@webmcp-auto-ui/agent 2.5.23 → 2.5.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webmcp-auto-ui/agent",
-  "version": "2.5.23",
+  "version": "2.5.24",
   "description": "LLM agent loop + remote/WASM/local providers + MCP wrapper",
   "license": "AGPL-3.0-or-later",
   "type": "module",

package/src/discovery-cache.ts

@@ -6,6 +6,9 @@
 
 import type { ProviderTool } from './types.js';
 
+/** Tool names that are resolved locally from cache — hidden from user-facing browsers. */
+export const DISCOVERY_TOOL_NAMES = new Set(['list_recipes', 'search_recipes', 'get_recipe', 'list_tools', 'search_tools']);
+
 export interface CachedRecipe {
   name: string;
   description?: string;
@@ -79,6 +82,12 @@ export class DiscoveryCache {
     return this.servers.get(serverPrefix)?.tools.length ?? 0;
   }
 
+  /** Tool count excluding discovery tools (hidden from user-facing browsers) */
+  browsableToolCount(serverPrefix: string): number {
+    const tools = this.servers.get(serverPrefix)?.tools ?? [];
+    return tools.filter(t => !DISCOVERY_TOOL_NAMES.has(t.name)).length;
+  }
+
   /**
    * Try to resolve a discovery tool call from cache.
    * Returns the result string if handled, or null if not a discovery tool.

package/src/index.ts

@@ -29,7 +29,7 @@ export { buildToolsFromLayers, buildDiscoveryTools, buildDiscoveryToolsWithAlias
 export type { ToolLayer, McpLayer, WebMcpLayer, SystemPromptResult, DiscoveryToolsResult, SchemaTransformOptions, BuildToolsResult } from './tool-layers.js';
 
 // Discovery cache
-export { DiscoveryCache } from './discovery-cache.js';
+export { DiscoveryCache, DISCOVERY_TOOL_NAMES } from './discovery-cache.js';
 export type { CachedRecipe, ServerCache } from './discovery-cache.js';
 
 // Re-export core WebMCP types

package/src/tool-layers.ts

@@ -465,6 +465,8 @@ Unless a recipe specifies otherwise, use these tools to display your responses o
 
 ${actionTools.join('\n')}
 
+widget_display may ONLY be called with data returned by a non-autoui DATA tool actually invoked in the current session. Fabricating IDs, URLs, names, dates, or any content not returned by a tool is a critical violation. If no DATA tool has been called yet, go back to STEP 1.
+
 STEP 5 — Fallback
 
 If previous steps failed, fall back to a classic chat without tool calling.`;