Implement JavaScript code execution feature for orchestrating multiple upstream MCP tools in a single request. This reduces round-trip latency and enables complex multi-step workflows with conditional logic, loops, and data transformations.

## Core Features
- Sandboxed JavaScript (ES5.1+) execution using Goja
- call_tool() function for invoking upstream MCP servers
- Execution limits (timeout, max_tool_calls, allowed_servers)
- Concurrent execution pool with configurable size
- Feature toggle (disabled by default for security)

## Observability
- execution_id tracking for log correlation
- Pool metrics (size, available, in-use)
- Acquisition/release duration tracking
- Tool call timing and result logging
- Thread-safe metrics collection

## Security
- Sandbox restrictions (no require, fs, network access)
- Timeout enforcement with watchdog goroutine
- Server whitelist support
- Max tool calls limit to prevent abuse

## Developer Experience
- CLI command: mcpproxy code exec
- Comprehensive documentation (overview, examples, API reference, troubleshooting)
- 19 unit tests with 100% pass rate

## Configuration
- enable_code_execution: false (default)
- code_execution_timeout_ms: 120000 (2 minutes)
- code_execution_max_tool_calls: 0 (unlimited)
- code_execution_pool_size: 10

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

…ct methods

Add missing code_execution operation constant and register it in all tool routing methods to enable CLI command support.

- Add operationCodeExecution constant
- Add case in CallBuiltInTool switch statement
- Add case in CallToolDirect switch statement
- Add to proxyTools map in handleCallTool
- Add to proxy tool routing switch statement

This fixes the 'unknown built-in tool: code_execution' error when using the mcpproxy code exec CLI command.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

Add comprehensive session tracking for MCP tool calls with UI display:
- Track MCP session ID, client name, and client version from InitializeRequest
- Link nested tool calls (from code_execution) to their parent calls
- Add 5 new optional fields to ToolCallRecord: parent_call_id, execution_type, mcp_session_id, mcp_client_name, mcp_client_version
- Create thread-safe session store for capturing client metadata
- Display session information in Tool Call History UI with Session column
- Show full session details and JavaScript code in expanded row view
- Support error status display with red badge and error messages
- Include test data generator for populating sample records

Backend changes:
- internal/server/session_store.go: Thread-safe session metadata storage
- internal/server/mcp.go: OnRegisterSession hook for capturing client info
- internal/server/mcp_code_execution.go: Parent-child linking for nested calls
- internal/runtime/runtime.go: API conversion includes new session fields
- internal/storage/server_identity.go: Extended ToolCallRecord schema
- internal/contracts/types.go: API response types with session fields

Frontend changes:
- frontend/src/types/api.ts: TypeScript types for session tracking
- frontend/src/views/ToolCalls.vue: Session column, Monaco editor for code, parent call navigation

Testing:
- cmd/populate-test-data: Tool to generate test records with session data

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

Changes:
- Updated Validate() to apply defaults for code_execution fields before validation
- Modified ValidateDetailed() to allow 0 values (treat as "use default")
- Fixed test failures in TestValidateDetailed and TestValidateWithDefaults

Fields affected:
- CodeExecutionTimeoutMs: 0 or 1-600000 (default: 120000)
- CodeExecutionPoolSize: 0 or 1-100 (default: 10)
- CodeExecutionMaxToolCalls: >= 0 (0 means unlimited)

This ensures configs without these fields can still validate successfully.

feat: JavaScript Code Execution Tool with Full Observability

… token metrics for nested calls

This commit fixes two issues in the tool call history feature:

1. **Code execution parent calls not visible**: The `GetToolCalls()` method in
   `internal/runtime/runtime.go` only queried buckets for servers registered in
   `server_identities`, which excluded the built-in "code_execution" pseudo-server.
   Now explicitly fetches from the `server_code_execution_tool_calls` bucket.

2. **Missing token metrics for nested calls**: Nested tool calls executed within
   `code_execution` did not calculate token counts. Added tokenizer integration to
   `storeToolCallInHistory()` in `internal/server/mcp_code_execution.go` to compute
   input/output/total tokens and encoding for nested calls.

Changes:
- internal/runtime/runtime.go:694-700: Added code to fetch code_execution tool calls
- internal/server/mcp_code_execution.go:264: Added mainServer field to upstreamToolCaller
- internal/server/mcp_code_execution.go:109: Pass mainServer to upstreamToolCaller
- internal/server/mcp_code_execution.go:360-408: Calculate token metrics for nested calls

Related to code execution observability and parent-child call tracking.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

Backend Changes:
- Add token metrics calculation for parent code_execution tool calls
- Count input tokens from both code and input arguments
- Count output tokens from execution result
- Use same tokenizer pattern as nested calls for consistency

Frontend Changes:
- Make Monaco editor resizable (vertical resize, 150px-600px range)
- Add copy button for JavaScript code section (matches Arguments/Response pattern)
- Set default Monaco editor height to 250px for better code visibility
- Add visual feedback for copy action (checkmark icon, 2-second toast)

All three issues from user feedback are now resolved:
1. ✅ Code execution parent calls show token metrics
2. ✅ Monaco editor is resizable and has proper default height
3. ✅ Copy button available for JavaScript code section

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

The Monaco editor was not responding to the resizable container because
it needed absolute positioning instead of flexbox to work correctly with
the VueMonacoEditor component.

Changes:
- Remove height prop from VueMonacoEditor component
- Change container to use position: relative
- Position monaco-wrapper absolutely to fill container (top/left/right/bottom: 0)
- Set Monaco editor to width: 100%, height: 100%

This allows the container to be resized vertically (150px-600px range)
and the Monaco editor will properly fill the resized space.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

…de-execution

fix: include code_execution parent calls in tool call history and add token metrics for nested calls