semantic context tools

[philipnee]

Why

Raw connector tools make clients choose between low-level source-specific operations. This PR adds a small high-level context surface so clients can search and read allowed personal context without exposing every
raw connector tool.

What changed

• Add search_personal_context.
• Add read_context_item.
• Wire semantic tools through semanticTools config.
• Gate semantic tool visibility by:
  • configured semantic tool source IDs
  • resolved client identity
  • source/action permissions
• Allow semantic tools for clients with rawToolsEnabled: false.
• Implement keyword-union retrieval across supported source adapters.
• Return source-attributed results with stable source_id, item_id, snippet, locator, and follow-up read action.
• Add MCP-level coverage proving semantic tools are visible/callable while raw tools remain hidden.

How

The router now owns semantic tool registration and dispatch. It indexes raw connector tools by policy source ID, then chooses simple adapters for supported search/read tools such as Obsidian search_notes /
read_note and filesystem-style search_files / read_file.

search_personal_context does not attempt embedding search or global semantic ranking. It performs per-source keyword retrieval and returns a ranking: "per_source_keyword_union" marker so the behavior is
explicit.

Changed files

src/server/router.ts - add semantic tool definitions, visibility checks, source adapters, keyword search, read-through behavior, and audit integration.

src/cli/start.ts - pass config.semanticTools into the router.

tests/router.test.ts - cover semantic tool listing, search results, and read-through behavior with raw tools disabled.

tests/server.test.ts - cover semantic tools through the HTTP MCP layer for a configured client.

Verification

npm test -- tests/router.test.ts tests/server.test.ts
npm run verify