" root cause. Platform-native binding packages
- * are named `<family>-<os>-<cpu>[-<abi>]` (e.g. `@esbuild/darwin-arm64`,
- * `lightningcss-linux-x64-gnu`, `@rollup/rollup-win32-x64-msvc`). npm's optional-
- * deps bug (npm/cli#4828) can materialise a DIFFERENT arch's variant than the host
- * needs (e.g. darwin-x64 on an arm64 Mac) — pnpm gets it right. We flag the tree
- * as poisoned exactly when a family ships a binding for our OS but NOT our OS+CPU,
- * which is the precise shape of the `Cannot find native binding` boot crash. A
- * family with no variant for our OS at all is a cross-platform optional dep that's
- * correctly absent, so it never trips the check. Never throws; on any probe error
- * it returns true (trust the cache) so a health probe can't itself break `tot dev`.
+ * The `<os>-<cpu>` targets a package's own manifest declares through its `os` and
+ * `cpu` fields — the authority npm and pnpm themselves install by. Null when the
+ * manifest is unreadable or declares no positive os AND cpu (negations such as
+ * `"!win32"` exclude rather than name a target).
+ */
+function declaredNativeTargets(pkgJsonPath) {
+  if (!pkgJsonPath) return null;
+  try {
+    const j = JSON.parse(readFileSync(pkgJsonPath, "utf8"));
+    const positive = (v) =>
+      (Array.isArray(v) ? v : typeof v === "string" ? [v] : []).filter(
+        (x) => typeof x === "string" && x && !x.startsWith("!"),
+      );
+    const os = positive(j.os);
+    const cpu = positive(j.cpu);
+    if (!os.length || !cpu.length) return null;
+    return os.flatMap((o) => cpu.map((c) => `${o}-${c}`));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Package-name spellings of an OS / CPU that differ from Node's `process.platform`
+ * / `process.arch`. `@cloudflare/workerd-linux-64` is linux-x64; reading the name
+ * token literally makes every x64 host look like it is missing workerd.
+ */
+const NATIVE_OS_ALIASES = { windows: "win32" };
+const NATIVE_CPU_ALIASES = { 64: "x64", amd64: "x64", x86_64: "x64", aarch64: "arm64", 32: "ia32", x86: "ia32", i386: "ia32" };
+
+/**
+ * Every native-binding family that ships a variant for this host's OS but not for
+ * its OS+CPU — the exact shape of astro's `Cannot find native binding` boot crash.
+ * Platform-native packages are named `<family>-<os>-<cpu>[-<abi>]` (e.g.
+ * `@esbuild/darwin-arm64`, `lightningcss-linux-x64-gnu`, `@cloudflare/workerd-linux-64`);
+ * the name only GROUPS a package into its family. Which target a package is for
+ * comes from its manifest's `os`/`cpu` fields, falling back to the name tokens
+ * (aliases normalised) only when the manifest is unreadable. npm's optional-deps bug
+ * (npm/cli#4828) can materialise a DIFFERENT arch's variant than the host needs
+ * (e.g. darwin-x64 on an arm64 Mac). A family with no variant for our OS at all is
+ * a cross-platform optional dep that's correctly absent, so it never counts.
  *
- * `platform`/`arch` are injectable so this is testable off the host's real arch.
+ * @returns {{ family: string, want: string, found: string[] }[]} — `family` in
+ *   npm spelling (`@scope/name`), `found` the targets installed for our OS.
+ *   [] on any probe error, so a health probe can't itself break `tot dev`.
  */
-export function rendererCacheHealthy(runnerDir, { platform = process.platform, arch = process.arch } = {}) {
+export function rendererNativeBindingGaps(runnerDir, { platform = process.platform, arch = process.arch } = {}) {
   try {
-    const re = /^(.*?)[-+](darwin|linux|win32|freebsd|android|openharmony)-([a-z0-9]+)/;
+    const re = /^(.*?)[-+](darwin|linux|win32|windows|freebsd|android|openharmony)-([a-z0-9_]+)/;
     const families = new Map(); // family -> Set("<os>-<cpu>")
-    for (const name of collectNativePackageDirs(runnerDir)) {
-      const m = name.match(re);
+    for (const { key, pkgJson } of collectNativePackageDirs(runnerDir)) {
+      const m = key.match(re);
       if (!m) continue;
       const [, family, os, cpu] = m;
+      const targets = declaredNativeTargets(pkgJson) || [
+        `${NATIVE_OS_ALIASES[os] || os}-${NATIVE_CPU_ALIASES[cpu] || cpu}`,
+      ];
       if (!families.has(family)) families.set(family, new Set());
-      families.get(family).add(`${os}-${cpu}`);
+      for (const t of targets) families.get(family).add(t);
     }
     const want = `${platform}-${arch}`;
-    for (const variants of families.values()) {
-      const hasOurOs = [...variants].some((v) => v.startsWith(`${platform}-`));
-      if (hasOurOs && !variants.has(want)) return false; // wrong-arch binary present, ours missing
+    const gaps = [];
+    for (const [family, variants] of families) {
+      const ours = [...variants].filter((v) => v.startsWith(`${platform}-`));
+      if (ours.length && !variants.has(want)) {
+        gaps.push({ family: family.replace(/^(@[^+]+)\+/, "$1/"), want, found: ours.sort() });
+      }
     }
-    return true;
+    return gaps;
   } catch {
-    return true;
+    return [];
   }
 }
 
+/**
+ * True unless the installed renderer is POISONED for this host's CPU arch — the
+ * "the dev server didn't come up" root cause (see rendererNativeBindingGaps).
+ * Never throws; on any probe error it returns true (trust the cache).
+ *
+ * `platform`/`arch` are injectable so this is testable off the host's real arch.
+ */
+export function rendererCacheHealthy(runnerDir, opts = {}) {
+  return rendererNativeBindingGaps(runnerDir, opts).length === 0;
+}
+
 /**
  * True unless the installed runner package is missing source the Astro config
  * chain needs to even boot — the "renderer resolves but `tot dev` can't load
@@ -1217,8 +1279,9 @@ export async function installRunnerTarball(
       const installSpin = startProgress("installing the store preview engine…", {
         stages: [{ afterMs: 20000, text: "still setting up the preview engine (first run only)…" }],
       });
+      let installer;
       try {
-        await runPnpmInstall(stagingDir, { logPath: installLog });
+        installer = await runPnpmInstall(stagingDir, { logPath: installLog });
       } finally {
         installSpin.stop();
       }
@@ -1234,12 +1297,20 @@ export async function installRunnerTarball(
       // rather than swallow it as "the dev server didn't come up". Permanent: the
       // same installer on the same host would just produce the same result, so the
       // auto-retry is skipped.
-      if (!rendererCacheHealthy(runnerDir)) {
+      const gaps = rendererNativeBindingGaps(runnerDir);
+      if (gaps.length) {
         await emitObstacle("renderer-native-bindings-missing");
         const err = new CliError(
-          `the store preview engine installed but is missing its native components for ${process.platform}-${process.arch}`,
+          `the store preview engine installed but is missing its native components for ${process.platform}-${process.arch}` +
+            ` (${gaps.map((g) => `${g.family}: only ${g.found.join(", ")} installed`).join("; ")})` +
+            `\n     details: ${installLog}`,
           {
-            next: "install pnpm (`npm i -g pnpm`, or `corepack enable`) and re-run `tot start` — pnpm installs the platform-native bits npm can skip (npm/cli#4828)",
+            // Only npm (the last-resort launcher) has the optional-deps bug that
+            // installing pnpm cures; a pnpm-installed gap is not the developer's to fix.
+            next:
+              installer === "npm"
+                ? "install pnpm (`npm i -g pnpm`, or `corepack enable`) and re-run `tot start` — pnpm installs the platform-native bits npm can skip (npm/cli#4828)"
+                : `re-run \`tot start --reset-cache\`; if it repeats, file feedback naming preview engine ${version} and the packages above — this is not something on your machine`,
             exitCode: 2,
           },
         );
@@ -1495,6 +1566,7 @@ function spawnAsyncResult(cmd, args, opts = {}) {
 /**
  * @param {string} runnerDir
  * @param {{ logPath?: string, spawnFn?: (cmd: string, args: string[], opts?: any) => any }} [opts]
+ * @returns {Promise<string>} the launcher that completed the install ("pnpm" | "corepack" | "npm").
  */
 export async function runPnpmInstall(runnerDir, { logPath, spawnFn = spawnAsyncResult } = {}) {
   const fd = logPath ? openSync(logPath, "a") : null;
@@ -1532,7 +1604,7 @@ export async function runPnpmInstall(runnerDir, { logPath, spawnFn = spawnAsyncR
         // Send both streams to the log fd (or swallow them) — never inherit.
         stdio: ["ignore", fd ?? "ignore", fd ?? "ignore"],
       });
-      if (r.status === 0) return; // installed
+      if (r.status === 0) return cmd; // installed — the launcher that did it
       if (/** @type {any} */ (r.error)?.code === "ENOENT") {
         // This launcher isn't on the machine — record it and try the next one.
         if (fd !== null) writeSync(fd, `[tot] ${cmd} not found (ENOENT) — trying the next launcher\n`);

package/src/commands/submit.mjs

@@ -1545,7 +1545,7 @@ export async function run(argv, ctx, {
       pointerScope = await scopeToTenant(client, tenant);
     } catch (error) {
       recordDiagnostic(error, {
-        command: verb, operation: "client_switch", required: false, degraded: true,
+        command: verb, operation: "tenant_scope", required: false, degraded: true,
       }, env);
     }
     const resolved = pointerScope
@@ -1661,7 +1661,7 @@ export async function run(argv, ctx, {
   let progress = null;
   let candidate = null;
   let previewPrUrl = null;
-  let operation = "client_switch";
+  let operation = "tenant_scope";
   const candidateRequired = changedEntries.length > 0;
   try {
     // Every candidate/preview call below goes through this tenant-scoped handle

package/src/tenant-scope.mjs

@@ -5,13 +5,15 @@
  * from a previous command. A command that acts on a store calls `scopeToTenant(client,
  * tenant)` once and makes every store call through the handle it returns:
  *
- *   - It pins the session with `client_switch`. A server that resolves the tenant of each
- *     call from its own `tenant` argument does not need the pin; one that still reads the
- *     session's active tenant does, and the pin is also what scopes the repo-addressed tools
- *     (PIN_SCOPED_TOOLS) for an invited developer.
  *   - It names the tenant on every call to a tool in TENANT_SCOPED_TOOLS — tools whose
  *     `tenant` argument means "the tenant this call acts on". The server uses a held tenant
  *     directly and refuses one the session does not hold; it never falls back to another.
+ *     These calls never send `client_switch`.
+ *   - It sends `client_switch` only before the first call to a tool in PIN_SCOPED_TOOLS, and
+ *     at most once. `client_switch` writes a selection the server shares across every
+ *     windowless session on the same login, so a pin can lose to another session's switch
+ *     between the pin and the call, and it moves that other session's selection too. A
+ *     command that needs no repo-addressed tool therefore never pins.
  *   - It refuses a result that reports acting on a different tenant than the one asked for.
  *
  * `test/tenant-scope-contract.test.mjs` fails the build if any file under `src/` calls a
@@ -41,7 +43,8 @@ export const TENANT_SCOPED_TOOLS = Object.freeze(new Set([
  * argument (`candidate_status` / `candidate_list` accept `tenant` only as an alias FOR `repo`;
  * `candidate_delete` / `candidate_refresh` have no `tenant` field and the server drops one).
  * The server confines them to the session's held tenants — for an invited developer, the
- * pinned one — so they go through the handle (which pinned first) with their args untouched.
+ * pinned one — so they go through the handle (which pins before the first of them) with
+ * their args untouched.
  */
 export const PIN_SCOPED_TOOLS = Object.freeze(new Set([
   "candidate_status",
@@ -109,22 +112,18 @@ export function isNotClientTenantRefusal(error) {
 /**
  * @typedef {{
  *   tenant: string,
- *   pinRefusal: any,
  *   callTool: (name: string, args?: Record<string, unknown>) => Promise<any>,
  * }} ScopedClient
- *   `pinRefusal` is the expected client_switch refusal (see isNotClientTenantRefusal) when
- *   the pin was refused, else null. The calls still name the tenant, so the server answers
- *   them authoritatively; `pinRefusal` is only the explanation a caller may add when no
- *   call produced a better one.
  */
 
 /**
- * Pin the session to `tenant` and return the handle every store call goes through.
+ * Return the handle every store call for `tenant` goes through. Sends nothing by itself.
  *
- * An expected client_switch refusal (the tenant is not one of the caller's clients — the
- * normal case for a staff human under a staff-preview authorization) is remembered on the
- * handle and the calls proceed, each naming the tenant, so the server decides. Any other
- * client_switch failure means the session is unusable and throws a CliError at once.
+ * The pin (`client_switch`) is sent lazily, once, before the first PIN_SCOPED_TOOLS call.
+ * An expected refusal of it (the tenant is not one of the caller's clients — the normal
+ * case for a staff human under a staff-preview authorization) is tolerated and the call
+ * proceeds, so the server decides. Any other pin failure means the session is unusable and
+ * that call throws a CliError without being sent.
  *
  * @param {{ callTool: (name: string, args: unknown) => Promise<any> }} client
  * @param {string} tenant
@@ -140,18 +139,20 @@ export async function scopeToTenant(client, tenant, { redact = (s) => s } = {})
   }
   const name = String(tenant).trim();
 
-  let pinRefusal = null;
-  try {
-    await client.callTool("client_switch", { tenant: name });
-  } catch (e) {
-    if (isNotClientTenantRefusal(e)) {
-      pinRefusal = e;
-    } else {
-      throw new CliError(redact(String(/** @type {any} */ (e)?.message || e)), {
-        next: "the session could not be scoped — check your connection and run `tot whoami`",
-        cause: e,
-      });
-    }
+  /** @type {Promise<void>|null} */
+  let pinned = null;
+  function pin() {
+    pinned ??= client.callTool("client_switch", { tenant: name }).then(
+      () => undefined,
+      (e) => {
+        if (isNotClientTenantRefusal(e)) return;
+        throw new CliError(redact(String(/** @type {any} */ (e)?.message || e)), {
+          next: "the session could not be scoped — check your connection and run `tot whoami`",
+          cause: e,
+        });
+      },
+    );
+    return pinned;
   }
 
   /**
@@ -159,6 +160,10 @@ export async function scopeToTenant(client, tenant, { redact = (s) => s } = {})
    * @param {Record<string, unknown>} [args]
    */
   async function callTool(tool, args = {}) {
+    if (PIN_SCOPED_TOOLS.has(tool)) {
+      await pin();
+      return client.callTool(tool, args);
+    }
     if (!TENANT_SCOPED_TOOLS.has(tool)) return client.callTool(tool, args);
     if (args && Object.hasOwn(args, "tenant") && normalizeTenant(args.tenant) !== requested) {
       throw new CliError(
@@ -180,5 +185,5 @@ export async function scopeToTenant(client, tenant, { redact = (s) => s } = {})
     return result;
   }
 
-  return { tenant: name, pinRefusal, callTool };
+  return { tenant: name, callTool };
 }