@duckmind/dm-darwin-x64 0.66.5 → 0.66.7

package/extensions/dm-mcp-adapter/server-manager.js

@@ -9,7 +9,8 @@ import {
   SseError,
   SSEClientTransport,
   StreamableHTTPClientTransport,
-  UnauthorizedError
+  UnauthorizedError,
+  RegistrationRejectedError
 } from "@modelcontextprotocol/client";
 import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
 import { UnixSocketClientTransport } from "./unix-socket-transport.js";
@@ -25,7 +26,7 @@ import { logger } from "./logger.js";
 import { RESOURCE_MIME_TYPE } from "./ui-app-bridge-helpers.js";
 import { isBuiltInAgentPlugin } from "./agent-plugin-provenance.js";
 import { McpOAuthProvider } from "./mcp-oauth-provider.js";
-import { extractOAuthConfig, supportsOAuth } from "./mcp-auth-flow.js";
+import { explainRegistrationRejection, extractOAuthConfig, supportsOAuth } from "./mcp-auth-flow.js";
 import {
   captureOAuthAuthority,
   inspectAuthForUrl,
@@ -42,6 +43,7 @@ import { attachTaskSession } from "./mcp-tasks.js";
 import {
   interpolateEnvVars,
   expandHomePath,
+  providerAuthUrlError,
   resolveBearerToken,
   resolveCommandSecretsRecord,
   resolveConfigPath,
@@ -76,19 +78,26 @@ function isLiteralLocalAddress(url) {
   local.addSubnet("fe80::", 10, "ipv6");
   return local.check(hostname, family === 6 ? "ipv6" : "ipv4");
 }
-function localNetworkFailureCodes(error, seen = new Set) {
+function isLoopbackUrl(url) {
+  return ["localhost", "127.0.0.1", "[::1]"].includes(new URL(url).hostname);
+}
+const LOCAL_NETWORK_FAILURE_CODES = ["EHOSTUNREACH", "ENETUNREACH", "EACCES"];
+function networkFailureCodes(error, wanted, seen = new Set) {
   if (typeof error !== "object" || error === null || seen.has(error))
     return [];
   seen.add(error);
   const codes = [];
-  if ("code" in error && typeof error.code === "string" && ["EHOSTUNREACH", "ENETUNREACH", "EACCES"].includes(error.code)) {
+  if ("code" in error && typeof error.code === "string" && wanted.includes(error.code)) {
     codes.push(error.code);
   }
   if ("cause" in error)
-    codes.push(...localNetworkFailureCodes(error.cause, seen));
+    codes.push(...networkFailureCodes(error.cause, wanted, seen));
+  if (error instanceof SdkError && typeof error.data === "object" && error.data !== null && "cause" in error.data) {
+    codes.push(...networkFailureCodes(error.data.cause, wanted, seen));
+  }
   if (error instanceof AggregateError) {
     for (const nested of error.errors)
-      codes.push(...localNetworkFailureCodes(nested, seen));
+      codes.push(...networkFailureCodes(nested, wanted, seen));
   }
   return [...new Set(codes)];
 }
@@ -131,6 +140,13 @@ function appendStderrTail(tail, chunk) {
   const combined = Buffer.concat([tail, bytes]);
   return combined.length > MAX_CAPTURED_STDERR_BYTES ? Buffer.from(combined.subarray(combined.length - MAX_CAPTURED_STDERR_BYTES)) : combined;
 }
+
+class AdapterClient extends Client {
+  requestMetadata() {
+    return this._outboundMetaEnvelope();
+  }
+}
+const clientMetadata = new WeakMap;
 const KEEP_ALIVE_REFRESH_TIMEOUT_MS = 5000;
 const LISTEN_RETRY_DELAY_MS = 5000;
 const RECENT_RESOURCE_TTL_MS = 10 * 60000;
@@ -144,14 +160,56 @@ export function isTransientHttpConnectError(error) {
   }
   return false;
 }
+function forwardInit(input, init, request, overrides = {}) {
+  const signal = init?.signal ?? (input instanceof Request ? input.signal : request.signal);
+  return [request.url, {
+    method: request.method,
+    headers: request.headers,
+    body: request.body,
+    cache: request.cache,
+    credentials: request.credentials,
+    integrity: request.integrity,
+    keepalive: request.keepalive,
+    mode: request.mode,
+    redirect: request.redirect,
+    referrer: request.referrer,
+    referrerPolicy: request.referrerPolicy,
+    signal,
+    ...request.body ? { duplex: "half" } : {},
+    ...overrides
+  }];
+}
 function createBearerCommandFetch(resolver, delegate) {
   const innerFetch = delegate ? (input, init) => delegate(input, init) : (input, init) => globalThis.fetch(input, init);
   return async (input, init) => {
     const request = new Request(input, init);
     const token = await resolver.resolve(request.signal);
     const headers = new Headers(request.headers);
-    headers.set("Authorization", `Bearer ${token}`);
-    return innerFetch(new Request(request, { headers }));
+    try {
+      headers.set("Authorization", `Bearer ${token}`);
+    } catch {
+      throw new TypeError("bearerTokenCommand returned a token that is not a valid header value");
+    }
+    return innerFetch(...forwardInit(input, init, request, { headers }));
+  };
+}
+function createProviderTokenFetch(serverUrl, provider, providerToken, delegate) {
+  const origin = new URL(serverUrl).origin;
+  const innerFetch = delegate ? (input, init) => delegate(input, init) : (input, init) => globalThis.fetch(input, init);
+  return async (input, init) => {
+    const request = new Request(input, init);
+    if (new URL(request.url).origin !== origin)
+      return innerFetch(...forwardInit(input, init, request));
+    const token = await providerToken(provider);
+    if (!token)
+      return new Response(null, { status: 401 });
+    const headers = new Headers(request.headers);
+    try {
+      headers.set("Authorization", `Bearer ${token}`);
+    } catch {
+      throw new TypeError(`DM provider "${provider}" returned a token that is not a valid header value`);
+    }
+    return innerFetch(...forwardInit(input, init, request, { headers, redirect: "error" }));
   };
 }
 
@@ -180,6 +238,7 @@ export class McpServerManager {
   connectAttempts = new Map;
   traceSettings;
   traceWriter;
+  providerToken;
   stopped = false;
   constructor(defaultCwd) {
     this.defaultCwd = defaultCwd;
@@ -223,6 +282,19 @@ export class McpServerManager {
   setAuthStorageOptions(options) {
     this.authStorageOptions = options;
   }
+  setProviderToken(providerToken) {
+    this.providerToken = providerToken;
+  }
+  validateProviderAuth(name, definition) {
+    if (typeof definition.auth !== "object")
+      return;
+    const urlError = providerAuthUrlError(resolveServerUrl(definition) ?? "");
+    if (urlError)
+      throw new Error(`MCP server "${name}": ${urlError}`);
+    if (!this.providerToken) {
+      throw new Error(`MCP server "${name}": auth.provider isn't available here; it needs a DM session whose model registry provides provider tokens (DM 0.99.2 or later)`);
+    }
+  }
   setOAuthRuntime(runtime) {
     this.oauthRuntime = runtime;
   }
@@ -275,6 +347,7 @@ export class McpServerManager {
   }
   async connect(name, definition, signal) {
     validateCaFile(definition);
+    this.validateProviderAuth(name, definition);
     if (isServerDisabled(definition))
       throw new Error(`MCP server "${name}" is disabled`);
     if (this.stopped)
@@ -334,6 +407,7 @@ export class McpServerManager {
   }
   async reconnect(name, definition, staleConnection, signal) {
     validateCaFile(definition);
+    this.validateProviderAuth(name, definition);
     if (isServerDisabled(definition))
       throw new Error(`MCP server "${name}" is disabled`);
     if (this.stopped)
@@ -799,6 +873,7 @@ export class McpServerManager {
       const connection = {
         client,
         transport,
+        requestMetadata: () => clientMetadata.get(client)?.(),
         definition,
         tools: [],
         toolsRevision: 0,
@@ -885,7 +960,7 @@ export class McpServerManager {
       if (cleanupFailures.length > 0) {
         reportedError = new AggregateError([error, ...cleanupFailures], "MCP connection setup failed");
       }
-      if (isUnauthorizedHttpError(error) && supportsOAuth(definition) && cleanupFailures.length === 0) {
+      if (isUnauthorizedHttpError(error) && (supportsOAuth(definition) || typeof definition.auth === "object") && cleanupFailures.length === 0) {
         if (!invalidated) {
           invalidateAuthEntryCache(name);
           invalidated = true;
@@ -917,9 +992,15 @@ export class McpServerManager {
     }
   }
   async enrichHttpConnectionError(definition, error) {
+    if (error instanceof RegistrationRejectedError)
+      return explainRegistrationRejection(error, resolveServerUrl(definition));
     const originalMessage = error instanceof Error ? error.message : String(error);
+    if (networkFailureCodes(error, ["ECONNREFUSED"]).length > 0 && isLoopbackUrl(resolveServerUrl(definition))) {
+      const url = new URL(resolveServerUrl(definition));
+      return new Error(`${originalMessage} — Nothing is listening at ${url.origin}${url.pathname}. Start the app or local process that serves this MCP server.`, { cause: error });
+    }
     if (process.platform === "darwin") {
-      const codes = localNetworkFailureCodes(error);
+      const codes = networkFailureCodes(error, LOCAL_NETWORK_FAILURE_CODES);
       if (codes.length > 0 && isLiteralLocalAddress(resolveServerUrl(definition))) {
         return new Error(`${originalMessage} — ${codes.join(", ")} — macOS Local Network Privacy may be blocking access. Check System Settings > Privacy & Security > Local Network for the app hosting DM; enable access if listed and restart it. Try launching DM from Terminal.app or SSH. Routing or firewall problems can also cause this error.`, { cause: error });
       }
@@ -978,7 +1059,7 @@ export class McpServerManager {
     const capabilities = this.buildClientCapabilities();
     const versionNegotiation = resolveVersionNegotiation(definition);
     let client;
-    client = new Client({ name: `pi-mcp-${serverName}`, version: "1.0.0" }, {
+    client = new AdapterClient({ name: `pi-mcp-${serverName}`, version: "1.0.0" }, {
       jsonSchemaValidator: createJsonSchemaValidator(),
       ...versionNegotiation ? { versionNegotiation } : {},
       ...Object.keys(capabilities).length > 0 ? { capabilities } : {},
@@ -1000,6 +1081,7 @@ export class McpServerManager {
         }
       }
     });
+    clientMetadata.set(client, () => client.requestMetadata());
     if (this.samplingConfig) {
       registerSamplingHandler(client, { ...this.samplingConfig, serverName });
     }
@@ -1016,6 +1098,7 @@ export class McpServerManager {
           const accepted = this.acceptedUrlElicitations.get(serverName);
           if (!accepted?.delete(notification.params.elicitationId))
             return;
+          this.touch(serverName);
           this.elicitationConfig?.ui.notify(`MCP browser interaction for ${serverName} completed. You can retry the tool now.`, "info");
         });
       }
@@ -1034,8 +1117,7 @@ export class McpServerManager {
       return;
     connection.tools = tools;
     connection.toolsRevision = (connection.toolsRevision ?? 0) + 1;
-    this.metadataListChangedListener?.(serverName, "tools-list-changed");
-    this.pendingMetadataPublications.delete(serverName);
+    this.publishMetadataChanged(serverName, connection, "tools-list-changed");
   }
   handlePromptsListChanged(serverName, client, error, prompts) {
     if (error) {
@@ -1049,8 +1131,7 @@ export class McpServerManager {
       return;
     connection.prompts = prompts;
     connection.promptDiscoveryFailed = false;
-    this.metadataListChangedListener?.(serverName, "prompts-list-changed");
-    this.pendingMetadataPublications.delete(serverName);
+    this.publishMetadataChanged(serverName, connection, "prompts-list-changed");
   }
   handleResourcesListChanged(serverName, client, error, resources) {
     if (error) {
@@ -1064,8 +1145,7 @@ export class McpServerManager {
       return;
     connection.resources = resources;
     connection.resourceDiscoveryFailed = false;
-    this.metadataListChangedListener?.(serverName, "resources-list-changed");
-    this.pendingMetadataPublications.delete(serverName);
+    this.publishMetadataChanged(serverName, connection, "resources-list-changed");
   }
   async handleUrlElicitationRequired(serverName, error) {
     if (this.runtimeSignal?.aborted || !this.elicitationConfig?.allowUrl)
@@ -1084,6 +1164,7 @@ export class McpServerManager {
   rememberUrlElicitation(serverName, elicitationId) {
     if (this.runtimeSignal?.aborted)
       return;
+    this.touch(serverName);
     let accepted = this.acceptedUrlElicitations.get(serverName);
     if (!accepted) {
       accepted = new Set;
@@ -1095,8 +1176,8 @@ export class McpServerManager {
     throwIfAborted(signal);
     const serverUrl = resolveServerUrl(definition);
     const url = new URL(serverUrl);
+    const provider = typeof definition.auth === "object" ? definition.auth.provider : undefined;
     const literalHeaders = isBuiltInAgentPlugin(definition, "headers");
-    const hasCommandHeader = !literalHeaders && Object.values(definition.headers ?? {}).some((value) => value.startsWith("!") && !value.startsWith("!!"));
     const oauthEnabled = supportsOAuth(definition);
     let headers;
     if (literalHeaders) {
@@ -1118,11 +1199,11 @@ export class McpServerManager {
           headers["Authorization"] = `Bearer ${token}`;
       }
     }
-    if (hasCommandHeader || commandBearer) {
+    for (const [name, value] of Object.entries(headers)) {
       try {
-        new Headers(headers);
+        new Headers({ [name]: value });
       } catch {
-        throw new Error(`Failed to resolve MCP server "${serverName}" HTTP command secret: command returned an invalid header value`);
+        throw new Error(`MCP server "${serverName}" HTTP header "${name}" has an invalid name or value`);
       }
     }
     const requestInit = !oauthEnabled && Object.keys(headers).length > 0 ? { headers } : undefined;
@@ -1154,7 +1235,7 @@ export class McpServerManager {
         invalidateAuthEntryCache(serverName);
       let authState = supportsOAuth(definition) ? definition.auth === undefined ? hasImplicitStoredTokens ? { status: "implicit-stored", provider: createAuthProvider() } : { status: "implicit-deferred" } : { status: "explicit", provider: createAuthProvider() } : { status: "disabled" };
       const commandFetch = definition.requestHeadersCommand ? createRequestHeadersCommandFetch(definition.requestHeadersCommand, caFetch?.fetch) : caFetch?.fetch;
-      const bearerFetch = bearerCommandResolver ? createBearerCommandFetch(bearerCommandResolver, commandFetch) : commandFetch;
+      const bearerFetch = bearerCommandResolver ? createBearerCommandFetch(bearerCommandResolver, commandFetch) : provider !== undefined ? createProviderTokenFetch(serverUrl, provider, this.providerToken, commandFetch) : commandFetch;
       const requestFetch = oauthEnabled ? createOAuthFetch(serverUrl, () => serviceHeaders, this.oauthRuntime?.signal, {
         timeout: false,
         ...bearerFetch ? { delegate: bearerFetch } : {}
@@ -1162,11 +1243,12 @@ export class McpServerManager {
       const attempt = async (kind) => {
         const authProvider = "provider" in authState ? authState.provider : undefined;
         let sseFetchFailure;
-        const transportFetch = kind === "sse" && process.platform === "darwin" && isLiteralLocalAddress(serverUrl) ? async (input, init) => {
+        const sseFailureCodes = kind !== "sse" ? [] : isLoopbackUrl(serverUrl) ? ["ECONNREFUSED"] : process.platform === "darwin" && isLiteralLocalAddress(serverUrl) ? LOCAL_NETWORK_FAILURE_CODES : [];
+        const transportFetch = sseFailureCodes.length > 0 ? async (input, init) => {
           try {
             return await (requestFetch ?? globalThis.fetch)(input, init);
           } catch (error) {
-            if (localNetworkFailureCodes(error).length > 0)
+            if (networkFailureCodes(error, sseFailureCodes).length > 0)
               sseFetchFailure = error;
             throw error;
           }
@@ -1234,7 +1316,7 @@ export class McpServerManager {
           continue;
         }
         if (isUnauthorizedHttpError(result.error)) {
-          if (supportsOAuth(definition)) {
+          if (supportsOAuth(definition) || provider !== undefined) {
             if (!invalidated) {
               invalidateAuthEntryCache(serverName);
               invalidated = true;
@@ -1524,7 +1606,7 @@ export class McpServerManager {
     const connection = this.connections.get(name);
     if (!connection || connection.status !== "connected")
       return false;
-    if (connection.inFlight > 0)
+    if (connection.inFlight > 0 || (connection.activeProtocolOperations ?? 0) > 0)
       return false;
     return Date.now() - connection.lastUsedAt > timeoutMs;
   }

package/extensions/dm-mcp-adapter/session-recovery.js

@@ -45,10 +45,11 @@ export async function withSessionRecovery(deps, serverName, fn) {
     return await fn(connection);
   } catch (err) {
     const definition = deps.config.mcpServers[serverName];
-    if (definition && supportsOAuth(definition) && (err instanceof UnauthorizedError || err instanceof SdkHttpError && err.status === 401)) {
+    const unauthorized = err instanceof UnauthorizedError || err instanceof SdkHttpError && err.status === 401;
+    if (definition && supportsOAuth(definition) && unauthorized) {
       invalidateAuthEntryCache(serverName);
     }
-    if (!isTerminatedSession(err, hadSessionId)) {
+    if (!isTerminatedSession(err, hadSessionId) && !(unauthorized && typeof definition?.auth === "object")) {
       throw err;
     }
     if (!definition) {

package/extensions/dm-mcp-adapter/skills/mcp-scripting/SKILL.md

@@ -1,49 +1,45 @@
 ---
 name: mcp-scripting
-description: Write mcpScript JavaScript for discovering, inspecting, and calling MCP tools.
+description: Read before writing mcpScript code. Covers tool discovery, the shape of call results (including JSON returned as text), and script limits.
 disable-model-invocation: true
 ---
 
 # MCP scripting
 
-For multi-call MCP work, write ordinary JavaScript with loops, filtering, chaining, fan-out, or other logic between calls. Run that source with `mcpScript`; it is the primary MCP orchestration surface. For a single MCP search, describe, status check, auth action, or tool call, use `mcp` instead.
+Use `mcpScript` when a request needs several MCP calls with logic between them, or when one call's output should go straight into another call. For a single search, describe, status check, auth action, or call, use `mcp`.
 
-Write the source naturally, then pass it as `mcpScript`'s `code` argument:
+Only what the script emits, logs, or returns enters the conversation, so keep intermediate data in variables and return a small result:
 
 ```js
-const { items } = await tools.search({ query: "search issues", server: "github" });
-const candidate = items[0];
-if (!candidate) return { error: "No matching tool" };
+const found = await tools.search({ query: "list issues", server: "github" });
+const path = found.items[0]?.path;
+if (!path) return { error: "No matching tool" };
 
-const details = await tools.describe({ path: candidate.path });
-if (details.error) return details;
-
-const result = await tools.call(details.path, { query: "is:open label:bug" });
+const result = await tools.call(path, { state: "open" });
 if (!result.ok) return result;
-emit({ tool: details.path, completed: true });
-return result.data;
+const issues = result.data.structuredContent ?? JSON.parse(result.data.content[0].text);
+return issues.filter((issue) => issue.comments === 0).map((issue) => issue.number);
 ```
 
-## Workflow
-
-1. Find candidate tools with `await tools.search({ query, server?, limit?, offset? })`.
-2. Inspect the exact returned path with `await tools.describe({ path })`.
-3. Call it with `tools.call(path, args)`.
-
-Descriptors include `inputTypeScript` (a compact parameter shape, or formatted schema fallback). When a compact shape would omit documented fields, `inputGuidance` preserves their descriptions, including formats and units. Undocumented inputs stay compact.
-
-When advertised by the server, `outputSchema` is the original JSON Schema and `outputSchemaTarget` is `"data.structuredContent"`: it describes structured output inside the successful `{ ok: true, data }` call envelope, not the envelope itself. Inspect this schema for result fields and constraints; unsupported constructs remain intact rather than being presented as an approximate TypeScript type. Both output fields are absent when no output schema is advertised. Discovery and cache refresh preserve these optional schemas; old cache entries gain them on the next server metadata refresh. Ordinary search results do not include schemas.
+## API
 
-Calls resolve to `{ ok: true, data }` or `{ ok: false, error }`; handle failed calls instead of expecting them to stop the script. `emit(value)` adds user-visible output before the final `return` value. `console` output is captured too.
+- `await tools.search({ query, server?, regex?, searchMode?, limit?, offset? })` returns `{ items: [{ path, name, server, description? }], total, hasMore, nextOffset }`, plus `error: { code, message }` when the search cannot run. It is the same search as `mcp({ search })`; an empty `query` with `server` lists that server's tools. Filter the items in code; follow `nextOffset` for more than one page.
+- `await tools.describe({ path, server? })` returns `inputTypeScript` (plus `inputGuidance` when documented fields would otherwise be lost) and optional `annotations`. When the server declares an `outputSchema`, it describes `data.structuredContent`. Otherwise, once the tool has returned JSON (in this or an earlier `mcpScript` session), `observedOutput` gives `{ target, typeScript }`: where the JSON is, and the field names and types seen so far. It is a hint, not a contract.
+- `await tools.call(path, args, { server }?)` returns `{ ok: true, data }` or `{ ok: false, error: { code, message } }`. A failed call does not stop the script. When two servers share a tool name, pass the hit's `server` to `describe` and `call`.
+- Known paths can be called directly and resolve the same `{ ok, data }` way: `tools.github_search_issues(args)`, or `tools["server_tool-name"](args)` for hyphenated names. `tools` cannot be enumerated. `search`, `call`, `describe`, `then`, `catch`, `finally`, `toJSON`, `toString`, and `valueOf` are reserved; call a colliding path with `tools.call`.
+- `emit(value)` adds output before the final `return` value; `console` output is captured too.
 
-With `settings.jev.scriptEvaluation` enabled, call `jev.evaluate({ state, questions, sources })`; declare every MCP server represented in state. The host conservatively taints the whole script with every server-attributed call result or error, so every declared or observed source must remain enabled and allowed for later direct evaluations and semantic searches. Semantic search requires `searchMode: "semantic"`. Direct and semantic attempts share count, UTF-8 request-byte, deadline, and provider-reported token budgets. Scores do not bypass `tools.call` approval. Action loops must use fresh observations, positive step/time/evaluation budgets, validated operations and targets, and stop on uncertainty, staleness, no progress, no match, or missing information. Do not retry a possibly side-effectful action.
+## Reading results
 
-On success, `data` may still be the raw MCP `CallToolResult` envelope rather than the domain payload. Check `data.structuredContent` for the fields your script expects; if they are absent, inspect text blocks in `data.content` too (some servers emit newline-delimited JSON). If neither shape is understood, return or emit the envelope for inspection instead of coercing it to `[]` or `{}`.
+A tool call's `data` is the raw MCP `CallToolResult` (`{ content, structuredContent?, isError? }`), not the domain payload; resource reads return text. Use `data.structuredContent` when present. Otherwise most JSON APIs return their payload as text, so parse `data.content[0].text` (some servers emit newline-delimited JSON). If neither shape is understood, emit the envelope for inspection instead of coercing it to `[]` or `{}`.
 
-`tools` is a non-enumerable proxy: `Object.keys(tools)` throws. Always use `tools.search` for discovery. When a known flat path is a valid identifier, direct calls such as `tools.github_search_issues(args)` are supported; use bracket syntax for hyphenated names: `tools["server_tool-name"](args)`. `search`, `call`, `describe`, and promise/serialization names (`then`, `catch`, `finally`, `toJSON`, `toString`, `valueOf`) are reserved on the proxy; if a flat path collides with one, call it via `tools.call("exact-path", args)`.
+Write the real script first instead of spending a turn looking at a result. Use `observedOutput` when describe has it; otherwise use the tool description and the field names the API most likely uses. Before a loop that writes (comments, closes, creates), check that the first item has the fields you filter on and throw if it does not, so a wrong guess stops before it changes anything. When a script throws, times out, or returns `[]`, `{}`, `null`, or `""`, its result lists the fields seen from the tools it called; fix the script from that. Never emit a whole list to inspect it.
 
-Successful intermediate data bypasses presentation truncation, summarization, and artifact spill until the script emits, logs, or returns it. A fixed, non-configurable **16 MiB cumulative UTF-8 JSON transfer budget per script** covers sequential and parallel calls. A result exceeding the remaining budget returns `{ ok: false, error: { code: "intermediate_result_too_large", message } }` with a failed call trace; rejected calls do not consume the budget, but upstream side effects may already have happened. Resource calls retain transformed text or `"(empty resource)"`; emitted, logged, or returned output and ordinary MCP calls remain guarded. This is not a memory limit: responses, serialization, copies, concurrency, and script values still allocate memory, and synchronous serialization can delay deadline handling.
+## Limits
 
-`tools.search` and `tools.describe` are asynchronous and must be awaited. The default script timeout is 30 seconds; the worker is terminated at the deadline, including for infinite loops. Every invocation still uses normal lazy connection, authentication, and approval gates. Result details contain a concise `calls` trace with every search, describe, and call operation; each entry includes its query or path, outcome, and duration.
+- Scripts time out after 30 seconds by default (`timeoutMs` changes it). The worker is stopped at the deadline, including infinite loops.
+- Intermediate results share a fixed 16 MiB transfer budget per script. A result that does not fit returns `{ ok: false, error: { code: "intermediate_result_too_large" } }`, and the upstream call may still have had side effects.
+- Every call goes through the normal connection, auth, and approval gates. The result details list each search, describe, and call with its outcome and duration.
+- There are no fluent helpers such as `tools.find`, `tools.parallel`, or `tools.retry`; use loops and `Promise.all`.
 
-Use plain JavaScript loops and Promise utilities for composition. Fluent helpers such as `tools.find(...).one()`, `tools.parallel(...)`, and `tools.retry(...)` are not provided.
+When `settings.jev.scriptEvaluation` is enabled, read [references/jev.md](references/jev.md) before calling `jev.evaluate`.

package/extensions/dm-mcp-adapter/skills/mcp-scripting/references/jev.md

@@ -0,0 +1,3 @@
+# jev.evaluate in mcpScript
+
+With `settings.jev.scriptEvaluation` enabled, call `jev.evaluate({ state, questions, sources })`; declare every MCP server represented in state. The host conservatively taints the whole script with every server-attributed call result or error, so every declared or observed source must remain enabled and allowed for later direct evaluations and semantic searches. Semantic search requires `searchMode: "semantic"`. Direct and semantic attempts share count, UTF-8 request-byte, deadline, and provider-reported token budgets. Scores do not bypass `tools.call` approval. Action loops must use fresh observations, positive step/time/evaluation budgets, validated operations and targets, and stop on uncertainty, staleness, no progress, no match, or missing information. Do not retry a possibly side-effectful action.

package/extensions/dm-mcp-adapter/test-runner.mjs

@@ -12,6 +12,6 @@ function run(script, scriptArgs = []) {
 }
 if (args.length > 0) {
   run("test:vitest", args);
-} else if (run("test:vitest", ["--exclude", "__tests__/ui-server-browser.test.ts"]) && run("test:vitest", ["__tests__/ui-server-browser.test.ts"])) {
+} else if (run("test:vitest", ["--maxWorkers=2", "--exclude", "__tests__/ui-server-browser.test.ts"]) && run("test:vitest", ["--maxWorkers=2", "__tests__/ui-server-browser.test.ts"])) {
   run("test:public-exports");
 }

package/extensions/dm-mcp-adapter/tool-approval.js

@@ -13,9 +13,14 @@ export function isToolCallApprovalRequired(config, serverName, toolMeta, toolMet
   const definition = config.mcpServers[serverName];
   const serverApproval = definition?.approveTools;
   const approval = serverApproval !== undefined ? serverApproval : config.settings?.approveTools;
-  if (approval === true)
+  if (approval === undefined || approval === false)
+    return false;
+  if (approval === "destructive") {
+    return toolMeta.resourceUri === undefined && toolMeta.annotations?.readOnlyHint !== true && toolMeta.annotations?.destructiveHint !== false;
+  }
+  if (!Array.isArray(approval))
     return true;
-  if (!Array.isArray(approval) || approval.length === 0)
+  if (approval.length === 0)
     return false;
   const prefix = resolveToolPrefix(definition, config.settings?.toolPrefix);
   const currentCandidates = getToolNameCandidates(toolMeta.originalName, serverName, prefix, false);
@@ -66,8 +71,8 @@ export function isToolCallApprovalRequired(config, serverName, toolMeta, toolMet
 function isMcpToolApprovalDecision(value) {
   return value === "allow_once" || value === "allow_for_session" || value === "deny" || value === "abstain";
 }
-async function requestBrokerApproval(state, serverName, toolMeta, args, origin, signal) {
-  if (!state.approvalEvents)
+export async function requestBrokerApproval(events, serverName, toolMeta, args, origin, signal) {
+  if (!events)
     return "abstain";
   let acceptingClaim = true;
   let handler;
@@ -86,7 +91,7 @@ async function requestBrokerApproval(state, serverName, toolMeta, args, origin,
       return true;
     }
   };
-  state.approvalEvents.emit(MCP_TOOL_APPROVAL_REQUEST_EVENT, request);
+  events.emit(MCP_TOOL_APPROVAL_REQUEST_EVENT, request);
   acceptingClaim = false;
   if (!handler)
     return "abstain";
@@ -103,7 +108,7 @@ export async function ensureToolCallApproved(state, serverName, toolMeta, args,
   const ownedSignal = combineAbortSignals(state.owner?.signal, signal);
   const approvedServers = state.approvedServers ??= new Map;
   const serverIdentity = getServerApprovalIdentity(state, serverName);
-  const brokerDecision = await requestBrokerApproval(state, serverName, toolMeta, args, origin, signal);
+  const brokerDecision = await requestBrokerApproval(state.approvalEvents, serverName, toolMeta, args, origin, signal);
   if (brokerDecision === "allow_once")
     return { ok: true };
   if (brokerDecision === "allow_for_session") {
@@ -134,8 +139,13 @@ export async function ensureToolCallApproved(state, serverName, toolMeta, args,
   const sanitized = sanitizeTerminalText(json);
   const preview = sanitized.length > 500 ? `${sanitized.slice(0, 500)}...` : sanitized;
   const title = `MCP: ${sanitizeTerminalText(serverName)} wants to run ${sanitizeTerminalText(toolMeta.originalName)}`;
+  const hint = toolMeta.annotations?.destructiveHint === true ? `
+
+The server marks this tool as destructive: it may delete or overwrite data.` : toolMeta.annotations?.readOnlyHint === true ? `
+
+The server marks this tool as read-only.` : "";
   const serverScope = "Allow server for this session permits all tools and arguments on this server until reload or session/branch change. Other security and UI consent checks still apply.";
-  const decision = await abortable(state.ui.select(`${title}
+  const decision = await abortable(state.ui.select(`${title}${hint}
 
 Arguments:
 ${preview}

package/extensions/dm-mcp-adapter/tool-metadata.js

@@ -1,7 +1,7 @@
 import { getToolUiResourceUri } from "./ui-app-bridge-helpers.js";
 import { createToolSelectorCandidateIndex, formatToolName, getToolNameCandidates, isToolAllowed, resolveToolPrefix, resolveUniqueNameOwnership } from "./types.js";
 import { resourceNameToToolName } from "./resource-tools.js";
-import { extractToolUiStreamMode } from "./utils.js";
+import { extractToolAnnotations, extractToolUiStreamMode } from "./utils.js";
 import { extractUiToolVisibility, isUiToolVisibleToModel } from "./ui-tool-visibility.js";
 export function buildToolMetadata(tools, resources, definition, serverName, prefix, configuredServers, knownMetadata, includeMissingConfiguredCandidates = false) {
   const metadata = [];
@@ -78,6 +78,7 @@ export function buildToolMetadata(tools, resources, definition, serverName, pref
       failedTools.push(tool.name);
     }
     const uiStreamMode = extractToolUiStreamMode(tool._meta);
+    const annotations = extractToolAnnotations(tool.annotations);
     metadata.push({
       name,
       originalName: tool.name,
@@ -86,7 +87,8 @@ export function buildToolMetadata(tools, resources, definition, serverName, pref
       ...tool.outputSchema !== undefined ? { outputSchema: tool.outputSchema } : {},
       ...uiResourceUri !== undefined ? { uiResourceUri } : {},
       ...uiVisibility !== undefined ? { uiVisibility } : {},
-      ...uiStreamMode !== undefined ? { uiStreamMode } : {}
+      ...uiStreamMode !== undefined ? { uiStreamMode } : {},
+      ...annotations !== undefined ? { annotations } : {}
     });
   }
   if (definition.exposeResources !== false) {

package/extensions/dm-mcp-adapter/tool-parameters.js

@@ -0,0 +1,4 @@
+import { Type } from "typebox";
+export function toToolParameters(schema) {
+  return typeof Type.Unsafe === "function" ? Type.Unsafe(schema) : schema;
+}