@code-yeongyu/senpi 2026.10.10-4 → 2026.10.10-6

package/dist/core/extensions/builtin/mcp/service.js

@@ -1,9 +1,9 @@
 import { getAgentDir } from "../../../../config.js";
 import { getToolSearchService, getToolSearchServiceForExtension, resetToolSearchServiceForTests, ToolSearchService, } from "../tool-search/service.js";
+import { mcpCredentialIdentity } from "./auth/catalog-identity.js";
 import { resolveAuthMode } from "./auth/context.js";
-import { getValidCachedServer, readMcpCatalogCache } from "./catalog-cache.js";
+import { cachedCatalogNeedsRefresh, getValidCachedServer, readMcpCatalogCache } from "./catalog-cache.js";
 import { loadMcpConfig, mergeExtensionMcpServers, visitSpawnableMcpServers } from "./config.js";
-import { collectAllPages } from "./expose/pagination.js";
 import { cleanupMcpOutputArtifacts, McpOutputArtifacts } from "./guard/output-guard.js";
 import { HostMcpRegistry } from "./host-registry.js";
 import { refreshMcpInstructionsForSession } from "./instructions.js";
@@ -15,7 +15,7 @@ import { registerMcpServiceDirectTools } from "./service-register.js";
 import { buildMcpServerSnapshot } from "./service-snapshot.js";
 import { refreshMcpToolsOnListChanged, subscribeMcpToolsChanged } from "./service-tools-changed.js";
 import { resolveSkillMcpServer } from "./skill-server.js";
-import { MCP_ATTACH_SETTLE_TIMEOUT_MS, McpDeferredAttach, raceMcpStartupConnect, resolveMcpStartupTimeoutMs, shouldRaceMcpStartup, } from "./startup-race.js";
+import { MCP_ATTACH_SETTLE_TIMEOUT_MS, McpDeferredAttach, raceMcpStartupConnect, shouldRaceMcpStartup, } from "./startup-race.js";
 import { safeTimer } from "./wrap.js";
 export { registerToolsPreservingActiveSet } from "./active-set.js";
 export class McpService {
@@ -86,7 +86,8 @@ export class McpService {
                 projectTrusted: sessionOptions.projectTrusted ?? ctx.isProjectTrusted(),
             });
             mergeExtensionMcpServers(config, ctx.getRegisteredMcpServers?.() ?? []);
-            this.#config = config;
+            // Equivalent peer attachment must not retire another session's configuration fence.
+            this.#config = JSON.stringify(this.#config) === JSON.stringify(config) ? this.#config : config;
             const binding = _pi === undefined || this.#releasedSessions.has(_pi) ? undefined : this.#bind(_pi, ctx);
             this.#authAgentDir = sessionOptions.agentDir;
             this.#authEnv = sessionOptions.env;
@@ -373,7 +374,8 @@ export class McpService {
     }
     getConnection(name) {
         const key = this.#connectionKeysByName.get(name);
-        return key === undefined ? undefined : this.#connections.get(key)?.connection;
+        const entry = key === undefined ? undefined : this.#connections.get(key);
+        return entry?.credentialsCurrent?.() === false ? undefined : entry?.connection;
     }
     async reconnectServer(name) {
         const entry = this.#entryForName(name);
@@ -431,13 +433,19 @@ export class McpService {
         const hadConnectionsBeforeSync = this.#connections.size > 0;
         this.#refreshActiveSetWhenNoTools = Object.keys(config.servers).length > 0 || hadConnectionsBeforeSync;
         const wanted = new Map();
+        const credentialIdentities = new Map();
         visitSpawnableMcpServers(config, (name, server) => {
             wanted.set(name, server);
+            if (server.config !== undefined) {
+                credentialIdentities.set(name, mcpCredentialIdentity(server.config, name, options.agentDir, options.env));
+            }
         });
         const disposals = [];
         for (const entry of this.#connections.values()) {
             const server = wanted.get(entry.name);
-            const key = server?.configHash === undefined ? undefined : `${entry.name}\0${server.configHash}`;
+            const key = server?.configHash === undefined
+                ? undefined
+                : `${entry.name}\0${server.configHash}\0${credentialIdentities.get(entry.name) ?? "unknown"}`;
             if (key === entry.key)
                 continue;
             this.#connections.delete(entry.key);
@@ -449,7 +457,9 @@ export class McpService {
         for (const [name, server] of wanted) {
             if (server.config === undefined || server.configHash === undefined)
                 continue;
-            const key = `${name}\0${server.configHash}`;
+            const serverConfig = server.config;
+            const credentialIdentity = credentialIdentities.get(name);
+            const key = `${name}\0${server.configHash}\0${credentialIdentity ?? "unknown"}`;
             if (this.#connections.has(key))
                 continue;
             const entry = createMcpSessionConnection({
@@ -460,13 +470,27 @@ export class McpService {
                 name,
                 configHash: server.configHash,
                 config: server.config,
+                credentialIdentity,
+                credentialsCurrent: () => mcpCredentialIdentity(serverConfig, name, options.agentDir, options.env) === credentialIdentity,
+                onCredentialsChanged: async () => {
+                    if (this.#disposed || this.#config !== config || this.#entryForName(name) !== entry)
+                        return;
+                    await this.#syncFromConfig(config, options, true, binding);
+                    for (const live of this.#liveBindings())
+                        await this.#registerDirectTools(live);
+                },
                 session: options,
                 cwd: this.#sessionContext?.cwd ?? process.cwd(),
                 ui: () => this.getMcpElicitationUi(),
                 artifacts: this.#outputArtifacts,
-                shouldReconnect: (current) => !this.#disposed && this.#entryForName(name) === current,
+                shouldReconnect: (current) => !this.#disposed &&
+                    this.#entryForName(name) === current &&
+                    this.#config?.servers[name]?.state === "enabled" &&
+                    this.#config.servers[name]?.configHash === current.configHash,
             });
-            const cachedCatalog = useCache ? getValidCachedServer(cache, name, server.configHash) : undefined;
+            const cachedCatalog = useCache && credentialIdentity !== undefined
+                ? getValidCachedServer(cache, name, server.configHash, credentialIdentity)
+                : undefined;
             entry.cachedCatalog = cachedCatalog;
             this.#connections.set(key, entry);
             this.#connectionKeysByName.set(name, key);
@@ -475,9 +499,11 @@ export class McpService {
             // the background past the deadline (eager/keep-alive always; a cold lazy
             // server that has no cached catalog also races so a slow/wedged server
             // never gates attachSession -> before_agent_start -> the first turn).
-            // A cached lazy server needs no startup connect: its tools come from the
-            // cache and it connects on demand at tool-call time.
-            if (shouldRaceMcpStartup(server.config.lifecycle) || cachedCatalog === undefined) {
+            // A fresh cached lazy server connects only on demand. An aged matching
+            // catalog remains usable while its background refresh runs.
+            if (shouldRaceMcpStartup(server.config.lifecycle) ||
+                cachedCatalog === undefined ||
+                cachedCatalogNeedsRefresh(cachedCatalog)) {
                 connects.push(raceMcpStartupConnect({
                     entry,
                     pi: binding?.pi,
@@ -510,7 +536,7 @@ export class McpService {
                     // A later attach does not supersede this catalog: it registers in every live session. Skip it only
                     // once the service is gone or this connection was replaced (#2524 review).
                     shouldRefreshTools: () => !this.#disposed && this.#entryForName(name) === entry,
-                    deadlineMs: resolveMcpStartupTimeoutMs(server.config.startupTimeoutMs),
+                    deadlineMs: 0,
                     onDeferred: (settled) => this.#deferredAttach.track(settled),
                 }));
             }
@@ -553,6 +579,16 @@ export class McpService {
         binding.registration = await registerMcpServiceDirectTools(binding.pi, config, this.#connections.values(), toolSearchService, {
             refreshActiveSetWhenEmpty: this.#refreshActiveSetWhenNoTools,
             onRegistered: (entry, identity) => binding.registeredIdentities.set(entry.key, identity),
+            contextRequired: binding.context.mode !== undefined,
+            sessionManager: binding.context.sessionManager,
+            isCurrent: (entry) => !this.#disposed &&
+                this.#config === config &&
+                this.#bindings.get(binding.pi) === binding &&
+                this.#entryForName(entry.name) === entry,
+            publishCurrent: async () => {
+                if (this.#bindings.get(binding.pi) === binding)
+                    await this.#registerDirectTools(binding);
+            },
         });
         const ctx = binding.context;
         if (ctx.mode === "rpc") {
@@ -571,9 +607,17 @@ export class McpService {
         return ((binding === undefined ? undefined : this.#toolSearchFor(binding)?.maybeRehydrateFromHistory(messages)) ?? []);
     }
     #serverSnapshot(name) {
+        const entry = this.#entryForName(name);
+        const config = this.#config?.servers[name]?.config;
         const connection = this.getConnection(name);
         connection?.refreshCapturedDiagnostics();
-        return buildMcpServerSnapshot(name, this.#config?.servers[name], connection, this.#entryForName(name));
+        const snapshot = buildMcpServerSnapshot(name, this.#config?.servers[name], connection, entry);
+        if (config !== undefined &&
+            entry?.connection.state === "needs_auth" &&
+            mcpCredentialIdentity(config, name, entry.agentDir, this.#authEnv) === undefined) {
+            return { ...snapshot, lifecycleState: "needs_auth", lastError: entry.connection.lastError?.message ?? null };
+        }
+        return snapshot;
     }
     async #captureWireStatus(sessionId) {
         const config = this.#config;
@@ -594,42 +638,19 @@ export class McpService {
     }
     async #captureWireStatusServer(name, server) {
         const entry = this.#entryForName(name);
-        const connection = entry?.connection;
+        const connection = this.getConnection(name);
         const connected = connection?.state === "connected";
-        const cached = entry?.cachedCatalog;
-        let tools = cached?.tools ?? [];
-        let resources = cached?.resources ?? [];
-        let resourceTemplates = [];
+        const needsAuth = !connected && this.#serverSnapshot(name).lifecycleState === "needs_auth";
+        const cached = entry?.credentialsCurrent?.() === false ? undefined : entry?.cachedCatalog;
+        const tools = cached?.tools ?? [];
+        const resources = cached?.resources ?? [];
+        const resourceTemplates = cached?.resourceTemplates ?? [];
         let serverInfo = null;
         if (connected && connection !== undefined) {
             const client = connection.client;
             const version = client.getServerVersion();
             if (version !== undefined)
                 serverInfo = mapWireServerInfo(version);
-            try {
-                tools = (await collectAllPages((cursor) => client.listTools(cursor === undefined ? {} : { cursor }))).items;
-            }
-            catch (error) {
-                if (!(error instanceof Error))
-                    throw error;
-                tools = cached?.tools ?? [];
-            }
-            try {
-                resources = (await collectAllPages((cursor) => client.listResources(cursor === undefined ? {} : { cursor }))).items;
-            }
-            catch (error) {
-                if (!(error instanceof Error))
-                    throw error;
-                resources = cached?.resources ?? [];
-            }
-            try {
-                resourceTemplates = (await collectAllPages((cursor) => client.listResourceTemplates(cursor === undefined ? {} : { cursor }))).items;
-            }
-            catch (error) {
-                if (!(error instanceof Error))
-                    throw error;
-                resourceTemplates = [];
-            }
         }
         return {
             name,
@@ -637,10 +658,16 @@ export class McpService {
             tools: tools.map(mapWireTool),
             resources: resources.map(mapWireResource),
             resourceTemplates: resourceTemplates.map(mapWireResourceTemplate),
-            authStatus: wireAuthStatus(entry, server),
+            authStatus: wireAuthStatus(entry, server, this.#authEnv),
             ...(connection?.state === undefined && server?.state === undefined
                 ? {}
-                : { status: connection?.state ?? server?.state }),
+                : {
+                    status: needsAuth
+                        ? "needs_auth"
+                        : entry?.startupCatalogClaim?.ownsRegistration()
+                            ? "connecting"
+                            : (connection?.state ?? server?.state),
+                }),
         };
     }
     #entryForName(name) {
@@ -651,6 +678,9 @@ export class McpService {
         this.#mcpInstructions = instructions;
     }
     getMcpInstructions() {
+        if ([...this.#connections.values()].some((entry) => entry.credentialsCurrent?.() === false)) {
+            refreshMcpInstructionsForSession(this);
+        }
         return this.#mcpInstructions;
     }
     setMcpElicitationUiProvider(provider) {
@@ -690,10 +720,11 @@ export class McpService {
     }
     /** Live auth status without fetching catalogs or exposing credentials. */
     getServerAuthStatus(name) {
-        return wireAuthStatus(this.#entryForName(name), this.#config?.servers[name]);
+        return wireAuthStatus(this.#entryForName(name), this.#config?.servers[name], this.#authEnv);
     }
     getCachedInstructions(name) {
-        return this.#entryForName(name)?.cachedCatalog?.instructions;
+        const entry = this.#entryForName(name);
+        return entry?.credentialsCurrent?.() === false ? undefined : entry?.cachedCatalog?.instructions;
     }
     /** Resolved `settings.nativeToolSearch` (auto | true | false | undefined).
      * Drives the native provider tool-search adapter gate. */
@@ -701,7 +732,7 @@ export class McpService {
         return this.#config?.settings.nativeToolSearch;
     }
 }
-function wireAuthStatus(entry, server) {
+function wireAuthStatus(entry, server, env) {
     const mode = entry?.authPlan?.mode ?? (server?.config === undefined ? "none" : resolveAuthMode(server.config));
     switch (mode) {
         case "none":
@@ -709,7 +740,10 @@ function wireAuthStatus(entry, server) {
         case "bearer":
             return entry?.connection.state === "needs_auth" ? "notLoggedIn" : "bearerToken";
         case "oauth":
-            return entry?.authPlan?.provider?.tokens() === undefined ? "notLoggedIn" : "oAuth";
+            return server?.config === undefined ||
+                mcpCredentialIdentity(server.config, server.name, entry?.agentDir, env) === undefined
+                ? "notLoggedIn"
+                : "oAuth";
         default:
             return assertNever(mode);
     }

package/dist/core/extensions/builtin/mcp/shared-connection.js

@@ -149,14 +149,27 @@ export class SharedMcpConnection {
     }
     async #collectCatalog() {
         const generation = this.connection.generation;
-        const catalog = await collectServerCatalogForCache(this.connection, this.#options.config, this.#options.configHash);
-        if (generation !== this.connection.generation || this.#disposed)
+        const ownsCatalog = () => generation === this.connection.generation &&
+            !this.#disposed &&
+            [...this.leases].some((lease) => lease.options.credentialsCurrent?.() !== false);
+        const catalog = await collectServerCatalogForCache(this.connection, this.#options.config, this.#options.configHash, this.#options.credentialIdentity);
+        if (!ownsCatalog())
             return catalog;
         if (this.#cacheGeneration !== generation) {
             this.#cacheGeneration = generation;
-            await writeMcpCachedServer(this.#options.agentDir, this.#options.serverName, catalog);
+            try {
+                await writeMcpCachedServer(this.#options.agentDir, this.#options.serverName, catalog, ownsCatalog);
+            }
+            catch (error) {
+                for (const lease of this.leases) {
+                    lease.options.logger.warn("Failed to persist MCP catalog cache", {
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                }
+            }
         }
-        await ensureMcpResourceSubscriptions(this.connection.client, catalog.resources);
+        if (ownsCatalog())
+            await ensureMcpResourceSubscriptions(this.connection.client, catalog.resources);
         return catalog;
     }
     async dispose() {

package/dist/core/extensions/builtin/mcp/sharing-policy.js

@@ -21,6 +21,7 @@ export function sharedMcpKey(options, agentDir) {
     const { config, env } = options;
     const bearer = config.bearerTokenEnv;
     const identity = {
+        credentialIdentity: options.credentialIdentity,
         agentDir,
         name: options.serverName,
         type: config.type,

package/dist/core/extensions/builtin/mcp/startup-race.js

@@ -64,6 +64,7 @@ export async function raceMcpStartupConnect(options) {
     const claim = {
         cachedCatalog: entry.cachedCatalog,
         ownsRegistration: () => pi !== undefined && options.shouldRefreshTools(),
+        settled: () => connect,
     };
     entry.startupCatalogClaim = claim;
     const releaseClaim = () => {
@@ -76,8 +77,22 @@ export async function raceMcpStartupConnect(options) {
         return;
     options.onDeferred(connect.then(() => refreshMcpToolsAfterStartupRace(options)));
 }
-export async function connectAndRefreshMcpCatalog(entry, serverConfig) {
-    if (serverConfig === undefined)
+const catalogRefreshes = new WeakMap();
+export function connectAndRefreshMcpCatalog(entry, serverConfig) {
+    const pending = catalogRefreshes.get(entry);
+    if (pending !== undefined)
+        return pending;
+    const refresh = refreshConnectedMcpCatalog(entry, serverConfig);
+    catalogRefreshes.set(entry, refresh);
+    const finish = () => {
+        if (catalogRefreshes.get(entry) === refresh)
+            catalogRefreshes.delete(entry);
+    };
+    void refresh.then(finish, finish);
+    return refresh;
+}
+async function refreshConnectedMcpCatalog(entry, serverConfig) {
+    if (serverConfig === undefined || entry.isCurrent?.() === false)
         return;
     try {
         await entry.authPlan?.refresh?.ensureFresh();
@@ -90,24 +105,47 @@ export async function connectAndRefreshMcpCatalog(entry, serverConfig) {
         }
         throw error;
     }
+    if (entry.credentialsCurrent?.() === false) {
+        await entry.onCredentialsChanged?.();
+        return;
+    }
     await connectMcpServer(entry.connection, entry.logger);
-    if (entry.connection.state !== "connected")
+    if (entry.connection.state !== "connected" || entry.isCurrent?.() === false)
         return;
+    const generation = entry.connection.generation;
+    const ownsCatalog = () => entry.isCurrent?.() !== false &&
+        entry.credentialsCurrent?.() !== false &&
+        entry.connection.state === "connected" &&
+        entry.connection.generation === generation;
     if (entry.connection instanceof SharedMcpLease) {
-        entry.cachedCatalog = await entry.connection.catalog();
+        const catalog = await entry.connection.catalog();
+        if (!ownsCatalog()) {
+            if (entry.credentialsCurrent?.() === false)
+                await entry.onCredentialsChanged?.();
+            return;
+        }
+        entry.cachedCatalog = catalog;
+        entry.catalogGeneration = generation;
         entry.cacheRefreshedAfterConnect = true;
         return;
     }
-    if (entry.cacheRefreshedAfterConnect)
+    if (entry.cacheRefreshedAfterConnect && entry.catalogGeneration === generation)
         return;
-    entry.cacheRefreshedAfterConnect = true;
     try {
-        const catalog = await collectServerCatalogForCache(entry.connection, serverConfig, entry.configHash);
+        const catalog = await collectServerCatalogForCache(entry.connection, serverConfig, entry.configHash, entry.credentialIdentity);
+        if (!ownsCatalog()) {
+            if (entry.credentialsCurrent?.() === false)
+                await entry.onCredentialsChanged?.();
+            return;
+        }
         entry.cachedCatalog = catalog;
-        await writeMcpCachedServer(entry.agentDir, entry.name, catalog);
+        entry.catalogGeneration = generation;
+        entry.cacheRefreshedAfterConnect = true;
+        await writeMcpCachedServer(entry.agentDir, entry.name, catalog, ownsCatalog);
         // Per-resource subscriptions (todo 39): only when the server declares
         // resources.subscribe; best-effort, failures are non-fatal.
-        await ensureMcpResourceSubscriptions(entry.connection.client, catalog.resources ?? []);
+        if (ownsCatalog())
+            await ensureMcpResourceSubscriptions(entry.connection.client, catalog.resources ?? []);
     }
     catch (error) {
         entry.logger.warn("Failed to refresh MCP catalog cache", {

package/dist/core/extensions/builtin/permission-system/dispatch-metadata.d.ts

@@ -0,0 +1,8 @@
+import type { ExtensionAPI, ExtensionContext, ToolCallEvent } from "../../types.ts";
+import { type DispatchAuthorizer, type DispatchIdentity } from "./dispatch.ts";
+type IdentityForInput = (input: Record<string, unknown>) => DispatchIdentity | undefined;
+export declare function registerDispatchIdentity(parameters: object, identity: IdentityForInput): void;
+export declare function getDispatchIdentity(parameters: object, input: Record<string, unknown>): DispatchIdentity | undefined;
+export declare function prepareMcpDispatchApproval(pi: Pick<ExtensionAPI, "getAllTools">, event: ToolCallEvent, ctx: ExtensionContext, authorizer: DispatchAuthorizer): (() => void) | undefined;
+export {};
+//# sourceMappingURL=dispatch-metadata.d.ts.map

package/dist/core/extensions/builtin/permission-system/dispatch-metadata.js

@@ -0,0 +1,23 @@
+import { prepareDispatchApproval } from "./dispatch.js";
+// ToolInfo retains the registered schema object. Its identity scopes metadata
+// to the offered definition, without adding private fields to provider schemas.
+const identities = new WeakMap();
+export function registerDispatchIdentity(parameters, identity) {
+    identities.set(parameters, identity);
+}
+export function getDispatchIdentity(parameters, input) {
+    return identities.get(parameters)?.(input);
+}
+export function prepareMcpDispatchApproval(pi, event, ctx, authorizer) {
+    // Other tools retain their existing preflight path, including calls while
+    // the extension runtime is still starting and cannot list tools (#2617).
+    if (!event.toolName.startsWith("mcp_"))
+        return undefined;
+    const tool = pi.getAllTools().find((candidate) => candidate.name === event.toolName);
+    const identity = tool === undefined ? undefined : getDispatchIdentity(tool.parameters, event.input);
+    if (identity === undefined)
+        return undefined;
+    const request = { ...event, identity };
+    return prepareDispatchApproval(ctx.sessionManager, request, authorizer.policy(request, ctx));
+}
+//# sourceMappingURL=dispatch-metadata.js.map

package/dist/core/extensions/builtin/permission-system/dispatch-policy.d.ts

@@ -0,0 +1,14 @@
+import type { ExtensionAPI, ExtensionContext, ToolCallEvent, ToolCallEventResult } from "../../types.ts";
+import type { DispatchAuthorizer } from "./dispatch.ts";
+import { type ParserRegistry } from "./parsers.ts";
+import type { PermissionService } from "./service.ts";
+import type { PermissionPresetName } from "./types.ts";
+export interface DispatchPermissionState {
+    readonly service: PermissionService | null;
+    readonly parsers: ParserRegistry | null;
+    readonly preset: PermissionPresetName | null;
+    readonly setupError: string | null;
+}
+/** Use the permission extension's live parser, evaluator and approval handler. */
+export declare function createDispatchAuthorizer(pi: Pick<ExtensionAPI, "getAllTools">, stateFor: (ctx: ExtensionContext) => DispatchPermissionState, authorize: (event: ToolCallEvent, ctx: ExtensionContext, signal?: AbortSignal) => Promise<ToolCallEventResult | undefined>): DispatchAuthorizer;
+//# sourceMappingURL=dispatch-policy.d.ts.map

package/dist/core/extensions/builtin/permission-system/dispatch-policy.js

@@ -0,0 +1,53 @@
+import { toolOwnedPermissionRequests } from "./parsers.js";
+/** Use the permission extension's live parser, evaluator and approval handler. */
+export function createDispatchAuthorizer(pi, stateFor, authorize) {
+    return {
+        policy(request, ctx) {
+            const state = stateFor(ctx);
+            if (state.setupError !== null)
+                throw new Error(`Permission setup failed: ${state.setupError}`);
+            const { service, parsers } = state;
+            if (!service || !parsers)
+                throw new Error("Permission authorizer is not initialized");
+            const requests = parsers.has(request.toolName)
+                ? parsers.parse(request.toolName, request.input, ctx.cwd)
+                : (toolOwnedPermissionRequests(pi.getAllTools(), request.toolName, request.input, ctx.cwd) ??
+                    parsers.parse(request.toolName, request.input, ctx.cwd));
+            let action = "allow";
+            const decisions = requests.map((permission) => {
+                const rules = permission.patterns.map((pattern) => service.dispatchDecision(permission.permission, permission.ruleAliases ?? pattern, {
+                    presetBound: state.preset === "auto",
+                }));
+                for (const decision of rules) {
+                    if (decision.action === "deny")
+                        action = "deny";
+                    else if (decision.action === "ask" && !permission.autoApproveAsk && action !== "deny")
+                        action = "ask";
+                }
+                return { permission, rules };
+            });
+            return {
+                action,
+                fingerprint: JSON.stringify([
+                    ctx.sessionManager.getSessionId(),
+                    ctx.cwd,
+                    state.preset === "auto",
+                    decisions,
+                ]),
+            };
+        },
+        async ask(request, ctx, signal) {
+            signal?.throwIfAborted();
+            const result = await authorize({
+                type: "tool_call",
+                toolCallId: request.toolCallId,
+                toolName: request.toolName,
+                input: request.input,
+                ...(request.parentToolCallId === undefined ? {} : { parentToolCallId: request.parentToolCallId }),
+            }, ctx, signal);
+            if (result?.block)
+                throw new Error(result.reason ?? "Permission request was rejected.");
+        },
+    };
+}
+//# sourceMappingURL=dispatch-policy.js.map

package/dist/core/extensions/builtin/permission-system/dispatch.d.ts

@@ -0,0 +1,33 @@
+import type { ExtensionContext } from "../../types.ts";
+export interface DispatchIdentity {
+    readonly owner: object;
+    readonly metadata: string;
+    readonly operation?: string;
+}
+export interface DispatchRequest {
+    readonly toolCallId: string;
+    readonly parentToolCallId?: string;
+    readonly toolName: string;
+    readonly input: Record<string, unknown>;
+    readonly identity: DispatchIdentity;
+}
+export interface DispatchPolicy {
+    readonly action: "allow" | "ask" | "deny";
+    readonly fingerprint: string;
+}
+export interface DispatchAuthorizer {
+    policy(request: DispatchRequest, ctx: ExtensionContext): DispatchPolicy;
+    ask(request: DispatchRequest, ctx: ExtensionContext, signal: AbortSignal | undefined): Promise<void>;
+}
+/** Retirement cannot remove the authorizer installed by a newer extension load. */
+export declare function registerDispatchAuthorizer(session: object, authorizer: DispatchAuthorizer): () => void;
+export declare function hasDispatchAuthorizer(session: object): boolean;
+/** Keep the policy and operation that were actually presented, not their post-reply replacements. */
+export declare function prepareDispatchApproval(session: object, request: DispatchRequest, policy: DispatchPolicy): () => void;
+export declare function forgetDispatchApproval(input: object): void;
+/**
+ * Resolve live permission after MCP readiness. The returned synchronous fence must
+ * pass immediately before dispatch; a false result requires preparation again.
+ */
+export declare function authorizeToolDispatch(session: object, request: DispatchRequest, ctx: ExtensionContext, signal: AbortSignal | undefined): Promise<() => boolean>;
+//# sourceMappingURL=dispatch.d.ts.map

package/dist/core/extensions/builtin/permission-system/dispatch.js

@@ -0,0 +1,106 @@
+import { DeniedError } from "./types.js";
+const authorizers = new WeakMap();
+// AgentSession passes this validated object unchanged from preflight to execution.
+// Identical calls, including calls with duplicate provider IDs, get distinct objects.
+const approvals = new WeakMap();
+/** Retirement cannot remove the authorizer installed by a newer extension load. */
+export function registerDispatchAuthorizer(session, authorizer) {
+    const previous = authorizers.get(session);
+    const registration = { authorizer, retired: new AbortController() };
+    authorizers.set(session, registration);
+    previous?.retired.abort(new Error("Permission authorizer was retired"));
+    return () => {
+        // Retain the retired registration so required authority cannot become
+        // indistinguishable from a session where enforcement was never loaded.
+        registration.retired.abort(new Error("Permission authorizer was retired"));
+    };
+}
+export function hasDispatchAuthorizer(session) {
+    return authorizers.has(session);
+}
+/** Keep the policy and operation that were actually presented, not their post-reply replacements. */
+export function prepareDispatchApproval(session, request, policy) {
+    const registration = authorizers.get(session);
+    if (!registration)
+        throw new Error("Permission authorizer is unavailable");
+    registration.retired.signal.throwIfAborted();
+    const approval = {
+        registration,
+        toolCallId: request.toolCallId,
+        toolName: request.toolName,
+        input: JSON.stringify(request.input),
+        identity: { ...request.identity },
+        policy: { ...policy },
+    };
+    return () => {
+        registration.retired.signal.throwIfAborted();
+        if (authorizers.get(session) !== registration)
+            throw new Error("Permission authorizer was retired");
+        approvals.set(request.input, approval);
+    };
+}
+export function forgetDispatchApproval(input) {
+    approvals.delete(input);
+}
+function matches(approval, registration, request, policy) {
+    return (approval?.registration === registration &&
+        approval.toolCallId === request.toolCallId &&
+        approval.toolName === request.toolName &&
+        approval.input === JSON.stringify(request.input) &&
+        approval.identity.owner === request.identity.owner &&
+        approval.identity.metadata === request.identity.metadata &&
+        approval.policy.action === policy.action &&
+        approval.policy.fingerprint === policy.fingerprint);
+}
+/** Await only this caller's approval; aborting it does not retire another caller's authority. */
+async function awaitApproval(pending, signal) {
+    if (!signal)
+        return pending;
+    let onAbort = () => { };
+    const aborted = new Promise((_resolve, reject) => {
+        onAbort = () => reject(signal.reason);
+        signal.addEventListener("abort", onAbort, { once: true });
+        if (signal.aborted)
+            onAbort();
+    });
+    try {
+        await Promise.race([pending, aborted]);
+    }
+    finally {
+        signal.removeEventListener("abort", onAbort);
+    }
+}
+/**
+ * Resolve live permission after MCP readiness. The returned synchronous fence must
+ * pass immediately before dispatch; a false result requires preparation again.
+ */
+export async function authorizeToolDispatch(session, request, ctx, signal) {
+    signal?.throwIfAborted();
+    const registration = authorizers.get(session);
+    if (!registration)
+        throw new Error("Permission authorizer is unavailable");
+    registration.retired.signal.throwIfAborted();
+    const policy = registration.authorizer.policy(request, ctx);
+    if (policy.action === "deny")
+        throw new DeniedError(["*"]);
+    if (policy.action === "ask" && !matches(approvals.get(request.input), registration, request, policy)) {
+        const approve = prepareDispatchApproval(session, request, policy);
+        const waitSignal = signal === undefined ? registration.retired.signal : AbortSignal.any([signal, registration.retired.signal]);
+        waitSignal.throwIfAborted();
+        await awaitApproval(registration.authorizer.ask(request, ctx, waitSignal), waitSignal);
+        signal?.throwIfAborted();
+        approve();
+    }
+    const approvedInput = JSON.stringify(request.input);
+    return () => {
+        if (signal?.aborted || registration.retired.signal.aborted || authorizers.get(session) !== registration)
+            return false;
+        if (JSON.stringify(request.input) !== approvedInput)
+            return false;
+        const current = registration.authorizer.policy(request, ctx);
+        if (current.action === "deny")
+            return false;
+        return current.action === "allow" || matches(approvals.get(request.input), registration, request, current);
+    };
+}
+//# sourceMappingURL=dispatch.js.map