Merge origin/main into 033-typescript-code-execution

Resolve merge conflicts between TypeScript code execution feature and
main branch changes (routing modes PR#327, tool quarantine PR#328,
goja update PR#330).

Conflicts resolved by keeping both sides:
- internal/jsruntime/runtime.go: Added Language field alongside auth
  context fields from Spec 031
- internal/server/mcp.go: Combined TypeScript+ES2020+ tool descriptions
  and kept language parameter alongside updated code description
- internal/server/mcp_code_execution.go: Kept language logging alongside
  auth context injection from Spec 031
- docs/code_execution/api-reference.md: Merged TypeScript language
  parameter docs with ES2020+ description updates

Also fixed binary E2E test config to disable tool-level quarantine
(quarantine_enabled: false), matching the approach in non-binary E2E
tests. Without this, the new tool quarantine feature from Spec 032
causes tools to be quarantined during tests.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: claude

CLAUDE.md

@@ -174,6 +174,8 @@ go test -race ./internal/... -v     # Race detection
 mcpproxy upstream list              # List all servers
 mcpproxy upstream logs <name>       # View logs (--tail, --follow)
 mcpproxy upstream restart <name>    # Restart server (supports --all)
+mcpproxy upstream inspect <name>    # Inspect tool approval status (Spec 032)
+mcpproxy upstream approve <name>    # Approve pending/changed tools (Spec 032)
 mcpproxy doctor                     # Run health checks
 ```
 
@@ -300,6 +302,7 @@ See [docs/configuration.md](docs/configuration.md) for complete reference.
 - **`call_tool_destructive`** - Proxy destructive tool calls to upstream servers (Spec 018)
 - **`code_execution`** - Execute JavaScript to orchestrate multiple tools (disabled by default)
 - **`upstream_servers`** - CRUD operations for server management
+- **`quarantine_security`** - Security quarantine management: list/inspect quarantined servers, inspect/approve/approve-all tools (Spec 032)
 
 **Tool Format**: `<serverName>:<toolName>` (e.g., `github:create_issue`)
 
@@ -333,6 +336,9 @@ See [docs/configuration.md](docs/configuration.md) for complete reference.
 | `GET /api/v1/tokens/{name}` | Get agent token details |
 | `DELETE /api/v1/tokens/{name}` | Revoke agent token |
 | `POST /api/v1/tokens/{name}/regenerate` | Regenerate agent token secret |
+| `POST /api/v1/servers/{id}/tools/approve` | Approve pending/changed tools (Spec 032) |
+| `GET /api/v1/servers/{id}/tools/{tool}/diff` | View tool description/schema changes (Spec 032) |
+| `GET /api/v1/servers/{id}/tools/export` | Export tool approval records (Spec 032) |
 | `GET /events` | SSE stream for live updates |
 
 **Authentication**: Use `X-API-Key` header or `?apikey=` query parameter.
@@ -403,7 +409,7 @@ All server responses include a `health` field that provides consistent status in
 
 ## JavaScript Code Execution
 
-The `code_execution` tool enables orchestrating multiple upstream MCP tools in a single request using sandboxed JavaScript (ES5.1+).
+The `code_execution` tool enables orchestrating multiple upstream MCP tools in a single request using sandboxed JavaScript (ES2020+). Modern syntax is fully supported: arrow functions, const/let, template literals, destructuring, classes, for-of, optional chaining (?.), nullish coalescing (??), spread/rest, Promises, Symbols, Map/Set, Proxy/Reflect, and generators.
 
 ### Configuration
 
@@ -439,6 +445,7 @@ See `docs/code_execution/` for complete guides:
 - **`require_mcp_auth`**: When enabled, `/mcp` endpoint rejects unauthenticated requests (default: false for backward compatibility)
 - **Quarantine system**: New servers quarantined until manually approved
 - **Tool Poisoning Attack (TPA) protection**: Automatic detection of malicious descriptions
+- **Tool-level quarantine (Spec 032)**: SHA-256 hash-based change detection for individual tool descriptions/schemas. New tools start as "pending", changed tools marked as "changed" (rug pull detection). Configurable via `quarantine_enabled` (global) and `skip_quarantine` (per-server).
 
 See [docs/features/agent-tokens.md](docs/features/agent-tokens.md) and [docs/features/security-quarantine.md](docs/features/security-quarantine.md) for details.
 
@@ -554,14 +561,25 @@ Runtime detection (uvx→Python, npx→Node.js), image selection, environment pa
 Dynamic port allocation, RFC 8252 + PKCE, flow coordinator (`internal/oauth/coordinator.go`), automatic token refresh. See [docs/oauth-resource-autodetect.md](docs/oauth-resource-autodetect.md).
 
 ### Code Execution
-Sandboxed JavaScript (ES5.1+), orchestrates multiple upstream tools in single request. See [docs/code_execution/overview.md](docs/code_execution/overview.md).
+Sandboxed JavaScript (ES2020+), orchestrates multiple upstream tools in single request. See [docs/code_execution/overview.md](docs/code_execution/overview.md).
 
 ### Connection Management
 Exponential backoff, separate contexts for app vs server lifecycle, state machine: Disconnected → Connecting → Authenticating → Ready.
 
 ### Tool Indexing
 Full rebuild on server changes, hash-based change detection, background indexing.
 
+### Tool-Level Quarantine (Spec 032)
+SHA-256 hash-based approval system for individual tools. Key files:
+- `internal/storage/models.go` - `ToolApprovalRecord` model and `ToolApprovalBucket`
+- `internal/storage/bbolt.go` - CRUD operations for tool approvals
+- `internal/runtime/tool_quarantine.go` - Hash calculation, approval checking, blocking logic
+- `internal/runtime/lifecycle.go` - Integration in `applyDifferentialToolUpdate()`
+- `internal/server/mcp.go` - Tool-level blocking in `handleCallToolVariant()` and MCP tool operations
+- `internal/httpapi/server.go` - REST API endpoints for inspection/approval
+- `internal/config/config.go` - `QuarantineEnabled` (global) and `SkipQuarantine` (per-server)
+- `frontend/src/views/ServerDetail.vue` - Web UI quarantine panel
+
 ### Signal Handling
 Graceful shutdown, context cancellation, Docker cleanup, double shutdown protection.
 

cmd/mcpproxy/doctor_cmd.go

@@ -421,6 +421,23 @@ func displaySecurityFeaturesStatus() {
 		return
 	}
 
+	// Routing Mode status (Spec 031)
+	routingMode := cfg.RoutingMode
+	if routingMode == "" {
+		routingMode = config.RoutingModeRetrieveTools
+	}
+	fmt.Printf("  Routing Mode: %s\n", routingMode)
+	switch routingMode {
+	case config.RoutingModeDirect:
+		fmt.Println("    All upstream tools exposed directly via /mcp endpoint")
+	case config.RoutingModeCodeExecution:
+		fmt.Println("    JS orchestration via code_execution tool")
+	default:
+		fmt.Println("    BM25 search via retrieve_tools + call_tool variants")
+	}
+	fmt.Printf("    Endpoints: /mcp/all (direct), /mcp/code (code_execution), /mcp/call (retrieve_tools)\n")
+	fmt.Println()
+
 	// Sensitive Data Detection status
 	sddConfig := cfg.SensitiveDataDetection
 	if sddConfig == nil || sddConfig.IsEnabled() {

cmd/mcpproxy/status_cmd.go

@@ -28,6 +28,7 @@ type StatusInfo struct {
 	UptimeSeconds float64          `json:"uptime_seconds,omitempty"`
 	APIKey        string           `json:"api_key"`
 	WebUIURL      string           `json:"web_ui_url"`
+	RoutingMode   string           `json:"routing_mode"`
 	Servers       *ServerCounts    `json:"servers,omitempty"`
 	SocketPath    string           `json:"socket_path,omitempty"`
 	ConfigPath    string           `json:"config_path,omitempty"`
@@ -158,11 +159,17 @@ func collectStatusFromDaemon(cfg *config.Config, socketPath, configPath string)
 	defer cancel()
 
 	info := &StatusInfo{
-		State:      "Running",
-		Edition:    Edition,
-		APIKey:     cfg.APIKey,
-		SocketPath: socketPath,
-		ConfigPath: configPath,
+		State:       "Running",
+		Edition:     Edition,
+		APIKey:      cfg.APIKey,
+		RoutingMode: cfg.RoutingMode,
+		SocketPath:  socketPath,
+		ConfigPath:  configPath,
+	}
+
+	// Apply routing mode default if empty
+	if info.RoutingMode == "" {
+		info.RoutingMode = config.RoutingModeRetrieveTools
 	}
 
 	// Add teams info if available
@@ -220,13 +227,19 @@ func collectStatusFromConfig(cfg *config.Config, socketPath, configPath string)
 		listenAddr = "127.0.0.1:8080"
 	}
 
+	routingMode := cfg.RoutingMode
+	if routingMode == "" {
+		routingMode = config.RoutingModeRetrieveTools
+	}
+
 	info := &StatusInfo{
-		State:      "Not running",
-		Edition:    Edition,
-		ListenAddr: listenAddr + " (configured)",
-		APIKey:     cfg.APIKey,
-		WebUIURL:   statusBuildWebUIURL(listenAddr, cfg.APIKey),
-		ConfigPath: configPath,
+		State:       "Not running",
+		Edition:     Edition,
+		ListenAddr:  listenAddr + " (configured)",
+		APIKey:      cfg.APIKey,
+		WebUIURL:    statusBuildWebUIURL(listenAddr, cfg.APIKey),
+		RoutingMode: routingMode,
+		ConfigPath:  configPath,
 	}
 
 	info.TeamsInfo = collectTeamsInfo(cfg)
@@ -351,6 +364,7 @@ func printStatusTable(info *StatusInfo) {
 	}
 
 	fmt.Printf("  %-12s %s\n", "API Key:", info.APIKey)
+	fmt.Printf("  %-12s %s\n", "Routing:", info.RoutingMode)
 	fmt.Printf("  %-12s %s\n", "Web UI:", info.WebUIURL)
 
 	if info.Servers != nil {

cmd/mcpproxy/status_cmd_test.go

@@ -449,6 +449,129 @@ func TestStatusJSONOutput(t *testing.T) {
 	}
 }
 
+func TestStatusRoutingModeInTable(t *testing.T) {
+	tests := []struct {
+		name        string
+		routingMode string
+		expected    string
+	}{
+		{
+			name:        "retrieve_tools mode",
+			routingMode: "retrieve_tools",
+			expected:    "retrieve_tools",
+		},
+		{
+			name:        "direct mode",
+			routingMode: "direct",
+			expected:    "direct",
+		},
+		{
+			name:        "code_execution mode",
+			routingMode: "code_execution",
+			expected:    "code_execution",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			info := &StatusInfo{
+				State:       "Running",
+				Edition:     "personal",
+				ListenAddr:  "127.0.0.1:8080",
+				APIKey:      "a1b2****a1b2",
+				WebUIURL:    "http://127.0.0.1:8080/ui/?apikey=test",
+				RoutingMode: tt.routingMode,
+			}
+
+			old := os.Stdout
+			r, w, _ := os.Pipe()
+			os.Stdout = w
+
+			printStatusTable(info)
+
+			w.Close()
+			os.Stdout = old
+
+			buf := make([]byte, 4096)
+			n, _ := r.Read(buf)
+			output := string(buf[:n])
+
+			if !strings.Contains(output, "Routing:") {
+				t.Errorf("expected output to contain 'Routing:', output:\n%s", output)
+			}
+			if !strings.Contains(output, tt.expected) {
+				t.Errorf("expected output to contain %q, output:\n%s", tt.expected, output)
+			}
+		})
+	}
+}
+
+func TestStatusRoutingModeInJSON(t *testing.T) {
+	info := &StatusInfo{
+		State:       "Running",
+		Edition:     "personal",
+		ListenAddr:  "127.0.0.1:8080",
+		APIKey:      "testkey",
+		WebUIURL:    "http://127.0.0.1:8080/ui/",
+		RoutingMode: "direct",
+	}
+
+	old := os.Stdout
+	r, w, _ := os.Pipe()
+	os.Stdout = w
+
+	err := printStatusJSON(info)
+
+	w.Close()
+	os.Stdout = old
+
+	if err != nil {
+		t.Fatalf("printStatusJSON failed: %v", err)
+	}
+
+	buf := make([]byte, 8192)
+	n, _ := r.Read(buf)
+	output := string(buf[:n])
+
+	var result StatusInfo
+	if jsonErr := json.Unmarshal([]byte(output), &result); jsonErr != nil {
+		t.Fatalf("invalid JSON: %v\nOutput: %s", jsonErr, output)
+	}
+
+	if result.RoutingMode != "direct" {
+		t.Errorf("expected routing_mode 'direct', got %q", result.RoutingMode)
+	}
+}
+
+func TestCollectStatusFromConfigRoutingMode(t *testing.T) {
+	t.Run("uses config routing mode", func(t *testing.T) {
+		cfg := &config.Config{
+			Listen:      "127.0.0.1:8080",
+			APIKey:      "testkey",
+			RoutingMode: "direct",
+		}
+
+		info := collectStatusFromConfig(cfg, "/tmp/test.sock", "/tmp/config.json")
+
+		if info.RoutingMode != "direct" {
+			t.Errorf("expected routing mode 'direct', got %q", info.RoutingMode)
+		}
+	})
+
+	t.Run("defaults to retrieve_tools when empty", func(t *testing.T) {
+		cfg := &config.Config{
+			Listen: "127.0.0.1:8080",
+			APIKey: "testkey",
+		}
+
+		info := collectStatusFromConfig(cfg, "/tmp/test.sock", "/tmp/config.json")
+
+		if info.RoutingMode != config.RoutingModeRetrieveTools {
+			t.Errorf("expected routing mode %q, got %q", config.RoutingModeRetrieveTools, info.RoutingMode)
+		}
+	})
+}
+
 // parseTestDuration is a helper to parse duration strings for tests.
 func parseTestDuration(s string) (time.Duration, error) {
 	return time.ParseDuration(s)