spl-lang 0.1.1 → 0.3.0

package/README.md

@@ -1,147 +1,91 @@
-# spl-lang: Semantic Prompt Language interpreter
+# spl-lang 0.3
 
-A Python-like language where LLM calls are part of the syntax. Everything outside LLM calls is deterministic; LLM
-calls go through the GitHub Copilot SDK. See [../LANG-PRD.md](../LANG-PRD.md) for the full spec,
-[docs/syntax.ebnf](docs/syntax.ebnf) for the grammar and the [documentation site](../docs/index.html) (open it in a
-browser, or publish `docs/` with GitHub Pages) for guides and reference.
+The Semantic Prompt Language interpreter. Requires Node.js 20+.
 
-## Run
+See the [project guide](../README.md), [language specification](../LANG-PRD.md),
+[EBNF](docs/syntax.ebnf), and [documentation site](../docs/index.html).
 
-```
-npm install && npm run build
-node dist/cli.js login                                   # once: authenticate with GitHub Copilot
-node dist/cli.js examples/live.spl
-npx file:./lang examples/live.spl                        # npx from a checkout (or `npx spl-lang` once published)
-```
-
-Requires Node 20+ and an authenticated GitHub Copilot.
+## Run from a checkout
 
+```sh
+npm install
+node dist/cli.js login
+node dist/cli.js examples/hi.spl
 ```
-spl <script.spl> [--log-level error|info|debug] [--silent] [--model <id>]
-                 [--store <file.json> | --store-module <module>]
-                 [--timeout <s>] [--cwd <dir>] [--check]
-spl login          # GitHub device flow: prints a code, you confirm it in the browser
-spl logout         # removes the credentials saved by `spl login`
-```
-
-* stdout: the value of `success` or a top-level `return` (strings raw, everything else as JSON) or the failure payload.
-* stderr: logs, including model and reasoning effort of every LLM call.
-* Exit code: `0` success, `1` uncaught failure, `2` syntax/usage error.
-
-`spl login` does nothing if the runtime is already authenticated (an earlier login, a Copilot CLI / `gh` login or
-`COPILOT_GITHUB_TOKEN`/`GH_TOKEN`/`GITHUB_TOKEN`). Otherwise it runs the device flow and saves the token to
-`~/.spl/credentials.json` (override the folder with `SPL_HOME`); scripts use that token automatically. A script that
-needs an LLM and finds no credentials fails with `llm_error` and tells you to run `spl login`.
-
-## Language at a glance
 
+`npm install` runs the TypeScript build. Installed packages expose `spl` and `spl-lang`.
+Authentication is needed only for live generation and explicit agents; raw tools and replay
+work without Copilot. Existing Copilot/CLI credentials and supported GitHub token environment
+variables are reused. `spl login` otherwise runs device authentication and saves credentials
+under `~/.spl` (override with `SPL_HOME`); `spl logout` removes those saved credentials.
+
+## Language contract
+
+- **Exact tools:** `read_file(path)`, `write_file(path, content)`, `web_fetch(url)`,
+  `web_search(query)`, `shell(command)` never call a model.
+- **Generation:** `?` and `think` have no tools or MCP access.
+- **Agency:** `agent` explicitly enables model-directed runtime and configured MCP tools.
+- **Validation:** expression-valued `schema` uses strict synchronous JSON Schema draft-07;
+  `fmt='json'` accepts any JSON value, `fmt='object'` requires an object/array.
+  Prose and code fences are not silently extracted.
+- **Repairs:** `repairs=0..5` retries only malformed/invalid generation, not transport errors
+  or external actions. Agents require `repairs=0`. Use `assert` for business rules.
+- **Guidance:** `instruct`, `avoid`, and `len` influence prompts, not runtime guarantees.
+- **Capabilities:** nested `restrict fs/net/exec/mcp` clauses intersect. Shell command
+  inspection is best effort; MCP servers are trusted services, not OS-sandboxed.
+- **Bindings:** `let` declares/redeclares function/script locals; `x = ...` and `x += ...`
+  update existing locals. Every block shares that scope. Enclosing names are readable but
+  cannot be rebound by a function; shared collections remain mutable.
+
+Common generation modifiers are `len`, `fmt`, `reasoning`, `show`, `schema`, `repairs`,
+and `model`. Values are evaluated once, then validated before calling the model.
+`think` and `agent` default to medium reasoning; `?` uses the model default.
+CLI `--model` overrides per-call `model`, which overrides the header directive.
+
+## Record/replay
+
+```sh
+node dist/cli.js examples/triage-issues.spl --record triage.jsonl
+node dist/cli.js examples/triage-issues.spl --replay triage.jsonl --silent
 ```
-@{model='gpt-5.5'}
 
-def fib(n) {
-    if n < 2 { return n }
-    return fib(n - 1) + fib(n - 2)
-}
+Record creates a new file and rejects agents. Replay performs exact, ordered request matching
+without starting Copilot/MCP. Local reads are permitted; writes, shell, network, agents,
+and persistent stores are blocked. Recordings include prompts and raw responses and must
+be protected like logs. Mismatched, missing, or unused entries fail explicitly.
 
-let joke = ?{len='sentence', fmt='object'} 'A joke about programmers'   # JSON validated and parsed
-let why  = think{level='high', show=True} 'Why is {joke.setup} funny?'
+## CLI
 
-let color = None
-enforce 'Answer in English' {
-    forbid 'profanity' { let color = ?{len='word'} 'Your favorite color?' }   # results leave the block
-}
+```text
+spl script.spl [--model id] [--mcp file.json] [--cwd dir] [--timeout seconds]
+               [--store file.json | --store-module module]
+               [--record file.jsonl | --replay file.jsonl]
+               [--log-level error|info|debug] [--silent] [--check]
+```
 
-{                                                      # a bare block is a nested scope
-    let color = 'Red'                                  # shadows the outer variable
-    log(color)
-}
+Results are printed on stdout, logs on stderr. Full prompts/responses and statement traces
+appear at every non-silent log level. Exit codes are `0` success, `1` script failure,
+`2` syntax/usage error, and `70` internal error. `--check` does not execute modifier expressions
+or compile schemas. See [CLI and MCP configuration](../docs/cli.html).
 
-restrict './out' {                                    # also: restrict net 'host,..' / restrict exec 'git,npm'
-    let f = write_file{path='./out/a.txt', content='{fib(10)}'} 'Confirm'
-}
+## Tests and embedding
 
-try { assert fib(5) == 4 'wrong' } except err { log(err.reason) }
-success {'joke': joke, 'why': why, 'color': color}
+```sh
+npm test
 ```
 
-Decisions worth knowing (the PRD leaves them open):
-
-* **Blocks use braces**, statements end at a newline.
-* **Every modification of a variable starts with `let`**: `let x = 1`, `let x += 1`, `let d['k'] = 2`, `let d.k = 3`.
-  A bare `x = 1` is a syntax error.
-* **Scoping.** `let NAME = ...` binds in the current scope. Bare `{ ... }` blocks and function bodies open a new scope,
-  so `let` there shadows an outer variable and the outer one is untouched. `if`/`elif`/`else`, `for`, `while`,
-  `try`/`except`, `enforce`, `forbid` and `restrict` bodies share the enclosing scope, so `let` inside them updates the
-  enclosing variable: this is how the answer of an LLM call leaves an `enforce`/`forbid`/`restrict` block. A function
-  cannot rebind its caller's variables (use a list or dict to share state); names are read through all enclosing scopes.
-* **`return` exits immediately** from any scope: the innermost function, or the whole script when used at the top level
-  (like `success`). `break`/`continue` still belong to loops.
-* **`?` is a prefix operator**: `?'a' + b` is `(?'a') + b`, `-?'n'` is `-(?'n')`.
-* **LLM commands have defaults and braces are optional**: `?'q'`, `think 'q'` (level `medium`), and tools without
-  parameters, e.g. `read_file 'Read notes.txt and summarize it'`.
-* **Every string interpolates `{expr}`**. Write `{{`/`}}` or `\{`/`\}` for literal braces, or use a raw string
-  `r'{"a": 1}'`. Values are substituted as is: strings raw, `True`/`False`/`None`, lists and dicts as JSON.
-* Tool calls (`read_file`, `write_file`, `web_fetch`, `web_search`, `shell`): when the script supplies every parameter
-  the tool needs, the runtime runs it first (restriction-checked), and the output plus your instructions go to the LLM
-  whose answer is the value. When a parameter is missing (`read_file 'summarize notes.txt'`,
-  `write_file{path='a.txt'} 'write a haiku'`, `web_search 'latest Node.js LTS'`) the LLM calls the tool itself with the
-  parameters you gave kept fixed. `web_search` queries DuckDuckGo and counts as network access for `restrict net`.
-* Builtins: `len str int float bool type list range abs round min max sum sorted reversed enumerate zip any all keys
-  values items json_parse json_stringify log`, plus Python-style string/list/dict methods. `log(...)` writes to stderr.
-* Unknown modifiers/values, `break` outside loops, `try` without `except`, a modification without `let`, etc. are
-  syntax errors (exit code 2).
-
-## Restrictions
-
-Two layers: the LLM is told about active restrictions in the prompt, and the runtime enforces them. The LLM only gets
-the five runtime tools (`read_file`, `write_file`, `web_fetch`, `web_search`, `shell`); every call is checked against
-the active `restrict` scopes and any other Copilot permission request is rejected. A violation raises a
-`restriction_violation` failure (catchable with `try/except`).
-
-* Paths are canonicalized (symlinks resolved, `..` removed) relative to `--cwd` before the check.
-* `net` matches exact hosts (and `*.example.com` wildcards); redirects are re-checked on every hop. `web_search`
-  needs `html.duckduckgo.com` to be allowed.
-* `exec` matches the executable name. While any restriction is active, `shell` accepts only simple commands (no
-  `&|;<>` redirects, substitution or chaining) so the check is exact; path-like and URL arguments are also checked
-  against `fs`/`net`. This is best effort for programs that touch files or the network on their own.
-* Nested restrictions of one kind intersect and can never widen.
-
-## Reproducibility
-
-Control flow, arithmetic and interpolation are deterministic. The Copilot SDK has no `temperature` or `seed` setting,
-so the language has none either. `think` levels map to the SDK reasoning effort; if the selected model does not support
-it a warning is logged and the model default is used. Guard against variance with `assert` and `fmt='object'`.
-
-## Variable store
-
-`--store vars.json` loads top-level variables from the file at start and writes them back at exit (also on failure).
-`--store-module ./mystore.mjs` plugs in your own store: export `createStore()` returning `{ load(): Record, save(vars) }`.
-
-## Examples
-
-All in [examples/](examples); run from the project root, `--cwd <dir>` points a script at another project. The example
-syntax is checked by `tests/examples.test.ts`; `triage-issues` is also run on Copilot there.
-
-| Script | Shows |
-|--------|-------|
-| `commit-message.spl` | `shell` under `restrict exec 'git'`, validation helper, retry loop |
-| `triage-issues.spl` | `fmt='object'` + `assert` validation with feedback retries, aggregation, summary |
-| `extract-invoice.spl` | structured extraction cross-checked with arithmetic before it is accepted |
-| `code-review.spl` | `think` then structure, `restrict` on read and on write, `fail` as a CI gate |
-| `release-notes.spl` | nested `forbid`/`enforce`, git history to a file inside `./out` |
-| `web-digest.spl` | `restrict net`, `web_fetch`, catching a blocked second host |
-| `fix-failing-tests.spl` | agent loop: run `npm test`, let the LLM fix the source, repeat |
-| `translate-docs.spl` | `write_file` without `content` (LLM writes, path pinned), dict iteration |
-| `journal.spl` | state across runs with `--store` |
-| `basics.spl`, `live.spl`, `restrict-live.spl`, `tools-live.spl` | small feature tours |
-
-## Develop
+The default suite is offline. In PowerShell, opt into authenticated live checks with
+`$env:SPL_LIVE_TESTS='1'; npm test`, then remove the environment variable.
 
-```
-npm test          # builds, then runs parser, interpreter, restriction and CLI tests, plus live tests on Copilot
-```
+The package exports `parse`, `run`, `Logger`, `CopilotBackend`, `RecordingBackend`,
+`ReplayBackend`, variable stores, authentication helpers, and related types.
+Call `close()` on the backend after running; replay also checks for unused entries there.
+Custom backends must honor the request kind: only `agent` may execute tools.
+See [embedding](../docs/internals.html#embedding).
 
-The live tests (`tests/live.test.ts`, one example in `tests/examples.test.ts`) call the real GitHub Copilot service and
-are skipped automatically when the runtime is not authenticated: run `spl login` first to include them.
+## Migration
 
-The VS Code extension (syntax highlighting, snippets) lives in `../vscode`.
+0.3 intentionally removes `enforce`/`forbid`, `think{level=...}`, tool-command syntax,
+and `let` before compound/member/index assignments. Use `instruct`/`avoid`,
+`reasoning`, ordinary raw functions, and explicit agents instead.
+Bare blocks no longer create scopes. See the [migration table](../README.md#breaking-changes-in-03).

package/dist/ast.d.ts

@@ -61,29 +61,16 @@ export type Expr = {
     lo?: Expr;
     hi?: Expr;
 } | {
-    t: 'ask';
-    mods: AskMods;
+    t: 'ask' | 'think' | 'agent';
+    mods: Record<string, Expr>;
     prompt: Expr;
-} | {
-    t: 'think';
-    mods: ThinkMods;
-    prompt: Expr;
-} | {
-    t: 'tool';
-    tool: ToolName;
-    params: Record<string, Expr>;
-    instructions: Expr;
 };
 export interface AskMods {
     len?: 'word' | 'sentence' | 'paragraph' | 'long';
     fmt?: 'text' | 'object';
 }
-export interface ThinkMods {
-    level?: 'low' | 'medium' | 'high';
-    show?: boolean;
-}
 export type ToolName = 'read_file' | 'write_file' | 'web_fetch' | 'web_search' | 'shell';
-export type RestrictKind = 'fs' | 'net' | 'exec';
+export type RestrictKind = 'fs' | 'net' | 'exec' | 'mcp';
 export type AssignTarget = {
     t: 'name';
     name: string;
@@ -101,6 +88,10 @@ interface Base {
 }
 export type Stmt = Base & ({
     t: 'let';
+    name: string;
+    value: Expr;
+} | {
+    t: 'assign';
     target: AssignTarget;
     op: '=' | '+=' | '-=' | '*=' | '/=' | '//=' | '%=';
     value: Expr;
@@ -157,13 +148,15 @@ export type Stmt = Base & ({
     value?: Expr;
 } | {
     t: 'constraint';
-    kind: 'enforce' | 'forbid';
+    kind: 'instruct' | 'avoid';
     text: Expr;
     body: Stmt[];
 } | {
     t: 'restrict';
-    kind: RestrictKind;
-    arg: Expr;
+    clauses: {
+        kind: RestrictKind;
+        arg: Expr;
+    }[];
     body: Stmt[];
 });
 export interface Directives {

package/dist/cli.js

@@ -4,12 +4,15 @@ import * as path from 'node:path';
 import { parseArgs } from 'node:util';
 import { CopilotBackend } from './copilot.js';
 import { AuthError, login, logout } from './auth.js';
-import { SplSyntaxError } from './errors.js';
+import { Failure, SplSyntaxError } from './errors.js';
+import { LlmError } from './llm.js';
 import { Logger } from './logger.js';
 import { parse } from './parser.js';
 import { run } from './interpreter.js';
 import { JsonFileStore, MemoryStore, loadStoreModule } from './store.js';
 import { toJson } from './values.js';
+import { loadMcpConfig } from './mcp.js';
+import { RecordingBackend, ReplayBackend } from './recording.js';
 const HELP = `spl - Semantic Prompt Language interpreter
 
 Usage: spl <script.spl> [options]
@@ -18,13 +21,17 @@ Usage: spl <script.spl> [options]
 
 Options:
   --log-level <level>     error | info | debug (default: info). Logs go to stderr.
+                          All levels include LLM transcripts and [deterministic] statement traces.
   --silent                suppress all logs; only the result is printed
   --model <id>            model override (takes precedence over @{model=...})
+  --mcp <file.json>       MCP servers in VS Code mcp.json format
   --store <file.json>     persist top-level variables in a JSON file
   --store-module <path>   custom variable store: module exporting createStore() -> { load(), save(vars) }
   --timeout <seconds>     per LLM call timeout (default: 300)
+  --record <file.jsonl>   record generation responses (new file; no agents)
+  --replay <file.jsonl>   offline generation replay; only local reads allowed
   --cwd <dir>             base directory for relative paths and restrictions (default: current directory)
-  --check                 parse the script and exit
+  --check                 validate script syntax and any --mcp config without executing
   -v, --version           print version
   -h, --help              print this help
 
@@ -72,9 +79,12 @@ async function main() {
                 'log-level': { type: 'string' },
                 silent: { type: 'boolean' },
                 model: { type: 'string' },
+                mcp: { type: 'string' },
                 store: { type: 'string' },
                 'store-module': { type: 'string' },
                 timeout: { type: 'string' },
+                record: { type: 'string' },
+                replay: { type: 'string' },
                 cwd: { type: 'string' },
                 check: { type: 'boolean' },
                 version: { type: 'boolean', short: 'v' },
@@ -110,6 +120,10 @@ async function main() {
         usageError('--timeout must be a positive number');
     if (values.store && values['store-module'])
         usageError('--store and --store-module are mutually exclusive');
+    if (values.record && values.replay)
+        usageError('--record and --replay are mutually exclusive');
+    if (values.replay && (values.store || values['store-module']))
+        usageError('--replay cannot use a persistent variable store');
     const cwd = path.resolve(values.cwd ?? process.cwd());
     const file = positionals[0];
     let source;
@@ -130,6 +144,13 @@ async function main() {
         }
         throw e;
     }
+    let mcpServers;
+    try {
+        mcpServers = values.mcp ? loadMcpConfig(values.mcp, cwd) : undefined;
+    }
+    catch (e) {
+        return usageError(e.message);
+    }
     if (values.check)
         return 0;
     let store;
@@ -139,22 +160,46 @@ async function main() {
     catch (e) {
         return usageError(e.message);
     }
-    const backend = new CopilotBackend({ logger, cwd, timeoutMs: timeoutSec * 1000 });
+    let backend;
     try {
-        const result = await run(program, { backend, logger, store, cwd, model: values.model });
-        if (result.status === 'failure') {
-            process.stdout.write(JSON.stringify(result.failure, null, 4) + '\n');
-            return 1;
+        if (values.replay)
+            backend = new ReplayBackend(values.replay);
+        else {
+            backend = new CopilotBackend({ logger, cwd, timeoutMs: timeoutSec * 1000, mcpServers });
+            if (values.record)
+                backend = new RecordingBackend(backend, values.record);
         }
-        if (result.hasValue) {
-            const v = result.value;
-            process.stdout.write((typeof v === 'string' ? v : JSON.stringify(toJson(v), null, 2)) + '\n');
-        }
-        return 0;
+    }
+    catch (e) {
+        if (!(e instanceof Error))
+            throw e;
+        return usageError(`cannot open recording: ${e.message}`);
+    }
+    let result;
+    try {
+        result = await run(program, { backend, logger, store: values.replay ? undefined : store, cwd, model: values.model });
     }
     finally {
-        await backend.close();
+        try {
+            await backend.close();
+        }
+        catch (e) {
+            if (!(e instanceof LlmError))
+                throw e;
+            logger.error(e.message);
+            if (result?.status !== 'failure')
+                result = { status: 'failure', failure: new Failure('llm_error', e.message).payload() };
+        }
+    }
+    if (result.status === 'failure') {
+        process.stdout.write(JSON.stringify(result.failure, null, 4) + '\n');
+        return 1;
+    }
+    if (result.hasValue) {
+        const v = result.value;
+        process.stdout.write((typeof v === 'string' ? v : JSON.stringify(toJson(v), null, 2)) + '\n');
     }
+    return 0;
 }
 main().then((code) => process.exit(code), (e) => {
     process.stderr.write(`spl: internal error: ${e.stack ?? e}\n`);

package/dist/copilot.d.ts

@@ -3,10 +3,12 @@ import { Failure } from './errors.js';
 import { type LlmBackend, type LlmRequest, type LlmResponse } from './llm.js';
 import type { Logger } from './logger.js';
 import type { Restrictions } from './restrict.js';
+import { type McpServers } from './mcp.js';
 export interface CopilotBackendOptions {
     logger: Logger;
     cwd: string;
     timeoutMs: number;
+    mcpServers?: McpServers;
 }
 export declare class CopilotBackend implements LlmBackend {
     private readonly opts;
@@ -14,6 +16,7 @@ export declare class CopilotBackend implements LlmBackend {
     private models?;
     constructor(opts: CopilotBackendOptions);
     private getClient;
+    private denyGenerationPermission;
     private listModels;
     /** Maps the `think` level to the SDK reasoning effort, warning when the model cannot honor it. */
     private resolveEffort;
@@ -23,7 +26,7 @@ export declare class CopilotBackend implements LlmBackend {
     close(): Promise<void>;
 }
 /**
- * Hard enforcement at the permission layer. Only the five runtime tools are exposed to the model, so any
- * other request is denied; requests that would violate a restriction are additionally reported as violations.
+ * Only runtime tools and explicitly configured MCP tools are approved.
+ * Requests that violate a restriction are additionally reported as violations.
  */
-export declare function decidePermission(r: PermissionRequest, restrictions: Restrictions, block: (f: Failure) => void): PermissionRequestResult;
+export declare function decidePermission(r: PermissionRequest, restrictions: Restrictions, block: (f: Failure) => void, mcpServers?: McpServers): PermissionRequestResult;

package/dist/copilot.js

@@ -3,10 +3,11 @@ import { loadToken } from './auth.js';
 import { Failure } from './errors.js';
 import { LlmError } from './llm.js';
 import { TOOL_SPECS } from './tools.js';
+import { configuredMcpTool, filterMcpServers } from './mcp.js';
 const SYSTEM_MESSAGE = [
     'You are the execution engine of an automated script. Your reply is stored in a variable and used by the program.',
     'Reply with exactly what was asked for: no preamble, no sign-off, no commentary.',
-    'Use the provided tools (read_file, write_file, web_fetch, web_search, shell) only when the task needs them. No other tools exist.',
+    'Use the provided runtime tools and configured MCP tools only when the task needs them.',
 ].join(' ');
 const TOOL_NAMES = Object.keys(TOOL_SPECS);
 export class CopilotBackend {
@@ -35,6 +36,11 @@ export class CopilotBackend {
         }
         return this.client;
     }
+    denyGenerationPermission(block) {
+        const failure = new Failure('restriction_violation', 'generation cannot use tools; use an explicit agent operation');
+        block(failure);
+        return { kind: 'reject', feedback: failure.reason };
+    }
     listModels(client) {
         this.models ??= client.listModels().catch((e) => {
             this.opts.logger.debug(`could not list models: ${e.message}`);
@@ -75,7 +81,8 @@ export class CopilotBackend {
             violation ??= failure;
             void session?.abort().catch(() => undefined);
         };
-        const tools = TOOL_NAMES.map((name) => {
+        const agent = req.kind === 'agent';
+        const tools = (agent ? TOOL_NAMES : []).map((name) => {
             const spec = TOOL_SPECS[name];
             return defineTool(name, {
                 description: spec.description,
@@ -83,8 +90,6 @@ export class CopilotBackend {
                 parameters: { type: 'object', properties: spec.properties, required: spec.required, additionalProperties: false },
                 handler: async (args) => {
                     const params = { ...args };
-                    if (req.pinned?.tool === name)
-                        Object.assign(params, req.pinned.params);
                     try {
                         return await req.tools.invoke(name, params);
                     }
@@ -100,13 +105,15 @@ export class CopilotBackend {
                 },
             });
         });
+        const mcpServers = agent ? filterMcpServers(this.opts.mcpServers ?? {}, req.restrictions) : {};
         const baseConfig = {
             model: req.model,
             tools,
-            availableTools: TOOL_NAMES,
+            availableTools: [...(agent ? TOOL_NAMES : []), ...Object.keys(mcpServers).map((name) => `mcp:${name}-*`)],
+            mcpServers,
             systemMessage: { mode: 'append', content: SYSTEM_MESSAGE },
             workingDirectory: this.opts.cwd,
-            onPermissionRequest: (r) => decidePermission(r, req.restrictions, block),
+            onPermissionRequest: (r) => agent ? decidePermission(r, req.restrictions, block, mcpServers) : this.denyGenerationPermission(block),
         };
         try {
             try {
@@ -160,11 +167,17 @@ export class CopilotBackend {
     }
 }
 /**
- * Hard enforcement at the permission layer. Only the five runtime tools are exposed to the model, so any
- * other request is denied; requests that would violate a restriction are additionally reported as violations.
+ * Only runtime tools and explicitly configured MCP tools are approved.
+ * Requests that violate a restriction are additionally reported as violations.
  */
-export function decidePermission(r, restrictions, block) {
+export function decidePermission(r, restrictions, block, mcpServers = {}) {
     try {
+        if (r.kind === 'mcp') {
+            restrictions.checkMcp(r.serverName, r.toolName);
+            if (configuredMcpTool(mcpServers, r.serverName, r.toolName))
+                return { kind: 'approve-once' };
+            return { kind: 'reject', feedback: 'MCP server/tool is not enabled by --mcp configuration.' };
+        }
         if (r.kind === 'custom-tool' && TOOL_NAMES.includes(r.toolName)) {
             return { kind: 'approve-once' }; // the tool itself performs the restriction checks
         }
@@ -188,5 +201,5 @@ export function decidePermission(r, restrictions, block) {
             return { kind: 'reject', feedback: JSON.stringify(e.payload()) };
         }
     }
-    return { kind: 'reject', feedback: 'Only the read_file, write_file, web_fetch, web_search and shell tools may be used.' };
+    return { kind: 'reject', feedback: 'Only runtime tools and configured MCP tools may be used.' };
 }

package/dist/errors.d.ts

@@ -1,4 +1,4 @@
-export type StatusCode = 'assertion_failed' | 'explicit_failure' | 'invalid_format' | 'restriction_violation' | 'llm_error' | 'tool_error' | 'runtime_error';
+export type StatusCode = 'assertion_failed' | 'explicit_failure' | 'invalid_format' | 'validation_failed' | 'restriction_violation' | 'llm_error' | 'tool_error' | 'runtime_error';
 export interface FailurePayload {
     status: 'failure';
     reason: string;

package/dist/index.d.ts

@@ -3,6 +3,8 @@ export { run, type RunOptions, type RunResult } from './interpreter.js';
 export { Failure, SplSyntaxError, type FailurePayload, type StatusCode } from './errors.js';
 export { Logger, type LogLevel } from './logger.js';
 export { CopilotBackend } from './copilot.js';
+export { RecordingBackend, ReplayBackend } from './recording.js';
+export { loadMcpConfig, type McpServers } from './mcp.js';
 export { login, logout, authStatus, AuthError } from './auth.js';
 export { JsonFileStore, MemoryStore, loadStoreModule, type VariableStore } from './store.js';
 export type { LlmBackend, LlmRequest, LlmResponse } from './llm.js';

package/dist/index.js

@@ -3,5 +3,7 @@ export { run } from './interpreter.js';
 export { Failure, SplSyntaxError } from './errors.js';
 export { Logger } from './logger.js';
 export { CopilotBackend } from './copilot.js';
+export { RecordingBackend, ReplayBackend } from './recording.js';
+export { loadMcpConfig } from './mcp.js';
 export { login, logout, authStatus, AuthError } from './auth.js';
 export { JsonFileStore, MemoryStore, loadStoreModule } from './store.js';