ummaya 0.2.3 → 0.2.5

package/tui/src/tools/LookupPrimitive/LookupPrimitive.ts

@@ -28,6 +28,11 @@ import {
 } from '../../services/api/adapterManifest.js'
 import { FIND_TOOL_NAME, DESCRIPTION, FIND_TOOL_PROMPT } from './prompt.js'
 import { dispatchPrimitive } from '../_shared/dispatchPrimitive.js'
+import {
+  applyDocumentVisualRenderGateToOutput,
+  isDocumentVisualRenderFailedOutput,
+  renderDocumentToolResultIfPresent,
+} from '../_shared/documentToolResultRender.js'
 import {
   renderVerboseInputJson,
   renderVerboseOutputJson,
@@ -38,6 +43,11 @@ import {
 } from '../_shared/compactPrimitiveResult.js'
 import { getOrCreateUmmayaBridge } from '../../ipc/bridgeSingleton.js'
 import { getOrCreatePendingCallRegistry } from '../../ipc/pendingCallSingleton.js'
+import {
+  isRootPrimitiveToolId,
+  normalizeRootPrimitiveAdapterEnvelope,
+  rootPrimitiveSelfTargetMessage,
+} from '../_shared/rootPrimitiveInput.js'
 
 // ---------------------------------------------------------------------------
 // UMMAYA citation extension — attaches resolved citation to the context so the
@@ -48,8 +58,6 @@ type ContextWithCitation = ToolUseContext & {
   ummayaCitations?: AdapterCitation[]
 }
 
-const ROOT_PRIMITIVE_TOOL_IDS = new Set(['find', 'locate', 'check', 'send'])
-
 function asRecord(value: unknown): Record<string, unknown> | null {
   return value !== null && typeof value === 'object'
     ? value as Record<string, unknown>
@@ -531,19 +539,22 @@ function buildFindResultRows(output: Output): React.ReactNode[] {
 // ---------------------------------------------------------------------------
 
 const inputSchema = lazySchema(() =>
-  z.object({
-    tool_id: z
-      .string()
-      .min(1)
-      .describe(
-        'Concrete adapter identifier picked from <available_adapters>. ' +
-          'This is not the function name. Never use "find", "locate", "check", or "send". ' +
-          'Examples: "kma_forecast_fetch", "hira_hospital_search".',
-      ),
-    params: z
-      .record(z.string(), z.unknown())
-      .describe('Adapter-defined Pydantic-validated parameter body'),
-  }),
+  z.preprocess(
+    value => normalizeRootPrimitiveAdapterEnvelope(FIND_TOOL_NAME, value),
+    z.object({
+      tool_id: z
+        .string()
+        .min(1)
+        .describe(
+          'Concrete adapter identifier picked from <available_adapters>. ' +
+            'This is not the function name. Never use "find", "locate", "check", or "send". ' +
+            'Examples: "kma_forecast_fetch", "hira_hospital_search".',
+        ),
+      params: z
+        .record(z.string(), z.unknown())
+        .describe('Adapter-defined Pydantic-validated parameter body'),
+    }),
+  ),
 )
 type InputSchema = ReturnType<typeof inputSchema>
 
@@ -620,26 +631,27 @@ export const LookupPrimitive = buildTool({
   },
 
   mapToolResultToToolResultBlockParam(output, toolUseID) {
+    const gatedOutput = applyDocumentVisualRenderGateToOutput(output)
     // Spec 2521 (2026-05-02) — strip ``outbound_traces`` from the
     // LLM-facing content. The trace is UI-only (verbose render);
     // shipping raw HTTP bodies back into the next turn would bloat
     // K-EXAONE's context with KMA/data.go.kr response payloads.
     const llmContent =
-      typeof output === 'object' && output !== null
+      typeof gatedOutput === 'object' && gatedOutput !== null
         ? Object.fromEntries(
-            Object.entries(output as Record<string, unknown>).filter(
+            Object.entries(gatedOutput as Record<string, unknown>).filter(
               ([k]) => k !== 'outbound_traces',
             ),
           )
-        : output
+        : gatedOutput
     return {
       tool_use_id: toolUseID,
       type: 'tool_result',
       content: JSON.stringify(llmContent),
+      ...(isDocumentVisualRenderFailedOutput(gatedOutput) ? { is_error: true } : {}),
     }
   },
 
-  // UMMAYA hotfix #2518 follow-up — CC pattern (tools/BashTool/UI.tsx:renderToolUseMessage).
   // Return an args preview so the citizen can see which tool was dispatched.
   // Spec 2521 (2026-05-01) — fetch-only surface; legacy mode='search'
   // payloads from older sessions surface as the bare tool_id.
@@ -678,10 +690,10 @@ export const LookupPrimitive = buildTool({
     // policy URL) is enforced at the primitive surface, not just at the
     // permission gauntlet.
 
-    if (ROOT_PRIMITIVE_TOOL_IDS.has(input.tool_id)) {
+    if (isRootPrimitiveToolId(input.tool_id)) {
       return {
         result: false,
-        message: `Root primitive '${input.tool_id}' is not an adapter tool_id. Pick a concrete adapter from <available_adapters>.`,
+        message: rootPrimitiveSelfTargetMessage(input.tool_id, 'find'),
         errorCode: PrimitiveErrorCode.AdapterNotFound,
       }
     }
@@ -761,14 +773,17 @@ export const LookupPrimitive = buildTool({
     _progress: unknown,
     options: { verbose: boolean; isTranscriptMode?: boolean } = { verbose: false },
   ): React.ReactNode {
+    const gatedOutput = applyDocumentVisualRenderGateToOutput(output) as Output
+    const documentResult = renderDocumentToolResultIfPresent(gatedOutput, options)
+    if (documentResult !== null) {
+      return documentResult
+    }
     // Spec 2521 (2026-05-01 evening) — Ctrl+O expand / transcript mode
     // surfaces the full envelope JSON the backend returned. Mirrors
     // CC BashTool/UI.tsx:renderToolResultMessage(verbose).
     if (options.verbose || options.isTranscriptMode) {
-      return renderVerboseOutputJson(output)
+      return renderVerboseOutputJson(gatedOutput)
     }
-    // UMMAYA hotfix #2519 (CC-original migration, 2026-04-30):
-    //
     // After the dispatchPrimitive register-and-await rewrite, output.result
     // is the actual primitive output (the inner of the backend envelope:
     // src/ummaya/tools/find.py LookupSearchResult / LookupRecord /
@@ -776,8 +791,8 @@ export const LookupPrimitive = buildTool({
     // its own `kind` field. The CC pattern wraps each branch in
     // <MessageResponse> so the "  ⎿  " gutter glyph prefixes every row
     // (tui/src/components/MessageResponse.tsx:22).
-    if (!output.ok) {
-      const message = extractErrorMessage(output.error.message)
+    if (!gatedOutput.ok) {
+      const message = extractErrorMessage(gatedOutput.error.message)
       return React.createElement(
         MessageResponse,
         null,
@@ -789,7 +804,7 @@ export const LookupPrimitive = buildTool({
       )
     }
 
-    const result = output.result as Record<string, unknown>
+    const result = gatedOutput.result as Record<string, unknown>
 
     // search mode (LookupSearchResult, models.py:820):
     //   { kind: "search", candidates: [AdapterCandidate], total_registry_size, effective_top_k, reason }
@@ -846,12 +861,16 @@ export const LookupPrimitive = buildTool({
    * validateInput has already resolved the adapter and populated ummayaCitations on the context.
    */
   async call(input, context) {
-    return dispatchPrimitive<Output>({
+    const result = await dispatchPrimitive<Output>({
       primitive: 'find',
-      args: input as Record<string, unknown>,
+      args: input,
       context,
       registry: getOrCreatePendingCallRegistry(),
       bridge: getOrCreateUmmayaBridge(),
     })
+    return {
+      ...result,
+      data: applyDocumentVisualRenderGateToOutput(result.data) as Output,
+    }
   },
 } satisfies ToolDef<InputSchema, Output>)

package/tui/src/tools/LookupPrimitive/prompt.ts

@@ -1,31 +1,30 @@
 // SPDX-License-Identifier: Apache-2.0
 // UMMAYA-original — Epic #1634 P3 · FindPrimitive prompt strings.
 // 2026 migration note: root primitives are lightweight category descriptors
-// and legacy transcript compatibility wrappers. Concrete adapter functions are
-// loaded through CC ToolSearch/deferred schema expansion or backend top-K
-// retrieval, then called directly with adapter schema arguments.
+// and legacy transcript compatibility wrappers. Concrete adapter ids are
+// selected through CC ToolSearch/deferred schema expansion or backend top-K
+// retrieval, then exposed as concrete model-facing tool functions.
 // Contract: specs/1634-tool-system-wiring/contracts/primitive-envelope.md § 2
 
 export const FIND_TOOL_NAME = 'find'
 
 /** Citizen-facing English description shown to the LLM (<= 240 chars). */
 export const DESCRIPTION =
-  'Discover Korean public-service lookup adapters. Prefer concrete adapter functions loaded by ToolSearch or backend retrieval; find is a legacy wrapper only.'
+  'Discover Korean public-service lookup adapters. Prefer concrete lookup adapter functions loaded by ToolSearch or backend retrieval; find is a legacy wrapper.'
 
 /** Extended prompt included in the system-prompt tool-use section. */
 export const FIND_TOOL_PROMPT = `Discover Korean public-service lookup adapters registered in the UMMAYA tool registry.
 
 Preferred path:
 - Call concrete adapter functions directly after their schemas are loaded.
-- Example: kma_current_observation({ base_date: "YYYYMMDD", base_time: "HH00", nx: 97, ny: 74 })
-- Adapter schemas are progressively disclosed by ToolSearch or by backend top-K retrieval for the current citizen request.
+- Adapter ids and schemas are progressively disclosed by ToolSearch, adapter_manifest, or backend top-K retrieval for the current citizen request.
 - Only top candidates should be loaded; do not expect every adapter schema in the prompt.
+- A concrete adapter id may be valid even when it is not listed in <available-deferred-tools>; if it appears in <available_adapters> or adapter_manifest and its function is loaded, call that function directly with its schema fields.
 
 Legacy root wrapper:
 - If a concrete adapter function is not loaded and only the root primitive is available, find accepts { tool_id, params } for old transcripts and compatibility paths.
 - tool_id must be a concrete adapter id from <available_adapters>, never "find", "locate", "check", or "send".
 - Invalid: find({ tool_id: "find", params: {...} })
-- Compatibility-only: find({ tool_id: "kma_current_observation", params: { base_date: "YYYYMMDD", base_time: "HH00", nx: 97, ny: 74 } })
 
 Rules:
 - Do not call find with mode='search' or query; discovery is handled outside the primitive call.

package/tui/src/tools/MCPTool/trustPolicy.ts

@@ -0,0 +1,118 @@
+import { mcpInfoFromString } from '../../services/mcp/mcpStringUtils.js'
+import type { ToolPermissionContext, ToolUseContext } from '../../Tool.js'
+import type { PermissionResult } from '../../utils/permissions/PermissionResult.js'
+import {
+  getAllowRules,
+  getDenyRuleForTool,
+} from '../../utils/permissions/permissions.js'
+
+const TRUSTED_BUILTIN_MCP_SERVERS = ['ummaya'] as const
+
+type McpTrustInput = { readonly [key: string]: unknown }
+
+function mcpServerRuleName(serverName: string): string {
+  return `mcp__${serverName}`
+}
+
+function hasExactServerAllowRule(
+  permissionContext: ToolPermissionContext,
+  serverName: string,
+): boolean {
+  return getAllowRules(permissionContext).some(rule => {
+    if (rule.ruleValue.ruleContent !== undefined) return false
+    const ruleInfo = mcpInfoFromString(rule.ruleValue.toolName)
+    if (ruleInfo === null) return false
+    return (
+      ruleInfo.serverName === serverName &&
+      (ruleInfo.toolName === undefined || ruleInfo.toolName === '*')
+    )
+  })
+}
+
+function hasServerDenyRule(
+  permissionContext: ToolPermissionContext,
+  serverName: string,
+): boolean {
+  return (
+    getDenyRuleForTool(permissionContext, {
+      name: mcpServerRuleName(serverName),
+      mcpInfo: { serverName, toolName: '*' },
+    }) !== null
+  )
+}
+
+export function isTrustedMcpServer(
+  permissionContext: ToolPermissionContext,
+  serverName: string,
+): boolean {
+  if (hasServerDenyRule(permissionContext, serverName)) return false
+  if (TRUSTED_BUILTIN_MCP_SERVERS.some(name => name === serverName)) return true
+  return hasExactServerAllowRule(permissionContext, serverName)
+}
+
+export function assertNonEmptyMcpServerName(serverName: string): void {
+  if (serverName.trim().length === 0) {
+    throw new Error('MCP server name cannot be empty')
+  }
+}
+
+export function assertNonEmptyMcpResourceUri(uri: string): void {
+  if (uri.trim().length === 0) {
+    throw new Error('MCP resource URI cannot be empty')
+  }
+}
+
+export function assertTrustedMcpServerForResourceAccess(
+  permissionContext: ToolPermissionContext,
+  serverName: string,
+): void {
+  assertTrustedMcpServer(
+    permissionContext,
+    serverName,
+    `Server "${serverName}" is not trusted for MCP resource access`,
+  )
+}
+
+export function assertTrustedMcpServer(
+  permissionContext: ToolPermissionContext,
+  serverName: string,
+  message: string,
+): void {
+  assertNonEmptyMcpServerName(serverName)
+  if (!isTrustedMcpServer(permissionContext, serverName)) {
+    throw new Error(message)
+  }
+}
+
+export function createMcpServerTrustSuggestion(serverName: string) {
+  return {
+    type: 'addRules' as const,
+    rules: [
+      {
+        toolName: mcpServerRuleName(serverName),
+        ruleContent: undefined,
+      },
+    ],
+    behavior: 'allow' as const,
+    destination: 'localSettings' as const,
+  }
+}
+
+export function checkMcpServerTrustPermission<Input extends McpTrustInput>(
+  serverName: string,
+  input: Input,
+  context: ToolUseContext,
+  message: string,
+): PermissionResult<Input> {
+  assertNonEmptyMcpServerName(serverName)
+  if (
+    isTrustedMcpServer(context.getAppState().toolPermissionContext, serverName)
+  ) {
+    return { behavior: 'allow', updatedInput: input }
+  }
+  return {
+    behavior: 'passthrough',
+    message,
+    suggestions: [createMcpServerTrustSuggestion(serverName)],
+  }
+}

package/tui/src/tools/McpAuthTool/McpAuthTool.ts

@@ -18,7 +18,11 @@ import type { Tool } from '../../Tool.js'
 import { errorMessage } from '../../utils/errors.js'
 import { lazySchema } from '../../utils/lazySchema.js'
 import { logMCPDebug, logMCPError } from '../../utils/log.js'
-import type { PermissionDecision } from '../../utils/permissions/PermissionResult.js'
+import type { PermissionResult } from '../../utils/permissions/PermissionResult.js'
+import {
+  assertTrustedMcpServer,
+  checkMcpServerTrustPermission,
+} from '../MCPTool/trustPolicy.js'
 
 const inputSchema = lazySchema(() => z.object({}))
 type InputSchema = ReturnType<typeof inputSchema>
@@ -79,10 +83,21 @@ export function createMcpAuthTool(
     get inputSchema(): InputSchema {
       return inputSchema()
     },
-    async checkPermissions(input): Promise<PermissionDecision> {
-      return { behavior: 'allow', updatedInput: input }
+    async checkPermissions(input, context): Promise<PermissionResult> {
+      return checkMcpServerTrustPermission(
+        serverName,
+        input,
+        context,
+        `MCP server "${serverName}" requires trust before authentication can run.`,
+      )
     },
     async call(_input, context) {
+      assertTrustedMcpServer(
+        context.getAppState().toolPermissionContext,
+        serverName,
+        `MCP server "${serverName}" requires trust before authentication can run.`,
+      )
+
       // claude.ai connectors use a separate auth flow (handleClaudeAIAuth in
       // MCPRemoteServerMenu) that we don't invoke programmatically here —
       // just point the user at /mcp.
@@ -196,6 +211,9 @@ export function createMcpAuthTool(
           },
         }
       } catch (err) {
+        if (!(err instanceof Error)) {
+          throw err
+        }
         return {
           data: {
             status: 'error' as const,