resolveLeastPrivilegeOperatorScopesForMethod,

type OperatorScope,

} from "../../gateway/method-scopes.js";

import { getOperatorApprovalRuntimeToken } from "../../gateway/operator-approval-runtime-token.js";

import { GATEWAY_CLIENT_MODES, GATEWAY_CLIENT_NAMES } from "../../gateway/protocol/client-info.js";

import { formatErrorMessage } from "../../infra/errors.js";

import {

return { url: validatedOverride?.url, token, timeoutMs };

}

const APPROVAL_RUNTIME_METHODS = new Set<string>([

"exec.approval.request",

"exec.approval.waitDecision",

"plugin.approval.request",

"plugin.approval.waitDecision",

]);

function resolveApprovalRuntimeTokenForGatewayTool(params: {

method: string;

opts: GatewayCallOptions;

}): string | undefined {

if (!APPROVAL_RUNTIME_METHODS.has(params.method)) {

return undefined;

}

if (trimToUndefined(params.opts.gatewayUrl) !== undefined) {

return undefined;

}

return getOperatorApprovalRuntimeToken();

}

export async function callGatewayTool<T = Record<string, unknown>>(

method: string,

opts: GatewayCallOptions,

const scopes = Array.isArray(extra?.scopes)

? extra.scopes

: resolveLeastPrivilegeOperatorScopesForMethod(method, params);

const approvalRuntimeToken = resolveApprovalRuntimeTokenForGatewayTool({ method, opts });

return await callGateway<T>({

url: gateway.url,

token: gateway.token,

clientName: GATEWAY_CLIENT_NAMES.GATEWAY_CLIENT,

clientDisplayName: "agent",

mode: GATEWAY_CLIENT_MODES.BACKEND,

...(approvalRuntimeToken ? { approvalRuntimeToken } : {}),

scopes,

});

}