@duckmind/dm-linux-x64 0.65.4 → 0.65.6

package/extensions/dm-mcp-adapter/session-approvals.js

@@ -0,0 +1,127 @@
+import { createHash } from "node:crypto";
+import { logger } from "./logger.js";
+import { stableStringify } from "./utils.js";
+export const MCP_APPROVAL_CUSTOM_TYPE = "mcp-approval-v1";
+const TOOL_APPROVAL_KEYS = [
+  "version",
+  "kind",
+  "decision",
+  "serverName",
+  "originalToolName",
+  "definitionHash",
+  "argsHash"
+];
+const IFRAME_APPROVAL_KEYS = ["version", "kind", "decision", "serverName"];
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+export function computeToolArgumentsHash(args) {
+  return createHash("sha256").update(stableStringify(args ?? {})).digest("hex");
+}
+export function computeToolDefinitionHash(toolMeta) {
+  return createHash("sha256").update(stableStringify({
+    originalName: toolMeta.originalName,
+    inputSchema: toolMeta.inputSchema ?? null,
+    resourceUri: toolMeta.resourceUri ?? null,
+    uiResourceUri: toolMeta.uiResourceUri ?? null
+  })).digest("hex");
+}
+export function makeToolApprovalKey(serverName, originalToolName, definitionHash, argsHash) {
+  return `${serverName}\x00${originalToolName}\x00${definitionHash}\x00${argsHash}`;
+}
+export function getToolApprovalIdentity(serverName, toolMeta, args) {
+  const definitionHash = computeToolDefinitionHash(toolMeta);
+  const argsHash = computeToolArgumentsHash(args);
+  return {
+    definitionHash,
+    argsHash,
+    cacheKey: makeToolApprovalKey(serverName, toolMeta.originalName, definitionHash, argsHash)
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasExactKeys(value, keys) {
+  const actualKeys = Object.keys(value);
+  return actualKeys.length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function isSha256(value) {
+  return typeof value === "string" && SHA256_HEX.test(value);
+}
+function isSessionApprovalEntry(value) {
+  if (!isRecord(value) || value.version !== 1 || !isNonEmptyString(value.serverName))
+    return false;
+  if (value.kind === "tool") {
+    return hasExactKeys(value, TOOL_APPROVAL_KEYS) && value.decision === "allow_for_session" && isNonEmptyString(value.originalToolName) && isSha256(value.definitionHash) && isSha256(value.argsHash);
+  }
+  if (value.kind === "iframe") {
+    return hasExactKeys(value, IFRAME_APPROVAL_KEYS) && (value.decision === "allow" || value.decision === "deny");
+  }
+  return false;
+}
+function isApprovalCustomEntry(entry) {
+  return isRecord(entry) && entry.type === "custom" && entry.customType === MCP_APPROVAL_CUSTOM_TYPE;
+}
+export function createSessionApprovalWriter(appendEntry, canAppend = undefined) {
+  return (record) => {
+    if (canAppend && !canAppend())
+      return;
+    try {
+      appendEntry(MCP_APPROVAL_CUSTOM_TYPE, record);
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      logger.debug(`MCP: failed to persist session approval: ${detail}`);
+    }
+  };
+}
+export function rememberToolApproval(state, serverName, toolMeta, args) {
+  const { definitionHash, argsHash, cacheKey } = getToolApprovalIdentity(serverName, toolMeta, args);
+  const approvedToolCalls = state.approvedToolCalls ??= new Map;
+  if (approvedToolCalls.has(cacheKey))
+    return;
+  approvedToolCalls.set(cacheKey, true);
+  const record = {
+    version: 1,
+    kind: "tool",
+    decision: "allow_for_session",
+    serverName,
+    originalToolName: toolMeta.originalName,
+    definitionHash,
+    argsHash
+  };
+  try {
+    state.persistSessionApproval?.(record);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    logger.debug(`MCP: session approval persistence callback failed: ${detail}`);
+  }
+}
+export function getServerApprovalIdentity(state, serverName) {
+  if (!Object.hasOwn(state.config.mcpServers, serverName))
+    return;
+  const definition = state.config.mcpServers[serverName];
+  if (!definition)
+    return;
+  return {
+    definition,
+    hash: createHash("sha256").update(stableStringify(definition)).digest("hex")
+  };
+}
+export function restoreSessionApprovalState(state, branchEntries) {
+  const approvedToolCalls = state.approvedToolCalls ??= new Map;
+  approvedToolCalls.clear();
+  state.approvedServers = new Map;
+  state.consentManager.clear();
+  for (const entry of branchEntries) {
+    if (!isApprovalCustomEntry(entry))
+      continue;
+    if (!isSessionApprovalEntry(entry.data))
+      continue;
+    if (entry.data.kind === "tool") {
+      approvedToolCalls.set(makeToolApprovalKey(entry.data.serverName, entry.data.originalToolName, entry.data.definitionHash, entry.data.argsHash), true);
+      continue;
+    }
+    state.consentManager.restoreDecision(entry.data.serverName, entry.data.decision === "allow");
+  }
+}

package/extensions/dm-mcp-adapter/skills/mcp-scripting/SKILL.md

@@ -30,10 +30,20 @@ return result.data;
 2. Inspect the exact returned path with `await tools.describe({ path })`.
 3. Call it with `tools.call(path, args)`.
 
+Descriptors include `inputTypeScript` (a compact parameter shape, or formatted schema fallback). When a compact shape would omit documented fields, `inputGuidance` preserves their descriptions, including formats and units. Undocumented inputs stay compact.
+
+When advertised by the server, `outputSchema` is the original JSON Schema and `outputSchemaTarget` is `"data.structuredContent"`: it describes structured output inside the successful `{ ok: true, data }` call envelope, not the envelope itself. Inspect this schema for result fields and constraints; unsupported constructs remain intact rather than being presented as an approximate TypeScript type. Both output fields are absent when no output schema is advertised. Discovery and cache refresh preserve these optional schemas; old cache entries gain them on the next server metadata refresh. Ordinary search results do not include schemas.
+
 Calls resolve to `{ ok: true, data }` or `{ ok: false, error }`; handle failed calls instead of expecting them to stop the script. `emit(value)` adds user-visible output before the final `return` value. `console` output is captured too.
 
+With `settings.jev.scriptEvaluation` enabled, call `jev.evaluate({ state, questions, sources })`; declare every MCP server represented in state. The host conservatively taints the whole script with every server-attributed call result or error, so every declared or observed source must remain enabled and allowed for later direct evaluations and semantic searches. Semantic search requires `searchMode: "semantic"`. Direct and semantic attempts share count, UTF-8 request-byte, deadline, and provider-reported token budgets. Scores do not bypass `tools.call` approval. Action loops must use fresh observations, positive step/time/evaluation budgets, validated operations and targets, and stop on uncertainty, staleness, no progress, no match, or missing information. Do not retry a possibly side-effectful action.
+
+On success, `data` may still be the raw MCP `CallToolResult` envelope rather than the domain payload. Check `data.structuredContent` for the fields your script expects; if they are absent, inspect text blocks in `data.content` too (some servers emit newline-delimited JSON). If neither shape is understood, return or emit the envelope for inspection instead of coercing it to `[]` or `{}`.
+
 `tools` is a non-enumerable proxy: `Object.keys(tools)` throws. Always use `tools.search` for discovery. When a known flat path is a valid identifier, direct calls such as `tools.github_search_issues(args)` are supported; use bracket syntax for hyphenated names: `tools["server_tool-name"](args)`. `search`, `call`, `describe`, and promise/serialization names (`then`, `catch`, `finally`, `toJSON`, `toString`, `valueOf`) are reserved on the proxy; if a flat path collides with one, call it via `tools.call("exact-path", args)`.
 
-`tools.search` and `tools.describe` are asynchronous and must be awaited. The default script timeout is 30 seconds; the worker is terminated at the deadline, including for infinite loops. Every invocation still uses normal lazy connection, authentication, output guarding, and approval gates. Result details contain a concise `calls` trace with every search, describe, and call operation; each entry includes its query or path, outcome, and duration.
+Successful intermediate data bypasses presentation truncation, summarization, and artifact spill until the script emits, logs, or returns it. A fixed, non-configurable **16 MiB cumulative UTF-8 JSON transfer budget per script** covers sequential and parallel calls. A result exceeding the remaining budget returns `{ ok: false, error: { code: "intermediate_result_too_large", message } }` with a failed call trace; rejected calls do not consume the budget, but upstream side effects may already have happened. Resource calls retain transformed text or `"(empty resource)"`; emitted, logged, or returned output and ordinary MCP calls remain guarded. This is not a memory limit: responses, serialization, copies, concurrency, and script values still allocate memory, and synchronous serialization can delay deadline handling.
+
+`tools.search` and `tools.describe` are asynchronous and must be awaited. The default script timeout is 30 seconds; the worker is terminated at the deadline, including for infinite loops. Every invocation still uses normal lazy connection, authentication, and approval gates. Result details contain a concise `calls` trace with every search, describe, and call operation; each entry includes its query or path, outcome, and duration.
 
 Use plain JavaScript loops and Promise utilities for composition. Fluent helpers such as `tools.find(...).one()`, `tools.parallel(...)`, and `tools.retry(...)` are not provided.

package/extensions/dm-mcp-adapter/test-runner.mjs

@@ -1,11 +1,10 @@
-import { spawnSync } from "node:child_process";
-const npm = process.platform === "win32" ? "npm.cmd" : "npm";
+import crossSpawn from "cross-spawn";
 const args = process.argv.slice(2);
 function run(script, scriptArgs = []) {
   const commandArgs = ["run", script];
   if (scriptArgs.length > 0)
     commandArgs.push("--", ...scriptArgs);
-  const result = spawnSync(npm, commandArgs, { stdio: "inherit" });
+  const result = crossSpawn.sync("npm", commandArgs, { stdio: "inherit" });
   if (result.error)
     throw result.error;
   process.exitCode = result.status ?? 1;
@@ -13,6 +12,6 @@ function run(script, scriptArgs = []) {
 }
 if (args.length > 0) {
   run("test:vitest", args);
-} else if (run("test:vitest")) {
+} else if (run("test:vitest", ["--exclude", "__tests__/ui-server-browser.test.ts"]) && run("test:vitest", ["__tests__/ui-server-browser.test.ts"])) {
   run("test:public-exports");
 }

package/extensions/dm-mcp-adapter/tool-approval.js

@@ -1,6 +1,7 @@
-import { createHash, randomUUID } from "node:crypto";
+import { randomUUID } from "node:crypto";
 import { abortable } from "./abort.js";
 import { combineAbortSignals } from "./runtime-owner.js";
+import { getServerApprovalIdentity, getToolApprovalIdentity, rememberToolApproval } from "./session-approvals.js";
 import {
   getToolNameCandidates,
   matchesToolPattern,
@@ -8,17 +9,6 @@ import {
   MCP_TOOL_APPROVAL_REQUEST_EVENT
 } from "./types.js";
 import { sanitizeTerminalText } from "./utils.js";
-function stableStringify(value) {
-  if (value === null || value === undefined || typeof value !== "object") {
-    const serialized = JSON.stringify(value);
-    return serialized === undefined ? "undefined" : serialized;
-  }
-  if (Array.isArray(value)) {
-    return `[${value.map((item) => stableStringify(item)).join(",")}]`;
-  }
-  const object = value;
-  return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(object[key])}`).join(",")}}`;
-}
 export function isToolCallApprovalRequired(config, serverName, toolMeta, toolMetadata) {
   const definition = config.mcpServers[serverName];
   const serverApproval = definition?.approveTools;
@@ -110,21 +100,30 @@ async function requestBrokerApproval(state, serverName, toolMeta, args, origin,
   }
 }
 export async function ensureToolCallApproved(state, serverName, toolMeta, args, signal, origin = toolMeta.resourceUri ? "resource" : "proxy", approvalMetadata) {
-  const argsHash = createHash("sha256").update(stableStringify(args ?? {})).digest("hex");
-  const cacheKey = `${serverName}\x00${toolMeta.originalName}\x00${argsHash}`;
-  const approvedToolCalls = state.approvedToolCalls ??= new Map;
-  if (approvedToolCalls.has(cacheKey)) {
-    return { ok: true };
-  }
+  const ownedSignal = combineAbortSignals(state.owner?.signal, signal);
+  const approvedServers = state.approvedServers ??= new Map;
+  const serverIdentity = getServerApprovalIdentity(state, serverName);
   const brokerDecision = await requestBrokerApproval(state, serverName, toolMeta, args, origin, signal);
   if (brokerDecision === "allow_once")
     return { ok: true };
   if (brokerDecision === "allow_for_session") {
-    approvedToolCalls.set(cacheKey, true);
+    rememberToolApproval(state, serverName, toolMeta, args);
     return { ok: true };
   }
   if (brokerDecision === "deny")
     return { ok: false, reason: "denied" };
+  const serverGrant = approvedServers.get(serverName);
+  const liveServerIdentity = getServerApprovalIdentity(state, serverName);
+  if (serverGrant && state.approvedServers === approvedServers && serverGrant.definition === liveServerIdentity?.definition && serverGrant.hash === liveServerIdentity?.hash) {
+    ownedSignal?.throwIfAborted();
+    return { ok: true };
+  }
+  approvedServers.delete(serverName);
+  const { cacheKey } = getToolApprovalIdentity(serverName, toolMeta, args);
+  const approvedToolCalls = state.approvedToolCalls ??= new Map;
+  if (approvedToolCalls.has(cacheKey)) {
+    return { ok: true };
+  }
   if (!isToolCallApprovalRequired(state.config, serverName, toolMeta, approvalMetadata ?? state.toolMetadata)) {
     return { ok: true };
   }
@@ -135,16 +134,27 @@ export async function ensureToolCallApproved(state, serverName, toolMeta, args,
   const sanitized = sanitizeTerminalText(json);
   const preview = sanitized.length > 500 ? `${sanitized.slice(0, 500)}...` : sanitized;
   const title = `MCP: ${sanitizeTerminalText(serverName)} wants to run ${sanitizeTerminalText(toolMeta.originalName)}`;
-  const ownedSignal = combineAbortSignals(state.owner?.signal, signal);
+  const serverScope = "Allow server for this session permits all tools and arguments on this server until reload or session/branch change. Other security and UI consent checks still apply.";
   const decision = await abortable(state.ui.select(`${title}
 
 Arguments:
-${preview}`, ["Allow once", "Allow for session", "Deny"]), ownedSignal);
+${preview}
+
+${serverScope}`, ["Allow once", "Allow for session", "Allow server for this session", "Deny"]), ownedSignal);
+  if (decision === "Allow server for this session") {
+    ownedSignal?.throwIfAborted();
+    const currentIdentity = getServerApprovalIdentity(state, serverName);
+    if (!serverIdentity || state.approvedServers !== approvedServers || currentIdentity?.definition !== serverIdentity.definition || currentIdentity.hash !== serverIdentity.hash) {
+      return { ok: false, reason: "denied" };
+    }
+    approvedServers.set(serverName, serverIdentity);
+    return { ok: true };
+  }
   if (decision === "Allow once") {
     return { ok: true };
   }
   if (decision === "Allow for session") {
-    approvedToolCalls.set(cacheKey, true);
+    rememberToolApproval(state, serverName, toolMeta, args);
     return { ok: true };
   }
   return { ok: false, reason: "denied" };

package/extensions/dm-mcp-adapter/tool-metadata.js

@@ -1,12 +1,11 @@
 import { getToolUiResourceUri } from "./ui-app-bridge-helpers.js";
-import { createToolSelectorCandidateIndex, formatToolName, getToolNameCandidates, isToolAllowed, resolveToolPrefix } from "./types.js";
+import { createToolSelectorCandidateIndex, formatToolName, getToolNameCandidates, isToolAllowed, resolveToolPrefix, resolveUniqueNameOwnership } from "./types.js";
 import { resourceNameToToolName } from "./resource-tools.js";
 import { extractToolUiStreamMode } from "./utils.js";
 import { extractUiToolVisibility, isUiToolVisibleToModel } from "./ui-tool-visibility.js";
 export function buildToolMetadata(tools, resources, definition, serverName, prefix, configuredServers, knownMetadata, includeMissingConfiguredCandidates = false) {
   const metadata = [];
   const failedTools = [];
-  const seenNames = new Set;
   const effectivePrefix = resolveToolPrefix(definition, prefix);
   const hasToolFilters = Array.isArray(definition.includeTools) && definition.includeTools.length > 0 || Array.isArray(definition.excludeTools) && definition.excludeTools.length > 0;
   const selectorCandidateIndex = hasToolFilters && configuredServers ? (() => {
@@ -68,14 +67,10 @@ export function buildToolMetadata(tools, resources, definition, serverName, pref
       continue;
     }
     const name = formatToolName(tool.name, serverName, effectivePrefix);
-    if (seenNames.has(name)) {
-      continue;
-    }
     const uiVisibility = extractUiToolVisibility(tool._meta);
     if (!isUiToolVisibleToModel(uiVisibility)) {
       continue;
     }
-    seenNames.add(name);
     let uiResourceUri;
     try {
       uiResourceUri = getToolUiResourceUri({ _meta: tool._meta });
@@ -88,6 +83,7 @@ export function buildToolMetadata(tools, resources, definition, serverName, pref
       originalName: tool.name,
       description: tool.description ?? "",
       ...tool.inputSchema !== undefined ? { inputSchema: tool.inputSchema } : {},
+      ...tool.outputSchema !== undefined ? { outputSchema: tool.outputSchema } : {},
       ...uiResourceUri !== undefined ? { uiResourceUri } : {},
       ...uiVisibility !== undefined ? { uiVisibility } : {},
       ...uiStreamMode !== undefined ? { uiStreamMode } : {}
@@ -100,10 +96,6 @@ export function buildToolMetadata(tools, resources, definition, serverName, pref
         continue;
       }
       const name = formatToolName(baseName, serverName, effectivePrefix);
-      if (seenNames.has(name)) {
-        continue;
-      }
-      seenNames.add(name);
       metadata.push({
         name,
         originalName: baseName,
@@ -112,7 +104,11 @@ export function buildToolMetadata(tools, resources, definition, serverName, pref
       });
     }
   }
-  return { metadata, failedTools };
+  const ownership = resolveUniqueNameOwnership(metadata, (tool) => tool.name);
+  for (const colliding of ownership.collisions.values()) {
+    failedTools.push(...colliding.map((tool) => tool.originalName));
+  }
+  return { metadata: ownership.unique, failedTools };
 }
 export function getToolNames(state, serverName) {
   return state.toolMetadata.get(serverName)?.map((m) => m.name) ?? [];
@@ -133,6 +129,17 @@ export function findToolByName(metadata, toolName) {
   const normalized = toolName.replace(/-/g, "_");
   return metadata.find((m) => m.name.replace(/-/g, "_") === normalized);
 }
+export function hasSchemaDescriptions(schema, includeRoot = false) {
+  if (!schema || typeof schema !== "object" || Array.isArray(schema))
+    return false;
+  const s = schema;
+  if (includeRoot && typeof s.description === "string" && s.description.length > 0)
+    return true;
+  const hasNestedDescription = (child) => hasSchemaDescriptions(child, true);
+  if (s.properties && typeof s.properties === "object" && !Array.isArray(s.properties) && Object.values(s.properties).some(hasNestedDescription))
+    return true;
+  return hasNestedDescription(s.items) || Array.isArray(s.anyOf) && s.anyOf.some(hasNestedDescription) || Array.isArray(s.oneOf) && s.oneOf.some(hasNestedDescription);
+}
 export function formatSchema(schema, indent = "  ") {
   if (!schema || typeof schema !== "object" || Array.isArray(schema)) {
     return `${indent}(no schema)`;

package/extensions/dm-mcp-adapter/tool-registrar.js

@@ -196,12 +196,15 @@ URI: ${linkUri}`
 }
 export function resolveMcpResultContent(result, scope) {
   const blocks = transformMcpContent(Array.isArray(result.content) ? result.content : [], scope);
-  if (blocks.length > 0)
-    return blocks;
   if (result.structuredContent !== undefined && result.structuredContent !== null) {
-    return [{ type: "text", text: stringifyStructuredContent(result.structuredContent) }];
+    const structured = stringifyStructuredContent(result.structuredContent);
+    if (blocks.length > 0) {
+      return [...blocks, { type: "text", text: `structuredContent:
+${structured}` }];
+    }
+    return [{ type: "text", text: structured }];
   }
-  return [];
+  return blocks;
 }
 function stringifyStructuredContent(value) {
   try {

package/extensions/dm-mcp-adapter/tool-result-renderer.js

@@ -162,8 +162,10 @@ export function formatMcpProxyToolCallLines(args, maxInputChars = DEFAULT_MAX_CA
   }
   if (args.connect)
     return [`mcp connect ${args.connect}`];
-  if (args.describe)
-    return [`mcp describe ${args.describe}`];
+  if (args.describe) {
+    const target = args.server ? `${args.describe} @ ${args.server}` : args.describe;
+    return [`mcp describe ${target}`];
+  }
   if (args.search) {
     let line = `mcp search ${args.search}`;
     if (args.server)

package/extensions/dm-mcp-adapter/types.js

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 export const MCP_STATUS_EVENT = "dm-mcp-adapter/status/v1";
 export const MCP_STATUS_SNAPSHOT_VERSION = 1;
 export {
@@ -75,6 +76,27 @@ export function createUiModelContextUpdate(params, maxChars = 12000) {
 export function isServerDisabled(definition) {
   return definition?.disabled === true;
 }
+const ENCODED_SERVER_NAMESPACE_MARKER = "_mcpns_";
+const MAX_SERVER_NAMESPACE_LENGTH = 59;
+export function formatServerNamespace(serverName) {
+  const normalized = serverName.replace(/-/g, "_");
+  const safe = /^[A-Za-z0-9_]*$/.test(normalized) && !normalized.startsWith(ENCODED_SERVER_NAMESPACE_MARKER);
+  const body = safe ? normalized : encodeServerNamespace(normalized);
+  const namespace = safe ? body : `${ENCODED_SERVER_NAMESPACE_MARKER}${body}`;
+  if (namespace.length <= MAX_SERVER_NAMESPACE_LENGTH)
+    return namespace;
+  const digest = createHash("sha256").update(namespace, "utf8").digest("hex").slice(0, 16);
+  const hashPrefix = `${ENCODED_SERVER_NAMESPACE_MARKER}_h_`;
+  const head = body.slice(0, MAX_SERVER_NAMESPACE_LENGTH - hashPrefix.length - digest.length - 1);
+  return `${hashPrefix}${head}_${digest}`;
+}
+function encodeServerNamespace(name) {
+  return Array.from(name, (character) => {
+    if (character === "_")
+      return "__";
+    return /^[A-Za-z0-9]$/.test(character) ? character : `_${character.codePointAt(0).toString(16)}_`;
+  }).join("");
+}
 export const MCP_TOOL_APPROVAL_REQUEST_EVENT = "dm-mcp-adapter:tool-approval-request";
 function sanitizeServerPrefix(serverName, preserveProviderValid = true) {
   const validCharacters = preserveProviderValid ? /^[A-Za-z0-9_-]$/ : /^[A-Za-z0-9]$/;
@@ -96,11 +118,28 @@ export function getServerPrefix(serverName, mode) {
 export function formatToolName(toolName, serverName, prefix) {
   const p = getServerPrefix(serverName, prefix);
   const sanitized = toolName.replace(/\./g, "_");
+  if (p && sanitized.startsWith(`${p}_`) && sanitized.length > p.length + 1) {
+    return sanitized;
+  }
   return p ? `${p}_${sanitized}` : sanitized;
 }
 export function resolveToolPrefix(definition, globalPrefix) {
   return definition?.toolPrefix ?? globalPrefix ?? "server";
 }
+export function resolveUniqueNameOwnership(entries, getName) {
+  const owners = new Map;
+  for (const entry of entries) {
+    const name = getName(entry);
+    const named = owners.get(name) ?? [];
+    named.push(entry);
+    owners.set(name, named);
+  }
+  const collisions = new Map([...owners].filter(([, named]) => named.length > 1));
+  return {
+    unique: entries.filter((entry) => !collisions.has(getName(entry))),
+    collisions
+  };
+}
 export function resolveServerFromToolName(toolName, serverNames, prefix) {
   if (prefix === "none")
     return;

package/extensions/dm-mcp-adapter/ui-server.js

@@ -2,19 +2,21 @@ import http from "node:http";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
-import { buildAllowAttribute } from "./ui-app-bridge-helpers.js";
+import { buildAllowAttribute, getToolUiResourceUri } from "./ui-app-bridge-helpers.js";
 import { ContentBlockSchema } from "@modelcontextprotocol/core";
 import { ServerError, wrapError } from "./errors.js";
 import { formatAuthRequiredMessage, normalizeToolArguments } from "./utils.js";
-import { buildHostHtmlTemplate, buildCspMetaContent } from "./host-html-template.js";
+import { buildHostHtmlTemplate, buildSandboxResourceCsp } from "./host-html-template.js";
 import {
   buildSandboxProxyCsp,
   buildSandboxProxyHtml,
-  SANDBOX_PROXY_PATH
+  SANDBOX_PROXY_PATH,
+  SANDBOX_RESOURCE_PATH_PREFIX
 } from "./sandbox-proxy-template.js";
 import { logger } from "./logger.js";
 import { SessionRecoveryAuthRequiredError, withSessionRecovery } from "./session-recovery.js";
 import { ensureToolCallApproved, isToolCallApprovalRequired } from "./tool-approval.js";
+import { callToolViaTaskSession } from "./mcp-tasks.js";
 import { extractUiToolVisibility, isUiToolCallableByApp, isUiToolVisibleToModel } from "./ui-tool-visibility.js";
 import { resourceNameToToolName } from "./resource-tools.js";
 import {
@@ -33,7 +35,8 @@ const MOSHI_DISCOVERY_PORT_END = 8396;
 let nextMoshiDiscoveryPort = MOSHI_DISCOVERY_PORT_START;
 export async function startUiServer(options) {
   const sessionToken = options.sessionToken ?? randomUUID();
-  const uiResourceToken = randomUUID();
+  const sandboxResourcePath = `${SANDBOX_RESOURCE_PATH_PREFIX}${randomUUID()}`;
+  const resourceAllow = buildAllowAttribute(options.resource.meta.permissions);
   const log = logger.child({
     component: "UiServer",
     server: options.serverName,
@@ -247,8 +250,12 @@ data: ${JSON.stringify(payload)}
     try {
       const method = req.method || "GET";
       const hostHeader = req.headers.host;
-      const url = new URL(req.url || "/", `http://${hostHeader || "127.0.0.1"}`);
-      if (hostHeader !== undefined && !isAllowedHost(url.hostname)) {
+      if (!hostHeader) {
+        sendText(res, 400, "Missing host");
+        return;
+      }
+      const url = new URL(req.url || "/", `http://${hostHeader}`);
+      if (!isAllowedHost(url.hostname)) {
         sendText(res, 403, "Invalid host");
         return;
       }
@@ -272,12 +279,11 @@ data: ${JSON.stringify(payload)}
         }
         const html = buildHostHtmlTemplate({
           sessionToken,
-          uiResourceToken,
           serverName: options.serverName,
           toolName: options.toolName,
           toolArgs: options.toolArgs,
           resource: options.resource,
-          allowAttribute: buildAllowAttribute(options.resource.meta.permissions),
+          allowAttribute: resourceAllow,
           requireToolConsent: options.consentManager.requiresPrompt(options.serverName),
           cacheToolConsent: options.consentManager.shouldCacheConsent(),
           hostContext,
@@ -317,19 +323,6 @@ data: ${JSON.stringify(payload)}
         sendJson(res, 200, { ok: true, result: { healthy: true } });
         return;
       }
-      if (method === "GET" && url.pathname === "/ui-app") {
-        if (!validateTokenQuery(url, uiResourceToken, res, "resource"))
-          return;
-        touchHeartbeat();
-        const cspContent = buildCspMetaContent(options.resource.meta.csp);
-        res.writeHead(200, {
-          "Content-Type": "text/html; charset=utf-8",
-          "Cache-Control": "no-store",
-          "Content-Security-Policy": cspContent
-        });
-        res.end(options.resource.html);
-        return;
-      }
       if (method === "GET" && url.pathname === "/app-bridge.bundle.js") {
         const bundlePath = path.join(import.meta.dirname, "app-bridge.bundle.js");
         try {
@@ -393,11 +386,16 @@ data: ${JSON.stringify(payload)}
           name: callParams.name,
           arguments: normalizedArguments
         };
+        let uiResourceUri;
+        try {
+          uiResourceUri = getToolUiResourceUri({ _meta: toolDefinition._meta });
+        } catch {}
         const toolMeta = {
           name: callParams.name,
           originalName: callParams.name,
           description: toolDefinition?.description ?? "",
           ...toolDefinition?.inputSchema !== undefined ? { inputSchema: toolDefinition.inputSchema } : {},
+          ...uiResourceUri !== undefined ? { uiResourceUri } : {},
           ...uiVisibility !== undefined ? { uiVisibility } : {}
         };
         const approvalMetadata = new Map(options.state?.toolMetadata);
@@ -437,17 +435,24 @@ data: ${JSON.stringify(payload)}
         try {
           options.manager.touch(options.serverName);
           options.manager.incrementInFlight(options.serverName);
+          const callTool = async (conn) => {
+            await options.manager.ensureListen?.(options.serverName, conn);
+            const requestOptions = options.manager.getRequestOptions?.(options.serverName);
+            if (conn.taskSession) {
+              return callToolViaTaskSession(conn.taskSession, {
+                name: callArgs.name,
+                args: callArgs.arguments,
+                requestTimeoutMs: requestOptions?.timeout,
+                signal: requestOptions?.signal
+              });
+            }
+            return conn.client.callTool(callArgs, requestOptions);
+          };
           const result = options.config ? await withSessionRecovery({
             manager: options.manager,
             config: options.config,
             ...options.onNeedsAuth ? { onNeedsAuth: options.onNeedsAuth } : {}
-          }, options.serverName, async (conn) => {
-            await options.manager.ensureListen?.(options.serverName, conn);
-            return conn.client.callTool(callArgs, options.manager.getRequestOptions?.(options.serverName));
-          }) : await (async () => {
-            await options.manager.ensureListen?.(options.serverName, connection);
-            return connection.client.callTool(callArgs, options.manager.getRequestOptions?.(options.serverName));
-          })();
+          }, options.serverName, callTool) : await callTool(connection);
           sendJson(res, 200, { ok: true, result });
         } finally {
           options.manager.decrementInFlight(options.serverName);
@@ -588,29 +593,39 @@ data: ${JSON.stringify(payload)}
         try {
           const method = req.method || "GET";
           const hostHeader = req.headers.host;
-          const url = new URL(req.url || "/", `http://${hostHeader || "127.0.0.1"}`);
-          if (hostHeader !== undefined && !isAllowedHost(url.hostname)) {
+          if (!hostHeader) {
+            sendText(res, 400, "Missing host");
+            return;
+          }
+          const url = new URL(req.url || "/", `http://${hostHeader}`);
+          if (!isAllowedHost(url.hostname)) {
             sendText(res, 403, "Invalid host");
             return;
           }
-          if (method === "HEAD" && url.pathname === SANDBOX_PROXY_PATH) {
+          if ((method === "GET" || method === "HEAD") && url.pathname === SANDBOX_PROXY_PATH) {
             res.writeHead(200, {
               "Content-Type": "text/html; charset=utf-8",
               "Cache-Control": "no-store",
-              "Content-Security-Policy": buildSandboxProxyCsp()
+              "Content-Security-Policy": buildSandboxProxyCsp(),
+              "Referrer-Policy": "no-referrer",
+              "X-Content-Type-Options": "nosniff"
             });
-            res.end();
+            res.end(method === "HEAD" ? undefined : buildSandboxProxyHtml({
+              parentOrigin,
+              resourcePath: sandboxResourcePath,
+              allowAttribute: resourceAllow
+            }));
             return;
           }
-          if (method === "GET" && url.pathname === SANDBOX_PROXY_PATH) {
+          if ((method === "GET" || method === "HEAD") && url.pathname === sandboxResourcePath) {
             res.writeHead(200, {
               "Content-Type": "text/html; charset=utf-8",
               "Cache-Control": "no-store",
-              "Content-Security-Policy": buildSandboxProxyCsp(),
+              "Content-Security-Policy": buildSandboxResourceCsp(options.resource.meta.csp),
               "Referrer-Policy": "no-referrer",
               "X-Content-Type-Options": "nosniff"
             });
-            res.end(buildSandboxProxyHtml({ parentOrigin }));
+            res.end(method === "HEAD" ? undefined : options.resource.html);
             return;
           }
           sendJson(res, 404, { ok: false, error: "Not found" });