@code-yeongyu/senpi 2026.11.10 → 2026.11.11

package/dist/core/extensions/builtin/mcp/auth/oauth-refresh.js

@@ -2,8 +2,9 @@ import { loadMcpSdkAuth } from "../sdk.lazy.js";
 import { safeDelay } from "../wrap.js";
 import { isInvalidGrant, isTransientTokenError, OAuthFlowError } from "./oauth-errors.js";
 import { oauthFetch } from "./oauth-fetch.js";
-import { credentialsMatchIssuer, validatedAuthorizationServerIssuer } from "./oauth-issuer.js";
-import { mergeTokensIntoStoredAuth, REFRESH_LEEWAY_MS, storedAuthToTokens, storedGrantIssuer, } from "./oauth-provider.js";
+import { canonicalAuthorizationServerIssuer, credentialsMatchIssuer, validatedAuthorizationServerIssuer, } from "./oauth-issuer.js";
+import { mergeTokensIntoStoredAuth, storedAuthToTokens, storedGrantIssuer, validGrantProof, withGrantAuthorization, } from "./oauth-grant.js";
+const REFRESH_LEEWAY_MS = 5 * 60 * 1000;
 export function isTokenStale(record, now) {
     const token = record?.accessToken;
     if (token === undefined || token.length === 0)
@@ -82,6 +83,7 @@ export class McpRefreshManager {
             });
         }
         const resource = new URL(current.resource ?? this.#provider.serverUrl);
+        const proof = validGrantProof(current, this.#provider.grantContext);
         const { refreshAuthorization } = await loadMcpSdkAuth();
         const maxRetries = this.#options.maxRetries ?? 2;
         for (let attempt = 0;; attempt++) {
@@ -93,10 +95,29 @@ export class McpRefreshManager {
                     resource,
                     fetchFn: oauthFetch(this.#options.fetchFn),
                 });
-                this.#provider.store.writeUnlocked(mergeTokensIntoStoredAuth(current, tokens, this.#provider.serverUrl, authorizationServer));
-                return { ...tokens, issuer: authorizationServer };
+                if (tokens.issuer !== undefined &&
+                    canonicalAuthorizationServerIssuer(tokens.issuer) !==
+                        canonicalAuthorizationServerIssuer(authorizationServer)) {
+                    this.#provider.store.writeUnlocked(undefined);
+                    throw new OAuthFlowError("needs_auth", "MCP refresh response names a different issuer.", {
+                        serverName: this.#provider.serverName,
+                    });
+                }
+                const next = mergeTokensIntoStoredAuth({ ...current, issuer: authorizationServer, resource: resource.href, refreshScope: proof?.refreshScope }, {
+                    ...tokens,
+                    issuer: authorizationServer,
+                    scope: tokens.scope === undefined ? proof?.refreshScope : tokens.scope,
+                });
+                const committed = withGrantAuthorization(next, this.#provider.grantContext, current);
+                this.#provider.store.writeUnlocked(committed);
+                const result = storedAuthToTokens(committed);
+                if (result === undefined)
+                    throw new OAuthFlowError("needs_auth", "MCP refresh returned no access token.");
+                return result;
             }
             catch (error) {
+                if (error instanceof OAuthFlowError)
+                    throw error;
                 if (isInvalidGrant(error)) {
                     // Terminal: drop credentials so the next use forces a clean re-auth.
                     this.#provider.store.writeUnlocked(undefined);

package/dist/core/extensions/builtin/mcp/auth/oauth.js

@@ -34,11 +34,11 @@ export async function finishAuthorization(provider, code, options = {}, iss) {
     let result;
     const { auth } = await loadMcpSdkAuth();
     try {
-        result = await auth(provider, {
+        result = await provider.withFreshAuthorization(() => auth(provider, {
             serverUrl: provider.serverUrl,
             authorizationCode: code,
             fetchFn: oauthFetch(options.fetchFn),
-        });
+        }));
     }
     catch (error) {
         if (isInvalidGrant(error) || isRejectedAuthorizationCode(error)) {
@@ -111,12 +111,15 @@ export async function clientCredentialsGrant(provider, options = {}) {
         },
     };
     const { fetchToken } = await loadMcpSdkAuth();
-    const tokens = await fetchToken(credentialsProvider, info.authorizationServerUrl, {
-        metadata: info.authorizationServerMetadata,
-        resource: new URL(provider.serverUrl),
-        fetchFn: oauthFetch(options.fetchFn),
+    await provider.validateResourceURL(provider.serverUrl, provider.serverUrl);
+    await provider.withFreshAuthorization(async () => {
+        const tokens = await fetchToken(credentialsProvider, info.authorizationServerUrl, {
+            metadata: info.authorizationServerMetadata,
+            resource: new URL(provider.serverUrl),
+            fetchFn: oauthFetch(options.fetchFn),
+        });
+        await provider.saveTokens({ ...tokens, issuer: validatedAuthorizationServerIssuer(info, provider.serverName) });
     });
-    await provider.saveTokens({ ...tokens, issuer: validatedAuthorizationServerIssuer(info, provider.serverName) });
 }
 export async function logout(provider) {
     await provider.store.clear();

package/dist/core/extensions/builtin/mcp/auth/registered-redirect.d.ts

@@ -0,0 +1,19 @@
+import type { McpClientRegistration, McpStoredAuth } from "./token-store.ts";
+/** The provider options that decide which registration a flow uses. */
+export interface RegistrationFlow {
+    readonly redirectUrl?: string | URL | undefined;
+    /** The flow sends an authorize request to `redirectUrl`. */
+    readonly requireRegisteredRedirect?: boolean | undefined;
+}
+/** The registration a flow uses: for an authorizing flow, the signed-in or staged client naming its redirect URI. */
+export declare function registrationForFlow(record: McpStoredAuth | undefined, flow: RegistrationFlow): McpClientRegistration | undefined;
+/** The stored grant as a flow may present it: a staged client has no grant, so the refresh token is withheld. */
+export declare function grantForFlow(record: McpStoredAuth | undefined, flow: RegistrationFlow): McpStoredAuth | undefined;
+/**
+ * Stores a registration. An authorizing flow stages a client that would replace the signed-in one; otherwise a
+ * replaced client's refresh token goes with it, because the SDK would present it under the new `client_id`.
+ */
+export declare function withRegistration(current: McpStoredAuth | undefined, clientInfo: McpClientRegistration, flow: RegistrationFlow): McpStoredAuth;
+/** After an authorizing flow's code exchange: its staged client replaces the signed-in one and that client's grant. */
+export declare function withPromotedRegistration(current: McpStoredAuth | undefined, flow: RegistrationFlow): McpStoredAuth | undefined;
+//# sourceMappingURL=registered-redirect.d.ts.map

package/dist/core/extensions/builtin/mcp/auth/registered-redirect.js

@@ -0,0 +1,55 @@
+// Matched against the redirect URIs the client sent when it registered: an authorization server may echo them
+// rewritten. A registration saved before that record existed falls back to the echo; one with neither is kept.
+function registrationNamesRedirect(registration, redirectUrl) {
+    const registered = registration.redirectUrisSent ?? registration.redirect_uris;
+    if (registered === undefined || redirectUrl === undefined)
+        return true;
+    return registered.some((uri) => String(uri) === String(redirectUrl));
+}
+/** The registration a flow uses: for an authorizing flow, the signed-in or staged client naming its redirect URI. */
+export function registrationForFlow(record, flow) {
+    if (flow.requireRegisteredRedirect !== true)
+        return record?.clientInfo;
+    return [record?.clientInfo, record?.pendingClientInfo].find((registration) => registration !== undefined && registrationNamesRedirect(registration, flow.redirectUrl));
+}
+function usesStagedRegistration(record, flow) {
+    const registration = registrationForFlow(record, flow);
+    return registration !== undefined && registration === record?.pendingClientInfo;
+}
+/** The stored grant as a flow may present it: a staged client has no grant, so the refresh token is withheld. */
+export function grantForFlow(record, flow) {
+    if (record === undefined || !usesStagedRegistration(record, flow))
+        return record;
+    const grant = { ...record };
+    delete grant.refreshToken;
+    return grant;
+}
+/**
+ * Stores a registration. An authorizing flow stages a client that would replace the signed-in one; otherwise a
+ * replaced client's refresh token goes with it, because the SDK would present it under the new `client_id`.
+ */
+export function withRegistration(current, clientInfo, flow) {
+    const known = [current?.clientInfo, current?.pendingClientInfo].some((registration) => registration?.client_id === clientInfo.client_id);
+    // The SDK registers with `clientMetadata.redirect_uris`, which is exactly the flow's redirect URL.
+    const registration = known || flow.redirectUrl === undefined
+        ? clientInfo
+        : { ...clientInfo, redirectUrisSent: [String(flow.redirectUrl)] };
+    const replaced = current?.clientInfo?.client_id;
+    if (replaced === undefined || replaced === registration.client_id)
+        return { ...(current ?? {}), clientInfo: registration };
+    if (flow.requireRegisteredRedirect === true)
+        return { ...current, pendingClientInfo: registration };
+    const next = { ...current, clientInfo: registration };
+    delete next.refreshToken;
+    return next;
+}
+/** After an authorizing flow's code exchange: its staged client replaces the signed-in one and that client's grant. */
+export function withPromotedRegistration(current, flow) {
+    if (current?.pendingClientInfo === undefined || !usesStagedRegistration(current, flow))
+        return current;
+    const next = { ...current, clientInfo: current.pendingClientInfo };
+    delete next.pendingClientInfo;
+    delete next.refreshToken;
+    return next;
+}
+//# sourceMappingURL=registered-redirect.js.map

package/dist/core/extensions/builtin/mcp/auth/token-store.d.ts

@@ -1,9 +1,30 @@
 import type { OAuthDiscoveryState } from "@modelcontextprotocol/sdk/client/auth.js";
 import type { OAuthClientInformationFull } from "@modelcontextprotocol/sdk/shared/auth.js";
+export type McpClientRegistration = OAuthClientInformationFull & {
+    redirectUrisSent?: string[];
+};
+export interface McpAuthorizationProof {
+    readonly credentialIdentity: string;
+    readonly previousCredentialIdentity?: string;
+    readonly issuer: string;
+    readonly resource: string;
+    readonly clientIdentity: string;
+    readonly scope: string;
+    readonly refreshScope?: string;
+}
+export interface McpAuthorization {
+    readonly version: 1;
+    readonly id: string;
+    readonly proof?: McpAuthorizationProof;
+}
 export interface McpStoredAuth {
+    readonly scope?: string;
+    readonly refreshScope?: string;
+    readonly authorization?: McpAuthorization;
     accessToken?: string;
     refreshToken?: string;
-    clientInfo?: OAuthClientInformationFull;
+    clientInfo?: McpClientRegistration;
+    pendingClientInfo?: McpClientRegistration;
     codeVerifier?: string;
     discoveryState?: OAuthDiscoveryState;
     resource?: string;
@@ -33,6 +54,7 @@ export declare class McpTokenStore<TRecord extends McpStoredAuth = McpStoredAuth
     readonly serverUrl: string;
     constructor(options: TokenStoreOptions);
     get rootDir(): string;
+    get agentDir(): string;
     get dir(): string;
     get tokensPath(): string;
     get lockPath(): string;

package/dist/core/extensions/builtin/mcp/auth/token-store.js

@@ -40,6 +40,9 @@ export class McpTokenStore {
     get rootDir() {
         return join(this.#agentDir, AUTH_ROOT);
     }
+    get agentDir() {
+        return this.#agentDir;
+    }
     get dir() {
         return join(this.rootDir, this.#hash);
     }

package/dist/core/extensions/builtin/mcp/catalog-cache.js

@@ -39,24 +39,25 @@ export function cachedCatalogNeedsRefresh(cached, now = Date.now()) {
     return now - cached.fetchedAt > CACHE_TTL_MS;
 }
 export async function collectServerCatalogForCache(connection, config, configHash, credentialIdentity) {
-    const tools = await collectAllPages((cursor) => listMcpTools(connection.client, cursor === undefined ? {} : { cursor }, {
+    const client = connection.client;
+    const tools = await collectAllPages((cursor) => listMcpTools(client, cursor === undefined ? {} : { cursor }, {
         timeout: config.requestTimeoutMs,
     }));
-    const resources = await collectOptionalPages((cursor) => connection.client.listResources(cursor === undefined ? {} : { cursor }, {
+    const resources = await collectOptionalPages((cursor) => client.listResources(cursor === undefined ? {} : { cursor }, {
         timeout: config.requestTimeoutMs,
     }));
-    const prompts = await collectOptionalPages((cursor) => connection.client.listPrompts(cursor === undefined ? {} : { cursor }, {
+    const prompts = await collectOptionalPages((cursor) => client.listPrompts(cursor === undefined ? {} : { cursor }, {
         timeout: config.requestTimeoutMs,
     }));
-    const resourceTemplates = await collectOptionalPages((cursor) => connection.client.listResourceTemplates(cursor === undefined ? {} : { cursor }, {
+    const resourceTemplates = await collectOptionalPages((cursor) => client.listResourceTemplates(cursor === undefined ? {} : { cursor }, {
         timeout: config.requestTimeoutMs,
     }));
     return {
         configHash,
-        ...(isModernMcpClient(connection.client) ? { modern: true } : {}),
+        ...(isModernMcpClient(client) ? { modern: true } : {}),
         credentialIdentity,
         fetchedAt: Date.now(),
-        instructions: connection.client.getInstructions(),
+        instructions: client.getInstructions(),
         prompts,
         resources,
         resourceTemplates,

package/dist/core/extensions/builtin/mcp/catalog.js

@@ -3,7 +3,8 @@ import { isModernMcpClient } from "./modern/request.js";
 import { hasSupportedModernToolSchemas } from "./modern/tool-schema.js";
 import { collectAllPages } from "./expose/pagination.js";
 export async function collectToolCatalog(server, connection, config, options = {}) {
-    const result = await collectAllPages((cursor) => listMcpTools(connection.client, cursor === undefined ? {} : { cursor }, { timeout: config.requestTimeoutMs }));
+    const client = connection.client;
+    const result = await collectAllPages((cursor) => listMcpTools(client, cursor === undefined ? {} : { cursor }, { timeout: config.requestTimeoutMs }));
     return result.items.map((tool) => ({
         requestOrigin: options.requestOrigin,
         annotations: tool.annotations,
@@ -17,7 +18,7 @@ export async function collectToolCatalog(server, connection, config, options = {
         requestTimeoutMs: config.requestTimeoutMs,
         schema: tool.inputSchema,
         outputSchema: tool.outputSchema,
-        modern: isModernMcpClient(connection.client),
+        modern: isModernMcpClient(client),
         server,
         tool: tool.name,
     }));

package/dist/core/extensions/builtin/mcp/invocation.js

@@ -61,6 +61,12 @@ export function createMcpInvocationResolver(scope) {
             try {
                 await Promise.race([ready, interrupted]);
             }
+            catch (error) {
+                readySignal.throwIfAborted();
+                if (!scope.isCurrent())
+                    return refuse("unavailable", "MCP session or server configuration was replaced.");
+                throw error;
+            }
             finally {
                 clearTimeout(timeout);
                 readySignal.removeEventListener("abort", abort);

package/dist/core/extensions/builtin/mcp/service-register.js

@@ -3,7 +3,7 @@ import { computeMcpExposurePolicy } from "./expose/policy.js";
 import { registerDirectMcpTools } from "./expose/session.js";
 import { ensureMcpToolCallConnection } from "./health.js";
 import { createMcpInvocationResolver } from "./invocation.js";
-import { connectAndRefreshMcpCatalog } from "./startup-race.js";
+import { connectAndRefreshMcpCatalog, prepareMcpAuthentication } from "./startup-race.js";
 export async function registerMcpServiceDirectTools(pi, config, entries, toolSearchService, options = {}) {
     return await registerDirectMcpTools(pi, config, [...entries].map((entry) => {
         const serverConfig = config.servers[entry.name]?.config;
@@ -18,7 +18,21 @@ export async function registerMcpServiceDirectTools(pi, config, entries, toolSea
             servesSession: options.servesSession,
             isCurrent: () => entry.isCurrent?.() !== false && options.isCurrent?.(entry) !== false,
             ready: async () => {
-                await ensureMcpToolCallConnection(entry.connection, () => entry.authPlan?.refresh?.ensureFresh().then(() => undefined) ?? Promise.resolve());
+                if (!(await prepareMcpAuthentication(entry)))
+                    return;
+                if (entry.isCurrent?.() === false || options.isCurrent?.(entry) === false)
+                    return;
+                if (entry.credentialsCurrent?.() === false) {
+                    await entry.onCredentialsChanged?.();
+                    return;
+                }
+                await ensureMcpToolCallConnection(entry.connection);
+                if (entry.isCurrent?.() === false || options.isCurrent?.(entry) === false)
+                    return;
+                if (entry.credentialsCurrent?.() === false) {
+                    await entry.onCredentialsChanged?.();
+                    return;
+                }
                 await connectAndRefreshMcpCatalog(entry, serverConfig);
                 await entry.startupCatalogClaim?.settled();
                 if (entry.isCurrent?.() === false || options.isCurrent?.(entry) === false)

package/dist/core/extensions/builtin/mcp/service-tools-changed.js

@@ -54,71 +54,78 @@ export async function refreshMcpToolsOnListChanged(entry, targets, config, conne
     // The startup connect that still owns registration registers its refreshed catalog itself.
     if (connectOnly && entry.startupCatalogClaim?.ownsRegistration() === true)
         return;
-    const registeredCatalog = entry.cachedCatalog;
-    if (entry.connection instanceof SharedMcpLease) {
-        const refreshed = await entry.connection.catalog();
-        if (!ownsCatalog())
-            return;
-        entry.cachedCatalog = refreshed;
-    }
-    const catalog = await collectToolCatalog(entry.name, entry.connection, server.config, {
-        agentDir: entry.agentDir,
-        outputGuard: config.settings.outputGuard,
-    });
-    if (!ownsCatalog())
-        return;
-    const newNames = mapMcpCatalogNames(catalog).map(({ name }) => name);
-    // Before the first refresh, the registered names are the catalog the startup pass registered.
-    const knownNames = entry.knownToolNames ??
-        (registeredCatalog === undefined
-            ? newNames
-            : mapMcpCatalogNames(cachedToolsToCatalogEntries(entry.name, registeredCatalog, entry.connection, server.config.requestTimeoutMs, async () => { })).map(({ name }) => name));
-    const diff = diffMcpToolNames(knownNames, newNames);
-    const identity = mcpRegistrationIdentity(catalog, entry.cachedCatalog);
-    const initial = targets();
-    const stale = connectOnly ? initial.filter((target) => target.registeredIdentity() !== identity) : initial;
-    if (stale.length > 0) {
-        // Registration reads entry.cachedCatalog. A shared lease refreshed it above; nothing else
-        // refreshes a non-shared connection's catalog after its startup connect (#2188).
-        if (!(entry.connection instanceof SharedMcpLease)) {
-            const refreshed = await collectServerCatalogForCache(entry.connection, server.config, entry.generationHash ?? entry.configHash, entry.credentialIdentity);
+    try {
+        const registeredCatalog = entry.cachedCatalog;
+        if (entry.connection instanceof SharedMcpLease) {
+            const refreshed = await entry.connection.catalog();
             if (!ownsCatalog())
                 return;
             entry.cachedCatalog = refreshed;
-            await writeMcpCachedServer(entry.agentDir, entry.name, refreshed, ownsCatalog);
         }
+        const catalog = await collectToolCatalog(entry.name, entry.connection, server.config, {
+            agentDir: entry.agentDir,
+            outputGuard: config.settings.outputGuard,
+        });
         if (!ownsCatalog())
             return;
-        // Tombstone removed tools BEFORE re-registration so the subsequent
-        // setActiveTools (which excludes them) leaves the tombstones inactive.
-        const seen = new Set(initial.map((target) => target.pi));
-        const failures = [];
-        let pending = stale;
-        while (pending.length > 0) {
-            for (const target of pending) {
+        const newNames = mapMcpCatalogNames(catalog).map(({ name }) => name);
+        // Before the first refresh, the registered names are the catalog the startup pass registered.
+        const knownNames = entry.knownToolNames ??
+            (registeredCatalog === undefined
+                ? newNames
+                : mapMcpCatalogNames(cachedToolsToCatalogEntries(entry.name, registeredCatalog, entry.connection, server.config.requestTimeoutMs, async () => { })).map(({ name }) => name));
+        const diff = diffMcpToolNames(knownNames, newNames);
+        const identity = mcpRegistrationIdentity(catalog, entry.cachedCatalog);
+        const initial = targets();
+        const stale = connectOnly ? initial.filter((target) => target.registeredIdentity() !== identity) : initial;
+        if (stale.length > 0) {
+            // Registration reads entry.cachedCatalog. A shared lease refreshed it above; nothing else
+            // refreshes a non-shared connection's catalog after its startup connect (#2188).
+            if (!(entry.connection instanceof SharedMcpLease)) {
+                const refreshed = await collectServerCatalogForCache(entry.connection, server.config, entry.generationHash ?? entry.configHash, entry.credentialIdentity);
                 if (!ownsCatalog())
                     return;
-                try {
-                    for (const removed of diff.removed)
-                        target.pi.registerTool(buildMcpTombstoneDefinition(removed, entry.name));
-                    await target.register();
-                }
-                catch (error) {
-                    failures.push(error);
+                entry.cachedCatalog = refreshed;
+                await writeMcpCachedServer(entry.agentDir, entry.name, refreshed, ownsCatalog);
+            }
+            if (!ownsCatalog())
+                return;
+            // Tombstone removed tools BEFORE re-registration so the subsequent
+            // setActiveTools (which excludes them) leaves the tombstones inactive.
+            const seen = new Set(initial.map((target) => target.pi));
+            const failures = [];
+            let pending = stale;
+            while (pending.length > 0) {
+                for (const target of pending) {
+                    if (!ownsCatalog())
+                        return;
+                    try {
+                        for (const removed of diff.removed)
+                            target.pi.registerTool(buildMcpTombstoneDefinition(removed, entry.name));
+                        await target.register();
+                    }
+                    catch (error) {
+                        failures.push(error);
+                    }
                 }
+                // A session that attached during this refresh registered the catalog cached before it.
+                pending = targets().filter((target) => !seen.has(target.pi));
+                for (const target of pending)
+                    seen.add(target.pi);
+            }
+            if (failures.length > 0) {
+                entry.knownToolNames = newNames;
+                entry.lastListChangedDelta = formatMcpListChangedDelta(diff);
+                throw new AggregateError(failures, `MCP ${entry.name} tool refresh failed in ${failures.length} of ${seen.size} session(s)`);
             }
-            // A session that attached during this refresh registered the catalog cached before it.
-            pending = targets().filter((target) => !seen.has(target.pi));
-            for (const target of pending)
-                seen.add(target.pi);
-        }
-        if (failures.length > 0) {
-            entry.knownToolNames = newNames;
-            entry.lastListChangedDelta = formatMcpListChangedDelta(diff);
-            throw new AggregateError(failures, `MCP ${entry.name} tool refresh failed in ${failures.length} of ${seen.size} session(s)`);
         }
+        entry.knownToolNames = newNames;
+        entry.lastListChangedDelta = formatMcpListChangedDelta(diff);
+    }
+    catch (error) {
+        if (!ownsCatalog())
+            return;
+        throw error;
     }
-    entry.knownToolNames = newNames;
-    entry.lastListChangedDelta = formatMcpListChangedDelta(diff);
 }
 //# sourceMappingURL=service-tools-changed.js.map

package/dist/core/extensions/builtin/mcp/startup-race.d.ts

@@ -43,6 +43,8 @@ export declare class McpDeferredAttach {
 }
 export declare function raceMcpStartupConnect(options: RaceMcpStartupConnectOptions): Promise<void>;
 export declare function connectAndRefreshMcpCatalog(entry: McpConnectionEntry, serverConfig: ResolvedMcpServer["config"]): Promise<void>;
+/** Reconcile the grant before health recovery without attempting a transport connection. */
+export declare function prepareMcpAuthentication(entry: McpConnectionEntry): Promise<boolean>;
 export declare function ignoreStartupNeedsAuth(entry: McpConnectionEntry, connect: Promise<void>): Promise<void>;
 export declare function waitForMcpStartupRace(connect: Promise<void>, deadlineMs?: number): Promise<McpStartupRaceResult>;
 export declare function shouldRaceMcpStartup(lifecycle: "lazy" | "eager" | "keep-alive"): boolean;

package/dist/core/extensions/builtin/mcp/startup-race.js

@@ -91,15 +91,16 @@ export function connectAndRefreshMcpCatalog(entry, serverConfig) {
     void refresh.then(finish, finish);
     return refresh;
 }
-async function refreshConnectedMcpCatalog(entry, serverConfig) {
-    if (serverConfig === undefined || entry.isCurrent?.() === false)
-        return;
+/** Reconcile the grant before health recovery without attempting a transport connection. */
+export async function prepareMcpAuthentication(entry) {
+    if (entry.isCurrent?.() === false)
+        return false;
     try {
         await entry.authPlan?.refresh?.ensureFresh();
     }
     catch (error) {
-        if (entry.connection.state === "disabled")
-            return;
+        if (entry.isCurrent?.() === false || entry.connection.state === "disabled")
+            return false;
         const authError = markMcpConnectionNeedsAuth(entry.connection, error);
         if (authError !== undefined) {
             entry.logger.warn(authError.message);
@@ -107,10 +108,17 @@ async function refreshConnectedMcpCatalog(entry, serverConfig) {
         }
         throw error;
     }
+    if (entry.isCurrent?.() === false)
+        return false;
     if (entry.credentialsCurrent?.() === false) {
         await entry.onCredentialsChanged?.();
-        return;
+        return false;
     }
+    return true;
+}
+async function refreshConnectedMcpCatalog(entry, serverConfig) {
+    if (serverConfig === undefined || !(await prepareMcpAuthentication(entry)))
+        return;
     await connectMcpServer(entry.connection, entry.logger);
     if (entry.connection.state !== "connected" || entry.isCurrent?.() === false)
         return;
@@ -120,7 +128,15 @@ async function refreshConnectedMcpCatalog(entry, serverConfig) {
         entry.connection.state === "connected" &&
         entry.connection.generation === generation;
     if (entry.connection instanceof SharedMcpLease) {
-        const catalog = await entry.connection.catalog();
+        let catalog;
+        try {
+            catalog = await entry.connection.catalog();
+        }
+        catch (error) {
+            if (!ownsCatalog())
+                return;
+            throw error;
+        }
         if (!ownsCatalog()) {
             if (entry.credentialsCurrent?.() === false)
                 await entry.onCredentialsChanged?.();
@@ -150,6 +166,8 @@ async function refreshConnectedMcpCatalog(entry, serverConfig) {
             await ensureMcpResourceSubscriptions(entry.connection.client, catalog.resources ?? []);
     }
     catch (error) {
+        if (!ownsCatalog())
+            return;
         entry.logger.warn("Failed to refresh MCP catalog cache", {
             error: error instanceof Error ? error.message : String(error),
         });

package/dist/core/extensions/builtin/permission-system/parsers.js

@@ -203,6 +203,7 @@ export function toolOwnedPermissionRequests(tools, toolName, input, cwd) {
         permission: request.permission,
         patterns: [...request.patterns],
         always: [...request.always],
+        ...(request.autoApproveAsk === true ? { autoApproveAsk: true } : {}),
     }));
 }
 /** Registry for tool-specific permission parsers */

package/dist/core/extensions/builtin/prompt-preset/claude-fable-5-1.js

@@ -85,7 +85,7 @@ ${buildSearchLine(context)}
 Route by true intent, not surface form:
 - Information asks (explain, look into, investigate): read the code and report; no edits.
 - Judgment asks (what do you think, review) and open-ended changes (refactor, improve, clean up): assess and propose, then wait for confirmation.
-- Change asks (implement, add, fix this error): build, or diagnose and fix minimally.
+- Change asks (implement, add, fix this error): build, or diagnose and fix at the cause.
 
 Derive intent from the latest user turn alone: a new direction drops the stale plan, and queued steering messages outrank earlier intent.
 
@@ -93,7 +93,7 @@ Derive intent from the latest user turn alone: a new direction drops the stale p
 
 The request sets the scope, and the scope is the deliverable: deliver all of it and only it. Make routine judgment calls yourself; ask only when different readings would lead to materially different work, and ask after doing everything that does not depend on the answer, through ask_user_question when it is available (waitForAnswer true when the next step depends on the answer). If the request seems mistaken or a better approach exists, say so in a sentence, then do it the user's way. If part of the task is blocked, finish every other part and say exactly what you left out and why.
 
-Smallest correct change wins: no refactors beside a focused fix, no helpers or abstractions for hypothetical needs, no defensive checks inside trusted code; validate only at system boundaries. A pre-existing bug or performance concern you notice is a follow-up for your summary, not a change in this diff. Scratch checks verify and get discarded; commit tests only where the task asks for them or the repository already keeps tests for that kind of change, sized like the neighboring test files. Prefer a surgical edit over rewriting a file when the result would be identical.
+This codebase is yours: what it's for and how it's built are your call, and you'll keep building on it. Change it the way its owner would: build on the code that already does the job instead of adding a parallel copy, fit new behavior into the structure that is there, and leave no duplicate or dead code behind. A defect in the code you are changing is yours to fix now; one elsewhere goes in your summary as a follow-up. Add no helpers or abstractions for hypothetical needs and no defensive checks inside trusted code; validate only at system boundaries. Scratch checks verify and get discarded; commit tests only where the task asks for them or the repository already keeps tests for that kind of change, sized like the neighboring test files. Prefer a surgical edit over rewriting a file when the result would be identical.
 
 ## Working the Task
 
@@ -107,7 +107,7 @@ Scale the checks to the change, never the rigor: diagnostics on every changed fi
 
 ${buildTestDisciplineSection(context.sharedSections)}
 
-Before reporting progress, audit each claim against a tool result from this session; ${context.surface !== "terminal" ? `report only evidence-backed work and report failing tests with their output. ${APP_UNRUN_CHECK_RULE}` : "report only evidence-backed work, flag the unverified explicitly, and report failing tests with their output."} Fix only failures your change caused.
+Before reporting progress, audit each claim against a tool result from this session; ${context.surface !== "terminal" ? `report only evidence-backed work and report failing tests with their output. ${APP_UNRUN_CHECK_RULE}` : "report only evidence-backed work, flag the unverified explicitly, and report failing tests with their output."} Fix failures your change caused and any that sit in the code you changed; note other pre-existing failures separately.
 
 ${context.toolSection}
 

package/dist/core/extensions/builtin/prompt-preset/claude-fable-5-2.js

@@ -16,10 +16,11 @@
 //   retries after a busy tool from nearly all tries to four in ten. "Blind
 //   retries" becomes the exact action it meant, repeating a failure that has not
 //   been diagnosed, so it no longer collides with "wait and retry".
-// - Scope, structure ("Say who owns the code"): with no ownership statement 5.2
-//   repeats existing code instead of reusing it. The user owns the code here, so
-//   the guide's ownership sentence stays out (it invites unrequested changes);
-//   the smallest-change rule says to build on the code that already does the job.
+// - Scope, structure ("Say who owns the code"): the guide's ownership sentence
+//   opens the structure paragraph and replaces the smallest-change sentence
+//   (owner order). Without it, 5.2 acts as a guest: parallel code, duplicates
+//   left in place, and nearby bugs only mentioned. senpi#6358 carries the same
+//   sentence, with what the owner does, into every core.
 // - Working the Task, delegation ("Set expectations for subagents"): the 5.1
 //   sentence was a standing invitation to delegate, which the guide says to
 //   review first. It now states the cost before the invitation, what a brief
@@ -29,7 +30,7 @@
 //   mannered-prose sentence. 5.2 reports run dense, so the rule asks for plain
 //   words, mostly short one-idea sentences, one word per thing, and no names
 //   made up during the work, for a reader switching in from something else.
-// Deliberately absent: the ownership sentence; "answer directly" or think-less
+// Deliberately absent: "answer directly" or think-less
 // lines (the guide: no effect at medium effort and above, lower the effort
 // instead); a token budget; the "treat that answer as done" lines; hard
 // sentence-length limits; any instruction to write reasoning in the reply (a
@@ -67,7 +68,7 @@ ${buildSearchLine(context)}
 Route by true intent, not surface form:
 - Information asks (explain, look into, investigate): read the code and report; no edits.
 - Judgment asks (what do you think, review) and open-ended changes (refactor, improve, clean up): assess and propose, then wait for confirmation.
-- Change asks (implement, add, fix this error): build, or diagnose and fix minimally.
+- Change asks (implement, add, fix this error): build, or diagnose and fix at the cause.
 
 Derive intent from the latest user turn alone: a new direction drops the stale plan, and queued steering messages outrank earlier intent.
 
@@ -77,7 +78,7 @@ The request sets the scope, and the scope is the deliverable: deliver all of it
 
 Errors, timeouts, locked files, empty results, and failing tools are ordinary obstacles, not blockers: diagnose them, then work through them with the access you have (wait and retry a call that is safe to repeat, fix the request, use another tool or source) without asking first. A file marked not to be touched, withheld access, or a safety guardrail is a deliberate blocker: leave it alone and look for another safe way to finish. If part of the task stays blocked, finish every other part and say exactly what you left out and why.
 
-Smallest correct change wins: build on the code that already does the job instead of adding a parallel copy, with no refactors beside a focused fix, no helpers or abstractions for hypothetical needs, and no defensive checks inside trusted code; validate only at system boundaries. A pre-existing bug or performance concern you notice is a follow-up for your summary, not a change in this diff. Scratch checks verify and get discarded; commit tests only where the task asks for them or the repository already keeps tests for that kind of change, sized like the neighboring test files. Prefer a surgical edit over rewriting a file when the result would be identical.
+This codebase is yours: what it's for and how it's built are your call, and you'll keep building on it. Change it the way its owner would: build on the code that already does the job instead of adding a parallel copy, fit new behavior into the structure that is there, and leave no duplicate or dead code behind. A defect in the code you are changing is yours to fix now; one elsewhere goes in your summary as a follow-up. Add no helpers or abstractions for hypothetical needs and no defensive checks inside trusted code; validate only at system boundaries. Scratch checks verify and get discarded; commit tests only where the task asks for them or the repository already keeps tests for that kind of change, sized like the neighboring test files. Prefer a surgical edit over rewriting a file when the result would be identical.
 
 ## Working the Task
 
@@ -91,7 +92,7 @@ Scale the checks to the change, never the rigor: diagnostics on every changed fi
 
 ${buildTestDisciplineSection(context.sharedSections)}
 
-Before reporting progress, audit each claim against a tool result from this session; ${context.surface !== "terminal" ? `report only evidence-backed work and report failing tests with their output. ${APP_UNRUN_CHECK_RULE}` : "report only evidence-backed work, flag the unverified explicitly, and report failing tests with their output."} Fix only failures your change caused.
+Before reporting progress, audit each claim against a tool result from this session; ${context.surface !== "terminal" ? `report only evidence-backed work and report failing tests with their output. ${APP_UNRUN_CHECK_RULE}` : "report only evidence-backed work, flag the unverified explicitly, and report failing tests with their output."} Fix failures your change caused and any that sit in the code you changed; note other pre-existing failures separately.
 
 ${context.toolSection}