@cydm/pie 2.5.1 → 2.6.0

package/dist/builtin/extensions/ask-user/index.js

@@ -1,9 +1,9 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 import {
   createAskUserCapability
-} from "../../../chunks/chunk-REP6QANY.js";
-import "../../../chunks/chunk-ZKHMNEXL.js";
-import "../../../chunks/chunk-YRXXRLMQ.js";
+} from "../../../chunks/chunk-AZ336HKF.js";
+import "../../../chunks/chunk-Y4CYXJR7.js";
+import "../../../chunks/chunk-O2DKMLNX.js";
 import "../../../chunks/chunk-XXGYUYXI.js";
 import "../../../chunks/chunk-LZQXQOPJ.js";
 

package/dist/builtin/extensions/computer-use/index.js

@@ -3787,8 +3787,23 @@ function wireableInputDescendants(node) {
   visit(node);
   return matches;
 }
+var FOCUS_CHANGING_KEYS = /* @__PURE__ */ new Set(["TAB", "SHIFT+TAB", "ENTER", "RETURN", "SPACE", "UP", "DOWN", "LEFT", "RIGHT", "UP_ARROW", "DOWN_ARROW", "LEFT_ARROW", "RIGHT_ARROW", "ESC", "ESCAPE", "HOME", "END", "PAGE_UP", "PAGE_DOWN", "PAGEDOWN", "PAGEUP"]);
+function isFocusChangingKey(keys2) {
+  const list = typeof keys2 === "string" ? [keys2] : Array.isArray(keys2) ? keys2 : [];
+  for (const raw of list) {
+    if (typeof raw !== "string") continue;
+    const token = raw.trim().toUpperCase().split("+").pop() ?? "";
+    if (FOCUS_CHANGING_KEYS.has(token) || FOCUS_CHANGING_KEYS.has(raw.trim().toUpperCase())) return true;
+  }
+  return false;
+}
 function recordActionFocus(action, state, node, coordinateFocus = false) {
-  if (!["click", "press", "keypress", "typeText"].includes(action.action) || !action.ref && action.action !== "click") return;
+  if (action.action === "keypress" && !action.ref && isFocusChangingKey(action.keys)) {
+    state.currentFocus = true;
+    state.focusRef = void 0;
+    return;
+  }
+  if (!["click", "press", "keypress", "typeText"].includes(action.action) || !action.ref && action.action !== "click" && action.action !== "press" && !coordinateFocus) return;
   state.currentFocus = Boolean(node?.isTextInput && !node.pictureOnly) || coordinateFocus;
   state.focusRef = node?.isTextInput && node.wireRef && !node.pictureOnly ? node.ref : void 0;
   if (!state.currentFocus && node && !node.pictureOnly && action.ref && (action.action === "click" || action.action === "press") && containsEditable(node)) {
@@ -8546,7 +8561,7 @@ async function dispatchUiAction(action, target, look, headless, state, signal) {
   }
   const trace = await helperAct(target, prepared, headless, signal);
   if (!headless) {
-    const coordinateFocus = prepared.action === "click" && "x" in prepared.target;
+    const coordinateFocus = (prepared.action === "click" || prepared.action === "press") && "x" in prepared.target;
     const node = action.ref ? outlineNodeByRef(action.ref.trim()) : coordinateFocus ? editorAtPoint(currentOutlineOrThrow().nodes, action.x, action.y) : void 0;
     recordActionFocus(action, state, node, coordinateFocus);
   }

package/dist/builtin/extensions/computer-use/scripts/setup-helper.mjs

@@ -313,19 +313,100 @@ async function installPrebuiltHelperApp(sourceAppPath) {
 	const existingInfo = await fs.readFile(path.join(helperAppPath, "Contents", "Info.plist"), "utf8").catch(() => undefined);
 	const sourceInfo = await fs.readFile(sourceInfoPath, "utf8");
 	if (existingExecutable?.equals(sourceExecutable) && existingInfo === sourceInfo) {
-		await registerHelperApp();
-		return false;
+		// Byte equality alone is NOT sufficient for the no-change shortcut: a
+		// damaged/missing _CodeSignature (CodeResources tampered or deleted
+		// around an otherwise-identical executable) would otherwise survive
+		// every repair invocation. The existing bundle must still verify.
+		let existingVerifies = false;
+		try {
+			await run("codesign", ["--verify", "--strict", helperAppPath]);
+			existingVerifies = true;
+		} catch {
+			// Fall through to the replacement path below, which re-installs (and
+			// re-verifies) a complete bundle.
+		}
+		if (existingVerifies) {
+			await registerHelperApp();
+			return false;
+		}
 	}
 	// The sealed bundle must arrive intact — a broken signature would burn
 	// the user's TCC grants on an identity that can never validate.
 	await run("codesign", ["--verify", "--strict", sourceAppPath]);
-	await fs.rm(helperAppPath, { force: true, recursive: true });
-	// ditto preserves the bundle byte-for-byte (signature + stapled
-	// notarization ticket). The sealed app is NEVER re-signed here: its
-	// Developer ID designated requirement (identifier + team) is exactly
-	// what gives release builds their best chance of retaining TCC grants.
-	await run("/usr/bin/ditto", [sourceAppPath, helperAppPath]);
-	await registerHelperApp();
+	// Sweep staging directories abandoned by crashed installers (the finally
+	// below only runs on ordinary unwinding). Reclaim is ownership-aware:
+	// the staging name embeds its creator's PID, and ONLY a demonstrably dead
+	// owner (ESRCH on signal-0) plus age beyond a generous slow-install window
+	// makes a stage garbage — mtime alone is not ownership evidence, so a
+	// live/slow installer's stage is never touched.
+	try {
+		const parent = path.dirname(helperAppPath);
+		const base = path.basename(helperAppPath);
+		const entries = await fs.readdir(parent);
+		const cutoff = Date.now() - 60 * 60 * 1000;
+		for (const entry of entries) {
+			// Exact staging format <app>.staged-<pid>-<ts36>: anything else that
+			// merely contains ".staged-" is not ours to touch.
+			const match = new RegExp(`^${base.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\.staged-(\\d+)-[0-9a-z]+$`).exec(entry);
+			if (!match) continue;
+			const staged = path.join(parent, entry);
+			try {
+				const stat = await fs.stat(staged);
+				if (stat.mtimeMs >= cutoff) continue;
+				const ownerPid = Number(match[1]);
+				let ownerAlive = false;
+				try {
+					process.kill(ownerPid, 0);
+					ownerAlive = true;
+				} catch (error) {
+					// ESRCH: dead. EPERM (exists, other user): treat as alive —
+					// conservative, never delete on unknown liveness.
+					ownerAlive = error && error.code === "EPERM";
+				}
+				if (!ownerAlive) await fs.rm(staged, { force: true, recursive: true });
+			} catch { /* raced away */ }
+		}
+	} catch { /* no parent dir yet */ }
+	// Stage-then-swap: the staged copy is verified before publication and the
+	// previous installation survives every failure up to the final swap.
+	// NOTE: the swap itself (rm + rename) is NOT atomic — directory bundles
+	// have no atomic exchange on stock Node — but the failure window no longer
+	// starts before verification, and a crash mid-swap self-heals on the next
+	// run (which re-stages from the verified source).
+	const stagingPath = `${helperAppPath}.staged-${process.pid}-${Date.now().toString(36)}`;
+	await fs.rm(stagingPath, { force: true, recursive: true });
+	try {
+		// ditto preserves the bundle byte-for-byte (signature + stapled
+		// notarization ticket). The sealed app is NEVER re-signed here: its
+		// Developer ID designated requirement (identifier + team) is exactly
+		// what gives release builds their best chance of retaining TCC grants.
+		await run("/usr/bin/ditto", [sourceAppPath, stagingPath]);
+		// Verify the STAGED bundle (not just the source): source mutation
+		// between the verify above and the copy, or a torn copy, stops here.
+		await run("codesign", ["--verify", "--strict", stagingPath]);
+		let published = false;
+		try {
+			await fs.rm(helperAppPath, { force: true, recursive: true });
+			await fs.rename(stagingPath, helperAppPath);
+			published = true;
+		} catch (renameError) {
+			// Cross-device or otherwise unrenamable staging: fall back to a
+			// second ditto onto the final path, then verify the destination. A
+			// VERIFIED fallback is a successful installation — continue to
+			// registration instead of failing after doing the work.
+			try {
+				await run("/usr/bin/ditto", [stagingPath, helperAppPath]);
+				await run("codesign", ["--verify", "--strict", helperAppPath]);
+				published = true;
+			} catch (fallbackError) {
+				fallbackError.cause = renameError;
+				throw fallbackError;
+			}
+		}
+		if (published) await registerHelperApp();
+	} finally {
+		await fs.rm(stagingPath, { force: true, recursive: true }).catch(() => {});
+	}
 	return true;
 }
 

package/dist/builtin/extensions/mcp-adapter/index.js

@@ -24434,6 +24434,7 @@ var StdioClientTransport = class {
 };
 
 // builtin/extensions/mcp-adapter/src/server-manager.ts
+import { createHash } from "node:crypto";
 import * as fs2 from "node:fs";
 import * as path2 from "node:path";
 var CONNECT_TIMEOUT_MS = 3e4;
@@ -24442,6 +24443,56 @@ var PACKAGE_MANAGER_COMMANDS = /* @__PURE__ */ new Set(["npx", "npm", "bunx", "u
 var METADATA_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 var CALL_TIMEOUT_MS = 12e4;
 var STDERR_TAIL_LIMIT = 4e3;
+var DIAGNOSTIC_TEXT_LIMIT = 1500;
+function definitionSecrets(definition) {
+  const secrets = [];
+  for (const value of Object.values(definition.env ?? {})) {
+    if (typeof value === "string" && value.length > 0) secrets.push(value);
+  }
+  for (const value of Object.values(definition.headers ?? {})) {
+    if (typeof value === "string" && value.length > 0) secrets.push(value);
+  }
+  return secrets.sort((a, b) => b.length - a.length);
+}
+function redactSecrets(text, secrets) {
+  let sanitized = text;
+  for (const secret of secrets) {
+    sanitized = sanitized.split(secret).join("[redacted]");
+  }
+  return sanitized;
+}
+function redactLeadingSecretSuffix(text, secrets) {
+  if (secrets.length === 0 || text.length === 0) return text;
+  for (const secret of secrets) {
+    for (let keep = Math.min(secret.length - 1, text.length); keep >= 4; keep--) {
+      if (text.startsWith(secret.slice(secret.length - keep))) {
+        return `[redacted]${text.slice(keep)}`;
+      }
+    }
+  }
+  return text;
+}
+function redactTrailingSecretPrefix(text, secrets) {
+  if (secrets.length === 0 || text.length === 0) return text;
+  for (const secret of secrets) {
+    for (let keep = Math.min(secret.length - 1, text.length); keep >= 4; keep--) {
+      if (text.endsWith(secret.slice(0, keep))) {
+        return `${text.slice(0, text.length - keep)}[redacted]`;
+      }
+    }
+  }
+  return text;
+}
+function redactStderrTail(tail, secrets) {
+  return redactTrailingSecretPrefix(redactLeadingSecretSuffix(redactSecrets(tail, secrets), secrets), secrets);
+}
+function sanitizeDiagnostic(text, secrets) {
+  const sanitized = redactLeadingSecretSuffix(redactSecrets(text, secrets), secrets);
+  if (sanitized.length > DIAGNOSTIC_TEXT_LIMIT) {
+    return `${sanitized.slice(0, DIAGNOSTIC_TEXT_LIMIT)}\u2026[truncated ${sanitized.length - DIAGNOSTIC_TEXT_LIMIT} chars]`;
+  }
+  return sanitized;
+}
 function connectTimeoutFor(definition) {
   if (definition.connectTimeoutMs !== void 0) return definition.connectTimeoutMs;
   const base = path2.basename(definition.command ?? "");
@@ -24499,6 +24550,28 @@ function withTimeout(promise, timeoutMs, label, signal) {
     );
   });
 }
+function cacheFingerprint(definition) {
+  return createHash("sha256").update(JSON.stringify({
+    sourceScope: definition.sourceScope,
+    sourcePath: definition.sourcePath,
+    name: definition.name,
+    command: definition.command,
+    args: definition.args,
+    // Canonicalized (key-sorted) so reordering equivalent env/header keys
+    // does not invalidate cached metadata. Sorting must be locale-stable
+    // (code-unit order, not localeCompare) so the same definition
+    // fingerprints identically on every machine.
+    env: canonicalizeKeys(definition.env),
+    serverCwd: definition.cwd,
+    url: definition.url,
+    headers: canonicalizeKeys(definition.headers),
+    inheritEnv: definition.inheritEnv
+  })).digest("hex").slice(0, 24);
+}
+function canonicalizeKeys(record2) {
+  if (!record2) return {};
+  return Object.fromEntries(Object.entries(record2).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0));
+}
 var McpServerManager = class {
   constructor(definitions, cacheDir, log, now = Date.now) {
     this.now = now;
@@ -24577,8 +24650,9 @@ var McpServerManager = class {
         stderr: "pipe"
       });
       if (transport2.stderr) {
+        const captureSecrets = definitionSecrets(definition);
         transport2.stderr.on("data", (chunk) => {
-          runtime.stderrTail = appendTail(runtime.stderrTail, chunk);
+          runtime.stderrTail = appendTail(runtime.stderrTail, redactSecrets(String(chunk), captureSecrets));
         });
       }
       return { client, transport: transport2 };
@@ -24669,7 +24743,7 @@ var McpServerManager = class {
         if (!runtime.tools) continue;
         const shardPath = path2.join(this.cacheDir, `${key}.json`);
         const tempPath = `${shardPath}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
-        fs2.writeFileSync(tempPath, JSON.stringify({ updatedAt: this.now(), tools: runtime.tools }, null, 2), "utf8");
+        fs2.writeFileSync(tempPath, JSON.stringify({ updatedAt: this.now(), fingerprint: cacheFingerprint(runtime.definition), tools: runtime.tools }, null, 2), "utf8");
         try {
           fs2.renameSync(tempPath, shardPath);
         } catch (error2) {
@@ -24722,10 +24796,11 @@ var McpServerManager = class {
       catalog.set(tool.prefixedName, tool);
       ownerOf.set(tool.prefixedName, tool.server);
     };
-    for (const tools of Object.values(this.readCacheFile())) {
-      for (const tool of tools) {
-        const definition = this.definitions.get(tool.server);
-        if (!definition || definition.disabled) continue;
+    for (const [key, shard] of Object.entries(this.readCacheFile())) {
+      const definition = this.definitions.get(key);
+      if (!definition || definition.disabled) continue;
+      if (shard.fingerprint !== cacheFingerprint(definition)) continue;
+      for (const tool of shard.tools) {
         claim2(tool, false);
       }
     }
@@ -24786,7 +24861,10 @@ var McpServerManager = class {
         if (typeof parsed.updatedAt !== "number" || this.now() - parsed.updatedAt > METADATA_TTL_MS) continue;
         if (!Array.isArray(parsed.tools)) continue;
         const key = name.slice(0, -".json".length);
-        snapshot[key] = parsed.tools;
+        snapshot[key] = {
+          tools: parsed.tools,
+          ...typeof parsed.fingerprint === "string" ? { fingerprint: parsed.fingerprint } : {}
+        };
         updatedAt[key] = parsed.updatedAt;
       } catch {
       }
@@ -24829,13 +24907,17 @@ var McpServerManager = class {
       runtime = await this.connect(server, signal);
     } catch (error2) {
       const runtimeState = this.runtimes.get(server);
-      const tail = runtimeState?.stderrTail.trim();
+      const secrets = definitionSecrets(definition);
+      const tail = redactStderrTail(runtimeState?.stderrTail ?? "", secrets).trim();
       return {
         delivery: "not_sent",
-        error: `MCP server "${server}" failed to start: ${error2 instanceof Error ? error2.message : String(error2)}` + (tail ? `
+        error: sanitizeDiagnostic(
+          `MCP server "${server}" failed to start: ${error2 instanceof Error ? error2.message : String(error2)}` + (tail ? `
 
 Server stderr tail:
-${tail}` : "")
+${tail}` : ""),
+          secrets
+        )
       };
     }
     const client = runtime.client;
@@ -24879,7 +24961,7 @@ ${tail}` : "")
         isError: result.isError === true
       };
     } catch (error2) {
-      const message = error2 instanceof Error ? error2.message : String(error2);
+      const message = sanitizeDiagnostic(error2 instanceof Error ? error2.message : String(error2), definitionSecrets(definition));
       if (error2 instanceof ProtocolError && (error2.code === ProtocolErrorCode.InvalidRequest || error2.code === ProtocolErrorCode.InvalidParams) && /output schema|structured content/i.test(message)) {
         return {
           delivery: "invalid_result",
@@ -24914,7 +24996,7 @@ ${tail}` : "")
 };
 
 // builtin/extensions/mcp-adapter/src/trust.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 import * as fs3 from "node:fs";
 import * as path3 from "node:path";
 function serverFingerprint(cwd, definition) {
@@ -24933,7 +25015,7 @@ function serverFingerprint(cwd, definition) {
     inheritEnv: definition.inheritEnv,
     headers: definition.headers
   });
-  return createHash("sha256").update(spec).digest("hex").slice(0, 24);
+  return createHash2("sha256").update(spec).digest("hex").slice(0, 24);
 }
 var McpTrustStore = class {
   filePath;
@@ -25034,8 +25116,9 @@ function structuredContentIsMirroredInText(textBlocks, structured) {
 function mapMcpOutcome(outcome, maxBytes) {
   if (outcome.delivery !== "ok") {
     const prefix = outcome.delivery === "may_have_run" || outcome.delivery === "invalid_result" ? "[outcome unknown]" : "[not executed]";
+    const errorText = truncate(`${outcome.error ?? "MCP call failed"}`, maxBytes);
     return {
-      content: [{ type: "text", text: `${prefix} ${outcome.error ?? "MCP call failed"}` }],
+      content: [{ type: "text", text: `${prefix} ${errorText}` }],
       details: { mode: "mcp", delivery: outcome.delivery, ...outcome.protocolCode !== void 0 ? { protocolCode: outcome.protocolCode } : {} },
       isError: true
     };
@@ -25070,8 +25153,9 @@ ${JSON.stringify(outcome.structuredContent, null, 2)}` });
     isError: outcome.isError === true
   };
 }
-function createMcpProxyTool(getManager, ensureTrusted, options = {}) {
-  const maxBytes = options.outputMaxBytes ?? DEFAULT_OUTPUT_MAX_BYTES;
+function createMcpProxyTool(getManager, ensureTrusted, optionsOrVerify = {}, options = {}) {
+  const verifyTrusted = typeof optionsOrVerify === "function" ? optionsOrVerify : void 0;
+  const maxBytes = typeof optionsOrVerify === "object" && optionsOrVerify.outputMaxBytes || options.outputMaxBytes || DEFAULT_OUTPUT_MAX_BYTES;
   return {
     name: "mcp",
     label: "MCP",
@@ -25122,8 +25206,10 @@ ${truncate(JSON.stringify(schema ?? {}, null, 2), maxBytes)}` : `unknown MCP too
       }
       const resolved = getManager().resolvePrefixedName(params.tool);
       const server = descriptor?.server ?? resolved?.server ?? "";
+      let dispatchManager;
       if (server) {
-        const trust = await ensureTrusted(server);
+        const managerAtGate = getManager();
+        const trust = await ensureTrusted(server, managerAtGate);
         if (!trust.trusted) {
           return {
             content: [{ type: "text", text: `[not executed] ${trust.reason ?? "MCP server not trusted"}` }],
@@ -25131,6 +25217,15 @@ ${truncate(JSON.stringify(schema ?? {}, null, 2), maxBytes)}` : `unknown MCP too
             isError: true
           };
         }
+        const managerNow = getManager();
+        if (managerNow !== managerAtGate || verifyTrusted !== void 0 && !verifyTrusted(server, managerNow)) {
+          return {
+            content: [{ type: "text", text: `[not executed] MCP config changed during approval for server "${server}" \u2014 the approved definition and the current one differ. Retry the call to approve the new definition.` }],
+            details: { mode: "mcp", delivery: "not_sent" },
+            isError: true
+          };
+        }
+        dispatchManager = managerNow;
       }
       let args = {};
       if (typeof params.args === "string") {
@@ -25146,7 +25241,7 @@ ${truncate(JSON.stringify(schema ?? {}, null, 2), maxBytes)}` : `unknown MCP too
       } else if (params.args && typeof params.args === "object" && !Array.isArray(params.args)) {
         args = params.args;
       }
-      const outcome = await getManager().callTool(params.tool, args, toolContext.signal);
+      const outcome = await (dispatchManager ?? getManager()).callTool(params.tool, args, toolContext.signal);
       return mapMcpOutcome(outcome, maxBytes);
     }
   };
@@ -25204,7 +25299,7 @@ function jsonSchemaToTypebox(schema) {
 // builtin/extensions/mcp-adapter/src/direct-tools.ts
 var FALLBACK_PARAMS = Type.Object({}, { description: "MCP tool arguments (schema unknown until first connect)" });
 var DEFAULT_DIRECT_OUTPUT_MAX_BYTES = 8192;
-function registerDirectTools(ctx, getManager, ensureTrusted, outputMaxBytes) {
+function registerDirectTools(ctx, getManager, ensureTrusted, verifyTrusted, outputMaxBytes) {
   const registered = [];
   const seenNames = /* @__PURE__ */ new Set();
   for (const definition of getManager().listDefinitions()) {
@@ -25218,13 +25313,13 @@ function registerDirectTools(ctx, getManager, ensureTrusted, outputMaxBytes) {
         continue;
       }
       seenNames.add(descriptor.prefixedName);
-      registerDirectTool(ctx, getManager, ensureTrusted, definition, descriptor.prefixedName, descriptor.description, descriptor.inputSchema, outputMaxBytes);
+      registerDirectTool(ctx, getManager, ensureTrusted, verifyTrusted, definition, descriptor.prefixedName, descriptor.description, descriptor.inputSchema, outputMaxBytes);
       registered.push(descriptor.prefixedName);
     }
   }
   return registered;
 }
-function registerDirectTool(ctx, getManager, ensureTrusted, definition, prefixedName, description, inputSchema, outputMaxBytes) {
+function registerDirectTool(ctx, getManager, ensureTrusted, verifyTrusted, definition, prefixedName, description, inputSchema, outputMaxBytes) {
   const parameters = inputSchema ? jsonSchemaToTypebox(inputSchema) : FALLBACK_PARAMS;
   ctx.registerTool({
     name: prefixedName,
@@ -25232,7 +25327,8 @@ function registerDirectTool(ctx, getManager, ensureTrusted, definition, prefixed
     description: `${(description ?? prefixedName).trim()} (MCP server: ${definition.name})`,
     parameters,
     async execute(args, toolContext) {
-      const trust = await ensureTrusted(definition.name);
+      const managerAtGate = getManager();
+      const trust = await ensureTrusted(definition.name, managerAtGate);
       if (!trust.trusted) {
         return {
           content: [{ type: "text", text: `[not executed] ${trust.reason ?? "MCP server not trusted"}` }],
@@ -25240,7 +25336,15 @@ function registerDirectTool(ctx, getManager, ensureTrusted, definition, prefixed
           isError: true
         };
       }
-      const outcome = await getManager().callTool(
+      const managerNow = getManager();
+      if (managerNow !== managerAtGate || verifyTrusted !== void 0 && !verifyTrusted(definition.name, managerNow)) {
+        return {
+          content: [{ type: "text", text: `[not executed] MCP config changed during approval for server "${definition.name}" \u2014 retry the call to approve the new definition.` }],
+          details: { delivery: "not_sent" },
+          isError: true
+        };
+      }
+      const outcome = await managerNow.callTool(
         prefixedName,
         args && typeof args === "object" && !Array.isArray(args) ? args : {},
         toolContext.signal
@@ -25335,8 +25439,8 @@ function mcpAdapter(ctx) {
     fs4.writeFileSync(filePath, JSON.stringify(parsed, null, 2) + "\n", "utf8");
     return filePath;
   }
-  async function ensureTrusted(serverName) {
-    const definition = manager.getDefinition(serverName);
+  async function ensureTrusted(serverName, managerAtGate = manager) {
+    const definition = managerAtGate.getDefinition(serverName);
     if (!definition) return { trusted: false, reason: `unknown MCP server "${serverName}"` };
     if (trustStore.isTrusted(ctx.cwd, definition)) return { trusted: true };
     if (!ctx.interactions.isAvailable()) {
@@ -25360,8 +25464,12 @@ function mcpAdapter(ctx) {
       reason: `MCP server "${definition.name}" was not approved. It was NOT started. Ask the user to approve it, or remove it from ${definition.sourcePath}.`
     };
   }
-  ctx.registerTool(createMcpProxyTool(() => manager, ensureTrusted));
-  const eagerRegistered = registerDirectTools(ctx, () => manager, ensureTrusted);
+  function verifyTrusted(serverName, currentManager) {
+    const definition = currentManager.getDefinition(serverName);
+    return !!definition && trustStore.isTrusted(ctx.cwd, definition);
+  }
+  ctx.registerTool(createMcpProxyTool(() => manager, ensureTrusted, verifyTrusted));
+  const eagerRegistered = registerDirectTools(ctx, () => manager, ensureTrusted, verifyTrusted);
   if (eagerRegistered.length > 0) {
     ctx.log(`mcp: registered ${eagerRegistered.length} direct tool(s) from metadata cache: ${eagerRegistered.join(", ")}`);
   }

package/dist/builtin/extensions/plan-mode/index.js

@@ -7,9 +7,9 @@ import {
   isPlanModeSafeCommand,
   markCompletedPlanSteps,
   restoreExecutionState
-} from "../../../chunks/chunk-REP6QANY.js";
-import "../../../chunks/chunk-ZKHMNEXL.js";
-import "../../../chunks/chunk-YRXXRLMQ.js";
+} from "../../../chunks/chunk-AZ336HKF.js";
+import "../../../chunks/chunk-Y4CYXJR7.js";
+import "../../../chunks/chunk-O2DKMLNX.js";
 import {
   Type
 } from "../../../chunks/chunk-XXGYUYXI.js";

package/dist/builtin/extensions/subagent/index.js

@@ -1,13 +1,13 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 import {
   createCliHostCapabilities
-} from "../../../chunks/chunk-N2MK46AE.js";
+} from "../../../chunks/chunk-G6KCJA6B.js";
 import {
   createSharedFileSystemTools,
   createSubagentCapability
-} from "../../../chunks/chunk-REP6QANY.js";
-import "../../../chunks/chunk-ZKHMNEXL.js";
-import "../../../chunks/chunk-YRXXRLMQ.js";
+} from "../../../chunks/chunk-AZ336HKF.js";
+import "../../../chunks/chunk-Y4CYXJR7.js";
+import "../../../chunks/chunk-O2DKMLNX.js";
 import "../../../chunks/chunk-5353DEEC.js";
 import "../../../chunks/chunk-XXGYUYXI.js";
 import "../../../chunks/chunk-LZQXQOPJ.js";
@@ -39,11 +39,14 @@ function subagentExtension(ctx) {
     debugLog: (module, message, data) => ctx.log(`[subagent:${module}] ${message}${data !== void 0 ? ` ${JSON.stringify(data)}` : ""}`),
     resolveModelClass: (modelClass) => ctx.resolveModelClass?.(modelClass),
     resolveModelRef: (modelRef) => ctx.resolveModelRef?.(modelRef),
-    createRuntimeTools: () => {
+    createRuntimeTools: (mode) => {
       const parentRuntimeTools = ctx.getRuntimeTools();
       if (Array.isArray(parentRuntimeTools) && parentRuntimeTools.length > 0) {
         return parentRuntimeTools.filter((tool) => tool?.name !== "spawn_subagents_parallel");
       }
+      if (mode === "edit") {
+        throw new Error("Edit delegation requires the parent's executable runtime tools; fallback tools are read-mode only.");
+      }
       const configDir = path.join(os.homedir(), ".pie");
       const fsOptions = ctx.yoloMode ? { allowlistedDirs: ["/"] } : {
         accessRoots: [

package/dist/builtin/extensions/todo/index.js

@@ -8,9 +8,9 @@ import {
   executeManageTodoList,
   executionStateToTodos,
   restoreExecutionState
-} from "../../../chunks/chunk-REP6QANY.js";
-import "../../../chunks/chunk-ZKHMNEXL.js";
-import "../../../chunks/chunk-YRXXRLMQ.js";
+} from "../../../chunks/chunk-AZ336HKF.js";
+import "../../../chunks/chunk-Y4CYXJR7.js";
+import "../../../chunks/chunk-O2DKMLNX.js";
 import "../../../chunks/chunk-XXGYUYXI.js";
 import "../../../chunks/chunk-LZQXQOPJ.js";