openmausbot 0.1.93 → 0.1.94

package/dist-server/shared/live-approval.js

@@ -0,0 +1,124 @@
+/** "approval": a provider or peer ask the voice may decide with a strict yes/no.
+ * "review": a harness-native proposal (skill, routine, profile, default
+ * model, tightening, team setup) that must be reviewed on screen.
+ * "question": a provider question. An expired proposal is settled: nothing
+ * can answer it any more. */
+export function liveCardKind(card) {
+    if (!card?.requestId || card.answered || card.dismissed || card.expired)
+        return null;
+    if (card.skillRequest || card.routineRequest || card.profileRequest || card.modelRequest || card.tighteningRequest || card.teamSetupRequest) {
+        return "review";
+    }
+    return card.tool ? "approval" : "question";
+}
+/** Why a decision made on a Live call must not reach this card, or null to
+ * deliver it. A card settled a moment earlier (answered or dismissed on
+ * screen) is refused before anything runs: delivering to it would add a
+ * false "the action was not run" line after the tap did run it. A card that
+ * is not on the thread is left to the normal answer path. */
+export function liveDecisionRefusal(card) {
+    if (!card)
+        return null;
+    const kind = liveCardKind(card);
+    if (kind === "review")
+        return "This request is reviewed on screen.";
+    return kind ? null : "The request is no longer open.";
+}
+const TOOL_PHRASES = {
+    Bash: "run a command",
+    Read: "read a file",
+    Write: "write a file",
+    Edit: "edit a file",
+    WebFetch: "fetch a web page",
+    WebSearch: "search the web",
+    schedule_routine: "schedule a routine",
+    manage_routine: "change a routine",
+    stage_skill: "enable a learned skill",
+    update_skill: "update a learned skill",
+    update_profile: "update its profile",
+    shell: "run a command",
+    edit: "edit a file",
+    read: "read a file",
+    fetch: "fetch a web page",
+    delete: "delete a file",
+    think: "think",
+    other: "take an action",
+    tool: "use a tool",
+};
+/** Same rule as toolLabel in src/components/ApprovalCard.tsx, in English. */
+export function toolPhrase(tool) {
+    if (!tool)
+        return "take an action";
+    return TOOL_PHRASES[tool] ?? tool.replace(/^mcp__[^_]+__/, "").replace(/_/g, " ");
+}
+const DETAIL_LIMIT = 400;
+function duration(ms) {
+    const seconds = Math.max(0, Math.round(ms / 1_000));
+    if (seconds < 60)
+        return `${seconds} second${seconds === 1 ? "" : "s"}`;
+    const minutes = Math.round(seconds / 60);
+    return `${minutes} minute${minutes === 1 ? "" : "s"}`;
+}
+/** A bot's step as the voice may name it: the tool's own spoken label, or
+ * the tool's name ("team notes: query database") — never its arguments,
+ * which can hold paths, queries or private text. */
+export function liveStepLabel(tool) {
+    if (tool.spoken?.trim())
+        return brief(tool.spoken, 80);
+    const parts = tool.name.split("__");
+    if (parts[0] === "mcp" && parts.length >= 3) {
+        const server = parts[1].replace(/[-_]+/g, " ").trim();
+        const action = parts.slice(2).join(" ").replace(/_+/g, " ").trim();
+        return brief(`${server}: ${action}`, 80);
+    }
+    return toolPhrase(tool.name);
+}
+function brief(text, limit = DETAIL_LIMIT) {
+    const flat = text.replace(/\s+/g, " ").trim().replace(/[.!?]+$/, "");
+    return flat.length <= limit ? flat : `${flat.slice(0, limit).replace(/\s+\S*$/, "")}…`;
+}
+// The voice IS the bot to the person on the call, so everything below is
+// either said as the bot ("I …") or addressed to the voice as "you". Never
+// name the bot in the third person: the voice then talks about itself as a
+// separate "backend" (seen in the first test calls).
+export function spokenApprovalPrompt(card) {
+    const detail = brief(card.subtitle);
+    return `I want to ${toolPhrase(card.tool)}.${detail ? ` ${detail}.` : ""} May I?`;
+}
+export function spokenReviewPrompt(card) {
+    const title = brief(card.title || "a proposal", 200);
+    return `Tell the user, in your own words, that you need their decision in the chat: ${title}. They review it on screen and choose there; it cannot be decided by voice.`;
+}
+/** The bot waits for an app to be connected in the chat (a connector card). */
+export function spokenConnectorPrompt(label) {
+    return `Tell the user, in your own words, that you need them to connect ${brief(label || "an app", 80)} in the chat before you can go on. It cannot be done by voice.`;
+}
+/** The bot waits for a credential entered on screen (a secret card). It must
+ * never travel through the call, so the voice never asks for it aloud. */
+export function spokenSecretPrompt(label) {
+    return `Tell the user, in your own words, that you need ${brief(label || "a credential", 80)} entered in the chat on screen before you can go on. Never ask them to say it aloud.`;
+}
+export function spokenQuestionPrompt(card) {
+    const detail = brief(card.subtitle || card.title);
+    const choices = card.options.length ? ` The options are ${card.options.join(", ")}.` : "";
+    // brief() drops the detail's own closing mark, so the "?" is never doubled
+    return `Ask the user, in your own words: ${detail}?${choices} Then delegate their answer.`;
+}
+export const LIVE_COPY = {
+    notHeard: "The request was not heard clearly. Ask the user to say it again.",
+    notClear: "That was not a clear yes or no. Ask the user again for a clear yes or no.",
+    deniedMessage: "Denied by the user, on a live call.",
+    answeredInChat: "The user answered that request in the chat. Do not ask about it again.",
+    working: "You are working on the request now. Nothing is done until the result comes back; do not guess it.",
+    answerPassed: "You are using the user's answer now. Wait for the result.",
+    granted: "Thanks, I'll go ahead.",
+    denied: "Okay, I won't do it.",
+    saveFailed: (detail) => `The decision could not be saved${detail ? `: ${detail}` : "."} Ask the user to try again.`,
+    noAnswer: "I'm done. The result, or what went wrong, is in the chat.",
+    typedAnswerLead: (typed) => `About what you typed in the chat ("${brief(typed, 200)}"):`,
+    progress: (spoken) => `Progress: ${brief(spoken, 200)}`,
+    status: (workedMs, steps, lastStep, lastStepAgoMs) => `Status note, do not announce it: you are still working on it (${duration(workedMs)} so far, ${steps} step${steps === 1 ? "" : "s"}${lastStep ? `; last step: ${lastStep}, ${duration(lastStepAgoMs)} ago` : ""}).`,
+    signedOut: "The call has ended because the sign-in that started it has ended. Sign in again to start a new call.",
+    unpaired: "The call has ended because the phone that started it was unpaired from this computer.",
+    permissionRequest: (prompt) => `You need the user's permission. Say it in your own words: ${prompt} Ask for a clear yes or no, then delegate their answer.`,
+};

package/dist-server/shared/live-call.js

@@ -0,0 +1,176 @@
+// Pure pieces of a Live (GPT-Live) call, kept out of the component so they
+// can be tested without WebRTC.
+//
+// With client delegation GPT-Live says *that* it wants help, never *what*:
+// `session.delegation.created` carries an id and a timeline offset, and the
+// request has to be rebuilt from the input transcript. That reconstruction,
+// and the shaping of the bot's answer into the 500-token appends GPT-Live
+// accepts, live here.
+/** Collects `session.input_transcript.delta` fragments on the session
+ * timeline. Fragments are appended in delivery order, as the API asks. */
+export class LiveTranscript {
+    input = [];
+    /** when the voice itself was speaking, on the same timeline */
+    output = [];
+    cutoffMs = -1;
+    addInput(text, startMs, endMs) {
+        if (!text)
+            return;
+        this.input.push({ text, startMs: Number.isFinite(startMs) ? startMs : 0, endMs: Number.isFinite(endMs) ? endMs : 0 });
+        // keep memory bounded on long calls: only the unconsumed tail matters
+        if (this.input.length > 2_000)
+            this.input = this.input.filter((segment) => segment.startMs > this.cutoffMs);
+    }
+    /** A stretch of the voice's own speech (a `session.output_transcript.delta`
+     * with its timing). Input heard during it may be the voice itself, picked
+     * up again by the microphone of a phone on speaker. Deltas without timing
+     * are ignored. */
+    addOutput(startMs, endMs) {
+        if (!Number.isFinite(startMs) || !Number.isFinite(endMs) || endMs < startMs)
+            return;
+        const last = this.output.at(-1);
+        if (last && startMs <= last.endMs)
+            last.endMs = Math.max(last.endMs, endMs);
+        else
+            this.output.push({ startMs, endMs });
+        if (this.output.length > 500)
+            this.output.splice(0, this.output.length - 500);
+    }
+    /** The words spoken since the previous request, up to a little past the
+     * delegation point (transcription can trail the delegation event, and the
+     * person may finish the sentence that triggered it). Consumes them, so the
+     * next request starts after this one. */
+    takeRequest(offsetMs, graceMs = 1_500) {
+        return this.takeRequestParts(offsetMs, graceMs).text;
+    }
+    /** takeRequest, plus the same words without those heard while the voice
+     * spoke (`withoutEcho`), for reading a spoken yes/no. Consumes all of them. */
+    takeRequestParts(offsetMs, graceMs = 1_500) {
+        const until = offsetMs + graceMs;
+        const taken = this.input.filter((segment) => segment.startMs > this.cutoffMs && segment.startMs <= until);
+        if (!taken.length)
+            return { text: "", withoutEcho: "" };
+        this.cutoffMs = Math.max(this.cutoffMs, ...taken.map((segment) => segment.startMs));
+        return {
+            text: joinFragments(taken.map((segment) => segment.text)),
+            withoutEcho: joinFragments(taken.filter((segment) => !this.echoed(segment)).map((segment) => segment.text)),
+        };
+    }
+    /** Everything heard since the last taken request, without consuming it —
+     * used to read a spoken yes/no while a permission question is open.
+     * `skipEcho` leaves out what was heard while the voice itself spoke. */
+    pending(options = {}) {
+        return joinFragments(this.input
+            .filter((segment) => segment.startMs > this.cutoffMs && !(options.skipEcho && this.echoed(segment)))
+            .map((segment) => segment.text));
+    }
+    echoed(segment) {
+        return this.output.some((span) => segment.startMs < span.endMs && segment.endMs > span.startMs);
+    }
+    /** Mark everything heard so far as handled (e.g. after a spoken decision). */
+    consumeAll() {
+        for (const segment of this.input)
+            this.cutoffMs = Math.max(this.cutoffMs, segment.startMs);
+    }
+}
+/** Transcript deltas are fragments of words, not words: glue them as sent. */
+export function joinFragments(fragments) {
+    return fragments.join("").replace(/\s+/g, " ").trim();
+}
+/** GPT-Live caps each append at 500 tokens. A 500 UTF-8 byte budget is
+ * conservative even for emoji/CJK, unlike a prose-only character estimate.
+ * Byte-level tokenization cannot produce more tokens than input bytes. */
+const APPEND_BYTE_LIMIT = 500;
+const encoder = new TextEncoder();
+const bytes = (text) => encoder.encode(text).length;
+/** Standard UTF-8 accounting; stop at a complete code point, not a surrogate. */
+function bytePrefix(text, budget) {
+    return new TextDecoder().decode(encoder.encode(text).subarray(0, budget), { stream: true });
+}
+const MAX_SPOKEN_CHUNKS = 3;
+export const FULL_ANSWER_IN_CHAT = "The full answer is in the chat.";
+/** Group speakable utterances (from /api/tts/prepare) into appends. Long
+ * answers are cut at a sentence boundary with a pointer to the chat, because
+ * a voice reading four minutes of a report is not a conversation. */
+export function commentaryChunks(utterances) {
+    const chunks = [];
+    let current = "";
+    let truncated = false;
+    for (const raw of utterances) {
+        const utterance = raw.replace(/\s+/g, " ").trim();
+        if (!utterance)
+            continue;
+        const pieces = bytes(utterance) > APPEND_BYTE_LIMIT ? splitLong(utterance) : [utterance];
+        for (const piece of pieces) {
+            if (current && bytes(current) + 1 + bytes(piece) > APPEND_BYTE_LIMIT) {
+                chunks.push(current);
+                current = "";
+            }
+            if (chunks.length >= MAX_SPOKEN_CHUNKS) {
+                truncated = true;
+                break;
+            }
+            current = current ? `${current} ${piece}` : piece;
+        }
+        if (truncated)
+            break;
+    }
+    if (current && chunks.length < MAX_SPOKEN_CHUNKS)
+        chunks.push(current);
+    else if (current)
+        truncated = true;
+    if (truncated && chunks.length) {
+        const last = chunks[chunks.length - 1];
+        chunks[chunks.length - 1] = bytes(last) + 1 + bytes(FULL_ANSWER_IN_CHAT) <= APPEND_BYTE_LIMIT
+            ? `${last} ${FULL_ANSWER_IN_CHAT}`
+            : `${bytePrefix(last, APPEND_BYTE_LIMIT - bytes(FULL_ANSWER_IN_CHAT) - 1).replace(/\s+\S*$/, "")} ${FULL_ANSWER_IN_CHAT}`;
+    }
+    return chunks;
+}
+function splitLong(text) {
+    const out = [];
+    let rest = text;
+    while (bytes(rest) > APPEND_BYTE_LIMIT) {
+        const window = bytePrefix(rest, APPEND_BYTE_LIMIT);
+        const sentence = Math.max(window.lastIndexOf(". "), window.lastIndexOf("! "), window.lastIndexOf("? "));
+        const space = window.lastIndexOf(" ");
+        const cut = sentence > window.length / 2 ? sentence + 1 : space > 0 ? space : window.length;
+        out.push(rest.slice(0, cut).trim());
+        rest = rest.slice(cut).trim();
+    }
+    if (rest)
+        out.push(rest);
+    return out;
+}
+/** Keep appended content inside the per-append limit. */
+export function clampAppend(content) {
+    const text = content.replace(/\s+/g, " ").trim();
+    return bytes(text) <= APPEND_BYTE_LIMIT ? text : `${bytePrefix(text, APPEND_BYTE_LIMIT - bytes("…")).replace(/\s+\S*$/, "")}…`;
+}
+/** GPT-Live voices from OpenAI's documentation (Managing GPT-Live sessions,
+ * "Voice options", and the SDK's BuiltInVoice list), with the regional
+ * notes the docs give for the additional ones. */
+export const LIVE_VOICE_OPTIONS = [
+    { id: "marin", label: "Marin (default)" },
+    { id: "cedar", label: "Cedar" },
+    { id: "alloy", label: "Alloy" },
+    { id: "ash", label: "Ash" },
+    { id: "ballad", label: "Ballad" },
+    { id: "coral", label: "Coral" },
+    { id: "echo", label: "Echo" },
+    { id: "sage", label: "Sage" },
+    { id: "shimmer", label: "Shimmer" },
+    { id: "verse", label: "Verse" },
+    { id: "gleam", label: "Gleam — North American, feminine" },
+    { id: "meridian", label: "Meridian — North American, masculine" },
+    { id: "quartz", label: "Quartz — Australian, feminine" },
+    { id: "ripple", label: "Ripple — Australian, masculine" },
+    { id: "vesper", label: "Vesper — British, masculine" },
+    { id: "willow", label: "Willow — Irish, feminine" },
+    { id: "stone", label: "Stone — Irish, masculine" },
+    { id: "delta", label: "Delta — Southern U.S., feminine" },
+    { id: "cinder", label: "Cinder — Southern U.S., masculine" },
+    { id: "beacon", label: "Beacon — Filipino, masculine" },
+    { id: "bossa", label: "Bossa — Brazilian Portuguese, feminine" },
+    { id: "tempo", label: "Tempo — Brazilian Portuguese, masculine" },
+];

package/dist-server/shared/skill-md.js

@@ -13,6 +13,15 @@ export const SKILL_FILE_MAX_BYTES = 256 * 1024;
 export function isSkillName(name) {
     return name.length >= 1 && name.length <= SKILL_NAME_MAX && SKILL_NAME.test(name);
 }
+/** Browsing tags: lowercase slug-ish words, short enough for chip rows. */
+const TAG_PATTERN = /^[a-z0-9][a-z0-9-]{0,23}$/;
+export const SKILL_TAGS_MAX = 8;
+export function parseSkillTags(raw) {
+    if (!raw)
+        return undefined;
+    const tags = [...new Set(raw.split(",").map((tag) => tag.trim().toLowerCase()).filter((tag) => TAG_PATTERN.test(tag)))].slice(0, SKILL_TAGS_MAX);
+    return tags.length > 0 ? tags : undefined;
+}
 /** Minimal frontmatter reader for the two required keys plus the two we
  * display. Deliberately not a YAML engine: values are single-line strings in
  * every skill the spec's own examples show, and a parser that cannot
@@ -41,6 +50,7 @@ export function parseSkillMd(raw) {
         description,
         license: fields.license || undefined,
         compatibility: fields.compatibility || undefined,
+        tags: parseSkillTags(fields.tags),
         body: match[2] ?? "",
     };
 }

package/dist-server/shared/team-backup.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { CONNECTOR_SLUG_PATTERN, CONNECTOR_TOOL_NAME_PATTERN } from "./wire.js";
+import { parseToolScope } from "./tool-scope.js";
 export const MAX_TEAM_BACKUP_BYTES = 50 * 1024 * 1024;
 export const TEAM_BACKUP_CONTENTS = "Bot profiles, instructions, sections, rooms, playbooks, routines, each bot's memory (MEMORY.md, topic notes and daily logs) and conversation text (all tasks and branches).";
 export const TEAM_BACKUP_EXCLUSIONS = "Files, images, custom avatars, account connections, model settings and permissions are not included. Action cards are saved as text. Memory is saved with secrets removed. Imported routines start paused.";
@@ -98,6 +99,8 @@ const backupSchema = z.object({
         hidden: z.boolean(),
         playbooks: z.array(playbook).max(200),
         connectorTools: connectorTools.optional(),
+        toolScope: z.custom((value) => value !== undefined && parseToolScope(value).ok, "Invalid tool selection")
+            .transform((value) => { const parsed = parseToolScope(value); return parsed.ok ? parsed.scope : value; }).optional(),
         memory: memory.optional(),
     })).min(1).max(200),
     groups: z.array(z.preprocess(knownRoomResponder, z.object({

package/dist-server/shared/tool-scope-support.js

@@ -0,0 +1,25 @@
+import { narrowsNativeTools, parseToolScope } from "./tool-scope.js";
+/** Native contracts and app-supplied MCP gates are separate capabilities. */
+export const TOOL_SCOPE_SUPPORT = {
+    grok: "native-and-mcp", grokAgent: "native-and-mcp", piAgent: "native-and-mcp",
+    "openai-compat": "native-and-mcp", mistral: "native-and-mcp", minimax: "native-and-mcp", cerebras: "native-and-mcp",
+    claudeAgent: "mcp", codex: "mcp", geminiAgent: "mcp", kimiAgent: "mcp", droidAgent: "mcp",
+    cursorAgent: "mcp", opencodeGo: "mcp", qwenAgent: "mcp", hermesAgent: "mcp", customAcp: "mcp", antigravityAgent: "mcp",
+    boxAgent: "none",
+};
+export function assertToolScopeSupported(engine, value) {
+    const parsed = parseToolScope(value);
+    if (!parsed.ok)
+        throw new Error(parsed.error);
+    const support = TOOL_SCOPE_SUPPORT[engine];
+    if (parsed.scope !== undefined && support !== "native-and-mcp") {
+        if (support === "none" || support === undefined) {
+            if (parsed.scope.allow !== undefined || parsed.scope.deny?.length)
+                throw new Error(`${engine}: tool selection is not supported by this engine. Choose a supported engine.`);
+        }
+        else if (narrowsNativeTools(parsed.scope)) {
+            throw new Error(`${engine}: native tool selection is not supported by this engine. Keep native:* in the selection or choose a supported engine.`);
+        }
+    }
+    return parsed.scope;
+}

package/dist-server/shared/tool-scope.js

@@ -0,0 +1,136 @@
+const SERVER_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
+// Selectors must never contain protocol control characters.
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHARACTER = /[\x00-\x1f\x7f]/;
+const MAX_SELECTORS = 256;
+const MAX_SELECTOR_LENGTH = 1024;
+function validName(name) {
+    return typeof name === "string" && name.trim().length > 0
+        && name.length <= MAX_SELECTOR_LENGTH && !CONTROL_CHARACTER.test(name)
+        && !name.includes("*");
+}
+function selectorIdentity(selector) {
+    if (selector.length > MAX_SELECTOR_LENGTH || CONTROL_CHARACTER.test(selector))
+        return;
+    if (selector.startsWith("native:")) {
+        const name = selector.slice(7);
+        if (name === "*" || validName(name))
+            return { kind: "native", name };
+    }
+    else if (selector.startsWith("mcp:")) {
+        const separator = selector.indexOf(":", 4);
+        if (separator < 0)
+            return;
+        const server = selector.slice(4, separator);
+        const name = selector.slice(separator + 1);
+        if (SERVER_NAME.test(server) && (name === "*" || validName(name))) {
+            return { kind: "mcp", server, name };
+        }
+    }
+}
+/** Undefined inherits the existing catalog. A present invalid value never does. */
+export function parseToolScope(value) {
+    if (value === undefined)
+        return { ok: true, scope: undefined };
+    const invalid = { ok: false, error: "Tool selection must contain only valid allow and deny lists." };
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return invalid;
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null)
+        return invalid;
+    const scope = {};
+    for (const key of Reflect.ownKeys(value)) {
+        if (key !== "allow" && key !== "deny")
+            return invalid;
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (!descriptor || !("value" in descriptor))
+            return invalid;
+        const list = descriptor.value;
+        if (!Array.isArray(list) || list.length > MAX_SELECTORS)
+            return invalid;
+        // Array.from exposes holes as undefined instead of silently skipping them.
+        if (!Array.from(list).every((entry) => typeof entry === "string" && selectorIdentity(entry)))
+            return invalid;
+        scope[key] = [...new Set(list)];
+    }
+    return { ok: true, scope };
+}
+function matches(selector, tool) {
+    const selected = selectorIdentity(selector);
+    return selected?.kind === tool.kind
+        && (selected.kind !== "mcp" || (tool.kind === "mcp" && selected.server === tool.server))
+        && (selected.name === "*" || selected.name === tool.name);
+}
+function permits(scope, tool) {
+    if (!validName(tool.name) || (tool.kind === "mcp" && !SERVER_NAME.test(tool.server)))
+        return false;
+    return (scope?.allow === undefined || scope.allow.some((selector) => matches(selector, tool)))
+        && !scope?.deny?.some((selector) => matches(selector, tool));
+}
+export function allowsTool(scope, tool) {
+    const parsed = parseToolScope(scope);
+    return parsed.ok && permits(parsed.scope, tool);
+}
+/** Whether an engine needs a native catalog contract, in addition to MCP gates. */
+export function narrowsNativeTools(value) {
+    const parsed = parseToolScope(value);
+    if (!parsed.ok)
+        return true;
+    const scope = parsed.scope;
+    return scope !== undefined && ((scope.allow !== undefined && !scope.allow.includes("native:*"))
+        || Boolean(scope.deny?.some((selector) => selector.startsWith("native:"))));
+}
+/** Without a catalog, asks whether this server could have a permitted tool. */
+export function canUseMcpServer(scope, server, names) {
+    const parsed = parseToolScope(scope);
+    if (!parsed.ok || !SERVER_NAME.test(server))
+        return false;
+    if (names !== undefined) {
+        return names.some((name) => permits(parsed.scope, { kind: "mcp", server, name }));
+    }
+    if (parsed.scope?.deny?.includes(`mcp:${server}:*`))
+        return false;
+    if (parsed.scope?.allow === undefined)
+        return true;
+    return parsed.scope.allow.some((selector) => {
+        const selected = selectorIdentity(selector);
+        return selected?.kind === "mcp" && selected.server === server
+            && (selected.name === "*" || permits(parsed.scope, selected));
+    });
+}
+/** Compare the selector partitions, including a tool/server outside all exact names. */
+export function toolScopeWidens(previous, next) {
+    const before = parseToolScope(previous);
+    const after = parseToolScope(next);
+    if (!after.ok)
+        return false;
+    const namespaces = new Map([["native", new Set()]]);
+    const scopes = [before.ok ? before.scope : undefined, after.scope];
+    for (const scope of scopes) {
+        for (const selector of [...(scope?.allow ?? []), ...(scope?.deny ?? [])]) {
+            const tool = selectorIdentity(selector);
+            const namespace = tool.kind === "native" ? "native" : `mcp:${tool.server}`;
+            if (!namespaces.has(namespace))
+                namespaces.set(namespace, new Set());
+            if (tool.name !== "*")
+                namespaces.get(namespace).add(tool.name);
+        }
+    }
+    let server = "unlisted";
+    for (let i = 0; namespaces.has(`mcp:${server}`); i++)
+        server = `unlisted${i}`;
+    namespaces.set(`mcp:${server}`, new Set());
+    for (const [namespace, names] of namespaces) {
+        let other = "__unlisted_tool__";
+        for (let i = 0; names.has(other); i++)
+            other = `__unlisted_tool_${i}__`;
+        names.add(other);
+        for (const name of names) {
+            const tool = namespace === "native" ? { kind: "native", name }
+                : { kind: "mcp", server: namespace.slice(4), name };
+            if (permits(after.scope, tool) && (!before.ok || !permits(before.scope, tool)))
+                return true;
+        }
+    }
+    return false;
+}