@truefoundry/trueforge-core 0.2.0-rc.5 → 0.2.0-rc.6

package/dist/core/mcp/ToolSelectorPolicy.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/core/mcp/ToolSelectorPolicy.ts"],"sourcesContent":["import type { ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';\nimport type { AgentToolSchema } from './IMCPServer';\nimport {\n  DEFAULT_REQUIRE_APPROVAL_FOR_TOOLS,\n  isToolAllowed,\n  literalToolNames,\n  selectorsIncludeAll,\n  toolMatchesAnySelector,\n  toolRequiresApproval,\n} from './toolSelectors';\n\n/**\n * Per-server tool selectors. Enable/disable/preload tags: `@all`, `@read-only`.\n * Approval tags: `@all`, `@write`, `@destructive`.\n */\nexport interface ToolSelectorConfig {\n  enableTools: string[];\n  disableTools: string[];\n  preloadTools: string[];\n  requireApprovalForTools?: string[] | undefined;\n}\n\n/**\n * Encapsulates enable/disable/preload/approval selector policy for a single MCP server. Pure: it\n * never throws or does IO — callers decide how to surface a disallowed/missing tool so each can\n * raise its own error type.\n */\nexport class ToolSelectorPolicy {\n  readonly preload: boolean;\n  readonly hasPreloadedTools: boolean;\n\n  private readonly enableTools: string[];\n  private readonly disableTools: string[];\n  private readonly preloadTools: string[];\n  private readonly requireApprovalForTools: string[];\n  // Tool names that survived enable/disable filtering on the most recent filterAndAnnotate() call.\n  // Used by the sandbox allow-list and as the fast path for callTool gating.\n  private resolvedAllowedToolNames: string[] | undefined;\n\n  constructor(params: { selectors: ToolSelectorConfig; preload: boolean }) {\n    this.enableTools = params.selectors.enableTools;\n    this.disableTools = params.selectors.disableTools;\n    this.preloadTools = params.selectors.preloadTools;\n    this.requireApprovalForTools = params.selectors.requireApprovalForTools ?? DEFAULT_REQUIRE_APPROVAL_FOR_TOOLS;\n    this.preload = params.preload;\n    this.hasPreloadedTools = params.preload || this.preloadTools.length > 0;\n  }\n\n  /** Literal enable_tools names that are not present on the server (caller throws if non-empty). */\n  missingEnableLiterals(tools: AgentToolSchema[]): string[] {\n    const availableNames = new Set(tools.map(t => t.name));\n    return literalToolNames(this.enableTools).filter(name => !availableNames.has(name));\n  }\n\n  /** Filter by enable/disable, record the resolved allow-list, and annotate per-tool preload. */\n  filterAndAnnotate(tools: AgentToolSchema[]): AgentToolSchema[] {\n    const filtered = tools.filter(tool =>\n      isToolAllowed({\n        toolName: tool.name,\n        annotations: tool.annotations,\n        enableSelectors: this.enableTools,\n        disableSelectors: this.disableTools,\n      }),\n    );\n    this.resolvedAllowedToolNames = filtered.map(t => t.name);\n    return filtered.map(tool => ({ ...tool, preload: this.isToolPreloaded(tool.name, tool.annotations) }));\n  }\n\n  private isToolPreloaded(toolName: string, annotations: ToolAnnotations | undefined): boolean {\n    // Fully-preloaded server: every allowed tool is loaded into context.\n    if (this.preload) {\n      return true;\n    }\n    // Otherwise only the tools matching `preload_tools` stay eager.\n    return toolMatchesAnySelector(toolName, annotations, this.preloadTools);\n  }\n\n  /**\n   * Whether a tool may be called. Uses the resolved allow-list once listTools() has run; before that\n   * falls back to matching against the raw selectors, resolving annotations lazily only when needed.\n   */\n  async isAllowed(toolName: string, resolveAnnotations: () => Promise<ToolAnnotations | undefined>): Promise<boolean> {\n    if (this.resolvedAllowedToolNames) {\n      return this.resolvedAllowedToolNames.includes(toolName);\n    }\n    return isToolAllowed({\n      toolName,\n      annotations: await resolveAnnotations(),\n      enableSelectors: this.enableTools,\n      disableSelectors: this.disableTools,\n    });\n  }\n\n  /**\n   * Best-effort allow-list for the sandbox. After a listTools() call returns the concrete names;\n   * before that, `@all` with no disables means \"unrestricted\" (undefined), else the literal names.\n   */\n  allowedNamesForSandbox(): string[] | undefined {\n    if (this.resolvedAllowedToolNames) {\n      return this.resolvedAllowedToolNames;\n    }\n    if (selectorsIncludeAll(this.enableTools) && this.disableTools.length === 0) {\n      return undefined;\n    }\n    return literalToolNames(this.enableTools);\n  }\n\n  /**\n   * Whether the tool requires human approval. Honors `requireApprovalForTools` exactly: omit /\n   * undefined defaults to write+destructive (constructor); an explicit list — including empty —\n   * is exact.\n   */\n  requiresApproval(toolName: string, annotations: ToolAnnotations | undefined): boolean {\n    return toolRequiresApproval(toolName, annotations, this.requireApprovalForTools);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,2BAOO;AAkBA,IAAM,qBAAN,MAAyB;AAAA,EACrB;AAAA,EACA;AAAA,EAEQ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGT;AAAA,EAER,YAAY,QAA6D;AACvE,SAAK,cAAc,OAAO,UAAU;AACpC,SAAK,eAAe,OAAO,UAAU;AACrC,SAAK,eAAe,OAAO,UAAU;AACrC,SAAK,0BAA0B,OAAO,UAAU,2BAA2B;AAC3E,SAAK,UAAU,OAAO;AACtB,SAAK,oBAAoB,OAAO,WAAW,KAAK,aAAa,SAAS;AAAA,EACxE;AAAA;AAAA,EAGA,sBAAsB,OAAoC;AACxD,UAAM,iBAAiB,IAAI,IAAI,MAAM,IAAI,OAAK,EAAE,IAAI,CAAC;AACrD,eAAO,uCAAiB,KAAK,WAAW,EAAE,OAAO,UAAQ,CAAC,eAAe,IAAI,IAAI,CAAC;AAAA,EACpF;AAAA;AAAA,EAGA,kBAAkB,OAA6C;AAC7D,UAAM,WAAW,MAAM;AAAA,MAAO,cAC5B,oCAAc;AAAA,QACZ,UAAU,KAAK;AAAA,QACf,aAAa,KAAK;AAAA,QAClB,iBAAiB,KAAK;AAAA,QACtB,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AACA,SAAK,2BAA2B,SAAS,IAAI,OAAK,EAAE,IAAI;AACxD,WAAO,SAAS,IAAI,WAAS,EAAE,GAAG,MAAM,SAAS,KAAK,gBAAgB,KAAK,MAAM,KAAK,WAAW,EAAE,EAAE;AAAA,EACvG;AAAA,EAEQ,gBAAgB,UAAkB,aAAmD;AAE3F,QAAI,KAAK,SAAS;AAChB,aAAO;AAAA,IACT;AAEA,eAAO,6CAAuB,UAAU,aAAa,KAAK,YAAY;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,UAAU,UAAkB,oBAAkF;AAClH,QAAI,KAAK,0BAA0B;AACjC,aAAO,KAAK,yBAAyB,SAAS,QAAQ;AAAA,IACxD;AACA,eAAO,oCAAc;AAAA,MACnB;AAAA,MACA,aAAa,MAAM,mBAAmB;AAAA,MACtC,iBAAiB,KAAK;AAAA,MACtB,kBAAkB,KAAK;AAAA,IACzB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,yBAA+C;AAC7C,QAAI,KAAK,0BAA0B;AACjC,aAAO,KAAK;AAAA,IACd;AACA,YAAI,0CAAoB,KAAK,WAAW,KAAK,KAAK,aAAa,WAAW,GAAG;AAC3E,aAAO;AAAA,IACT;AACA,eAAO,uCAAiB,KAAK,WAAW;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,iBAAiB,UAAkB,aAAmD;AACpF,eAAO,2CAAqB,UAAU,aAAa,KAAK,uBAAuB;AAAA,EACjF;AACF;","names":[]}
+{"version":3,"sources":["../../../src/core/mcp/ToolSelectorPolicy.ts"],"sourcesContent":["import type { ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';\nimport type { AgentToolSchema } from './IMCPServer';\nimport {\n  DEFAULT_REQUIRE_APPROVAL_FOR_TOOLS,\n  isToolAllowed,\n  literalToolNames,\n  selectorsIncludeAll,\n  toolMatchesAnySelector,\n  toolRequiresApproval,\n} from './toolSelectors';\n\n/**\n * Per-server tool selectors. Enable/disable/preload tags: `@all`, `@read-only`.\n * Approval tags: `@all`, `@write`, `@destructive`.\n */\nexport interface ToolSelectorConfig {\n  enableTools: string[];\n  disableTools: string[];\n  preloadTools: string[];\n  requireApprovalForTools?: string[] | undefined;\n}\n\n/**\n * Encapsulates enable/disable/preload/approval selector policy for a single MCP server. Pure: it\n * never throws or does IO — callers decide how to surface a disallowed/missing tool so each can\n * raise its own error type.\n */\nexport class ToolSelectorPolicy {\n  readonly preload: boolean;\n  readonly hasPreloadedTools: boolean;\n\n  private readonly enableTools: string[];\n  private readonly disableTools: string[];\n  private readonly preloadTools: string[];\n  private readonly requireApprovalForTools: string[];\n  // Tool names that survived enable/disable filtering on the most recent filterAndAnnotate() call.\n  // Used by the sandbox allow-list and as the fast path for callTool gating.\n  private resolvedAllowedToolNames: string[] | undefined;\n\n  constructor(params: { selectors: ToolSelectorConfig; preload: boolean }) {\n    this.enableTools = params.selectors.enableTools;\n    this.disableTools = params.selectors.disableTools;\n    this.preloadTools = params.selectors.preloadTools;\n    this.requireApprovalForTools = params.selectors.requireApprovalForTools ?? DEFAULT_REQUIRE_APPROVAL_FOR_TOOLS;\n    this.preload = params.preload;\n    this.hasPreloadedTools = params.preload || this.preloadTools.length > 0;\n  }\n\n  /** Literal enable_tools names that are not present on the server (caller throws if non-empty). */\n  missingEnableLiterals(tools: AgentToolSchema[]): string[] {\n    const availableNames = new Set(tools.map(t => t.name));\n    return literalToolNames(this.enableTools).filter(name => !availableNames.has(name));\n  }\n\n  /** Filter by enable/disable, record the resolved allow-list, and annotate per-tool preload. */\n  filterAndAnnotate(tools: AgentToolSchema[]): AgentToolSchema[] {\n    const filtered = tools.filter(tool =>\n      isToolAllowed({\n        toolName: tool.name,\n        annotations: tool.annotations,\n        enableSelectors: this.enableTools,\n        disableSelectors: this.disableTools,\n      }),\n    );\n    this.resolvedAllowedToolNames = filtered.map(t => t.name);\n    return filtered.map(tool => ({ ...tool, preload: this.isToolPreloaded(tool.name, tool.annotations) }));\n  }\n\n  private isToolPreloaded(toolName: string, annotations: ToolAnnotations | undefined): boolean {\n    // Fully-preloaded server: every allowed tool is loaded into context.\n    if (this.preload) {\n      return true;\n    }\n    // Otherwise only the tools matching `preload_tools` stay eager.\n    return toolMatchesAnySelector(toolName, annotations, this.preloadTools);\n  }\n\n  /**\n   * Whether a tool may be called. Uses the resolved allow-list once listTools() has run; before that\n   * falls back to matching against the raw selectors, resolving annotations lazily only when needed.\n   */\n  async isAllowed(toolName: string, resolveAnnotations: () => Promise<ToolAnnotations | undefined>): Promise<boolean> {\n    if (this.resolvedAllowedToolNames) {\n      return this.resolvedAllowedToolNames.includes(toolName);\n    }\n    return isToolAllowed({\n      toolName,\n      annotations: await resolveAnnotations(),\n      enableSelectors: this.enableTools,\n      disableSelectors: this.disableTools,\n    });\n  }\n\n  /**\n   * Best-effort allow-list for the sandbox. After a listTools() call returns the concrete names;\n   * before that, `@all` with no disables means \"unrestricted\" (undefined), else the literal names.\n   */\n  allowedNamesForSandbox(): string[] | undefined {\n    if (this.resolvedAllowedToolNames) {\n      return this.resolvedAllowedToolNames;\n    }\n    if (selectorsIncludeAll(this.enableTools) && this.disableTools.length === 0) {\n      return undefined;\n    }\n    return literalToolNames(this.enableTools);\n  }\n\n  /**\n   * Whether the tool requires human approval. Honors `requireApprovalForTools` exactly: omit /\n   * undefined defaults to `@destructive` (constructor); an explicit list — including empty —\n   * is exact.\n   */\n  requiresApproval(toolName: string, annotations: ToolAnnotations | undefined): boolean {\n    return toolRequiresApproval(toolName, annotations, this.requireApprovalForTools);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,2BAOO;AAkBA,IAAM,qBAAN,MAAyB;AAAA,EACrB;AAAA,EACA;AAAA,EAEQ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGT;AAAA,EAER,YAAY,QAA6D;AACvE,SAAK,cAAc,OAAO,UAAU;AACpC,SAAK,eAAe,OAAO,UAAU;AACrC,SAAK,eAAe,OAAO,UAAU;AACrC,SAAK,0BAA0B,OAAO,UAAU,2BAA2B;AAC3E,SAAK,UAAU,OAAO;AACtB,SAAK,oBAAoB,OAAO,WAAW,KAAK,aAAa,SAAS;AAAA,EACxE;AAAA;AAAA,EAGA,sBAAsB,OAAoC;AACxD,UAAM,iBAAiB,IAAI,IAAI,MAAM,IAAI,OAAK,EAAE,IAAI,CAAC;AACrD,eAAO,uCAAiB,KAAK,WAAW,EAAE,OAAO,UAAQ,CAAC,eAAe,IAAI,IAAI,CAAC;AAAA,EACpF;AAAA;AAAA,EAGA,kBAAkB,OAA6C;AAC7D,UAAM,WAAW,MAAM;AAAA,MAAO,cAC5B,oCAAc;AAAA,QACZ,UAAU,KAAK;AAAA,QACf,aAAa,KAAK;AAAA,QAClB,iBAAiB,KAAK;AAAA,QACtB,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AACA,SAAK,2BAA2B,SAAS,IAAI,OAAK,EAAE,IAAI;AACxD,WAAO,SAAS,IAAI,WAAS,EAAE,GAAG,MAAM,SAAS,KAAK,gBAAgB,KAAK,MAAM,KAAK,WAAW,EAAE,EAAE;AAAA,EACvG;AAAA,EAEQ,gBAAgB,UAAkB,aAAmD;AAE3F,QAAI,KAAK,SAAS;AAChB,aAAO;AAAA,IACT;AAEA,eAAO,6CAAuB,UAAU,aAAa,KAAK,YAAY;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,UAAU,UAAkB,oBAAkF;AAClH,QAAI,KAAK,0BAA0B;AACjC,aAAO,KAAK,yBAAyB,SAAS,QAAQ;AAAA,IACxD;AACA,eAAO,oCAAc;AAAA,MACnB;AAAA,MACA,aAAa,MAAM,mBAAmB;AAAA,MACtC,iBAAiB,KAAK;AAAA,MACtB,kBAAkB,KAAK;AAAA,IACzB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,yBAA+C;AAC7C,QAAI,KAAK,0BAA0B;AACjC,aAAO,KAAK;AAAA,IACd;AACA,YAAI,0CAAoB,KAAK,WAAW,KAAK,KAAK,aAAa,WAAW,GAAG;AAC3E,aAAO;AAAA,IACT;AACA,eAAO,uCAAiB,KAAK,WAAW;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,iBAAiB,UAAkB,aAAmD;AACpF,eAAO,2CAAqB,UAAU,aAAa,KAAK,uBAAuB;AAAA,EACjF;AACF;","names":[]}

package/dist/core/mcp/ToolSelectorPolicy.mjs

@@ -79,7 +79,7 @@ var ToolSelectorPolicy = class {
   }
   /**
    * Whether the tool requires human approval. Honors `requireApprovalForTools` exactly: omit /
-   * undefined defaults to write+destructive (constructor); an explicit list — including empty —
+   * undefined defaults to `@destructive` (constructor); an explicit list — including empty —
    * is exact.
    */
   requiresApproval(toolName, annotations) {

package/dist/core/mcp/ToolSelectorPolicy.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/core/mcp/ToolSelectorPolicy.ts"],"sourcesContent":["import type { ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';\nimport type { AgentToolSchema } from './IMCPServer';\nimport {\n  DEFAULT_REQUIRE_APPROVAL_FOR_TOOLS,\n  isToolAllowed,\n  literalToolNames,\n  selectorsIncludeAll,\n  toolMatchesAnySelector,\n  toolRequiresApproval,\n} from './toolSelectors';\n\n/**\n * Per-server tool selectors. Enable/disable/preload tags: `@all`, `@read-only`.\n * Approval tags: `@all`, `@write`, `@destructive`.\n */\nexport interface ToolSelectorConfig {\n  enableTools: string[];\n  disableTools: string[];\n  preloadTools: string[];\n  requireApprovalForTools?: string[] | undefined;\n}\n\n/**\n * Encapsulates enable/disable/preload/approval selector policy for a single MCP server. Pure: it\n * never throws or does IO — callers decide how to surface a disallowed/missing tool so each can\n * raise its own error type.\n */\nexport class ToolSelectorPolicy {\n  readonly preload: boolean;\n  readonly hasPreloadedTools: boolean;\n\n  private readonly enableTools: string[];\n  private readonly disableTools: string[];\n  private readonly preloadTools: string[];\n  private readonly requireApprovalForTools: string[];\n  // Tool names that survived enable/disable filtering on the most recent filterAndAnnotate() call.\n  // Used by the sandbox allow-list and as the fast path for callTool gating.\n  private resolvedAllowedToolNames: string[] | undefined;\n\n  constructor(params: { selectors: ToolSelectorConfig; preload: boolean }) {\n    this.enableTools = params.selectors.enableTools;\n    this.disableTools = params.selectors.disableTools;\n    this.preloadTools = params.selectors.preloadTools;\n    this.requireApprovalForTools = params.selectors.requireApprovalForTools ?? DEFAULT_REQUIRE_APPROVAL_FOR_TOOLS;\n    this.preload = params.preload;\n    this.hasPreloadedTools = params.preload || this.preloadTools.length > 0;\n  }\n\n  /** Literal enable_tools names that are not present on the server (caller throws if non-empty). */\n  missingEnableLiterals(tools: AgentToolSchema[]): string[] {\n    const availableNames = new Set(tools.map(t => t.name));\n    return literalToolNames(this.enableTools).filter(name => !availableNames.has(name));\n  }\n\n  /** Filter by enable/disable, record the resolved allow-list, and annotate per-tool preload. */\n  filterAndAnnotate(tools: AgentToolSchema[]): AgentToolSchema[] {\n    const filtered = tools.filter(tool =>\n      isToolAllowed({\n        toolName: tool.name,\n        annotations: tool.annotations,\n        enableSelectors: this.enableTools,\n        disableSelectors: this.disableTools,\n      }),\n    );\n    this.resolvedAllowedToolNames = filtered.map(t => t.name);\n    return filtered.map(tool => ({ ...tool, preload: this.isToolPreloaded(tool.name, tool.annotations) }));\n  }\n\n  private isToolPreloaded(toolName: string, annotations: ToolAnnotations | undefined): boolean {\n    // Fully-preloaded server: every allowed tool is loaded into context.\n    if (this.preload) {\n      return true;\n    }\n    // Otherwise only the tools matching `preload_tools` stay eager.\n    return toolMatchesAnySelector(toolName, annotations, this.preloadTools);\n  }\n\n  /**\n   * Whether a tool may be called. Uses the resolved allow-list once listTools() has run; before that\n   * falls back to matching against the raw selectors, resolving annotations lazily only when needed.\n   */\n  async isAllowed(toolName: string, resolveAnnotations: () => Promise<ToolAnnotations | undefined>): Promise<boolean> {\n    if (this.resolvedAllowedToolNames) {\n      return this.resolvedAllowedToolNames.includes(toolName);\n    }\n    return isToolAllowed({\n      toolName,\n      annotations: await resolveAnnotations(),\n      enableSelectors: this.enableTools,\n      disableSelectors: this.disableTools,\n    });\n  }\n\n  /**\n   * Best-effort allow-list for the sandbox. After a listTools() call returns the concrete names;\n   * before that, `@all` with no disables means \"unrestricted\" (undefined), else the literal names.\n   */\n  allowedNamesForSandbox(): string[] | undefined {\n    if (this.resolvedAllowedToolNames) {\n      return this.resolvedAllowedToolNames;\n    }\n    if (selectorsIncludeAll(this.enableTools) && this.disableTools.length === 0) {\n      return undefined;\n    }\n    return literalToolNames(this.enableTools);\n  }\n\n  /**\n   * Whether the tool requires human approval. Honors `requireApprovalForTools` exactly: omit /\n   * undefined defaults to write+destructive (constructor); an explicit list — including empty —\n   * is exact.\n   */\n  requiresApproval(toolName: string, annotations: ToolAnnotations | undefined): boolean {\n    return toolRequiresApproval(toolName, annotations, this.requireApprovalForTools);\n  }\n}\n"],"mappings":";AAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAkBA,IAAM,qBAAN,MAAyB;AAAA,EACrB;AAAA,EACA;AAAA,EAEQ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGT;AAAA,EAER,YAAY,QAA6D;AACvE,SAAK,cAAc,OAAO,UAAU;AACpC,SAAK,eAAe,OAAO,UAAU;AACrC,SAAK,eAAe,OAAO,UAAU;AACrC,SAAK,0BAA0B,OAAO,UAAU,2BAA2B;AAC3E,SAAK,UAAU,OAAO;AACtB,SAAK,oBAAoB,OAAO,WAAW,KAAK,aAAa,SAAS;AAAA,EACxE;AAAA;AAAA,EAGA,sBAAsB,OAAoC;AACxD,UAAM,iBAAiB,IAAI,IAAI,MAAM,IAAI,OAAK,EAAE,IAAI,CAAC;AACrD,WAAO,iBAAiB,KAAK,WAAW,EAAE,OAAO,UAAQ,CAAC,eAAe,IAAI,IAAI,CAAC;AAAA,EACpF;AAAA;AAAA,EAGA,kBAAkB,OAA6C;AAC7D,UAAM,WAAW,MAAM;AAAA,MAAO,UAC5B,cAAc;AAAA,QACZ,UAAU,KAAK;AAAA,QACf,aAAa,KAAK;AAAA,QAClB,iBAAiB,KAAK;AAAA,QACtB,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AACA,SAAK,2BAA2B,SAAS,IAAI,OAAK,EAAE,IAAI;AACxD,WAAO,SAAS,IAAI,WAAS,EAAE,GAAG,MAAM,SAAS,KAAK,gBAAgB,KAAK,MAAM,KAAK,WAAW,EAAE,EAAE;AAAA,EACvG;AAAA,EAEQ,gBAAgB,UAAkB,aAAmD;AAE3F,QAAI,KAAK,SAAS;AAChB,aAAO;AAAA,IACT;AAEA,WAAO,uBAAuB,UAAU,aAAa,KAAK,YAAY;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,UAAU,UAAkB,oBAAkF;AAClH,QAAI,KAAK,0BAA0B;AACjC,aAAO,KAAK,yBAAyB,SAAS,QAAQ;AAAA,IACxD;AACA,WAAO,cAAc;AAAA,MACnB;AAAA,MACA,aAAa,MAAM,mBAAmB;AAAA,MACtC,iBAAiB,KAAK;AAAA,MACtB,kBAAkB,KAAK;AAAA,IACzB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,yBAA+C;AAC7C,QAAI,KAAK,0BAA0B;AACjC,aAAO,KAAK;AAAA,IACd;AACA,QAAI,oBAAoB,KAAK,WAAW,KAAK,KAAK,aAAa,WAAW,GAAG;AAC3E,aAAO;AAAA,IACT;AACA,WAAO,iBAAiB,KAAK,WAAW;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,iBAAiB,UAAkB,aAAmD;AACpF,WAAO,qBAAqB,UAAU,aAAa,KAAK,uBAAuB;AAAA,EACjF;AACF;","names":[]}
+{"version":3,"sources":["../../../src/core/mcp/ToolSelectorPolicy.ts"],"sourcesContent":["import type { ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';\nimport type { AgentToolSchema } from './IMCPServer';\nimport {\n  DEFAULT_REQUIRE_APPROVAL_FOR_TOOLS,\n  isToolAllowed,\n  literalToolNames,\n  selectorsIncludeAll,\n  toolMatchesAnySelector,\n  toolRequiresApproval,\n} from './toolSelectors';\n\n/**\n * Per-server tool selectors. Enable/disable/preload tags: `@all`, `@read-only`.\n * Approval tags: `@all`, `@write`, `@destructive`.\n */\nexport interface ToolSelectorConfig {\n  enableTools: string[];\n  disableTools: string[];\n  preloadTools: string[];\n  requireApprovalForTools?: string[] | undefined;\n}\n\n/**\n * Encapsulates enable/disable/preload/approval selector policy for a single MCP server. Pure: it\n * never throws or does IO — callers decide how to surface a disallowed/missing tool so each can\n * raise its own error type.\n */\nexport class ToolSelectorPolicy {\n  readonly preload: boolean;\n  readonly hasPreloadedTools: boolean;\n\n  private readonly enableTools: string[];\n  private readonly disableTools: string[];\n  private readonly preloadTools: string[];\n  private readonly requireApprovalForTools: string[];\n  // Tool names that survived enable/disable filtering on the most recent filterAndAnnotate() call.\n  // Used by the sandbox allow-list and as the fast path for callTool gating.\n  private resolvedAllowedToolNames: string[] | undefined;\n\n  constructor(params: { selectors: ToolSelectorConfig; preload: boolean }) {\n    this.enableTools = params.selectors.enableTools;\n    this.disableTools = params.selectors.disableTools;\n    this.preloadTools = params.selectors.preloadTools;\n    this.requireApprovalForTools = params.selectors.requireApprovalForTools ?? DEFAULT_REQUIRE_APPROVAL_FOR_TOOLS;\n    this.preload = params.preload;\n    this.hasPreloadedTools = params.preload || this.preloadTools.length > 0;\n  }\n\n  /** Literal enable_tools names that are not present on the server (caller throws if non-empty). */\n  missingEnableLiterals(tools: AgentToolSchema[]): string[] {\n    const availableNames = new Set(tools.map(t => t.name));\n    return literalToolNames(this.enableTools).filter(name => !availableNames.has(name));\n  }\n\n  /** Filter by enable/disable, record the resolved allow-list, and annotate per-tool preload. */\n  filterAndAnnotate(tools: AgentToolSchema[]): AgentToolSchema[] {\n    const filtered = tools.filter(tool =>\n      isToolAllowed({\n        toolName: tool.name,\n        annotations: tool.annotations,\n        enableSelectors: this.enableTools,\n        disableSelectors: this.disableTools,\n      }),\n    );\n    this.resolvedAllowedToolNames = filtered.map(t => t.name);\n    return filtered.map(tool => ({ ...tool, preload: this.isToolPreloaded(tool.name, tool.annotations) }));\n  }\n\n  private isToolPreloaded(toolName: string, annotations: ToolAnnotations | undefined): boolean {\n    // Fully-preloaded server: every allowed tool is loaded into context.\n    if (this.preload) {\n      return true;\n    }\n    // Otherwise only the tools matching `preload_tools` stay eager.\n    return toolMatchesAnySelector(toolName, annotations, this.preloadTools);\n  }\n\n  /**\n   * Whether a tool may be called. Uses the resolved allow-list once listTools() has run; before that\n   * falls back to matching against the raw selectors, resolving annotations lazily only when needed.\n   */\n  async isAllowed(toolName: string, resolveAnnotations: () => Promise<ToolAnnotations | undefined>): Promise<boolean> {\n    if (this.resolvedAllowedToolNames) {\n      return this.resolvedAllowedToolNames.includes(toolName);\n    }\n    return isToolAllowed({\n      toolName,\n      annotations: await resolveAnnotations(),\n      enableSelectors: this.enableTools,\n      disableSelectors: this.disableTools,\n    });\n  }\n\n  /**\n   * Best-effort allow-list for the sandbox. After a listTools() call returns the concrete names;\n   * before that, `@all` with no disables means \"unrestricted\" (undefined), else the literal names.\n   */\n  allowedNamesForSandbox(): string[] | undefined {\n    if (this.resolvedAllowedToolNames) {\n      return this.resolvedAllowedToolNames;\n    }\n    if (selectorsIncludeAll(this.enableTools) && this.disableTools.length === 0) {\n      return undefined;\n    }\n    return literalToolNames(this.enableTools);\n  }\n\n  /**\n   * Whether the tool requires human approval. Honors `requireApprovalForTools` exactly: omit /\n   * undefined defaults to `@destructive` (constructor); an explicit list — including empty —\n   * is exact.\n   */\n  requiresApproval(toolName: string, annotations: ToolAnnotations | undefined): boolean {\n    return toolRequiresApproval(toolName, annotations, this.requireApprovalForTools);\n  }\n}\n"],"mappings":";AAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAkBA,IAAM,qBAAN,MAAyB;AAAA,EACrB;AAAA,EACA;AAAA,EAEQ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGT;AAAA,EAER,YAAY,QAA6D;AACvE,SAAK,cAAc,OAAO,UAAU;AACpC,SAAK,eAAe,OAAO,UAAU;AACrC,SAAK,eAAe,OAAO,UAAU;AACrC,SAAK,0BAA0B,OAAO,UAAU,2BAA2B;AAC3E,SAAK,UAAU,OAAO;AACtB,SAAK,oBAAoB,OAAO,WAAW,KAAK,aAAa,SAAS;AAAA,EACxE;AAAA;AAAA,EAGA,sBAAsB,OAAoC;AACxD,UAAM,iBAAiB,IAAI,IAAI,MAAM,IAAI,OAAK,EAAE,IAAI,CAAC;AACrD,WAAO,iBAAiB,KAAK,WAAW,EAAE,OAAO,UAAQ,CAAC,eAAe,IAAI,IAAI,CAAC;AAAA,EACpF;AAAA;AAAA,EAGA,kBAAkB,OAA6C;AAC7D,UAAM,WAAW,MAAM;AAAA,MAAO,UAC5B,cAAc;AAAA,QACZ,UAAU,KAAK;AAAA,QACf,aAAa,KAAK;AAAA,QAClB,iBAAiB,KAAK;AAAA,QACtB,kBAAkB,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AACA,SAAK,2BAA2B,SAAS,IAAI,OAAK,EAAE,IAAI;AACxD,WAAO,SAAS,IAAI,WAAS,EAAE,GAAG,MAAM,SAAS,KAAK,gBAAgB,KAAK,MAAM,KAAK,WAAW,EAAE,EAAE;AAAA,EACvG;AAAA,EAEQ,gBAAgB,UAAkB,aAAmD;AAE3F,QAAI,KAAK,SAAS;AAChB,aAAO;AAAA,IACT;AAEA,WAAO,uBAAuB,UAAU,aAAa,KAAK,YAAY;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,UAAU,UAAkB,oBAAkF;AAClH,QAAI,KAAK,0BAA0B;AACjC,aAAO,KAAK,yBAAyB,SAAS,QAAQ;AAAA,IACxD;AACA,WAAO,cAAc;AAAA,MACnB;AAAA,MACA,aAAa,MAAM,mBAAmB;AAAA,MACtC,iBAAiB,KAAK;AAAA,MACtB,kBAAkB,KAAK;AAAA,IACzB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,yBAA+C;AAC7C,QAAI,KAAK,0BAA0B;AACjC,aAAO,KAAK;AAAA,IACd;AACA,QAAI,oBAAoB,KAAK,WAAW,KAAK,KAAK,aAAa,WAAW,GAAG;AAC3E,aAAO;AAAA,IACT;AACA,WAAO,iBAAiB,KAAK,WAAW;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,iBAAiB,UAAkB,aAAmD;AACpF,WAAO,qBAAqB,UAAU,aAAa,KAAK,uBAAuB;AAAA,EACjF;AACF;","names":[]}

package/dist/core/mcp/remoteMcpClient.d.ts

@@ -1,3 +1,4 @@
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
 import type { CallToolRequest, CallToolResult } from '@modelcontextprotocol/sdk/types.js';
 import type { ToolSchema } from './IMCPServer';
 /** Networking for remote (url-based) MCP servers, kept separate so it can be mocked in tests. */
@@ -13,6 +14,9 @@ export interface RemoteMcpConnection {
     callTool(params: CallToolRequest['params']): Promise<CallToolResult>;
     close(): Promise<void>;
 }
+export declare const DEFAULT_MAX_MCP_RESPONSE_BYTES: number;
+/** GET SSE is long-lived and uncapped; every other body aborts at `maxBytes`. */
+export declare function withMaxResponseBytes(fetchFn: FetchLike, maxBytes: number): FetchLike;
 export declare function isSessionExpiredError(error: unknown): boolean;
 /**
  * Connect to a remote MCP server, keeping the first transport that connects. `sessionId` is passed to
@@ -29,6 +33,7 @@ export declare function connectRemoteMcp(params: {
     knownTransportType?: RemoteMcpTransportType | undefined;
     requestTimeoutMs: number;
     connectTimeoutMs: number;
+    maxResponseBytes?: number | undefined;
     signal: AbortSignal;
     onClose?: (() => void) | undefined;
     onError?: ((error: Error) => void) | undefined;

package/dist/core/mcp/remoteMcpClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remoteMcpClient.d.ts","sourceRoot":"","sources":["../../../src/core/mcp/remoteMcpClient.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAK1F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,iGAAiG;AAEjG,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GAAG,KAAK,CAAC;AAE/D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,aAAa,EAAE,sBAAsB,CAAC;IAC/C,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC,CAAC;IAC9F,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACrE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAiDD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQ7D;AAgED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,kBAAkB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IACxD,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;IACnC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAChD,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAmD/B"}
+{"version":3,"file":"remoteMcpClient.d.ts","sourceRoot":"","sources":["../../../src/core/mcp/remoteMcpClient.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAK1F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,iGAAiG;AAEjG,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GAAG,KAAK,CAAC;AAE/D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,aAAa,EAAE,sBAAsB,CAAC;IAC/C,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC,CAAC;IAC9F,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACrE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AASD,eAAO,MAAM,8BAA8B,QAAmB,CAAC;AAW/D,iFAAiF;AACjF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,CA0BpF;AAkCD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQ7D;AAgED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,kBAAkB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IACxD,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;IACnC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAChD,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAoD/B"}

package/dist/core/mcp/remoteMcpClient.js

@@ -20,8 +20,10 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/core/mcp/remoteMcpClient.ts
 var remoteMcpClient_exports = {};
 __export(remoteMcpClient_exports, {
+  DEFAULT_MAX_MCP_RESPONSE_BYTES: () => DEFAULT_MAX_MCP_RESPONSE_BYTES,
   connectRemoteMcp: () => connectRemoteMcp,
-  isSessionExpiredError: () => isSessionExpiredError
+  isSessionExpiredError: () => isSessionExpiredError,
+  withMaxResponseBytes: () => withMaxResponseBytes
 });
 module.exports = __toCommonJS(remoteMcpClient_exports);
 var import_client = require("@modelcontextprotocol/sdk/client/index.js");
@@ -33,9 +35,35 @@ var import_errors = require("../errors.js");
 var import_promiseUtils = require("../util/promiseUtils.js");
 var CLIENT_INFO = { name: "tfy-agent-mcp-client", version: "1.0.0" };
 var TRANSPORT_PROBE_ORDER = ["streamable-http", "sse"];
+var DEFAULT_MAX_MCP_RESPONSE_BYTES = 50 * 1024 * 1024;
 var MCP_BODY_TIMEOUT_MS = 30 * 60 * 1e3;
 var mcpHttpAgent = new import_undici.Agent({ bodyTimeout: MCP_BODY_TIMEOUT_MS });
 var mcpFetch = (url, init) => (0, import_undici.fetch)(typeof url === "string" ? url : url.href, { ...init, dispatcher: mcpHttpAgent });
+function withMaxResponseBytes(fetchFn, maxBytes) {
+  return async (url, init) => {
+    const response = await fetchFn(url, init);
+    const isGetSse = (init?.method ?? "GET").toUpperCase() === "GET" && (response.headers.get("content-type") ?? "").toLowerCase().includes("text/event-stream");
+    if (isGetSse || !response.body) {
+      return response;
+    }
+    let seen = 0;
+    return new Response(
+      response.body.pipeThrough(
+        new TransformStream({
+          transform(chunk, controller) {
+            seen += chunk.byteLength;
+            if (seen > maxBytes) {
+              controller.error(new Error(`MCP response exceeded max ${String(maxBytes)} bytes`));
+              return;
+            }
+            controller.enqueue(chunk);
+          }
+        })
+      ),
+      { status: response.status, statusText: response.statusText, headers: response.headers }
+    );
+  };
+}
 var McpClientWithTimeout = class extends import_client.Client {
   constructor(requestTimeoutMs) {
     super(CLIENT_INFO, { capabilities: {} });
@@ -48,16 +76,16 @@ var McpClientWithTimeout = class extends import_client.Client {
     return super.request(req, schema, { ...options, timeout: this.requestTimeoutMs });
   }
 };
-function createTransport(type, url, headers, sessionId) {
+function createTransport(type, url, headers, fetchFn, sessionId) {
   const requestInit = { headers };
   if (type === "streamable-http") {
     return new import_streamableHttp.StreamableHTTPClientTransport(url, {
       requestInit,
-      fetch: mcpFetch,
+      fetch: fetchFn,
       ...sessionId !== void 0 ? { sessionId } : {}
     });
   }
-  return new import_sse.SSEClientTransport(url, { requestInit, fetch: mcpFetch });
+  return new import_sse.SSEClientTransport(url, { requestInit, fetch: fetchFn });
 }
 function isSessionExpiredError(error) {
   if (!(error instanceof Error)) {
@@ -120,10 +148,11 @@ function buildConnection(client, transport, transportType, headers, requestOptio
 async function connectRemoteMcp(params) {
   const url = new URL(params.url);
   const requestOptions = { signal: params.signal };
+  const fetchFn = withMaxResponseBytes(mcpFetch, params.maxResponseBytes ?? DEFAULT_MAX_MCP_RESPONSE_BYTES);
   const candidates = params.knownTransportType ? [params.knownTransportType, ...TRANSPORT_PROBE_ORDER.filter((t) => t !== params.knownTransportType)] : TRANSPORT_PROBE_ORDER;
   const failures = [];
   for (const transportType of candidates) {
-    const transport = createTransport(transportType, url, params.headers, params.sessionId);
+    const transport = createTransport(transportType, url, params.headers, fetchFn, params.sessionId);
     const client = new McpClientWithTimeout(params.requestTimeoutMs);
     const timeout = new AbortController();
     const connectOptions = { signal: AbortSignal.any([params.signal, timeout.signal]) };
@@ -157,7 +186,9 @@ async function connectRemoteMcp(params) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  DEFAULT_MAX_MCP_RESPONSE_BYTES,
   connectRemoteMcp,
-  isSessionExpiredError
+  isSessionExpiredError,
+  withMaxResponseBytes
 });
 //# sourceMappingURL=remoteMcpClient.js.map

package/dist/core/mcp/remoteMcpClient.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/core/mcp/remoteMcpClient.ts"],"sourcesContent":["import { Client } from '@modelcontextprotocol/sdk/client/index.js';\n// SSE remains required during the Streamable HTTP migration (some servers still speak SSE only).\n\nimport { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js';\nimport { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';\nimport type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';\nimport type { CallToolRequest, CallToolResult } from '@modelcontextprotocol/sdk/types.js';\nimport { context, propagation } from '@opentelemetry/api';\nimport { Agent, fetch as undiciFetch } from 'undici';\nimport { McpConnectionError } from '../errors';\nimport { withTimeout } from '../util/promiseUtils';\nimport type { ToolSchema } from './IMCPServer';\n\n/** Networking for remote (url-based) MCP servers, kept separate so it can be mocked in tests. */\n\nexport type RemoteMcpTransportType = 'streamable-http' | 'sse';\n\nexport interface RemoteMcpConnection {\n  readonly transportType: RemoteMcpTransportType;\n  /** Session id for a stateful server, or null for a stateless one. */\n  readonly sessionId: string | null;\n  listTools(cursor?: string): Promise<{ tools: ToolSchema[]; nextCursor?: string | undefined }>;\n  callTool(params: CallToolRequest['params']): Promise<CallToolResult>;\n  close(): Promise<void>;\n}\n\n// SSE transport type kept for dual-probe support during migration.\n// eslint-disable-next-line @typescript-eslint/no-deprecated -- see TRANSPORT_PROBE_ORDER\ntype McpTransport = StreamableHTTPClientTransport | SSEClientTransport;\n\nconst CLIENT_INFO = { name: 'tfy-agent-mcp-client', version: '1.0.0' } as const;\nconst TRANSPORT_PROBE_ORDER: RemoteMcpTransportType[] = ['streamable-http', 'sse'];\n\n// MCP SSE/streamable-HTTP keeps a long-lived response open that is often idle between tool calls.\n// Node fetch (undici) defaults bodyTimeout to 300s of silence, then kills the stream with\n// `Body Timeout Error` — we reconnect and the ~5m cycle repeats in logs. 30m matches the\n// Gateway idle-body window; MCP request deadlines still come from requestTimeoutMs.\nconst MCP_BODY_TIMEOUT_MS = 30 * 60 * 1000;\nconst mcpHttpAgent = new Agent({ bodyTimeout: MCP_BODY_TIMEOUT_MS });\nconst mcpFetch: FetchLike = (url, init) =>\n  undiciFetch(typeof url === 'string' ? url : url.href, { ...(init as object), dispatcher: mcpHttpAgent });\n\nclass McpClientWithTimeout extends Client {\n  constructor(private readonly requestTimeoutMs: number) {\n    super(CLIENT_INFO, { capabilities: {} });\n  }\n\n  // SDK Client.request is loosely typed; forward with an explicit timeout.\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- MCP SDK request typing\n  override request(req: any, schema: any, options?: any): Promise<any> {\n    // eslint-disable-next-line @typescript-eslint/no-unsafe-argument -- MCP SDK request typing\n    return super.request(req, schema, { ...options, timeout: this.requestTimeoutMs });\n  }\n}\n\nfunction createTransport(\n  type: RemoteMcpTransportType,\n  url: URL,\n  headers: Record<string, string>,\n  sessionId?: string,\n): McpTransport {\n  const requestInit = { headers };\n  if (type === 'streamable-http') {\n    return new StreamableHTTPClientTransport(url, {\n      requestInit,\n      fetch: mcpFetch,\n      ...(sessionId !== undefined ? { sessionId } : {}),\n    });\n  }\n  // eslint-disable-next-line @typescript-eslint/no-deprecated -- dual-transport probe; see TRANSPORT_PROBE_ORDER\n  return new SSEClientTransport(url, { requestInit, fetch: mcpFetch });\n}\n\nexport function isSessionExpiredError(error: unknown): boolean {\n  if (!(error instanceof Error)) {\n    return false;\n  }\n  if ('code' in error && error.code === 404) {\n    return true;\n  }\n  return error.message.includes('HTTP 404') || error.message.toLowerCase().includes('session');\n}\n\nfunction isAuthError(error: unknown): boolean {\n  if (!(error instanceof Error)) {\n    return false;\n  }\n  if ('code' in error && error.code === 401) {\n    return true;\n  }\n  return error.message.includes('HTTP 401');\n}\n\n/** Inject the active otel trace context so each request propagates its span. */\nfunction stampTraceHeaders(headers: Record<string, string>): void {\n  propagation.inject(context.active(), headers);\n}\n\nfunction getTransportSessionId(transport: McpTransport): string | null {\n  return transport instanceof StreamableHTTPClientTransport ? (transport.sessionId ?? null) : null;\n}\n\nfunction toConnectError(error: unknown): McpConnectionError {\n  if (error instanceof McpConnectionError) {\n    return error;\n  }\n  if (isAuthError(error)) {\n    return new McpConnectionError('upstream returned 401 Unauthorized', 401, {\n      cause: error,\n    });\n  }\n  const message = error instanceof Error ? error.message : String(error);\n  return new McpConnectionError(message, 502, { cause: error });\n}\n\nfunction buildConnection(\n  client: McpClientWithTimeout,\n  transport: McpTransport,\n  transportType: RemoteMcpTransportType,\n  headers: Record<string, string>,\n  requestOptions: { signal: AbortSignal },\n): RemoteMcpConnection {\n  return {\n    transportType,\n    sessionId: getTransportSessionId(transport),\n    listTools: async (cursor?: string) => {\n      stampTraceHeaders(headers);\n      const response = await client.listTools(cursor ? { cursor } : undefined, requestOptions);\n      return {\n        tools: response.tools,\n        nextCursor: response.nextCursor,\n      };\n    },\n    callTool: async (callParams: CallToolRequest['params']): Promise<CallToolResult> => {\n      stampTraceHeaders(headers);\n      return (await client.callTool(callParams, undefined, requestOptions)) as CallToolResult;\n    },\n    close: async (): Promise<void> => {\n      await client.close().catch(() => {\n        /* no-op */\n      });\n    },\n  };\n}\n\n/**\n * Connect to a remote MCP server, keeping the first transport that connects. `sessionId` is passed to\n * every attempt so a stateful session resumes in place instead of opening a throwaway one.\n *\n * `knownTransportType` is a hint (from a prior connect / persisted state): it's tried first for a fast\n * path, but on failure we still fall back to probing the remaining transports, so a stale or wrong\n * hint (server switched transports, bad resume data) self-heals instead of failing every turn.\n */\nexport async function connectRemoteMcp(params: {\n  url: string;\n  headers: Record<string, string>;\n  sessionId?: string | undefined;\n  knownTransportType?: RemoteMcpTransportType | undefined;\n  requestTimeoutMs: number;\n  connectTimeoutMs: number;\n  signal: AbortSignal;\n  onClose?: (() => void) | undefined;\n  onError?: ((error: Error) => void) | undefined;\n}): Promise<RemoteMcpConnection> {\n  const url = new URL(params.url);\n  const requestOptions = { signal: params.signal };\n  const candidates = params.knownTransportType\n    ? [params.knownTransportType, ...TRANSPORT_PROBE_ORDER.filter(t => t !== params.knownTransportType)]\n    : TRANSPORT_PROBE_ORDER;\n  const failures: { transport: RemoteMcpTransportType; error: string }[] = [];\n\n  for (const transportType of candidates) {\n    const transport = createTransport(transportType, url, params.headers, params.sessionId);\n    const client = new McpClientWithTimeout(params.requestTimeoutMs);\n    // withTimeout races client.connect() and does not abort it, so timed-out connects can leak\n    // sockets until GC. Abort this controller on timeout so the handshake is cancelled.\n    // AbortSignal.timeout cannot be cleared, and the SDK keeps the signal on initialize, so it\n    // would still fire connectTimeoutMs later and cancel the live client.\n    const timeout = new AbortController();\n    const connectOptions = { signal: AbortSignal.any([params.signal, timeout.signal]) };\n    try {\n      stampTraceHeaders(params.headers);\n      await withTimeout(\n        // Concrete transports use sessionId: string|undefined; Transport uses an optional\n        // property — exactOptionalPropertyTypes rejects assignability without this cast.\n        client.connect(transport as Parameters<Client['connect']>[0], connectOptions),\n        params.connectTimeoutMs,\n        transportType,\n      );\n    } catch (error) {\n      timeout.abort();\n      await client.close().catch(() => {\n        /* no-op */\n      });\n      if (isAuthError(error)) {\n        throw toConnectError(error);\n      }\n      // A session-expired error means the transport is right but the session is stale: surface it so\n      // the caller reconnects fresh instead of falling through to a different transport.\n      if (params.sessionId && isSessionExpiredError(error)) {\n        throw toConnectError(error);\n      }\n      failures.push({ transport: transportType, error: error instanceof Error ? error.message.trim() : String(error) });\n      continue;\n    }\n\n    // Set on the client (not the transport) so the SDK's own onclose/onerror cleanup still runs; the\n    // SDK invokes these from inside it. Only wired on the kept connection, so failed attempts stay quiet.\n    client.onclose = () => params.onClose?.();\n    client.onerror = error => params.onError?.(error);\n    return buildConnection(client, transport, transportType, params.headers, requestOptions);\n  }\n\n  throw new McpConnectionError(`failed to connect (tried ${candidates.join(', ')}): ${JSON.stringify(failures)}`, 502);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAuB;AAGvB,iBAAmC;AACnC,4BAA8C;AAG9C,iBAAqC;AACrC,oBAA4C;AAC5C,oBAAmC;AACnC,0BAA4B;AAoB5B,IAAM,cAAc,EAAE,MAAM,wBAAwB,SAAS,QAAQ;AACrE,IAAM,wBAAkD,CAAC,mBAAmB,KAAK;AAMjF,IAAM,sBAAsB,KAAK,KAAK;AACtC,IAAM,eAAe,IAAI,oBAAM,EAAE,aAAa,oBAAoB,CAAC;AACnE,IAAM,WAAsB,CAAC,KAAK,aAChC,cAAAA,OAAY,OAAO,QAAQ,WAAW,MAAM,IAAI,MAAM,EAAE,GAAI,MAAiB,YAAY,aAAa,CAAC;AAEzG,IAAM,uBAAN,cAAmC,qBAAO;AAAA,EACxC,YAA6B,kBAA0B;AACrD,UAAM,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC;AADZ;AAAA,EAE7B;AAAA,EAF6B;AAAA;AAAA;AAAA,EAMpB,QAAQ,KAAU,QAAa,SAA6B;AAEnE,WAAO,MAAM,QAAQ,KAAK,QAAQ,EAAE,GAAG,SAAS,SAAS,KAAK,iBAAiB,CAAC;AAAA,EAClF;AACF;AAEA,SAAS,gBACP,MACA,KACA,SACA,WACc;AACd,QAAM,cAAc,EAAE,QAAQ;AAC9B,MAAI,SAAS,mBAAmB;AAC9B,WAAO,IAAI,oDAA8B,KAAK;AAAA,MAC5C;AAAA,MACA,OAAO;AAAA,MACP,GAAI,cAAc,SAAY,EAAE,UAAU,IAAI,CAAC;AAAA,IACjD,CAAC;AAAA,EACH;AAEA,SAAO,IAAI,8BAAmB,KAAK,EAAE,aAAa,OAAO,SAAS,CAAC;AACrE;AAEO,SAAS,sBAAsB,OAAyB;AAC7D,MAAI,EAAE,iBAAiB,QAAQ;AAC7B,WAAO;AAAA,EACT;AACA,MAAI,UAAU,SAAS,MAAM,SAAS,KAAK;AACzC,WAAO;AAAA,EACT;AACA,SAAO,MAAM,QAAQ,SAAS,UAAU,KAAK,MAAM,QAAQ,YAAY,EAAE,SAAS,SAAS;AAC7F;AAEA,SAAS,YAAY,OAAyB;AAC5C,MAAI,EAAE,iBAAiB,QAAQ;AAC7B,WAAO;AAAA,EACT;AACA,MAAI,UAAU,SAAS,MAAM,SAAS,KAAK;AACzC,WAAO;AAAA,EACT;AACA,SAAO,MAAM,QAAQ,SAAS,UAAU;AAC1C;AAGA,SAAS,kBAAkB,SAAuC;AAChE,yBAAY,OAAO,mBAAQ,OAAO,GAAG,OAAO;AAC9C;AAEA,SAAS,sBAAsB,WAAwC;AACrE,SAAO,qBAAqB,sDAAiC,UAAU,aAAa,OAAQ;AAC9F;AAEA,SAAS,eAAe,OAAoC;AAC1D,MAAI,iBAAiB,kCAAoB;AACvC,WAAO;AAAA,EACT;AACA,MAAI,YAAY,KAAK,GAAG;AACtB,WAAO,IAAI,iCAAmB,sCAAsC,KAAK;AAAA,MACvE,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,SAAO,IAAI,iCAAmB,SAAS,KAAK,EAAE,OAAO,MAAM,CAAC;AAC9D;AAEA,SAAS,gBACP,QACA,WACA,eACA,SACA,gBACqB;AACrB,SAAO;AAAA,IACL;AAAA,IACA,WAAW,sBAAsB,SAAS;AAAA,IAC1C,WAAW,OAAO,WAAoB;AACpC,wBAAkB,OAAO;AACzB,YAAM,WAAW,MAAM,OAAO,UAAU,SAAS,EAAE,OAAO,IAAI,QAAW,cAAc;AACvF,aAAO;AAAA,QACL,OAAO,SAAS;AAAA,QAChB,YAAY,SAAS;AAAA,MACvB;AAAA,IACF;AAAA,IACA,UAAU,OAAO,eAAmE;AAClF,wBAAkB,OAAO;AACzB,aAAQ,MAAM,OAAO,SAAS,YAAY,QAAW,cAAc;AAAA,IACrE;AAAA,IACA,OAAO,YAA2B;AAChC,YAAM,OAAO,MAAM,EAAE,MAAM,MAAM;AAAA,MAEjC,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAUA,eAAsB,iBAAiB,QAUN;AAC/B,QAAM,MAAM,IAAI,IAAI,OAAO,GAAG;AAC9B,QAAM,iBAAiB,EAAE,QAAQ,OAAO,OAAO;AAC/C,QAAM,aAAa,OAAO,qBACtB,CAAC,OAAO,oBAAoB,GAAG,sBAAsB,OAAO,OAAK,MAAM,OAAO,kBAAkB,CAAC,IACjG;AACJ,QAAM,WAAmE,CAAC;AAE1E,aAAW,iBAAiB,YAAY;AACtC,UAAM,YAAY,gBAAgB,eAAe,KAAK,OAAO,SAAS,OAAO,SAAS;AACtF,UAAM,SAAS,IAAI,qBAAqB,OAAO,gBAAgB;AAK/D,UAAM,UAAU,IAAI,gBAAgB;AACpC,UAAM,iBAAiB,EAAE,QAAQ,YAAY,IAAI,CAAC,OAAO,QAAQ,QAAQ,MAAM,CAAC,EAAE;AAClF,QAAI;AACF,wBAAkB,OAAO,OAAO;AAChC,gBAAM;AAAA;AAAA;AAAA,QAGJ,OAAO,QAAQ,WAA+C,cAAc;AAAA,QAC5E,OAAO;AAAA,QACP;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,cAAQ,MAAM;AACd,YAAM,OAAO,MAAM,EAAE,MAAM,MAAM;AAAA,MAEjC,CAAC;AACD,UAAI,YAAY,KAAK,GAAG;AACtB,cAAM,eAAe,KAAK;AAAA,MAC5B;AAGA,UAAI,OAAO,aAAa,sBAAsB,KAAK,GAAG;AACpD,cAAM,eAAe,KAAK;AAAA,MAC5B;AACA,eAAS,KAAK,EAAE,WAAW,eAAe,OAAO,iBAAiB,QAAQ,MAAM,QAAQ,KAAK,IAAI,OAAO,KAAK,EAAE,CAAC;AAChH;AAAA,IACF;AAIA,WAAO,UAAU,MAAM,OAAO,UAAU;AACxC,WAAO,UAAU,WAAS,OAAO,UAAU,KAAK;AAChD,WAAO,gBAAgB,QAAQ,WAAW,eAAe,OAAO,SAAS,cAAc;AAAA,EACzF;AAEA,QAAM,IAAI,iCAAmB,4BAA4B,WAAW,KAAK,IAAI,CAAC,MAAM,KAAK,UAAU,QAAQ,CAAC,IAAI,GAAG;AACrH;","names":["undiciFetch"]}
+{"version":3,"sources":["../../../src/core/mcp/remoteMcpClient.ts"],"sourcesContent":["import { Client } from '@modelcontextprotocol/sdk/client/index.js';\n// SSE remains required during the Streamable HTTP migration (some servers still speak SSE only).\n\nimport { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js';\nimport { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';\nimport type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';\nimport type { CallToolRequest, CallToolResult } from '@modelcontextprotocol/sdk/types.js';\nimport { context, propagation } from '@opentelemetry/api';\nimport { Agent, fetch as undiciFetch } from 'undici';\nimport { McpConnectionError } from '../errors';\nimport { withTimeout } from '../util/promiseUtils';\nimport type { ToolSchema } from './IMCPServer';\n\n/** Networking for remote (url-based) MCP servers, kept separate so it can be mocked in tests. */\n\nexport type RemoteMcpTransportType = 'streamable-http' | 'sse';\n\nexport interface RemoteMcpConnection {\n  readonly transportType: RemoteMcpTransportType;\n  /** Session id for a stateful server, or null for a stateless one. */\n  readonly sessionId: string | null;\n  listTools(cursor?: string): Promise<{ tools: ToolSchema[]; nextCursor?: string | undefined }>;\n  callTool(params: CallToolRequest['params']): Promise<CallToolResult>;\n  close(): Promise<void>;\n}\n\n// SSE transport type kept for dual-probe support during migration.\n// eslint-disable-next-line @typescript-eslint/no-deprecated -- see TRANSPORT_PROBE_ORDER\ntype McpTransport = StreamableHTTPClientTransport | SSEClientTransport;\n\nconst CLIENT_INFO = { name: 'tfy-agent-mcp-client', version: '1.0.0' } as const;\nconst TRANSPORT_PROBE_ORDER: RemoteMcpTransportType[] = ['streamable-http', 'sse'];\n\nexport const DEFAULT_MAX_MCP_RESPONSE_BYTES = 50 * 1024 * 1024;\n\n// MCP SSE/streamable-HTTP keeps a long-lived response open that is often idle between tool calls.\n// Node fetch (undici) defaults bodyTimeout to 300s of silence, then kills the stream with\n// `Body Timeout Error` — we reconnect and the ~5m cycle repeats in logs. 30m matches the\n// Gateway idle-body window; MCP request deadlines still come from requestTimeoutMs.\nconst MCP_BODY_TIMEOUT_MS = 30 * 60 * 1000;\nconst mcpHttpAgent = new Agent({ bodyTimeout: MCP_BODY_TIMEOUT_MS });\nconst mcpFetch: FetchLike = (url, init) =>\n  undiciFetch(typeof url === 'string' ? url : url.href, { ...(init as object), dispatcher: mcpHttpAgent });\n\n/** GET SSE is long-lived and uncapped; every other body aborts at `maxBytes`. */\nexport function withMaxResponseBytes(fetchFn: FetchLike, maxBytes: number): FetchLike {\n  return async (url, init) => {\n    const response = await fetchFn(url, init);\n    const isGetSse =\n      (init?.method ?? 'GET').toUpperCase() === 'GET' &&\n      (response.headers.get('content-type') ?? '').toLowerCase().includes('text/event-stream');\n    if (isGetSse || !response.body) {\n      return response;\n    }\n    let seen = 0;\n    return new Response(\n      response.body.pipeThrough(\n        new TransformStream<Uint8Array, Uint8Array>({\n          transform(chunk, controller) {\n            seen += chunk.byteLength;\n            if (seen > maxBytes) {\n              controller.error(new Error(`MCP response exceeded max ${String(maxBytes)} bytes`));\n              return;\n            }\n            controller.enqueue(chunk);\n          },\n        }),\n      ),\n      { status: response.status, statusText: response.statusText, headers: response.headers },\n    );\n  };\n}\n\nclass McpClientWithTimeout extends Client {\n  constructor(private readonly requestTimeoutMs: number) {\n    super(CLIENT_INFO, { capabilities: {} });\n  }\n\n  // SDK Client.request is loosely typed; forward with an explicit timeout.\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- MCP SDK request typing\n  override request(req: any, schema: any, options?: any): Promise<any> {\n    // eslint-disable-next-line @typescript-eslint/no-unsafe-argument -- MCP SDK request typing\n    return super.request(req, schema, { ...options, timeout: this.requestTimeoutMs });\n  }\n}\n\nfunction createTransport(\n  type: RemoteMcpTransportType,\n  url: URL,\n  headers: Record<string, string>,\n  fetchFn: FetchLike,\n  sessionId?: string,\n): McpTransport {\n  const requestInit = { headers };\n  if (type === 'streamable-http') {\n    return new StreamableHTTPClientTransport(url, {\n      requestInit,\n      fetch: fetchFn,\n      ...(sessionId !== undefined ? { sessionId } : {}),\n    });\n  }\n  // eslint-disable-next-line @typescript-eslint/no-deprecated -- dual-transport probe; see TRANSPORT_PROBE_ORDER\n  return new SSEClientTransport(url, { requestInit, fetch: fetchFn });\n}\n\nexport function isSessionExpiredError(error: unknown): boolean {\n  if (!(error instanceof Error)) {\n    return false;\n  }\n  if ('code' in error && error.code === 404) {\n    return true;\n  }\n  return error.message.includes('HTTP 404') || error.message.toLowerCase().includes('session');\n}\n\nfunction isAuthError(error: unknown): boolean {\n  if (!(error instanceof Error)) {\n    return false;\n  }\n  if ('code' in error && error.code === 401) {\n    return true;\n  }\n  return error.message.includes('HTTP 401');\n}\n\n/** Inject the active otel trace context so each request propagates its span. */\nfunction stampTraceHeaders(headers: Record<string, string>): void {\n  propagation.inject(context.active(), headers);\n}\n\nfunction getTransportSessionId(transport: McpTransport): string | null {\n  return transport instanceof StreamableHTTPClientTransport ? (transport.sessionId ?? null) : null;\n}\n\nfunction toConnectError(error: unknown): McpConnectionError {\n  if (error instanceof McpConnectionError) {\n    return error;\n  }\n  if (isAuthError(error)) {\n    return new McpConnectionError('upstream returned 401 Unauthorized', 401, {\n      cause: error,\n    });\n  }\n  const message = error instanceof Error ? error.message : String(error);\n  return new McpConnectionError(message, 502, { cause: error });\n}\n\nfunction buildConnection(\n  client: McpClientWithTimeout,\n  transport: McpTransport,\n  transportType: RemoteMcpTransportType,\n  headers: Record<string, string>,\n  requestOptions: { signal: AbortSignal },\n): RemoteMcpConnection {\n  return {\n    transportType,\n    sessionId: getTransportSessionId(transport),\n    listTools: async (cursor?: string) => {\n      stampTraceHeaders(headers);\n      const response = await client.listTools(cursor ? { cursor } : undefined, requestOptions);\n      return {\n        tools: response.tools,\n        nextCursor: response.nextCursor,\n      };\n    },\n    callTool: async (callParams: CallToolRequest['params']): Promise<CallToolResult> => {\n      stampTraceHeaders(headers);\n      return (await client.callTool(callParams, undefined, requestOptions)) as CallToolResult;\n    },\n    close: async (): Promise<void> => {\n      await client.close().catch(() => {\n        /* no-op */\n      });\n    },\n  };\n}\n\n/**\n * Connect to a remote MCP server, keeping the first transport that connects. `sessionId` is passed to\n * every attempt so a stateful session resumes in place instead of opening a throwaway one.\n *\n * `knownTransportType` is a hint (from a prior connect / persisted state): it's tried first for a fast\n * path, but on failure we still fall back to probing the remaining transports, so a stale or wrong\n * hint (server switched transports, bad resume data) self-heals instead of failing every turn.\n */\nexport async function connectRemoteMcp(params: {\n  url: string;\n  headers: Record<string, string>;\n  sessionId?: string | undefined;\n  knownTransportType?: RemoteMcpTransportType | undefined;\n  requestTimeoutMs: number;\n  connectTimeoutMs: number;\n  maxResponseBytes?: number | undefined;\n  signal: AbortSignal;\n  onClose?: (() => void) | undefined;\n  onError?: ((error: Error) => void) | undefined;\n}): Promise<RemoteMcpConnection> {\n  const url = new URL(params.url);\n  const requestOptions = { signal: params.signal };\n  const fetchFn = withMaxResponseBytes(mcpFetch, params.maxResponseBytes ?? DEFAULT_MAX_MCP_RESPONSE_BYTES);\n  const candidates = params.knownTransportType\n    ? [params.knownTransportType, ...TRANSPORT_PROBE_ORDER.filter(t => t !== params.knownTransportType)]\n    : TRANSPORT_PROBE_ORDER;\n  const failures: { transport: RemoteMcpTransportType; error: string }[] = [];\n\n  for (const transportType of candidates) {\n    const transport = createTransport(transportType, url, params.headers, fetchFn, params.sessionId);\n    const client = new McpClientWithTimeout(params.requestTimeoutMs);\n    // withTimeout races client.connect() and does not abort it, so timed-out connects can leak\n    // sockets until GC. Abort this controller on timeout so the handshake is cancelled.\n    // AbortSignal.timeout cannot be cleared, and the SDK keeps the signal on initialize, so it\n    // would still fire connectTimeoutMs later and cancel the live client.\n    const timeout = new AbortController();\n    const connectOptions = { signal: AbortSignal.any([params.signal, timeout.signal]) };\n    try {\n      stampTraceHeaders(params.headers);\n      await withTimeout(\n        // Concrete transports use sessionId: string|undefined; Transport uses an optional\n        // property — exactOptionalPropertyTypes rejects assignability without this cast.\n        client.connect(transport as Parameters<Client['connect']>[0], connectOptions),\n        params.connectTimeoutMs,\n        transportType,\n      );\n    } catch (error) {\n      timeout.abort();\n      await client.close().catch(() => {\n        /* no-op */\n      });\n      if (isAuthError(error)) {\n        throw toConnectError(error);\n      }\n      // A session-expired error means the transport is right but the session is stale: surface it so\n      // the caller reconnects fresh instead of falling through to a different transport.\n      if (params.sessionId && isSessionExpiredError(error)) {\n        throw toConnectError(error);\n      }\n      failures.push({ transport: transportType, error: error instanceof Error ? error.message.trim() : String(error) });\n      continue;\n    }\n\n    // Set on the client (not the transport) so the SDK's own onclose/onerror cleanup still runs; the\n    // SDK invokes these from inside it. Only wired on the kept connection, so failed attempts stay quiet.\n    client.onclose = () => params.onClose?.();\n    client.onerror = error => params.onError?.(error);\n    return buildConnection(client, transport, transportType, params.headers, requestOptions);\n  }\n\n  throw new McpConnectionError(`failed to connect (tried ${candidates.join(', ')}): ${JSON.stringify(failures)}`, 502);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAuB;AAGvB,iBAAmC;AACnC,4BAA8C;AAG9C,iBAAqC;AACrC,oBAA4C;AAC5C,oBAAmC;AACnC,0BAA4B;AAoB5B,IAAM,cAAc,EAAE,MAAM,wBAAwB,SAAS,QAAQ;AACrE,IAAM,wBAAkD,CAAC,mBAAmB,KAAK;AAE1E,IAAM,iCAAiC,KAAK,OAAO;AAM1D,IAAM,sBAAsB,KAAK,KAAK;AACtC,IAAM,eAAe,IAAI,oBAAM,EAAE,aAAa,oBAAoB,CAAC;AACnE,IAAM,WAAsB,CAAC,KAAK,aAChC,cAAAA,OAAY,OAAO,QAAQ,WAAW,MAAM,IAAI,MAAM,EAAE,GAAI,MAAiB,YAAY,aAAa,CAAC;AAGlG,SAAS,qBAAqB,SAAoB,UAA6B;AACpF,SAAO,OAAO,KAAK,SAAS;AAC1B,UAAM,WAAW,MAAM,QAAQ,KAAK,IAAI;AACxC,UAAM,YACH,MAAM,UAAU,OAAO,YAAY,MAAM,UACzC,SAAS,QAAQ,IAAI,cAAc,KAAK,IAAI,YAAY,EAAE,SAAS,mBAAmB;AACzF,QAAI,YAAY,CAAC,SAAS,MAAM;AAC9B,aAAO;AAAA,IACT;AACA,QAAI,OAAO;AACX,WAAO,IAAI;AAAA,MACT,SAAS,KAAK;AAAA,QACZ,IAAI,gBAAwC;AAAA,UAC1C,UAAU,OAAO,YAAY;AAC3B,oBAAQ,MAAM;AACd,gBAAI,OAAO,UAAU;AACnB,yBAAW,MAAM,IAAI,MAAM,6BAA6B,OAAO,QAAQ,CAAC,QAAQ,CAAC;AACjF;AAAA,YACF;AACA,uBAAW,QAAQ,KAAK;AAAA,UAC1B;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MACA,EAAE,QAAQ,SAAS,QAAQ,YAAY,SAAS,YAAY,SAAS,SAAS,QAAQ;AAAA,IACxF;AAAA,EACF;AACF;AAEA,IAAM,uBAAN,cAAmC,qBAAO;AAAA,EACxC,YAA6B,kBAA0B;AACrD,UAAM,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC;AADZ;AAAA,EAE7B;AAAA,EAF6B;AAAA;AAAA;AAAA,EAMpB,QAAQ,KAAU,QAAa,SAA6B;AAEnE,WAAO,MAAM,QAAQ,KAAK,QAAQ,EAAE,GAAG,SAAS,SAAS,KAAK,iBAAiB,CAAC;AAAA,EAClF;AACF;AAEA,SAAS,gBACP,MACA,KACA,SACA,SACA,WACc;AACd,QAAM,cAAc,EAAE,QAAQ;AAC9B,MAAI,SAAS,mBAAmB;AAC9B,WAAO,IAAI,oDAA8B,KAAK;AAAA,MAC5C;AAAA,MACA,OAAO;AAAA,MACP,GAAI,cAAc,SAAY,EAAE,UAAU,IAAI,CAAC;AAAA,IACjD,CAAC;AAAA,EACH;AAEA,SAAO,IAAI,8BAAmB,KAAK,EAAE,aAAa,OAAO,QAAQ,CAAC;AACpE;AAEO,SAAS,sBAAsB,OAAyB;AAC7D,MAAI,EAAE,iBAAiB,QAAQ;AAC7B,WAAO;AAAA,EACT;AACA,MAAI,UAAU,SAAS,MAAM,SAAS,KAAK;AACzC,WAAO;AAAA,EACT;AACA,SAAO,MAAM,QAAQ,SAAS,UAAU,KAAK,MAAM,QAAQ,YAAY,EAAE,SAAS,SAAS;AAC7F;AAEA,SAAS,YAAY,OAAyB;AAC5C,MAAI,EAAE,iBAAiB,QAAQ;AAC7B,WAAO;AAAA,EACT;AACA,MAAI,UAAU,SAAS,MAAM,SAAS,KAAK;AACzC,WAAO;AAAA,EACT;AACA,SAAO,MAAM,QAAQ,SAAS,UAAU;AAC1C;AAGA,SAAS,kBAAkB,SAAuC;AAChE,yBAAY,OAAO,mBAAQ,OAAO,GAAG,OAAO;AAC9C;AAEA,SAAS,sBAAsB,WAAwC;AACrE,SAAO,qBAAqB,sDAAiC,UAAU,aAAa,OAAQ;AAC9F;AAEA,SAAS,eAAe,OAAoC;AAC1D,MAAI,iBAAiB,kCAAoB;AACvC,WAAO;AAAA,EACT;AACA,MAAI,YAAY,KAAK,GAAG;AACtB,WAAO,IAAI,iCAAmB,sCAAsC,KAAK;AAAA,MACvE,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,SAAO,IAAI,iCAAmB,SAAS,KAAK,EAAE,OAAO,MAAM,CAAC;AAC9D;AAEA,SAAS,gBACP,QACA,WACA,eACA,SACA,gBACqB;AACrB,SAAO;AAAA,IACL;AAAA,IACA,WAAW,sBAAsB,SAAS;AAAA,IAC1C,WAAW,OAAO,WAAoB;AACpC,wBAAkB,OAAO;AACzB,YAAM,WAAW,MAAM,OAAO,UAAU,SAAS,EAAE,OAAO,IAAI,QAAW,cAAc;AACvF,aAAO;AAAA,QACL,OAAO,SAAS;AAAA,QAChB,YAAY,SAAS;AAAA,MACvB;AAAA,IACF;AAAA,IACA,UAAU,OAAO,eAAmE;AAClF,wBAAkB,OAAO;AACzB,aAAQ,MAAM,OAAO,SAAS,YAAY,QAAW,cAAc;AAAA,IACrE;AAAA,IACA,OAAO,YAA2B;AAChC,YAAM,OAAO,MAAM,EAAE,MAAM,MAAM;AAAA,MAEjC,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAUA,eAAsB,iBAAiB,QAWN;AAC/B,QAAM,MAAM,IAAI,IAAI,OAAO,GAAG;AAC9B,QAAM,iBAAiB,EAAE,QAAQ,OAAO,OAAO;AAC/C,QAAM,UAAU,qBAAqB,UAAU,OAAO,oBAAoB,8BAA8B;AACxG,QAAM,aAAa,OAAO,qBACtB,CAAC,OAAO,oBAAoB,GAAG,sBAAsB,OAAO,OAAK,MAAM,OAAO,kBAAkB,CAAC,IACjG;AACJ,QAAM,WAAmE,CAAC;AAE1E,aAAW,iBAAiB,YAAY;AACtC,UAAM,YAAY,gBAAgB,eAAe,KAAK,OAAO,SAAS,SAAS,OAAO,SAAS;AAC/F,UAAM,SAAS,IAAI,qBAAqB,OAAO,gBAAgB;AAK/D,UAAM,UAAU,IAAI,gBAAgB;AACpC,UAAM,iBAAiB,EAAE,QAAQ,YAAY,IAAI,CAAC,OAAO,QAAQ,QAAQ,MAAM,CAAC,EAAE;AAClF,QAAI;AACF,wBAAkB,OAAO,OAAO;AAChC,gBAAM;AAAA;AAAA;AAAA,QAGJ,OAAO,QAAQ,WAA+C,cAAc;AAAA,QAC5E,OAAO;AAAA,QACP;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,cAAQ,MAAM;AACd,YAAM,OAAO,MAAM,EAAE,MAAM,MAAM;AAAA,MAEjC,CAAC;AACD,UAAI,YAAY,KAAK,GAAG;AACtB,cAAM,eAAe,KAAK;AAAA,MAC5B;AAGA,UAAI,OAAO,aAAa,sBAAsB,KAAK,GAAG;AACpD,cAAM,eAAe,KAAK;AAAA,MAC5B;AACA,eAAS,KAAK,EAAE,WAAW,eAAe,OAAO,iBAAiB,QAAQ,MAAM,QAAQ,KAAK,IAAI,OAAO,KAAK,EAAE,CAAC;AAChH;AAAA,IACF;AAIA,WAAO,UAAU,MAAM,OAAO,UAAU;AACxC,WAAO,UAAU,WAAS,OAAO,UAAU,KAAK;AAChD,WAAO,gBAAgB,QAAQ,WAAW,eAAe,OAAO,SAAS,cAAc;AAAA,EACzF;AAEA,QAAM,IAAI,iCAAmB,4BAA4B,WAAW,KAAK,IAAI,CAAC,MAAM,KAAK,UAAU,QAAQ,CAAC,IAAI,GAAG;AACrH;","names":["undiciFetch"]}

package/dist/core/mcp/remoteMcpClient.mjs

@@ -8,9 +8,35 @@ import { McpConnectionError } from "../errors.mjs";
 import { withTimeout } from "../util/promiseUtils.mjs";
 var CLIENT_INFO = { name: "tfy-agent-mcp-client", version: "1.0.0" };
 var TRANSPORT_PROBE_ORDER = ["streamable-http", "sse"];
+var DEFAULT_MAX_MCP_RESPONSE_BYTES = 50 * 1024 * 1024;
 var MCP_BODY_TIMEOUT_MS = 30 * 60 * 1e3;
 var mcpHttpAgent = new Agent({ bodyTimeout: MCP_BODY_TIMEOUT_MS });
 var mcpFetch = (url, init) => undiciFetch(typeof url === "string" ? url : url.href, { ...init, dispatcher: mcpHttpAgent });
+function withMaxResponseBytes(fetchFn, maxBytes) {
+  return async (url, init) => {
+    const response = await fetchFn(url, init);
+    const isGetSse = (init?.method ?? "GET").toUpperCase() === "GET" && (response.headers.get("content-type") ?? "").toLowerCase().includes("text/event-stream");
+    if (isGetSse || !response.body) {
+      return response;
+    }
+    let seen = 0;
+    return new Response(
+      response.body.pipeThrough(
+        new TransformStream({
+          transform(chunk, controller) {
+            seen += chunk.byteLength;
+            if (seen > maxBytes) {
+              controller.error(new Error(`MCP response exceeded max ${String(maxBytes)} bytes`));
+              return;
+            }
+            controller.enqueue(chunk);
+          }
+        })
+      ),
+      { status: response.status, statusText: response.statusText, headers: response.headers }
+    );
+  };
+}
 var McpClientWithTimeout = class extends Client {
   constructor(requestTimeoutMs) {
     super(CLIENT_INFO, { capabilities: {} });
@@ -23,16 +49,16 @@ var McpClientWithTimeout = class extends Client {
     return super.request(req, schema, { ...options, timeout: this.requestTimeoutMs });
   }
 };
-function createTransport(type, url, headers, sessionId) {
+function createTransport(type, url, headers, fetchFn, sessionId) {
   const requestInit = { headers };
   if (type === "streamable-http") {
     return new StreamableHTTPClientTransport(url, {
       requestInit,
-      fetch: mcpFetch,
+      fetch: fetchFn,
       ...sessionId !== void 0 ? { sessionId } : {}
     });
   }
-  return new SSEClientTransport(url, { requestInit, fetch: mcpFetch });
+  return new SSEClientTransport(url, { requestInit, fetch: fetchFn });
 }
 function isSessionExpiredError(error) {
   if (!(error instanceof Error)) {
@@ -95,10 +121,11 @@ function buildConnection(client, transport, transportType, headers, requestOptio
 async function connectRemoteMcp(params) {
   const url = new URL(params.url);
   const requestOptions = { signal: params.signal };
+  const fetchFn = withMaxResponseBytes(mcpFetch, params.maxResponseBytes ?? DEFAULT_MAX_MCP_RESPONSE_BYTES);
   const candidates = params.knownTransportType ? [params.knownTransportType, ...TRANSPORT_PROBE_ORDER.filter((t) => t !== params.knownTransportType)] : TRANSPORT_PROBE_ORDER;
   const failures = [];
   for (const transportType of candidates) {
-    const transport = createTransport(transportType, url, params.headers, params.sessionId);
+    const transport = createTransport(transportType, url, params.headers, fetchFn, params.sessionId);
     const client = new McpClientWithTimeout(params.requestTimeoutMs);
     const timeout = new AbortController();
     const connectOptions = { signal: AbortSignal.any([params.signal, timeout.signal]) };
@@ -131,7 +158,9 @@ async function connectRemoteMcp(params) {
   throw new McpConnectionError(`failed to connect (tried ${candidates.join(", ")}): ${JSON.stringify(failures)}`, 502);
 }
 export {
+  DEFAULT_MAX_MCP_RESPONSE_BYTES,
   connectRemoteMcp,
-  isSessionExpiredError
+  isSessionExpiredError,
+  withMaxResponseBytes
 };
 //# sourceMappingURL=remoteMcpClient.mjs.map

package/dist/core/mcp/remoteMcpClient.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/core/mcp/remoteMcpClient.ts"],"sourcesContent":["import { Client } from '@modelcontextprotocol/sdk/client/index.js';\n// SSE remains required during the Streamable HTTP migration (some servers still speak SSE only).\n\nimport { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js';\nimport { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';\nimport type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';\nimport type { CallToolRequest, CallToolResult } from '@modelcontextprotocol/sdk/types.js';\nimport { context, propagation } from '@opentelemetry/api';\nimport { Agent, fetch as undiciFetch } from 'undici';\nimport { McpConnectionError } from '../errors';\nimport { withTimeout } from '../util/promiseUtils';\nimport type { ToolSchema } from './IMCPServer';\n\n/** Networking for remote (url-based) MCP servers, kept separate so it can be mocked in tests. */\n\nexport type RemoteMcpTransportType = 'streamable-http' | 'sse';\n\nexport interface RemoteMcpConnection {\n  readonly transportType: RemoteMcpTransportType;\n  /** Session id for a stateful server, or null for a stateless one. */\n  readonly sessionId: string | null;\n  listTools(cursor?: string): Promise<{ tools: ToolSchema[]; nextCursor?: string | undefined }>;\n  callTool(params: CallToolRequest['params']): Promise<CallToolResult>;\n  close(): Promise<void>;\n}\n\n// SSE transport type kept for dual-probe support during migration.\n// eslint-disable-next-line @typescript-eslint/no-deprecated -- see TRANSPORT_PROBE_ORDER\ntype McpTransport = StreamableHTTPClientTransport | SSEClientTransport;\n\nconst CLIENT_INFO = { name: 'tfy-agent-mcp-client', version: '1.0.0' } as const;\nconst TRANSPORT_PROBE_ORDER: RemoteMcpTransportType[] = ['streamable-http', 'sse'];\n\n// MCP SSE/streamable-HTTP keeps a long-lived response open that is often idle between tool calls.\n// Node fetch (undici) defaults bodyTimeout to 300s of silence, then kills the stream with\n// `Body Timeout Error` — we reconnect and the ~5m cycle repeats in logs. 30m matches the\n// Gateway idle-body window; MCP request deadlines still come from requestTimeoutMs.\nconst MCP_BODY_TIMEOUT_MS = 30 * 60 * 1000;\nconst mcpHttpAgent = new Agent({ bodyTimeout: MCP_BODY_TIMEOUT_MS });\nconst mcpFetch: FetchLike = (url, init) =>\n  undiciFetch(typeof url === 'string' ? url : url.href, { ...(init as object), dispatcher: mcpHttpAgent });\n\nclass McpClientWithTimeout extends Client {\n  constructor(private readonly requestTimeoutMs: number) {\n    super(CLIENT_INFO, { capabilities: {} });\n  }\n\n  // SDK Client.request is loosely typed; forward with an explicit timeout.\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- MCP SDK request typing\n  override request(req: any, schema: any, options?: any): Promise<any> {\n    // eslint-disable-next-line @typescript-eslint/no-unsafe-argument -- MCP SDK request typing\n    return super.request(req, schema, { ...options, timeout: this.requestTimeoutMs });\n  }\n}\n\nfunction createTransport(\n  type: RemoteMcpTransportType,\n  url: URL,\n  headers: Record<string, string>,\n  sessionId?: string,\n): McpTransport {\n  const requestInit = { headers };\n  if (type === 'streamable-http') {\n    return new StreamableHTTPClientTransport(url, {\n      requestInit,\n      fetch: mcpFetch,\n      ...(sessionId !== undefined ? { sessionId } : {}),\n    });\n  }\n  // eslint-disable-next-line @typescript-eslint/no-deprecated -- dual-transport probe; see TRANSPORT_PROBE_ORDER\n  return new SSEClientTransport(url, { requestInit, fetch: mcpFetch });\n}\n\nexport function isSessionExpiredError(error: unknown): boolean {\n  if (!(error instanceof Error)) {\n    return false;\n  }\n  if ('code' in error && error.code === 404) {\n    return true;\n  }\n  return error.message.includes('HTTP 404') || error.message.toLowerCase().includes('session');\n}\n\nfunction isAuthError(error: unknown): boolean {\n  if (!(error instanceof Error)) {\n    return false;\n  }\n  if ('code' in error && error.code === 401) {\n    return true;\n  }\n  return error.message.includes('HTTP 401');\n}\n\n/** Inject the active otel trace context so each request propagates its span. */\nfunction stampTraceHeaders(headers: Record<string, string>): void {\n  propagation.inject(context.active(), headers);\n}\n\nfunction getTransportSessionId(transport: McpTransport): string | null {\n  return transport instanceof StreamableHTTPClientTransport ? (transport.sessionId ?? null) : null;\n}\n\nfunction toConnectError(error: unknown): McpConnectionError {\n  if (error instanceof McpConnectionError) {\n    return error;\n  }\n  if (isAuthError(error)) {\n    return new McpConnectionError('upstream returned 401 Unauthorized', 401, {\n      cause: error,\n    });\n  }\n  const message = error instanceof Error ? error.message : String(error);\n  return new McpConnectionError(message, 502, { cause: error });\n}\n\nfunction buildConnection(\n  client: McpClientWithTimeout,\n  transport: McpTransport,\n  transportType: RemoteMcpTransportType,\n  headers: Record<string, string>,\n  requestOptions: { signal: AbortSignal },\n): RemoteMcpConnection {\n  return {\n    transportType,\n    sessionId: getTransportSessionId(transport),\n    listTools: async (cursor?: string) => {\n      stampTraceHeaders(headers);\n      const response = await client.listTools(cursor ? { cursor } : undefined, requestOptions);\n      return {\n        tools: response.tools,\n        nextCursor: response.nextCursor,\n      };\n    },\n    callTool: async (callParams: CallToolRequest['params']): Promise<CallToolResult> => {\n      stampTraceHeaders(headers);\n      return (await client.callTool(callParams, undefined, requestOptions)) as CallToolResult;\n    },\n    close: async (): Promise<void> => {\n      await client.close().catch(() => {\n        /* no-op */\n      });\n    },\n  };\n}\n\n/**\n * Connect to a remote MCP server, keeping the first transport that connects. `sessionId` is passed to\n * every attempt so a stateful session resumes in place instead of opening a throwaway one.\n *\n * `knownTransportType` is a hint (from a prior connect / persisted state): it's tried first for a fast\n * path, but on failure we still fall back to probing the remaining transports, so a stale or wrong\n * hint (server switched transports, bad resume data) self-heals instead of failing every turn.\n */\nexport async function connectRemoteMcp(params: {\n  url: string;\n  headers: Record<string, string>;\n  sessionId?: string | undefined;\n  knownTransportType?: RemoteMcpTransportType | undefined;\n  requestTimeoutMs: number;\n  connectTimeoutMs: number;\n  signal: AbortSignal;\n  onClose?: (() => void) | undefined;\n  onError?: ((error: Error) => void) | undefined;\n}): Promise<RemoteMcpConnection> {\n  const url = new URL(params.url);\n  const requestOptions = { signal: params.signal };\n  const candidates = params.knownTransportType\n    ? [params.knownTransportType, ...TRANSPORT_PROBE_ORDER.filter(t => t !== params.knownTransportType)]\n    : TRANSPORT_PROBE_ORDER;\n  const failures: { transport: RemoteMcpTransportType; error: string }[] = [];\n\n  for (const transportType of candidates) {\n    const transport = createTransport(transportType, url, params.headers, params.sessionId);\n    const client = new McpClientWithTimeout(params.requestTimeoutMs);\n    // withTimeout races client.connect() and does not abort it, so timed-out connects can leak\n    // sockets until GC. Abort this controller on timeout so the handshake is cancelled.\n    // AbortSignal.timeout cannot be cleared, and the SDK keeps the signal on initialize, so it\n    // would still fire connectTimeoutMs later and cancel the live client.\n    const timeout = new AbortController();\n    const connectOptions = { signal: AbortSignal.any([params.signal, timeout.signal]) };\n    try {\n      stampTraceHeaders(params.headers);\n      await withTimeout(\n        // Concrete transports use sessionId: string|undefined; Transport uses an optional\n        // property — exactOptionalPropertyTypes rejects assignability without this cast.\n        client.connect(transport as Parameters<Client['connect']>[0], connectOptions),\n        params.connectTimeoutMs,\n        transportType,\n      );\n    } catch (error) {\n      timeout.abort();\n      await client.close().catch(() => {\n        /* no-op */\n      });\n      if (isAuthError(error)) {\n        throw toConnectError(error);\n      }\n      // A session-expired error means the transport is right but the session is stale: surface it so\n      // the caller reconnects fresh instead of falling through to a different transport.\n      if (params.sessionId && isSessionExpiredError(error)) {\n        throw toConnectError(error);\n      }\n      failures.push({ transport: transportType, error: error instanceof Error ? error.message.trim() : String(error) });\n      continue;\n    }\n\n    // Set on the client (not the transport) so the SDK's own onclose/onerror cleanup still runs; the\n    // SDK invokes these from inside it. Only wired on the kept connection, so failed attempts stay quiet.\n    client.onclose = () => params.onClose?.();\n    client.onerror = error => params.onError?.(error);\n    return buildConnection(client, transport, transportType, params.headers, requestOptions);\n  }\n\n  throw new McpConnectionError(`failed to connect (tried ${candidates.join(', ')}): ${JSON.stringify(failures)}`, 502);\n}\n"],"mappings":";AAAA,SAAS,cAAc;AAGvB,SAAS,0BAA0B;AACnC,SAAS,qCAAqC;AAG9C,SAAS,SAAS,mBAAmB;AACrC,SAAS,OAAO,SAAS,mBAAmB;AAC5C,SAAS,0BAA0B;AACnC,SAAS,mBAAmB;AAoB5B,IAAM,cAAc,EAAE,MAAM,wBAAwB,SAAS,QAAQ;AACrE,IAAM,wBAAkD,CAAC,mBAAmB,KAAK;AAMjF,IAAM,sBAAsB,KAAK,KAAK;AACtC,IAAM,eAAe,IAAI,MAAM,EAAE,aAAa,oBAAoB,CAAC;AACnE,IAAM,WAAsB,CAAC,KAAK,SAChC,YAAY,OAAO,QAAQ,WAAW,MAAM,IAAI,MAAM,EAAE,GAAI,MAAiB,YAAY,aAAa,CAAC;AAEzG,IAAM,uBAAN,cAAmC,OAAO;AAAA,EACxC,YAA6B,kBAA0B;AACrD,UAAM,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC;AADZ;AAAA,EAE7B;AAAA,EAF6B;AAAA;AAAA;AAAA,EAMpB,QAAQ,KAAU,QAAa,SAA6B;AAEnE,WAAO,MAAM,QAAQ,KAAK,QAAQ,EAAE,GAAG,SAAS,SAAS,KAAK,iBAAiB,CAAC;AAAA,EAClF;AACF;AAEA,SAAS,gBACP,MACA,KACA,SACA,WACc;AACd,QAAM,cAAc,EAAE,QAAQ;AAC9B,MAAI,SAAS,mBAAmB;AAC9B,WAAO,IAAI,8BAA8B,KAAK;AAAA,MAC5C;AAAA,MACA,OAAO;AAAA,MACP,GAAI,cAAc,SAAY,EAAE,UAAU,IAAI,CAAC;AAAA,IACjD,CAAC;AAAA,EACH;AAEA,SAAO,IAAI,mBAAmB,KAAK,EAAE,aAAa,OAAO,SAAS,CAAC;AACrE;AAEO,SAAS,sBAAsB,OAAyB;AAC7D,MAAI,EAAE,iBAAiB,QAAQ;AAC7B,WAAO;AAAA,EACT;AACA,MAAI,UAAU,SAAS,MAAM,SAAS,KAAK;AACzC,WAAO;AAAA,EACT;AACA,SAAO,MAAM,QAAQ,SAAS,UAAU,KAAK,MAAM,QAAQ,YAAY,EAAE,SAAS,SAAS;AAC7F;AAEA,SAAS,YAAY,OAAyB;AAC5C,MAAI,EAAE,iBAAiB,QAAQ;AAC7B,WAAO;AAAA,EACT;AACA,MAAI,UAAU,SAAS,MAAM,SAAS,KAAK;AACzC,WAAO;AAAA,EACT;AACA,SAAO,MAAM,QAAQ,SAAS,UAAU;AAC1C;AAGA,SAAS,kBAAkB,SAAuC;AAChE,cAAY,OAAO,QAAQ,OAAO,GAAG,OAAO;AAC9C;AAEA,SAAS,sBAAsB,WAAwC;AACrE,SAAO,qBAAqB,gCAAiC,UAAU,aAAa,OAAQ;AAC9F;AAEA,SAAS,eAAe,OAAoC;AAC1D,MAAI,iBAAiB,oBAAoB;AACvC,WAAO;AAAA,EACT;AACA,MAAI,YAAY,KAAK,GAAG;AACtB,WAAO,IAAI,mBAAmB,sCAAsC,KAAK;AAAA,MACvE,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,SAAO,IAAI,mBAAmB,SAAS,KAAK,EAAE,OAAO,MAAM,CAAC;AAC9D;AAEA,SAAS,gBACP,QACA,WACA,eACA,SACA,gBACqB;AACrB,SAAO;AAAA,IACL;AAAA,IACA,WAAW,sBAAsB,SAAS;AAAA,IAC1C,WAAW,OAAO,WAAoB;AACpC,wBAAkB,OAAO;AACzB,YAAM,WAAW,MAAM,OAAO,UAAU,SAAS,EAAE,OAAO,IAAI,QAAW,cAAc;AACvF,aAAO;AAAA,QACL,OAAO,SAAS;AAAA,QAChB,YAAY,SAAS;AAAA,MACvB;AAAA,IACF;AAAA,IACA,UAAU,OAAO,eAAmE;AAClF,wBAAkB,OAAO;AACzB,aAAQ,MAAM,OAAO,SAAS,YAAY,QAAW,cAAc;AAAA,IACrE;AAAA,IACA,OAAO,YAA2B;AAChC,YAAM,OAAO,MAAM,EAAE,MAAM,MAAM;AAAA,MAEjC,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAUA,eAAsB,iBAAiB,QAUN;AAC/B,QAAM,MAAM,IAAI,IAAI,OAAO,GAAG;AAC9B,QAAM,iBAAiB,EAAE,QAAQ,OAAO,OAAO;AAC/C,QAAM,aAAa,OAAO,qBACtB,CAAC,OAAO,oBAAoB,GAAG,sBAAsB,OAAO,OAAK,MAAM,OAAO,kBAAkB,CAAC,IACjG;AACJ,QAAM,WAAmE,CAAC;AAE1E,aAAW,iBAAiB,YAAY;AACtC,UAAM,YAAY,gBAAgB,eAAe,KAAK,OAAO,SAAS,OAAO,SAAS;AACtF,UAAM,SAAS,IAAI,qBAAqB,OAAO,gBAAgB;AAK/D,UAAM,UAAU,IAAI,gBAAgB;AACpC,UAAM,iBAAiB,EAAE,QAAQ,YAAY,IAAI,CAAC,OAAO,QAAQ,QAAQ,MAAM,CAAC,EAAE;AAClF,QAAI;AACF,wBAAkB,OAAO,OAAO;AAChC,YAAM;AAAA;AAAA;AAAA,QAGJ,OAAO,QAAQ,WAA+C,cAAc;AAAA,QAC5E,OAAO;AAAA,QACP;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,cAAQ,MAAM;AACd,YAAM,OAAO,MAAM,EAAE,MAAM,MAAM;AAAA,MAEjC,CAAC;AACD,UAAI,YAAY,KAAK,GAAG;AACtB,cAAM,eAAe,KAAK;AAAA,MAC5B;AAGA,UAAI,OAAO,aAAa,sBAAsB,KAAK,GAAG;AACpD,cAAM,eAAe,KAAK;AAAA,MAC5B;AACA,eAAS,KAAK,EAAE,WAAW,eAAe,OAAO,iBAAiB,QAAQ,MAAM,QAAQ,KAAK,IAAI,OAAO,KAAK,EAAE,CAAC;AAChH;AAAA,IACF;AAIA,WAAO,UAAU,MAAM,OAAO,UAAU;AACxC,WAAO,UAAU,WAAS,OAAO,UAAU,KAAK;AAChD,WAAO,gBAAgB,QAAQ,WAAW,eAAe,OAAO,SAAS,cAAc;AAAA,EACzF;AAEA,QAAM,IAAI,mBAAmB,4BAA4B,WAAW,KAAK,IAAI,CAAC,MAAM,KAAK,UAAU,QAAQ,CAAC,IAAI,GAAG;AACrH;","names":[]}
+{"version":3,"sources":["../../../src/core/mcp/remoteMcpClient.ts"],"sourcesContent":["import { Client } from '@modelcontextprotocol/sdk/client/index.js';\n// SSE remains required during the Streamable HTTP migration (some servers still speak SSE only).\n\nimport { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js';\nimport { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';\nimport type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';\nimport type { CallToolRequest, CallToolResult } from '@modelcontextprotocol/sdk/types.js';\nimport { context, propagation } from '@opentelemetry/api';\nimport { Agent, fetch as undiciFetch } from 'undici';\nimport { McpConnectionError } from '../errors';\nimport { withTimeout } from '../util/promiseUtils';\nimport type { ToolSchema } from './IMCPServer';\n\n/** Networking for remote (url-based) MCP servers, kept separate so it can be mocked in tests. */\n\nexport type RemoteMcpTransportType = 'streamable-http' | 'sse';\n\nexport interface RemoteMcpConnection {\n  readonly transportType: RemoteMcpTransportType;\n  /** Session id for a stateful server, or null for a stateless one. */\n  readonly sessionId: string | null;\n  listTools(cursor?: string): Promise<{ tools: ToolSchema[]; nextCursor?: string | undefined }>;\n  callTool(params: CallToolRequest['params']): Promise<CallToolResult>;\n  close(): Promise<void>;\n}\n\n// SSE transport type kept for dual-probe support during migration.\n// eslint-disable-next-line @typescript-eslint/no-deprecated -- see TRANSPORT_PROBE_ORDER\ntype McpTransport = StreamableHTTPClientTransport | SSEClientTransport;\n\nconst CLIENT_INFO = { name: 'tfy-agent-mcp-client', version: '1.0.0' } as const;\nconst TRANSPORT_PROBE_ORDER: RemoteMcpTransportType[] = ['streamable-http', 'sse'];\n\nexport const DEFAULT_MAX_MCP_RESPONSE_BYTES = 50 * 1024 * 1024;\n\n// MCP SSE/streamable-HTTP keeps a long-lived response open that is often idle between tool calls.\n// Node fetch (undici) defaults bodyTimeout to 300s of silence, then kills the stream with\n// `Body Timeout Error` — we reconnect and the ~5m cycle repeats in logs. 30m matches the\n// Gateway idle-body window; MCP request deadlines still come from requestTimeoutMs.\nconst MCP_BODY_TIMEOUT_MS = 30 * 60 * 1000;\nconst mcpHttpAgent = new Agent({ bodyTimeout: MCP_BODY_TIMEOUT_MS });\nconst mcpFetch: FetchLike = (url, init) =>\n  undiciFetch(typeof url === 'string' ? url : url.href, { ...(init as object), dispatcher: mcpHttpAgent });\n\n/** GET SSE is long-lived and uncapped; every other body aborts at `maxBytes`. */\nexport function withMaxResponseBytes(fetchFn: FetchLike, maxBytes: number): FetchLike {\n  return async (url, init) => {\n    const response = await fetchFn(url, init);\n    const isGetSse =\n      (init?.method ?? 'GET').toUpperCase() === 'GET' &&\n      (response.headers.get('content-type') ?? '').toLowerCase().includes('text/event-stream');\n    if (isGetSse || !response.body) {\n      return response;\n    }\n    let seen = 0;\n    return new Response(\n      response.body.pipeThrough(\n        new TransformStream<Uint8Array, Uint8Array>({\n          transform(chunk, controller) {\n            seen += chunk.byteLength;\n            if (seen > maxBytes) {\n              controller.error(new Error(`MCP response exceeded max ${String(maxBytes)} bytes`));\n              return;\n            }\n            controller.enqueue(chunk);\n          },\n        }),\n      ),\n      { status: response.status, statusText: response.statusText, headers: response.headers },\n    );\n  };\n}\n\nclass McpClientWithTimeout extends Client {\n  constructor(private readonly requestTimeoutMs: number) {\n    super(CLIENT_INFO, { capabilities: {} });\n  }\n\n  // SDK Client.request is loosely typed; forward with an explicit timeout.\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- MCP SDK request typing\n  override request(req: any, schema: any, options?: any): Promise<any> {\n    // eslint-disable-next-line @typescript-eslint/no-unsafe-argument -- MCP SDK request typing\n    return super.request(req, schema, { ...options, timeout: this.requestTimeoutMs });\n  }\n}\n\nfunction createTransport(\n  type: RemoteMcpTransportType,\n  url: URL,\n  headers: Record<string, string>,\n  fetchFn: FetchLike,\n  sessionId?: string,\n): McpTransport {\n  const requestInit = { headers };\n  if (type === 'streamable-http') {\n    return new StreamableHTTPClientTransport(url, {\n      requestInit,\n      fetch: fetchFn,\n      ...(sessionId !== undefined ? { sessionId } : {}),\n    });\n  }\n  // eslint-disable-next-line @typescript-eslint/no-deprecated -- dual-transport probe; see TRANSPORT_PROBE_ORDER\n  return new SSEClientTransport(url, { requestInit, fetch: fetchFn });\n}\n\nexport function isSessionExpiredError(error: unknown): boolean {\n  if (!(error instanceof Error)) {\n    return false;\n  }\n  if ('code' in error && error.code === 404) {\n    return true;\n  }\n  return error.message.includes('HTTP 404') || error.message.toLowerCase().includes('session');\n}\n\nfunction isAuthError(error: unknown): boolean {\n  if (!(error instanceof Error)) {\n    return false;\n  }\n  if ('code' in error && error.code === 401) {\n    return true;\n  }\n  return error.message.includes('HTTP 401');\n}\n\n/** Inject the active otel trace context so each request propagates its span. */\nfunction stampTraceHeaders(headers: Record<string, string>): void {\n  propagation.inject(context.active(), headers);\n}\n\nfunction getTransportSessionId(transport: McpTransport): string | null {\n  return transport instanceof StreamableHTTPClientTransport ? (transport.sessionId ?? null) : null;\n}\n\nfunction toConnectError(error: unknown): McpConnectionError {\n  if (error instanceof McpConnectionError) {\n    return error;\n  }\n  if (isAuthError(error)) {\n    return new McpConnectionError('upstream returned 401 Unauthorized', 401, {\n      cause: error,\n    });\n  }\n  const message = error instanceof Error ? error.message : String(error);\n  return new McpConnectionError(message, 502, { cause: error });\n}\n\nfunction buildConnection(\n  client: McpClientWithTimeout,\n  transport: McpTransport,\n  transportType: RemoteMcpTransportType,\n  headers: Record<string, string>,\n  requestOptions: { signal: AbortSignal },\n): RemoteMcpConnection {\n  return {\n    transportType,\n    sessionId: getTransportSessionId(transport),\n    listTools: async (cursor?: string) => {\n      stampTraceHeaders(headers);\n      const response = await client.listTools(cursor ? { cursor } : undefined, requestOptions);\n      return {\n        tools: response.tools,\n        nextCursor: response.nextCursor,\n      };\n    },\n    callTool: async (callParams: CallToolRequest['params']): Promise<CallToolResult> => {\n      stampTraceHeaders(headers);\n      return (await client.callTool(callParams, undefined, requestOptions)) as CallToolResult;\n    },\n    close: async (): Promise<void> => {\n      await client.close().catch(() => {\n        /* no-op */\n      });\n    },\n  };\n}\n\n/**\n * Connect to a remote MCP server, keeping the first transport that connects. `sessionId` is passed to\n * every attempt so a stateful session resumes in place instead of opening a throwaway one.\n *\n * `knownTransportType` is a hint (from a prior connect / persisted state): it's tried first for a fast\n * path, but on failure we still fall back to probing the remaining transports, so a stale or wrong\n * hint (server switched transports, bad resume data) self-heals instead of failing every turn.\n */\nexport async function connectRemoteMcp(params: {\n  url: string;\n  headers: Record<string, string>;\n  sessionId?: string | undefined;\n  knownTransportType?: RemoteMcpTransportType | undefined;\n  requestTimeoutMs: number;\n  connectTimeoutMs: number;\n  maxResponseBytes?: number | undefined;\n  signal: AbortSignal;\n  onClose?: (() => void) | undefined;\n  onError?: ((error: Error) => void) | undefined;\n}): Promise<RemoteMcpConnection> {\n  const url = new URL(params.url);\n  const requestOptions = { signal: params.signal };\n  const fetchFn = withMaxResponseBytes(mcpFetch, params.maxResponseBytes ?? DEFAULT_MAX_MCP_RESPONSE_BYTES);\n  const candidates = params.knownTransportType\n    ? [params.knownTransportType, ...TRANSPORT_PROBE_ORDER.filter(t => t !== params.knownTransportType)]\n    : TRANSPORT_PROBE_ORDER;\n  const failures: { transport: RemoteMcpTransportType; error: string }[] = [];\n\n  for (const transportType of candidates) {\n    const transport = createTransport(transportType, url, params.headers, fetchFn, params.sessionId);\n    const client = new McpClientWithTimeout(params.requestTimeoutMs);\n    // withTimeout races client.connect() and does not abort it, so timed-out connects can leak\n    // sockets until GC. Abort this controller on timeout so the handshake is cancelled.\n    // AbortSignal.timeout cannot be cleared, and the SDK keeps the signal on initialize, so it\n    // would still fire connectTimeoutMs later and cancel the live client.\n    const timeout = new AbortController();\n    const connectOptions = { signal: AbortSignal.any([params.signal, timeout.signal]) };\n    try {\n      stampTraceHeaders(params.headers);\n      await withTimeout(\n        // Concrete transports use sessionId: string|undefined; Transport uses an optional\n        // property — exactOptionalPropertyTypes rejects assignability without this cast.\n        client.connect(transport as Parameters<Client['connect']>[0], connectOptions),\n        params.connectTimeoutMs,\n        transportType,\n      );\n    } catch (error) {\n      timeout.abort();\n      await client.close().catch(() => {\n        /* no-op */\n      });\n      if (isAuthError(error)) {\n        throw toConnectError(error);\n      }\n      // A session-expired error means the transport is right but the session is stale: surface it so\n      // the caller reconnects fresh instead of falling through to a different transport.\n      if (params.sessionId && isSessionExpiredError(error)) {\n        throw toConnectError(error);\n      }\n      failures.push({ transport: transportType, error: error instanceof Error ? error.message.trim() : String(error) });\n      continue;\n    }\n\n    // Set on the client (not the transport) so the SDK's own onclose/onerror cleanup still runs; the\n    // SDK invokes these from inside it. Only wired on the kept connection, so failed attempts stay quiet.\n    client.onclose = () => params.onClose?.();\n    client.onerror = error => params.onError?.(error);\n    return buildConnection(client, transport, transportType, params.headers, requestOptions);\n  }\n\n  throw new McpConnectionError(`failed to connect (tried ${candidates.join(', ')}): ${JSON.stringify(failures)}`, 502);\n}\n"],"mappings":";AAAA,SAAS,cAAc;AAGvB,SAAS,0BAA0B;AACnC,SAAS,qCAAqC;AAG9C,SAAS,SAAS,mBAAmB;AACrC,SAAS,OAAO,SAAS,mBAAmB;AAC5C,SAAS,0BAA0B;AACnC,SAAS,mBAAmB;AAoB5B,IAAM,cAAc,EAAE,MAAM,wBAAwB,SAAS,QAAQ;AACrE,IAAM,wBAAkD,CAAC,mBAAmB,KAAK;AAE1E,IAAM,iCAAiC,KAAK,OAAO;AAM1D,IAAM,sBAAsB,KAAK,KAAK;AACtC,IAAM,eAAe,IAAI,MAAM,EAAE,aAAa,oBAAoB,CAAC;AACnE,IAAM,WAAsB,CAAC,KAAK,SAChC,YAAY,OAAO,QAAQ,WAAW,MAAM,IAAI,MAAM,EAAE,GAAI,MAAiB,YAAY,aAAa,CAAC;AAGlG,SAAS,qBAAqB,SAAoB,UAA6B;AACpF,SAAO,OAAO,KAAK,SAAS;AAC1B,UAAM,WAAW,MAAM,QAAQ,KAAK,IAAI;AACxC,UAAM,YACH,MAAM,UAAU,OAAO,YAAY,MAAM,UACzC,SAAS,QAAQ,IAAI,cAAc,KAAK,IAAI,YAAY,EAAE,SAAS,mBAAmB;AACzF,QAAI,YAAY,CAAC,SAAS,MAAM;AAC9B,aAAO;AAAA,IACT;AACA,QAAI,OAAO;AACX,WAAO,IAAI;AAAA,MACT,SAAS,KAAK;AAAA,QACZ,IAAI,gBAAwC;AAAA,UAC1C,UAAU,OAAO,YAAY;AAC3B,oBAAQ,MAAM;AACd,gBAAI,OAAO,UAAU;AACnB,yBAAW,MAAM,IAAI,MAAM,6BAA6B,OAAO,QAAQ,CAAC,QAAQ,CAAC;AACjF;AAAA,YACF;AACA,uBAAW,QAAQ,KAAK;AAAA,UAC1B;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MACA,EAAE,QAAQ,SAAS,QAAQ,YAAY,SAAS,YAAY,SAAS,SAAS,QAAQ;AAAA,IACxF;AAAA,EACF;AACF;AAEA,IAAM,uBAAN,cAAmC,OAAO;AAAA,EACxC,YAA6B,kBAA0B;AACrD,UAAM,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC;AADZ;AAAA,EAE7B;AAAA,EAF6B;AAAA;AAAA;AAAA,EAMpB,QAAQ,KAAU,QAAa,SAA6B;AAEnE,WAAO,MAAM,QAAQ,KAAK,QAAQ,EAAE,GAAG,SAAS,SAAS,KAAK,iBAAiB,CAAC;AAAA,EAClF;AACF;AAEA,SAAS,gBACP,MACA,KACA,SACA,SACA,WACc;AACd,QAAM,cAAc,EAAE,QAAQ;AAC9B,MAAI,SAAS,mBAAmB;AAC9B,WAAO,IAAI,8BAA8B,KAAK;AAAA,MAC5C;AAAA,MACA,OAAO;AAAA,MACP,GAAI,cAAc,SAAY,EAAE,UAAU,IAAI,CAAC;AAAA,IACjD,CAAC;AAAA,EACH;AAEA,SAAO,IAAI,mBAAmB,KAAK,EAAE,aAAa,OAAO,QAAQ,CAAC;AACpE;AAEO,SAAS,sBAAsB,OAAyB;AAC7D,MAAI,EAAE,iBAAiB,QAAQ;AAC7B,WAAO;AAAA,EACT;AACA,MAAI,UAAU,SAAS,MAAM,SAAS,KAAK;AACzC,WAAO;AAAA,EACT;AACA,SAAO,MAAM,QAAQ,SAAS,UAAU,KAAK,MAAM,QAAQ,YAAY,EAAE,SAAS,SAAS;AAC7F;AAEA,SAAS,YAAY,OAAyB;AAC5C,MAAI,EAAE,iBAAiB,QAAQ;AAC7B,WAAO;AAAA,EACT;AACA,MAAI,UAAU,SAAS,MAAM,SAAS,KAAK;AACzC,WAAO;AAAA,EACT;AACA,SAAO,MAAM,QAAQ,SAAS,UAAU;AAC1C;AAGA,SAAS,kBAAkB,SAAuC;AAChE,cAAY,OAAO,QAAQ,OAAO,GAAG,OAAO;AAC9C;AAEA,SAAS,sBAAsB,WAAwC;AACrE,SAAO,qBAAqB,gCAAiC,UAAU,aAAa,OAAQ;AAC9F;AAEA,SAAS,eAAe,OAAoC;AAC1D,MAAI,iBAAiB,oBAAoB;AACvC,WAAO;AAAA,EACT;AACA,MAAI,YAAY,KAAK,GAAG;AACtB,WAAO,IAAI,mBAAmB,sCAAsC,KAAK;AAAA,MACvE,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,SAAO,IAAI,mBAAmB,SAAS,KAAK,EAAE,OAAO,MAAM,CAAC;AAC9D;AAEA,SAAS,gBACP,QACA,WACA,eACA,SACA,gBACqB;AACrB,SAAO;AAAA,IACL;AAAA,IACA,WAAW,sBAAsB,SAAS;AAAA,IAC1C,WAAW,OAAO,WAAoB;AACpC,wBAAkB,OAAO;AACzB,YAAM,WAAW,MAAM,OAAO,UAAU,SAAS,EAAE,OAAO,IAAI,QAAW,cAAc;AACvF,aAAO;AAAA,QACL,OAAO,SAAS;AAAA,QAChB,YAAY,SAAS;AAAA,MACvB;AAAA,IACF;AAAA,IACA,UAAU,OAAO,eAAmE;AAClF,wBAAkB,OAAO;AACzB,aAAQ,MAAM,OAAO,SAAS,YAAY,QAAW,cAAc;AAAA,IACrE;AAAA,IACA,OAAO,YAA2B;AAChC,YAAM,OAAO,MAAM,EAAE,MAAM,MAAM;AAAA,MAEjC,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAUA,eAAsB,iBAAiB,QAWN;AAC/B,QAAM,MAAM,IAAI,IAAI,OAAO,GAAG;AAC9B,QAAM,iBAAiB,EAAE,QAAQ,OAAO,OAAO;AAC/C,QAAM,UAAU,qBAAqB,UAAU,OAAO,oBAAoB,8BAA8B;AACxG,QAAM,aAAa,OAAO,qBACtB,CAAC,OAAO,oBAAoB,GAAG,sBAAsB,OAAO,OAAK,MAAM,OAAO,kBAAkB,CAAC,IACjG;AACJ,QAAM,WAAmE,CAAC;AAE1E,aAAW,iBAAiB,YAAY;AACtC,UAAM,YAAY,gBAAgB,eAAe,KAAK,OAAO,SAAS,SAAS,OAAO,SAAS;AAC/F,UAAM,SAAS,IAAI,qBAAqB,OAAO,gBAAgB;AAK/D,UAAM,UAAU,IAAI,gBAAgB;AACpC,UAAM,iBAAiB,EAAE,QAAQ,YAAY,IAAI,CAAC,OAAO,QAAQ,QAAQ,MAAM,CAAC,EAAE;AAClF,QAAI;AACF,wBAAkB,OAAO,OAAO;AAChC,YAAM;AAAA;AAAA;AAAA,QAGJ,OAAO,QAAQ,WAA+C,cAAc;AAAA,QAC5E,OAAO;AAAA,QACP;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,cAAQ,MAAM;AACd,YAAM,OAAO,MAAM,EAAE,MAAM,MAAM;AAAA,MAEjC,CAAC;AACD,UAAI,YAAY,KAAK,GAAG;AACtB,cAAM,eAAe,KAAK;AAAA,MAC5B;AAGA,UAAI,OAAO,aAAa,sBAAsB,KAAK,GAAG;AACpD,cAAM,eAAe,KAAK;AAAA,MAC5B;AACA,eAAS,KAAK,EAAE,WAAW,eAAe,OAAO,iBAAiB,QAAQ,MAAM,QAAQ,KAAK,IAAI,OAAO,KAAK,EAAE,CAAC;AAChH;AAAA,IACF;AAIA,WAAO,UAAU,MAAM,OAAO,UAAU;AACxC,WAAO,UAAU,WAAS,OAAO,UAAU,KAAK;AAChD,WAAO,gBAAgB,QAAQ,WAAW,eAAe,OAAO,SAAS,cAAc;AAAA,EACzF;AAEA,QAAM,IAAI,mBAAmB,4BAA4B,WAAW,KAAK,IAAI,CAAC,MAAM,KAAK,UAAU,QAAQ,CAAC,IAAI,GAAG;AACrH;","names":[]}

package/dist/core/mcp/toolSelectors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"toolSelectors.d.ts","sourceRoot":"","sources":["../../../src/core/mcp/toolSelectors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAkB1E,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,iCAA8C,CAAC;AAE/E,oDAAoD;AACpD,eAAO,MAAM,oCAAoC,6CAAgE,CAAC;AAElH,eAAO,MAAM,oBAAoB,EAAE,MAAM,EAAmB,CAAC;AAC7D,eAAO,MAAM,qBAAqB,EAAE,MAAM,EAAO,CAAC;AAClD,eAAO,MAAM,qBAAqB,EAAE,MAAM,EAAO,CAAC;AAClD,eAAO,MAAM,kCAAkC,EAAE,MAAM,EAA2C,CAAC;AA+BnG,mEAAmE;AACnE,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,eAAe,GAAG,SAAS,EACxC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACvC,OAAO,CAeT;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,eAAe,GAAG,SAAS,EACxC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACvC,OAAO,CAKT;AAED,oDAAoD;AACpD,wBAAgB,aAAa,CAAC,MAAM,EAAE;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,eAAe,GAAG,SAAS,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,GAAG,OAAO,CASV;AAED,yFAAyF;AACzF,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAKnF;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,CAErF"}
+{"version":3,"file":"toolSelectors.d.ts","sourceRoot":"","sources":["../../../src/core/mcp/toolSelectors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAkB1E,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,iCAA8C,CAAC;AAE/E,oDAAoD;AACpD,eAAO,MAAM,oCAAoC,6CAAgE,CAAC;AAElH,eAAO,MAAM,oBAAoB,EAAE,MAAM,EAAmB,CAAC;AAC7D,eAAO,MAAM,qBAAqB,EAAE,MAAM,EAAO,CAAC;AAClD,eAAO,MAAM,qBAAqB,EAAE,MAAM,EAAO,CAAC;AAClD,eAAO,MAAM,kCAAkC,EAAE,MAAM,EAA2B,CAAC;AA+BnF,mEAAmE;AACnE,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,eAAe,GAAG,SAAS,EACxC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACvC,OAAO,CAeT;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,eAAe,GAAG,SAAS,EACxC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACvC,OAAO,CAKT;AAED,oDAAoD;AACpD,wBAAgB,aAAa,CAAC,MAAM,EAAE;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,eAAe,GAAG,SAAS,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,GAAG,OAAO,CASV;AAED,yFAAyF;AACzF,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAKnF;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,CAErF"}

package/dist/core/mcp/toolSelectors.js

@@ -43,7 +43,7 @@ var REQUIRE_APPROVAL_TOOLS_SELECTOR_TAGS = [TOOL_TAG_ALL, TOOL_TAG_WRITE, TOOL_T
 var DEFAULT_ENABLE_TOOLS = [TOOL_TAG_ALL];
 var DEFAULT_DISABLE_TOOLS = [];
 var DEFAULT_PRELOAD_TOOLS = [];
-var DEFAULT_REQUIRE_APPROVAL_FOR_TOOLS = [TOOL_TAG_WRITE, TOOL_TAG_DESTRUCTIVE];
+var DEFAULT_REQUIRE_APPROVAL_FOR_TOOLS = [TOOL_TAG_DESTRUCTIVE];
 function isToolTag(selector) {
   return TOOL_TAGS.includes(selector);
 }

package/dist/core/mcp/toolSelectors.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/core/mcp/toolSelectors.ts"],"sourcesContent":["import type { ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';\n\n/**\n * MCP server tool selectors are either a special tag or a literal tool name.\n *\n *   @all          — every tool on the server\n *   @read-only    — readOnlyHint === true\n *   @write        — readOnlyHint === false and not destructive\n *   @destructive   — destructiveHint === true\n */\nconst TOOL_TAG_ALL = '@all';\nconst TOOL_TAG_READ_ONLY = '@read-only';\nconst TOOL_TAG_WRITE = '@write';\nconst TOOL_TAG_DESTRUCTIVE = '@destructive';\n\nconst TOOL_TAGS = [TOOL_TAG_ALL, TOOL_TAG_READ_ONLY, TOOL_TAG_WRITE, TOOL_TAG_DESTRUCTIVE] as const;\ntype ToolTag = (typeof TOOL_TAGS)[number];\n\n/** Tags allowed on `enable_tools`, `disable_tools`, and `preload_tools`. */\nexport const TOOLS_SELECTOR_TAGS = [TOOL_TAG_ALL, TOOL_TAG_READ_ONLY] as const;\n\n/** Tags allowed on `require_approval_for_tools`. */\nexport const REQUIRE_APPROVAL_TOOLS_SELECTOR_TAGS = [TOOL_TAG_ALL, TOOL_TAG_WRITE, TOOL_TAG_DESTRUCTIVE] as const;\n\nexport const DEFAULT_ENABLE_TOOLS: string[] = [TOOL_TAG_ALL];\nexport const DEFAULT_DISABLE_TOOLS: string[] = [];\nexport const DEFAULT_PRELOAD_TOOLS: string[] = [];\nexport const DEFAULT_REQUIRE_APPROVAL_FOR_TOOLS: string[] = [TOOL_TAG_WRITE, TOOL_TAG_DESTRUCTIVE];\n\nfunction isToolTag(selector: string): selector is ToolTag {\n  return TOOL_TAGS.includes(selector as ToolTag);\n}\n\nfunction isReadOnly(annotations?: ToolAnnotations): boolean {\n  return annotations?.readOnlyHint === true;\n}\n\nfunction isWrite(annotations?: ToolAnnotations): boolean {\n  return annotations?.readOnlyHint === false && annotations.destructiveHint !== true;\n}\n\nfunction isDestructive(annotations?: ToolAnnotations): boolean {\n  return annotations?.destructiveHint === true;\n}\n\nfunction toolMatchesTag(tag: ToolTag, annotations: ToolAnnotations | undefined): boolean {\n  switch (tag) {\n    case TOOL_TAG_ALL:\n      return true;\n    case TOOL_TAG_READ_ONLY:\n      return isReadOnly(annotations);\n    case TOOL_TAG_WRITE:\n      return isWrite(annotations);\n    case TOOL_TAG_DESTRUCTIVE:\n      return isDestructive(annotations);\n  }\n}\n\n/** True if the tool matches any selector (tag or literal name). */\nexport function toolMatchesAnySelector(\n  toolName: string,\n  annotations: ToolAnnotations | undefined,\n  selectors: readonly string[] | undefined,\n): boolean {\n  if (!selectors?.length) {\n    return false;\n  }\n\n  for (const selector of selectors) {\n    if (isToolTag(selector)) {\n      if (toolMatchesTag(selector, annotations)) {\n        return true;\n      }\n    } else if (selector === toolName) {\n      return true;\n    }\n  }\n  return false;\n}\n\n/**\n * Whether the tool requires human approval before execution.\n * Matches `@write`, `@destructive`, `@all`, or explicit tool names against annotations.\n * Unannotated tools are exempt unless named in `require_approval_for_tools` or covered by `@all`.\n */\nexport function toolRequiresApproval(\n  toolName: string,\n  annotations: ToolAnnotations | undefined,\n  selectors: readonly string[] | undefined,\n): boolean {\n  if (!selectors?.length) {\n    return false;\n  }\n  return toolMatchesAnySelector(toolName, annotations, selectors);\n}\n\n/** True if the tool is enabled and not disabled. */\nexport function isToolAllowed(params: {\n  toolName: string;\n  annotations: ToolAnnotations | undefined;\n  enableSelectors: readonly string[];\n  disableSelectors: readonly string[];\n}): boolean {\n  const { toolName, annotations, enableSelectors, disableSelectors } = params;\n  if (!toolMatchesAnySelector(toolName, annotations, enableSelectors)) {\n    return false;\n  }\n  if (toolMatchesAnySelector(toolName, annotations, disableSelectors)) {\n    return false;\n  }\n  return true;\n}\n\n/** Non-tag names from a selector list (for upfront validation / sandbox allow-lists). */\nexport function literalToolNames(selectors: readonly string[] | undefined): string[] {\n  if (!selectors) {\n    return [];\n  }\n  return selectors.filter(s => !isToolTag(s));\n}\n\nexport function selectorsIncludeAll(selectors: readonly string[] | undefined): boolean {\n  return !!selectors?.includes(TOOL_TAG_ALL);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,IAAM,eAAe;AACrB,IAAM,qBAAqB;AAC3B,IAAM,iBAAiB;AACvB,IAAM,uBAAuB;AAE7B,IAAM,YAAY,CAAC,cAAc,oBAAoB,gBAAgB,oBAAoB;AAIlF,IAAM,sBAAsB,CAAC,cAAc,kBAAkB;AAG7D,IAAM,uCAAuC,CAAC,cAAc,gBAAgB,oBAAoB;AAEhG,IAAM,uBAAiC,CAAC,YAAY;AACpD,IAAM,wBAAkC,CAAC;AACzC,IAAM,wBAAkC,CAAC;AACzC,IAAM,qCAA+C,CAAC,gBAAgB,oBAAoB;AAEjG,SAAS,UAAU,UAAuC;AACxD,SAAO,UAAU,SAAS,QAAmB;AAC/C;AAEA,SAAS,WAAW,aAAwC;AAC1D,SAAO,aAAa,iBAAiB;AACvC;AAEA,SAAS,QAAQ,aAAwC;AACvD,SAAO,aAAa,iBAAiB,SAAS,YAAY,oBAAoB;AAChF;AAEA,SAAS,cAAc,aAAwC;AAC7D,SAAO,aAAa,oBAAoB;AAC1C;AAEA,SAAS,eAAe,KAAc,aAAmD;AACvF,UAAQ,KAAK;AAAA,IACX,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,WAAW,WAAW;AAAA,IAC/B,KAAK;AACH,aAAO,QAAQ,WAAW;AAAA,IAC5B,KAAK;AACH,aAAO,cAAc,WAAW;AAAA,EACpC;AACF;AAGO,SAAS,uBACd,UACA,aACA,WACS;AACT,MAAI,CAAC,WAAW,QAAQ;AACtB,WAAO;AAAA,EACT;AAEA,aAAW,YAAY,WAAW;AAChC,QAAI,UAAU,QAAQ,GAAG;AACvB,UAAI,eAAe,UAAU,WAAW,GAAG;AACzC,eAAO;AAAA,MACT;AAAA,IACF,WAAW,aAAa,UAAU;AAChC,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,qBACd,UACA,aACA,WACS;AACT,MAAI,CAAC,WAAW,QAAQ;AACtB,WAAO;AAAA,EACT;AACA,SAAO,uBAAuB,UAAU,aAAa,SAAS;AAChE;AAGO,SAAS,cAAc,QAKlB;AACV,QAAM,EAAE,UAAU,aAAa,iBAAiB,iBAAiB,IAAI;AACrE,MAAI,CAAC,uBAAuB,UAAU,aAAa,eAAe,GAAG;AACnE,WAAO;AAAA,EACT;AACA,MAAI,uBAAuB,UAAU,aAAa,gBAAgB,GAAG;AACnE,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,SAAS,iBAAiB,WAAoD;AACnF,MAAI,CAAC,WAAW;AACd,WAAO,CAAC;AAAA,EACV;AACA,SAAO,UAAU,OAAO,OAAK,CAAC,UAAU,CAAC,CAAC;AAC5C;AAEO,SAAS,oBAAoB,WAAmD;AACrF,SAAO,CAAC,CAAC,WAAW,SAAS,YAAY;AAC3C;","names":[]}
+{"version":3,"sources":["../../../src/core/mcp/toolSelectors.ts"],"sourcesContent":["import type { ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';\n\n/**\n * MCP server tool selectors are either a special tag or a literal tool name.\n *\n *   @all          — every tool on the server\n *   @read-only    — readOnlyHint === true\n *   @write        — readOnlyHint === false and not destructive\n *   @destructive   — destructiveHint === true\n */\nconst TOOL_TAG_ALL = '@all';\nconst TOOL_TAG_READ_ONLY = '@read-only';\nconst TOOL_TAG_WRITE = '@write';\nconst TOOL_TAG_DESTRUCTIVE = '@destructive';\n\nconst TOOL_TAGS = [TOOL_TAG_ALL, TOOL_TAG_READ_ONLY, TOOL_TAG_WRITE, TOOL_TAG_DESTRUCTIVE] as const;\ntype ToolTag = (typeof TOOL_TAGS)[number];\n\n/** Tags allowed on `enable_tools`, `disable_tools`, and `preload_tools`. */\nexport const TOOLS_SELECTOR_TAGS = [TOOL_TAG_ALL, TOOL_TAG_READ_ONLY] as const;\n\n/** Tags allowed on `require_approval_for_tools`. */\nexport const REQUIRE_APPROVAL_TOOLS_SELECTOR_TAGS = [TOOL_TAG_ALL, TOOL_TAG_WRITE, TOOL_TAG_DESTRUCTIVE] as const;\n\nexport const DEFAULT_ENABLE_TOOLS: string[] = [TOOL_TAG_ALL];\nexport const DEFAULT_DISABLE_TOOLS: string[] = [];\nexport const DEFAULT_PRELOAD_TOOLS: string[] = [];\nexport const DEFAULT_REQUIRE_APPROVAL_FOR_TOOLS: string[] = [TOOL_TAG_DESTRUCTIVE];\n\nfunction isToolTag(selector: string): selector is ToolTag {\n  return TOOL_TAGS.includes(selector as ToolTag);\n}\n\nfunction isReadOnly(annotations?: ToolAnnotations): boolean {\n  return annotations?.readOnlyHint === true;\n}\n\nfunction isWrite(annotations?: ToolAnnotations): boolean {\n  return annotations?.readOnlyHint === false && annotations.destructiveHint !== true;\n}\n\nfunction isDestructive(annotations?: ToolAnnotations): boolean {\n  return annotations?.destructiveHint === true;\n}\n\nfunction toolMatchesTag(tag: ToolTag, annotations: ToolAnnotations | undefined): boolean {\n  switch (tag) {\n    case TOOL_TAG_ALL:\n      return true;\n    case TOOL_TAG_READ_ONLY:\n      return isReadOnly(annotations);\n    case TOOL_TAG_WRITE:\n      return isWrite(annotations);\n    case TOOL_TAG_DESTRUCTIVE:\n      return isDestructive(annotations);\n  }\n}\n\n/** True if the tool matches any selector (tag or literal name). */\nexport function toolMatchesAnySelector(\n  toolName: string,\n  annotations: ToolAnnotations | undefined,\n  selectors: readonly string[] | undefined,\n): boolean {\n  if (!selectors?.length) {\n    return false;\n  }\n\n  for (const selector of selectors) {\n    if (isToolTag(selector)) {\n      if (toolMatchesTag(selector, annotations)) {\n        return true;\n      }\n    } else if (selector === toolName) {\n      return true;\n    }\n  }\n  return false;\n}\n\n/**\n * Whether the tool requires human approval before execution.\n * Matches `@write`, `@destructive`, `@all`, or explicit tool names against annotations.\n * Unannotated tools are exempt unless named in `require_approval_for_tools` or covered by `@all`.\n */\nexport function toolRequiresApproval(\n  toolName: string,\n  annotations: ToolAnnotations | undefined,\n  selectors: readonly string[] | undefined,\n): boolean {\n  if (!selectors?.length) {\n    return false;\n  }\n  return toolMatchesAnySelector(toolName, annotations, selectors);\n}\n\n/** True if the tool is enabled and not disabled. */\nexport function isToolAllowed(params: {\n  toolName: string;\n  annotations: ToolAnnotations | undefined;\n  enableSelectors: readonly string[];\n  disableSelectors: readonly string[];\n}): boolean {\n  const { toolName, annotations, enableSelectors, disableSelectors } = params;\n  if (!toolMatchesAnySelector(toolName, annotations, enableSelectors)) {\n    return false;\n  }\n  if (toolMatchesAnySelector(toolName, annotations, disableSelectors)) {\n    return false;\n  }\n  return true;\n}\n\n/** Non-tag names from a selector list (for upfront validation / sandbox allow-lists). */\nexport function literalToolNames(selectors: readonly string[] | undefined): string[] {\n  if (!selectors) {\n    return [];\n  }\n  return selectors.filter(s => !isToolTag(s));\n}\n\nexport function selectorsIncludeAll(selectors: readonly string[] | undefined): boolean {\n  return !!selectors?.includes(TOOL_TAG_ALL);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,IAAM,eAAe;AACrB,IAAM,qBAAqB;AAC3B,IAAM,iBAAiB;AACvB,IAAM,uBAAuB;AAE7B,IAAM,YAAY,CAAC,cAAc,oBAAoB,gBAAgB,oBAAoB;AAIlF,IAAM,sBAAsB,CAAC,cAAc,kBAAkB;AAG7D,IAAM,uCAAuC,CAAC,cAAc,gBAAgB,oBAAoB;AAEhG,IAAM,uBAAiC,CAAC,YAAY;AACpD,IAAM,wBAAkC,CAAC;AACzC,IAAM,wBAAkC,CAAC;AACzC,IAAM,qCAA+C,CAAC,oBAAoB;AAEjF,SAAS,UAAU,UAAuC;AACxD,SAAO,UAAU,SAAS,QAAmB;AAC/C;AAEA,SAAS,WAAW,aAAwC;AAC1D,SAAO,aAAa,iBAAiB;AACvC;AAEA,SAAS,QAAQ,aAAwC;AACvD,SAAO,aAAa,iBAAiB,SAAS,YAAY,oBAAoB;AAChF;AAEA,SAAS,cAAc,aAAwC;AAC7D,SAAO,aAAa,oBAAoB;AAC1C;AAEA,SAAS,eAAe,KAAc,aAAmD;AACvF,UAAQ,KAAK;AAAA,IACX,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,WAAW,WAAW;AAAA,IAC/B,KAAK;AACH,aAAO,QAAQ,WAAW;AAAA,IAC5B,KAAK;AACH,aAAO,cAAc,WAAW;AAAA,EACpC;AACF;AAGO,SAAS,uBACd,UACA,aACA,WACS;AACT,MAAI,CAAC,WAAW,QAAQ;AACtB,WAAO;AAAA,EACT;AAEA,aAAW,YAAY,WAAW;AAChC,QAAI,UAAU,QAAQ,GAAG;AACvB,UAAI,eAAe,UAAU,WAAW,GAAG;AACzC,eAAO;AAAA,MACT;AAAA,IACF,WAAW,aAAa,UAAU;AAChC,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,qBACd,UACA,aACA,WACS;AACT,MAAI,CAAC,WAAW,QAAQ;AACtB,WAAO;AAAA,EACT;AACA,SAAO,uBAAuB,UAAU,aAAa,SAAS;AAChE;AAGO,SAAS,cAAc,QAKlB;AACV,QAAM,EAAE,UAAU,aAAa,iBAAiB,iBAAiB,IAAI;AACrE,MAAI,CAAC,uBAAuB,UAAU,aAAa,eAAe,GAAG;AACnE,WAAO;AAAA,EACT;AACA,MAAI,uBAAuB,UAAU,aAAa,gBAAgB,GAAG;AACnE,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,SAAS,iBAAiB,WAAoD;AACnF,MAAI,CAAC,WAAW;AACd,WAAO,CAAC;AAAA,EACV;AACA,SAAO,UAAU,OAAO,OAAK,CAAC,UAAU,CAAC,CAAC;AAC5C;AAEO,SAAS,oBAAoB,WAAmD;AACrF,SAAO,CAAC,CAAC,WAAW,SAAS,YAAY;AAC3C;","names":[]}

package/dist/core/mcp/toolSelectors.mjs

@@ -9,7 +9,7 @@ var REQUIRE_APPROVAL_TOOLS_SELECTOR_TAGS = [TOOL_TAG_ALL, TOOL_TAG_WRITE, TOOL_T
 var DEFAULT_ENABLE_TOOLS = [TOOL_TAG_ALL];
 var DEFAULT_DISABLE_TOOLS = [];
 var DEFAULT_PRELOAD_TOOLS = [];
-var DEFAULT_REQUIRE_APPROVAL_FOR_TOOLS = [TOOL_TAG_WRITE, TOOL_TAG_DESTRUCTIVE];
+var DEFAULT_REQUIRE_APPROVAL_FOR_TOOLS = [TOOL_TAG_DESTRUCTIVE];
 function isToolTag(selector) {
   return TOOL_TAGS.includes(selector);
 }

package/dist/core/mcp/toolSelectors.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/core/mcp/toolSelectors.ts"],"sourcesContent":["import type { ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';\n\n/**\n * MCP server tool selectors are either a special tag or a literal tool name.\n *\n *   @all          — every tool on the server\n *   @read-only    — readOnlyHint === true\n *   @write        — readOnlyHint === false and not destructive\n *   @destructive   — destructiveHint === true\n */\nconst TOOL_TAG_ALL = '@all';\nconst TOOL_TAG_READ_ONLY = '@read-only';\nconst TOOL_TAG_WRITE = '@write';\nconst TOOL_TAG_DESTRUCTIVE = '@destructive';\n\nconst TOOL_TAGS = [TOOL_TAG_ALL, TOOL_TAG_READ_ONLY, TOOL_TAG_WRITE, TOOL_TAG_DESTRUCTIVE] as const;\ntype ToolTag = (typeof TOOL_TAGS)[number];\n\n/** Tags allowed on `enable_tools`, `disable_tools`, and `preload_tools`. */\nexport const TOOLS_SELECTOR_TAGS = [TOOL_TAG_ALL, TOOL_TAG_READ_ONLY] as const;\n\n/** Tags allowed on `require_approval_for_tools`. */\nexport const REQUIRE_APPROVAL_TOOLS_SELECTOR_TAGS = [TOOL_TAG_ALL, TOOL_TAG_WRITE, TOOL_TAG_DESTRUCTIVE] as const;\n\nexport const DEFAULT_ENABLE_TOOLS: string[] = [TOOL_TAG_ALL];\nexport const DEFAULT_DISABLE_TOOLS: string[] = [];\nexport const DEFAULT_PRELOAD_TOOLS: string[] = [];\nexport const DEFAULT_REQUIRE_APPROVAL_FOR_TOOLS: string[] = [TOOL_TAG_WRITE, TOOL_TAG_DESTRUCTIVE];\n\nfunction isToolTag(selector: string): selector is ToolTag {\n  return TOOL_TAGS.includes(selector as ToolTag);\n}\n\nfunction isReadOnly(annotations?: ToolAnnotations): boolean {\n  return annotations?.readOnlyHint === true;\n}\n\nfunction isWrite(annotations?: ToolAnnotations): boolean {\n  return annotations?.readOnlyHint === false && annotations.destructiveHint !== true;\n}\n\nfunction isDestructive(annotations?: ToolAnnotations): boolean {\n  return annotations?.destructiveHint === true;\n}\n\nfunction toolMatchesTag(tag: ToolTag, annotations: ToolAnnotations | undefined): boolean {\n  switch (tag) {\n    case TOOL_TAG_ALL:\n      return true;\n    case TOOL_TAG_READ_ONLY:\n      return isReadOnly(annotations);\n    case TOOL_TAG_WRITE:\n      return isWrite(annotations);\n    case TOOL_TAG_DESTRUCTIVE:\n      return isDestructive(annotations);\n  }\n}\n\n/** True if the tool matches any selector (tag or literal name). */\nexport function toolMatchesAnySelector(\n  toolName: string,\n  annotations: ToolAnnotations | undefined,\n  selectors: readonly string[] | undefined,\n): boolean {\n  if (!selectors?.length) {\n    return false;\n  }\n\n  for (const selector of selectors) {\n    if (isToolTag(selector)) {\n      if (toolMatchesTag(selector, annotations)) {\n        return true;\n      }\n    } else if (selector === toolName) {\n      return true;\n    }\n  }\n  return false;\n}\n\n/**\n * Whether the tool requires human approval before execution.\n * Matches `@write`, `@destructive`, `@all`, or explicit tool names against annotations.\n * Unannotated tools are exempt unless named in `require_approval_for_tools` or covered by `@all`.\n */\nexport function toolRequiresApproval(\n  toolName: string,\n  annotations: ToolAnnotations | undefined,\n  selectors: readonly string[] | undefined,\n): boolean {\n  if (!selectors?.length) {\n    return false;\n  }\n  return toolMatchesAnySelector(toolName, annotations, selectors);\n}\n\n/** True if the tool is enabled and not disabled. */\nexport function isToolAllowed(params: {\n  toolName: string;\n  annotations: ToolAnnotations | undefined;\n  enableSelectors: readonly string[];\n  disableSelectors: readonly string[];\n}): boolean {\n  const { toolName, annotations, enableSelectors, disableSelectors } = params;\n  if (!toolMatchesAnySelector(toolName, annotations, enableSelectors)) {\n    return false;\n  }\n  if (toolMatchesAnySelector(toolName, annotations, disableSelectors)) {\n    return false;\n  }\n  return true;\n}\n\n/** Non-tag names from a selector list (for upfront validation / sandbox allow-lists). */\nexport function literalToolNames(selectors: readonly string[] | undefined): string[] {\n  if (!selectors) {\n    return [];\n  }\n  return selectors.filter(s => !isToolTag(s));\n}\n\nexport function selectorsIncludeAll(selectors: readonly string[] | undefined): boolean {\n  return !!selectors?.includes(TOOL_TAG_ALL);\n}\n"],"mappings":";AAUA,IAAM,eAAe;AACrB,IAAM,qBAAqB;AAC3B,IAAM,iBAAiB;AACvB,IAAM,uBAAuB;AAE7B,IAAM,YAAY,CAAC,cAAc,oBAAoB,gBAAgB,oBAAoB;AAIlF,IAAM,sBAAsB,CAAC,cAAc,kBAAkB;AAG7D,IAAM,uCAAuC,CAAC,cAAc,gBAAgB,oBAAoB;AAEhG,IAAM,uBAAiC,CAAC,YAAY;AACpD,IAAM,wBAAkC,CAAC;AACzC,IAAM,wBAAkC,CAAC;AACzC,IAAM,qCAA+C,CAAC,gBAAgB,oBAAoB;AAEjG,SAAS,UAAU,UAAuC;AACxD,SAAO,UAAU,SAAS,QAAmB;AAC/C;AAEA,SAAS,WAAW,aAAwC;AAC1D,SAAO,aAAa,iBAAiB;AACvC;AAEA,SAAS,QAAQ,aAAwC;AACvD,SAAO,aAAa,iBAAiB,SAAS,YAAY,oBAAoB;AAChF;AAEA,SAAS,cAAc,aAAwC;AAC7D,SAAO,aAAa,oBAAoB;AAC1C;AAEA,SAAS,eAAe,KAAc,aAAmD;AACvF,UAAQ,KAAK;AAAA,IACX,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,WAAW,WAAW;AAAA,IAC/B,KAAK;AACH,aAAO,QAAQ,WAAW;AAAA,IAC5B,KAAK;AACH,aAAO,cAAc,WAAW;AAAA,EACpC;AACF;AAGO,SAAS,uBACd,UACA,aACA,WACS;AACT,MAAI,CAAC,WAAW,QAAQ;AACtB,WAAO;AAAA,EACT;AAEA,aAAW,YAAY,WAAW;AAChC,QAAI,UAAU,QAAQ,GAAG;AACvB,UAAI,eAAe,UAAU,WAAW,GAAG;AACzC,eAAO;AAAA,MACT;AAAA,IACF,WAAW,aAAa,UAAU;AAChC,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,qBACd,UACA,aACA,WACS;AACT,MAAI,CAAC,WAAW,QAAQ;AACtB,WAAO;AAAA,EACT;AACA,SAAO,uBAAuB,UAAU,aAAa,SAAS;AAChE;AAGO,SAAS,cAAc,QAKlB;AACV,QAAM,EAAE,UAAU,aAAa,iBAAiB,iBAAiB,IAAI;AACrE,MAAI,CAAC,uBAAuB,UAAU,aAAa,eAAe,GAAG;AACnE,WAAO;AAAA,EACT;AACA,MAAI,uBAAuB,UAAU,aAAa,gBAAgB,GAAG;AACnE,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,SAAS,iBAAiB,WAAoD;AACnF,MAAI,CAAC,WAAW;AACd,WAAO,CAAC;AAAA,EACV;AACA,SAAO,UAAU,OAAO,OAAK,CAAC,UAAU,CAAC,CAAC;AAC5C;AAEO,SAAS,oBAAoB,WAAmD;AACrF,SAAO,CAAC,CAAC,WAAW,SAAS,YAAY;AAC3C;","names":[]}
+{"version":3,"sources":["../../../src/core/mcp/toolSelectors.ts"],"sourcesContent":["import type { ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';\n\n/**\n * MCP server tool selectors are either a special tag or a literal tool name.\n *\n *   @all          — every tool on the server\n *   @read-only    — readOnlyHint === true\n *   @write        — readOnlyHint === false and not destructive\n *   @destructive   — destructiveHint === true\n */\nconst TOOL_TAG_ALL = '@all';\nconst TOOL_TAG_READ_ONLY = '@read-only';\nconst TOOL_TAG_WRITE = '@write';\nconst TOOL_TAG_DESTRUCTIVE = '@destructive';\n\nconst TOOL_TAGS = [TOOL_TAG_ALL, TOOL_TAG_READ_ONLY, TOOL_TAG_WRITE, TOOL_TAG_DESTRUCTIVE] as const;\ntype ToolTag = (typeof TOOL_TAGS)[number];\n\n/** Tags allowed on `enable_tools`, `disable_tools`, and `preload_tools`. */\nexport const TOOLS_SELECTOR_TAGS = [TOOL_TAG_ALL, TOOL_TAG_READ_ONLY] as const;\n\n/** Tags allowed on `require_approval_for_tools`. */\nexport const REQUIRE_APPROVAL_TOOLS_SELECTOR_TAGS = [TOOL_TAG_ALL, TOOL_TAG_WRITE, TOOL_TAG_DESTRUCTIVE] as const;\n\nexport const DEFAULT_ENABLE_TOOLS: string[] = [TOOL_TAG_ALL];\nexport const DEFAULT_DISABLE_TOOLS: string[] = [];\nexport const DEFAULT_PRELOAD_TOOLS: string[] = [];\nexport const DEFAULT_REQUIRE_APPROVAL_FOR_TOOLS: string[] = [TOOL_TAG_DESTRUCTIVE];\n\nfunction isToolTag(selector: string): selector is ToolTag {\n  return TOOL_TAGS.includes(selector as ToolTag);\n}\n\nfunction isReadOnly(annotations?: ToolAnnotations): boolean {\n  return annotations?.readOnlyHint === true;\n}\n\nfunction isWrite(annotations?: ToolAnnotations): boolean {\n  return annotations?.readOnlyHint === false && annotations.destructiveHint !== true;\n}\n\nfunction isDestructive(annotations?: ToolAnnotations): boolean {\n  return annotations?.destructiveHint === true;\n}\n\nfunction toolMatchesTag(tag: ToolTag, annotations: ToolAnnotations | undefined): boolean {\n  switch (tag) {\n    case TOOL_TAG_ALL:\n      return true;\n    case TOOL_TAG_READ_ONLY:\n      return isReadOnly(annotations);\n    case TOOL_TAG_WRITE:\n      return isWrite(annotations);\n    case TOOL_TAG_DESTRUCTIVE:\n      return isDestructive(annotations);\n  }\n}\n\n/** True if the tool matches any selector (tag or literal name). */\nexport function toolMatchesAnySelector(\n  toolName: string,\n  annotations: ToolAnnotations | undefined,\n  selectors: readonly string[] | undefined,\n): boolean {\n  if (!selectors?.length) {\n    return false;\n  }\n\n  for (const selector of selectors) {\n    if (isToolTag(selector)) {\n      if (toolMatchesTag(selector, annotations)) {\n        return true;\n      }\n    } else if (selector === toolName) {\n      return true;\n    }\n  }\n  return false;\n}\n\n/**\n * Whether the tool requires human approval before execution.\n * Matches `@write`, `@destructive`, `@all`, or explicit tool names against annotations.\n * Unannotated tools are exempt unless named in `require_approval_for_tools` or covered by `@all`.\n */\nexport function toolRequiresApproval(\n  toolName: string,\n  annotations: ToolAnnotations | undefined,\n  selectors: readonly string[] | undefined,\n): boolean {\n  if (!selectors?.length) {\n    return false;\n  }\n  return toolMatchesAnySelector(toolName, annotations, selectors);\n}\n\n/** True if the tool is enabled and not disabled. */\nexport function isToolAllowed(params: {\n  toolName: string;\n  annotations: ToolAnnotations | undefined;\n  enableSelectors: readonly string[];\n  disableSelectors: readonly string[];\n}): boolean {\n  const { toolName, annotations, enableSelectors, disableSelectors } = params;\n  if (!toolMatchesAnySelector(toolName, annotations, enableSelectors)) {\n    return false;\n  }\n  if (toolMatchesAnySelector(toolName, annotations, disableSelectors)) {\n    return false;\n  }\n  return true;\n}\n\n/** Non-tag names from a selector list (for upfront validation / sandbox allow-lists). */\nexport function literalToolNames(selectors: readonly string[] | undefined): string[] {\n  if (!selectors) {\n    return [];\n  }\n  return selectors.filter(s => !isToolTag(s));\n}\n\nexport function selectorsIncludeAll(selectors: readonly string[] | undefined): boolean {\n  return !!selectors?.includes(TOOL_TAG_ALL);\n}\n"],"mappings":";AAUA,IAAM,eAAe;AACrB,IAAM,qBAAqB;AAC3B,IAAM,iBAAiB;AACvB,IAAM,uBAAuB;AAE7B,IAAM,YAAY,CAAC,cAAc,oBAAoB,gBAAgB,oBAAoB;AAIlF,IAAM,sBAAsB,CAAC,cAAc,kBAAkB;AAG7D,IAAM,uCAAuC,CAAC,cAAc,gBAAgB,oBAAoB;AAEhG,IAAM,uBAAiC,CAAC,YAAY;AACpD,IAAM,wBAAkC,CAAC;AACzC,IAAM,wBAAkC,CAAC;AACzC,IAAM,qCAA+C,CAAC,oBAAoB;AAEjF,SAAS,UAAU,UAAuC;AACxD,SAAO,UAAU,SAAS,QAAmB;AAC/C;AAEA,SAAS,WAAW,aAAwC;AAC1D,SAAO,aAAa,iBAAiB;AACvC;AAEA,SAAS,QAAQ,aAAwC;AACvD,SAAO,aAAa,iBAAiB,SAAS,YAAY,oBAAoB;AAChF;AAEA,SAAS,cAAc,aAAwC;AAC7D,SAAO,aAAa,oBAAoB;AAC1C;AAEA,SAAS,eAAe,KAAc,aAAmD;AACvF,UAAQ,KAAK;AAAA,IACX,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,WAAW,WAAW;AAAA,IAC/B,KAAK;AACH,aAAO,QAAQ,WAAW;AAAA,IAC5B,KAAK;AACH,aAAO,cAAc,WAAW;AAAA,EACpC;AACF;AAGO,SAAS,uBACd,UACA,aACA,WACS;AACT,MAAI,CAAC,WAAW,QAAQ;AACtB,WAAO;AAAA,EACT;AAEA,aAAW,YAAY,WAAW;AAChC,QAAI,UAAU,QAAQ,GAAG;AACvB,UAAI,eAAe,UAAU,WAAW,GAAG;AACzC,eAAO;AAAA,MACT;AAAA,IACF,WAAW,aAAa,UAAU;AAChC,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,qBACd,UACA,aACA,WACS;AACT,MAAI,CAAC,WAAW,QAAQ;AACtB,WAAO;AAAA,EACT;AACA,SAAO,uBAAuB,UAAU,aAAa,SAAS;AAChE;AAGO,SAAS,cAAc,QAKlB;AACV,QAAM,EAAE,UAAU,aAAa,iBAAiB,iBAAiB,IAAI;AACrE,MAAI,CAAC,uBAAuB,UAAU,aAAa,eAAe,GAAG;AACnE,WAAO;AAAA,EACT;AACA,MAAI,uBAAuB,UAAU,aAAa,gBAAgB,GAAG;AACnE,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,SAAS,iBAAiB,WAAoD;AACnF,MAAI,CAAC,WAAW;AACd,WAAO,CAAC;AAAA,EACV;AACA,SAAO,UAAU,OAAO,OAAK,CAAC,UAAU,CAAC,CAAC;AAC5C;AAEO,SAAS,oBAAoB,WAAmD;AACrF,SAAO,CAAC,CAAC,WAAW,SAAS,YAAY;AAC3C;","names":[]}

package/dist/core/web-search/ParallelWebSearchProvider.d.ts

@@ -0,0 +1,24 @@
+import { WebSearchProviders, type IWebSearchProvider, type WebFetchPages, type WebSearchHits } from './WebSearchProvider';
+export type ParallelSearchMode = 'turbo' | 'fast' | 'basic' | 'advanced';
+export interface ParallelWebSearchProviderOptions {
+    apiKey: string;
+    /** Parallel Search mode preset. Caller supplies the default (e.g. `turbo`). */
+    mode: ParallelSearchMode;
+}
+/**
+ * Parallel Search + Extract via the official `parallel-web` SDK.
+ */
+export declare class ParallelWebSearchProvider implements IWebSearchProvider {
+    #private;
+    readonly id = WebSearchProviders.Parallel;
+    constructor(options: ParallelWebSearchProviderOptions);
+    search(input: {
+        search_queries: string[];
+        objective: string | undefined;
+    }): Promise<WebSearchHits>;
+    fetch(input: {
+        urls: string[];
+        objective: string | undefined;
+    }): Promise<WebFetchPages>;
+}
+//# sourceMappingURL=ParallelWebSearchProvider.d.ts.map

package/dist/core/web-search/ParallelWebSearchProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ParallelWebSearchProvider.d.ts","sourceRoot":"","sources":["../../../src/core/web-search/ParallelWebSearchProvider.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAClB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;AAOzE,MAAM,WAAW,gCAAgC;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,IAAI,EAAE,kBAAkB,CAAC;CAC1B;AAED;;GAEG;AACH,qBAAa,yBAA0B,YAAW,kBAAkB;;IAClE,QAAQ,CAAC,EAAE,+BAA+B;IAI1C,YAAY,OAAO,EAAE,gCAAgC,EAGpD;IAEK,MAAM,CAAC,KAAK,EAAE;QAAE,cAAc,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAmBvG;IAEK,KAAK,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAoB5F;CACF"}