@edgehero/pi-dispatch-admin 4.1.0 → 4.2.0

package/dist/index.mjs

@@ -9218,6 +9218,7 @@ var init_reserved_env = __esm({
       "PI_FLOW",
       "PI_COMMAND",
       "PI_EXCLUDE_TOOLS",
+      "PI_MCP_SERVERS",
       // Issues #501, #502: the per-job dollar cap (written by the worker since #501, from the trigger's and the
       // deployment's caps) and the allowed-model list (reserved until #502 writes it). Neither can be bound through
       // `run.secrets`: a trigger setting its own cap, or its own list, would be the policy choosing itself.
@@ -10488,7 +10489,7 @@ function sanitizeJobId(id) {
   if (s2 === "") return "unknown-job";
   return s2.replace(/[^A-Za-z0-9._-]/g, "_");
 }
-var COST_CAP_WHYS, RESOURCE_KEYS, EXIT_OOM_KILLED, TOKEN_KEYS, PLAN_RECORD_OUTCOMES, PLAN_RECORD_REASONS, TAIL_CAP_BYTES, UNREADABLE_RECORD, RECORD_CLOCK_SKEW_MS;
+var MCP_RUNNER_REASONS, RUNNER_POLICY_REASONS, COST_CAP_WHYS, RESOURCE_KEYS, EXIT_OOM_KILLED, TOKEN_KEYS, PLAN_RECORD_OUTCOMES, PLAN_RECORD_REASONS, TAIL_CAP_BYTES, UNREADABLE_RECORD, RECORD_CLOCK_SKEW_MS;
 var init_run_history = __esm({
   "../worker/src/run-history.mjs"() {
     init_redact();
@@ -10500,6 +10501,8 @@ var init_run_history = __esm({
     init_wait_for();
     init_repeat_slot();
     init_run_earlier();
+    MCP_RUNNER_REASONS = Object.freeze(["mcp-unavailable", "mcp-config-invalid", "mcp-config-mismatch", "mcp-secret-missing", "mcp-command-missing", "mcp-shadowed"]);
+    RUNNER_POLICY_REASONS = /* @__PURE__ */ new Set(["provider-auth-refused", "cost-cap", "model-not-allowed", "cost-cap-unenforceable", "model-policy-unenforceable", ...MCP_RUNNER_REASONS]);
     COST_CAP_WHYS = Object.freeze(["unboundable", "external", "over-cap"]);
     RESOURCE_KEYS = Object.freeze(["memPeak", "swapPeak", "oomKills", "memSomeUsec", "memFullUsec", "cpuUsec", "throttledUsec", "throttled", "pidsPeak"]);
     EXIT_OOM_KILLED = "oom-killed";
@@ -10529,6 +10532,219 @@ var init_run_history = __esm({
   }
 });
 
+// ../worker/src/mcp-config.mjs
+import { lstatSync as fsLstatSync, readFileSync as fsReadFileSync } from "node:fs";
+import { basename, isAbsolute as isAbsolute4, join, posix as posix2 } from "node:path";
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function refValue(value, { header = false } = {}) {
+  if (typeof value !== "string") return { problem: "is not a string" };
+  const match2 = (header ? HEADER_REF_RE : ENV_REF_RE).exec(value);
+  if (match2) return { name: match2[1] };
+  const shape = header ? `\`\${NAME}\`, or an auth scheme and a space before it (\`Bearer \${NAME}\`; ${MCP_HEADER_SCHEMES.join(", ")})` : "exactly `${NAME}`";
+  return { problem: `must be ${shape}, NAME in capitals, digits and \`_\`: a value is never written in the overlay, which every job can read` };
+}
+function mixedProblem(value, refs) {
+  if (value.startsWith("!")) return "starts with `!`";
+  const rest = value.replace(REF_RE, (_, name) => {
+    refs.add(name);
+    return "";
+  });
+  if (rest.includes("${")) return "has a `${` that is not a whole `${NAME}` reference (NAME in capitals, digits and `_`)";
+  return null;
+}
+function checkServer(name, raw) {
+  const refuse2 = (problem) => ({ name, problem });
+  if (!MCP_SERVER_NAME_RE.test(name)) return refuse2("the name must be lowercase letters and digits, words joined by single `-`, up to 32");
+  if (name.includes("dispatch")) return refuse2("a name holding `dispatch` is reserved for the dispatch admin");
+  if (name === FORGE_MCP_SERVER_NAME) return refuse2("`forge` is reserved for the worker's own forge server (the job's GitHub or GitLab, as its own token), which a trigger names in run.mcp without an overlay entry");
+  if (!isRecord(raw)) return refuse2("the entry is not an object");
+  for (const key of Object.keys(raw)) {
+    if (Object.hasOwn(MCP_REFUSED_KEYS, key)) return refuse2(`\`${key}\` is not accepted: ${MCP_REFUSED_KEYS[key]}`);
+  }
+  const { type } = raw;
+  if (type === "sse") return refuse2("the legacy SSE transport is not supported; use the server's streamable HTTP URL");
+  if (type !== void 0 && !["http", "streamable-http", "stdio"].includes(type)) return refuse2("`type` must be http, streamable-http or stdio");
+  const hasUrl = raw.url !== void 0;
+  const hasCommand = raw.command !== void 0;
+  if (hasUrl === hasCommand) return refuse2("the entry needs exactly one of `url` (streamable HTTP) or `command` (stdio)");
+  const transport3 = hasUrl ? "http" : "stdio";
+  if (type !== void 0 && type === "stdio" !== (transport3 === "stdio")) return refuse2(`\`type\` ${type} does not match a server with \`${hasUrl ? "url" : "command"}\``);
+  const allowed = transport3 === "http" ? MCP_HTTP_KEYS : MCP_STDIO_KEYS;
+  for (const key of Object.keys(raw)) {
+    if (!allowed.includes(key)) return refuse2(`${shown(key)} is not a key a ${transport3 === "http" ? "streamable HTTP" : "stdio"} server takes here`);
+  }
+  if (typeof raw.description !== "string" || raw.description.trim() === "") return refuse2("`description` is required: one sentence on what the server offers, which pi puts in the job's prompt");
+  if (raw.description.length > 300 || /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(raw.description)) return refuse2("`description` must be one line of at most 300 characters, with no control or format characters");
+  if (raw.exposure !== void 0 && !MCP_EXPOSURES.includes(raw.exposure)) return refuse2(`\`exposure\` must be one of ${MCP_EXPOSURES.join(", ")}`);
+  if (raw.toolExposure !== void 0) {
+    if (!isRecord(raw.toolExposure)) return refuse2("`toolExposure` must map tool names or `*` patterns to exposures");
+    for (const [tool, exposure] of Object.entries(raw.toolExposure)) {
+      if (!MCP_EXPOSURES.includes(exposure)) return refuse2(`\`toolExposure\` ${shown(tool)} must be one of ${MCP_EXPOSURES.join(", ")}`);
+    }
+  }
+  if (raw.enabled !== void 0 && typeof raw.enabled !== "boolean") return refuse2("`enabled` must be true or false");
+  if (raw.timeout !== void 0 && !(Number.isInteger(raw.timeout) && raw.timeout > 0 && raw.timeout <= 600)) return refuse2("`timeout` must be a whole number of seconds from 1 to 600");
+  const entry = { name, transport: transport3 };
+  for (const key of ["description", "exposure", "toolExposure", "timeout", "enabled"]) if (raw[key] !== void 0) entry[key] = raw[key];
+  const refs = /* @__PURE__ */ new Set();
+  if (transport3 === "http") {
+    if (typeof raw.url !== "string") return refuse2("`url` must be a string");
+    if (raw.url.includes("#")) return refuse2("`url` must not carry a fragment");
+    const urlProblem = mixedProblem(raw.url, refs);
+    if (urlProblem) return refuse2(`\`url\` ${urlProblem}`);
+    const stand = (word) => raw.url.replace(REF_RE, word);
+    if (!URL.canParse(stand("refa"))) return refuse2("`url` is not a URL");
+    const url = new URL(stand("refa"));
+    if (url.host !== new URL(stand("refb")).host) return refuse2("`url` holds a reference in its host; the host is written as is, since the egress check reads it before the job starts");
+    if (url.href !== stand("refa") && url.href !== `${stand("refa")}/`) return refuse2(`\`url\` must be written in its plain form, as a URL parser writes it back (${JSON.stringify(url.href.replaceAll("refa", "${...}"))})`);
+    if (url.protocol !== "https:" && url.protocol !== "http:") return refuse2("`url` must be http or https");
+    if (url.username !== "" || url.password !== "") return refuse2("`url` must not carry a user name or password; send a credential in a header, as a `${NAME}` reference");
+    const query = raw.url.includes("?") ? raw.url.slice(raw.url.indexOf("?") + 1) : void 0;
+    if (query !== void 0) {
+      for (const pair of query.split("&")) {
+        const eq = pair.indexOf("=");
+        const value = eq === -1 ? "" : pair.slice(eq + 1);
+        if (!ENV_REF_RE.test(value)) return refuse2(`\`url\` query value ${shown(eq === -1 ? pair : pair.slice(0, eq))} must be exactly \`\${NAME}\`: a query is where hosted servers put a key, so no value there is written in the overlay`);
+      }
+    }
+    entry.url = raw.url;
+    if (raw.headers !== void 0) {
+      if (!isRecord(raw.headers)) return refuse2("`headers` must map header names to strings");
+      for (const [header, value] of Object.entries(raw.headers)) {
+        if (!HEADER_NAME_RE.test(header) || RESERVED_NAMES.includes(header)) return refuse2(`header name ${shown(header)} is not a valid HTTP header name`);
+        const ref = refValue(value, { header: true });
+        if (ref.problem) return refuse2(`header ${shown(header)} ${ref.problem}`);
+        refs.add(ref.name);
+      }
+      entry.headers = { ...raw.headers };
+    }
+  } else {
+    if (typeof raw.command !== "string" || raw.command === "") return refuse2("`command` must be a non-empty string");
+    if (raw.command.startsWith("!")) return refuse2("`command` starts with `!`");
+    if (raw.command.includes("$")) return refuse2("`command` holds a `$`; it is used as written, and a reference goes in an argument or `env`");
+    if (raw.command.startsWith("~")) return refuse2("`command` must not start with `~`, which pi reads as the job's home folder");
+    if (!isAbsolute4(raw.command) && raw.command.includes("/")) return refuse2("`command` must be an absolute path or a bare name found on the job image's PATH");
+    if (isAbsolute4(raw.command)) {
+      const normalised = posix2.normalize(raw.command);
+      if (!MCP_COMMAND_ROOTS.some((r2) => normalised.startsWith(`${r2}/`))) return refuse2(`\`command\` must sit under ${MCP_COMMAND_ROOTS.join(", ")} (the job image's own folders and the overlay at /opt/pi-global); the job writes the others`);
+    }
+    if (raw.allowPackageRunner !== void 0 && typeof raw.allowPackageRunner !== "boolean") return refuse2("`allowPackageRunner` must be true or false");
+    const runner = MCP_PACKAGE_RUNNERS.includes(basename(raw.command));
+    if (runner && raw.allowPackageRunner !== true) return refuse2(`\`command\` ${basename(raw.command)} fetches the server from a package registry at start; install it in the job image, or set \`allowPackageRunner: true\` and allowlist the registry`);
+    entry.command = raw.command;
+    if (raw.args !== void 0) {
+      if (!Array.isArray(raw.args) || !raw.args.every((arg) => typeof arg === "string")) return refuse2("`args` must be a list of strings");
+      for (const arg of raw.args) {
+        const problem = mixedProblem(arg, refs);
+        if (problem) return refuse2(`an argument ${problem}`);
+        if (arg.startsWith("~")) return refuse2("an argument starts with `~`, which pi reads as the job's home folder, a folder the job writes");
+      }
+      entry.args = [...raw.args];
+    }
+    if (raw.env !== void 0) {
+      if (!isRecord(raw.env)) return refuse2("`env` must map variable names to strings");
+      for (const [key, value] of Object.entries(raw.env)) {
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key) || RESERVED_NAMES.includes(key)) return refuse2(`env name ${shown(key)} is not a variable name`);
+        const ref = refValue(value);
+        if (ref.problem) return refuse2(`env ${key} ${ref.problem}`);
+        refs.add(ref.name);
+      }
+      entry.env = { ...raw.env };
+    }
+    entry.packageRunner = runner;
+  }
+  entry.refs = [...refs].sort();
+  return entry;
+}
+function parseOverlayMcp(text, path6 = MCP_CONFIG_FILE_NAME) {
+  const fail2 = (why) => {
+    const error = new Error(`${path6}: ${why}`);
+    error.mcpConfig = true;
+    return error;
+  };
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    throw fail2("not valid JSON");
+  }
+  const duplicate = findDuplicateKey(text);
+  if (duplicate) throw fail2(`the key ${JSON.stringify(duplicate.at)} appears twice; JSON keeps only the last, so the file would not say what it reads as`);
+  if (!isRecord(value)) throw fail2("expected an object with an `mcpServers` object");
+  for (const key of Object.keys(value)) {
+    if (!MCP_TOP_KEYS.includes(key)) throw fail2(`${shown(key)} is not a top-level key here (accepted: ${MCP_TOP_KEYS.join(", ")})`);
+  }
+  if (value.autoEnableCodemode !== void 0 && typeof value.autoEnableCodemode !== "boolean") throw fail2("`autoEnableCodemode` must be true or false");
+  if (value.codemodeModels !== void 0 && typeof value.codemodeModels !== "boolean") throw fail2("`codemodeModels` must be true or false");
+  if (value.mcpServers !== void 0 && !isRecord(value.mcpServers)) throw fail2("`mcpServers` must be an object of servers by name");
+  const servers = {};
+  const refused = [];
+  for (const [name, raw] of Object.entries(value.mcpServers ?? {})) {
+    const entry = checkServer(name, raw);
+    if (entry.problem) refused.push(entry);
+    else servers[name] = entry;
+  }
+  return { autoEnableCodemode: value.autoEnableCodemode ?? true, codemodeModels: value.codemodeModels ?? true, servers, refused };
+}
+function mcpServerWhere(server) {
+  if (server.transport === "http") return URL.canParse(server.url) ? new URL(server.url).host : "an unreadable url";
+  return basename(server.command);
+}
+function readOverlayMcp(globalPiDir, { readFileSync: readFileSync11 = fsReadFileSync, lstatSync: lstatSync5 = fsLstatSync } = {}) {
+  if (typeof globalPiDir !== "string" || globalPiDir === "") return null;
+  const path6 = join(globalPiDir, MCP_CONFIG_FILE_NAME);
+  const fail2 = (why) => {
+    const error = new Error(`${path6}: ${why}`);
+    error.mcpConfig = true;
+    return error;
+  };
+  let text;
+  try {
+    const entry = lstatSync5(path6);
+    if (entry.isSymbolicLink()) throw fail2("is a link; replace it with the file itself (the job's read-only mount cannot follow links reliably)");
+    if (!entry.isFile()) throw fail2("is not a regular file; replace it with the file itself");
+    if (entry.size > MCP_CONFIG_MAX_BYTES) throw fail2(`is larger than ${MCP_CONFIG_MAX_BYTES} bytes`);
+    text = String(readFileSync11(path6, "utf8"));
+  } catch (error) {
+    if (ABSENT_CODES.has(error?.code)) return null;
+    throw error;
+  }
+  return parseOverlayMcp(text, path6);
+}
+var MCP_CONFIG_FILE_NAME, MCP_CONFIG_MAX_BYTES, MCP_SERVER_NAME_RE, MCP_EXPOSURES, MCP_TOP_KEYS, COMMON_KEYS, MCP_HTTP_KEYS, MCP_STDIO_KEYS, MCP_REFUSED_KEYS, MCP_PACKAGE_RUNNERS, MCP_COMMAND_ROOTS, MCP_HEADER_SCHEMES, RESERVED_NAMES, HEADER_NAME_RE, ENV_REF_RE, HEADER_REF_RE, REF_RE, shown, FORGE_MCP_SERVER_NAME, FORGE_MCP_KINDS, ABSENT_CODES;
+var init_mcp_config = __esm({
+  "../worker/src/mcp-config.mjs"() {
+    init_json_duplicates();
+    MCP_CONFIG_FILE_NAME = "mcp.json";
+    MCP_CONFIG_MAX_BYTES = 64 * 1024;
+    MCP_SERVER_NAME_RE = /^(?=[a-z0-9-]{1,32}$)[a-z0-9]+(?:-[a-z0-9]+)*$/;
+    MCP_EXPOSURES = Object.freeze(["codemode", "deferred", "direct", "hidden"]);
+    MCP_TOP_KEYS = Object.freeze(["autoEnableCodemode", "codemodeModels", "mcpServers"]);
+    COMMON_KEYS = ["type", "description", "exposure", "toolExposure", "timeout", "enabled"];
+    MCP_HTTP_KEYS = Object.freeze([...COMMON_KEYS, "url", "headers"]);
+    MCP_STDIO_KEYS = Object.freeze([...COMMON_KEYS, "command", "args", "env", "allowPackageRunner"]);
+    MCP_REFUSED_KEYS = Object.freeze({
+      auth: "it sends a pi login's token, which a job does not hold",
+      oauth: "OAuth needs a sign-in in a browser and a token file, and a job has neither",
+      cwd: "a job runs its servers in the checkout"
+    });
+    MCP_PACKAGE_RUNNERS = Object.freeze(["npx", "npm", "pnpm", "pnpx", "yarn", "bunx", "bun", "uvx", "uv", "pipx"]);
+    MCP_COMMAND_ROOTS = Object.freeze(["/usr", "/bin", "/sbin", "/opt", "/app"]);
+    MCP_HEADER_SCHEMES = Object.freeze(["Bearer", "Basic", "Token", "Bot", "ApiKey", "Key", "Splunk", "SSWS", "Digest"]);
+    RESERVED_NAMES = ["__proto__", "constructor", "prototype"];
+    HEADER_NAME_RE = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+    ENV_REF_RE = /^\$\{([A-Z_][A-Z0-9_]*)\}$/;
+    HEADER_REF_RE = new RegExp(`^(?:(?:${MCP_HEADER_SCHEMES.join("|")}) )?\\$\\{([A-Z_][A-Z0-9_]*)\\}$`, "i");
+    REF_RE = /\$\{([A-Z_][A-Z0-9_]*)\}/g;
+    shown = (name) => JSON.stringify(name);
+    FORGE_MCP_SERVER_NAME = "forge";
+    FORGE_MCP_KINDS = Object.freeze(["github", "gitlab"]);
+    ABSENT_CODES = /* @__PURE__ */ new Set(["ENOENT", "ELOOP", "ENOTDIR", "ENAMETOOLONG"]);
+  }
+});
+
 // ../worker/src/budget.mjs
 function dayKey(now = /* @__PURE__ */ new Date(), prefix = "budget") {
   return `${prefix}:${now.toISOString().slice(0, 10)}`;
@@ -10560,7 +10776,7 @@ var init_budget = __esm({
 });
 
 // ../worker/src/pause-windows.mjs
-import { isAbsolute as isAbsolute4 } from "node:path";
+import { isAbsolute as isAbsolute5 } from "node:path";
 function isNonEmptyString2(value) {
   return typeof value === "string" && value.trim() !== "";
 }
@@ -10668,8 +10884,8 @@ function zonedParts(tz, ms) {
 }
 function wallToMs(tz, y, mo, d, hh, mi) {
   const guess = Date.UTC(y, mo - 1, d, hh, mi);
-  const shown = zonedParts(tz, guess);
-  const shownAsUtc = Date.UTC(shown.y, shown.mo - 1, shown.d, shown.hh, shown.mi);
+  const shown2 = zonedParts(tz, guess);
+  const shownAsUtc = Date.UTC(shown2.y, shown2.mo - 1, shown2.d, shown2.hh, shown2.mi);
   return guess - (shownAsUtc - guess);
 }
 function shiftDay(tz, parts, delta) {
@@ -10700,7 +10916,7 @@ function windowEndAt(w, nowMs2) {
 }
 function parseScopeString(text) {
   const scope = String(text).trim().normalize("NFC");
-  if (isAbsolute4(scope) || /^[A-Za-z]:/.test(scope)) return { type: "local", kind: null, repo: null };
+  if (isAbsolute5(scope) || /^[A-Za-z]:/.test(scope)) return { type: "local", kind: null, repo: null };
   const m2 = /^([^/\\:]+):(.*)$/s.exec(scope);
   if (m2 === null) return { type: "bare", kind: null, repo: null };
   if (!isForgeKind(m2[1])) throw configError4(`scope ${JSON.stringify(scope)} starts with an unknown prefix "${m2[1]}:" (a forge-qualified scope starts with one of ${FORGE_KINDS.join(", ")}, such as github:owner/name)`);
@@ -10746,7 +10962,7 @@ var init_fleet_lease = __esm({
 });
 
 // ../worker/src/scoped-limits.mjs
-import { isAbsolute as isAbsolute5, resolve } from "node:path";
+import { isAbsolute as isAbsolute6, resolve } from "node:path";
 function isModelScope(scope) {
   return typeof scope === "string" && scope.startsWith(MODEL_SCOPE_PREFIX);
 }
@@ -10869,7 +11085,7 @@ function normalizeLimit(row, index, path6, version = SCOPED_LIMITS_VERSION) {
     // foreign-platform row (a windows drive path on a POSIX worker) stays verbatim and is inert here;
     // the doctor's unreferenced-scope advisory names it. Resolving it instead would "work" only by
     // both sides mangling into the same cwd-prefixed string -- a match by accident, not by contract.
-    scope: isProjectScope(trimmed) ? trimmed : form.type === "qualified" ? `${form.kind}:${form.repo}` : isAbsolute5(trimmed) ? resolve(trimmed) : trimmed,
+    scope: isProjectScope(trimmed) ? trimmed : form.type === "qualified" ? `${form.kind}:${form.repo}` : isAbsolute6(trimmed) ? resolve(trimmed) : trimmed,
     day: null,
     week: null,
     month: null,
@@ -11015,7 +11231,7 @@ var init_fingerprint = __esm({
 });
 
 // ../worker/src/projects.mjs
-import { isAbsolute as isAbsolute6, resolve as resolve2 } from "node:path";
+import { isAbsolute as isAbsolute7, resolve as resolve2 } from "node:path";
 function parseProjects(text, path6) {
   try {
     return parseProjectsText(text, path6);
@@ -11103,7 +11319,7 @@ function normalizeMember(raw, at, path6) {
   if (form.type === "bare") {
     throw configError4(`${at}: ${JSON.stringify(trimmed)} is a bare repo, which names that repo on every forge; write it with its forge, such as github:${trimmed}, or give an absolute folder: ${path6}`);
   }
-  if (!isAbsolute6(trimmed)) throw configError4(`${at}: ${JSON.stringify(trimmed)} is not an absolute path on this host: ${path6}`);
+  if (!isAbsolute7(trimmed)) throw configError4(`${at}: ${JSON.stringify(trimmed)} is not an absolute path on this host: ${path6}`);
   return resolve2(trimmed);
 }
 function projectsFingerprintInput(projects) {
@@ -11252,7 +11468,7 @@ function parseRepos(repos, projectId, members) {
     if (!isPlainObject(repo)) return refuse(PLAN_INVALID, "projects.repos", "shape");
     if (unknownKey(repo, REPO_KEYS)) return refuse(PLAN_INVALID, "projects.repos", "unknown-key");
     if (repo.ref === void 0) return refuse(PLAN_INVALID, "projects.repos.ref", "missing");
-    if (typeof repo.ref !== "string" || !REF_RE.test(repo.ref)) return refuse(PLAN_INVALID, "projects.repos.ref", "format");
+    if (typeof repo.ref !== "string" || !REF_RE2.test(repo.ref)) return refuse(PLAN_INVALID, "projects.repos.ref", "format");
     if (out.some((r2) => r2.ref === repo.ref)) return refuse(PLAN_INVALID, "projects.repos.ref", "duplicate");
     if (known && !known.includes(repo.ref)) return refuse(PLAN_INVALID, "projects.repos.ref", "unknown-ref");
     if (repo.weight === void 0) return refuse(PLAN_INVALID, "projects.repos.weight", "missing");
@@ -11448,7 +11664,7 @@ function rebase(vector, envelope) {
   for (const id of entries) alloc[id] = floors[id] + shares[id];
   return toNumbers(alloc, anyWeight ? shares[UNALLOCATED] : remainder);
 }
-var PLAN_VERSION, WEIGHT_MAX, REASON_MAX, PLAN_MAX_BYTES, DEFAULT_MAX_PLAN_DAYS, OTHER, PLAN_WRITERS, PLAN_INVALID, PLAN_INCOMPLETE, PLAN_FIELDS, PLAN_RULES, PLAN_LADDER, PLAN_KEYS, PROJECT_KEYS, REPO_KEYS, BASIS_RE, REF_RE, INSTANT_RE, REASON_REFUSED, LIST_MAX, DAY_MS, MAX_PLAN_DAYS, MAX_DATE_MS, UNALLOCATED;
+var PLAN_VERSION, WEIGHT_MAX, REASON_MAX, PLAN_MAX_BYTES, DEFAULT_MAX_PLAN_DAYS, OTHER, PLAN_WRITERS, PLAN_INVALID, PLAN_INCOMPLETE, PLAN_FIELDS, PLAN_RULES, PLAN_LADDER, PLAN_KEYS, PROJECT_KEYS, REPO_KEYS, BASIS_RE, REF_RE2, INSTANT_RE, REASON_REFUSED, LIST_MAX, DAY_MS, MAX_PLAN_DAYS, MAX_DATE_MS, UNALLOCATED;
 var init_priorities = __esm({
   "../worker/src/priorities.mjs"() {
     init_project_id();
@@ -11481,7 +11697,7 @@ var init_priorities = __esm({
     PROJECT_KEYS = /* @__PURE__ */ new Set(["id", "weight", "reason", "repos"]);
     REPO_KEYS = /* @__PURE__ */ new Set(["ref", "weight"]);
     BASIS_RE = /^[0-9a-f]{16}$/;
-    REF_RE = /^[0-9a-f]{8}$/;
+    REF_RE2 = /^[0-9a-f]{8}$/;
     INSTANT_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,3})?Z$/;
     REASON_REFUSED = /[\p{Cc}\p{Cf}\p{Cs}\p{Co}\p{Cn}\p{Zl}\p{Zp}]/u;
     LIST_MAX = 256;
@@ -11634,7 +11850,7 @@ var init_envelope = __esm({
 // ../worker/src/allocation.mjs
 import { randomUUID } from "node:crypto";
 import * as nodeFs2 from "node:fs";
-import { isAbsolute as isAbsolute7, join } from "node:path";
+import { isAbsolute as isAbsolute8, join as join2 } from "node:path";
 function iso(now) {
   return new Date(now instanceof Date ? now.getTime() : now).toISOString();
 }
@@ -11713,12 +11929,12 @@ function auditRow({ at, host, writer, outcome, reason = null, field = null, rule
   };
 }
 function makeAllocationAudit({ logsDir, fs: fs7 = nodeFs2 }) {
-  const dir = join(logsDir, "allocations");
+  const dir = join2(logsDir, "allocations");
   return {
     dir,
     append(row) {
       fs7.mkdirSync(dir, { recursive: true, mode: 448 });
-      fs7.appendFileSync(join(dir, `${String(row.at).slice(0, 7)}.jsonl`), `${JSON.stringify(row)}
+      fs7.appendFileSync(join2(dir, `${String(row.at).slice(0, 7)}.jsonl`), `${JSON.stringify(row)}
 `, { flag: "a", mode: 384 });
     }
   };
@@ -12306,7 +12522,7 @@ __export(valkey_auth_exports, {
   volumeRecordText: () => volumeRecordText
 });
 import { randomBytes } from "node:crypto";
-import { basename, join as join2 } from "node:path";
+import { basename as basename2, join as join3 } from "node:path";
 function newValkeyPassword(random = randomBytes) {
   return random(32).toString("hex");
 }
@@ -12411,7 +12627,7 @@ function valkeyPasswordDecision(keys, { envPath = ".env" } = {}) {
   return { password: null, generate: true, note: null };
 }
 function composeProjectName(dir) {
-  const name = basename(String(dir)).toLowerCase().replace(/[^a-z0-9_-]/g, "").replace(/^[_-]+/, "");
+  const name = basename2(String(dir)).toLowerCase().replace(/[^a-z0-9_-]/g, "").replace(/^[_-]+/, "");
   return name === "" ? "pi-dispatch" : name;
 }
 function composeArgs({ project = null, override = false } = {}) {
@@ -12419,7 +12635,7 @@ function composeArgs({ project = null, override = false } = {}) {
 }
 function valkeyContainerIsOurs(info, { dirs, port }) {
   const labels = info?.Config?.Labels ?? {};
-  const mine = new Set(dirs.filter(Boolean).flatMap((d) => [d, join2(d, "deploy")]));
+  const mine = new Set(dirs.filter(Boolean).flatMap((d) => [d, join3(d, "deploy")]));
   if (typeof labels[DEPLOYMENT_LABEL] === "string") return mine.has(labels[DEPLOYMENT_LABEL]);
   const wd = labels["com.docker.compose.project.working_dir"];
   if (typeof wd === "string") return mine.has(wd);
@@ -12528,7 +12744,7 @@ function volumeRecordText(volume) {
 }
 function readVolumeRecord(dir, fs7) {
   try {
-    const path6 = join2(dir, VALKEY_VOLUME_RECORD);
+    const path6 = join3(dir, VALKEY_VOLUME_RECORD);
     if (!fs7.existsSync(path6)) return null;
     const r2 = JSON.parse(String(fs7.readFileSync(path6, "utf8")));
     return r2 && typeof r2 === "object" ? r2 : null;
@@ -14188,8 +14404,8 @@ function unplainCause(value) {
   if (v.startsWith("=")) return "an = at the start of an unquoted value, which zsh expands as a command name. Quote the whole value";
   if (v.includes(":=")) return "a := in an unquoted value, which zsh expands as a command name. Quote the whole value";
   const bad = /[^A-Za-z0-9_@+=:,./-]/u.exec(v)?.[0];
-  const shown = bad === void 0 ? "" : /^[\x21-\x7e]$/.test(bad) ? `\`${bad}\` ` : `U+${bad.codePointAt(0).toString(16).toUpperCase().padStart(4, "0")} `;
-  return `a character (${shown.trim() || "one"}) outside A-Z, a-z, 0-9 and _@+=:,./- in an unquoted value. Quote the whole value`;
+  const shown2 = bad === void 0 ? "" : /^[\x21-\x7e]$/.test(bad) ? `\`${bad}\` ` : `U+${bad.codePointAt(0).toString(16).toUpperCase().padStart(4, "0")} `;
+  return `a character (${shown2.trim() || "one"}) outside A-Z, a-z, 0-9 and _@+=:,./- in an unquoted value. Quote the whole value`;
 }
 var NETNS_KEEPER_START, QUADLET_FILES, ALL_QUADLET_FILES, DEFAULT_VALKEY_PORT, VALKEY_SHARED_KEY, STACK_KEYS, STACK_VALUE_MAX;
 var init_podman_stack = __esm({
@@ -14220,7 +14436,7 @@ var init_podman_stack = __esm({
 import { lookup as dnsLookup } from "node:dns/promises";
 import { readFileSync as readFileSync2 } from "node:fs";
 import { networkInterfaces, userInfo } from "node:os";
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 function valkeyRefusal(message) {
   return Object.assign(new Error(message), { piDispatchConfig: true, valkeyRefused: true });
 }
@@ -14231,7 +14447,7 @@ function defaultValkeyContext() {
   return contextProvider ? contextProvider() : valkeyClientContext();
 }
 function valkeyClientContext({ env: env2 = process.env, cwd = process.cwd(), platform = process.platform, rootRefused, readEnv: readEnv3 = (p) => readFileSync2(p) } = {}) {
-  const envPath = join3(cwd, ".env");
+  const envPath = join4(cwd, ".env");
   let content = null;
   let error = null;
   try {
@@ -14576,9 +14792,9 @@ var init_connection = __esm({
 // src/deployment-pointer.mjs
 import * as nodeFs3 from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join4, isAbsolute as isAbsolute8 } from "node:path";
+import { join as join5, isAbsolute as isAbsolute9 } from "node:path";
 function pointerPath(env2 = process.env) {
-  return env2.PI_DISPATCH_DEPLOYMENT_FILE || join4(env2.PI_CODING_AGENT_DIR || join4(homedir2(), ".pi", "agent"), POINTER_BASENAME);
+  return env2.PI_DISPATCH_DEPLOYMENT_FILE || join5(env2.PI_CODING_AGENT_DIR || join5(homedir2(), ".pi", "agent"), POINTER_BASENAME);
 }
 function normalizePointer(raw) {
   if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
@@ -14590,7 +14806,7 @@ function normalizePointer(raw) {
   if (raw.version > POINTER_VERSION) {
     return { ignored: `version ${raw.version} is newer than the supported version ${POINTER_VERSION}` };
   }
-  if (typeof raw.deploymentDir !== "string" || !isAbsolute8(raw.deploymentDir)) {
+  if (typeof raw.deploymentDir !== "string" || !isAbsolute9(raw.deploymentDir)) {
     return { ignored: "deploymentDir must be an absolute path" };
   }
   const rawEnv = raw.env === void 0 ? {} : raw.env;
@@ -14601,7 +14817,7 @@ function normalizePointer(raw) {
   for (const key of POINTER_ENV_ALLOWLIST) {
     const value = rawEnv[key];
     if (typeof value !== "string" || value === "") continue;
-    if (key !== "VALKEY_URL" && !isAbsolute8(value)) continue;
+    if (key !== "VALKEY_URL" && !isAbsolute9(value)) continue;
     env2[key] = value;
   }
   return { pointer: { version: raw.version, deploymentDir: raw.deploymentDir, env: env2 } };
@@ -15663,7 +15879,7 @@ return {size, oldest[2] or false, horizon, at, sinceHeld() and 1 or 0, range}
 
 // ../worker/src/size-records.mjs
 import { readdirSync, readFileSync as readFileSync3, statSync as statSync4 } from "node:fs";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 function readSizingRecords(logsDir, { nowMs: nowMs2, fs: fs7 = { readdirSync, readFileSync: readFileSync3, statSync: statSync4 } } = {}) {
   const since = nowMs2 - SIZING_MTIME_DAYS * DAY_MS5;
   let names;
@@ -15677,7 +15893,7 @@ function readSizingRecords(logsDir, { nowMs: nowMs2, fs: fs7 = { readdirSync, re
   for (const name of names) {
     if (typeof name !== "string" || !name.endsWith(".json")) continue;
     try {
-      const path6 = join5(logsDir, name);
+      const path6 = join6(logsDir, name);
       const st = fs7.statSync(path6);
       if (!st.isFile() || st.mtimeMs < since) continue;
       if (st.size > SIZING_RECORD_MAX_BYTES) {
@@ -15718,7 +15934,7 @@ var init_size_records = __esm({
 
 // ../worker/src/capacity-records.mjs
 import { readdirSync as readdirSync2, readFileSync as readFileSync4, statSync as statSync5 } from "node:fs";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 function bounded3(promise, ms) {
   return new Promise((resolve5, reject) => {
     const t2 = setTimeout(() => reject(new Error("timeout")), ms);
@@ -15792,7 +16008,7 @@ function readLocalWindow(logsDir, { sinceMs, fs: fs7 = { readdirSync: readdirSyn
   for (const name of names) {
     if (typeof name !== "string" || !name.endsWith(".json")) continue;
     try {
-      const path6 = join6(logsDir, name);
+      const path6 = join7(logsDir, name);
       const st = fs7.statSync(path6);
       if (!st.isFile() || st.mtimeMs < sinceMs - DAY_MS6) continue;
       if (st.size > SIZING_RECORD_MAX_BYTES) {
@@ -15863,9 +16079,9 @@ var init_capacity_records = __esm({
 function onlyHost(report, host) {
   const known = report.hosts.map((h2) => h2.name);
   if (!known.includes(host)) return { unknown: known };
-  const shown = report.hosts.find((h2) => h2.name === host);
-  const { fromMs, source: _source, truncated, ...counts } = shown.coverage;
-  return { report: { ...report, hosts: [shown], coverage: { ...report.coverage, fromMs, truncated, ...counts, historyNotShared: report.coverage.historyNotShared.filter((n) => n === host) } } };
+  const shown2 = report.hosts.find((h2) => h2.name === host);
+  const { fromMs, source: _source, truncated, ...counts } = shown2.coverage;
+  return { report: { ...report, hosts: [shown2], coverage: { ...report.coverage, fromMs, truncated, ...counts, historyNotShared: report.coverage.historyNotShared.filter((n) => n === host) } } };
 }
 async function deploymentFacts(env2) {
   const raw = env2.PI_LOG_RETENTION_DAYS;
@@ -16245,6 +16461,9 @@ var init_provider_steering = __esm({
 });
 
 // ../worker/src/triggers.mjs
+function mcpServerToolPattern(name) {
+  return `mcp__${String(name).replace(/-/g, "_")}__*`;
+}
 function isNonEmptyString5(value) {
   return typeof value === "string" && value.trim() !== "";
 }
@@ -16357,11 +16576,12 @@ function normalizeCron(on, run, index, path6, state2) {
   const backend = validateBackend(on, run, `cron trigger "${id}"`, path6, { localWorkspace: true });
   validateWaitFor(on, run, `cron trigger "${id}"`, path6, { onType: "cron" });
   const excludeTools = validateExcludeTools(on, run, `cron trigger "${id}"`, path6);
+  const mcp = validateMcp(on, run, `cron trigger "${id}"`, path6, { kind: "local" });
   const ref = validateRunModel(on, run, `cron trigger "${id}"`, path6);
   const portfolio = validatePortfolio(run, command, `cron trigger "${id}"`, path6);
   return {
     on: { type: "cron", id, pattern },
-    run: { kind: "local", folder: run.folder, flow: run.flow, task: run.task, provider: ref.provider, model: ref.model, maxTurns: ref.maxTurns, github: run.github, packages, image, resume, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile }, ...backend !== void 0 && { backend }, ...excludeTools !== void 0 && { excludeTools }, ...ref.models !== void 0 && { models: ref.models }, ...ref.maxCostUsd !== void 0 && { maxCostUsd: ref.maxCostUsd }, ...portfolio !== void 0 && { portfolio } }
+    run: { kind: "local", folder: run.folder, flow: run.flow, task: run.task, provider: ref.provider, model: ref.model, maxTurns: ref.maxTurns, github: run.github, packages, image, resume, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile }, ...backend !== void 0 && { backend }, ...excludeTools !== void 0 && { excludeTools }, ...mcp !== void 0 && { mcp }, ...ref.models !== void 0 && { models: ref.models }, ...ref.maxCostUsd !== void 0 && { maxCostUsd: ref.maxCostUsd }, ...portfolio !== void 0 && { portfolio } }
   };
 }
 function validatePortfolio(run, command, at, path6) {
@@ -16728,14 +16948,20 @@ function validateExcludeTools(on, run, at, path6) {
   if (!Array.isArray(excludeTools) || excludeTools.length === 0) {
     throw configError4(`${at}: run.excludeTools must be a non-empty array of tool names when present (got ${JSON.stringify(excludeTools)}) -- an empty exclusion is a field that does nothing, and accepted-and-ignored is how an operator comes to trust one that does: ${path6}`);
   }
+  const known = new Set(EXCLUDABLE_TOOL_NAMES);
+  if (Array.isArray(run?.mcp) && run.mcp.length > 0) {
+    for (const name of MCP_EXCLUDABLE_TOOL_NAMES) known.add(name);
+    for (const name of run.mcp) if (typeof name === "string" && MCP_SERVER_NAME_RE.test(name)) known.add(mcpServerToolPattern(name));
+  }
   const seen = /* @__PURE__ */ new Set();
   for (let i2 = 0; i2 < excludeTools.length; i2++) {
     const name = excludeTools[i2];
     if (!isNonEmptyString5(name)) {
       throw configError4(`${at}: run.excludeTools[${i2}] must be a non-empty string naming a pi tool (got ${JSON.stringify(name)}): ${path6}`);
     }
-    if (!EXCLUDABLE_TOOL_NAMES.has(name)) {
-      throw configError4(`${at}: run.excludeTools[${i2}] ${JSON.stringify(name)} is not a tool the pinned pi knows (known: ${[...EXCLUDABLE_TOOL_NAMES].join(", ")}) -- pi ignores unknown names silently, so a misspelled exclusion would exclude nothing while the file reads as though it did: ${path6}`);
+    if (!known.has(name)) {
+      const mcpHint = MCP_EXCLUDABLE_TOOL_NAMES.has(name) || name.startsWith("mcp__") ? " (an MCP tool is excludable only by a trigger whose run.mcp names its server, and a server's tools only all at once, as mcp__<server>__*)" : "";
+      throw configError4(`${at}: run.excludeTools[${i2}] ${JSON.stringify(name)} is not a tool the pinned pi knows (known: ${[...known].join(", ")})${mcpHint} -- pi ignores unknown names silently, so a misspelled exclusion would exclude nothing while the file reads as though it did: ${path6}`);
     }
     if (seen.has(name)) {
       throw configError4(`${at}: run.excludeTools names ${JSON.stringify(name)} twice -- the entries are a removal set, so the second can never change the answer: ${path6}`);
@@ -16744,6 +16970,51 @@ function validateExcludeTools(on, run, at, path6) {
   }
   return [...excludeTools];
 }
+function mcpKeySkeleton(key) {
+  return String(key).toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+function isMcpNearMiss(key) {
+  if (key === "mcp") return false;
+  if (/^[\x20-\x7E]*$/.test(key)) return MCP_NEAR_MISSES.includes(mcpKeySkeleton(key));
+  return [...key.matchAll(/[a-z]/gi)].every(([letter]) => "mcpservers".includes(letter.toLowerCase()));
+}
+function validateMcp(on, run, at, path6, { kind }) {
+  for (const [label2, source, exactIsLegal] of [
+    ["run", run, true],
+    ["on", on, false]
+  ]) {
+    for (const key of Object.keys(source ?? {})) {
+      if (exactIsLegal ? isMcpNearMiss(key) : key === "mcp" || isMcpNearMiss(key)) {
+        if (!/^[\x20-\x7E]*$/.test(key)) {
+          throw configError4(`${at}: ${label2}.${JSON.stringify(key)} is not a field: a key outside plain ASCII with no plain letter other than run.mcp's can be drawn exactly like run.mcp, which the loader would drop while the file reads as though it named servers. Write field names in plain ASCII: ${path6}`);
+        }
+        throw configError4(`${at}: ${label2}.${key} is not a field -- did you mean run.mcp? A list of MCP servers the loader drops runs the job without them while the file reads as though it named them, so a near miss is refused rather than dropped: ${path6}`);
+      }
+    }
+  }
+  const mcp = run?.mcp;
+  if (mcp === void 0) return void 0;
+  if (!Array.isArray(mcp) || mcp.length === 0) {
+    throw configError4(`${at}: run.mcp must be a non-empty array of server names from the overlay's mcp.json when present (got ${JSON.stringify(mcp)}); leave it out for none: ${path6}`);
+  }
+  if (mcp.length > MCP_SERVERS_MAX) {
+    throw configError4(`${at}: run.mcp names ${mcp.length} servers, more than ${MCP_SERVERS_MAX}: ${path6}`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < mcp.length; i2++) {
+    const name = mcp[i2];
+    if (typeof name !== "string" || !MCP_SERVER_NAME_RE.test(name)) {
+      throw configError4(`${at}: run.mcp[${i2}] must name a server of the overlay's mcp.json: lowercase letters and digits, words joined by single -, up to 32 (got ${JSON.stringify(name)}): ${path6}`);
+    }
+    if (seen.has(name)) throw configError4(`${at}: run.mcp names ${JSON.stringify(name)} twice: ${path6}`);
+    seen.add(name);
+    if (name === FORGE_MCP_SERVER_NAME && !FORGE_MCP_KINDS.includes(kind)) {
+      const why = kind === "local" ? "a cron job holds no forge token of its own for the server to use" : `${kind} has no forge MCP server this deployment has verified yet`;
+      throw configError4(`${at}: run.mcp names "forge", the job's own forge server, which a ${FORGE_MCP_KINDS.join(" or ")} trigger may name and this one may not: ${why}: ${path6}`);
+    }
+  }
+  return [...mcp];
+}
 function validateWaitFor(on, run, at, path6, { onType }) {
   for (const [label2, source, exactIsLegal] of [
     ["run", run, true],
@@ -16842,10 +17113,11 @@ function normalizeLabel(on, run, index, path6) {
   const backend = validateBackend(on, run, at, path6, { localWorkspace: false });
   const waitFor = validateWaitFor(on, run, at, path6, { onType: on.type });
   const excludeTools = validateExcludeTools(on, run, at, path6);
+  const mcp = validateMcp(on, run, at, path6, { kind: run.kind });
   const ref = validateRunModel(on, run, at, path6);
   return {
     on: { type: "label", any: predicate.any, all: predicate.all, none: predicate.none },
-    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...repository !== void 0 && { repository }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile }, ...waitFor !== void 0 && { waitFor }, ...backend !== void 0 && { backend }, ...excludeTools !== void 0 && { excludeTools }, ...ref }
+    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...repository !== void 0 && { repository }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile }, ...waitFor !== void 0 && { waitFor }, ...backend !== void 0 && { backend }, ...excludeTools !== void 0 && { excludeTools }, ...mcp !== void 0 && { mcp }, ...ref }
   };
 }
 function normalizeComment(on, run, index, path6, state2) {
@@ -16877,10 +17149,11 @@ function normalizeComment(on, run, index, path6, state2) {
   const backend = validateBackend(on, run, at, path6, { localWorkspace: false });
   const waitFor = validateWaitFor(on, run, at, path6, { onType: on.type });
   const excludeTools = validateExcludeTools(on, run, at, path6);
+  const mcp = validateMcp(on, run, at, path6, { kind: run.kind });
   const ref = validateRunModel(on, run, at, path6);
   return {
     on: { type: "comment", phrase: on.phrase },
-    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...repository !== void 0 && { repository }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile }, ...waitFor !== void 0 && { waitFor }, ...backend !== void 0 && { backend }, ...excludeTools !== void 0 && { excludeTools }, ...ref }
+    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...repository !== void 0 && { repository }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile }, ...waitFor !== void 0 && { waitFor }, ...backend !== void 0 && { backend }, ...excludeTools !== void 0 && { excludeTools }, ...mcp !== void 0 && { mcp }, ...ref }
   };
 }
 function normalizeIssue(on, run, index, path6) {
@@ -16922,6 +17195,7 @@ function normalizeIssue(on, run, index, path6) {
   const backend = validateBackend(on, run, at, path6, { localWorkspace: false });
   const waitFor = validateWaitFor(on, run, at, path6, { onType: on.type });
   const excludeTools = validateExcludeTools(on, run, at, path6);
+  const mcp = validateMcp(on, run, at, path6, { kind: run.kind });
   const ref = validateRunModel(on, run, at, path6);
   return {
     on: {
@@ -16932,7 +17206,7 @@ function normalizeIssue(on, run, index, path6) {
       ...number !== void 0 && { number },
       ...once !== void 0 && { once }
     },
-    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile }, ...waitFor !== void 0 && { waitFor }, ...backend !== void 0 && { backend }, ...excludeTools !== void 0 && { excludeTools }, ...ref }
+    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile }, ...waitFor !== void 0 && { waitFor }, ...backend !== void 0 && { backend }, ...excludeTools !== void 0 && { excludeTools }, ...mcp !== void 0 && { mcp }, ...ref }
   };
 }
 function normalizePullRequest(on, run, index, path6) {
@@ -16983,6 +17257,7 @@ function normalizePullRequest(on, run, index, path6) {
   const backend = validateBackend(on, run, at, path6, { localWorkspace: false });
   const waitFor = validateWaitFor(on, run, at, path6, { onType: on.type });
   const excludeTools = validateExcludeTools(on, run, at, path6);
+  const mcp = validateMcp(on, run, at, path6, { kind: run.kind });
   const ref = validateRunModel(on, run, at, path6);
   return {
     on: {
@@ -16998,7 +17273,7 @@ function normalizePullRequest(on, run, index, path6) {
       ...number !== void 0 && { number },
       ...once !== void 0 && { once }
     },
-    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile }, ...waitFor !== void 0 && { waitFor }, ...backend !== void 0 && { backend }, ...excludeTools !== void 0 && { excludeTools }, ...ref }
+    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile }, ...waitFor !== void 0 && { waitFor }, ...backend !== void 0 && { backend }, ...excludeTools !== void 0 && { excludeTools }, ...mcp !== void 0 && { mcp }, ...ref }
   };
 }
 function validateReviewState(on, actions, run, at, path6) {
@@ -17020,7 +17295,7 @@ function validateReviewState(on, actions, run, at, path6) {
   }
   return [...on.reviewState];
 }
-var ON_TYPES, DISARMED_TYPE, PR_ACTIONS, PR_CLOSE_ACTIONS, ISSUE_ACTIONS, REVIEW_STATES, REVIEW_ACTION, EXCLUDABLE_TOOL_NAMES, ID_CHARSET, REPLICAS_MAX, SECRETS_MAX, ENV_NAME, RESERVED_ENV_NAMES, INSTRUCTIONS_MAX, RUN_MODEL_NEAR_MISS_TARGETS;
+var ON_TYPES, DISARMED_TYPE, PR_ACTIONS, PR_CLOSE_ACTIONS, ISSUE_ACTIONS, REVIEW_STATES, REVIEW_ACTION, EXCLUDABLE_TOOL_NAMES, MCP_EXCLUDABLE_TOOL_NAMES, ID_CHARSET, REPLICAS_MAX, SECRETS_MAX, ENV_NAME, RESERVED_ENV_NAMES, INSTRUCTIONS_MAX, RUN_MODEL_NEAR_MISS_TARGETS, MCP_SERVERS_MAX, MCP_NEAR_MISSES;
 var init_triggers = __esm({
   "../worker/src/triggers.mjs"() {
     init_backends();
@@ -17029,6 +17304,7 @@ var init_triggers = __esm({
     init_flow_gate();
     init_forges();
     init_json_duplicates();
+    init_mcp_config();
     init_model_ref();
     init_money();
     init_provider_steering();
@@ -17065,6 +17341,7 @@ var init_triggers = __esm({
     REVIEW_STATES = /* @__PURE__ */ new Set(["approved", "changes_requested", "commented"]);
     REVIEW_ACTION = "review_submitted";
     EXCLUDABLE_TOOL_NAMES = /* @__PURE__ */ new Set(["read", "bash", "powershell", "edit", "write", "grep", "find", "ls"]);
+    MCP_EXCLUDABLE_TOOL_NAMES = /* @__PURE__ */ new Set(["codemode", "tool_search", "list_mcp_resources", "list_mcp_resource_templates", "read_mcp_resource"]);
     ID_CHARSET = /^[A-Za-z0-9._-]+$/;
     REPLICAS_MAX = 3;
     SECRETS_MAX = 16;
@@ -17090,6 +17367,8 @@ var init_triggers = __esm({
       maxcostusd: "run.maxCostUsd",
       maxcost: "run.maxCostUsd"
     });
+    MCP_SERVERS_MAX = 8;
+    MCP_NEAR_MISSES = Object.freeze(["mcp", "mcps", "mcpserver", "mcpservers"]);
   }
 });
 
@@ -17138,7 +17417,7 @@ function swallowedRunSentence(jobId, existing) {
   const hhmm = at ? ` at ${String(at.getHours()).padStart(2, "0")}:${String(at.getMinutes()).padStart(2, "0")}` : "";
   return `an identical run was queued${hhmm} as ${jobId} (${existing?.state ?? "already queued or done"}); nothing new was queued.`;
 }
-async function addLocalJob(queue, { folder, flow, task, command, provider, model, maxTurns, models, maxCostUsd, image, backend, excludeTools, skillsDir, secrets, secretsProfile, chainDepth, parentJobId, jobId, enqueueNonce, now = /* @__PURE__ */ new Date() }) {
+async function addLocalJob(queue, { folder, flow, task, command, provider, model, maxTurns, models, maxCostUsd, image, backend, excludeTools, mcp, skillsDir, secrets, secretsProfile, chainDepth, parentJobId, jobId, enqueueNonce, now = /* @__PURE__ */ new Date() }) {
   const minute = now.toISOString().slice(0, 16);
   const id = jobId ?? localJobId({ folder, flow: command !== void 0 ? `cmd:${command}` : flow, task, minute, provider, model, models });
   const data = {
@@ -17169,6 +17448,7 @@ async function addLocalJob(queue, { folder, flow, task, command, provider, model
     // same reason: `trigger` is copied verbatim into /job/event.json, and a permission boundary is the
     // worker's business, never agent-visible input to reason about.
     ...excludeTools !== void 0 && { excludeTools },
+    ...mcp !== void 0 && { mcp },
     // The host directory of operator-authored skills this trigger injects (REQ-PER-TRIGGER-SKILLS).
     // Conditional like `image`, so an unflagged job's data stays byte-identical, and at JOB level rather
     // than inside `trigger` because a worker-host path is an execution knob, not a fact about the
@@ -17241,7 +17521,7 @@ var init_queue = __esm({
 // ../worker/src/git-dirty.mjs
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync as existsSync2 } from "node:fs";
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 function gitDirty(folder, { exec: exec4 = execFileSync2 } = {}) {
   try {
     const out = exec4("git", [...GIT_READ_FLAGS, "-C", folder, "status", "--porcelain"], { encoding: "utf8" });
@@ -17251,7 +17531,7 @@ function gitDirty(folder, { exec: exec4 = execFileSync2 } = {}) {
   }
 }
 function localRepoProblem(folder, { exists = existsSync2, exec: exec4 = execFileSync2 } = {}) {
-  if (!exists(join7(folder, ".git"))) {
+  if (!exists(join8(folder, ".git"))) {
     const root = enclosingRepoRoot(folder, exec4);
     if (root) return `${folder} is not the root of a git repository, and a local job needs one. Run \`git init\` here and commit, or, if this folder belongs to the repository at ${root}, run it on ${root}.`;
     return `${folder} is not a git repository. A local job needs one: run \`git init\` there and commit, then run again.`;
@@ -17328,6 +17608,7 @@ var init_import_pi = __esm({
     init_packages();
     init_host_pi();
     init_copy_tree();
+    init_mcp_config();
     execFileAsync = promisify2(execFile2);
   }
 });
@@ -17444,13 +17725,13 @@ var init_container_spec = __esm({
 
 // ../worker/src/packages.mjs
 import { existsSync as existsSync3, readdirSync as readdirSync3, readFileSync as readFileSync5 } from "node:fs";
-import { basename as basename2, dirname as dirname2, join as join8, resolve as resolve3 } from "node:path";
+import { basename as basename3, dirname as dirname2, join as join9, resolve as resolve3 } from "node:path";
 function isNonEmptyString6(value) {
   return typeof value === "string" && value.trim() !== "";
 }
 function readStageManifest({ globalPiDir, readFile: readFile2 = readFileSync5, fileExists = existsSync3 } = {}) {
   if (!globalPiDir) return null;
-  const path6 = join8(globalPiDir, PACKAGES_SUBDIR, STAGE_MANIFEST);
+  const path6 = join9(globalPiDir, PACKAGES_SUBDIR, STAGE_MANIFEST);
   try {
     if (!fileExists(path6)) return null;
     const parsed = JSON.parse(readFile2(path6, "utf8"));
@@ -17473,10 +17754,10 @@ function readStagedSkills({ globalPiDir, readFile: readFile2 = readFileSync5, fi
   const manifest = readStageManifest({ globalPiDir, readFile: readFile2, fileExists });
   if (!manifest) return out;
   for (const pkg of manifest.packages) {
-    const root = join8(globalPiDir, PACKAGES_SUBDIR, pkg.dir);
+    const root = join9(globalPiDir, PACKAGES_SUBDIR, pkg.dir);
     let sources;
     try {
-      const parsed = JSON.parse(readFile2(join8(root, "package.json"), "utf8"));
+      const parsed = JSON.parse(readFile2(join9(root, "package.json"), "utf8"));
       const pi = parsed !== null && typeof parsed === "object" && parsed.pi !== null && typeof parsed.pi === "object" ? parsed.pi : null;
       if (pi) {
         const entries = Array.isArray(pi.skills) ? pi.skills.filter((e2) => typeof e2 === "string") : [];
@@ -17486,23 +17767,23 @@ function readStagedSkills({ globalPiDir, readFile: readFile2 = readFileSync5, fi
         }
         sources = entries.filter((e2) => !e2.split(/[\\/]/).includes("..")).map((e2) => resolve3(root, e2));
       } else {
-        sources = [join8(root, "skills")];
+        sources = [join9(root, "skills")];
       }
     } catch {
       continue;
     }
     for (const source of sources) {
       for (const skillFile of walkSkillFiles(source, fileExists, readDir)) {
-        out.skills.push({ name: basename2(dirname2(skillFile)), package: pkg.name, dir: pkg.dir });
+        out.skills.push({ name: basename3(dirname2(skillFile)), package: pkg.name, dir: pkg.dir });
       }
     }
   }
   return out;
 }
 function walkSkillFiles(source, fileExists, readDir, depth = 3) {
-  if (basename2(source) === "SKILL.md") return fileExists(source) ? [source] : [];
+  if (basename3(source) === "SKILL.md") return fileExists(source) ? [source] : [];
   const found = [];
-  const own = join8(source, "SKILL.md");
+  const own = join9(source, "SKILL.md");
   if (fileExists(own)) found.push(own);
   if (depth === 0) return found;
   let children;
@@ -17513,7 +17794,7 @@ function walkSkillFiles(source, fileExists, readDir, depth = 3) {
   }
   for (const child of children) {
     if (!child.isDirectory?.()) continue;
-    found.push(...walkSkillFiles(join8(source, child.name), fileExists, readDir, depth - 1));
+    found.push(...walkSkillFiles(join9(source, child.name), fileExists, readDir, depth - 1));
   }
   return found;
 }
@@ -19248,7 +19529,7 @@ var init_costs = __esm({
 });
 
 // src/dollar-windows.mjs
-import { isAbsolute as isAbsolute9 } from "node:path";
+import { isAbsolute as isAbsolute10 } from "node:path";
 function deploymentDollarCaps(overlay, env2) {
   const caps = { day: null, week: null, month: null };
   const invalid = [];
@@ -19331,7 +19612,7 @@ function belongs(record, spec) {
 }
 function foldWindowRecords(records, spec) {
   if (spec.ledger === "model") return { records: null, unattributed: UNATTRIBUTED.model };
-  if (spec.ledger === "scope" && typeof spec.name === "string" && isAbsolute9(spec.name)) return { records: null, unattributed: UNATTRIBUTED.folder };
+  if (spec.ledger === "scope" && typeof spec.name === "string" && isAbsolute10(spec.name)) return { records: null, unattributed: UNATTRIBUTED.folder };
   const basis = Object.fromEntries(DOLLAR_BASIS.map((b) => [b, 0]));
   let runs = 0;
   let settledMicros = 0;
@@ -19429,7 +19710,7 @@ var init_dollar_windows = __esm({
 // ../worker/src/service-env.mjs
 import { constants as fsConstants2 } from "node:fs";
 import { userInfo as userInfo2 } from "node:os";
-import { dirname as dirname3, join as join9 } from "node:path";
+import { dirname as dirname3, join as join10 } from "node:path";
 function serviceEnvLoader(platform) {
   return platform === "linux" ? "systemd" : platform === "win32" ? "cmd" : "shell";
 }
@@ -19533,7 +19814,7 @@ function trustedChain(realPath, { fs: fs7, uid, names = {} }) {
   return null;
 }
 function readDeploymentEnv({ dir, fs: fs7, uid = process.geteuid?.(), names = accountNames(fs7) }) {
-  const path6 = join9(dir, ".env");
+  const path6 = join10(dir, ".env");
   let real;
   try {
     real = fs7.realpathSync(path6);
@@ -19698,7 +19979,10 @@ var init_triggers_file = __esm({
       // Issue #501: a trigger's per-job dollar cap. Dropped by a receiver from before #501 (which tolerated the key as
       // unknown), the job would run under the deployment's wider cap, or with none, on a clean record. Any present
       // value counts as authored; whether it is a valid amount is the loader's question, not this one.
-      Object.freeze({ key: "maxCostUsd", authored: (v) => v !== void 0 && v !== null })
+      Object.freeze({ key: "maxCostUsd", authored: (v) => v !== void 0 && v !== null }),
+      // REQ-MCP-OPERATOR-SERVERS: the MCP servers a trigger's jobs connect. Not a widening when dropped but the same
+      // silent outcome: the job runs its flow without the servers it was written against, on a clean record.
+      Object.freeze({ key: "mcp", authored: (v) => Array.isArray(v) && v.length > 0 })
     ]);
   }
 });
@@ -19706,7 +19990,7 @@ var init_triggers_file = __esm({
 // src/read-model.mjs
 import * as nodeFs5 from "node:fs";
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { join as join10, delimiter as delimiter2, sep as sep2, isAbsolute as isAbsolute10, resolve as resolvePath } from "node:path";
+import { join as join11, delimiter as delimiter2, sep as sep2, isAbsolute as isAbsolute11, resolve as resolvePath } from "node:path";
 import { execFileSync as execFileSync3 } from "node:child_process";
 function resolvePaths(env2 = process.env) {
   return {
@@ -19790,7 +20074,7 @@ function panelEnv({ env: env2 = process.env, pointerDir = null, owned = [], fs:
   const res = deploymentServiceEnv({ env: own, dir, keys: PANEL_SERVICE_KEYS, platform, fs: fs7, uid });
   const out = res.env;
   for (const [key, value] of Object.entries(res.fromFile)) {
-    if (PANEL_PATH_KEYS.has(key) && value !== "" && !isAbsolute10(value)) out[key] = resolvePath(dir, value);
+    if (PANEL_PATH_KEYS.has(key) && value !== "" && !isAbsolute11(value)) out[key] = resolvePath(dir, value);
   }
   for (const key of owned) if (out[key] === void 0 && env2[key] !== void 0) out[key] = env2[key];
   const said = [];
@@ -20732,9 +21016,9 @@ async function readCapacity({ url, env: env2 = process.env, window: window2 = "7
     ]);
     const coverage = { ...read.coverage, reason: [read.coverage.reason, fleet.unreachable ? `host registry unreadable (${fleet.unreachable})` : null].filter(Boolean).join("; ") || null };
     const report = computeCapacity({ records: read.records, live: fleet.hosts ?? [], windowStartMs: sinceMs, nowMs: nowMs2, bucketMs, coverage });
-    const shown = host === void 0 || host === null ? { report } : onlyHost(report, host);
-    if (shown.unknown) return { error: `no host named ${JSON.stringify(host)} in the last ${window2}${shown.unknown.length > 0 ? ` (hosts: ${shown.unknown.join(", ")})` : ""}` };
-    return { report: shown.report, text: capacityText(shown.report, { since: window2 }) };
+    const shown2 = host === void 0 || host === null ? { report } : onlyHost(report, host);
+    if (shown2.unknown) return { error: `no host named ${JSON.stringify(host)} in the last ${window2}${shown2.unknown.length > 0 ? ` (hosts: ${shown2.unknown.join(", ")})` : ""}` };
+    return { report: shown2.report, text: capacityText(shown2.report, { since: window2 }) };
   } finally {
     try {
       redis?.disconnect?.();
@@ -20973,7 +21257,7 @@ function listRuns({ logsDir, limit: limit3 = 10, fs: fs7 = nodeFs5 }) {
   const records = [];
   for (const name of names) {
     if (!name.endsWith(".json")) continue;
-    const record = readJsonFile(join10(logsDir, name), fs7);
+    const record = readJsonFile(join11(logsDir, name), fs7);
     if (record && typeof record === "object") records.push(record);
   }
   records.sort(byEndedAtDesc);
@@ -20992,7 +21276,7 @@ function scanRunRecords({ logsDir, sinceMs, nowMs: nowMs2 = Date.now(), fs: fs7
   const records = [];
   for (const name of names) {
     if (!name.endsWith(".json")) continue;
-    const record = readJsonFile(join10(logsDir, name), fs7);
+    const record = readJsonFile(join11(logsDir, name), fs7);
     if (!record || typeof record !== "object") continue;
     const at = Date.parse(record.endedAt ?? record.startedAt ?? "");
     if (!Number.isFinite(at) || at < cutoffMs) continue;
@@ -21024,12 +21308,12 @@ function hostBudgetsOf(hosts) {
   return (Array.isArray(hosts) ? hosts : []).map((h2) => publishedBudget(h2));
 }
 function readRun({ logsDir, jobId, fs: fs7 = nodeFs5 }) {
-  return readJsonFile(join10(logsDir, `${sanitizeJobId(jobId)}.json`), fs7);
+  return readJsonFile(join11(logsDir, `${sanitizeJobId(jobId)}.json`), fs7);
 }
 function readLogTail({ logsDir, jobId, lines = 200, fs: fs7 = nodeFs5, host = null, self: self2 = null }) {
   let text;
   try {
-    text = fs7.readFileSync(join10(logsDir, `${sanitizeJobId(jobId)}.log`), "utf8");
+    text = fs7.readFileSync(join11(logsDir, `${sanitizeJobId(jobId)}.log`), "utf8");
   } catch {
     const foreign = typeof host === "string" && host !== "" && typeof self2 === "string" && self2 !== "" && host !== self2;
     return foreign ? { missing: true, elsewhere: host } : { missing: true };
@@ -21109,7 +21393,10 @@ function normalizeTriggerForDisplay(entry) {
     // a dollar amount, the operator's own words, never a value a job chose. Spread only when present, so a trigger
     // that sets neither keeps exactly its keys.
     ...Array.isArray(run.models) && run.models.length > 0 && run.models.every((m2) => typeof m2 === "string") && { models: [...run.models] },
-    ...(typeof run.maxCostUsd === "string" || typeof run.maxCostUsd === "number") && { maxCostUsd: String(run.maxCostUsd) }
+    ...(typeof run.maxCostUsd === "string" || typeof run.maxCostUsd === "number") && { maxCostUsd: String(run.maxCostUsd) },
+    // The overlay MCP servers the jobs connect (REQ-MCP-OPERATOR-SERVERS), by name: the operator's own words, never a
+    // server's definition or a credential. Shown for `secrets`' reason: what a job can reach is set only in this file.
+    ...Array.isArray(run.mcp) && run.mcp.length > 0 && run.mcp.every((name) => typeof name === "string") && { mcp: [...run.mcp] }
   };
   switch (on.type) {
     case "cron":
@@ -21226,6 +21513,26 @@ function readStagedPackages({ globalPiDir, fs: fs7 = nodeFs5, readManifest: read
     packages: entries.filter((p) => p && typeof p.name === "string").map(nameAtVersion)
   };
 }
+function readOverlayMcpView({ globalPiDir, read = readOverlayMcp } = {}) {
+  const empty = { servers: [], refused: [], unreadable: null };
+  if (typeof globalPiDir !== "string" || globalPiDir === "") return empty;
+  let parsed;
+  try {
+    parsed = read(globalPiDir);
+  } catch (err) {
+    return { ...empty, unreadable: err?.mcpConfig ? "invalid" : err?.code ?? "unreadable" };
+  }
+  if (parsed === null) return empty;
+  const servers = Object.entries(parsed.servers ?? {}).map(([name, server]) => ({
+    name,
+    transport: server.transport === "http" ? "http" : "stdio",
+    where: mcpServerWhere(server),
+    exposure: typeof server.exposure === "string" ? server.exposure : "codemode",
+    enabled: server.enabled !== false,
+    refs: Array.isArray(server.refs) ? [...server.refs] : []
+  }));
+  return { servers, refused: (parsed.refused ?? []).map((r2) => r2.name).filter((n) => typeof n === "string"), unreadable: null };
+}
 function nameAtVersion(pkg) {
   return typeof pkg.version === "string" && pkg.version !== "" ? `${pkg.name}@${pkg.version}` : pkg.name;
 }
@@ -21429,7 +21736,7 @@ function readInjectedSkills({ skillsDir, fs: fs7 = nodeFs5 } = {}) {
   for (const name of valid.slice(0, GRAPH_LIMITS.maxSkillsPerFolder)) {
     let aiTrigger = false;
     try {
-      const text = fs7.readFileSync(join10(skillsDir, name, "SKILL.md"), "utf8");
+      const text = fs7.readFileSync(join11(skillsDir, name, "SKILL.md"), "utf8");
       aiTrigger = aiTriggerAllows(text);
     } catch {
       continue;
@@ -21440,7 +21747,7 @@ function readInjectedSkills({ skillsDir, fs: fs7 = nodeFs5 } = {}) {
 }
 function readOverlaySkills({ globalPiDir, fs: fs7 = nodeFs5 } = {}) {
   if (typeof globalPiDir !== "string" || globalPiDir === "") return { skills: [], truncated: false, unreachable: null };
-  const dir = join10(globalPiDir, "skills");
+  const dir = join11(globalPiDir, "skills");
   let names;
   try {
     names = fs7.readdirSync(dir);
@@ -21454,7 +21761,7 @@ function readOverlaySkills({ globalPiDir, fs: fs7 = nodeFs5 } = {}) {
   for (const name of valid.slice(0, GRAPH_LIMITS.maxSkillsPerFolder)) {
     let present = false;
     try {
-      present = fs7.existsSync(join10(dir, name, "SKILL.md"));
+      present = fs7.existsSync(join11(dir, name, "SKILL.md"));
     } catch {
       present = false;
     }
@@ -21583,6 +21890,7 @@ var init_read_model = __esm({
     init_runtime_settings();
     init_money();
     init_run_history();
+    init_mcp_config();
     init_budget();
     init_pause_windows();
     init_scoped_limits();
@@ -21657,7 +21965,7 @@ return 1`;
 // src/write-guard.mjs
 import * as nodeFs6 from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { dirname as dirname4, isAbsolute as isAbsolute11, join as join11, parse as parsePath, resolve as nodeResolve, sep as sep3 } from "node:path";
+import { dirname as dirname4, isAbsolute as isAbsolute12, join as join12, parse as parsePath, resolve as nodeResolve, sep as sep3 } from "node:path";
 import { fileURLToPath } from "node:url";
 function normalizeWindowsShellPath(filePath) {
   if (!filePath.startsWith("/") || filePath.startsWith("//") || filePath.includes("\\")) return filePath;
@@ -21673,13 +21981,13 @@ function piResolveToCwd(input, cwd, { home = homedir3(), platform = process.plat
     if (at && s2.startsWith("@")) s2 = s2.slice(1);
     if (platform === "win32") s2 = normalizeWindowsShellPath(s2);
     if (s2 === "~") return home;
-    if (s2.startsWith("~/") || platform === "win32" && s2.startsWith("~\\")) return join11(home, s2.slice(2));
+    if (s2.startsWith("~/") || platform === "win32" && s2.startsWith("~\\")) return join12(home, s2.slice(2));
     if (/^file:\/\//.test(s2)) return fileURLToPath(s2);
     return s2;
   };
   const target = normalize2(String(input), { spaces: true, at: true });
   const base = normalize2(String(cwd), { spaces: false, at: false });
-  return isAbsolute11(target) ? nodeResolve(target) : nodeResolve(base, target);
+  return isAbsolute12(target) ? nodeResolve(target) : nodeResolve(base, target);
 }
 function idOf(st) {
   return `${st.dev}:${st.ino}`;
@@ -21704,7 +22012,7 @@ function targetIdentity(absPath, { fs: fs7 = nodeFs6 } = {}) {
     let cur = root;
     let restarted = false;
     for (let i2 = 0; i2 < segments.length; i2++) {
-      const next = join11(cur, segments[i2]);
+      const next = join12(cur, segments[i2]);
       let st;
       try {
         st = fs7.lstatSync(next);
@@ -21754,7 +22062,7 @@ function readSmallRegularFile(path6, { fs: fs7 = nodeFs6, max = ENV_READ_MAX } =
   }
 }
 function envNamedFiles(dir, { fs: fs7 = nodeFs6, home = homedir3() } = {}) {
-  const text = readSmallRegularFile(join11(dir, ".env"), { fs: fs7 });
+  const text = readSmallRegularFile(join12(dir, ".env"), { fs: fs7 });
   if (text === null) return [];
   const last = /* @__PURE__ */ new Map();
   for (const line of text.replace(/^\uFEFF/, "").split(/\r?\n/)) {
@@ -21772,7 +22080,7 @@ function envNamedFiles(dir, { fs: fs7 = nodeFs6, home = homedir3() } = {}) {
     }
     for (const r2 of readings) if (r2.trim() !== "") out.push({ path: nodeResolve(dir, r2), ...GUARDED_ENV_KEYS[key] });
   }
-  if (out.length > 0) out.push({ path: join11(dir, ".env"), label: "the deployment's .env, which names these files (PI_*_FILE)", tool: "the operator's own editor" });
+  if (out.length > 0) out.push({ path: join12(dir, ".env"), label: "the deployment's .env, which names these files (PI_*_FILE)", tool: "the operator's own editor" });
   return out;
 }
 function sameFile(a, b) {
@@ -24982,9 +25290,9 @@ function buildInsightsHtml(payload, { now, fullPaths } = {}) {
     const fill = cls === "estimated" || cls === "seeded" ? PAGE_THEME.amber : PAGE_THEME.dim;
     const text = fmtCost(entry.cost);
     const cols = Math.max(2, Math.floor((pl.w - 20) / BADGE_COL_W));
-    const shown = drawnColumns(text) <= cols ? text : clipColumns(text, cols - 1);
-    const tip = shown !== text ? `<title>${escapeHtml(text)}</title>` : "";
-    spendParts.push(`<text x="${fmt(pl.x + 16)}" y="${fmt(pl.y + SPEND_BADGE_DY)}" font-size="10" fill="${fill}">${escapeHtml(shown)}${tip}</text>`);
+    const shown2 = drawnColumns(text) <= cols ? text : clipColumns(text, cols - 1);
+    const tip = shown2 !== text ? `<title>${escapeHtml(text)}</title>` : "";
+    spendParts.push(`<text x="${fmt(pl.x + 16)}" y="${fmt(pl.y + SPEND_BADGE_DY)}" font-size="10" fill="${fill}">${escapeHtml(shown2)}${tip}</text>`);
   }
   const tips = [];
   const bodyParts = [];
@@ -37575,20 +37883,20 @@ function getName(value, options) {
   const name = "name" in value ? value.name : void 0;
   const explicitName = name && String(name) || "filename" in value && value.filename && String(value.filename);
   if (explicitName) {
-    return options?.stripFilename === false ? normalizeFilenamePath(explicitName) : basename3(explicitName);
+    return options?.stripFilename === false ? normalizeFilenamePath(explicitName) : basename4(explicitName);
   }
   const url = "url" in value && value.url && String(value.url);
   if (url) {
     try {
-      return basename3(new URL(url).pathname);
+      return basename4(new URL(url).pathname);
     } catch {
-      return basename3(url);
+      return basename4(url);
     }
   }
   const path6 = "path" in value && value.path && String(value.path);
-  return path6 ? basename3(path6) : void 0;
+  return path6 ? basename4(path6) : void 0;
 }
-function basename3(value) {
+function basename4(value) {
   return value.split(/[\\/]/).pop() || void 0;
 }
 function normalizeFilenamePath(value) {
@@ -37692,7 +38000,7 @@ function getStreamingFileName(value, options) {
     if (typeof name !== "string" || !name) {
       throw new TypeError("Streaming upload file name must be a non-empty string");
     }
-    return options.stripFilenames === false ? normalizeFilenamePath(name) : basename3(name) ?? "unknown_file";
+    return options.stripFilenames === false ? normalizeFilenamePath(name) : basename4(name) ?? "unknown_file";
   }
   return getName(value, { stripFilename: options.stripFilenames }) ?? "unknown_file";
 }
@@ -76140,7 +76448,7 @@ function timeoutError(timeoutMs) {
   error.body = "";
   return error;
 }
-function isRecord(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function requiredNumber(label2, value, field) {
@@ -76192,7 +76500,7 @@ function tokenCount(value) {
   return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : 0;
 }
 function parseClassifierUsage(value, model) {
-  if (!isRecord(value) || value.input_tokens === void 0 && value.output_tokens === void 0)
+  if (!isRecord2(value) || value.input_tokens === void 0 && value.output_tokens === void 0)
     return void 0;
   const input = tokenCount(value.input_tokens);
   const output = tokenCount(value.output_tokens);
@@ -76217,7 +76525,7 @@ var init_classifier_shared = __esm({
 
 // ../node_modules/@earendil-works/pi-ai/dist/api/system-one-shared.js
 function probabilities(label2, value, id) {
-  if (!isRecord(value))
+  if (!isRecord2(value))
     throw new Error(`${label2} returned invalid probabilities for ${id}`);
   return Object.fromEntries(Object.entries(value).map(([key, probability]) => [
     key,
@@ -76225,12 +76533,12 @@ function probabilities(label2, value, id) {
   ]));
 }
 function parseAnswers(label2, value, context) {
-  if (!isRecord(value))
+  if (!isRecord2(value))
     throw new Error(`${label2} returned an unexpected response`);
   const answers = [];
   for (const [id, question] of Object.entries(context.questions)) {
     const answer = value[id];
-    if (!isRecord(answer))
+    if (!isRecord2(answer))
       throw new Error(`${label2} did not return an answer for ${id}`);
     if (question.type === "choice") {
       if (answer.type !== "choice" || typeof answer.choice !== "string") {
@@ -76320,7 +76628,7 @@ __export(cloudflare_workers_ai_system_one_exports, {
 });
 function cloudflareErrorMessage(errors) {
   if (Array.isArray(errors)) {
-    const messages = errors.map((error) => isRecord(error) && typeof error.message === "string" ? error.message : void 0).filter((message) => message !== void 0);
+    const messages = errors.map((error) => isRecord2(error) && typeof error.message === "string" ? error.message : void 0).filter((message) => message !== void 0);
     if (messages.length > 0)
       return `${LABEL} error: ${messages.join("; ")}`;
   }
@@ -76338,19 +76646,19 @@ var init_cloudflare_workers_ai_system_one = __esm({
       url: (model) => new URL("run", `${model.baseUrl.replace(/\/+$/u, "")}/`),
       payload: (model, request) => ({ model: model.id, input: request }),
       output: (body) => {
-        if (!isRecord(body))
+        if (!isRecord2(body))
           throw new Error(`${LABEL} returned an unexpected response`);
         if (body.success === false)
           throw new Error(cloudflareErrorMessage(body.errors));
         const result = body.result;
-        if (!isRecord(result))
+        if (!isRecord2(result))
           throw new Error(`${LABEL} returned an unexpected response`);
         if ("answers" in result)
           return result;
         if (result.state !== "Completed") {
           throw new Error(`${LABEL} run did not complete (state: ${String(result.state)})`);
         }
-        if (!isRecord(result.result))
+        if (!isRecord2(result.result))
           throw new Error(`${LABEL} returned an unexpected response`);
         return result.result;
       }
@@ -83273,7 +83581,7 @@ var require_node_domexception = __commonJS({
 
 // ../node_modules/fetch-blob/from.js
 import { statSync as statSync6, createReadStream as createReadStream2, promises as fs5 } from "node:fs";
-import { basename as basename4 } from "node:path";
+import { basename as basename5 } from "node:path";
 var import_node_domexception, stat2, blobFromSync, blobFrom, fileFrom, fileFromSync, fromBlob, fromFile, BlobDataItem;
 var init_from = __esm({
   "../node_modules/fetch-blob/from.js"() {
@@ -83296,7 +83604,7 @@ var init_from = __esm({
       size: stat4.size,
       lastModified: stat4.mtimeMs,
       start: 0
-    })], basename4(path6), { type, lastModified: stat4.mtimeMs });
+    })], basename5(path6), { type, lastModified: stat4.mtimeMs });
     BlobDataItem = class _BlobDataItem {
       #path;
       #start;
@@ -123213,7 +123521,7 @@ function choiceProbabilities(value, id) {
   if (!Array.isArray(value))
     throw new Error(`${LABEL2} returned invalid probabilities for ${id}`);
   return Object.fromEntries(value.map((entry) => {
-    if (!isRecord(entry) || typeof entry.value !== "string") {
+    if (!isRecord2(entry) || typeof entry.value !== "string") {
       throw new Error(`${LABEL2} returned invalid probabilities for ${id}`);
     }
     return [entry.value, requiredNumber(LABEL2, entry.probability, `probability for ${id}.${entry.value}`)];
@@ -123251,7 +123559,7 @@ function parseAnswers2(value, context) {
     throw new Error(`${LABEL2} returned an unexpected response`);
   const byName = /* @__PURE__ */ new Map();
   for (const answer of value) {
-    if (isRecord(answer) && typeof answer.name === "string")
+    if (isRecord2(answer) && typeof answer.name === "string")
       byName.set(answer.name, answer);
   }
   return Object.fromEntries(Object.entries(context.questions).map(([id, question]) => {
@@ -123292,7 +123600,7 @@ var init_openai_decisions = __esm({
           input: wireInput(context),
           questions: Object.entries(context.questions).map(([id, question]) => wireQuestion(id, question))
         }, options, NO_RETRY_STATUSES);
-        if (!isRecord(body))
+        if (!isRecord2(body))
           throw new Error(`${LABEL2} returned an unexpected response`);
         const usage = parseClassifierUsage(body.usage, model);
         if (usage)
@@ -124829,7 +125137,7 @@ var init_typesafe_system_one = __esm({
       url: (model) => new URL("systemone", `${model.baseUrl.replace(/\/+$/u, "")}/`),
       payload: (model, request) => ({ model: model.id, ...request }),
       output: (body) => {
-        if (!isRecord(body))
+        if (!isRecord2(body))
           throw new Error("System One API returned an unexpected response");
         return body;
       }
@@ -125958,7 +126266,7 @@ var init_all = __esm({
 
 // ../worker/src/pricing.mjs
 import { readFileSync as readFileSync6 } from "node:fs";
-import { dirname as dirname6, join as join13 } from "node:path";
+import { dirname as dirname6, join as join14 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function listPricedModels() {
   const out = [];
@@ -125990,7 +126298,7 @@ function readPiAiVersion(readText) {
     let dir = dirname6(fileURLToPath2(import.meta.resolve("@earendil-works/pi-ai")));
     for (let hops = 0; hops < 8; hops++) {
       try {
-        const parsed = JSON.parse(readText(join13(dir, "package.json")));
+        const parsed = JSON.parse(readText(join14(dir, "package.json")));
         if (parsed !== null && parsed.name === "@earendil-works/pi-ai") {
           const match2 = /^(\d+\.\d+\.\d+)/.exec(String(parsed.version ?? ""));
           return match2 === null ? null : match2[1];
@@ -126056,10 +126364,10 @@ function gateDialogs(ctx) {
   const gatedSelect = async (live, args) => {
     const cleaned = args.map(clean);
     const picked = await live.select(...cleaned);
-    const shown = cleaned[1];
+    const shown2 = cleaned[1];
     const original = args[1];
-    if (!Array.isArray(shown) || !Array.isArray(original)) return picked;
-    const at = shown.indexOf(picked);
+    if (!Array.isArray(shown2) || !Array.isArray(original)) return picked;
+    const at = shown2.indexOf(picked);
     return at >= 0 ? original[at] : picked;
   };
   const wrapOne = (live, name) => typeof live[name] === "function" ? (...args) => live[name](...args.map(clean)) : live[name];
@@ -126243,7 +126551,7 @@ var init_backend_local = __esm({
 });
 
 // ../worker/src/docker-run.mjs
-import { isAbsolute as isAbsolute13, relative } from "node:path";
+import { isAbsolute as isAbsolute14, relative } from "node:path";
 function dockerArgsFromSpec(spec) {
   if (spec?.userns !== null && spec?.userns !== void 0) {
     throw new Error(`docker run: refusing a spec with userns ${JSON.stringify(spec.userns)}: the docker CLI has no --userns=keep-id, and only a podman venue builds one`);
@@ -126330,7 +126638,7 @@ function buildPodmanRunArgs(opts) {
 function insideDir(outer, inner) {
   if (typeof outer !== "string" || typeof inner !== "string" || outer === "" || inner === "") return false;
   const rel = relative(outer, inner);
-  return rel !== "" && !rel.startsWith("..") && !isAbsolute13(rel);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute14(rel);
 }
 var ISOLATION_FLAGS, DOCKER_EXTRA_FORBIDDEN, DOCKER_EXTRA_ALLOWED, PODMAN_PINNED_FLAGS;
 var init_docker_run = __esm({
@@ -126539,6 +126847,7 @@ var CAPABILITY_GATES, FIELD_SEP, PI_VERSION_LABEL, PI_VERSION_TEMPLATE, FORGES_L
 var init_image_preflight = __esm({
   "../worker/src/image-preflight.mjs"() {
     init_image_ref();
+    init_mcp_config();
     CAPABILITY_GATES = Object.freeze([
       // REQ-REPLICA-RUNS: an image built before it bakes a HARD_RULES.md whose rule 3 hard-codes `pi/issue-<n>`
       // as a SYSTEM rule, which the model treats as authoritative over the user prompt naming `pi/issue-<n>-r2`.
@@ -126597,6 +126906,27 @@ var init_image_preflight = __esm({
         reason: "job-image-cost-cap-unsupported",
         event: "refused_image_cost_cap_unsupported",
         comment: (image, declared) => `Refused: the job image "${image}" does not declare cost-cap support (\`dev.pi-dispatch.capabilities\` ${declared}), so its runner would ignore the per-job dollar cap and run this job with no cap at all. Rebuild the image from a version that has this feature. Not run.`
+      }),
+      // REQ-MCP-OPERATOR-SERVERS: a runner that predates run.mcp reads no /job/mcp.json, so the job would run without
+      // the servers its flow was written against and record a clean exit while the file reads as though it named them.
+      Object.freeze({
+        token: "mcp",
+        needed: (job) => Array.isArray(job?.mcp) && job.mcp.length > 0,
+        result: "mcpUnsupported",
+        reason: "job-image-mcp-unsupported",
+        event: "refused_image_mcp_unsupported",
+        comment: (image, declared) => `Refused: the job image "${image}" does not declare MCP support (\`dev.pi-dispatch.capabilities\` ${declared}), so its runner would not connect the servers \`run.mcp\` names. Rebuild the image from a version that has this feature. Not run.`
+      }),
+      // DES-FORGE-MCP: `forge` in run.mcp starts a server the IMAGE carries (github-mcp-server, mcp-gitlab), not one the
+      // overlay names. An image with `mcp` and without them would pass every gate, reserve the budget, and refuse at the
+      // container's start as mcp-command-missing; this row says so before anything is spent.
+      Object.freeze({
+        token: "forgeMcp",
+        needed: (job) => Array.isArray(job?.mcp) && job.mcp.includes(FORGE_MCP_SERVER_NAME),
+        result: "forgeMcpUnsupported",
+        reason: "job-image-forge-mcp-unsupported",
+        event: "refused_image_forge_mcp_unsupported",
+        comment: (image, declared) => `Refused: the job image "${image}" does not declare the forge's own MCP server (\`dev.pi-dispatch.capabilities\` ${declared}), so it does not carry the server \`run.mcp\` names as \`forge\`. Rebuild the image from a version that has this feature. Not run.`
       })
     ]);
     FIELD_SEP = "|";
@@ -126950,6 +127280,34 @@ var init_secrets = __esm({
   }
 });
 
+// ../worker/src/egress-allowlist.mjs
+var init_egress_allowlist = __esm({
+  "../worker/src/egress-allowlist.mjs"() {
+    init_backends();
+    init_model_endpoints();
+  }
+});
+
+// ../worker/src/mcp-preflight.mjs
+var MCP_REFUSAL_COMMENT;
+var init_mcp_preflight = __esm({
+  "../worker/src/mcp-preflight.mjs"() {
+    init_egress_allowlist();
+    init_mcp_config();
+    init_triggers();
+    MCP_REFUSAL_COMMENT = Object.freeze({
+      "mcp-list-invalid": "the list this job carries is not one the triggers file's loader writes (a service in this deployment may be at another version)",
+      "mcp-config-invalid": "this deployment's list of MCP servers (mcp.json in the overlay) cannot be used",
+      "mcp-server-unknown": "this deployment does not offer that server",
+      "mcp-secret-reserved": "that server would be handed a credential this deployment keeps for the job itself",
+      "mcp-secret-unmapped": "a credential that server needs is not passed by this trigger",
+      "mcp-excluded": "this trigger's run.excludeTools removes every way the job could reach that server",
+      "mcp-egress-unreachable": "the egress policy does not let a job reach that server",
+      "mcp-package-runner": "the egress policy does not let a job reach the registry that server is fetched from"
+    });
+  }
+});
+
 // ../worker/src/processor.mjs
 var OBSERVATION_COMMENT, TERMINAL_COMMENTS, JOB_USER_COMMENTS, VENUE_RUNTIME;
 var init_processor = __esm({
@@ -126962,6 +127320,7 @@ var init_processor = __esm({
     init_scoped_limits();
     init_secrets();
     init_triggers();
+    init_mcp_preflight();
     init_exit_code();
     init_run_history();
     init_egress();
@@ -126996,6 +127355,16 @@ var init_processor = __esm({
       "model-not-allowed": "Stopped: the run tried to call an AI model this trigger does not allow, or to change an AI request in a way it does not allow, so the call was not made. Partial work may exist. Not retried.",
       "cost-cap-unenforceable": "Stopped: this run has a cost limit, and the job image could not enforce it before each AI call, so nothing was sent to the AI provider. The operator needs to update the job image. Not retried.",
       "model-policy-unenforceable": "Stopped: this run is limited to certain AI models, and the job image could not enforce that before each AI call, so nothing was sent to the AI provider. The operator needs to update the job image. Not retried.",
+      // The runner's refusals of the job's MCP servers, each before the prompt. Never the server's name, its host or a
+      // variable: the exit line carries the name and the cause in its message, which the worker never parses (it reaches
+      // the worker's log as the container's output). Each says what the operator can check; the issue's author can act on
+      // none of it.
+      "mcp-unavailable": "Stopped: an MCP server this trigger names could not be used (it did not start, failed its handshake or refused the connection, an authentication error among them), so the run ended before the agent started. The operator needs to check that server and the job image. Not retried.",
+      "mcp-config-invalid": "Stopped: the list of MCP servers the worker wrote for this job is not one the job image accepts, so the run ended before the agent started. The operator needs to run a worker and a job image of the same release. Not retried.",
+      "mcp-config-mismatch": "Stopped: the MCP servers the worker wrote for this job are not the ones it named for it, so the run ended before the agent started. The operator needs to run a worker and a job image of the same release. Not retried.",
+      "mcp-secret-missing": "Stopped: a credential an MCP server this trigger names needs was not set inside the job, so the run ended before the agent started. The operator needs to check the secrets this trigger passes. Not retried.",
+      "mcp-command-missing": "Stopped: the job image does not have the program an MCP server this trigger names runs, so the run ended before the agent started. The operator needs to install that server in the job image or the overlay. Not retried.",
+      "mcp-shadowed": "Stopped: another extension in this job registers a tool or command that only the job's MCP servers may, so the run ended before the agent started. The operator needs to remove that extension or this trigger's MCP servers. Not retried.",
       // Issue #596. Never the size or the project: both are operator configuration, and the reader may be an issue author
       // who can act on neither. The worker log and the run record carry them.
       [EXIT_OOM_KILLED]: "Stopped: the job's container ran out of memory and was stopped. Partial work may exist. Not retried, because the same size would stop the same way. The operator can raise this job's memory size."
@@ -128154,7 +128523,7 @@ var init_backend_podman = __esm({
 
 // ../worker/src/sandbox-store.mjs
 import { chmodSync as chmodSync4, chownSync as chownSync2, lstatSync as lstatSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync8, readdirSync as readdirSync5, renameSync as renameSync2, rmdirSync, rmSync, statSync as statSync9, writeFileSync as writeFileSync2 } from "node:fs";
-import { isAbsolute as isAbsolute14, join as join14, relative as relative2 } from "node:path";
+import { isAbsolute as isAbsolute15, join as join15, relative as relative2 } from "node:path";
 function sandboxEntryName(jobId) {
   const name = sanitizeJobId(jobId);
   return name.startsWith(".") || name.startsWith("_") ? `_${name}` : name;
@@ -128162,9 +128531,9 @@ function sandboxEntryName(jobId) {
 function readManifest({ sandboxDir, jobId, fs: fs7 = defaultFs }) {
   if (!sandboxDir || jobId === void 0 || jobId === null) return null;
   const read = (name) => {
-    const dir = join14(sandboxDir, name);
+    const dir = join15(sandboxDir, name);
     try {
-      const manifest = JSON.parse(fs7.readFileSync(join14(dir, SANDBOX_MANIFEST), "utf8"));
+      const manifest = JSON.parse(fs7.readFileSync(join15(dir, SANDBOX_MANIFEST), "utf8"));
       return { ...manifest, dir };
     } catch {
       return null;
@@ -128196,7 +128565,7 @@ function readRetained(fs7, dir) {
   }
   let text;
   try {
-    text = String(fs7.readFileSync(join14(dir, SANDBOX_MANIFEST), "utf8"));
+    text = String(fs7.readFileSync(join15(dir, SANDBOX_MANIFEST), "utf8"));
   } catch (err) {
     if (err?.code === "ENOENT" || err?.code === "ENOTDIR") return { absent: true };
     if (TRANSIENT_READ_ERRORS.has(err?.code)) return { transient: true, code: err.code };
@@ -128224,7 +128593,7 @@ var init_sandbox_store = __esm({
 // ../worker/src/sandbox.mjs
 import { execFile as execFile5, spawn as spawn3 } from "node:child_process";
 import { existsSync as existsSync4, lstatSync as lstatSync4, readdirSync as readdirSync6, readFileSync as readFileSync9, statSync as statSync10 } from "node:fs";
-import { basename as basename6, join as join15 } from "node:path";
+import { basename as basename7, join as join16 } from "node:path";
 import { release as osRelease2 } from "node:os";
 import { promisify as promisify6 } from "node:util";
 function sandboxLauncher(venue) {
@@ -128372,7 +128741,7 @@ function resolveSandbox({ jobId, sandboxDir, retentionHours, publish = [], fs: f
   if (refusal) return refusal;
   const lapsed = sandboxWindowRefusal({ jobId, manifest, retentionHours, at: now(), pin });
   if (lapsed) return lapsed;
-  return { manifest, name: `${SANDBOX_NAME_PREFIX}${basename6(manifest.dir)}`, publish, venue: sandboxVenueOf(manifest), identity: dirIdentity(fs7 ?? { lstatSync: lstatSync4 }, manifest.dir) };
+  return { manifest, name: `${SANDBOX_NAME_PREFIX}${basename7(manifest.dir)}`, publish, venue: sandboxVenueOf(manifest), identity: dirIdentity(fs7 ?? { lstatSync: lstatSync4 }, manifest.dir) };
 }
 function dirIdentity(fs7, dir) {
   try {
@@ -128453,7 +128822,7 @@ async function openSandbox({
       };
     }
   }
-  const id = basename6(resolved.manifest.dir);
+  const id = basename7(resolved.manifest.dir);
   const ask = (signal) => Promise.resolve().then(() => running(signal ? { bin, signal } : { bin })).then((ids) => ({ answered: true, live: new Set(ids) }), () => ({ answered: false, live: /* @__PURE__ */ new Set() }));
   const before = await ask();
   if (before.live.has(id)) {
@@ -128970,26 +129339,27 @@ function triggerLine(t2) {
   const res = t2?.resume === true ? "  [resume]" : "";
   const rep = t2?.replicas > 1 ? `  [x${t2.replicas}]` : "";
   const sec = t2?.secrets > 0 ? `  [secrets ${t2.secrets}${t2.secretsProfile ? ` via ${t2.secretsProfile}` : ""}]` : "";
+  const mcp = Array.isArray(t2?.mcp) && t2.mcp.length > 0 ? `  [mcp ${t2.mcp.join(", ")}]` : "";
   const shot = t2?.disarmed ? "  [spent]" : t2?.once === true ? "  [once]" : "";
   const pol = `${Array.isArray(t2?.models) && t2.models.length > 0 ? `  [models ${t2.models.join(", ")}]` : ""}${t2?.maxCostUsd ? `  [max $${t2.maxCostUsd}]` : ""}`;
   const pfo = t2?.portfolio === true ? "  [portfolio]" : "";
   switch (t2?.type) {
     case "cron":
-      return `cron  ${t2.id ?? "-"}  ${t2.pattern ?? "-"} \u2192 ${t2.folder ?? "-"}/${flow}${forge}${pkgs}${img}${skl}${ins}${res}${rep}${sec}${pol}${pfo}`;
+      return `cron  ${t2.id ?? "-"}  ${t2.pattern ?? "-"} \u2192 ${t2.folder ?? "-"}/${flow}${forge}${pkgs}${img}${skl}${ins}${res}${rep}${sec}${mcp}${pol}${pfo}`;
     case "label":
-      return `label  ${ruleClauses(t2) || "(no selector)"} \u2192 ${flow}${forge}${pkgs}${img}${skl}${ins}${res}${rep}${sec}${pol}`;
+      return `label  ${ruleClauses(t2) || "(no selector)"} \u2192 ${flow}${forge}${pkgs}${img}${skl}${ins}${res}${rep}${sec}${mcp}${pol}`;
     case "comment":
-      return `comment  "${t2.phrase ?? "-"}" \u2192 ${flow}${forge}${pkgs}${img}${skl}${ins}${res}${rep}${sec}${pol}`;
+      return `comment  "${t2.phrase ?? "-"}" \u2192 ${flow}${forge}${pkgs}${img}${skl}${ins}${res}${rep}${sec}${mcp}${pol}`;
     case "pull_request": {
       const clauses = ruleClauses(t2);
       const action = `action[${(t2.action ?? []).join(",")}]`;
       const num = Number.isInteger(t2.number) ? ` #${t2.number}` : "";
-      return `pull_request  ${action}${num}${clauses ? ` ${clauses}` : ""} \u2192 ${flow}${forge}${pkgs}${img}${skl}${ins}${res}${rep}${sec}${pol}${shot}`;
+      return `pull_request  ${action}${num}${clauses ? ` ${clauses}` : ""} \u2192 ${flow}${forge}${pkgs}${img}${skl}${ins}${res}${rep}${sec}${mcp}${pol}${shot}`;
     }
     case "issue": {
       const action = `action[${(t2.action ?? []).join(",")}]`;
       const num = Number.isInteger(t2.number) ? ` #${t2.number}` : "";
-      return `issue  ${action}${num} \u2192 ${flow}${forge}${pkgs}${img}${skl}${ins}${res}${rep}${sec}${pol}${shot}`;
+      return `issue  ${action}${num} \u2192 ${flow}${forge}${pkgs}${img}${skl}${ins}${res}${rep}${sec}${mcp}${pol}${shot}`;
     }
     default:
       return "(unknown trigger)";
@@ -129635,6 +130005,9 @@ function createDashboardDeps(paths, {
         // read-model.mjs -- this module never touches the filesystem -- and it degrades to a safe empty
         // shape rather than throwing, so a broken overlay cannot take the whole snapshot down.
         stagedPackages: readStagedPackages({ globalPiDir: paths.globalPiDir }),
+        // The overlay's MCP servers (REQ-MCP-OPERATOR-SERVERS), for a trigger's `run.mcp` lines: the same plain,
+        // never-throw read, names and where each runs, never a header, an argument or a value.
+        overlayMcp: readOverlayMcpView({ globalPiDir: paths.globalPiDir }),
         // ONLY the id off the active Job -- a Job's `.data` holds issue title/body/username (PII), so it
         // never enters the snapshot (no-pii-in-logs, INT-RUN-HISTORY-FILE-CONTRACT).
         activeJobId: activeList?.[0]?.id ?? null
@@ -130328,7 +130701,7 @@ function renderPanelLines(snapshot, width, state2, styler) {
     const detailTitle = `trigger \xB7 ${scrubControl(String(t2?.type ?? "?"))}`;
     const dw = framed ? Math.min(Math.trunc(width), DRILL_WIDTH) : Math.trunc(width);
     const sched = cronSchedInfo(t2, snapshot);
-    const lines = renderTriggerDetail(t2, framed ? dw - 4 : 24, styler, sched, snapshot?.stagedPackages, snapshot?.fetchedAt, detailTrigger?.instructions);
+    const lines = renderTriggerDetail(t2, framed ? dw - 4 : 24, styler, sched, snapshot?.stagedPackages, snapshot?.fetchedAt, detailTrigger?.instructions, snapshot?.overlayMcp);
     if (!framed) return [detailTitle, "", ...lines.map((l) => styler.stripAnsi(l)), "", pendingDelete ? "delete this trigger? y/n" : "e edit \xB7 x delete \xB7 esc back"];
     const boxed = frame(styler, { title: detailTitle, width: dw, lines, footer: triggerDetailHints(dw - 4, styler, pendingDelete) });
     return centerBlock(boxed, Math.trunc(width), dw);
@@ -130601,9 +130974,9 @@ function heldSection(held, inner, styler) {
   }
   const rows = Array.isArray(held.rows) ? held.rows : [];
   if (rows.length === 0) return [];
-  const shown = rows.slice(0, HELD_ON_DASHBOARD);
-  const hidden = rows.length - shown.length + (Number(held.more) || 0);
-  const body = shown.map((r2) => heldRow(r2, inner, styler));
+  const shown2 = rows.slice(0, HELD_ON_DASHBOARD);
+  const hidden = rows.length - shown2.length + (Number(held.more) || 0);
+  const body = shown2.map((r2) => heldRow(r2, inner, styler));
   if (hidden > 0) body.push(styler.cell(`\u2193 ${hidden} more`, inner, { color: "dim" }));
   const total = rows.length + (Number(held.more) || 0);
   return [{ key: "held", priority: 5, viewKey: "h", head: ["held", `${total}${held.truncated ? "+" : ""} waiting \xB7 h view`], body }];
@@ -130653,9 +131026,9 @@ function failedSection(failed, inner, styler) {
   }
   const rows = Array.isArray(failed.rows) ? failed.rows : [];
   if (rows.length === 0) return [];
-  const shown = rows.slice(0, FAILED_ON_DASHBOARD);
-  const hidden = rows.length - shown.length + (Number(failed.more) || 0);
-  const body = shown.map((r2) => failedRow(r2, inner, styler));
+  const shown2 = rows.slice(0, FAILED_ON_DASHBOARD);
+  const hidden = rows.length - shown2.length + (Number(failed.more) || 0);
+  const body = shown2.map((r2) => failedRow(r2, inner, styler));
   if (hidden > 0) body.push(styler.cell(`\u2193 ${hidden} more`, inner, { color: "dim" }));
   const total = rows.length + (Number(failed.more) || 0);
   return [{ key: "failed", priority: 6, viewKey: "f", head: ["failed", `${total} in the queue \xB7 f view`], body }];
@@ -130803,12 +131176,13 @@ function triggerRow(raw, sel, inner, styler, sched = null) {
   const skl = t2?.skillsDir ? rowBadge("accent", false, "[skills ", cellOf(skillsBasename(t2.skillsDir)), "]") : null;
   const ins = t2?.instructions === true ? rowBadge("accent", false, "[instructions]") : null;
   const sec = t2?.secrets > 0 ? rowBadge("warning", true, `[secrets ${t2.secrets}${t2.secretsProfile ? " via " : ""}`, t2.secretsProfile ? cellOf(t2.secretsProfile) : "", "]") : null;
+  const mcp = Array.isArray(t2?.mcp) && t2.mcp.length > 0 ? rowBadge("warning", true, "[mcp ", cellOf(t2.mcp.join(", ")), "]") : null;
   const shot = t2?.disarmed ? rowBadge("dim", false, "[spent]") : t2?.once === true ? rowBadge("accent", false, "[once]") : null;
   const health = sched && (sched.overdueMs || sched.stallMax > 0 && sched.stalls >= sched.stallMax) ? rowBadge("warning", true, sched.overdueMs ? "\u26A0 overdue" : "\u26A0 stalled") : null;
   const mdl = Array.isArray(t2?.models) && t2.models.length > 0 ? rowBadge("accent", false, "[models ", cellOf(t2.models.join(", ")), "]") : null;
   const cap = t2?.maxCostUsd ? rowBadge("accent", false, "[max $", cellOf(t2.maxCostUsd), "]") : null;
   const pfo = t2?.portfolio === true ? rowBadge("accent", false, "[portfolio]") : null;
-  const badges = [pkgs, img, skl, ins, res, rep, sec, shot, mdl, cap, pfo, health].filter((b) => b !== null);
+  const badges = [pkgs, img, skl, ins, res, rep, sec, mcp, shot, mdl, cap, pfo, health].filter((b) => b !== null);
   const match2 = matchColored(t2, styler);
   return fitTriggerRow(`${cursor} ${badge} `, match2, targetColored(t2, styler), badges, inner, styler, rowFloorMatch(t2, match2, styler));
 }
@@ -131034,10 +131408,10 @@ function callLines(text, iw, styler, indentMax) {
   if (rows.length > 1) for (const l of wrapColumns(CALL_JOIN_NOTE, Math.max(1, w - indentMax), styler)) out.push(fitLine(`${" ".repeat(indentMax)}${styler.fg("dim", l)}`, w, styler));
   return out;
 }
-function sizingVerdict(dim, name, shown) {
-  if (dim.suggested) return `${name} ${shown(dim.suggested)} (${dim.reason}${dim.held === "cap" ? ", the most a live host offers" : ""})`;
+function sizingVerdict(dim, name, shown2) {
+  if (dim.suggested) return `${name} ${shown2(dim.suggested)} (${dim.reason}${dim.held === "cap" ? ", the most a live host offers" : ""})`;
   if (dim.held === "largest") return `${name} stays (${dim.reason}, ${Number.isSafeInteger(dim.cap) && dim.current > dim.cap ? "already above the most a live host offers" : "already the largest size a live host offers"})`;
-  if (dim.held === "no-cap") return `${name} wants ${shown(dim.wanted)} (${dim.reason}, ${NO_CAP_WORDS[dim.capMissing] ?? NO_CAP_WORDS.unread}: no call)`;
+  if (dim.held === "no-cap") return `${name} wants ${shown2(dim.wanted)} (${dim.reason}, ${NO_CAP_WORDS[dim.capMissing] ?? NO_CAP_WORDS.unread}: no call)`;
   return null;
 }
 function sizingLines(sizing, id, iw, styler) {
@@ -131408,9 +131782,9 @@ function runRow(row, sel, inner, styler) {
 }
 function outcomeColored(outcome, reason, styler) {
   if (outcome === "completed") return styler.fg("success", "\u2714 done");
-  const shown = (v) => scrubControl(String(v));
-  if (outcome === "policy") return styler.fg("warning", `\u26A0 ${shown(reason ?? "policy")}`);
-  return styler.fg("error", `\u2718 ${shown(reason ?? outcome ?? "failed")}`);
+  const shown2 = (v) => scrubControl(String(v));
+  if (outcome === "policy") return styler.fg("warning", `\u26A0 ${shown2(reason ?? "policy")}`);
+  return styler.fg("error", `\u2718 ${shown2(reason ?? outcome ?? "failed")}`);
 }
 function settingsLines(settings2, inner, styler) {
   if (settings2 && settings2.invalid) return [styler.cell(`settings invalid: ${settings2.invalid}`, inner, { color: "error" })];
@@ -131423,7 +131797,7 @@ function settingsLines(settings2, inner, styler) {
   const l2 = [kv("dailyCap", o.dailyCap), tk("dailyTokenCap", o.dailyTokenCap), kv("concurrency", o.concurrency), styler.fg("muted", "softHold") + " " + styler.fg("text", pctVal)].join(gap);
   return [fitLine(l1, inner, styler), fitLine(l2, inner, styler)];
 }
-function renderTriggerDetail(raw, inner, styler, sched = null, staged = null, fetchedAt, instructionsText = null) {
+function renderTriggerDetail(raw, inner, styler, sched = null, staged = null, fetchedAt, instructionsText = null, overlayMcp = null) {
   if (!raw) return [styler.cell("(no trigger)", inner, { color: "dim" })];
   const t2 = scrubTrigger(raw);
   const out = [];
@@ -131491,10 +131865,15 @@ function renderTriggerDetail(raw, inner, styler, sched = null, staged = null, fe
   out.push(kv("resume", t2.resume === true ? "continues the previous session" : "cold start", t2.resume === true ? "warning" : "dim"));
   kvWrap("secrets", t2.secrets > 0 ? `${t2.secrets} bound${t2.secretsProfile ? ` via profile ${cellOf(t2.secretsProfile)}` : ""}` : "none bound", t2.secrets > 0 ? "warning" : "dim");
   out.push(kv("replicas", t2.replicas > 1 ? `${t2.replicas} sandboxes race this flow` : "one run per delivery", t2.replicas > 1 ? "warning" : "dim"));
+  kvWrap("mcp", Array.isArray(t2.mcp) && t2.mcp.length > 0 ? t2.mcp.map((n) => cellOf(n)).join(", ") : "none", Array.isArray(t2.mcp) && t2.mcp.length > 0 ? "warning" : "dim");
   blank();
   section("trust model");
   const bullet = (text, color) => wrapColumns(text, inner - 2, styler).forEach((part, i2) => out.push(fitLine(styler.fg("border", i2 === 0 ? "\xB7 " : "  ") + styler.fg(color, part), inner, styler)));
   for (const line of trustModel(t2)) bullet(line, "text");
+  if (Array.isArray(t2.mcp) && t2.mcp.length > 0) {
+    for (const name of t2.mcp) bullet(mcpServerLine(name, overlayMcp), "warning");
+    bullet("an MCP server's tools and text are input the job did not write; a stdio server runs code with the variables it names", "warning");
+  }
   if (t2.packages === true) {
     const loads = (text) => bullet(text, "warning");
     loads(`packages loaded \xB7 ${stagedNames(staged)}`);
@@ -131525,6 +131904,20 @@ function spentMark(disarmed) {
   const by = disarmed.jobId ? ` by ${cellOf(disarmed.jobId)}` : "";
   return `spent ${cellOf(disarmed.at ?? "-")}${by}`;
 }
+function mcpServerLine(name, overlayMcp) {
+  const label2 = `mcp ${cellOf(name)}`;
+  if (name === FORGE_MCP_SERVER_NAME) return `${label2} \xB7 the forge's own server, as the job's own token`;
+  if (overlayMcp?.unreadable === "invalid") return `${label2} \xB7 the overlay's mcp.json cannot be used, so every job is refused`;
+  if (overlayMcp?.unreadable) return `${label2} \xB7 the overlay's mcp.json cannot be read just now (${cellOf(overlayMcp.unreadable)})`;
+  const server = Array.isArray(overlayMcp?.servers) ? overlayMcp.servers.find((s2) => s2?.name === name) : void 0;
+  if (!server) {
+    const refused = Array.isArray(overlayMcp?.refused) && overlayMcp.refused.includes(name);
+    return `${label2} \xB7 ${refused ? "refused by the overlay's mcp.json (pi-dispatch doctor says why)" : "not offered by the overlay"}, so every job is refused`;
+  }
+  if (server.enabled === false) return `${label2} \xB7 turned off in the overlay, so every job is refused`;
+  const refs = Array.isArray(server.refs) && server.refs.length > 0 ? ` \xB7 handed ${server.refs.map((r2) => cellOf(r2)).join(", ")}` : "";
+  return `${label2} \xB7 ${cellOf(server.transport)} ${cellOf(server.where)} \xB7 ${cellOf(server.exposure)}${refs}`;
+}
 function stagedNames(staged) {
   const list2 = Array.isArray(staged?.packages) ? staged.packages : [];
   return list2.length > 0 ? list2.map(cellOf).join(" \xB7 ") : "(none staged in the overlay)";
@@ -131911,12 +132304,12 @@ __export(setup_wizard_exports, {
 import * as nodeFs7 from "node:fs";
 import { execFileSync as execFileSync4, spawn as nodeSpawn2 } from "node:child_process";
 import { homedir as homedir5 } from "node:os";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 function envIsSet(env2, key) {
   return typeof env2[key] === "string" && env2[key] !== "";
 }
 function hasCwdScaffold(cwd, fs7) {
-  return CWD_SCAFFOLD_FILES.every((name) => fs7.existsSync(join16(cwd, name)));
+  return CWD_SCAFFOLD_FILES.every((name) => fs7.existsSync(join17(cwd, name)));
 }
 async function defaultProbeQueue(url) {
   return !(await readQueueState({ url })).unreachable;
@@ -132075,7 +132468,7 @@ function podmanPreferred(env2, dir, fs7) {
   return fromFile2.podmanUsed && !fromFile2.localUsed;
 }
 function deploymentBackends(dir, fs7, { writing = false, platform = process.platform, readBackFn = readStackKeys } = {}) {
-  const envPath = join16(dir, ".env");
+  const envPath = join17(dir, ".env");
   let text;
   try {
     if (!fs7.existsSync(envPath)) return { absent: true };
@@ -132150,25 +132543,25 @@ function npmSpawnOptions(platform, dir) {
 }
 function listRepoSkills(cwd, fs7 = nodeFs7) {
   try {
-    const root = join16(cwd, ".pi", "skills");
-    return fs7.readdirSync(root).filter((name) => SKILL_NAME_RE.test(name) && fs7.existsSync(join16(root, name, "SKILL.md")));
+    const root = join17(cwd, ".pi", "skills");
+    return fs7.readdirSync(root).filter((name) => SKILL_NAME_RE.test(name) && fs7.existsSync(join17(root, name, "SKILL.md")));
   } catch {
     return [];
   }
 }
 function runtimeDirFor(dir, pkg = "pi-dispatch") {
-  return join16(dir, "node_modules", "@edgehero", pkg);
+  return join17(dir, "node_modules", "@edgehero", pkg);
 }
 function readInstalledVersion(fs7, runtimeDir) {
   try {
-    const pkg = JSON.parse(fs7.readFileSync(join16(runtimeDir, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs7.readFileSync(join17(runtimeDir, "package.json"), "utf8"));
     return typeof pkg?.version === "string" ? pkg.version : void 0;
   } catch {
     return void 0;
   }
 }
 function ensureDeploymentPackageJson(fs7, dir) {
-  const rootPkg = join16(dir, "package.json");
+  const rootPkg = join17(dir, "package.json");
   if (!fs7.existsSync(rootPkg)) {
     fs7.writeFileSync(rootPkg, `${JSON.stringify({ name: "pi-dispatch-deployment", private: true }, null, 2)}
 `);
@@ -132216,7 +132609,7 @@ async function runSetupWizard(paths, rawCtx, notify, deps = {}) {
     return;
   }
   if (intent !== "Guided setup") return;
-  const defaultDir = join16(homedirFn(), "pi-dispatch");
+  const defaultDir = join17(homedirFn(), "pi-dispatch");
   const dirAnswer = await ui.input("deployment directory \u2014 where the runtime and its config live", defaultDir);
   const dir = dirAnswer === void 0 || dirAnswer.trim() === "" ? defaultDir : dirAnswer.trim();
   try {
@@ -132226,7 +132619,7 @@ async function runSetupWizard(paths, rawCtx, notify, deps = {}) {
     return;
   }
   const runtimeDir = runtimeDirFor(dir);
-  const cliPath = join16(runtimeDir, "src", "cli.mjs");
+  const cliPath = join17(runtimeDir, "src", "cli.mjs");
   let runtime;
   if (podmanPreferred(env2, dir, fs7)) {
     if (!await ensurePodman(ui, notify, { platform, probePodmanFn })) return;
@@ -132245,7 +132638,7 @@ async function runSetupWizard(paths, rawCtx, notify, deps = {}) {
     }
     if ("value" in fileBackends && !venuesOf({ PI_BACKENDS: fileBackends.value }).podmanUsed) {
       notify?.(
-        `${join16(dir, ".env")} sets PI_BACKENDS=${fileBackends.value}, which does not list podman, and setup never overwrites a key you set. Change it to PI_BACKENDS=podman (or add podman to the list), then re-run /dispatch setup. Nothing was installed`,
+        `${join17(dir, ".env")} sets PI_BACKENDS=${fileBackends.value}, which does not list podman, and setup never overwrites a key you set. Change it to PI_BACKENDS=podman (or add podman to the list), then re-run /dispatch setup. Nothing was installed`,
         "error"
       );
       return;
@@ -132326,11 +132719,11 @@ up shows each docker action and asks y/N before it \u2014 nothing is auto-accept
     version: POINTER_VERSION,
     deploymentDir: dir,
     env: {
-      PI_TRIGGERS_FILE: join16(dir, "triggers.json"),
-      PI_PAUSE_WINDOWS_FILE: join16(dir, "pause-windows.json"),
-      PI_SCOPED_LIMITS_FILE: join16(dir, "scoped-limits.json"),
-      PI_PROJECTS_FILE: join16(dir, "projects.json"),
-      PI_SUBSCRIPTIONS_FILE: join16(dir, "subscriptions.json")
+      PI_TRIGGERS_FILE: join17(dir, "triggers.json"),
+      PI_PAUSE_WINDOWS_FILE: join17(dir, "pause-windows.json"),
+      PI_SCOPED_LIMITS_FILE: join17(dir, "scoped-limits.json"),
+      PI_PROJECTS_FILE: join17(dir, "projects.json"),
+      PI_SUBSCRIPTIONS_FILE: join17(dir, "subscriptions.json")
     }
   };
   const pPath = pointerPath(env2);
@@ -132348,7 +132741,7 @@ ${JSON.stringify(pointer, null, 2)}`);
     }
   }
   notify?.(
-    `provider key: set ANTHROPIC_API_KEY (or your provider's key) in ${join16(dir, ".env")} \u2014 already logged into pi on this machine? leave it blank and jobs use that login. Setup never reads or writes the key itself.`,
+    `provider key: set ANTHROPIC_API_KEY (or your provider's key) in ${join17(dir, ".env")} \u2014 already logged into pi on this machine? leave it blank and jobs use that login. Setup never reads or writes the key itself.`,
     "info"
   );
   const workerChoice = await ui.select("Run the worker", [
@@ -132452,10 +132845,10 @@ then, in the same folder:
     return;
   }
   if (choice === EDGE_COMPOSE) {
-    const deployDir = join16(dir, "deploy");
+    const deployDir = join17(dir, "deploy");
     const copies = [
-      [join16(runtimeDirFor(dir), "deploy", "docker-compose.yml"), join16(deployDir, "docker-compose.yml"), true],
-      [join16(runtimeDirFor(dir), "deploy", "egress-proxy.conf"), join16(deployDir, "egress-proxy.conf"), false]
+      [join17(runtimeDirFor(dir), "deploy", "docker-compose.yml"), join17(deployDir, "docker-compose.yml"), true],
+      [join17(runtimeDirFor(dir), "deploy", "egress-proxy.conf"), join17(deployDir, "egress-proxy.conf"), false]
     ];
     const dest = copies[0][1];
     for (const [src, to, required] of copies) {
@@ -132480,14 +132873,14 @@ then, in the same folder:
       }
     }
     const project = composeProjectName(dir);
-    const legacy = join16(dir, "docker-compose.yml");
+    const legacy = join17(dir, "docker-compose.yml");
     if (fs7.existsSync(legacy)) {
       notify?.(
         `${legacy} is an earlier setup's copy: its ../ paths reach the folder above ${dir}, so it is not used. It ran as compose project "${project}" (its volume ${project}_valkey-data), which the command below keeps with -p ${project}. ${dest} is the one to run; move any edits of yours there, then remove it`,
         "warning"
       );
     }
-    const override = join16(dir, COMPOSE_VALKEY_OVERRIDE);
+    const override = join17(dir, COMPOSE_VALKEY_OVERRIDE);
     const hasOverride = fs7.existsSync(override);
     const port = composeValkeyPort(dir, fs7);
     let real = dir;
@@ -132513,7 +132906,7 @@ then, in the same folder:
     const args = [...base, "--profile", "receiver", "up", "-d"];
     const pull = [...composeArgs({ project, override: hasOverride }), "--profile", "receiver", "pull"];
     const portPrefix = port !== 6379 ? `${VALKEY_PORT_KEY}=${port} ` : "";
-    const shown = `${portPrefix}docker ${args.join(" ")}`;
+    const shown2 = `${portPrefix}docker ${args.join(" ")}`;
     const shownPull = `${portPrefix}docker ${pull.join(" ")}`;
     const writeLine = handover && !hasOverride ? `write ${override}:
 ${VALKEY_HANDOVER_OVERRIDE.replace(/^/gm, "      ")}` : "";
@@ -132525,17 +132918,17 @@ ${VALKEY_HANDOVER_OVERRIDE.replace(/^/gm, "      ")}` : "";
     const ok = await ui.confirm(
       "Start the receiver container",
       `Run in ${dir}:
-  ${handoverLines}${shown}
+  ${handoverLines}${shown2}
 
-the receiver profile reads ${join16(dir, ".env")}: WEBHOOK_SECRET and the forge credentials must be in there, or the container refuses to boot.`
+the receiver profile reads ${join17(dir, ".env")}: WEBHOOK_SECRET and the forge credentials must be in there, or the container refuses to boot.`
     );
     if (!ok) {
       notify?.(`later: ${handover ? `${shownPull}; ${writeLine ? `write ${override} with:
-${VALKEY_HANDOVER_OVERRIDE}` : ""}docker stop pi-dispatch-valkey && docker rm pi-dispatch-valkey; then ` : ""}${shown}  (in ${dir})`, "info");
+${VALKEY_HANDOVER_OVERRIDE}` : ""}docker stop pi-dispatch-valkey && docker rm pi-dispatch-valkey; then ` : ""}${shown2}  (in ${dir})`, "info");
       return;
     }
     try {
-      const envPath = join16(dir, ".env");
+      const envPath = join17(dir, ".env");
       if (fs7.existsSync(envPath)) {
         const read = deploymentServiceEnv({ env: {}, dir, keys: [VALKEY_PORT_KEY], fs: fs7, platform: "linux" });
         const found = read.fromFile[VALKEY_PORT_KEY] ?? (read.unread.length > 0 || read.hazardSkipped.length > 0 || read.untrusted ? "?" : void 0);
@@ -132595,22 +132988,22 @@ ${VALKEY_HANDOVER_OVERRIDE}` : ""}docker stop pi-dispatch-valkey && docker rm pi
         notify?.(`docker rm pi-dispatch-valkey failed; up's Valkey is STOPPED. \`docker start pi-dispatch-valkey\` brings it back on its volume.${putBack()}`, "error");
         return;
       }
-      if (!await step(args, shown, composeEnv)) {
-        notify?.(`${shown} failed after up's Valkey was removed: NO Valkey runs now. Its volume, pi-dispatch-valkey-data, and the queue in it are kept: \`node ${cliPath} up\` (in ${dir}) starts pi-dispatch-valkey on it again.${putBack()} Compose's own output above says why it failed`, "error");
+      if (!await step(args, shown2, composeEnv)) {
+        notify?.(`${shown2} failed after up's Valkey was removed: NO Valkey runs now. Its volume, pi-dispatch-valkey-data, and the queue in it are kept: \`node ${cliPath} up\` (in ${dir}) starts pi-dispatch-valkey on it again.${putBack()} Compose's own output above says why it failed`, "error");
         return;
       }
       await ownerMarker();
       if (plan.record) {
         try {
-          fs7.writeFileSync(join16(dir, VALKEY_VOLUME_RECORD), volumeRecordText(plan.record), { mode: 384, flag: "wx" });
+          fs7.writeFileSync(join17(dir, VALKEY_VOLUME_RECORD), volumeRecordText(plan.record), { mode: 384, flag: "wx" });
         } catch (err) {
-          if (err?.code !== "EEXIST") notify?.(`the volume could not be recorded in ${join16(dir, VALKEY_VOLUME_RECORD)} (${err?.message ?? err}); a later \`up\` asks about it`, "warning");
+          if (err?.code !== "EEXIST") notify?.(`the volume could not be recorded in ${join17(dir, VALKEY_VOLUME_RECORD)} (${err?.message ?? err}); a later \`up\` asks about it`, "warning");
         }
       }
       return;
     }
-    if (!await step(args, shown, composeEnv)) {
-      notify?.(`${shown} failed; compose's own output above says why (another container on 127.0.0.1:${port} is the usual one)`, "error");
+    if (!await step(args, shown2, composeEnv)) {
+      notify?.(`${shown2} failed; compose's own output above says why (another container on 127.0.0.1:${port} is the usual one)`, "error");
       return;
     }
     if (useOverride) await ownerMarker();
@@ -132642,7 +133035,7 @@ function podmanWriteVerify(envPath, prior, readBackFn = readStackKeys) {
   };
 }
 function recordPodmanVenue(dir, fs7, notify, platform, readBackFn = readStackKeys) {
-  const envPath = join16(dir, ".env");
+  const envPath = join17(dir, ".env");
   if (!fs7.existsSync(envPath)) {
     notify?.(`no ${envPath} yet (\`up\` runs init, which writes it): add PI_BACKENDS=podman to it before \`service install\`, which reads only that file`, "warning");
     return;
@@ -132699,11 +133092,11 @@ async function offerFirstTrigger(repoCwd, deployDir, ui, notify, { fs: fs7, list
   const task = taskAnswer.trim() === "" ? "run the flow" : taskAnswer.trim();
   notify?.(`a local cron job edits ${repoCwd} IN PLACE with no undo \u2014 commit or stash before it first fires`, "warning");
   notify?.(
-    `to let AI-invoked runs use this flow, add \`ai-trigger: allow\` to ${join16(".pi", "skills", flow, "SKILL.md")} frontmatter \u2014 takes effect once committed. Setup never writes into the repo.`,
+    `to let AI-invoked runs use this flow, add \`ai-trigger: allow\` to ${join17(".pi", "skills", flow, "SKILL.md")} frontmatter \u2014 takes effect once committed. Setup never writes into the repo.`,
     "info"
   );
   const entry = buildTriggerEntry("cron", { id, pattern, folder: repoCwd, flow, task });
-  const res = writeTriggersFn({ triggersPath: join16(deployDir, "triggers.json"), mutate: (list2) => [...list2, entry] });
+  const res = writeTriggersFn({ triggersPath: join17(deployDir, "triggers.json"), mutate: (list2) => [...list2, entry] });
   notify?.(
     res.ok !== false && !res.invalid ? `trigger added \u2014 ${id} (${pattern}) runs ${flow} in ${repoCwd}` : `trigger rejected: ${res.invalid}`,
     res.invalid ? "error" : "info"
@@ -132719,8 +133112,8 @@ function registerNudge(pi, deps = {}) {
       if (POINTER_ENV_ALLOWLIST.some((key) => envIsSet(env2, key))) return;
       const cwd = typeof ctx?.cwd === "string" && ctx.cwd !== "" ? ctx.cwd : process.cwd();
       if (hasCwdScaffold(cwd, fs7)) return;
-      const agentDir = env2.PI_CODING_AGENT_DIR || join16(homedirFn(), ".pi", "agent");
-      const marker = join16(agentDir, NUDGE_MARKER_BASENAME);
+      const agentDir = env2.PI_CODING_AGENT_DIR || join17(homedirFn(), ".pi", "agent");
+      const marker = join17(agentDir, NUDGE_MARKER_BASENAME);
       if (fs7.existsSync(marker)) return;
       ctx?.ui?.notify?.("pi-dispatch: no deployment configured \u2014 /dispatch setup gets you started", "info");
       fs7.writeFileSync(marker, `${(/* @__PURE__ */ new Date()).toISOString()}
@@ -132743,8 +133136,8 @@ var init_setup_wizard = __esm({
     init_connection();
     init_service_env();
     init_index();
-    RUNTIME_VERSION = "4.1.0";
-    RECEIVER_VERSION = "4.1.0";
+    RUNTIME_VERSION = "4.2.0";
+    RECEIVER_VERSION = "4.2.0";
     RUNTIME_PKG = "@edgehero/pi-dispatch";
     RECEIVER_PKG = "@edgehero/pi-dispatch-receiver";
     NUDGE_MARKER_BASENAME = "pi-dispatch-setup.nudged";
@@ -132865,7 +133258,7 @@ import { VERSION as VERSION3 } from "@earendil-works/pi-coding-agent";
 import { fileURLToPath as fileURLToPath3, pathToFileURL } from "node:url";
 import * as nodeFs8 from "node:fs";
 import { hostname as hostname2 } from "node:os";
-import { basename as basename7, join as join17 } from "node:path";
+import { basename as basename8, join as join18 } from "node:path";
 function computePiVersionAdvisory(version, supported) {
   if (version === supported || version === "0.0.0") return void 0;
   return `pi-dispatch admin: running on pi ${version}, tested with pi ${supported} \u2014 things should work; report anything odd, and check for a newer @edgehero/pi-dispatch-admin`;
@@ -132934,15 +133327,15 @@ function guardedFiles() {
     { path: set("PI_SCOPED_LIMITS_FILE") ? paths.scopedLimitsPath : null, label: "scoped-limits.json (PI_SCOPED_LIMITS_FILE)", tool: "dispatch_limit_add, _edit or _delete" },
     { path: set("PI_TRIGGERS_FILE") ? paths.triggersPath : null, label: "triggers.json (PI_TRIGGERS_FILE)", tool: "dispatch_trigger_add, _edit or _delete" },
     { path: paths.settingsFile, label: "the settings overlay (PI_SETTINGS_FILE)", tool: "dispatch_set" },
-    { path: typeof dir === "string" && dir !== "" ? join17(dir, ".env") : null, label: "the deployment's .env, which names these files (PI_*_FILE)", tool: "the operator's own editor" },
+    { path: typeof dir === "string" && dir !== "" ? join18(dir, ".env") : null, label: "the deployment's .env, which names these files (PI_*_FILE)", tool: "the operator's own editor" },
     { path: pointerPath(process.env), label: "the deployment pointer (PI_DISPATCH_DEPLOYMENT_FILE)", tool: "/dispatch setup" }
   ];
   if (!(typeof dir === "string" && dir !== "")) {
     const cwd = process.cwd();
     out.push(...envNamedFiles(cwd));
-    if (DEPLOYMENT_SCAFFOLD_FILES.every((f3) => nodeFs8.existsSync(join17(cwd, f3)))) {
+    if (DEPLOYMENT_SCAFFOLD_FILES.every((f3) => nodeFs8.existsSync(join18(cwd, f3)))) {
       out.push(
-        { path: join17(cwd, ".env"), label: "the deployment's .env, which names these files (PI_*_FILE)", tool: "the operator's own editor" },
+        { path: join18(cwd, ".env"), label: "the deployment's .env, which names these files (PI_*_FILE)", tool: "the operator's own editor" },
         { path: paths.triggersPath, label: "triggers.json (PI_TRIGGERS_FILE)", tool: "dispatch_trigger_add, _edit or _delete" },
         { path: paths.scopedLimitsPath, label: "scoped-limits.json (PI_SCOPED_LIMITS_FILE)", tool: "dispatch_limit_add, _edit or _delete" },
         { path: paths.projectsPath, label: "projects.json (PI_PROJECTS_FILE)", tool: "dispatch_project_add, _edit or _delete" }
@@ -133024,9 +133417,9 @@ function registerTools(pi) {
       const set = await killSwitchSet({ paused: true });
       if (set.refused) throw new Error(set.refused);
       const lines = [];
-      for (const { shown, res } of set.results) {
-        const at = set.results.length > 1 ? ` at ${shown}` : "";
-        if (res.unreachable && !res.partial) throw new Error(`could not reach the queue at ${shown}: ${res.unreachable}`);
+      for (const { shown: shown2, res } of set.results) {
+        const at = set.results.length > 1 ? ` at ${shown2}` : "";
+        if (res.unreachable && !res.partial) throw new Error(`could not reach the queue at ${shown2}: ${res.unreachable}`);
         if (res.partial) throw new Error(`paused ${res.partial.done.join(", ")}${at} but FAILED at ${res.partial.failed}: the deployment is half paused: ${res.partial.error}`);
         lines.push(`paused${at}${res.queues.length > 1 ? ` (${res.queues.length} queues)` : ""}`);
       }
@@ -133042,9 +133435,9 @@ function registerTools(pi) {
     async execute() {
       const set = await killSwitchSet({ paused: false });
       if (set.refused) throw new Error(set.refused);
-      const { shown, res } = set.results[0];
+      const { shown: shown2, res } = set.results[0];
       if (res.unreachable && !res.partial) {
-        throw new Error(`could not reach the queue at ${shown}: ${res.unreachable}`);
+        throw new Error(`could not reach the queue at ${shown2}: ${res.unreachable}`);
       }
       if (res.partial) {
         throw new Error(`resumed ${res.partial.done.join(", ")} but FAILED at ${res.partial.failed} \u2014 the deployment is half resumed: ${res.partial.error}`);
@@ -133109,23 +133502,23 @@ function registerTools(pi) {
       }
       const paths = resolvePaths(deploymentEnv());
       const env2 = deploymentEnv();
-      const shown = { deploymentDir: pointerState().deploymentDir ?? null };
+      const shown2 = { deploymentDir: pointerState().deploymentDir ?? null };
       const view = readSettingsView({ settingsFile: paths.settingsFile });
       if (view?.invalid && !blankSettingsFile(paths.settingsFile)) throw new Error(`rejected: ${overlayInvalidRefusal(view.invalid)}`);
       const unset = params.value === void 0 || params.value.trim() === "";
       const newVal = unset ? void 0 : coerceSettingValue(params.key, params.value.trim());
       if (!unset && DOLLAR_SETTING_KEYS.includes(params.key)) parseUsdMicros(newVal, params.key);
       const afterOverlay = unset ? Object.fromEntries(Object.entries(view?.overlay ?? {}).filter(([k]) => k !== params.key)) : { ...view?.overlay ?? {}, [params.key]: newVal };
-      const after = unset ? settingShown(params.key, afterOverlay, env2, shown) : String(newVal);
+      const after = unset ? settingShown(params.key, afterOverlay, env2, shown2) : String(newVal);
       const isDollarKey = DOLLAR_SETTING_KEYS.includes(params.key);
-      const problem = isDollarKey ? mergedDollarProblem(afterOverlay, env2, shown) : null;
+      const problem = isDollarKey ? mergedDollarProblem(afterOverlay, env2, shown2) : null;
       const broken = settingsEnvelopeRefusal(params.key, view?.overlay ?? {}, afterOverlay, paths, env2);
       if (broken) throw new Error(`rejected: ${escapeInterpreted(broken)}`);
       const result = await confirmedWrite(
         ctx,
         {
           title: unset ? `Unset ${params.key}` : `Set ${params.key}`,
-          message: `${params.key}: ${settingShown(params.key, view?.overlay, env2, shown)} -> ${after}${problem?.warning ? `
+          message: `${params.key}: ${settingShown(params.key, view?.overlay, env2, shown2)} -> ${after}${problem?.warning ? `
 
 Warning: ${problem.warning}` : ""}`
         },
@@ -134029,14 +134422,17 @@ function sizeFieldsOf(f3) {
   }
   return out;
 }
+function mcpFieldNearMiss(key) {
+  return key === "mcp" || isMcpNearMiss(key) ? "run.mcp" : null;
+}
 function refuseWideningFields(params, tool) {
   const objects = [["", params], ["run.", params?.run], ["on.", params?.on]];
   for (const [label2, source] of objects) {
     if (source === null || typeof source !== "object" || Array.isArray(source)) continue;
     for (const key of Object.keys(source)) {
-      const meant = runModelFieldNearMiss(key);
+      const meant = runModelFieldNearMiss(key) ?? mcpFieldNearMiss(key);
       if (meant === null || !TOOL_PROOF_FIELDS.has(meant)) continue;
-      const what = meant === "run.models" ? "allowed-model list" : "per-job dollar cap";
+      const what = meant === "run.models" ? "allowed-model list" : meant === "run.mcp" ? "list of MCP servers" : "per-job dollar cap";
       throw new Error(`${tool} cannot set ${meant} (sent as ${label2}${key}): a trigger's ${what} is set by hand in the triggers file, never by a tool`);
     }
   }
@@ -134213,11 +134609,11 @@ ${scopedText}` : ""}`);
         return;
       }
       if (set.disagreement) notify?.(`${set.disagreement}: pausing both`, "warning");
-      for (const { shown, res } of set.results) {
-        const at = set.results.length > 1 ? ` at ${shown}` : "";
+      for (const { shown: shown2, res } of set.results) {
+        const at = set.results.length > 1 ? ` at ${shown2}` : "";
         if (res.unreachable) {
           notify?.(
-            res.partial ? `${paused ? "paused" : "resumed"} ${res.partial.done.join(", ")}${at} but FAILED at ${res.partial.failed}: the deployment is half ${paused ? "paused" : "resumed"}` : `could not reach Valkey at ${shown}: ${valkeyDownHint(shown)}`,
+            res.partial ? `${paused ? "paused" : "resumed"} ${res.partial.done.join(", ")}${at} but FAILED at ${res.partial.failed}: the deployment is half ${paused ? "paused" : "resumed"}` : `could not reach Valkey at ${shown2}: ${valkeyDownHint(shown2)}`,
             "error"
           );
           continue;
@@ -134391,7 +134787,7 @@ async function assembleAllocationView(paths, counts, { fullPaths = false } = {})
   const read = readEnvelope({ envelopeFile: paths.envelopeFile, projectsPath: paths.projectsFile, scopedLimitsPath: paths.scopedLimitsPath, maxCostMicros: envelopeJobCap({ settingsFile: paths.settingsFile, env: deploymentEnv() }) });
   if (!read.envelope) {
     const file = String(paths.envelopeFile);
-    const invalid = read.invalid !== void 0 && !fullPaths ? String(read.invalid).split(file).join(basename7(file)) : read.invalid;
+    const invalid = read.invalid !== void 0 && !fullPaths ? String(read.invalid).split(file).join(basename8(file)) : read.invalid;
     return { problem: envelopeProblem({ ...read, invalid }) };
   }
   const e2 = read.envelope;
@@ -134840,11 +135236,11 @@ The project's runs could not be read (${sizing.unreachable}).`;
   const m2 = s2.memory;
   const c = s2.cpu;
   const peaks = `p95 peak ${m2.evidence.p95MiB === null ? "none" : formatMemory(m2.evidence.p95MiB)} over ${m2.evidence.samples} runs, p95 ${c.evidence.p95CoresCenti === null ? "none" : coresText(c.evidence.p95CoresCenti)} used over ${c.evidence.samples} runs`;
-  const said = (dim, words, shown) => {
-    if (dim.suggested) return `${shown(dim.suggested)} (${dim.reason}: ${words})`;
-    if (dim.held === "no-cap") return `${shown(dim.wanted)} (${dim.reason}: ${words}; budget not checked here)`;
+  const said = (dim, words, shown2) => {
+    if (dim.suggested) return `${shown2(dim.suggested)} (${dim.reason}: ${words})`;
+    if (dim.held === "no-cap") return `${shown2(dim.wanted)} (${dim.reason}: ${words}; budget not checked here)`;
     if (dim.held === "largest") return `no larger size (${dim.reason}: ${words})`;
-    return dim.reason === "not-enough-runs" ? notEnoughRunsText(dim, shown === formatCpus ? cpusText : shown) : "fits";
+    return dim.reason === "not-enough-runs" ? notEnoughRunsText(dim, shown2 === formatCpus ? cpusText : shown2) : "fits";
   };
   const facts = [s2.words.memoryFact, s2.words.cpuFact].filter(Boolean);
   return `
@@ -135279,7 +135675,7 @@ var init_index = __esm({
       hostShare: (v) => optInt(v),
       minJobs: (v) => optInt(v)
     };
-    TOOL_PROOF_FIELDS = /* @__PURE__ */ new Set(["run.maxCostUsd", "run.models"]);
+    TOOL_PROOF_FIELDS = /* @__PURE__ */ new Set(["run.maxCostUsd", "run.models", "run.mcp"]);
     PRICING = { listPricedModels, getPricedModel, isZeroRated, reprice, piAiVersion };
     INSIGHTS_USAGE = "usage: /dispatch insights [7d|30d|mtd] [--no-open] [--full-paths] | /dispatch insights whatif <provider/model> --flow <flow>";
     SPLIT_REFUSALS2 = INSIGHTS_SPLIT_REFUSALS;