@gajae-code/coding-agent 0.11.4 → 0.11.6

package/src/modes/runtime-init.ts

@@ -301,15 +301,29 @@ export async function initializeExtensions(session: AgentSession, options: Initi
 						try {
 							return {
 								handoff: await session.handoff(
-									typeof input.instructions === "string" ? input.instructions : undefined,
+									typeof input.target === "string"
+										? input.target
+										: typeof input.instructions === "string"
+											? input.instructions
+											: undefined,
 								),
 							};
 						} catch (error) {
+							const typed = error as { code?: unknown; handoffDocument?: unknown };
+							const handoffDocument =
+								typeof typed?.handoffDocument === "string"
+									? { handoffDocument: typed.handoffDocument }
+									: undefined;
+							// Preserve a safe typed code (e.g. transient `busy`) so clients keep
+							// correct retry/backoff semantics; only synthesize invalid_request for
+							// otherwise-untyped failures.
+							const code = typed?.code === "busy" ? "busy" : "invalid_request";
 							throw Object.assign(
 								new Error(
 									error instanceof Error ? error.message : "Handoff is unavailable for the current state.",
 								),
-								{ code: "invalid_request" },
+								{ code },
+								handoffDocument,
 							);
 						}
 					case "session.export_html":

package/src/modes/shared/agent-wire/deep-interview-gate.ts

@@ -10,6 +10,11 @@
  * This is the pure mapping primitive used by SDK-native workflow gate emitters.
  */
 
+import { isDeepInterviewAskQuestion } from "../../../deep-interview/render-middleware";
+import {
+	assertDeepInterviewInputWithinLimit,
+	MAX_USER_RESPONSE_LENGTH,
+} from "../../../gjc-runtime/deep-interview-state";
 import type { OpenGateInput } from "./workflow-gate-broker";
 import {
 	type AskGateDeepInterviewState,
@@ -134,7 +139,17 @@ export function buildAskGateStageState(question: AskGateQuestion, labels: string
 /** Build the `workflow_gate` open-input for one ask question. */
 export function questionToGate(question: AskGateQuestion): OpenGateInput {
 	const labels = question.options.map(o => o.label);
-	const schema = buildAskGateAnswerSchema(question, labels);
+	const schema = buildAskGateAnswerSchema(
+		{
+			multi: question.multi,
+			allowEmpty: question.allowEmpty,
+			customMaxLength:
+				question.deepInterview || isDeepInterviewAskQuestion(question.question)
+					? MAX_USER_RESPONSE_LENGTH
+					: undefined,
+		},
+		labels,
+	);
 	return {
 		stage: question.workflowGate?.stage ?? "deep-interview",
 		kind: question.workflowGate?.kind ?? "question",
@@ -229,6 +244,12 @@ export function gateAnswerToResult(question: AskGateQuestion, answer: unknown):
 	if (other && (answer.custom === undefined || answer.custom.trim() === "")) {
 		throw new DeepInterviewGateError("missing_custom", "custom text is required when `other` is true");
 	}
+	if (
+		other &&
+		(question.deepInterview || isDeepInterviewAskQuestion(question.question)) &&
+		answer.custom !== undefined
+	)
+		assertDeepInterviewInputWithinLimit(answer.custom, MAX_USER_RESPONSE_LENGTH, "user_response");
 	return {
 		id: question.id,
 		question: question.question,
@@ -261,6 +282,15 @@ export function classifyAskGateDisposition(
 		multi: (state as Record<string, unknown>).multi === true,
 		allowEmpty: (state as Record<string, unknown>).allow_empty === true,
 	};
+	if (
+		(state as Record<string, unknown>).deep_interview_metadata === true &&
+		typeof (answer as Record<string, unknown>)?.custom === "string"
+	)
+		assertDeepInterviewInputWithinLimit(
+			(answer as Record<string, unknown>).custom as string,
+			MAX_USER_RESPONSE_LENGTH,
+			"user_response",
+		);
 	if (typeof answer === "object" && answer !== null && (answer as Record<string, unknown>).action === "clarify") {
 		gateAnswerToResult(question, answer);
 		return "resolve_without_commit";

package/src/modes/shared/agent-wire/workflow-gate-broker.ts

@@ -76,6 +76,13 @@ export interface NotificationGateResolutionOptions {
 	closeClaimInvalid(reason: string): void;
 }
 
+export class NotificationGatePolicyChangedError extends Error {
+	constructor() {
+		super("Notification policy changed while resolving the workflow gate");
+		this.name = "NotificationGatePolicyChangedError";
+	}
+}
+
 export interface AskSelectedAckRecoveryParticipant {
 	requestRecoveredAskSelectedAck(input: {
 		sessionId: string;
@@ -361,7 +368,8 @@ export class BrokerWorkflowGateEmitter implements WorkflowGateEmitter {
 								daemonDeadlineAt: Date.now() + 8_000,
 								hostTimeoutMs: 10_000,
 							});
-						} catch {
+						} catch (error) {
+							if (error instanceof NotificationGatePolicyChangedError) throw error;
 							outcome = { status: "unknown", reason: "host_timeout" };
 						}
 						this.#broker.updateAckPolicy(response.gate_id, {
@@ -378,6 +386,14 @@ export class BrokerWorkflowGateEmitter implements WorkflowGateEmitter {
 			else closeClaimInvalid(resolution.error?.code ?? "invalid_answer");
 			return resolution;
 		} catch (error) {
+			if (error instanceof NotificationGatePolicyChangedError) {
+				try {
+					closeClaimInvalid(error.message);
+				} finally {
+					this.quarantineGate(response.gate_id);
+				}
+				throw error;
+			}
 			closeClaimInvalid(error instanceof Error ? error.message : "invalid_answer");
 			this.#scheduleRecovery();
 			throw error;

package/src/modes/shared/agent-wire/workflow-gate-schema.ts

@@ -12,6 +12,7 @@
  * swapped in later without changing callers.
  */
 import { createHash } from "node:crypto";
+import { deepInterviewCharacterCount } from "../../../gjc-runtime/deep-interview-state";
 import type { JsonSchema, WorkflowGateValidationError } from "./workflow-gate-types";
 
 /** Keywords this wrapper understands. Any other keyword is rejected. */
@@ -238,7 +239,8 @@ function validateValue(schema: JsonSchema, value: unknown, path: string, errors:
 		if (!ok) errors.push({ path, keyword: "enum", message: "value not in enum", expected: schema.enum });
 	}
 	if (typeof value === "string") {
-		if (schema.minLength !== undefined && value.length < schema.minLength) {
+		const characterCount = deepInterviewCharacterCount(value);
+		if (schema.minLength !== undefined && characterCount < schema.minLength) {
 			errors.push({
 				path,
 				keyword: "minLength",
@@ -246,7 +248,7 @@ function validateValue(schema: JsonSchema, value: unknown, path: string, errors:
 				expected: schema.minLength,
 			});
 		}
-		if (schema.maxLength !== undefined && value.length > schema.maxLength) {
+		if (schema.maxLength !== undefined && characterCount > schema.maxLength) {
 			errors.push({
 				path,
 				keyword: "maxLength",

package/src/modes/shared/agent-wire/workflow-gate-types.ts

@@ -1,3 +1,5 @@
+import { deepInterviewCharacterCount } from "../../../gjc-runtime/deep-interview-state";
+
 /** Transport-neutral workflow gate contract used by SDK workflow coordination. */
 
 /** Lifecycle stages that emit machine-addressable SDK workflow gates. */
@@ -14,12 +16,28 @@ export type WorkflowGateKind = "question" | "approval" | "execution";
 /** "Other (type your own)" sentinel, mirroring the interactive ask tool. */
 export const GATE_OTHER_OPTION = "Other (type your own)";
 
+/**
+ * Structured adapter context queued at interview start. Non-behavioral:
+ * `confused_terms` and `references` MUST NOT alter the first question, are never
+ * inferred from vocabulary density, and referenced `url`/`excerpt` are inert
+ * strings that are never auto-fetched.
+ */
+export interface AskGateReference {
+	reference_id: string;
+	label: string;
+	origin: string;
+	url?: string;
+	excerpt?: string;
+}
+
 export interface AskGateDeepInterviewState {
 	round_id?: string;
 	round: number;
 	component: string;
 	dimension: string;
 	ambiguity: number;
+	confused_terms?: string[];
+	references?: AskGateReference[];
 }
 
 export interface AskGateStageStateInput {
@@ -34,10 +52,90 @@ export interface AskGateStageStateInput {
 export interface AskGateSchemaInput {
 	multi?: boolean;
 	allowEmpty?: boolean;
+	customMaxLength?: number;
 }
 
 function isBoundedAskGateString(value: unknown): value is string {
-	return typeof value === "string" && value.length > 0 && new TextEncoder().encode(value).byteLength <= 256;
+	return (
+		typeof value === "string" &&
+		value.length > 0 &&
+		deepInterviewCharacterCount(value) <= MAX_ASK_GATE_ADAPTER_STRING_LENGTH
+	);
+}
+
+/** Max characters for adapter metadata identifiers and confused terms. */
+const MAX_ASK_GATE_ADAPTER_STRING_LENGTH = 256;
+const MAX_ASK_GATE_DEEP_INTERVIEW_STRING_LENGTH = 128;
+/** Max characters for a longer inert reference string (url/excerpt); never fetched. */
+const MAX_ASK_GATE_LONG_STRING_LENGTH = 2048;
+const MAX_ASK_GATE_CONFUSED_TERMS = 32;
+const MAX_ASK_GATE_REFERENCES = 32;
+
+function isBoundedAskGateAdapterString(value: unknown): value is string {
+	return (
+		typeof value === "string" &&
+		value.length > 0 &&
+		deepInterviewCharacterCount(value) <= MAX_ASK_GATE_ADAPTER_STRING_LENGTH
+	);
+}
+
+function isBoundedAskGateDeepInterviewString(value: unknown): value is string {
+	return (
+		typeof value === "string" &&
+		value.length > 0 &&
+		deepInterviewCharacterCount(value) <= MAX_ASK_GATE_DEEP_INTERVIEW_STRING_LENGTH
+	);
+}
+
+function isBoundedAskGateLongString(value: unknown): value is string {
+	return (
+		typeof value === "string" &&
+		value.length > 0 &&
+		deepInterviewCharacterCount(value) <= MAX_ASK_GATE_LONG_STRING_LENGTH
+	);
+}
+
+function isDenseArray(value: unknown[]): boolean {
+	for (let index = 0; index < value.length; index++) if (!Object.hasOwn(value, index)) return false;
+	return true;
+}
+
+function isValidAskGateConfusedTerms(value: unknown): value is string[] {
+	return (
+		Array.isArray(value) &&
+		isDenseArray(value) &&
+		value.length <= MAX_ASK_GATE_CONFUSED_TERMS &&
+		value.every(isBoundedAskGateAdapterString)
+	);
+}
+
+function isValidAskGateReference(value: unknown): boolean {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const prototype = Object.getPrototypeOf(value);
+	if (prototype !== Object.prototype && prototype !== null) return false;
+	const ref = value as Record<string, unknown>;
+	const allowed = new Set(["reference_id", "label", "origin", "url", "excerpt"]);
+	if (Object.keys(ref).some(key => !allowed.has(key))) return false;
+	if (!Object.hasOwn(ref, "reference_id") || !Object.hasOwn(ref, "label") || !Object.hasOwn(ref, "origin"))
+		return false;
+	if (
+		!isBoundedAskGateAdapterString(ref.reference_id) ||
+		!isBoundedAskGateAdapterString(ref.label) ||
+		!isBoundedAskGateAdapterString(ref.origin)
+	)
+		return false;
+	if (ref.url !== undefined && !isBoundedAskGateLongString(ref.url)) return false;
+	if (ref.excerpt !== undefined && !isBoundedAskGateLongString(ref.excerpt)) return false;
+	return true;
+}
+
+function isValidAskGateReferences(value: unknown): boolean {
+	return (
+		Array.isArray(value) &&
+		isDenseArray(value) &&
+		value.length <= MAX_ASK_GATE_REFERENCES &&
+		value.every(isValidAskGateReference)
+	);
 }
 
 /** Rejects stage state that is not exactly compatible with the generic ask-gate producer. */
@@ -62,6 +160,8 @@ export function validateAskGateStageState(value: unknown): asserts value is Reco
 		"challenge_mode",
 		"ambiguity",
 		"topology_gate",
+		"confused_terms",
+		"references",
 	]);
 	if (Object.keys(state).some(key => !allowed.has(key))) throw new Error("ask gate stage_state has an unknown field");
 	if (
@@ -76,7 +176,10 @@ export function validateAskGateStageState(value: unknown): asserts value is Reco
 		throw new Error("ask gate stage_state has invalid required fields");
 	if (state.navigation_label !== undefined && state.navigation_label !== "Next" && state.navigation_label !== "Done")
 		throw new Error("ask gate stage_state has an invalid navigation label");
-	for (const key of ["round_id", "component", "dimension", "mode", "challenge_mode"])
+	for (const key of ["round_id", "component", "dimension"])
+		if (state[key] !== undefined && !isBoundedAskGateDeepInterviewString(state[key]))
+			throw new Error(`ask gate stage_state has an invalid ${key}`);
+	for (const key of ["mode", "challenge_mode"])
 		if (state[key] !== undefined && !isBoundedAskGateString(state[key]))
 			throw new Error(`ask gate stage_state has an invalid ${key}`);
 	if (state.deep_interview_metadata !== undefined && typeof state.deep_interview_metadata !== "boolean")
@@ -93,6 +196,10 @@ export function validateAskGateStageState(value: unknown): asserts value is Reco
 		throw new Error("ask gate stage_state has an invalid ambiguity");
 	if (state.topology_gate !== undefined && typeof state.topology_gate !== "boolean")
 		throw new Error("ask gate stage_state has an invalid topology flag");
+	if (state.confused_terms !== undefined && !isValidAskGateConfusedTerms(state.confused_terms))
+		throw new Error("ask gate stage_state has invalid confused_terms");
+	if (state.references !== undefined && !isValidAskGateReferences(state.references))
+		throw new Error("ask gate stage_state has invalid references");
 }
 
 /** Builds the canonical generic ask answer schema. */
@@ -114,6 +221,7 @@ export function buildAskGateAnswerSchema(question: AskGateSchemaInput, labels: s
 			custom: {
 				type: "string",
 				minLength: 1,
+				...(question.customMaxLength === undefined ? {} : { maxLength: question.customMaxLength }),
 				pattern: "\\S",
 				description: "free-text answer; required when `other` is true",
 			},
@@ -142,7 +250,12 @@ export function buildAskGateAnswerSchema(question: AskGateSchemaInput, labels: s
 				properties: {
 					selected: selectedWithOther,
 					other: { const: true },
-					custom: { type: "string", minLength: 1, pattern: "\\S" },
+					custom: {
+						type: "string",
+						minLength: 1,
+						...(question.customMaxLength === undefined ? {} : { maxLength: question.customMaxLength }),
+						pattern: "\\S",
+					},
 					action: { const: "answer" },
 				},
 				required: ["selected", "other", "custom"],
@@ -176,6 +289,10 @@ export function buildAskGateStageState(input: AskGateStageStateInput, labels: st
 					dimension: input.deepInterview.dimension,
 					ambiguity: input.deepInterview.ambiguity,
 					...(input.deepInterview.round_id === undefined ? {} : { round_id: input.deepInterview.round_id }),
+					...(input.deepInterview.confused_terms === undefined
+						? {}
+						: { confused_terms: input.deepInterview.confused_terms }),
+					...(input.deepInterview.references === undefined ? {} : { references: input.deepInterview.references }),
 				}
 			: (input.fallbackState ?? {})),
 	};

package/src/plan-mode/approved-plan.ts

@@ -114,6 +114,7 @@ interface RenameApprovedPlanFileOptions {
 	planFilePath: string;
 	finalPlanFilePath: string;
 	getArtifactsDir: () => string | null;
+	isManagedDestination?: () => boolean;
 	getSessionId: () => string | null;
 }
 
@@ -124,12 +125,13 @@ function assertLocalUrl(path: string, label: "source" | "destination"): void {
 }
 
 export async function renameApprovedPlanFile(options: RenameApprovedPlanFileOptions): Promise<void> {
-	const { planFilePath, finalPlanFilePath, getArtifactsDir, getSessionId } = options;
+	const { planFilePath, finalPlanFilePath, getArtifactsDir, getSessionId, isManagedDestination } = options;
 	assertLocalUrl(planFilePath, "source");
 	assertLocalUrl(finalPlanFilePath, "destination");
 
 	const resolveOptions = {
 		getArtifactsDir: () => getArtifactsDir(),
+		isManagedDestination,
 		getSessionId: () => getSessionId(),
 	};
 	const resolvedSource = resolveLocalUrlToPath(normalizeLocalScheme(planFilePath), resolveOptions);

package/src/prompts/agents/architect.md

@@ -33,6 +33,7 @@ You may receive a forked parent-conversation snapshot as background. Your read-o
 - Never approve CRITICAL or HIGH severity issues.
 - Do not skip spec compliance to jump to style nitpicks.
 - Be constructive: explain why an issue matters and how to fix it or strengthen the design.
+- Practical sufficiency beats endless logical completeness: treat preemptive logic for edge cases with no observed or evidenced trigger as over-engineering, but never downgrade genuine CRITICAL/HIGH architecture, extensibility, or robustness risks that have observability-based evidence.
 </constraints>
 
 <review_stages>

package/src/prompts/agents/critic.md

@@ -23,6 +23,7 @@ Review plan clarity, completeness, verification, big-picture fit, referenced fil
 - Do not invent problems; report no issues found when the plan passes.
 - Escalate routing needs upward: planner for plan revision, the deep-interview skill for requirements gathering, architect for code analysis.
 - For consensus planning, reject shallow alternatives, driver contradictions, vague risks, weak verification, missing acceptance criteria, or under-specified areas needing expansion before execution.
+- Prefer practical sufficiency over endless logical completeness: do not demand preemptive logic for edge cases that are not actually observed or evidenced, yet still require extensibility and robustness when observability-based evidence shows the investment is worth the token and time.
 </constraints>
 
 <execution_loop>

package/src/prompts/system/custom-system-prompt.md

@@ -37,6 +37,6 @@ Rules are local constraints. You MUST read `rule://<name>` when working in that
 {{/if}}
 {{#if secretsEnabled}}
 <redacted-content>
-Some values in tool output are redacted for security. They appear as `#XXXX#` tokens (4 uppercase-alphanumeric characters wrapped in `#`). These are **not errors** — they are intentional placeholders for sensitive values (API keys, passwords, tokens). Treat them as opaque strings. Do not attempt to decode, fix, or report them as problems.
+Some values in tool output are redacted for security. They appear as versioned `#GJC1_…#` tokens. These are **not errors** — they are intentional placeholders for sensitive values (API keys, passwords, tokens). Treat them as opaque strings. Do not attempt to decode, fix, or report them as problems.
 </redacted-content>
 {{/if}}

package/src/prompts/system/system-prompt.md

@@ -94,7 +94,7 @@ Discoverable capabilities include browser automation, scheduling, debugging, and
 
 {{#if secretsEnabled}}
 <redacted-content>
-Some tool output values are intentionally redacted as `#XXXX#` tokens. Treat them as opaque sensitive strings.
+Some tool output values are intentionally redacted as versioned `#GJC1_…#` tokens. Treat them as opaque sensitive strings.
 </redacted-content>
 {{/if}}
 
@@ -206,6 +206,7 @@ Guardrails? None. Restrictions? None. Freedom? Unlimited.
 - **Do your homework first** - Read the files, search, and understand the context before asking
 - **Don’t Stop at Analysis** - Once you’ve assessed the situation, take the next step (session, comment, merge, fix, cleanup) on your own
 - **No Inflating Operational/Meta Issues** - Just because the backlog is empty doesn’t mean you should force operational follow-ups, verifiability checks, or meta issues. Only raise issues for actual repository problems; otherwise, stop.
+- **Practical sufficiency over completeness** - Don’t add logic that preemptively handles edge cases you haven’t actually observed; endless logical completeness loses to practical sufficiency. Extensibility and robustness matter, but they must be observability-based and evidence-based—any engineering without underlying evidence that it’s worth the token and time is over-engineering.
 - **Always maintain execution** - Do not end your turn with just reporting, summarizing, or analyzing. If an action is possible, execute it immediately during the same turn.
 - **Always be in action mode** - The default stance is intervention, not observation. If you see something that needs cleaning up, clean it up; if you see a session that needs opening, open it; if you see a PR that needs blocking, block it; if you see a PR that needs merging, review it and merge it.
 - **No begging for permission** - For obvious follow-up actions (cleaning up sessions, marking items as stale, fixing routing, updating documentation to reflect Doctrine), don’t ask—just do it.

package/src/prompts/tools/lsp.md

@@ -1,7 +1,7 @@
 Interacts with Language Server Protocol servers for code intelligence.
 
 <operations>
-- `diagnostics`: Get errors/warnings for a file, a glob of files, or the entire workspace (`file: "*"`)
+- `diagnostics`: Get errors/warnings for a concrete file or a glob of files
 - `definition`: Go to symbol definition → file path + position + 3-line source context
 - `type_definition`: Go to symbol type definition → file path + position + 3-line source context
 - `implementation`: Find concrete implementations → file path + position + 3-line source context
@@ -18,7 +18,7 @@ Interacts with Language Server Protocol servers for code intelligence.
 </operations>
 
 <parameters>
-- `file`: File path, glob pattern (e.g. `src/**/*.ts`), or `"*"` for workspace scope. Globs are expanded locally before dispatch. `"*"` routes `diagnostics`/`symbols`/`reload` to their workspace-wide form.
+- `file`: File path, glob pattern (e.g. `src/**/*.ts`), or `"*"` for workspace scope where supported. Globs are expanded locally before dispatch. `"*"` routes `symbols`/`reload` to their workspace-wide form; workspace build diagnostics are unavailable through `lsp`.
 - `line`: 1-indexed line number for position-based actions
 - `symbol`: Substring on the target line used to resolve column automatically. Append `#N` to pick the Nth occurrence on that line (1-indexed; default 1) — e.g. `foo#2` selects the second `foo`.
 - `query`: Symbol search query, code-action kind filter / selector (list/apply mode), or LSP method name when `action: request`
@@ -31,7 +31,7 @@ Interacts with Language Server Protocol servers for code intelligence.
 <caution>
 - Requires running LSP server for target language
 - Some operations require file to be saved to disk
-- Glob expansion samples up to 20 files per request; use `file: "*"` for broader coverage
+- Glob expansion samples up to 20 files per request; narrow broad patterns when they exceed that limit
 - When `symbol` is provided for position-based actions, missing symbols or out-of-bounds `#N` occurrence selectors return an explicit error instead of silently falling back
 </caution>
 

package/src/runtime-mcp/manager.ts

@@ -235,6 +235,7 @@ export class MCPManager {
 	#epoch = 0;
 	readonly #toolsOnly: boolean;
 	#toolsOnlyConfigLoaded = false;
+	#connectionSetSealed = false;
 
 	#serverError(message: string): string {
 		return this.#toolsOnly ? "MCP server unavailable" : message;
@@ -242,6 +243,17 @@ export class MCPManager {
 	#assertRawMCPAccessAllowed(): void {
 		if (this.#toolsOnly) throw new Error("Tools-only MCP manager does not allow raw MCP access");
 	}
+	#assertConnectionSetMutable(): void {
+		if (this.#connectionSetSealed) throw new Error("MCP manager connection set is sealed");
+	}
+
+	sealConnectionSet(): void {
+		this.#connectionSetSealed = true;
+	}
+
+	isConnectionSetSealed(): boolean {
+		return this.#connectionSetSealed;
+	}
 
 	#isCurrentConnection(
 		name: string,
@@ -379,6 +391,7 @@ export class MCPManager {
 	 * Returns tools and any connection errors.
 	 */
 	async discoverAndConnect(options?: MCPDiscoverOptions): Promise<MCPLoadResult> {
+		this.#assertConnectionSetMutable();
 		const hasConfigPath = options?.configPath !== undefined;
 		if (this.#toolsOnly !== hasConfigPath) {
 			throw new Error(
@@ -414,6 +427,7 @@ export class MCPManager {
 		onConnecting?: (serverNames: string[]) => void,
 	): Promise<MCPLoadResult> {
 		this.#assertRawMCPAccessAllowed();
+		this.#assertConnectionSetMutable();
 		return this.#connectServers(configs, sources, onConnecting);
 	}
 
@@ -923,6 +937,7 @@ export class MCPManager {
 	 */
 	async disconnectServer(name: string): Promise<void> {
 		this.#assertRawMCPAccessAllowed();
+		this.#assertConnectionSetMutable();
 		await this.#disconnectServer(name);
 	}
 
@@ -1050,7 +1065,7 @@ export class MCPManager {
 	 * Returns the new connection, or null if reconnection failed.
 	 */
 	async reconnectServer(name: string): Promise<MCPServerConnection | null> {
-		if (this.#toolsOnly) return null;
+		if (this.#toolsOnly || this.#connectionSetSealed) return null;
 		const pending = this.#pendingReconnections.get(name);
 		if (pending) return pending;