Surface workspace-mcp tool-handler errors as execution failures

Decision: workspace-mcp's /api/tool, /api/tools direct-HTTP endpoints are
a first-class, server-sanctioned transport (see transport.py's "Direct
HTTP API for non-MCP clients"), not a workaround — Hexis's REST provider
is the right integration, no migration to the SSE/JSON-RPC MCP transport
needed.

The actual gap: workspace-mcp catches tool-handler exceptions and reports
them as an ERROR-coded warning inside a 200 response envelope rather than
an HTTP error status, so Execute()'s status-code check alone let every
such failure through as a successful execution. Detect the ERROR-coded
warning and return it as an error so it maps to Hexis's failed status.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018ghELqYhZNLub2TXGMazqA

internal/provider/workspace_mcp.go

@@ -175,11 +175,42 @@ func (p *WorkspaceMCPProvider) Execute(capability *domain.Capability, req *domai
 		}, nil
 	}
 
+	// workspace-mcp catches tool-handler exceptions and reports them as an
+	// ERROR-coded warning inside a 200 response envelope rather than an HTTP
+	// error status, so a plain status-code check would report every such
+	// failure as a successful execution. Surface it as an error here so it
+	// maps to Hexis's failed execution status instead.
+	if envelopeErr := workspaceEnvelopeError(result); envelopeErr != "" {
+		return map[string]any{"result": result}, fmt.Errorf("workspace tool %q reported an error: %s", toolName, envelopeErr)
+	}
+
 	return map[string]any{
 		"result": result,
 	}, nil
 }
 
+func workspaceEnvelopeError(result any) string {
+	envelope, ok := result.(map[string]any)
+	if !ok {
+		return ""
+	}
+	warnings, ok := envelope["warnings"].([]any)
+	if !ok {
+		return ""
+	}
+	for _, w := range warnings {
+		warning, ok := w.(map[string]any)
+		if !ok {
+			continue
+		}
+		if code, _ := warning["code"].(string); code == "ERROR" {
+			message, _ := warning["message"].(string)
+			return message
+		}
+	}
+	return ""
+}
+
 func (p *WorkspaceMCPProvider) capabilityToTool(capName string) string {
 	for toolName, mapping := range p.allowlist.Tools {
 		if mapping.Capability == capName {