openmausbot 0.1.93 → 0.1.94

package/dist-server/server/live-call.js

@@ -0,0 +1,216 @@
+// Live calls: OpenAI GPT-Live as the voice, the bot as the brain.
+//
+// The voice design doc (docs/voice-mode.md) rejected speech-to-speech models
+// because "they replace the brain". GPT-Live's *client delegation* does not:
+// the voice model only runs the conversation — listening while it speaks,
+// taking interruptions, filling the wait — and hands every real request back
+// to the application. Here that application is the harness, and the request
+// becomes an ordinary turn on the bot the person called, with its own engine,
+// tools, memory and approvals. Nothing about the bot changes.
+//
+// This file owns the one server-side step: exchanging the renderer's WebRTC
+// offer for an answer. The OpenAI key never leaves the harness; the renderer
+// only ever holds the SDP answer and the media connection it describes.
+export const LIVE_MODEL = "gpt-live-1";
+const OPENAI_BASE = "https://api.openai.com";
+export const DEFAULT_LIVE_VOICE = "marin";
+/** Largest SDP offer accepted from the renderer — a real offer is a few KB. */
+export const MAX_SDP_BYTES = 64 * 1024;
+/** The client's data channel is untrusted (it runs on a phone or in a
+ * renderer). It may only hang up; the harness sends every append over the
+ * sideband. Server events are limited to what captions and state need. */
+export const LIVE_DATA_CHANNEL = {
+    allowed_client_events: ["session.close"],
+    allowed_server_events: [
+        { type: "session.started" },
+        { type: "session.input_transcript.delta" },
+        { type: "session.output_transcript.delta" },
+        { type: "session.closed" },
+        { type: "error" },
+        { type: "info" },
+    ],
+};
+/** Tests and fixtures point this at server/testing/fake-openai-live.ts.
+ * Only a loopback http URL is accepted, read at call time. */
+export function liveBaseUrl(env = process.env) {
+    const override = env.OMB_OPENAI_LIVE_URL?.trim() ?? "";
+    return /^http:\/\/127\.0\.0\.1:\d{1,5}$/.test(override) ? override : OPENAI_BASE;
+}
+export function liveSessionsUrl(env = process.env) {
+    return `${liveBaseUrl(env)}/v1/live/sessions`;
+}
+export function liveAttachUrl(sessionId, env = process.env) {
+    return `${liveBaseUrl(env).replace(/^http/, "ws")}/v1/live/sessions/${encodeURIComponent(sessionId)}/attach`;
+}
+// Startup history is capped by the API at 128 messages / 8,192 tokens; stay
+// well inside it. It is only there so "and the other one?" makes sense to
+// the voice — the bot's own thread remains the source of truth.
+const HISTORY_MESSAGES = 8;
+const HISTORY_MESSAGE_CHARS = 600;
+const HISTORY_TOTAL_CHARS = 6_000;
+const CREATE_TIMEOUT_MS = 20_000;
+export class LiveSessionError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+    }
+}
+/** Frontend instructions for the voice. Business rules stay with the bot;
+ * this only says who is speaking and when to hand work over. Structure
+ * follows the GPT-Live prompting guide's template. */
+export function liveInstructions(bot) {
+    const name = oneLine(bot.name) || "the agent";
+    const title = oneLine(bot.title ?? "");
+    const description = oneLine(bot.description ?? "").slice(0, 400);
+    return [
+        `You are ${name}${title ? `, ${title}` : ""}, an AI agent that runs in OpenMausBot on the user's own computer.${description ? ` ${description}` : ""}`,
+        `To the user you are one assistant, ${name}, and you speak in the first person. Your work — looking things up, using your tools, files and memory, researching, deciding, and answering anything that needs facts this conversation does not hold — happens when you delegate. Delegating is how you think and act; it is not someone else.`,
+        "Never mention a backend, delegation, a voice layer, or another system or model doing the work, and never say you are only a voice. Say \"I\" about the work.",
+        "Never ask the user whether you may look something up or check something. When it needs checking, delegate at once and say briefly that you are checking.",
+        "Speak warmly and naturally, at an unhurried pace. Keep replies short: one or two sentences unless the user asks for more. Speak the language the user speaks.",
+        "",
+        "Backchannel policy: Use light backchannels. Acknowledge naturally without competing with the user.",
+        "Interruption policy: Stop speaking when the user interrupts. Listen to what they say.",
+        "Delegation policy:",
+        "Backend tools:",
+        `- ${name}: your own files, tools, memory, settings and this conversation's history. It researches, writes, changes things on the computer, and answers questions, including questions about yourself such as which AI model you run on, your settings, your tools and your memory.`,
+        "Delegate to the backend when:",
+        "- The user asks a question, asks for work, or gives an instruction.",
+        "- The user asks something about you that this conversation does not already answer, for example which AI model you run on.",
+        "- The user answers a question you asked, including yes or no to a permission request.",
+        "- A correction or a new detail changes work already requested.",
+        "Do not delegate to the backend when:",
+        "- You can answer from this conversation or from a result that is still current.",
+        "- The user only greets you, thanks you, or asks you to repeat something you already said.",
+        "- The user only asks whether you are still working or stuck.",
+        "- You cannot tell what they are asking for without a brief clarification.",
+        "Delegate before giving an answer that depends on backend work.",
+        "Do not guess the result while waiting. You may say briefly that you are on it, then wait for the update.",
+        "While you work you get quiet status notes: how long you have worked, how many steps you took, and your last step. Answer questions about progress from the latest note in one short sentence. Only say you are stuck when the note shows no new step for several minutes.",
+        "Never say that an action happened until the result reports it.",
+        "When a permission question comes up, ask it clearly and wait for a clear yes or no. Never answer it yourself.",
+    ].join("\n");
+}
+/** Recent thread text as startup history, newest last, inside the budget. */
+export function liveInitialInput(history) {
+    const picked = [];
+    let total = 0;
+    for (const message of [...history].reverse()) {
+        if (picked.length >= HISTORY_MESSAGES)
+            break;
+        const text = message.text.replace(/\s+/g, " ").trim().slice(0, HISTORY_MESSAGE_CHARS);
+        if (!text)
+            continue;
+        if (total + text.length > HISTORY_TOTAL_CHARS)
+            break;
+        total += text.length;
+        picked.unshift({ role: message.role, text });
+    }
+    return picked.map((message) => message.role === "user"
+        ? { type: "message", role: "user", content: [{ type: "input_text", text: message.text }] }
+        : { type: "message", role: "assistant", content: [{ type: "output_text", text: message.text }] });
+}
+/** The configured voice name, or the default. OpenAI validates the name and
+ * rejects an unknown one with a clear 400 (see liveErrorMessage). */
+export function liveVoice(voice) {
+    const name = voice?.trim().toLowerCase() ?? "";
+    return /^[a-z]{2,40}$/.test(name) ? name : DEFAULT_LIVE_VOICE;
+}
+/** POST /v1/live/sessions with client delegation. Returns the session id
+ * and the SDP answer. Errors carry a status and a message fit for the user —
+ * never the key, never OpenAI's raw body. */
+export async function createLiveSession(input) {
+    const key = input.key.trim();
+    if (!key)
+        throw new LiveSessionError("Add an OpenAI API key to use Live calls.", 409);
+    if (!input.sdp.trim() || Buffer.byteLength(input.sdp) > MAX_SDP_BYTES) {
+        throw new LiveSessionError("The call could not start: the connection offer was invalid.", 400);
+    }
+    const initialInput = liveInitialInput(input.history);
+    const body = {
+        session: {
+            model: LIVE_MODEL,
+            instructions: liveInstructions(input.bot),
+            // client delegation: every request comes back to the harness, which
+            // runs it as a normal turn on the bot
+            delegation: { type: "client" },
+            audio: { output: { voice: liveVoice(input.voice) } },
+            client: { data_channel: LIVE_DATA_CHANNEL },
+            ...(initialInput.length ? { input: initialInput } : {}),
+        },
+        transport: { type: "webrtc", sdp: input.sdp },
+    };
+    let response;
+    try {
+        response = await (input.fetchImpl ?? fetch)(input.url ?? liveSessionsUrl(), {
+            method: "POST",
+            headers: { authorization: `Bearer ${key}`, "content-type": "application/json" },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(input.timeoutMs ?? CREATE_TIMEOUT_MS),
+        });
+    }
+    catch (error) {
+        const timedOut = error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError");
+        throw new LiveSessionError(timedOut ? "OpenAI did not answer in time. Try the call again." : "Could not reach OpenAI. Check the internet connection.", 502);
+    }
+    if (!response.ok) {
+        const failure = await response.json().catch(() => null);
+        const param = typeof failure?.error?.param === "string" ? failure.error.param : undefined;
+        throw new LiveSessionError(liveErrorMessage(response.status, param), response.status === 429 ? 429 : 502);
+    }
+    const payload = await response.json().catch(() => null);
+    const sessionId = payload?.session?.id;
+    const sdp = payload?.transport?.sdp;
+    if (typeof sessionId !== "string" || typeof sdp !== "string" || !sdp.trim()) {
+        throw new LiveSessionError("OpenAI returned an unexpected answer. Try the call again.", 502);
+    }
+    return { sessionId, sdp };
+}
+export function liveErrorMessage(status, param) {
+    if (status === 400) {
+        return param && /voice/i.test(param)
+            ? "OpenAI rejected the voice for this call. Choose another voice."
+            : `OpenAI rejected the call settings (HTTP 400${param ? `, ${param.replace(/[^\w.]/g, "").slice(0, 60)}` : ""}).`;
+    }
+    if (status === 401)
+        return "OpenAI rejected the API key. Check the key for Live calls.";
+    if (status === 403)
+        return "This OpenAI project has no access to GPT-Live. Check the project's model access and billing.";
+    if (status === 404)
+        return "GPT-Live is not available for this OpenAI project.";
+    if (status === 429)
+        return "OpenAI is limiting Live sessions right now (rate limit or quota). Try again in a moment.";
+    if (status >= 500)
+        return "OpenAI had a problem starting the call. Try again in a moment.";
+    return `OpenAI could not start the call (HTTP ${status}).`;
+}
+function oneLine(value) {
+    return value.replace(/\s+/g, " ").trim();
+}
+/** One server.log line per finished Live call, from the call's counters
+ * (LiveCallController). Numbers and short codes only — never what anyone
+ * said. */
+export function liveCallSummaryLine(body) {
+    const count = (value) => {
+        const n = Number(value);
+        return Number.isFinite(n) && n >= 0 ? Math.min(Math.round(n), 1_000_000) : 0;
+    };
+    const code = (value) => typeof value === "string" ? value.replace(/[^\w.-]/g, "").slice(0, 40) : "";
+    const errors = Array.isArray(body.errors) ? body.errors.slice(0, 5).map(code).filter(Boolean) : [];
+    return [
+        "[live] call ended",
+        `bot=${code(body.botId) || "?"}`,
+        `voice=${code(body.voice) || DEFAULT_LIVE_VOICE}`,
+        `client=${code(body.client) || "?"}`,
+        `seconds=${count(body.seconds)}`,
+        `delegations=${count(body.delegations)}`,
+        `sentToBot=${count(body.sentToBot)}`,
+        `answers=${count(body.answers)}`,
+        `approvals=${count(body.approvals)}`,
+        `notHeard=${count(body.notHeard)}`,
+        `replies=${count(body.replies)}`,
+        `end=${code(body.end) || "unknown"}`,
+        `errors=${errors.length ? errors.join(",") : "none"}`,
+    ].join(" ");
+}

package/dist-server/server/mcp-gate-config.js

@@ -4,8 +4,10 @@
 // what a tool may put into a model's context is written once. The gate itself
 // is mcp-gate.ts; the policy it applies is mcp-trim.ts.
 import { join } from "node:path";
+import { parseToolScope } from "../shared/tool-scope.js";
 import { DATA_DIR } from "./config.js";
 import { DEFAULT_RESULT_BUDGET } from "./mcp-trim.js";
+import { remoteMcpSpec } from "./mcp-http.js";
 import { SPAWNED_PROXIES } from "./proxy-paths.js";
 /** Characters of a single tool result allowed into context, or 0 to mount
  * bot servers directly as before. `OMB_MCP_RESULT_BUDGET=0` is the escape
@@ -23,11 +25,26 @@ export function resultBudget(env = process.env) {
 export function spillDir(threadId) {
     return join(DATA_DIR, "tool-results", threadId.replace(/[^A-Za-z0-9_-]/g, "-").slice(0, 80) || "thread");
 }
+/** Use the existing remote client when an engine requires a stdio descriptor. */
+export function mcpStdioServer(server, options = {}) {
+    if (!server || typeof server !== "object" || Array.isArray(server))
+        return null;
+    const spec = server;
+    if (typeof spec.command === "string" && spec.command)
+        return spec;
+    const remote = remoteMcpSpec(server);
+    if (!remote)
+        return null;
+    return {
+        command: options.execPath ?? process.execPath,
+        args: [SPAWNED_PROXIES.mcpRemote],
+        env: { ...options.nodeEnv, OMB_REMOTE_MCP_SERVER: JSON.stringify(remote) },
+    };
+}
 /** The gated form of one bot-owned server, or null to mount it unchanged.
  *
- * Only a stdio server can be gated: the gate stands between two processes,
- * and there is no process to stand between for an http/sse entry. Those are
- * mounted as they were — a known gap, not a silent one.
+ * An explicit selection also wraps remote servers in the stdio facade.
+ * Unrestricted remote servers keep their existing native transport.
  *
  * The upstream spec travels in the gate's `env`, which means it travels inside
  * the same 0600 MCP config file the driver already writes for exactly this
@@ -35,22 +52,36 @@ export function spillDir(threadId) {
  * to every process on the machine. */
 export function gateServer(input) {
     const { name, server, budget } = input;
-    if (budget <= 0)
+    const parsed = parseToolScope(input.toolScope);
+    if (!parsed.ok)
+        throw new Error(parsed.error);
+    const scoped = parsed.scope !== undefined;
+    if (budget <= 0 && !scoped)
         return null;
-    if (!server || typeof server !== "object" || Array.isArray(server))
+    if (!scoped && remoteMcpSpec(server))
         return null;
-    const spec = server;
-    if (typeof spec.command !== "string" || !spec.command)
+    const spec = mcpStdioServer(server, input);
+    if (!spec) {
+        if (scoped)
+            throw new Error("Tool selection requires a supported MCP server.");
         return null;
+    }
+    const env = {
+        OMB_GATE_NAME: name,
+        OMB_GATE_UPSTREAM: JSON.stringify({ command: spec.command, args: spec.args ?? [], env: spec.env ?? {} }),
+        OMB_GATE_SPILL_DIR: spillDir(input.threadId),
+        OMB_GATE_BUDGET: String(budget),
+        ...(scoped ? { OMB_GATE_TOOL_SCOPE: JSON.stringify(parsed.scope) } : {}),
+    };
+    if (input.configEnvName && (!scoped || !/^OMB_GATE_CONFIG_[a-f0-9]{64}$/.test(input.configEnvName))) {
+        throw new Error("Invalid private MCP gate configuration.");
+    }
     return {
         command: input.execPath ?? process.execPath,
-        args: [SPAWNED_PROXIES.mcpGate],
+        args: [SPAWNED_PROXIES.mcpGate, ...(input.configEnvName ? ["--config-env", input.configEnvName] : [])],
         env: {
             ...input.nodeEnv,
-            OMB_GATE_NAME: name,
-            OMB_GATE_UPSTREAM: JSON.stringify({ command: spec.command, args: spec.args ?? [], env: spec.env ?? {} }),
-            OMB_GATE_SPILL_DIR: spillDir(input.threadId),
-            OMB_GATE_BUDGET: String(budget),
+            ...(input.configEnvName ? { [input.configEnvName]: JSON.stringify(env) } : env),
         },
     };
 }

package/dist-server/server/mcp-gate.js

@@ -2,8 +2,9 @@
 // conversation.
 //
 // The provider CLI mounts this instead of the bot's real MCP server. Every
-// JSON-RPC frame is relayed in both directions untouched, except the response
-// to a `tools/call`: an oversized result is cut to a budget (mcp-trim.ts), the
+// JSON-RPC frame is relayed in both directions. With a tool selection, discovery
+// is filtered and excluded calls are rejected before upstream execution.
+// An oversized `tools/call` result is cut to a budget (mcp-trim.ts), the
 // untrimmed text is written to a file, and the model is told in the result
 // where that file is so it can read or grep the rest with its ordinary tools.
 //
@@ -18,29 +19,81 @@ import { spawn } from "node:child_process";
 import { mkdirSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { createInterface } from "node:readline";
+import { allowsTool, parseToolScope } from "../shared/tool-scope.js";
 import { resolveCliSpawn } from "./env-path.js";
 import { DEFAULT_RESULT_BUDGET, trimResultText, trimStructured } from "./mcp-trim.js";
 import { killCliTree } from "./procs.js";
-const NAME = process.env.OMB_GATE_NAME || "mcp";
-const SPILL_DIR = process.env.OMB_GATE_SPILL_DIR || "";
-const BUDGET = Number(process.env.OMB_GATE_BUDGET) > 0 ? Number(process.env.OMB_GATE_BUDGET) : DEFAULT_RESULT_BUDGET;
+/** Codex imports env variables from one shared app-server environment. Each
+ * mount names its own private record; only the variable name reaches argv. */
+function gateEnvironment() {
+    if (process.argv.length === 2)
+        return process.env;
+    try {
+        const key = process.argv[3];
+        if (process.argv.length !== 4 || process.argv[2] !== "--config-env" || !key || !/^OMB_GATE_CONFIG_[a-f0-9]{64}$/.test(key))
+            throw new Error();
+        const value = JSON.parse(process.env[key] ?? "");
+        if (!value || typeof value !== "object" || Array.isArray(value)
+            || !["OMB_GATE_NAME", "OMB_GATE_UPSTREAM", "OMB_GATE_TOOL_SCOPE"].every(name => typeof value[name] === "string")
+            || !Object.entries(value).every(([name, setting]) => GATE_ENV_KEYS.includes(name) && typeof setting === "string"))
+            throw new Error();
+        return value;
+    }
+    catch {
+        process.stderr.write("mcp-gate: invalid private configuration\n");
+        process.exit(1);
+    }
+}
+/** The gate's own settings never reach the upstream server's environment. */
+const GATE_ENV_KEYS = ["OMB_GATE_NAME", "OMB_GATE_SPILL_DIR", "OMB_GATE_BUDGET", "OMB_GATE_UPSTREAM", "OMB_GATE_SPILL_HINT", "OMB_GATE_TOOL_SCOPE"];
+const gateEnv = gateEnvironment();
+const NAME = gateEnv.OMB_GATE_NAME || "mcp";
+const SPILL_DIR = gateEnv.OMB_GATE_SPILL_DIR || "";
+const rawBudget = Number(gateEnv.OMB_GATE_BUDGET);
+const BUDGET = Number.isFinite(rawBudget) && rawBudget >= 0 ? rawBudget : DEFAULT_RESULT_BUDGET;
 /** Spilled results older than this are swept at startup: they exist for the
  * turn that produced them, not forever. */
 const SPILL_MAX_AGE_MS = 24 * 60 * 60_000;
 /** Whether the model is told where the untrimmed result was saved. Off by
  * default: offering the path measured WORSE than no trimming, because the
  * model reads the file back in. See TrimInput.spillHint. */
-const SPILL_HINT = process.env.OMB_GATE_SPILL_HINT === "1";
-/** The gate's own settings never reach the upstream server's environment. */
-const GATE_ENV_KEYS = ["OMB_GATE_NAME", "OMB_GATE_SPILL_DIR", "OMB_GATE_BUDGET", "OMB_GATE_UPSTREAM", "OMB_GATE_SPILL_HINT"];
+const SPILL_HINT = gateEnv.OMB_GATE_SPILL_HINT === "1";
 function fail(message) {
     process.stderr.write(`mcp-gate(${NAME}): ${message}\n`);
     process.exit(1);
 }
+function toolScope() {
+    const raw = gateEnv.OMB_GATE_TOOL_SCOPE;
+    if (raw === undefined)
+        return;
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        fail("invalid tool selection JSON");
+    }
+    const parsed = parseToolScope(value);
+    if (!parsed.ok || parsed.scope === undefined)
+        fail("invalid tool selection; check the bot's Access settings");
+    if (!/^[a-z][a-z0-9_-]{0,31}$/.test(NAME))
+        fail("invalid MCP server identity for tool selection");
+    return parsed.scope;
+}
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function requestKey(id) {
+    return typeof id === "string" || (typeof id === "number" && Number.isFinite(id))
+        ? `${typeof id}:${id}` : undefined;
+}
+function rejectRequest(id, code, message) {
+    process.stdout.write(`${JSON.stringify({ jsonrpc: "2.0", id: requestKey(id) ? id : null, error: { code, message } })}\n`);
+}
 function upstreamSpec() {
     let parsed;
     try {
-        parsed = JSON.parse(process.env.OMB_GATE_UPSTREAM ?? "");
+        parsed = JSON.parse(gateEnv.OMB_GATE_UPSTREAM ?? "");
     }
     catch {
         fail("OMB_GATE_UPSTREAM is not valid JSON");
@@ -95,6 +148,8 @@ function spill(tool, text) {
 /** Rewrite one `tools/call` result in place. Returns true when anything was
  * actually trimmed, so the caller can report it on stderr. */
 function trimCallResult(result, tool) {
+    if (BUDGET === 0)
+        return false;
     const content = result.content;
     if (!Array.isArray(content))
         return false;
@@ -126,12 +181,15 @@ function trimCallResult(result, tool) {
     }
     return trimmed;
 }
+// Validate before starting a process: corrupt policy must never become pass-through.
+const scope = toolScope();
 const spec = upstreamSpec();
 if (SPILL_DIR)
     sweepSpill(SPILL_DIR);
 const childEnv = { ...process.env, ...spec.env };
-for (const key of GATE_ENV_KEYS)
-    delete childEnv[key];
+for (const key of Object.keys(childEnv))
+    if (key.startsWith("OMB_GATE_"))
+        delete childEnv[key];
 // The CLI used to spawn this server itself, on every platform, so the gate
 // has to spawn it exactly as well. On Windows CreateProcess cannot exec an
 // npm .cmd shim or a node-shebang script, which is what `npx -y mcp-remote`
@@ -170,20 +228,46 @@ child.on("error", (error) => {
     process.exit(1);
 });
 child.stderr.pipe(process.stderr);
-/** id -> tool name, for the calls whose answers are still in flight. */
+/** JSON-RPC string and numeric IDs are separate, even when their text is equal. */
 const pending = new Map();
 // client -> server: verbatim, but remember which ids are tool calls
 createInterface({ input: process.stdin }).on("line", (line) => {
+    let message;
     if (line.trim()) {
         try {
-            const message = JSON.parse(line);
-            if (message.method === "tools/call" && message.id !== undefined && message.id !== null) {
-                const params = message.params;
-                pending.set(String(message.id), typeof params?.name === "string" ? params.name : "tool");
-            }
+            const parsed = JSON.parse(line);
+            if (isRecord(parsed))
+                message = parsed;
         }
         catch {
-            /* not our business to validate the client's frames */
+            if (scope)
+                return rejectRequest(null, -32700, "Invalid JSON-RPC frame");
+        }
+        if (scope && (!message || message.jsonrpc !== "2.0"))
+            return rejectRequest(message?.id, -32600, "Invalid JSON-RPC frame");
+    }
+    const id = requestKey(message?.id);
+    const params = isRecord(message?.params) ? message.params : undefined;
+    if (scope && message?.method === "tools/call") {
+        if (!id || typeof params?.name !== "string"
+            || (params.arguments !== undefined && !isRecord(params.arguments))) {
+            return rejectRequest(message.id, -32602, "Invalid tool call");
+        }
+        if (!allowsTool(scope, { kind: "mcp", server: NAME, name: params.name })) {
+            return rejectRequest(message.id, -32602, "Tool selection excludes this tool. Check the bot's Access settings.");
+        }
+    }
+    if (scope && message?.method === "tools/list" && !id) {
+        return rejectRequest(message.id, -32600, "Tool listing needs a request ID");
+    }
+    if (id && typeof message?.method === "string") {
+        if (scope && pending.has(id))
+            fail("duplicate request ID on a restricted connection");
+        if (message.method === "tools/call") {
+            pending.set(id, { kind: "call", tool: typeof params?.name === "string" ? params.name : "tool" });
+        }
+        else if (scope) {
+            pending.set(id, { kind: message.method === "tools/list" ? "list" : "other" });
         }
     }
     child.stdin.write(`${line}\n`);
@@ -195,29 +279,47 @@ createInterface({ input: child.stdout }).on("line", (line) => {
         return;
     let message;
     try {
-        message = JSON.parse(line);
+        const parsed = JSON.parse(line);
+        if (isRecord(parsed))
+            message = parsed;
     }
     catch {
         // Not JSON the gate understands. Relay it exactly as it came: a frame the
         // gate cannot read is still the upstream server's answer to give.
+        if (scope)
+            fail("unreadable upstream frame on a restricted connection");
+    }
+    if (!message || (scope && message.jsonrpc !== "2.0")) {
+        if (scope)
+            fail("invalid upstream frame on a restricted connection");
         process.stdout.write(`${line}\n`);
         return;
     }
-    const id = message.id === undefined || message.id === null ? undefined : String(message.id);
-    const tool = id === undefined ? undefined : pending.get(id);
+    const id = typeof message.method === "string" ? undefined : requestKey(message.id);
+    const request = id === undefined ? undefined : pending.get(id);
+    if (scope && id !== undefined && !request)
+        fail("unrequested upstream response on a restricted connection");
     if (id !== undefined)
         pending.delete(id);
     const result = message.result;
-    if (tool && result && typeof result === "object" && !Array.isArray(result)) {
+    if (scope && request?.kind === "list" && message.error === undefined) {
+        if (!isRecord(result) || !Array.isArray(result.tools)
+            || !result.tools.every((tool) => isRecord(tool) && typeof tool.name === "string" && tool.name.trim().length > 0)
+            || (result.nextCursor !== undefined && typeof result.nextCursor !== "string")) {
+            return rejectRequest(message.id, -32603, "Invalid tool catalog on a restricted connection");
+        }
+        result.tools = result.tools.filter((tool) => allowsTool(scope, { kind: "mcp", server: NAME, name: tool.name }));
+    }
+    if (request?.kind === "call" && isRecord(result)) {
         try {
-            if (trimCallResult(result, tool)) {
-                process.stderr.write(`mcp-gate(${NAME}): trimmed ${tool} to ${BUDGET} chars\n`);
+            if (trimCallResult(result, request.tool)) {
+                process.stderr.write(`mcp-gate(${NAME}): trimmed ${request.tool} to ${BUDGET} chars\n`);
             }
         }
         catch (error) {
             // A result the trimmer chokes on is relayed whole. Costing context is
             // recoverable; dropping a tool answer is not.
-            process.stderr.write(`mcp-gate(${NAME}): could not trim ${tool}: ${String(error)}\n`);
+            process.stderr.write(`mcp-gate(${NAME}): could not trim ${request.tool}: ${String(error)}\n`);
             process.stdout.write(`${line}\n`);
             return;
         }