@bastani/atomic 0.9.12 → 0.9.13-alpha.2

package/dist/builtin/intercom/ui/compose.ts

@@ -60,35 +60,37 @@ export class ComposeOverlay implements Component {
 
   invalidate(): void {}
 
-  handleInput(data: string): void {
-    if (this.sending) return;
+  handleInput(data: string): boolean {
+    if (this.sending) return false;
     if (this.keybindings.matches(data, "tui.select.cancel")) {
       this.done({ sent: false });
-      return;
+      return true;
     }
 
     if (data.startsWith("\x1b")) {
-      return;
+      return false;
     }
 
     if (this.keybindings.matches(data, "tui.select.confirm")) {
       if (this.inputBuffer.trim()) {
         this.sendMessage();
       }
-      return;
+      return true;
     }
 
     if (this.keybindings.matches(data, "tui.editor.deleteCharBackward")) {
       this.inputBuffer = [...this.inputBuffer].slice(0, -1).join("");
       this.tui.requestRender();
-      return;
+      return true;
     }
 
     const printable = [...data].filter(c => c >= " ").join("");
     if (printable) {
       this.inputBuffer += printable;
       this.tui.requestRender();
+      return true;
     }
+    return false;
   }
 
   private async sendMessage(): Promise<void> {

package/dist/builtin/intercom/ui/session-list.ts

@@ -90,32 +90,34 @@ export class SessionListOverlay implements Component {
 
   invalidate(): void {}
 
-  handleInput(data: string): void {
+  handleInput(data: string): boolean {
     if (this.keybindings.matches(data, "tui.select.cancel")) {
       this.done(undefined);
-      return;
+      return true;
     }
 
     if (this.sessions.length === 0) {
-      return;
+      return false;
     }
 
     if (this.keybindings.matches(data, "tui.select.up")) {
       this.selectedIndex = this.selectedIndex === 0 ? this.sessions.length - 1 : this.selectedIndex - 1;
-      return;
+      return true;
     }
 
     if (this.keybindings.matches(data, "tui.select.down")) {
       this.selectedIndex = this.selectedIndex === this.sessions.length - 1 ? 0 : this.selectedIndex + 1;
-      return;
+      return true;
     }
 
     if (this.keybindings.matches(data, "tui.select.confirm")) {
       const session = this.sessions[this.selectedIndex];
       if (session) {
         this.onSessionSelect(session.id);
+        return true;
       }
     }
+    return false;
   }
 
   render(width: number): string[] {

package/dist/builtin/mcp/CHANGELOG.md

@@ -7,6 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.13-alpha.2] - 2026-08-12
+
+### Changed
+
+- MCP server processes and npm/Glimpse resolver probes now receive `AI_AGENT=atomic` for generic child-process attribution; the reserved marker overrides a configured `AI_AGENT` value.
+
+### Fixed
+
+- Fixed image blocks returned by MCP tools bypassing the host's `images.autoResize` processing before they enter session history.
+- Fixed deferred MCP initialization's stale-context check by consuming the host's exported predicate instead of copying its error-message marker.
+
+- Restored credential-resolved endpoints for MCP sampling requests, so GitHub Copilot Business and Enterprise accounts keep their own endpoint alongside dynamic API keys and request headers ([#7579](https://github.com/earendil-works/pi/issues/7579)).
+
+## [0.9.13-alpha.1] - 2026-08-05
+
+### Changed
+
+- In-process subagents now receive MCP direct-tool selection through typed admission policy. Omitted selection preserves MCP configuration defaults, a list selects exact server/tool entries, and an empty list disables direct tools; the process-era environment bridge has been removed ([#2188](https://github.com/bastani-inc/atomic/issues/2188)).
+
 ## [0.9.12] - 2026-08-04
 
 ### Fixed

package/dist/builtin/mcp/README.md

@@ -240,7 +240,9 @@ To exclude specific tools while still using `directTools: true`, add `excludeToo
 
 Each direct tool costs ~150-300 tokens in the system prompt (name + description + schema). Good for targeted sets of 5-20 tools. For servers with 75+ tools, stick with the proxy or pick specific tools with a `string[]`.
 
-Direct tools register from the metadata cache in the Pi agent dir (`~/.pi/agent/mcp-cache.json` by default, or `$PI_CODING_AGENT_DIR/mcp-cache.json` when set), so no server connections are needed at startup when the cache is warm. On the first session after adding `directTools` to a new server, or when a child/subagent selects tools through `MCP_DIRECT_TOOLS`, the cache may not exist yet — tools fall back to proxy-only while the selected/configured direct-tool servers populate in the background, then the extension refreshes tool registration so the warmed direct tools become available in the current session. To force it immediately: `/mcp reconnect <server>`.
+Direct tools register from the metadata cache in the Pi agent dir (`~/.pi/agent/mcp-cache.json` by default, or `$PI_CODING_AGENT_DIR/mcp-cache.json` when set), so no server connections are needed at startup when the cache is warm. On the first session after adding `directTools` to a new server, or when a child/subagent selects tools, the cache may not exist yet — tools fall back to proxy-only while the selected/configured direct-tool servers populate in the background, then the extension refreshes tool registration so the warmed direct tools become available in the current session. To force it immediately: `/mcp reconnect <server>`.
+
+In-process subagents receive direct-tool selection through the typed admission policy rather than an environment bridge. An omitted `mcpDirectTools` field preserves the session's MCP configuration defaults, a list selects exactly those server/tool names, and an empty list explicitly disables direct tools. The legacy environment override is removed; parent sessions should use MCP configuration instead.
 
 When you change direct-tool toggles in `/mcp` or write new config through `/mcp setup`, the extension triggers Pi's normal reload flow automatically. That refreshes extensions, prompts, skills, and MCP tool registration in one shot, so newly configured direct tools can appear without a manual restart.
 

package/dist/builtin/mcp/glimpse-ui.ts

@@ -3,6 +3,7 @@ import { execFileSync } from "node:child_process";
 import { join, dirname } from "node:path";
 import { platform } from "node:os";
 import { createRequire } from "node:module";
+import { createChildProcessEnvironment } from "@bastani/atomic";
 
 let glimpseAvailable: boolean | null = null;
 let resolvedBinaryPath: string | null = null;
@@ -35,7 +36,7 @@ function getGlimpseBinaryPath(): string | null {
 
   // Global npm install
   try {
-    const globalRoot = execFileSync("npm", ["root", "-g"], { encoding: "utf-8" }).trim();
+    const globalRoot = execFileSync("npm", ["root", "-g"], { encoding: "utf-8", env: createChildProcessEnvironment() }).trim();
     const binaryPath = join(globalRoot, "glimpseui", "src", "glimpse");
     if (existsSync(binaryPath)) return binaryPath;
   } catch {}

package/dist/builtin/mcp/index.ts

@@ -1,4 +1,4 @@
-import type { AgentToolUpdateCallback, ExtensionAPI, ExtensionContext, ToolInfo } from "@bastani/atomic";
+import { isStaleExtensionContextError, type AgentToolUpdateCallback, type ExtensionAPI, type ExtensionContext, type SubagentChildPolicy, type ToolInfo } from "@bastani/atomic";
 import type { McpExtensionState } from "./state.js";
 import type { McpConfig } from "./types.ts";
 import type { MetadataCache } from "./metadata-cache.js";
@@ -12,12 +12,6 @@ import { loadMcpConfig } from "./config.ts";
 import { getConfigPathFromArgv } from "./utils.js";
 import { renderMcpToolResult } from "./tool-result-renderer.js";
 
-/**
- * Marker substring from the host's stale-context error (see ExtensionRunner.invalidate).
- * A captured `pi`/`ctx` becomes stale when its backing session is disposed (e.g. a
- * workflow child stage session, or a reload/replace) without emitting `session_shutdown`.
- */
-const STALE_EXTENSION_CONTEXT_MARKER = "extension ctx is stale";
 const STALE_INITIALIZATION_PREFIX = "Stale MCP session initialization cancelled";
 
 interface ActiveMcpSession {
@@ -26,10 +20,6 @@ interface ActiveMcpSession {
   readonly cleanup: Promise<void>;
 }
 
-function isStaleExtensionContextError(error: unknown): boolean {
-  return error instanceof Error && error.message.includes(STALE_EXTENSION_CONTEXT_MARKER);
-}
-
 /** Probe the host guard to determine whether a captured context remains active. */
 function isContextActive(ctx: ExtensionContext): boolean {
   try {
@@ -55,22 +45,15 @@ export default function mcpAdapter(pi: ExtensionAPI) {
   async function registerDirectToolsFromConfig(
     config: McpConfig,
     cache: MetadataCache | null,
+    subagentPolicy?: SubagentChildPolicy,
   ): Promise<{ directToolCount: number; missingConfiguredDirectToolServers: string[] }> {
     const [{ resolveDirectTools, createDirectToolExecutor, getMissingConfiguredDirectToolServers }, { truncateAtWord }] = await Promise.all([
       import("./direct-tools.ts"),
       import("./utils.js"),
     ]);
     const prefix = config.settings?.toolPrefix ?? "server";
-    const envRaw = process.env.MCP_DIRECT_TOOLS;
-    const envDirectTools = envRaw?.split(",").map(s => s.trim()).filter(Boolean);
-    const directSpecs = envRaw === "__none__"
-      ? []
-      : resolveDirectTools(
-          config,
-          cache,
-          prefix,
-          envDirectTools,
-        );
+    const directTools = subagentPolicy?.mcpDirectTools;
+    const directSpecs = resolveDirectTools(config, cache, prefix, directTools === undefined ? undefined : [...directTools]);
     for (const spec of directSpecs) {
       if (registeredDirectToolNames.has(spec.prefixedName)) continue;
       registeredDirectToolNames.add(spec.prefixedName);
@@ -92,13 +75,13 @@ export default function mcpAdapter(pi: ExtensionAPI) {
     refreshTools?.();
     return {
       directToolCount: directSpecs.length,
-      missingConfiguredDirectToolServers: getMissingConfiguredDirectToolServers(config, cache, envDirectTools),
+      missingConfiguredDirectToolServers: getMissingConfiguredDirectToolServers(config, cache, directTools),
     };
   }
 
-  async function registerDirectTools(nextState: McpExtensionState): Promise<{ directToolCount: number; missingConfiguredDirectToolServers: string[] }> {
+  async function registerDirectTools(nextState: McpExtensionState, subagentPolicy?: SubagentChildPolicy): Promise<{ directToolCount: number; missingConfiguredDirectToolServers: string[] }> {
     const { loadMetadataCache } = await import("./metadata-cache.js");
-    return registerDirectToolsFromConfig(nextState.config, loadMetadataCache());
+    return registerDirectToolsFromConfig(nextState.config, loadMetadataCache(), subagentPolicy);
   }
 
   async function shutdownOAuthFlow(reason: string): Promise<void> {
@@ -196,7 +179,7 @@ export default function mcpAdapter(pi: ExtensionAPI) {
         throw new Error(`${STALE_INITIALIZATION_PREFIX} after startup`);
       }
 
-      const directToolState = await registerDirectTools(initializedState);
+      const directToolState = await registerDirectTools(initializedState, session.ctx.subagentPolicy);
       if (!isCurrentSession(session) || initPromise !== expectedPromise.current) {
         throw new Error(`${STALE_INITIALIZATION_PREFIX} after tool registration`);
       }
@@ -211,10 +194,11 @@ export default function mcpAdapter(pi: ExtensionAPI) {
       updateStatusBar(initializedState);
       let cancelWarmup: (() => void) | null = null;
       const warmup = scheduleMcpStartupWarmup(initializedState, {
+        subagentPolicy: session.ctx.subagentPolicy,
         shouldContinue: () => isCurrentSession(session) && state === initializedState,
         onDirectToolsChanged: async () => {
           if (!isCurrentSession(session) || state !== initializedState) return;
-          await registerDirectTools(initializedState);
+          await registerDirectTools(initializedState, session.ctx.subagentPolicy);
         },
         onSettled: () => {
           if (isCurrentSession(session) && state === initializedState && startupWarmupCancel === cancelWarmup) {

package/dist/builtin/mcp/mcp-panel.ts

@@ -101,82 +101,76 @@ class McpPanel {
     return buildMcpPanelResult(this.servers);
   }
 
-  handleInput(data: string): void {
+  handleInput(data: string): boolean {
     this.resetInactivityTimeout();
     this.importNotice = null;
     if (!this.authInFlight) this.authNotice = null;
 
-    if (this.confirmingDiscard) {
-      this.handleDiscardInput(data);
-      return;
-    }
+    if (this.confirmingDiscard) return this.handleDiscardInput(data);
 
     if (matchesKey(data, "ctrl+c")) {
       this.cleanup();
       this.done({ cancelled: true, changes: new Map() });
-      return;
+      return true;
     }
 
     if (matchesKey(data, "ctrl+s")) {
       this.cleanup();
       this.done(this.buildResult());
-      return;
+      return true;
     }
 
-    if (this.descSearchActive) {
-      this.handleDescriptionSearchInput(data);
-      return;
-    }
+    if (this.descSearchActive) return this.handleDescriptionSearchInput(data);
 
     if (matchesKey(data, "escape")) {
       if (this.nameQuery) {
         this.nameQuery = "";
         this.rebuildVisibleItemsAndClampCursor();
-        return;
+        return true;
       }
       if (this.dirty) {
         this.confirmingDiscard = true;
         this.discardSelected = 1;
-        return;
+        return true;
       }
       this.cleanup();
       this.done({ cancelled: true, changes: new Map() });
-      return;
+      return true;
     }
 
-    if (matchesKey(data, "up")) { this.moveCursor(-1); return; }
-    if (matchesKey(data, "down")) { this.moveCursor(1); return; }
+    if (matchesKey(data, "up")) { this.moveCursor(-1); return true; }
+    if (matchesKey(data, "down")) { this.moveCursor(1); return true; }
 
     if (matchesKey(data, "space")) {
       const item = this.visibleItems[this.cursorIndex];
       if (item && !this.authOnly) this.toggleItem(item);
-      return;
+      return true;
     }
 
     if (matchesKey(data, "return")) {
       const item = this.visibleItems[this.cursorIndex];
       if (item) this.activateItem(item);
-      return;
+      return true;
     }
 
     if (matchesKey(data, "ctrl+a")) {
       const item = this.visibleItems[this.cursorIndex];
       if (item) this.authenticateSelectedServer(item);
-      return;
+      return true;
     }
 
     if (matchesKey(data, "ctrl+r")) {
       const item = this.visibleItems[this.cursorIndex];
       if (item) this.reconnectSelectedServer(item);
-      return;
+      return true;
     }
 
     if (data === "?") {
-      if (this.authOnly) return;
+      if (this.authOnly) return false;
       this.descSearchActive = true;
       this.descQuery = "";
       this.rebuildVisibleItemsAndClampCursor();
-      return;
+      return true;
     }
 
     if (matchesKey(data, "backspace")) {
@@ -184,42 +178,47 @@ class McpPanel {
         this.nameQuery = this.nameQuery.slice(0, -1);
         this.rebuildVisibleItemsAndClampCursor();
       }
-      return;
+      return true;
     }
 
     if (data.length === 1 && data.charCodeAt(0) >= 32) {
       this.nameQuery += data;
       this.rebuildVisibleItemsAndClampCursor();
+      return true;
     }
+    return false;
   }
 
-  private handleDescriptionSearchInput(data: string): void {
+  private handleDescriptionSearchInput(data: string): boolean {
     if (matchesKey(data, "escape") || matchesKey(data, "return")) {
       this.descSearchActive = false;
       this.descQuery = "";
       this.rebuildVisibleItemsAndClampCursor();
-      return;
+      return true;
     }
     if (matchesKey(data, "backspace")) {
       if (this.descQuery.length > 0) {
         this.descQuery = this.descQuery.slice(0, -1);
         this.rebuildVisibleItemsAndClampCursor();
       }
-      return;
+      return true;
     }
-    if (matchesKey(data, "up")) { this.moveCursor(-1); return; }
-    if (matchesKey(data, "down")) { this.moveCursor(1); return; }
+    if (matchesKey(data, "up")) { this.moveCursor(-1); return true; }
+    if (matchesKey(data, "down")) { this.moveCursor(1); return true; }
     if (matchesKey(data, "space")) {
       const item = this.visibleItems[this.cursorIndex];
       if (item) this.toggleItem(item);
-      return;
+      return true;
     }
     if (data.length === 1 && data.charCodeAt(0) >= 32) {
       this.descQuery += data;
       this.rebuildVisibleItemsAndClampCursor();
+      return true;
     }
+    return false;
   }
 
+
   private activateItem(item: VisibleItem): void {
     const server = this.servers[item.serverIndex];
     if (item.type === "server") {
@@ -316,15 +315,15 @@ class McpPanel {
     this.updateDirty();
   }
 
-  private handleDiscardInput(data: string): void {
+  private handleDiscardInput(data: string): boolean {
     if (matchesKey(data, "ctrl+c")) {
       this.cleanup();
       this.done({ cancelled: true, changes: new Map() });
-      return;
+      return true;
     }
     if (matchesKey(data, "escape") || data === "n" || data === "N") {
       this.confirmingDiscard = false;
-      return;
+      return true;
     }
     if (matchesKey(data, "return")) {
       if (this.discardSelected === 0) {
@@ -333,16 +332,18 @@ class McpPanel {
       } else {
         this.confirmingDiscard = false;
       }
-      return;
+      return true;
     }
     if (data === "y" || data === "Y") {
       this.cleanup();
       this.done({ cancelled: true, changes: new Map() });
-      return;
+      return true;
     }
     if (matchesKey(data, "left") || matchesKey(data, "right") || matchesKey(data, "tab")) {
       this.discardSelected = this.discardSelected === 0 ? 1 : 0;
+      return true;
     }
+    return false;
   }
 
   private moveCursor(delta: number): void {

package/dist/builtin/mcp/mcp-setup-panel.ts

@@ -114,96 +114,98 @@ export class McpSetupPanel {
     const actions = this.getActions();
     return actions[this.actionCursor] ?? null;
   }
-  handleInput(data: string): void {
+  handleInput(data: string): boolean {
     this.resetInactivityTimeout();
     if (!this.busy) this.notice = null;
     if (matchesKey(data, "ctrl+c")) {
       this.cleanup();
       this.done();
-      return;
+      return true;
     }
     if (matchesKey(data, "escape")) {
       if (this.screen === "imports" || this.screen === "paths") {
         this.screen = this.discovery.hasAnyConfig ? "setup" : "empty";
         this.tui.requestRender();
-        return;
+        return true;
       }
       this.cleanup();
       this.done();
-      return;
-    }
-    if (this.busy) return;
-    if (this.screen === "imports") {
-      this.handleImportsInput(data);
-      return;
-    }
-    if (this.screen === "paths") {
-      this.handlePathsInput(data);
-      return;
+      return true;
     }
+    if (this.busy) return true;
+    if (this.screen === "imports") return this.handleImportsInput(data);
+    if (this.screen === "paths") return this.handlePathsInput(data);
     const actions = this.getActions();
     if (matchesKey(data, "up")) {
       this.actionCursor = Math.max(0, this.actionCursor - 1);
       this.tui.requestRender();
-      return;
+      return true;
     }
     if (matchesKey(data, "down")) {
       this.actionCursor = Math.min(actions.length - 1, this.actionCursor + 1);
       this.tui.requestRender();
-      return;
+      return true;
     }
     if (matchesKey(data, "return")) {
       const selected = this.getSelectedAction();
       if (selected) void this.runAction(selected.id);
+      return true;
     }
+    return false;
   }
-  private handleImportsInput(data: string): void {
+  private handleImportsInput(data: string): boolean {
     const imports = this.discovery.imports;
     if (matchesKey(data, "up")) {
       this.importCursor = Math.max(0, this.importCursor - 1);
       this.tui.requestRender();
-      return;
+      return true;
     }
     if (matchesKey(data, "down")) {
       this.importCursor = Math.min(imports.length - 1, this.importCursor + 1);
       this.tui.requestRender();
-      return;
+      return true;
     }
     if (matchesKey(data, "space")) {
       const current = imports[this.importCursor];
-      if (!current) return;
-      if (this.selectedImports.has(current.kind)) {
-        this.selectedImports.delete(current.kind);
-      } else {
-        this.selectedImports.add(current.kind);
+      if (current) {
+        if (this.selectedImports.has(current.kind)) {
+          this.selectedImports.delete(current.kind);
+        } else {
+          this.selectedImports.add(current.kind);
+        }
+        this.tui.requestRender();
       }
-      this.tui.requestRender();
-      return;
+      return true;
     }
     if (matchesKey(data, "return")) {
       void this.applySelectedImports();
+      return true;
     }
+    return false;
   }
-  private handlePathsInput(data: string): void {
+  private handlePathsInput(data: string): boolean {
     const paths = this.getDetectedPaths();
     if (matchesKey(data, "up")) {
       this.pathCursor = Math.max(0, this.pathCursor - 1);
       this.tui.requestRender();
-      return;
+      return true;
     }
     if (matchesKey(data, "down")) {
       this.pathCursor = Math.min(paths.length - 1, this.pathCursor + 1);
       this.tui.requestRender();
-      return;
+      return true;
     }
     if (matchesKey(data, "return")) {
       const selected = paths[this.pathCursor];
-      if (!selected) return;
-      void this.runBusy(async () => {
-        await this.callbacks.openPath(selected);
-        this.notice = { text: `Opened ${selected}`, tone: "success" };
-      });
+      if (selected) {
+        void this.runBusy(async () => {
+          await this.callbacks.openPath(selected);
+          this.notice = { text: `Opened ${selected}`, tone: "success" };
+        });
+      }
+      return true;
     }
+    return false;
   }
   private async runAction(action: ActionId): Promise<void> {
     if (action === "run-setup") {

package/dist/builtin/mcp/npx-resolver.ts

@@ -2,6 +2,7 @@
 import { existsSync, readFileSync, realpathSync, readdirSync, statSync, writeFileSync, renameSync, mkdirSync, openSync, readSync, closeSync } from "node:fs";
 import { join, dirname, extname, resolve, sep } from "node:path";
 import { getAgentPath } from "./agent-dir.ts";
+import { createChildProcessEnvironment } from "@bastani/atomic";
 import { spawn, spawnSync } from "node:child_process";
 
 const CACHE_VERSION = 1;
@@ -234,7 +235,7 @@ async function forceNpxCache(packageSpec: string): Promise<void> {
       const proc = spawn(
         "npm",
         ["exec", "--yes", "--package", packageSpec, "--", "node", "-e", "1"],
-        { stdio: "ignore" }
+        { stdio: "ignore", env: createChildProcessEnvironment() }
       );
       const timer = setTimeout(() => {
         proc.kill();
@@ -352,7 +353,7 @@ function getNpmCacheDir(): string | null {
     return npmCacheDirCached;
   }
   try {
-    const result = spawnSync("npm", ["config", "get", "cache"], { encoding: "utf-8" });
+    const result = spawnSync("npm", ["config", "get", "cache"], { encoding: "utf-8", env: createChildProcessEnvironment() });
     if (result.status === 0) {
       const path = String(result.stdout).trim();
       npmCacheDirCached = path || null;

package/dist/builtin/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/mcp",
-  "version": "0.9.12",
+  "version": "0.9.13-alpha.2",
   "private": true,
   "description": "Atomic extension that adapts MCP (Model Context Protocol) servers into the coding agent. Fork of: https://github.com/nicobailon/pi-mcp-adapter",
   "contributors": [
@@ -32,8 +32,8 @@
   },
   "peerDependencies": {
     "@bastani/atomic": "*",
-    "@earendil-works/pi-ai": "^0.83.0",
-    "@earendil-works/pi-tui": "^0.83.0",
+    "@earendil-works/pi-ai": "^0.84.1",
+    "@earendil-works/pi-tui": "^0.84.1",
     "zod": "^3.25.0 || ^4.0.0"
   },
   "peerDependenciesMeta": {

package/dist/builtin/mcp/sampling-handler.ts

@@ -152,7 +152,11 @@ async function resolveSamplingModel(
       errors.push(`${model.provider}/${model.id}: ${auth.error}`);
       continue;
     }
-		return { model, apiKey: auth.apiKey, headers: auth.headers };
+    return {
+      model: auth.baseUrl === undefined || auth.baseUrl === model.baseUrl ? model : { ...model, baseUrl: auth.baseUrl },
+      apiKey: auth.apiKey,
+      headers: auth.headers,
+    };
   }
 
   if (errors.length > 0) {

package/dist/builtin/mcp/server-manager.ts

@@ -4,6 +4,7 @@ import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
 import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
 import type { ReadResourceResult } from "@modelcontextprotocol/sdk/types.js";
+import { createChildProcessEnvironment } from "@bastani/atomic";
 import type {
   McpTool,
   McpResource,
@@ -353,18 +354,14 @@ export class McpServerManager {
  * Resolve environment variables with interpolation.
  */
 function resolveEnv(env?: Record<string, string>): Record<string, string> {
-  // Copy process.env, filtering out undefined values
+  const overrides = env ? interpolateEnvRecord(env) : undefined;
   const resolved: Record<string, string> = {};
-  for (const [key, value] of Object.entries(process.env)) {
+  for (const [key, value] of Object.entries(createChildProcessEnvironment(overrides))) {
     if (value !== undefined) {
       resolved[key] = value;
     }
   }
-  
-  if (!env) return resolved;
-
-  const overrides = interpolateEnvRecord(env);
-  return overrides ? { ...resolved, ...overrides } : resolved;
+  return resolved;
 }
 
 /**