@fitchmultz/pi-mcp-adapter 6.0.0 → 7.1.0

package/dist/config.js

@@ -1,7 +1,9 @@
 // config.ts - Config loading with import support
-import { existsSync, readFileSync, writeFileSync, mkdirSync, realpathSync, renameSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync, mkdirSync, realpathSync, renameSync, statSync, chmodSync } from "node:fs";
+import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { isDeepStrictEqual } from "node:util";
 import { parse as parseToml } from "smol-toml";
 import stripJsonComments from "strip-json-comments";
 import { getAdapterPath } from "./agent-dir.js";
@@ -367,6 +369,14 @@ function mergeServerMaps(base, next) {
                 delete baseEntry.oauth;
             }
         }
+        // Stdio env belongs to the program that received it, not just the server name.
+        if (existing?.command && ((definition.command !== undefined && definition.command !== existing.command)
+            || (definition.args !== undefined && !isDeepStrictEqual(definition.args, existing.args ?? []))
+            || (definition.cwd !== undefined && definition.cwd !== existing.cwd))) {
+            if (baseEntry === existing)
+                baseEntry = { ...existing };
+            delete baseEntry.env;
+        }
         merged[name] = { ...baseEntry, ...definition };
     }
     return merged;
@@ -533,8 +543,10 @@ function mergeOpenCodeConfigs(base, next) {
                         delete safeBase.cwd;
                     }
                 }
+                if (Object.hasOwn(override, "cwd") && override.cwd !== safeBase.cwd)
+                    delete safeBase.environment;
                 const mergedEntry = { ...safeBase, ...override };
-                for (const field of ["environment", "headers", "oauth"]) {
+                for (const field of ["headers", "oauth"]) {
                     const baseField = safeBase[field];
                     const nextField = override[field];
                     if (baseField && typeof baseField === "object" && !Array.isArray(baseField)
@@ -714,24 +726,37 @@ function buildConfigWritePreview(filePath, nextRaw) {
 function readRawConfigObject(filePath) {
     if (!existsSync(filePath))
         return {};
+    let raw;
     try {
-        const raw = parseJsonConfig(readFileSync(filePath, "utf-8"));
-        return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+        raw = parseJsonConfig(readFileSync(filePath, "utf-8"));
     }
-    catch {
-        return {};
+    catch (error) {
+        throw new Error(`Cannot read MCP config at ${filePath}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new Error(`Invalid MCP config at ${filePath}: expected an object`);
     }
+    return raw;
 }
 function writeRawConfigObject(filePath, raw) {
     mkdirSync(dirname(filePath), { recursive: true });
-    const tmpPath = `${filePath}.${process.pid}.tmp`;
-    writeFileSync(tmpPath, `${JSON.stringify(raw, null, 2)}\n`, "utf-8");
+    const existingMode = existsSync(filePath) ? statSync(filePath).mode & 0o7777 : undefined;
+    const tmpPath = `${filePath}.${randomUUID()}.tmp`;
+    writeFileSync(tmpPath, `${JSON.stringify(raw, null, 2)}\n`, {
+        encoding: "utf-8",
+        mode: existingMode ?? 0o666,
+        flag: "wx",
+    });
+    if (existingMode !== undefined)
+        chmodSync(tmpPath, existingMode);
     renameSync(tmpPath, filePath);
 }
-function getServersObject(raw) {
-    const existing = raw.mcpServers ?? raw["mcp-servers"] ?? {};
+function getServersObject(raw, filePath) {
+    const existing = raw.mcpServers !== undefined ? raw.mcpServers
+        : raw["mcp-servers"] !== undefined ? raw["mcp-servers"]
+            : {};
     if (!existing || typeof existing !== "object" || Array.isArray(existing)) {
-        return {};
+        throw new Error(`Invalid MCP config at ${filePath}: mcpServers must be an object`);
     }
     return existing;
 }
@@ -886,7 +911,7 @@ export function previewCompatibilityImports(importKinds, overridePath) {
     const currentImports = Array.isArray(raw.imports) ? raw.imports.filter((value) => typeof value === "string") : [];
     const merged = [...new Set([...currentImports, ...importKinds])];
     const nextRaw = { ...raw, imports: merged };
-    setServersObject(nextRaw, getServersObject(nextRaw));
+    setServersObject(nextRaw, getServersObject(nextRaw, targetPath));
     return buildConfigWritePreview(targetPath, nextRaw);
 }
 export function ensureCompatibilityImports(importKinds, overridePath) {
@@ -899,7 +924,7 @@ export function ensureCompatibilityImports(importKinds, overridePath) {
         return { path: targetPath, added: [] };
     }
     raw.imports = merged;
-    const servers = getServersObject(raw);
+    const servers = getServersObject(raw, targetPath);
     setServersObject(raw, servers);
     writeRawConfigObject(targetPath, raw);
     return { path: targetPath, added };
@@ -923,14 +948,14 @@ export function writeStarterProjectConfig(cwd = process.cwd()) {
 export function previewSharedServerEntry(filePath, serverName, entry) {
     const raw = readRawConfigObject(filePath);
     const nextRaw = { ...raw };
-    const servers = getServersObject(nextRaw);
+    const servers = getServersObject(nextRaw, filePath);
     servers[serverName] = entry;
     setServersObject(nextRaw, servers);
     return buildConfigWritePreview(filePath, nextRaw);
 }
 export function writeSharedServerEntry(filePath, serverName, entry) {
     const raw = readRawConfigObject(filePath);
-    const servers = getServersObject(raw);
+    const servers = getServersObject(raw, filePath);
     servers[serverName] = entry;
     setServersObject(raw, servers);
     writeRawConfigObject(filePath, raw);
@@ -991,7 +1016,7 @@ export function writeDirectToolsConfig(changes, provenance) {
     }
     for (const [filePath, entries] of byPath) {
         const raw = readRawConfigObject(filePath);
-        const servers = getServersObject(raw);
+        const servers = getServersObject(raw, filePath);
         for (const { name, value } of entries) {
             // Keep inherited connection details in their source file.
             servers[name] = { ...servers[name], directTools: value };

package/dist/direct-tools.js

@@ -15,7 +15,7 @@ export function directToolSelection(config, serverName, envOverride) {
 export function buildProxyDescription(config) {
     const servers = Object.entries(config.mcpServers).filter(([, definition]) => !isServerDisabled(definition)).map(([name]) => name).sort();
     return [
-        "MCP gateway. Use mcp_search to discover and load typed tools; mcp_script for multi-call composition. Native Pi tools are called directly.",
+        'MCP gateway. Use mcp_search to discover typed tools; enable mcp_script with mcp_search({ enable: ["script"] }) for multi-call composition. Native Pi tools are called directly.',
         `Configured servers: ${servers.join(", ") || "none"}. Catalog discovery is lazy.`,
         "Actions: status; list/search/describe; call (tool,args,server?); connect (server); instructions (server); resources (server); read-resource (server,uri); read-result (ref,path?,fields?,offset?,limit?); auth-start/auth-complete (server,args?); ui-messages.",
         "Use call when a discovered direct tool is unavailable in this host. read-result reads a retained response without repeating the remote operation.",

package/dist/gateway-arguments.d.ts

@@ -15,7 +15,7 @@ export type GatewayArguments = {
     fields?: string[];
 };
 export declare const gatewayParameters: Type.TObject<{
-    action: Type.TUnsafe<"status" | "resources" | "connect" | "search" | "list" | "instructions" | "call" | "auth-start" | "auth-complete" | "describe" | "read-resource" | "read-result" | "ui-messages">;
+    action: Type.TUnsafe<"auth-complete" | "auth-start" | "call" | "connect" | "describe" | "instructions" | "list" | "read-resource" | "read-result" | "resources" | "search" | "status" | "ui-messages">;
     server: Type.TOptional<Type.TString>;
     tool: Type.TOptional<Type.TString>;
     args: Type.TOptional<Type.TObject<{}>>;

package/dist/index.js

@@ -19,7 +19,7 @@ import { createToolLoader, supportsNativeAsync } from "./tool-loader.js";
 import { gatewayParameters, prepareGatewayArguments } from "./gateway-arguments.js";
 import { executeResourceList, executeResourceRead } from "./resource-tools.js";
 import { guardMcpOutput, guardedMcpDetails, readMcpResult, resolveMcpOutputGuardOptions } from "./mcp-output-guard.js";
-import { abortable } from "./abort.js";
+import { abortable, throwIfAborted } from "./abort.js";
 import { onSessionCheckpoint, prepareMcpCheckpoint } from "./checkpoint.js";
 export { MCP_STATUS_EVENT, MCP_STATUS_SNAPSHOT_VERSION, } from "./types.js";
 const INIT_WAIT_TIMEOUT_MS = 30_000;
@@ -90,29 +90,15 @@ function installMcpAdapter(pi, options) {
         ? cloneMcpConfig(sessionConfig)
         : { mcpServers: {} };
     const earlyCache = null;
+    let currentConfig = earlyConfig;
     const envRaw = process.env.MCP_DIRECT_TOOLS;
     const envDirectToolOverride = envRaw?.split(",").map(s => s.trim()).filter(Boolean);
     const toolLoader = createToolLoader(pi, () => state, () => initPromise, beforeExecute);
-    const deactivatedTools = new Set();
     let runtimeCwd;
     let nativeAsyncSupported = false;
     let proxyToolRegistered = false;
     let proxyToolDescription = null;
     let directToolsFrozen = false;
-    function deactivateTools(toolNames) {
-        if (toolNames.length === 0)
-            return;
-        const remove = new Set(toolNames);
-        const activeTools = pi.getActiveTools();
-        for (const toolName of toolNames) {
-            if (activeTools.includes(toolName))
-                deactivatedTools.add(toolName);
-        }
-        const nextActiveTools = activeTools.filter((name) => !remove.has(name));
-        if (nextActiveTools.length !== activeTools.length) {
-            pi.setActiveTools(nextActiveTools);
-        }
-    }
     function applyDirectToolConfigChanges(changes) {
         if (!state)
             return;
@@ -124,12 +110,9 @@ function installMcpAdapter(pi, options) {
         }
     }
     function syncToolSurface(ctx) {
-        const config = state?.config ?? earlyConfig;
+        const config = state?.config ?? currentConfig;
         const cache = loadMetadataCache(state?.metadataCacheEnabled ?? false);
-        toolLoader.sync(config, cache, envRaw === "__none__" ? null : envDirectToolOverride, nativeAsyncSupported, specs => {
-            syncProxyTool(config, cache, specs);
-            syncScriptTool(config);
-        });
+        toolLoader.sync(config, cache, envRaw === "__none__" ? null : envDirectToolOverride, nativeAsyncSupported, specs => syncGateways(config, cache, specs));
     }
     const registeredPromptCommands = new Set();
     function registerPromptCommands(specs) {
@@ -260,15 +243,13 @@ function installMcpAdapter(pi, options) {
         if (options.transformConfig) {
             runtimeConfig = cloneMcpConfig(options.transformConfig(cloneMcpConfig(runtimeConfig), ctx));
         }
+        currentConfig = runtimeConfig;
         const metadataCacheEnabled = ctx.isProjectTrusted()
             || !isPathInsideProject(getMetadataCachePath(), ctx.cwd);
         toolLoader.restore(ctx);
         registerPromptCommands(resolveCachedPrompts(runtimeConfig, metadataCacheEnabled));
         const runtimeCache = loadMetadataCache(metadataCacheEnabled);
-        toolLoader.sync(runtimeConfig, runtimeCache, envRaw === "__none__" ? null : envDirectToolOverride, nativeAsyncSupported, specs => {
-            syncProxyTool(runtimeConfig, runtimeCache, specs);
-            syncScriptTool(runtimeConfig);
-        });
+        toolLoader.sync(runtimeConfig, runtimeCache, envRaw === "__none__" ? null : envDirectToolOverride, nativeAsyncSupported, specs => syncGateways(runtimeConfig, runtimeCache, specs));
         const initialization = startInitialization(ctx, owner, oauthRuntime, runtimeConfig, generation);
         if (envRaw !== undefined && envRaw !== "__none__") {
             const missingEnvDirectTools = getMissingConfiguredDirectToolServers(runtimeConfig, runtimeCache, envDirectToolOverride);
@@ -538,7 +519,17 @@ function installMcpAdapter(pi, options) {
         owner?.throwIfInactive();
         return state ?? { content: [{ type: "text", text: "MCP not initialized" }], details: { error: "not_initialized" } };
     }
+    const unavailableFeatures = (enable = [], tools) => enable.filter(feature => !tools.some(tool => tool.name === (feature === "gateway" ? "mcp" : "mcp_script") && !tool.namespace));
     async function searchAndLoad(params, signal, ctx) {
+        throwIfAborted(signal);
+        if (params.query === undefined && !params.enable?.length)
+            throw new Error("Provide query or enable.");
+        // Loading front doors does not require initialization or connect to a server.
+        if (params.query === undefined) {
+            const tools = toolLoader.activate([], params.enable);
+            const unavailable = unavailableFeatures(params.enable, tools);
+            return { content: [{ type: "text", text: `Loaded for the next request: ${JSON.stringify(tools)}${unavailable.length ? `. Unavailable under configuration or host policy: ${unavailable.join(", ")}` : ""}` }], details: { loaded: tools, unavailable }, tools };
+        }
         const ready = await getToolState(signal);
         if ("content" in ready)
             return { ...ready, tools: [] };
@@ -551,23 +542,27 @@ function installMcpAdapter(pi, options) {
         const matches = params.query.trim() ? rankToolMatches(ready, params.query, params.server)
             : params.server ? (ready.toolMetadata.get(params.server) ?? []).filter(tool => !tool.resourceUri).map(tool => ({ server: params.server, tool })).sort((a, b) => a.tool.name.localeCompare(b.tool.name)) : [];
         const page = paginate(matches, params.offset ?? 0, params.limit ?? 5);
-        const tools = toolLoader.activate(page.items);
-        const result = executeSearch(ready, params.query, params.server, tools.length < page.items.length, params.limit ?? 5, params.offset);
+        const tools = toolLoader.activate(page.items, params.enable);
+        const unavailable = unavailableFeatures(params.enable, tools);
+        const typedCount = tools.filter(tool => tool.namespace || (tool.name !== "mcp" && tool.name !== "mcp_script")).length;
+        const result = executeSearch(ready, params.query, params.server, typedCount < page.items.length, params.limit ?? 5, params.offset, "mcp_search");
         const guarded = await guardMcpOutput([
             ...result.content,
-            { type: "text", text: tools.length ? `Loaded for the next request: ${JSON.stringify(tools)}` : "No direct tools loaded. Use mcp action call or tools.call in mcp_script with the returned exact names." },
+            { type: "text", text: tools.length ? `Loaded for the next request: ${JSON.stringify(tools)}` : 'No direct tools loaded. Enable gateway or script with mcp_search({ enable: ["gateway"] }) or mcp_search({ enable: ["script"] }), then use mcp action call or tools.call with the returned exact names.' },
+            ...(unavailable.length ? [{ type: "text", text: `Unavailable under configuration or host policy: ${unavailable.join(", ")}` }] : []),
         ], resolveMcpOutputGuardOptions(ready.config.settings, ready.outputDirectory));
-        return { content: guarded.content, details: { ...result.details, ...guardedMcpDetails(guarded), loaded: tools }, tools };
+        return { content: guarded.content, details: { ...result.details, ...guardedMcpDetails(guarded), loaded: tools, ...(unavailable.length ? { unavailable } : {}) }, tools };
     }
     const searchDefinition = {
         name: "mcp_search", label: "MCP Search",
-        description: "Discover MCP tools by name, description, and parameter guidance, and load matching tools with their complete schemas for the next request. Start with a specific task query. Specify server to discover an uncached server; an empty query with server browses it. Results report incomplete catalog coverage. Resources use mcp action resources/read-resource.",
+        description: "Discover and load typed MCP tools for the next request. Use query; server discovers an uncached server (empty query browses it). Results report incomplete coverage. Or enable gateway for mcp status/list/search/describe/call/connect/instructions, resources/read-resource, read-result, auth-start/auth-complete and ui-messages; enable script for JavaScript composition, resources and saved-result readback. Enable alone performs no integration action. Loaded schemas stay available in this session/branch.",
         parameters: Type.Object({
-            query: Type.String(),
+            query: Type.Optional(Type.String()),
+            enable: Type.Optional(Type.Array(Type.Union([Type.Literal("gateway"), Type.Literal("script")]), { minItems: 1, uniqueItems: true })),
             server: Type.Optional(Type.String()),
             limit: Type.Optional(Type.Integer({ minimum: 1, maximum: MAX_PAGE_SIZE, description: "Tools to load (default 5)." })),
             offset: Type.Optional(Type.Integer({ minimum: 0 })),
-        }),
+        }, { anyOf: [{ required: ["query"] }, { required: ["enable"] }] }),
         renderResult: renderMcpToolResult,
         async execute(toolCallId, params, signal, _onUpdate, ctx) {
             if (beforeExecute) {
@@ -587,7 +582,7 @@ function installMcpAdapter(pi, options) {
     function registerScriptTool() {
         if (scriptToolRegistered)
             return;
-        pi.registerTool({
+        toolLoader.registerFeature("script", {
             ...(beforeExecute ? { executionMode: "sequential" } : {}),
             name: "mcp_script",
             label: "MCP Script",
@@ -609,21 +604,8 @@ function installMcpAdapter(pi, options) {
         });
         scriptToolRegistered = true;
     }
-    function syncScriptTool(config) {
-        if (config.settings?.scriptMode === false) {
-            if (scriptToolRegistered)
-                deactivateTools(["mcp_script"]);
-            return;
-        }
-        registerScriptTool();
-        if (deactivatedTools.delete("mcp_script")) {
-            const activeTools = pi.getActiveTools();
-            if (!activeTools.includes("mcp_script"))
-                pi.setActiveTools([...activeTools, "mcp_script"]);
-        }
-    }
     function registerProxyTool(description) {
-        pi.registerTool({
+        toolLoader.registerFeature("gateway", {
             ...(beforeExecute ? { executionMode: "sequential" } : {}),
             name: "mcp", label: "MCP", description,
             promptSnippet: "MCP server operations, resources, saved result readback, and fallback tool calls",
@@ -684,7 +666,10 @@ function installMcpAdapter(pi, options) {
         proxyToolRegistered = true;
         proxyToolDescription = description;
     }
-    function syncProxyTool(config, cache, directSpecs) {
+    function syncGateways(config, cache, directSpecs) {
+        const policy = {};
+        if (config.settings?.scriptMode !== false)
+            policy.script = {};
         const missingConfiguredDirectToolServers = getMissingConfiguredDirectToolServers(config, cache, envRaw === undefined || envRaw === "__none__" ? undefined : envDirectToolOverride);
         const hasPinnedResources = envRaw !== "__none__" && Object.entries(config.mcpServers).some(([server, definition]) => {
             if (definition.disabled === true)
@@ -706,21 +691,15 @@ function installMcpAdapter(pi, options) {
             if (!proxyToolRegistered || proxyToolDescription !== description) {
                 registerProxyTool(description);
             }
-            if (deactivatedTools.delete("mcp")) {
-                const activeTools = pi.getActiveTools();
-                if (!activeTools.includes("mcp")) {
-                    pi.setActiveTools([...activeTools, "mcp"]);
-                }
-            }
-            return;
+            policy.gateway = { eager: hasPinnedResources };
         }
-        if (proxyToolRegistered)
-            deactivateTools(["mcp"]);
+        if (policy.script)
+            registerScriptTool();
+        return policy;
     }
     // A transform needs the session context before any configured tool surface is registered.
     if (!options.transformConfig) {
-        syncProxyTool(earlyConfig, earlyCache, []);
-        syncScriptTool(earlyConfig);
+        syncGateways(earlyConfig, earlyCache, []);
     }
 }
 export function createMcpAdapter(options = {}) {

package/dist/lifecycle.d.ts

@@ -4,8 +4,6 @@ import { hasPendingAuth } from "./mcp-auth-flow.ts";
 export type ReconnectCallback = (serverName: string) => void;
 export type ReconnectFailureCallback = (serverName: string, error: unknown) => void;
 export declare class McpLifecycleManager {
-    private readonly manager;
-    private readonly hasPendingAuthForServer;
     private keepAliveServers;
     private allServers;
     private serverSettings;
@@ -23,6 +21,8 @@ export declare class McpLifecycleManager {
     pauseForCheckpoint(): () => void;
     private healthSignal;
     private removeHealthAbortListener;
+    private readonly manager;
+    private readonly hasPendingAuthForServer;
     constructor(manager: McpServerManager, hasPendingAuthForServer?: typeof hasPendingAuth);
     setReconnectCallback(callback: ReconnectCallback): void;
     setReconnectFailureCallback(callback: ReconnectFailureCallback): void;

package/dist/lifecycle.js

@@ -3,8 +3,6 @@ import { hasPendingAuth } from "./mcp-auth-flow.js";
 import { logger } from "./logger.js";
 import { formatTerminalError, sanitizeTerminalText } from "./utils.js";
 export class McpLifecycleManager {
-    manager;
-    hasPendingAuthForServer;
     keepAliveServers = new Map();
     allServers = new Map();
     serverSettings = new Map();
@@ -31,6 +29,8 @@ export class McpLifecycleManager {
     }
     healthSignal;
     removeHealthAbortListener;
+    manager;
+    hasPendingAuthForServer;
     constructor(manager, hasPendingAuthForServer = hasPendingAuth) {
         this.manager = manager;
         this.hasPendingAuthForServer = hasPendingAuthForServer;

package/dist/mcp-auth-flow.js

@@ -9,7 +9,7 @@ import { McpOAuthProvider, issuersMatch, loopbackRedirectsMatch, validateOAuthCl
 import { ensureCallbackServer, waitForCallback, cancelPendingCallback, stopCallbackServer, releaseCallbackServer, takeCallbackResult, } from "./mcp-callback-server.js";
 import { getAuthForUrl, clearAllCredentials, clearClientInfo, clearTokens, clearCodeVerifier, getOAuthState, clearOAuthState, getAuthBaseDir, } from "./mcp-auth.js";
 import { isServerDisabled, isNonInteractiveOAuth, validateServerProtocolConfig } from "./types.js";
-import { formatTerminalError, interpolateEnvRecord, interpolateEnvVars, normalizeRequestTimeoutMs } from "./utils.js";
+import { ADAPTER_VERSION, formatTerminalError, interpolateEnvRecord, interpolateEnvVars, normalizeRequestTimeoutMs } from "./utils.js";
 import { abortable, throwIfAborted } from "./abort.js";
 import { combineAbortSignals, isAbortError } from "./runtime-owner.js";
 function applyConfiguredScope(discovery, config) {
@@ -255,7 +255,7 @@ async function probeAuthDiscovery(serverUrl, definition, signal) {
     const timeout = normalizeRequestTimeoutMs(definition?.requestTimeoutMs) ?? 5000;
     const discoverySignal = combineAbortSignals(signal, AbortSignal.timeout(Math.ceil(timeout)));
     let discovery = {};
-    const client = new Client({ name: "pi-mcp-auth-discovery", version: "4.3.1" }, {
+    const client = new Client({ name: "pi-mcp-auth-discovery", version: ADAPTER_VERSION }, {
         versionNegotiation: { mode: definition?.protocolVersion ?? "auto" },
         ...(isNonInteractiveOAuth(definition?.oauth)
             ? { capabilities: { extensions: { [definition?.oauth && definition.oauth.crossAppAccess

package/dist/mcp-auth.d.ts

@@ -51,8 +51,8 @@ export interface AuthStorageOptions {
     baseDir?: string;
 }
 export declare class OAuthCredentialStoreError extends Error {
-    readonly operation: 'read' | 'write' | 'remove';
     readonly code = "OAUTH_CREDENTIAL_STORE_UNAVAILABLE";
+    readonly operation: 'read' | 'write' | 'remove';
     constructor(message: string, operation: 'read' | 'write' | 'remove', cause: unknown);
 }
 export type OAuthCredentialStatus = {

package/dist/mcp-auth.js

@@ -15,8 +15,8 @@ import { createRequire } from 'module';
 import { readFileSync, existsSync, rmSync } from 'fs';
 import { dirname, join } from 'path';
 import { fileURLToPath } from 'url';
-import { getAdapterPath, getAgentPath } from "./agent-dir.js";
-import { resolveConfiguredOAuthDir } from "./config.js";
+import { getAdapterPath, getAgentPath } from './agent-dir.js';
+import { resolveConfiguredOAuthDir } from './config.js';
 const require = createRequire(import.meta.url);
 const AUTH_SECRET_SERVICE = 'fitch-mcp-adapter.oauth';
 const LEGACY_AUTH_SECRET_SERVICE = 'pi-mcp-adapter.oauth';
@@ -30,8 +30,8 @@ const TEST_LINUX_KEYRING_RECOVERY_ENV = 'PI_MCP_ADAPTER_TEST_LINUX_KEYRING_RECOV
 const KEYRING_RECOVERY_TIMEOUT_MS = 10_000;
 const AUTH_CHUNK_MANIFEST_KEY = '__piMcpAdapterOAuthChunked';
 export class OAuthCredentialStoreError extends Error {
-    operation;
     code = 'OAUTH_CREDENTIAL_STORE_UNAVAILABLE';
+    operation;
     constructor(message, operation, cause) {
         super(isAndroidKeyringLoadFailure(cause)
             ? `${message}. Android/Termux: @napi-rs/keyring could not load a native binding. Persistent OAuth requires a supported platform with an OS credential store; no plaintext fallback is used.`

package/dist/mcp-code.d.ts

@@ -6,6 +6,12 @@ export declare const runMcpScript: typeof runMcpScriptOperation;
 declare function runMcpScriptOperation(state: McpExtensionState, code: string, timeoutMs?: number | null, getPiTools?: () => ToolInfo[], signal?: AbortSignal, toolCallId?: string, beforeDispatch?: (signal: AbortSignal | undefined, operation: McpOperationContext) => Promise<void>): Promise<{
     content: ContentBlock[];
     details: {
+        mode: string;
+        resultRefs?: string[];
+        error?: "aborted" | "call_capture_failed" | "script_error" | "timeout";
+        message?: string | undefined;
+        timeoutMs: number | null;
+        recovery?: {} | null;
         calls?: ({
             operation: "call";
             path: string;
@@ -41,12 +47,6 @@ declare function runMcpScriptOperation(state: McpExtensionState, code: string, t
             error: string;
             durationMs: number;
         })[];
-        recovery?: {} | null;
-        timeoutMs: number | null;
-        error?: "aborted" | "timeout" | "call_capture_failed" | "script_error";
-        message?: string | undefined;
-        resultRefs?: string[];
-        mode: string;
     };
 }>;
 export {};

package/dist/mcp-code.js

@@ -122,7 +122,7 @@ async function runMcpScriptOperation(state, code, timeoutMs = DEFAULT_MCP_SCRIPT
             ? Math.max(0, Date.now() - startedAt)
             : operation.durationMs,
     }));
-    let callsSnapshot;
+    const pendingOperations = new Set();
     const resultRefs = new Set();
     const payloadNotices = new Set();
     const recordCall = async (path, dispatch) => {
@@ -149,11 +149,11 @@ async function runMcpScriptOperation(state, code, timeoutMs = DEFAULT_MCP_SCRIPT
                     : textFromContent(result.content);
             calls[index] = {
                 operation: "call", path, ok: false, error: errorCode, durationMs: Date.now() - startedAt, startedAt,
-                ...(errorCode === "ambiguous_outcome" ? { recovery: details.recovery } : {}),
+                ...(details.recovery !== undefined ? { recovery: details.recovery } : {}),
             };
             if (errorCode === "call_capture_failed")
                 throw new McpScriptCaptureError(details.recovery, message);
-            if (errorCode === "ambiguous_outcome")
+            if (details.recovery !== undefined)
                 output.push({ type: "text", text: message });
             return {
                 ok: false,
@@ -301,7 +301,7 @@ async function runMcpScriptOperation(state, code, timeoutMs = DEFAULT_MCP_SCRIPT
                     reject(new Error(message.message));
                     return;
                 }
-                void (async () => {
+                const operation = (async () => {
                     let envelope;
                     if (message.type === "call") {
                         envelope = await callTool(message.id, message.path, message.args, message.server);
@@ -332,7 +332,9 @@ async function runMcpScriptOperation(state, code, timeoutMs = DEFAULT_MCP_SCRIPT
                     }
                     const response = { type: "result", id: message.id, envelope };
                     activeWorker.postMessage(response);
-                })().catch(reject);
+                })();
+                pendingOperations.add(operation);
+                void operation.catch(reject).finally(() => pendingOperations.delete(operation));
             });
             activeWorker.once("error", reject);
             activeWorker.once("exit", (code) => {
@@ -345,7 +347,6 @@ async function runMcpScriptOperation(state, code, timeoutMs = DEFAULT_MCP_SCRIPT
                 return;
             const timeoutError = new McpScriptTimeoutError(resolvedTimeoutMs);
             timer = setTimeout(() => {
-                callsSnapshot = snapshotCalls();
                 timeoutController.abort(timeoutError);
                 void activeWorker.terminate();
                 reject(timeoutError);
@@ -354,7 +355,6 @@ async function runMcpScriptOperation(state, code, timeoutMs = DEFAULT_MCP_SCRIPT
         const aborted = externalSignal
             ? new Promise((_resolve, reject) => {
                 const onAbort = () => {
-                    callsSnapshot = snapshotCalls();
                     void activeWorker.terminate();
                     reject(abortReasonError(externalSignal.reason));
                 };
@@ -387,14 +387,15 @@ async function runMcpScriptOperation(state, code, timeoutMs = DEFAULT_MCP_SCRIPT
     finally {
         clearTimeout(timer);
         removeAbortListener();
-        // "incomplete" means the call had not settled when the script finished
-        // (deadline, abort, or early return). Snapshot before aborting stragglers.
-        callsSnapshot ??= snapshotCalls();
+        worker?.removeAllListeners("message");
         // A script may finish without awaiting every call; abort leftovers so
         // parent-side dispatches do not outlive the script.
         timeoutController.abort(new Error("mcp_script finished"));
+        // Let cancelled dispatches report whether an outcome is known before taking the trace.
+        await Promise.allSettled(pendingOperations);
         await worker?.terminate();
     }
+    const callsSnapshot = snapshotCalls();
     // Snapshot before the asynchronous output guard; the terminated worker can no longer emit.
     const guarded = await guardMcpOutput([...(output.length > 0 ? output : [{ type: "text", text: "(no output)" }]), ...[...payloadNotices].map(text => ({ type: "text", text })), ...[...resultRefs].map(ref => ({ type: "text", text: formatMcpResultReference(ref) }))], resolveMcpOutputGuardOptions(state.config.settings, state.outputDirectory));
     return {

package/dist/mcp-oauth-provider.d.ts

@@ -49,11 +49,6 @@ export interface McpOAuthCallbacks {
  * Implements the OAuthClientProvider interface from the MCP SDK.
  */
 export declare class McpOAuthProvider implements OAuthClientProvider {
-    private serverName;
-    private serverUrl;
-    private config;
-    private callbacks;
-    private storageOptions;
     private readonly redirectUrlSnapshot;
     readonly clientMetadataUrl?: string;
     private readonly controller;
@@ -66,6 +61,11 @@ export declare class McpOAuthProvider implements OAuthClientProvider {
     private flowDiscoveryState;
     private flowIssuerMismatch;
     private flowState;
+    private serverName;
+    private serverUrl;
+    private config;
+    private callbacks;
+    private storageOptions;
     constructor(serverName: string, serverUrl: string, config: McpOAuthConfig, callbacks: McpOAuthCallbacks, storageOptions?: AuthStorageOptions, runtimeSignal?: AbortSignal, initialState?: string);
     private get isNonInteractive();
     private get discoveredIssuer();

package/dist/mcp-oauth-provider.js

@@ -152,11 +152,6 @@ function addAuthorizationParams(authorizationUrl, params) {
  * Implements the OAuthClientProvider interface from the MCP SDK.
  */
 export class McpOAuthProvider {
-    serverName;
-    serverUrl;
-    config;
-    callbacks;
-    storageOptions;
     redirectUrlSnapshot;
     clientMetadataUrl;
     controller = new AbortController();
@@ -169,6 +164,11 @@ export class McpOAuthProvider {
     flowDiscoveryState;
     flowIssuerMismatch = false;
     flowState;
+    serverName;
+    serverUrl;
+    config;
+    callbacks;
+    storageOptions;
     constructor(serverName, serverUrl, config, callbacks, storageOptions = {}, runtimeSignal, initialState) {
         this.serverName = serverName;
         this.serverUrl = serverUrl;

package/dist/mcp-output-guard.d.ts

@@ -94,11 +94,11 @@ export declare function readMcpResult(input: ReadMcpResultInput, options?: McpOu
         text: string;
     }[];
     details: {
-        path?: string;
         ref: string;
         offset: number;
         nextOffset: number | null;
         totalCharacters: number;
+        path?: string;
         error?: never;
         message?: never;
     };

package/dist/mcp-output-guard.js

@@ -223,7 +223,7 @@ export function formatMcpPayloadFile(file) {
     return `[MCP ${file.kind === "audio" ? "audio" : "binary resource"}${file.uri ? ` (${file.uri})` : ""}: ${file.mimeType ?? "unknown MIME type"}; not rendered. ${file.path ? `Saved file: ${file.path}` : `Could not save: ${file.error}`}]`;
 }
 export function formatMcpResultReference(ref) {
-    return `[MCP result saved: ${JSON.stringify(ref)}. Inspect without repeating the call using mcp action "read-result" or tools.readResult with this ref. Optionally select a JSON Pointer with path.]`;
+    return `[MCP result saved: ${JSON.stringify(ref)}. Inspect without repeating the call using mcp action "read-result" or tools.readResult with this ref. If inactive, first mcp_search({ enable: ["gateway"] }) or mcp_search({ enable: ["script"] }). Optionally select a JSON Pointer with path.]`;
 }
 function summarizeMcpResult(result, rawBytes, artifact) {
     const { path: fullResultPath, error: resultWriteError } = artifact;

package/dist/mcp-panel.d.ts

@@ -2,8 +2,6 @@ import { type PanelKeybindings } from "./panel-keys.ts";
 import type { McpConfig, McpPanelCallbacks, McpPanelResult, ServerProvenance } from "./types.ts";
 import { type MetadataCache } from "./metadata-cache.ts";
 declare class McpPanel {
-    private callbacks;
-    private done;
     private noticeLines;
     private prefix;
     private servers;
@@ -25,6 +23,8 @@ declare class McpPanel {
     private keys;
     private static readonly MAX_VISIBLE;
     private static readonly INACTIVITY_MS;
+    private callbacks;
+    private done;
     constructor(config: McpConfig, cache: MetadataCache | null, provenance: Map<string, ServerProvenance>, callbacks: McpPanelCallbacks, tui: {
         requestRender(): void;
     }, done: (result: McpPanelResult) => void, options?: {