@code-yeongyu/senpi 2026.10.10-5 → 2026.10.10-6

package/dist/core/extensions/builtin/mcp/expose/register.d.ts

@@ -3,11 +3,13 @@ import type { Progress } from "@modelcontextprotocol/sdk/types.js";
 import type { TSchema } from "typebox";
 import type { ToolDefinition } from "../../../types.ts";
 import type { McpToolCatalogEntry } from "../catalog.ts";
+import type { McpInvocation, McpInvocationError } from "../invocation.ts";
 export interface McpToolDetails {
     server: string;
     tool: string;
     preview?: string;
     progress?: Progress;
+    error?: McpInvocationError;
 }
 export type McpToolDefinition = ToolDefinition<TSchema, McpToolDetails | undefined, unknown>;
 type WarnFn = (message: string) => void;
@@ -25,6 +27,6 @@ export declare function mapMcpCatalogNames(entries: readonly McpToolCatalogEntry
 export declare function buildMcpToolDefinitions(entries: readonly McpToolCatalogEntry[], warn?: WarnFn): McpToolDefinition[];
 /** Full guarded call path for one catalog entry (lifecycle + retry + output
  * guard). Shared by direct/search tool definitions and the Tier-C proxy. */
-export declare function executeMcpCatalogEntry(entry: McpToolCatalogEntry, args: Record<string, unknown>, signal: AbortSignal | undefined, onUpdate: Parameters<McpToolDefinition["execute"]>[3]): Promise<AgentToolResult<McpToolDetails | undefined>>;
+export declare function executeMcpCatalogEntry(entry: McpToolCatalogEntry, args: Record<string, unknown>, signal: AbortSignal | undefined, onUpdate: Parameters<McpToolDefinition["execute"]>[3], invocation?: McpInvocation): Promise<AgentToolResult<McpToolDetails | undefined>>;
 export {};
 //# sourceMappingURL=register.d.ts.map

package/dist/core/extensions/builtin/mcp/expose/register.js

@@ -1,8 +1,9 @@
 import { Text } from "@earendil-works/pi-tui";
+import { forgetDispatchApproval } from "../../permission-system/dispatch.js";
+import { registerDispatchIdentity } from "../../permission-system/dispatch-metadata.js";
 import { ToolExecError } from "../errors.js";
 import { applyMcpOutputGuard } from "../guard/output-guard.js";
-import { ensureMcpToolCallConnection, withMcpRetriableFailedSendRetry, withMcpSessionExpiryRetry } from "../health.js";
-import { runMcpConnectionLifecycleCall } from "../idle.js";
+import { callMcpTool } from "./call.js";
 import { buildMcpToolNames, convertJsonSchemaToTypeBox, mapMcpToolResult, } from "./schema-compat.js";
 /** Pair each catalog entry with its stable, collision-resolved mcp tool name.
  * Shared by the full-tool builder and the Tier-B search catalog so names never
@@ -18,15 +19,21 @@ export function buildMcpToolDefinitions(entries, warn) {
 function createMcpToolDefinition(entry, name) {
     const converted = convertJsonSchemaToTypeBox(entry.schema);
     const label = `${entry.server}/${entry.tool}`;
+    registerDispatchIdentity(converted.schema, () => entry.invocation?.identity(entry));
     return {
         name,
         label,
         description: entry.description ?? `MCP tool ${label}`,
         parameters: converted.schema,
         executionMode: "parallel",
-        async execute(_toolCallId, params, signal, onUpdate) {
+        async execute(toolCallId, params, signal, onUpdate, context) {
             const args = isRecord(params) ? params : {};
-            return await executeMcpCatalogEntry(entry, args, signal, onUpdate);
+            return await executeMcpCatalogEntry(entry, args, signal, onUpdate, {
+                toolCallId,
+                toolName: name,
+                input: args,
+                context,
+            });
         },
         renderCall(args, theme) {
             return new Text(theme.fg("toolTitle", theme.bold(`${name} ${previewArgs(args)}`.trim())), 0, 0);
@@ -41,47 +48,39 @@ function createMcpToolDefinition(entry, name) {
 }
 /** Full guarded call path for one catalog entry (lifecycle + retry + output
  * guard). Shared by direct/search tool definitions and the Tier-C proxy. */
-export async function executeMcpCatalogEntry(entry, args, signal, onUpdate) {
-    const label = `${entry.server}/${entry.tool}`;
-    const result = await callMcpTool(entry, args, signal, onUpdate, label);
-    const mapped = mapMcpToolResult(normalizeCallToolResult(result));
-    if (!mapped.ok) {
-        throw new ToolExecError(mapped.error.message, { phase: "call", serverName: entry.server });
-    }
-    const guarded = await applyMcpOutputGuard(mapped.content, {
-        agentDir: entry.agentDir,
-        artifacts: entry.artifacts,
-        outputGuard: entry.outputGuard,
-        server: entry.server,
-    });
-    const content = toAgentContent(guarded);
-    return { content, details: { preview: previewContent(content), server: entry.server, tool: entry.tool } };
-}
-async function callMcpTool(entry, args, signal, onUpdate, label) {
+export async function executeMcpCatalogEntry(entry, args, signal, onUpdate, invocation) {
     try {
-        return await runMcpConnectionLifecycleCall(entry.connection, () => withMcpSessionExpiryRetry(entry.connection, async () => {
-            await ensureMcpToolCallConnection(entry.connection, entry.ensureFresh);
-            await entry.ensureConnected?.();
-            return await withMcpRetriableFailedSendRetry(entry.connection, async () => {
-                return await entry.connection.client.callTool({ name: entry.tool, arguments: args }, undefined, {
-                    onprogress: (progress) => {
-                        onUpdate?.({
-                            content: [{ type: "text", text: formatProgress(label, progress) }],
-                            details: { progress, server: entry.server, tool: entry.tool },
-                        });
-                    },
-                    signal,
-                    timeout: entry.requestTimeoutMs,
-                });
+        const label = `${entry.server}/${entry.tool}`;
+        const outcome = await callMcpTool(entry, args, signal, onUpdate, label, invocation);
+        if (outcome.kind === "refused") {
+            const guarded = await applyMcpOutputGuard([{ type: "text", text: JSON.stringify({ error: outcome.error }) }], {
+                agentDir: entry.agentDir,
+                artifacts: entry.artifacts,
+                outputGuard: entry.outputGuard,
+                server: entry.server,
             });
-        }));
-    }
-    catch (error) {
-        throw new ToolExecError(`ToolExecError: ${errorLabel(error)}`, {
-            cause: error,
-            phase: "call",
-            serverName: entry.server,
+            return {
+                content: toAgentContent(guarded),
+                details: { error: outcome.error, preview: outcome.error.kind, server: entry.server, tool: entry.tool },
+            };
+        }
+        const current = outcome.entry;
+        const mapped = mapMcpToolResult(normalizeCallToolResult(outcome.result));
+        if (!mapped.ok) {
+            throw new ToolExecError(mapped.error.message, { phase: "call", serverName: entry.server });
+        }
+        const guarded = await applyMcpOutputGuard(mapped.content, {
+            agentDir: current.agentDir,
+            artifacts: current.artifacts,
+            outputGuard: current.outputGuard,
+            server: current.server,
         });
+        const content = toAgentContent(guarded);
+        return { content, details: { preview: previewContent(content), server: entry.server, tool: entry.tool } };
+    }
+    finally {
+        if (invocation !== undefined)
+            forgetDispatchApproval(invocation.input);
     }
 }
 function normalizeCallToolResult(result) {
@@ -121,14 +120,6 @@ function previewArgs(args) {
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function errorLabel(error) {
-    return error instanceof Error ? `${error.name}: ${error.message}` : String(error);
-}
-function formatProgress(label, progress) {
-    const total = progress.total === undefined ? "" : `/${progress.total}`;
-    const message = progress.message === undefined ? "" : ` ${progress.message}`;
-    return `${label} progress ${progress.progress}${total}${message}`.trim();
-}
 function truncatePreview(value) {
     return value.length <= 120 ? value : `${value.slice(0, 117)}...`;
 }

package/dist/core/extensions/builtin/mcp/expose/session.d.ts

@@ -4,6 +4,7 @@ import type { McpCachedServerCatalog } from "../catalog-cache.ts";
 import type { ResolvedMcpConfig } from "../config-schema.ts";
 import type { ServerConnection } from "../connection.ts";
 import type { McpOutputArtifacts } from "../guard/output-guard.ts";
+import type { McpInvocationResolver } from "../invocation.ts";
 import { type McpLogger } from "../log.ts";
 import type { McpPromptServer } from "../prompts.ts";
 import { type McpResourceServer } from "../resources.ts";
@@ -22,8 +23,11 @@ export interface McpDirectRegistrationEntry {
     readonly cachedCatalog?: McpCachedServerCatalog;
     readonly ensureFresh?: () => Promise<void>;
     readonly ensureCachedToolConnected?: () => Promise<void>;
+    readonly invocation?: McpInvocationResolver;
     /** A startup connect still owns this server's catalog; its refresh registers it. */
     readonly startupCatalogPending?: boolean;
+    /** Service admission and registry updates never enumerate a remote server. */
+    readonly localCatalogOnly?: boolean;
     readonly onRegistered?: (identity: string) => void;
 }
 export declare function registerDirectMcpTools(pi: Pick<ExtensionAPI, "getActiveTools" | "setActiveTools" | "registerTool">, config: ResolvedMcpConfig, entries: Iterable<McpDirectRegistrationEntry>, toolSearchService: ToolSearchService, options?: McpCatalogRegistrationOptions): Promise<McpSessionRegistration | undefined>;

package/dist/core/extensions/builtin/mcp/expose/session.js

@@ -16,11 +16,14 @@ export async function registerDirectMcpTools(pi, config, entries, toolSearchServ
         if (server?.config === undefined)
             continue;
         const catalog = entry.cachedCatalog === undefined
-            ? entry.connection.state === "connected" && entry.startupCatalogPending !== true
+            ? entry.connection.state === "connected" &&
+                entry.startupCatalogPending !== true &&
+                entry.localCatalogOnly !== true
                 ? await collectToolCatalog(entry.name, entry.connection, server.config, {
                     agentDir: entry.agentDir,
                     artifacts: entry.artifacts,
                     ensureFresh: entry.ensureFresh,
+                    invocation: entry.invocation,
                     outputGuard: config.settings.outputGuard,
                 })
                 : []
@@ -28,6 +31,7 @@ export async function registerDirectMcpTools(pi, config, entries, toolSearchServ
                 agentDir: entry.agentDir,
                 artifacts: entry.artifacts,
                 ensureFresh: entry.ensureFresh,
+                invocation: entry.invocation,
                 outputGuard: config.settings.outputGuard,
             });
         const identity = mcpRegistrationIdentity(catalog, entry.cachedCatalog);

package/dist/core/extensions/builtin/mcp/expose/tier-b.js

@@ -6,6 +6,7 @@
 // MCP feeds its searchable documents and activation hook into that service.
 import { Text } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
+import { getDispatchIdentity, registerDispatchIdentity } from "../../permission-system/dispatch-metadata.js";
 import { deriveMcpRegistrationId } from "../../tool-search/engine/marker.js";
 import { registerToolsPreservingActiveSet } from "../active-set.js";
 import { createMcpProxyTool } from "./proxy.js";
@@ -37,6 +38,8 @@ export function registerMcpTierBTools(pi, input, toolSearchService, warn) {
     }));
     const fullDefs = buildMcpToolDefinitions(input.registeredEntries, warn);
     const fullByName = new Map(fullDefs.map((def) => [def.name, def]));
+    const promoted = promotedNamesByRegistrar.get(pi) ?? new Set();
+    promotedNamesByRegistrar.set(pi, promoted);
     const gatewayNames = [];
     for (const gateway of input.proxyGateways ?? []) {
         const tool = createMcpProxyTool(gateway.server, gateway.entries);
@@ -47,7 +50,11 @@ export function registerMcpTierBTools(pi, input, toolSearchService, warn) {
         pi.registerTool(tool);
         gatewayNames.push(tool.name);
     }
-    const activeMcpNames = [...mapMcpCatalogNames(input.activeEntries).map(({ name }) => name), ...gatewayNames];
+    const activeMcpNames = [
+        ...mapMcpCatalogNames(input.activeEntries).map(({ name }) => name),
+        ...fullDefs.filter((def) => input.searchMode && promoted.has(def.name)).map((def) => def.name),
+        ...gatewayNames,
+    ];
     const managedNames = new Set([...fullDefs.map((def) => def.name), ...gatewayNames]);
     const previousManagedNames = managedNamesByRegistrar.get(pi) ?? new Set();
     managedNamesByRegistrar.set(pi, managedNames);
@@ -59,6 +66,8 @@ export function registerMcpTierBTools(pi, input, toolSearchService, warn) {
         const known = [...new Set(names.filter((name) => registeredNames.has(name)))];
         if (known.length === 0)
             return;
+        for (const name of known)
+            promoted.add(name);
         if (stubSwap)
             swapStubsToFull(pi, known, stubbed, fullByName);
         const current = pi.getActiveTools();
@@ -86,8 +95,6 @@ export function registerMcpTierBTools(pi, input, toolSearchService, warn) {
     // stubSwap: every search-mode tool is registered as a tiny stub and kept
     // active so the tools array is length-stable; direct tools stay full.
     const directActive = new Set(activeMcpNames);
-    const promoted = promotedNamesByRegistrar.get(pi) ?? new Set();
-    promotedNamesByRegistrar.set(pi, promoted);
     const toRegister = fullDefs.map((def) => {
         if (directActive.has(def.name) || promoted.has(def.name))
             return def;
@@ -135,13 +142,17 @@ function isLegacyMcpRegistrationName(name) {
  * definition and runs the call in the same turn, so the model never needs a
  * tool_search round trip; without a promotion hook it only points at tool_search. */
 export function buildMcpStubDefinition(name, promotion) {
+    const parameters = Type.Object({}, { additionalProperties: true });
+    if (promotion !== undefined) {
+        registerDispatchIdentity(parameters, (input) => getDispatchIdentity(promotion.full.parameters, input));
+    }
     return {
         name,
         label: name,
         description: promotion === undefined
             ? `Inactive MCP tool. Run tool_search to activate ${name}, then call it on your next turn.`
             : `Deferred MCP tool. Call ${name} with its real arguments; it activates and runs on this first call (tool_search lists its schema).`,
-        parameters: Type.Object({}, { additionalProperties: true }),
+        parameters,
         executionMode: "parallel",
         async execute(toolCallId, params, signal, onUpdate, ctx) {
             if (promotion === undefined) {

package/dist/core/extensions/builtin/mcp/index.js

@@ -8,7 +8,6 @@ import { registerMcpPromptCommands } from "./prompts.js";
 import { expandMcpResourceMentions } from "./resources.js";
 import { getMcpService, McpService } from "./service.js";
 import { parseSkillMcpDeclarations, skillActivationTargets, } from "./skills.js";
-import { MCP_ATTACH_SETTLE_TIMEOUT_MS } from "./startup-race.js";
 import { reportMcpAsyncError, safeEventBusOn, wrapAsync } from "./wrap.js";
 const MCP_BUILTIN_EXTENSION_PATH = "<builtin:mcp>";
 export function createMcpExtension(service, sessionOwned = true) {
@@ -91,16 +90,8 @@ export function createMcpExtension(service, sessionOwned = true) {
             }
             return undefined;
         });
-        // Attach is SINGLE-FLIGHT. session_start handlers are dispatched
-        // fire-and-forget, so a slow attach (a cold MCP server's boot + catalog
-        // collection is awaited inside attachSession) can still be in flight when
-        // before_agent_start fires. The old `attached` boolean was only set on
-        // completion, so before_agent_start would start a SECOND concurrent attach —
-        // which found the connection entries already created (still "connecting"),
-        // collected an empty catalog, and registered no MCP tools for turn 1; the
-        // first attach then landed the real registration turns later. Memoizing the
-        // in-flight promise makes before_agent_start await the ORIGINAL attach, so
-        // the first turn's payload deterministically carries the MCP tool set.
+        // Attach is single-flight: the prompt uses the original attach's bindings
+        // and known catalog, without waiting for deferred remote discovery.
         // session_start always starts a fresh attach (reloads must re-sync config).
         const attach = (event, ctx) => {
             attachedSessionId = ctx.sessionManager?.getSessionId?.();
@@ -117,11 +108,7 @@ export function createMcpExtension(service, sessionOwned = true) {
         const onSessionStart = wrapAsync("mcp.session_start", (event, ctx) => attach(event, ctx), sink);
         pi.on("session_start", (event, ctx) => {
             const work = onSessionStart(event, ctx);
-            // session_start is dispatched serially inside interactive startup, so awaiting attach here
-            // puts a cold server's boot and catalog handshake in front of the first frame: measured at
-            // 254ms median of a 292ms dispatch on a real config, against 0.2ms with no servers. Attach
-            // is single-flight via attachPromise + service.#attachQueue and before_agent_start awaits
-            // it, so the first turn still carries the full tool set; only the first paint stops waiting.
+            // First paint does not wait for attach; prompt preparation reuses its promise.
             void work;
         });
         const onBeforeAgentStart = async (event, ctx) => {
@@ -148,16 +135,8 @@ export function createMcpExtension(service, sessionOwned = true) {
                     for (const warning of warnings)
                         createMcpLogger("skills").warn(warning);
                 }
-                // attachPromise resolves at the startup-race deadline, which leaves a slow
-                // server still handshaking: assembling the prompt here would publish that
-                // server's stale instructions - or none at all - for the whole session.
-                // Await the attach's own completion signal instead, bounded; on timeout the
-                // turn still goes out and the server's catalog lands on a later turn.
-                if ((await service.whenAttachSettled()) === "timeout") {
-                    createMcpLogger("service").warn("MCP attach still settling at prompt build", {
-                        timeoutMs: MCP_ATTACH_SETTLE_TIMEOUT_MS,
-                    });
-                }
+                // Use the known instructions now. Deferred catalog registration refreshes
+                // the service for subsequent turns instead of gating this provider request.
                 const systemPrompt = injectMcpInstructions(service, event.systemPrompt);
                 return systemPrompt === undefined ? undefined : { systemPrompt };
             }

package/dist/core/extensions/builtin/mcp/invocation.d.ts

@@ -0,0 +1,42 @@
+import type { ExtensionToolContext } from "../../types.ts";
+import { type DispatchIdentity } from "../permission-system/dispatch.ts";
+import type { McpToolCatalogEntry } from "./catalog.ts";
+import { type McpAsyncErrorSink } from "./wrap.ts";
+export interface McpInvocation {
+    readonly toolCallId: string;
+    readonly toolName: string;
+    readonly input: Record<string, unknown>;
+    readonly context?: ExtensionToolContext;
+}
+export interface McpInvocationError {
+    readonly kind: "unavailable" | "schema_changed" | "permission_denied";
+    readonly server: string;
+    readonly tool: string;
+    readonly message: string;
+    readonly currentDefinition?: McpToolCatalogEntry["schema"];
+}
+export type McpPreparedInvocation = {
+    readonly kind: "ready";
+    readonly entry: McpToolCatalogEntry;
+    readonly isCurrent: () => boolean;
+} | {
+    readonly kind: "refused";
+    readonly error: McpInvocationError;
+};
+export interface McpInvocationResolver {
+    identity(entry: McpToolCatalogEntry): DispatchIdentity;
+    resolve(entry: McpToolCatalogEntry, args: Record<string, unknown>, invocation: McpInvocation | undefined, signal: AbortSignal | undefined): Promise<McpPreparedInvocation>;
+}
+interface InvocationScope {
+    readonly owner: object;
+    readonly sink: McpAsyncErrorSink;
+    readonly configuration: string;
+    readonly contextRequired: boolean;
+    readonly sessionManager?: object;
+    readonly isCurrent: () => boolean;
+    readonly ready: () => Promise<void>;
+    readonly current: (tool: string) => McpToolCatalogEntry | undefined;
+}
+export declare function createMcpInvocationResolver(scope: InvocationScope): McpInvocationResolver;
+export {};
+//# sourceMappingURL=invocation.d.ts.map

package/dist/core/extensions/builtin/mcp/invocation.js

@@ -0,0 +1,118 @@
+import { Type } from "typebox";
+import { Check } from "typebox/value";
+import { authorizeToolDispatch, hasDispatchAuthorizer } from "../permission-system/dispatch.js";
+import { getDispatchIdentity } from "../permission-system/dispatch-metadata.js";
+import { TimeoutError } from "./errors.js";
+import { safeTimer } from "./wrap.js";
+export function createMcpInvocationResolver(scope) {
+    const identity = (entry) => ({
+        owner: scope.owner,
+        operation: JSON.stringify([entry.server, entry.tool]),
+        metadata: JSON.stringify([
+            scope.configuration,
+            entry.server,
+            entry.tool,
+            entry.schema,
+            entry.description,
+            entry.annotations,
+        ]),
+    });
+    return {
+        identity,
+        async resolve(offered, args, invocation, signal) {
+            const refuse = (kind, message, current) => ({
+                kind: "refused",
+                error: {
+                    kind,
+                    message,
+                    server: offered.server,
+                    tool: offered.tool,
+                    currentDefinition: current?.schema,
+                },
+            });
+            signal?.throwIfAborted();
+            if (!scope.isCurrent())
+                return refuse("unavailable", "MCP session or server configuration was replaced.");
+            const ctx = invocation?.context;
+            if (scope.contextRequired &&
+                (ctx === undefined || (scope.sessionManager !== undefined && ctx.sessionManager !== scope.sessionManager))) {
+                return refuse("unavailable", "MCP invocation does not belong to this session.");
+            }
+            const deadline = new AbortController();
+            const timeout = safeTimer("invocation.catalog.deadline", offered.requestTimeoutMs, () => deadline.abort(new TimeoutError("MCP metadata was not ready before the request timeout.", {
+                phase: "catalog",
+                serverName: offered.server,
+            })), scope.sink);
+            const readySignal = signal === undefined ? deadline.signal : AbortSignal.any([signal, deadline.signal]);
+            const ready = scope.ready();
+            let abort = () => { };
+            const interrupted = new Promise((_resolve, reject) => {
+                abort = () => reject(readySignal.reason);
+                readySignal.addEventListener("abort", abort, { once: true });
+                if (readySignal.aborted)
+                    abort();
+            });
+            try {
+                await Promise.race([ready, interrupted]);
+            }
+            finally {
+                clearTimeout(timeout);
+                readySignal.removeEventListener("abort", abort);
+            }
+            signal?.throwIfAborted();
+            if (!scope.isCurrent())
+                return refuse("unavailable", "MCP session or server configuration was replaced.");
+            const current = scope.current(offered.tool);
+            if (current === undefined)
+                return refuse("unavailable", "MCP tool is no longer available.");
+            // Validate the current raw schema, never the coercing preflight schema.
+            if (!Check(Type.Unsafe(current.schema), args)) {
+                return refuse("schema_changed", "Arguments do not match the current MCP tool schema.", current);
+            }
+            const preparedIdentity = identity(current);
+            let permissionFence;
+            let operationFence;
+            if (ctx !== undefined &&
+                invocation !== undefined &&
+                (scope.contextRequired || ctx.sessionManager !== undefined)) {
+                operationFence = () => {
+                    const registered = ctx.tools.find((tool) => tool.name === invocation.toolName);
+                    const registeredIdentity = registered === undefined ? undefined : getDispatchIdentity(registered.parameters, invocation.input);
+                    return (registeredIdentity?.owner === preparedIdentity.owner &&
+                        registeredIdentity.operation === preparedIdentity.operation);
+                };
+                if (!operationFence()) {
+                    return refuse("unavailable", "MCP invocation name no longer identifies this operation.", current);
+                }
+                if (hasDispatchAuthorizer(ctx.sessionManager)) {
+                    try {
+                        permissionFence = await authorizeToolDispatch(ctx.sessionManager, { ...invocation, identity: preparedIdentity }, ctx, signal);
+                    }
+                    catch (error) {
+                        signal?.throwIfAborted();
+                        return refuse("permission_denied", error instanceof Error ? error.message : String(error), current);
+                    }
+                }
+                else if (ctx.loadedExtensionPaths === undefined ||
+                    ctx.loadedExtensionPaths.some((path) => path.includes("permission-system"))) {
+                    return refuse("permission_denied", "Permission authorizer is unavailable.", current);
+                }
+            }
+            return {
+                kind: "ready",
+                entry: current,
+                isCurrent: () => {
+                    if (signal?.aborted || !scope.isCurrent())
+                        return false;
+                    const latest = scope.current(offered.tool);
+                    return (latest !== undefined &&
+                        identity(latest).metadata === preparedIdentity.metadata &&
+                        Check(Type.Unsafe(latest.schema), args) &&
+                        (operationFence === undefined || operationFence()) &&
+                        (permissionFence === undefined || permissionFence()));
+                },
+            };
+        },
+    };
+}
+//# sourceMappingURL=invocation.js.map

package/dist/core/extensions/builtin/mcp/service-connection.d.ts

@@ -16,6 +16,9 @@ interface SessionConnectionOptions {
     readonly ui: McpElicitationUiProvider;
     readonly artifacts: McpOutputArtifacts;
     readonly shouldReconnect: (entry: McpConnectionEntry) => boolean;
+    readonly credentialIdentity?: string;
+    readonly credentialsCurrent?: () => boolean;
+    readonly onCredentialsChanged?: () => Promise<void>;
 }
 export declare function createMcpSessionConnection(options: SessionConnectionOptions): McpConnectionEntry;
 export declare function disposeEntryConnection(entry: McpConnectionEntry, registry: HostMcpRegistry, owner: object): Promise<void>;

package/dist/core/extensions/builtin/mcp/service-connection.js

@@ -20,6 +20,8 @@ export function createMcpSessionConnection(options) {
     for (const warning of detectLiteralBearerWarnings(name, config))
         logger.warn(warning);
     const connectionOptions = {
+        credentialIdentity: options.credentialIdentity,
+        credentialsCurrent: options.credentialsCurrent,
         authProvider: authPlan.provider,
         config,
         env: session.env,
@@ -39,6 +41,10 @@ export function createMcpSessionConnection(options) {
         artifacts: options.artifacts,
         authPlan,
         cacheRefreshedAfterConnect: false,
+        isCurrent: () => options.shouldReconnect(entry),
+        credentialIdentity: options.credentialIdentity,
+        credentialsCurrent: options.credentialsCurrent,
+        onCredentialsChanged: options.onCredentialsChanged,
         key,
         name,
         configHash: options.configHash,

package/dist/core/extensions/builtin/mcp/service-register.d.ts

@@ -7,6 +7,10 @@ type McpToolRegistrar = Pick<ExtensionAPI, "getActiveTools" | "setActiveTools" |
 export interface McpServiceDirectToolRegistrationOptions {
     readonly refreshActiveSetWhenEmpty?: boolean;
     readonly onRegistered?: (entry: McpConnectionEntry, identity: string) => void;
+    readonly isCurrent?: (entry: McpConnectionEntry) => boolean;
+    readonly contextRequired?: boolean;
+    readonly sessionManager?: object;
+    readonly publishCurrent?: () => Promise<void>;
 }
 export declare function registerMcpServiceDirectTools(pi: McpToolRegistrar, config: ResolvedMcpConfig, entries: Iterable<McpConnectionEntry>, toolSearchService: ToolSearchService, options?: McpServiceDirectToolRegistrationOptions): Promise<McpSessionRegistration | undefined>;
 export {};

package/dist/core/extensions/builtin/mcp/service-register.js

@@ -1,15 +1,59 @@
+import { cachedToolsToCatalogEntries } from "./catalog.js";
+import { computeMcpExposurePolicy } from "./expose/policy.js";
 import { registerDirectMcpTools } from "./expose/session.js";
+import { ensureMcpToolCallConnection } from "./health.js";
+import { createMcpInvocationResolver } from "./invocation.js";
 import { connectAndRefreshMcpCatalog } from "./startup-race.js";
 export async function registerMcpServiceDirectTools(pi, config, entries, toolSearchService, options = {}) {
     return await registerDirectMcpTools(pi, config, [...entries].map((entry) => {
         const serverConfig = config.servers[entry.name]?.config;
         const claim = entry.startupCatalogClaim;
         const startupCatalogPending = claim?.ownsRegistration() === true;
+        const invocation = createMcpInvocationResolver({
+            owner: entry,
+            sink: { logger: entry.logger },
+            configuration: entry.configHash,
+            contextRequired: options.contextRequired === true,
+            sessionManager: options.sessionManager,
+            isCurrent: () => entry.isCurrent?.() !== false && options.isCurrent?.(entry) !== false,
+            ready: async () => {
+                await ensureMcpToolCallConnection(entry.connection, () => entry.authPlan?.refresh?.ensureFresh().then(() => undefined) ?? Promise.resolve());
+                await connectAndRefreshMcpCatalog(entry, serverConfig);
+                await entry.startupCatalogClaim?.settled();
+                if (entry.isCurrent?.() === false || options.isCurrent?.(entry) === false)
+                    return;
+                await options.publishCurrent?.();
+            },
+            current: (tool) => {
+                if (serverConfig === undefined ||
+                    entry.credentialsCurrent?.() === false ||
+                    entry.cachedCatalog === undefined ||
+                    !entry.cacheRefreshedAfterConnect ||
+                    entry.catalogGeneration !== entry.connection.generation ||
+                    entry.connection.state !== "connected") {
+                    return undefined;
+                }
+                const current = cachedToolsToCatalogEntries(entry.name, entry.cachedCatalog, entry.connection, serverConfig.requestTimeoutMs, () => connectAndRefreshMcpCatalog(entry, serverConfig), {
+                    agentDir: entry.agentDir,
+                    artifacts: entry.artifacts,
+                    ensureFresh: () => entry.authPlan?.refresh?.ensureFresh().then(() => undefined) ?? Promise.resolve(),
+                    outputGuard: config.settings.outputGuard,
+                    invocation,
+                });
+                return computeMcpExposurePolicy(current, serverConfig, config.settings).filteredEntries.find((candidate) => candidate.tool === tool);
+            },
+        });
         return {
             agentDir: entry.agentDir,
             artifacts: entry.artifacts,
-            cachedCatalog: startupCatalogPending ? claim?.cachedCatalog : entry.cachedCatalog,
+            cachedCatalog: entry.credentialsCurrent?.() === false
+                ? undefined
+                : startupCatalogPending
+                    ? claim?.cachedCatalog
+                    : entry.cachedCatalog,
             startupCatalogPending,
+            localCatalogOnly: true,
+            invocation,
             onRegistered: (identity) => options.onRegistered?.(entry, identity),
             connection: entry.connection,
             ensureFresh: () => entry.authPlan?.refresh?.ensureFresh().then(() => undefined) ?? Promise.resolve(),

package/dist/core/extensions/builtin/mcp/service-tools-changed.js

@@ -40,17 +40,33 @@ export async function refreshMcpToolsOnListChanged(entry, targets, config, conne
     const server = config.servers[entry.name];
     if (server?.config === undefined || entry.connection.state !== "connected")
         return;
+    if (entry.isCurrent?.() === false)
+        return;
+    if (entry.credentialsCurrent?.() === false) {
+        await entry.onCredentialsChanged?.();
+        return;
+    }
+    const generation = entry.connection.generation;
+    const ownsCatalog = () => entry.isCurrent?.() !== false &&
+        entry.credentialsCurrent?.() !== false &&
+        entry.connection.generation === generation &&
+        entry.connection.state === "connected";
     // The startup connect that still owns registration registers its refreshed catalog itself.
     if (connectOnly && entry.startupCatalogClaim?.ownsRegistration() === true)
         return;
     const registeredCatalog = entry.cachedCatalog;
     if (entry.connection instanceof SharedMcpLease) {
-        entry.cachedCatalog = await entry.connection.catalog();
+        const refreshed = await entry.connection.catalog();
+        if (!ownsCatalog())
+            return;
+        entry.cachedCatalog = refreshed;
     }
     const catalog = await collectToolCatalog(entry.name, entry.connection, server.config, {
         agentDir: entry.agentDir,
         outputGuard: config.settings.outputGuard,
     });
+    if (!ownsCatalog())
+        return;
     const newNames = mapMcpCatalogNames(catalog).map(({ name }) => name);
     // Before the first refresh, the registered names are the catalog the startup pass registered.
     const knownNames = entry.knownToolNames ??
@@ -65,9 +81,14 @@ export async function refreshMcpToolsOnListChanged(entry, targets, config, conne
         // Registration reads entry.cachedCatalog. A shared lease refreshed it above; nothing else
         // refreshes a non-shared connection's catalog after its startup connect (#2188).
         if (!(entry.connection instanceof SharedMcpLease)) {
-            entry.cachedCatalog = await collectServerCatalogForCache(entry.connection, server.config, entry.configHash);
-            await writeMcpCachedServer(entry.agentDir, entry.name, entry.cachedCatalog);
+            const refreshed = await collectServerCatalogForCache(entry.connection, server.config, entry.configHash, entry.credentialIdentity);
+            if (!ownsCatalog())
+                return;
+            entry.cachedCatalog = refreshed;
+            await writeMcpCachedServer(entry.agentDir, entry.name, refreshed, ownsCatalog);
         }
+        if (!ownsCatalog())
+            return;
         // Tombstone removed tools BEFORE re-registration so the subsequent
         // setActiveTools (which excludes them) leaves the tombstones inactive.
         const seen = new Set(initial.map((target) => target.pi));
@@ -75,6 +96,8 @@ export async function refreshMcpToolsOnListChanged(entry, targets, config, conne
         let pending = stale;
         while (pending.length > 0) {
             for (const target of pending) {
+                if (!ownsCatalog())
+                    return;
                 try {
                     for (const removed of diff.removed)
                         target.pi.registerTool(buildMcpTombstoneDefinition(removed, entry.name));