agent-enderun 1.10.4 → 1.11.1

package/framework-mcp/src/tools/framework/update_contract_hash.ts

@@ -0,0 +1,7 @@
+import { safeExec } from "../../utils/cli.js";
+import { UpdateContractHashArgs, ToolResult } from "../types.js";
+
+export function handleUpdateContractHash(projectRoot: string, args: UpdateContractHashArgs): ToolResult {
+    const output = safeExec("npx", ["agent-enderun", "update-contract"], projectRoot, args.timeout);
+    return { content: [{ type: "text", text: output }] };
+}

package/framework-mcp/src/tools/framework/update_memory.ts

@@ -0,0 +1,10 @@
+import { safeExec } from "../../utils/cli.js";
+import { UpdateProjectMemoryArgs, ToolResult } from "../types.js";
+
+export function handleUpdateProjectMemory(projectRoot: string, args: UpdateProjectMemoryArgs): ToolResult {
+    const section = args.section;
+    const content = args.content;
+    // Using execFileSync with array args prevents command injection
+    safeExec("npx", ["agent-enderun", "update_project_memory", section, content], projectRoot);
+    return { content: [{ type: "text", text: `✅ Section ${section} updated.` }] };
+}

package/framework-mcp/src/tools/index.ts

@@ -0,0 +1,66 @@
+import { TOOLS } from "./definitions.js";
+import { handleReadFile } from "./file_system/read_file.js";
+import { handleWriteFile } from "./file_system/write_file.js";
+import { handleReplaceText } from "./file_system/replace_text.js";
+import { handleBatchSurgicalEdit } from "./file_system/batch_surgical_edit.js";
+import { handlePatchFile } from "./file_system/patch_file.js";
+import { handleGrepSearch } from "./search/grep_search.js";
+import { handleListDir } from "./search/list_dir.js";
+import { handleGetProjectGaps } from "./search/get_gaps.js";
+import { handleGetProjectMap } from "./search/get_map.js";
+import { handleGetFrameworkStatus } from "./framework/get_status.js";
+import { handleUpdateProjectMemory } from "./framework/update_memory.js";
+import { handleAuditDependencies } from "./framework/audit_deps.js";
+import { handleRunTests } from "./framework/run_tests.js";
+import { handleGetSystemHealth } from "./observability/get_health.js";
+import { handleCheckPorts } from "./observability/check_ports.js";
+import { handleStartDashboard } from "./dashboard/start_dashboard.js";
+import { handleOrchestrateLoop } from "./framework/orchestrate.js";
+import { handleUpdateContractHash } from "./framework/update_contract_hash.js";
+import { handleReadProjectMemory } from "./memory/read_memory.js";
+import { handleGetMemoryInsights } from "./memory/get_insights.js";
+import { handleSendAgentMessage } from "./messaging/send_message.js";
+import { handleLogAgentAction } from "./messaging/log_action.js";
+import { handleAcquireLock, handleReleaseLock } from "./control_plane/locking.js";
+import { handleRegisterAgent } from "./control_plane/registry.js";
+import { handleRunCommand } from "./shell/run_command.js";
+import { handleCheckLint } from "./quality/check_lint.js";
+import { ToolHandler, ToolResult } from "./types.js";
+
+// Map of tool names to their handler functions
+const bind = <T>(fn: (root: string, args: T) => ToolResult | Promise<ToolResult>): ToolHandler => {
+    return (root: string, args: unknown) => fn(root, args as T);
+};
+
+export const toolHandlers: Record<string, ToolHandler> = {
+    read_file: bind(handleReadFile),
+    view_file: bind(handleReadFile), // Alias
+    list_dir: bind(handleListDir),
+    grep_search: bind(handleGrepSearch),
+    get_project_map: bind(handleGetProjectMap),
+    get_project_gaps: bind(handleGetProjectGaps),
+    write_file: bind(handleWriteFile),
+    replace_text: bind(handleReplaceText),
+    batch_surgical_edit: bind(handleBatchSurgicalEdit),
+    patch_file: bind(handlePatchFile),
+    get_framework_status: bind(handleGetFrameworkStatus),
+    read_project_memory: bind(handleReadProjectMemory),
+    get_memory_insights: bind(handleGetMemoryInsights),
+    update_project_memory: bind(handleUpdateProjectMemory),
+    audit_dependencies: bind(handleAuditDependencies),
+    run_tests: bind(handleRunTests),
+    get_system_health: bind(handleGetSystemHealth),
+    check_active_ports: bind(handleCheckPorts),
+    start_dashboard: bind(handleStartDashboard),
+    orchestrate_loop: bind(handleOrchestrateLoop),
+    send_agent_message: bind(handleSendAgentMessage),
+    log_agent_action: bind(handleLogAgentAction),
+    update_contract_hash: bind(handleUpdateContractHash),
+    acquire_lock: bind(handleAcquireLock),
+    release_lock: bind(handleReleaseLock),
+    register_agent: bind(handleRegisterAgent),
+    run_shell_command: bind(handleRunCommand),
+    check_lint: bind(handleCheckLint),
+};
+
+export { TOOLS };

package/framework-mcp/src/tools/memory/get_insights.ts

@@ -0,0 +1,41 @@
+import fs from "fs";
+import path from "path";
+import { resolveFrameworkDir } from "../../utils/security.js";
+import { ToolArgs, ToolResult } from "../types.js";
+
+/**
+ * Extracts key insights from the project memory to minimize token usage.
+ * Returns only the active phase, trace, and the last 5 decisions/tasks.
+ */
+export function handleGetMemoryInsights(projectRoot: string, _args: ToolArgs): ToolResult {
+    try {
+        const frameworkDir = resolveFrameworkDir(projectRoot);
+        const memoryPath = path.join(projectRoot, frameworkDir, "memory/PROJECT_MEMORY.md");
+
+        if (!fs.existsSync(memoryPath)) {
+            return { content: [{ type: "text", text: "New project: No history available." }] };
+        }
+
+        const content = fs.readFileSync(memoryPath, "utf8");
+        const lines = content.split("\n");
+        
+        const activePhase = lines.find(l => l.includes("Active Phase:"))?.split(":")[1]?.trim() || "Unknown";
+        const activeTrace = lines.find(l => l.includes("Active Trace:"))?.split(":")[1]?.trim() || "None";
+        
+        // Find the last 5 history items (heuristic)
+        const historyStartIndex = lines.findIndex(l => l.includes("## History"));
+        let recentHistory = "No history found.";
+        if (historyStartIndex !== -1) {
+            recentHistory = lines.slice(historyStartIndex + 1, historyStartIndex + 15)
+                .filter(l => l.trim().startsWith("-"))
+                .slice(-5)
+                .join("\n");
+        }
+
+        const insights = `🧠 **Memory Insights**\n- **Phase:** ${activePhase}\n- **Trace:** ${activeTrace}\n\n**Recent Actions:**\n${recentHistory}`;
+        
+        return { content: [{ type: "text", text: insights }] };
+    } catch (e) {
+        return { isError: true, content: [{ type: "text", text: `Failed to extract insights: ${String(e)}` }] };
+    }
+}

package/framework-mcp/src/tools/memory/read_memory.ts

@@ -0,0 +1,31 @@
+import fs from "fs";
+import path from "path";
+import { resolveFrameworkDir } from "../../utils/security.js";
+import { ToolArgs, ToolResult } from "../types.js";
+
+/**
+ * Reads the project's central memory (PROJECT_MEMORY.md).
+ * This is the "brain" of the project.
+ */
+export function handleReadProjectMemory(projectRoot: string, _args: ToolArgs): ToolResult {
+    try {
+        const frameworkDir = resolveFrameworkDir(projectRoot);
+        const memoryPath = path.join(projectRoot, frameworkDir, "memory/PROJECT_MEMORY.md");
+
+        if (!fs.existsSync(memoryPath)) {
+            return {
+                content: [{ type: "text", text: "ℹ️ Project memory file not found. It might be a new project." }]
+            };
+        }
+
+        const content = fs.readFileSync(memoryPath, "utf8");
+        return {
+            content: [{ type: "text", text: content }]
+        };
+    } catch (e) {
+        return {
+            isError: true,
+            content: [{ type: "text", text: `Failed to read project memory: ${String(e)}` }]
+        };
+    }
+}

package/framework-mcp/src/tools/messaging/log_action.ts

@@ -0,0 +1,28 @@
+import fs from "fs";
+import path from "path";
+import { resolveFrameworkDir } from "../../utils/security.js";
+import { LogAgentActionArgs, ToolResult } from "../types.js";
+
+export function handleLogAgentAction(projectRoot: string, args: LogAgentActionArgs): ToolResult {
+    const { agent, action, traceId, status, summary } = args;
+    const findings = args.findings ? args.findings.split(",").map(f => f.trim()) : [];
+
+    const frameworkDir = resolveFrameworkDir(projectRoot);
+    const agentName = agent.replace("@", "");
+    const logPath = path.join(projectRoot, frameworkDir, "logs", `${agentName}.json`);
+
+    const logEntry = {
+        timestamp: new Date().toISOString(),
+        agent,
+        action,
+        requestId: traceId,
+        status,
+        summary,
+        findings
+    };
+
+    fs.mkdirSync(path.dirname(logPath), { recursive: true });
+    fs.appendFileSync(logPath, JSON.stringify(logEntry) + "\n");
+
+    return { content: [{ type: "text", text: `✅ Action logged for ${agent} to ${path.join(frameworkDir, "logs", `${agentName}.json`)}` }] };
+}

package/framework-mcp/src/tools/messaging/send_message.ts

@@ -0,0 +1,89 @@
+import fs from "fs";
+import path from "path";
+import { resolveFrameworkDir } from "../../utils/security.js";
+import { SendAgentMessageArgs, ToolResult } from "../types.js";
+import { Metrics } from "../../utils/metrics.js";
+
+export async function handleSendAgentMessage(projectRoot: string, args: SendAgentMessageArgs): Promise<ToolResult> {
+    const { to, category, content, traceId } = args;
+    const from = args.from || "@mcp";
+
+    if (!to || !category || !content || !traceId) {
+        const err = "Missing required messaging arguments (to, category, content, or traceId).";
+        Metrics.logError(projectRoot, from, "send_agent_message", err);
+        return { isError: true, content: [{ type: "text", text: `❌ ${err}` }] };
+    }
+
+    const frameworkDir = resolveFrameworkDir(projectRoot);
+    const messagesDir = path.join(projectRoot, frameworkDir, "messages");
+    const agentName = to.replace("@", "");
+    const messagePath = path.join(messagesDir, `${agentName}.json`);
+    const lockPath = path.join(messagesDir, `${agentName}.lock`);
+
+    // Hermes Lock Protocol: Retry 3 times with 500ms delay
+    let retries = 3;
+    let acquired = false;
+    while (retries > 0) {
+        try {
+            if (fs.existsSync(lockPath)) {
+                try {
+                    const stats = fs.statSync(lockPath);
+                    if (Date.now() - stats.mtimeMs > 5000) {
+                        fs.unlinkSync(lockPath);
+                    }
+                } catch {
+                    // ignore if concurrently unlinked
+                }
+            }
+            fs.mkdirSync(messagesDir, { recursive: true });
+            fs.writeFileSync(lockPath, `Locked by ${from} at ${new Date().toISOString()}`, { flag: "wx" });
+            acquired = true;
+            break;
+        } catch (err: unknown) {
+            const error = err as { code?: string; message?: string };
+            if (error.code === "EEXIST") {
+                retries--;
+                if (retries > 0) {
+                    await new Promise((resolve) => setTimeout(resolve, 500));
+                }
+            } else {
+                return { content: [{ type: "text", text: `❌ Unexpected lock acquisition error: ${error.message || String(err)}` }], isError: true };
+            }
+        }
+    }
+
+    if (!acquired) {
+        const err = `Could not send message to ${to}: Hermes lock is busy.`;
+        Metrics.logError(projectRoot, from, "send_agent_message", err);
+        return { content: [{ type: "text", text: `❌ ${err}` }], isError: true };
+    }
+
+    try {
+        const defaultPriority = (category === "ALERT" || category === "ACTION") ? "HIGH" : "NORMAL";
+        const message = {
+            timestamp: new Date().toISOString(),
+            from,
+            to,
+            category,
+            traceId,
+            content,
+            priority: args.priority || defaultPriority,
+            status: "PENDING"
+        };
+
+        fs.appendFileSync(messagePath, JSON.stringify(message) + "\n");
+        return { content: [{ type: "text", text: `✅ Message sent to ${to} (from: ${from})` }] };
+    } catch (e) {
+        const err = `Failed to write message: ${String(e)}`;
+        Metrics.logError(projectRoot, from, "send_agent_message", err);
+        return { isError: true, content: [{ type: "text", text: `❌ ${err}` }] };
+    } finally {
+        if (acquired && fs.existsSync(lockPath)) {
+            try {
+                fs.unlinkSync(lockPath);
+            } catch {
+                // ignore
+            }
+        }
+    }
+}

package/framework-mcp/src/tools/observability/check_ports.ts

@@ -0,0 +1,30 @@
+import { execSync } from "child_process";
+import { CheckActivePortsArgs, ToolResult } from "../types.js";
+
+/**
+ * Checks for active network ports and their status.
+ */
+export function handleCheckPorts(projectRoot: string, args: CheckActivePortsArgs): ToolResult {
+    const filter = args.filter || ""; // Optional filter (e.g., ":3000")
+
+    try {
+        // Using 'lsof -i -P -n' to list open files and network connections
+        // Note: may require permissions or behave differently on non-Unix systems
+        const command = process.platform === "win32"
+            ? `netstat -ano | findstr LISTENING ${filter ? `| findstr ${filter}` : ""}`
+            : `lsof -i -P -n | grep LISTEN ${filter ? `| grep ${filter}` : ""}`;
+
+        const output = execSync(command, { encoding: "utf8" });
+
+        return {
+            content: [{
+                type: "text",
+                text: `📡 **Active Listening Ports:**\n\n${output || "No active listening ports found matching filter."}`
+            }]
+        };
+    } catch (_e) {
+        return {
+            content: [{ type: "text", text: "ℹ️ No active ports found or command failed (this is normal if nothing is listening)." }]
+        };
+    }
+}

package/framework-mcp/src/tools/observability/get_health.ts

@@ -0,0 +1,24 @@
+import os from "os";
+import { ToolArgs, ToolResult } from "../types.js";
+
+/**
+ * Retrieves system health metrics including CPU load and memory usage.
+ */
+export function handleGetSystemHealth(_projectRoot: string, _args: ToolArgs): ToolResult {
+    const totalMem = os.totalmem();
+    const freeMem = os.freemem();
+    const usedMem = totalMem - freeMem;
+    const memUsagePercent = ((usedMem / totalMem) * 100).toFixed(2);
+
+    const loadAvg = os.loadavg(); // [1, 5, 15] minute averages
+
+    const healthReport = `🖥️ **System Health Report**
+- **Memory:** ${memUsagePercent}% used (${(usedMem / 1024 / 1024 / 1024).toFixed(2)} GB / ${(totalMem / 1024 / 1024 / 1024).toFixed(2)} GB)
+- **CPU Load (1m, 5m, 15m):** ${loadAvg.map(l => l.toFixed(2)).join(", ")}
+- **Platform:** ${os.platform()} (${os.release()})
+- **Uptime:** ${(os.uptime() / 3600).toFixed(2)} hours`;
+
+    return {
+        content: [{ type: "text", text: healthReport }]
+    };
+}

package/framework-mcp/src/tools/quality/check_lint.ts

@@ -0,0 +1,33 @@
+import { exec } from "child_process";
+import { ToolArgs, ToolResult } from "../types.js";
+import { Metrics } from "../../utils/metrics.js";
+
+const LINT_COMMAND = "npm run lint";
+const TIMEOUT = 60000; // 60 seconds
+
+/**
+ * Handles running the project's linter.
+ */
+export function handleCheckLint(projectRoot: string, _args: ToolArgs): Promise<ToolResult> {
+    return new Promise((resolve) => {
+        exec(LINT_COMMAND, { cwd: projectRoot, timeout: TIMEOUT }, (error, stdout, stderr) => {
+            const output = stdout + stderr;
+            const tokens = Metrics.estimateTokens(output);
+            
+            if (error) {
+                const err = `Linting failed: ${error.message}`;
+                Metrics.logError(projectRoot, "@mcp", "check_lint", err);
+                resolve({
+                    isError: true,
+                    content: [{ type: "text", text: `❌ Lint Errors Found:\n\n${output}` }]
+                });
+                return;
+            }
+
+            Metrics.logUsage(projectRoot, "@mcp", "check_lint", tokens);
+            resolve({
+                content: [{ type: "text", text: `✅ Lint check passed successfully:\n\n${output}` }]
+            });
+        });
+    });
+}

package/framework-mcp/src/tools/search/get_gaps.ts

@@ -0,0 +1,54 @@
+import fs from "fs";
+import path from "path";
+import { safePath } from "../../utils/security.js";
+import { GetProjectGapsArgs, ToolResult } from "../types.js";
+
+/**
+ * Scans the codebase for TODOs, FIXMEs, and empty function bodies.
+ * Helps identify what's left and where the agent might have skipped logic.
+ */
+export function handleGetProjectGaps(projectRoot: string, args: GetProjectGapsArgs): ToolResult {
+    const srcDir = safePath(projectRoot, args.path || "src");
+    const results: string[] = [];
+
+    const walk = (dir: string) => {
+        if (!fs.existsSync(dir)) return;
+        const files = fs.readdirSync(dir);
+        for (const file of files) {
+            const fullPath = path.join(dir, file);
+            const relativePath = path.relative(projectRoot, fullPath);
+
+            if (fs.statSync(fullPath).isDirectory()) {
+                if (file !== "node_modules" && file !== "dist" && !file.startsWith(".")) {
+                    walk(fullPath);
+                }
+            } else if (file.endsWith(".ts") || file.endsWith(".tsx")) {
+                const content = fs.readFileSync(fullPath, "utf8");
+                const lines = content.split("\n");
+
+                lines.forEach((line, index) => {
+                    // 1. Scan for markers
+                    if (line.includes("TODO") || line.includes("FIXME") || line.includes("!!!")) {
+                        results.push(`[${relativePath}:${index + 1}] Marker found: ${line.trim()}`);
+                    }
+                    
+                    // 2. Scan for empty function placeholders (heuristic)
+                    if (line.includes("throw new Error(\"Not implemented") || line.includes("// ... rest of code")) {
+                        results.push(`[${relativePath}:${index + 1}] Gap found: ${line.trim()}`);
+                    }
+                });
+            }
+        }
+    };
+
+    walk(srcDir);
+
+    return {
+        content: [{
+            type: "text",
+            text: results.length > 0 
+                ? `Found ${results.length} gaps/todos:\n\n${results.join("\n")}`
+                : "✅ No major gaps or TODOs found in the scanned directory."
+        }]
+    };
+}

package/framework-mcp/src/tools/search/get_map.ts

@@ -0,0 +1,48 @@
+import fs from "fs";
+import path from "path";
+import { GetProjectMapArgs, ToolResult } from "../types.js";
+
+/**
+ * Generates a tree-view map of the project structure.
+ * Helps agents visualize the entire project layout quickly.
+ */
+export function handleGetProjectMap(projectRoot: string, args: GetProjectMapArgs): ToolResult {
+    const maxDepth = args.maxDepth || 3;
+    const includeFiles = args.includeFiles !== false;
+
+    const buildTree = (dir: string, depth: number): string[] => {
+        if (depth > maxDepth) return [];
+
+        const results: string[] = [];
+        const files = fs.readdirSync(dir);
+
+        files.forEach(file => {
+            if (file === "node_modules" || file === ".git" || file === "dist" || file.startsWith(".")) return;
+
+            const fullPath = path.join(dir, file);
+            const stat = fs.statSync(fullPath);
+            const indent = "  ".repeat(depth);
+
+            if (stat.isDirectory()) {
+                results.push(`${indent}📁 ${file}/`);
+                results.push(...buildTree(fullPath, depth + 1));
+            } else if (includeFiles) {
+                results.push(`${indent}📄 ${file}`);
+            }
+        });
+
+        return results;
+    };
+
+    try {
+        const tree = buildTree(projectRoot, 0);
+        return {
+            content: [{
+                type: "text",
+                text: `🗺️ **Project Map (Depth: ${maxDepth})**\n\n${tree.join("\n")}`
+            }]
+        };
+    } catch (e) {
+        return { isError: true, content: [{ type: "text", text: `Failed to map project: ${String(e)}` }] };
+    }
+}

package/framework-mcp/src/tools/search/grep_search.ts

@@ -0,0 +1,76 @@
+import fs from "fs";
+import path from "path";
+import { GrepSearchArgs, ToolResult } from "../types.js";
+import { Metrics } from "../../utils/metrics.js";
+
+/**
+ * Searches for a regex pattern within files in the project.
+ */
+export function handleGrepSearch(projectRoot: string, args: GrepSearchArgs): ToolResult {
+    const pattern = args.pattern as string;
+    const includePattern = args.includePattern as string || ""; // e.g., ".ts"
+    const excludePattern = args.excludePattern as string || "node_modules";
+
+    if (!pattern) {
+        const err = "Search pattern is required.";
+        Metrics.logError(projectRoot, "@mcp", "grep_search", err);
+        return { isError: true, content: [{ type: "text", text: `❌ ${err}` }] };
+    }
+
+    const results: string[] = [];
+    let regex: RegExp;
+    try {
+        regex = new RegExp(pattern, "g");
+    } catch (e) {
+        const err = `Invalid regex pattern: ${String(e)}`;
+        Metrics.logError(projectRoot, "@mcp", "grep_search", err);
+        return { isError: true, content: [{ type: "text", text: `❌ ${err}` }] };
+    }
+
+    const walk = (dir: string) => {
+        if (results.length > 100) return;
+        try {
+            const files = fs.readdirSync(dir);
+            for (const file of files) {
+                if (results.length > 100) return;
+                const filePath = path.join(dir, file);
+                if (excludePattern && filePath.includes(excludePattern)) {
+                    continue;
+                }
+                const stat = fs.statSync(filePath);
+                if (stat.isDirectory()) {
+                    walk(filePath);
+                } else if (stat.isFile()) {
+                    if (includePattern && !filePath.endsWith(includePattern)) {
+                        continue;
+                    }
+                    const content = fs.readFileSync(filePath, "utf8");
+                    // Create a new regex object for each line to avoid state issues with /g
+                    if (new RegExp(pattern).test(content)) {
+                        if (results.length < 100) {
+                            results.push(filePath);
+                        }
+                    }
+                }
+            }
+        } catch (e) {
+            // Ignore directories that cannot be read
+        }
+    };
+    try {
+        walk(projectRoot);
+    } catch (e) {
+        const err = `Search failed: ${String(e)}`;
+        Metrics.logError(projectRoot, "@mcp", "grep_search", err);
+        return { isError: true, content: [{ type: "text", text: `❌ ${err}` }] };
+    }
+
+    return {
+        content: [{
+            type: "text",
+            text: results.length > 0
+                ? `Found ${results.length} matches:\n\n${results.join("\n")}`
+                : "No matches found."
+        }]
+    };
+}

package/framework-mcp/src/tools/search/list_dir.ts

@@ -0,0 +1,34 @@
+import fs from "fs";
+import path from "path";
+import { safePath } from "../../utils/security.js";
+import { ListDirArgs, ToolResult } from "../types.js";
+
+/**
+ * Lists the contents of a directory.
+ */
+export function handleListDir(projectRoot: string, args: ListDirArgs): ToolResult {
+    const dirPath = safePath(projectRoot, args.path || ".");
+    
+    if (!fs.existsSync(dirPath)) {
+        throw new Error(`Directory not found: ${args.path}`);
+    }
+
+    const stats = fs.statSync(dirPath);
+    if (!stats.isDirectory()) {
+        throw new Error(`Path is not a directory: ${args.path}`);
+    }
+
+    const files = fs.readdirSync(dirPath);
+    const results = files.map(file => {
+        const fullPath = path.join(dirPath, file);
+        const isDir = fs.statSync(fullPath).isDirectory();
+        return `${isDir ? "[DIR] " : "      "}${file}`;
+    });
+
+    return {
+        content: [{
+            type: "text",
+            text: `Directory listing for ${args.path || "."}:\n\n${results.join("\n")}`
+        }]
+    };
+}

package/framework-mcp/src/tools/shell/run_command.ts

@@ -0,0 +1,56 @@
+import { exec } from "child_process";
+import { RunCommandArgs, ToolResult } from "../types.js";
+import { Metrics } from "../../utils/metrics.js";
+
+const COMMAND_ALLOW_LIST = [
+    "npm test",
+    "npm run lint",
+    "git status",
+    "git diff",
+    "npx vitest run", // From the audit, this is the test command
+    "npm run build", // From the audit
+];
+
+const TIMEOUT = 30000; // 30 seconds
+
+export function handleRunCommand(projectRoot: string, args: RunCommandArgs): Promise<ToolResult> {
+    const command = args.command;
+
+    const isAllowed = COMMAND_ALLOW_LIST.some(allowedCmd => command.startsWith(allowedCmd));
+
+    if (!isAllowed) {
+        const errorMsg = `Command not allowed: "${command}". Only commands starting with the following are allowed: ${COMMAND_ALLOW_LIST.join(", ")}`;
+        Metrics.logError(projectRoot, "@mcp", `run_shell_command: ${command} (denied)`, errorMsg);
+        return Promise.resolve({
+            content: [{ type: "text", text: `ERROR: ${errorMsg}` }],
+            isError: true,
+        });
+    }
+
+    return new Promise((resolve) => {
+        exec(command, { cwd: projectRoot, timeout: TIMEOUT }, (error, stdout, stderr) => {
+            const output = stdout + stderr;
+            const tokens = Metrics.estimateTokens(output);
+            Metrics.logUsage(projectRoot, "@mcp", `run_shell_command: ${command}`, tokens);
+            
+            if (error) {
+                const errorMsg = `Command failed with exit code ${error.code}: ${error.message}.`;
+                Metrics.logError(projectRoot, "@mcp", `run_shell_command: ${command}`, errorMsg);
+                resolve({
+                    content: [{ type: "text", text: `ERROR: ${errorMsg}. Output: ${output}` }],
+                    isError: true,
+                });
+                return;
+            }
+
+            // Truncate long outputs
+            const MAX_OUTPUT_LENGTH = 5000;
+            let truncatedOutput = output;
+            if (output.length > MAX_OUTPUT_LENGTH) {
+                truncatedOutput = output.substring(0, MAX_OUTPUT_LENGTH) + "... [TRUNCATED] ..."; // Simplified
+            }
+            
+            resolve({ content: [{ type: "text", text: truncatedOutput }] });
+        });
+    });
+}