klyro 0.1.63 → 1.0.0

package/dist/mcp/client.js

@@ -0,0 +1,225 @@
+/**
+ * P1 — MCP stdio client (r-11-17.md §3.1).
+ *
+ * Minimal JSON-RPC 2.0 over newline-delimited stdio: `initialize`,
+ * `tools/list`, `tools/call`, `resources/list`, `resources/read`, `ping`.
+ * Every call is bound to an `AbortSignal` and a per-call timeout; spawn
+ * failures and server errors surface as typed `McpError`s — never throws
+ * raw across the boundary.
+ */
+import { spawn } from 'node:child_process';
+export class McpError extends Error {
+    code;
+    details;
+    constructor(message, code, details) {
+        super(message);
+        this.code = code;
+        this.details = details;
+        this.name = 'McpError';
+    }
+}
+const PROTOCOL_VERSION = '2024-11-05';
+const DEFAULT_TIMEOUT_MS = 30_000;
+const MAX_STDERR_BYTES = 8192;
+export class McpClient {
+    name;
+    spec;
+    child = null;
+    nextId = 1;
+    pending = new Map();
+    stdoutBuf = '';
+    stderrTail = '';
+    dead = null;
+    closed = false;
+    constructor(name, spec) {
+        this.name = name;
+        this.spec = spec;
+    }
+    async connect() {
+        if (this.child)
+            return;
+        const timeoutMs = this.spec.policy?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        await new Promise((resolve, reject) => {
+            let child;
+            try {
+                child = spawn(this.spec.command, this.spec.args ?? [], {
+                    stdio: ['pipe', 'pipe', 'pipe'],
+                    env: { ...process.env, ...(this.spec.env ?? {}) },
+                    shell: false,
+                    windowsHide: true,
+                });
+            }
+            catch (err) {
+                reject(new McpError(`mcp server "${this.name}" spawn failed: ${err instanceof Error ? err.message : String(err)}`, 'SPAWN_FAILED'));
+                return;
+            }
+            this.child = child;
+            child.on('error', (err) => {
+                this.failAll(new McpError(`mcp server "${this.name}" process error: ${err.message}`, 'SPAWN_FAILED'));
+                if (!this.connected)
+                    reject(new McpError(`mcp server "${this.name}" spawn failed: ${err.message}`, 'SPAWN_FAILED'));
+            });
+            child.stderr?.on('data', (b) => {
+                this.stderrTail = (this.stderrTail + b.toString('utf-8')).slice(-MAX_STDERR_BYTES);
+            });
+            child.stdout?.on('data', (b) => this.onStdout(b.toString('utf-8')));
+            child.on('exit', (code, signal) => {
+                if (!this.closed) {
+                    this.failAll(new McpError(`mcp server "${this.name}" exited (${signal ?? `code ${code}`})${this.stderrTail ? `: ${this.stderrTail.slice(-300)}` : ''}`, 'SERVER_EXITED'));
+                }
+            });
+            // Consider the transport up once the process is spawned; the
+            // initialize handshake below proves the protocol.
+            resolve();
+        });
+        try {
+            await this.request('initialize', {
+                protocolVersion: PROTOCOL_VERSION,
+                capabilities: {},
+                clientInfo: { name: 'klyro', version: '1.0.0' },
+            }, timeoutMs);
+            this.notify('notifications/initialized', {});
+            this.connected = true;
+        }
+        catch (err) {
+            await this.close();
+            throw err;
+        }
+    }
+    connected = false;
+    async listTools() {
+        this.assertLive();
+        const res = (await this.request('tools/list', {}, this.timeout()));
+        return Array.isArray(res.tools) ? res.tools : [];
+    }
+    async callTool(name, args, signal) {
+        this.assertLive();
+        const res = (await this.request('tools/call', { name, arguments: args ?? {} }, this.timeout(), signal));
+        const blocks = Array.isArray(res.content) ? res.content : [];
+        const text = blocks.map((b) => (typeof b.text === 'string' ? b.text : JSON.stringify(b))).join('\n');
+        return { text, isError: res.isError === true, raw: res };
+    }
+    async listResources() {
+        this.assertLive();
+        const res = (await this.request('resources/list', {}, this.timeout()));
+        return Array.isArray(res.resources) ? res.resources : [];
+    }
+    async readResource(uri, signal) {
+        this.assertLive();
+        const res = (await this.request('resources/read', { uri }, this.timeout(), signal));
+        const contents = Array.isArray(res.contents) ? res.contents : [];
+        return contents.map((c) => (typeof c.text === 'string' ? c.text : JSON.stringify(c))).join('\n');
+    }
+    async close() {
+        this.closed = true;
+        this.failAll(new McpError(`mcp server "${this.name}" closed`, 'CLOSED'));
+        const child = this.child;
+        this.child = null;
+        if (child && !child.killed) {
+            try {
+                child.kill();
+            }
+            catch { /* ignore */ }
+        }
+    }
+    /* ---------------- internals ---------------- */
+    timeout() {
+        return this.spec.policy?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    }
+    assertLive() {
+        if (this.dead)
+            throw this.dead;
+        if (!this.child || this.closed)
+            throw new McpError(`mcp server "${this.name}" is not connected`, 'NOT_CONNECTED');
+    }
+    onStdout(chunk) {
+        this.stdoutBuf += chunk;
+        let idx;
+        while ((idx = this.stdoutBuf.indexOf('\n')) >= 0) {
+            const line = this.stdoutBuf.slice(0, idx).trim();
+            this.stdoutBuf = this.stdoutBuf.slice(idx + 1);
+            if (!line)
+                continue;
+            let msg;
+            try {
+                msg = JSON.parse(line);
+            }
+            catch {
+                continue; // server chatter — ignore, don't crash
+            }
+            if (typeof msg.id !== 'number')
+                continue; // notification — ignore
+            const pend = this.pending.get(msg.id);
+            if (!pend)
+                continue;
+            this.pending.delete(msg.id);
+            clearTimeout(pend.timer);
+            pend.signal?.removeEventListener('abort', pend.onAbort);
+            if (msg.error) {
+                pend.reject(new McpError(`mcp server "${this.name}" error: ${msg.error.message ?? 'unknown'}`, 'SERVER_ERROR', msg.error));
+            }
+            else {
+                pend.resolve(msg.result);
+            }
+        }
+    }
+    notify(method, params) {
+        try {
+            this.child?.stdin?.write(JSON.stringify({ jsonrpc: '2.0', method, params }) + '\n');
+        }
+        catch { /* best-effort */ }
+    }
+    request(method, params, timeoutMs, signal) {
+        return new Promise((resolve, reject) => {
+            if (signal?.aborted) {
+                reject(new McpError(`mcp call "${method}" aborted`, 'ABORTED'));
+                return;
+            }
+            if (!this.child?.stdin) {
+                reject(new McpError(`mcp server "${this.name}" has no stdin`, 'NOT_CONNECTED'));
+                return;
+            }
+            const id = this.nextId++;
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                reject(new McpError(`mcp call "${method}" timed out after ${timeoutMs}ms`, 'TIMEOUT'));
+            }, timeoutMs);
+            const pend = { resolve, reject, timer };
+            if (signal) {
+                pend.signal = signal;
+                pend.onAbort = () => {
+                    if (!this.pending.has(id))
+                        return;
+                    this.pending.delete(id);
+                    clearTimeout(timer);
+                    reject(new McpError(`mcp call "${method}" aborted`, 'ABORTED'));
+                };
+                signal.addEventListener('abort', pend.onAbort, { once: true });
+            }
+            this.pending.set(id, pend);
+            try {
+                this.child.stdin.write(JSON.stringify({ jsonrpc: '2.0', id, method, params }) + '\n', (err) => {
+                    if (err) {
+                        this.pending.delete(id);
+                        clearTimeout(timer);
+                        reject(new McpError(`mcp call "${method}" write failed: ${err.message}`, 'IO_ERROR'));
+                    }
+                });
+            }
+            catch (err) {
+                this.pending.delete(id);
+                clearTimeout(timer);
+                reject(new McpError(`mcp call "${method}" write failed: ${err instanceof Error ? err.message : String(err)}`, 'IO_ERROR'));
+            }
+        });
+    }
+    failAll(err) {
+        if (!this.dead)
+            this.dead = err;
+        for (const [id, pend] of [...this.pending]) {
+            this.pending.delete(id);
+            clearTimeout(pend.timer);
+            pend.reject(err);
+        }
+    }
+}

package/dist/mcp/config.d.ts

@@ -0,0 +1,30 @@
+import { z } from 'zod';
+export declare const McpServerPolicySchema: z.ZodObject<{
+    allowTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    denyTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    requireApproval: z.ZodOptional<z.ZodBoolean>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type McpServerPolicy = z.infer<typeof McpServerPolicySchema>;
+export declare const McpServerSpecSchema: z.ZodObject<{
+    command: z.ZodString;
+    args: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    disabled: z.ZodOptional<z.ZodBoolean>;
+    policy: z.ZodOptional<z.ZodObject<{
+        allowTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        denyTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        requireApproval: z.ZodOptional<z.ZodBoolean>;
+        timeoutMs: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type McpServerSpec = z.infer<typeof McpServerSpecSchema>;
+export interface McpServersConfig {
+    servers: Record<string, McpServerSpec>;
+    /** Where each server entry came from (for doctor/diagnostics). */
+    sources: Record<string, string>;
+}
+/** Load + merge global and project MCP server specs. Invalid entries are skipped. */
+export declare function loadMcpServers(cwd: string): McpServersConfig;
+/** Servers eligible for connection (configured and not disabled). */
+export declare function enabledServers(cfg: McpServersConfig): Record<string, McpServerSpec>;

package/dist/mcp/config.js

@@ -0,0 +1,82 @@
+/**
+ * P1 — MCP server configuration (r-11-17.md §3.1).
+ *
+ * Mirrors Claude Code's project-level `.mcp.json` (`{mcpServers: {...}}`) for
+ * drop-in compatibility, and also tolerates the legacy Klyro shape
+ * (`{servers: {...}}` shown by `/mcp`). Global defaults live in
+ * `~/.klyro/mcp.json`; project config wins per-server.
+ *
+ * `${env:VAR}` references in `env` values expand from `process.env`.
+ */
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { z } from 'zod';
+export const McpServerPolicySchema = z.object({
+    allowTools: z.array(z.string()).optional(),
+    denyTools: z.array(z.string()).optional(),
+    requireApproval: z.boolean().optional(),
+    timeoutMs: z.number().int().positive().optional(),
+});
+export const McpServerSpecSchema = z.object({
+    command: z.string().min(1),
+    args: z.array(z.string()).optional(),
+    env: z.record(z.string(), z.string()).optional(),
+    disabled: z.boolean().optional(),
+    policy: McpServerPolicySchema.optional(),
+});
+function expandEnv(value) {
+    return value.replace(/\$\{env:([A-Za-z_][A-Za-z0-9_]*)\}/g, (_m, name) => process.env[name] ?? '');
+}
+function normalizeRaw(raw) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return {};
+    const obj = raw;
+    const servers = obj['mcpServers'] ?? obj['servers'] ?? {};
+    if (!servers || typeof servers !== 'object' || Array.isArray(servers))
+        return {};
+    return servers;
+}
+function readJsonFile(p) {
+    try {
+        return JSON.parse(fs.readFileSync(p, 'utf-8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Load + merge global and project MCP server specs. Invalid entries are skipped. */
+export function loadMcpServers(cwd) {
+    const home = os.homedir() || process.cwd();
+    const globalPath = path.join(home, '.klyro', 'mcp.json');
+    const projectPath = path.join(cwd, '.mcp.json');
+    const servers = {};
+    const sources = {};
+    for (const [filePath, label] of [[globalPath, 'global'], [projectPath, 'project']]) {
+        const raw = normalizeRaw(readJsonFile(filePath));
+        for (const [name, specRaw] of Object.entries(raw)) {
+            const parsed = McpServerSpecSchema.safeParse(specRaw);
+            if (!parsed.success)
+                continue;
+            const spec = parsed.data;
+            if (spec.env) {
+                const env = {};
+                for (const [k, v] of Object.entries(spec.env))
+                    env[k] = expandEnv(v);
+                spec.env = env;
+            }
+            servers[name] = spec;
+            sources[name] = label;
+        }
+    }
+    return { servers, sources };
+}
+/** Servers eligible for connection (configured and not disabled). */
+export function enabledServers(cfg) {
+    const out = {};
+    for (const [name, spec] of Object.entries(cfg.servers)) {
+        if (!spec.disabled)
+            out[name] = spec;
+    }
+    return out;
+}

package/dist/mcp/policy.d.ts

@@ -0,0 +1,13 @@
+/**
+ * P1 — per-server MCP tool policy (r-11-17.md: "deny by default").
+ *
+ * A server without an explicit `allowTools` list cannot execute anything:
+ * the registration layer refuses the call before any subprocess I/O. An
+ * explicit `denyTools` entry always wins over `allowTools`.
+ */
+import type { McpServerPolicy } from './config.js';
+export interface McpPolicyDecision {
+    allowed: boolean;
+    reason?: string;
+}
+export declare function evaluateMcpPolicy(policy: McpServerPolicy | undefined, toolName: string): McpPolicyDecision;

package/dist/mcp/policy.js

@@ -0,0 +1,12 @@
+export function evaluateMcpPolicy(policy, toolName) {
+    if (!policy || !policy.allowTools || policy.allowTools.length === 0) {
+        return { allowed: false, reason: 'mcp tool denied: server has no allowTools allowlist' };
+    }
+    if (policy.denyTools?.includes(toolName)) {
+        return { allowed: false, reason: `mcp tool denied by server denyTools: ${toolName}` };
+    }
+    if (!policy.allowTools.includes(toolName)) {
+        return { allowed: false, reason: `mcp tool not in server allowTools: ${toolName}` };
+    }
+    return { allowed: true };
+}

package/dist/mcp/registry.d.ts

@@ -0,0 +1,50 @@
+/**
+ * P1 — MCP tool registration (r-11-17.md §3.1).
+ *
+ * Exposes MCP server tools through the {@link ToolRegistry} under
+ * `mcp__<server>__<tool>` names. Security properties (non-negotiable):
+ *
+ *   1. Deny-by-default: `evaluateMcpPolicy` runs BEFORE any client I/O; a
+ *      denied tool returns POLICY_DENIED without touching the subprocess.
+ *   2. Redact-before-transcript: every success value AND error message passes
+ *      through `redact()` before it can reach the model or trace.
+ *   3. `requireApproval` servers add an ask-rule to the PolicyEngine so the
+ *      runtime loop prompts before executing.
+ *
+ * Permission class: no code in src consumes `Tool.permission` (it is
+ * write-only metadata today), so we pick the most restrictive class,
+ * 'admin' — the same class as `spawn_agent`, since MCP tools execute
+ * arbitrary external side effects (read/write/network) outside our control.
+ */
+import { type McpClientLike } from './client.js';
+import { type McpServerSpec } from './config.js';
+import type { PolicyEngine } from '../policy/engine.js';
+import type { ToolRegistry } from '../tools/registry.js';
+export interface McpRegisterResult {
+    registered: string[];
+    errors: {
+        server: string;
+        message: string;
+    }[];
+    skipped: {
+        name: string;
+        reason: string;
+    }[];
+    closeAll: () => Promise<void>;
+}
+export interface RegisterMcpOpts {
+    registry: ToolRegistry;
+    policy?: PolicyEngine;
+    clientFactory?: (name: string, spec: McpServerSpec) => McpClientLike;
+}
+/** `mcp__<server>__<tool>`, sanitized, server part ≤20 chars, total ≤64. */
+export declare function sanitizeMcpName(server: string, tool: string): string;
+export declare function registerMcpServers(cfg: {
+    servers: Record<string, McpServerSpec>;
+}, opts: RegisterMcpOpts): Promise<McpRegisterResult>;
+export declare function loadAndRegisterMcp(opts: {
+    cwd: string;
+    registry: ToolRegistry;
+    policy?: PolicyEngine;
+    clientFactory?: (name: string, spec: McpServerSpec) => McpClientLike;
+}): Promise<McpRegisterResult>;

package/dist/mcp/registry.js

@@ -0,0 +1,172 @@
+/**
+ * P1 — MCP tool registration (r-11-17.md §3.1).
+ *
+ * Exposes MCP server tools through the {@link ToolRegistry} under
+ * `mcp__<server>__<tool>` names. Security properties (non-negotiable):
+ *
+ *   1. Deny-by-default: `evaluateMcpPolicy` runs BEFORE any client I/O; a
+ *      denied tool returns POLICY_DENIED without touching the subprocess.
+ *   2. Redact-before-transcript: every success value AND error message passes
+ *      through `redact()` before it can reach the model or trace.
+ *   3. `requireApproval` servers add an ask-rule to the PolicyEngine so the
+ *      runtime loop prompts before executing.
+ *
+ * Permission class: no code in src consumes `Tool.permission` (it is
+ * write-only metadata today), so we pick the most restrictive class,
+ * 'admin' — the same class as `spawn_agent`, since MCP tools execute
+ * arbitrary external side effects (read/write/network) outside our control.
+ */
+import { McpClient, McpError } from './client.js';
+import { loadMcpServers } from './config.js';
+import { evaluateMcpPolicy } from './policy.js';
+import { jsonSchemaToZod } from './schema.js';
+import { redact } from '../policy/secret-redactor.js';
+import { defineTool } from '../tools/types.js';
+/** Hard cap so generated names always fit model/tool-name limits. */
+const MAX_NAME_LEN = 64;
+/** Server part is capped here; the tool part takes whatever remains. */
+const MAX_SERVER_PART = 20;
+function sanitizePart(s) {
+    return s.replace(/[^A-Za-z0-9_]/g, '_');
+}
+/** `mcp__<server>__<tool>`, sanitized, server part ≤20 chars, total ≤64. */
+export function sanitizeMcpName(server, tool) {
+    const srv = sanitizePart(server).slice(0, MAX_SERVER_PART) || 'server';
+    const maxTool = Math.max(1, MAX_NAME_LEN - 'mcp__'.length - srv.length - '__'.length);
+    const tl = sanitizePart(tool).slice(0, maxTool) || 'tool';
+    return `mcp__${srv}__${tl}`;
+}
+function errMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+async function executeMcpTool(spec, toolDef, client, input, ctx) {
+    try {
+        // (1) Deny-by-default — runs BEFORE any client I/O.
+        const decision = evaluateMcpPolicy(spec.policy, toolDef.name);
+        if (!decision.allowed) {
+            return {
+                ok: false,
+                error: { code: 'POLICY_DENIED', message: decision.reason ?? `mcp tool denied: ${toolDef.name}` },
+            };
+        }
+        // (2) Delegate to the server, honouring abort.
+        let res;
+        try {
+            res = await client.callTool(toolDef.name, input, ctx.signal);
+        }
+        catch (err) {
+            // (3) Typed server failures keep their code; everything else is TOOL_ERROR.
+            // Redact BEFORE the message can reach the model/trace.
+            if (err instanceof McpError) {
+                return { ok: false, error: { code: err.code, message: redact(err.message) } };
+            }
+            return { ok: false, error: { code: 'TOOL_ERROR', message: redact(errMessage(err)) } };
+        }
+        // (4) Server-reported error → TOOL_ERROR, redacted, bounded.
+        if (res.isError) {
+            return { ok: false, error: { code: 'TOOL_ERROR', message: redact(res.text).slice(0, 2000) } };
+        }
+        // (5) Success — redact BEFORE the value reaches the model/trace.
+        return { ok: true, value: redact(res.text) };
+    }
+    catch (err) {
+        // Tool contract: never throw — always return a ToolResult.
+        return { ok: false, error: { code: 'TOOL_ERROR', message: redact(errMessage(err)) } };
+    }
+}
+export async function registerMcpServers(cfg, opts) {
+    const { registry, policy } = opts;
+    const factory = opts.clientFactory ?? ((name, spec) => new McpClient(name, spec));
+    const registered = [];
+    const errors = [];
+    const skipped = [];
+    const clients = [];
+    for (const [server, spec] of Object.entries(cfg.servers)) {
+        try {
+            // enabledServers-style: skip disabled entries silently.
+            if (spec.disabled)
+                continue;
+            // Default factory returns a bare McpClient — connect it here so fake
+            // McpClientLike factories (no connect method) also work.
+            let client;
+            try {
+                client = await factory(server, spec);
+                const withConnect = client;
+                if (typeof withConnect.connect === 'function') {
+                    await withConnect.connect();
+                }
+            }
+            catch (err) {
+                errors.push({ server, message: errMessage(err) });
+                continue; // never throw — keep registering other servers
+            }
+            let tools;
+            try {
+                tools = await client.listTools();
+            }
+            catch (err) {
+                errors.push({ server, message: errMessage(err) });
+                try {
+                    await client.close();
+                }
+                catch {
+                    /* best-effort */
+                }
+                continue;
+            }
+            clients.push(client);
+            for (const toolDef of tools) {
+                const name = sanitizeMcpName(server, toolDef.name);
+                if (registry.get(name)) {
+                    skipped.push({ name, reason: 'name-collision' });
+                    continue;
+                }
+                // Capture per-tool bindings for the closure.
+                const boundSpec = spec;
+                const boundDef = toolDef;
+                const boundClient = client;
+                const tool = defineTool({
+                    name,
+                    description: `[mcp:${server}] ${boundDef.description ?? boundDef.name}`,
+                    inputSchema: jsonSchemaToZod(boundDef.inputSchema ?? { type: 'object' }),
+                    // 'admin': most restrictive class — MCP tools run arbitrary
+                    // external side effects; nothing in src reads this field yet.
+                    permission: 'admin',
+                    execute: (input, ctx) => executeMcpTool(boundSpec, boundDef, boundClient, input, ctx),
+                });
+                registry.register(tool);
+                registered.push(name);
+                if (boundSpec.policy?.requireApproval && policy) {
+                    policy.addAsk(name);
+                }
+            }
+        }
+        catch (err) {
+            // Belt-and-braces: registerMcpServers never throws.
+            errors.push({ server, message: errMessage(err) });
+        }
+    }
+    return {
+        registered,
+        errors,
+        skipped,
+        closeAll: async () => {
+            await Promise.allSettled(clients.map((c) => c.close()));
+        },
+    };
+}
+export async function loadAndRegisterMcp(opts) {
+    try {
+        const cfg = loadMcpServers(opts.cwd);
+        return await registerMcpServers(cfg, opts);
+    }
+    catch (err) {
+        // Never throws — surface load failures as error entries.
+        return {
+            registered: [],
+            errors: [{ server: '*', message: errMessage(err) }],
+            skipped: [],
+            closeAll: async () => { },
+        };
+    }
+}

package/dist/mcp/schema.d.ts

@@ -0,0 +1,11 @@
+/**
+ * P1 — JSON Schema → Zod converter for MCP tool input schemas.
+ *
+ * MCP servers describe inputs with JSON Schema; Klyro tools validate with
+ * Zod. This converts the common subset (object/string/number/integer/
+ * boolean/array/enum + required) and falls back to a permissive
+ * `z.looseObject({}).catchall(z.unknown())`-style schema for anything else —
+ * validation must never trust, but must also never crash on exotic schemas.
+ */
+import { z } from 'zod';
+export declare function jsonSchemaToZod(schema: unknown): z.ZodTypeAny;

package/dist/mcp/schema.js

@@ -0,0 +1,46 @@
+/**
+ * P1 — JSON Schema → Zod converter for MCP tool input schemas.
+ *
+ * MCP servers describe inputs with JSON Schema; Klyro tools validate with
+ * Zod. This converts the common subset (object/string/number/integer/
+ * boolean/array/enum + required) and falls back to a permissive
+ * `z.looseObject({}).catchall(z.unknown())`-style schema for anything else —
+ * validation must never trust, but must also never crash on exotic schemas.
+ */
+import { z } from 'zod';
+export function jsonSchemaToZod(schema) {
+    if (!schema || typeof schema !== 'object' || Array.isArray(schema)) {
+        return z.looseObject({}).catchall(z.unknown());
+    }
+    const s = schema;
+    const enumerated = Array.isArray(s['enum']) ? s['enum'] : undefined;
+    if (enumerated && enumerated.length > 0 && enumerated.every((v) => typeof v === 'string')) {
+        return z.enum(enumerated);
+    }
+    switch (s['type']) {
+        case 'string':
+            return z.string();
+        case 'number':
+            return z.number();
+        case 'integer':
+            return z.number().int();
+        case 'boolean':
+            return z.boolean();
+        case 'array': {
+            const items = jsonSchemaToZod(s['items']);
+            return z.array(items);
+        }
+        case 'object': {
+            const props = s['properties'] ?? {};
+            const required = new Set(Array.isArray(s['required']) ? s['required'].filter((v) => typeof v === 'string') : []);
+            const shape = {};
+            for (const [k, v] of Object.entries(props)) {
+                const inner = jsonSchemaToZod(v);
+                shape[k] = required.has(k) ? inner : inner.optional();
+            }
+            return z.looseObject(shape);
+        }
+        default:
+            return z.unknown();
+    }
+}

package/dist/policy/engine.js

@@ -158,8 +158,9 @@ function asString(v) {
     return typeof v === 'string' ? v : '';
 }
 function matchesGlobRule(call, rule) {
-    // Rule grammar: tool or tool(glob). e.g. "write_file", "write_file(.env)", "shell_exec(npm *)"
-    const m = /^([a-z_]+)(?:\((.*)\))?$/.exec(rule.trim());
+    // Rule grammar: tool or tool(glob). e.g. "write_file", "write_file(.env)", "shell_exec(npm *)".
+    // Digits are allowed so generated names (e.g. mcp__server__tool2) can be targeted.
+    const m = /^([a-z0-9_]+)(?:\((.*)\))?$/.exec(rule.trim());
     if (!m)
         return false;
     const tool = m[1];

package/dist/tools/agent/spawn-agent.d.ts

@@ -0,0 +1,9 @@
+import type { ChildSummary } from '../../agent/orchestrator.js';
+export declare const spawnAgentTool: import("../types.js").Tool<{
+    agent: string;
+    task: string;
+    cwd?: string | undefined;
+    model?: string | undefined;
+    timeoutMs?: number | undefined;
+}, ChildSummary>;
+export type SpawnAgentOutput = ChildSummary;