@gajae-code/coding-agent 0.17.4 → 0.17.5

package/src/sdk/session.ts

@@ -67,9 +67,11 @@ import {
 	formatModelString,
 	parseModelPattern,
 	parseModelString,
+	refreshMissingQualifiedModelProviders,
 	resolveAllowedModels,
 	resolveModelChainWithAuth,
 	resolveModelRoleValue,
+	resolveStartupModelRefreshSelectors,
 	type ScopedModelSelection,
 } from "../config/model-resolver";
 import { normalizeModelSelectorValue } from "../config/model-selector-value";
@@ -116,9 +118,11 @@ import { resolveCurrentPhaseForParent } from "../extensibility/gjc-plugins/injec
 import { currentActivationFingerprint } from "../extensibility/gjc-plugins/lifecycle";
 import {
 	buildPluginMcpConfigs,
+	type GjcPluginMcpServerProvenance,
 	getGjcPluginToolDeclarations,
 	loadAlwaysOnPluginTools,
 	renderAlwaysOnSystemAppendices,
+	safePluginMcpDiagnostic,
 } from "../extensibility/gjc-plugins/runtime-adapters";
 import {
 	GjcRuntimeFindingAccumulator,
@@ -145,8 +149,16 @@ import {
 	createOptionalRuntimeServices,
 	type OptionalRuntimeServicesOverrides,
 } from "../runtime/optional-runtime-services";
-import { isMCPStartupTimeoutError, loadAllMCPConfigs, MCPManager } from "../runtime-mcp";
+import {
+	DeferredMCPTool,
+	isMCPStartupTimeoutError,
+	loadAllMCPConfigs,
+	MCPManager,
+	type MCPToolCache,
+	resolveMCPToolCache,
+} from "../runtime-mcp";
 import type { MCPLoadResult } from "../runtime-mcp/manager";
+import { MCP_STARTUP_WAIT_GRACE_MS } from "../runtime-mcp/startup-policy";
 import type { MCPServerConfig } from "../runtime-mcp/types";
 import {
 	getNotificationConfig,
@@ -609,9 +621,9 @@ export interface CreateAgentSessionOptions {
 	inheritedAsyncJobManager?: AsyncJobManager;
 	/**
 	 * W6b: the parent's scope-held MCP facade, handed to a canonical sub-session so
-	 * it can inherit always-on MCP tools without owning the manager. Replaces the
-	 * removed `MCPManager.instance()` inheritance path; the sub-session never
-	 * connects, registers callbacks, or disposes this manager.
+	 * it can inherit MCP tools without owning the manager. Replaces the removed
+	 * `MCPManager.instance()` inheritance path; the sub-session subscribes to catalog
+	 * changes but never connects or disposes this manager.
 	 */
 	inheritedMcpManager?: import("../runtime-mcp/manager").MCPManager;
 
@@ -1248,6 +1260,29 @@ const DEFERRED_MCP_CONFIG_STARTUP_ERROR = "MCP tools could not be loaded.";
 const MAX_EXACT_MCP_TOOL_NAME_LENGTH = 100;
 const pluginMcpManagerServers = new WeakMap<MCPManager, ReadonlySet<string>>();
 const conventionalMcpManagerServers = new WeakMap<MCPManager, ReadonlySet<string>>();
+const failedPluginMcpManagerServers = new WeakMap<MCPManager, ReadonlySet<string>>();
+const pluginMcpCleanupFailures = new WeakSet<MCPManager>();
+
+function sameMcpToolSnapshot(first: readonly CustomTool[], second: readonly CustomTool[]): boolean {
+	return first.length === second.length && first.every((tool, index) => tool === second[index]);
+}
+
+function classifyInheritedMcpToolNames(
+	manager: MCPManager,
+	tools: readonly CustomTool[],
+): { pluginMcpToolNames: string[]; conventionalMcpToolNames: string[] } {
+	const pluginServers = pluginMcpManagerServers.get(manager);
+	const conventionalServers = conventionalMcpManagerServers.get(manager);
+	const pluginMcpToolNames: string[] = [];
+	const conventionalMcpToolNames: string[] = [];
+	for (const tool of tools) {
+		const serverName = tool.mcpServerName;
+		if (serverName === undefined) continue;
+		if (pluginServers?.has(serverName)) pluginMcpToolNames.push(tool.name);
+		else if (conventionalServers?.has(serverName)) conventionalMcpToolNames.push(tool.name);
+	}
+	return { pluginMcpToolNames, conventionalMcpToolNames };
+}
 
 class ExactMcpToolNameCollisionError extends Error {
 	constructor(toolNames: Iterable<string>) {
@@ -1262,23 +1297,43 @@ class ExactMcpToolNameCollisionError extends Error {
 class McpManagerCleanupError extends Error {
 	readonly code = "MCP_MANAGER_CLEANUP_FAILED";
 	constructor(cause: unknown) {
-		super(`Owned MCP manager cleanup failed: ${safeErrorDescription(cause)}`, { cause });
+		super(`Owned MCP manager cleanup failed: ${safePluginMcpDiagnostic(cause)}`, { cause });
 		this.name = "McpManagerCleanupError";
 	}
 }
 
+class McpStartupCleanupRetryError extends Error {
+	readonly primaryError: unknown;
+	constructor(primaryError: unknown) {
+		super("Owned MCP manager cleanup failed during startup", { cause: primaryError });
+		this.name = "McpStartupCleanupRetryError";
+		this.primaryError = primaryError;
+	}
+}
+
 class McpManagerCleanupDiagnosticError extends Error {
 	readonly code = "MCP_MANAGER_CLEANUP_FAILED";
 	readonly primaryError: unknown;
 	readonly cleanupDiagnostic: { code: "MCP_MANAGER_CLEANUP_FAILED"; cause: unknown };
 	constructor(primaryError: unknown, cleanupError: unknown) {
-		super(safeErrorDescription(primaryError), { cause: primaryError });
+		super(safePluginMcpDiagnostic(primaryError), { cause: primaryError });
 		this.name = "McpManagerCleanupDiagnosticError";
 		this.primaryError = primaryError;
 		this.cleanupDiagnostic = { code: "MCP_MANAGER_CLEANUP_FAILED", cause: cleanupError };
 	}
 }
 
+class McpPluginStartupCleanupDiagnosticError extends Error {
+	readonly primaryError: unknown;
+	readonly cleanupDiagnostic: { code: "MCP_MANAGER_CLEANUP_FAILED"; cause: unknown };
+	constructor(primaryError: unknown, cleanupError: unknown) {
+		super("GJC plugin MCP startup and cleanup failed");
+		this.name = "McpPluginStartupCleanupDiagnosticError";
+		this.primaryError = primaryError;
+		this.cleanupDiagnostic = { code: "MCP_MANAGER_CLEANUP_FAILED", cause: cleanupError };
+	}
+}
+
 function safeIsInstanceOf<T extends object>(value: unknown, ctor: abstract new (...args: any[]) => T): boolean {
 	try {
 		return value instanceof ctor;
@@ -1301,8 +1356,8 @@ function safeCleanupDiagnosticForLog(value: unknown): { code: string; cause: str
 	const code = safeReadProperty(value, "code");
 	const nestedCause = safeReadProperty(value, "cause");
 	return {
-		code: typeof code === "string" ? code : "MCP_MANAGER_CLEANUP_FAILED",
-		cause: safeErrorDescription(nestedCause === undefined ? value : nestedCause),
+		code: typeof code === "string" ? safePluginMcpDiagnostic(code) : "MCP_MANAGER_CLEANUP_FAILED",
+		cause: safePluginMcpDiagnostic(nestedCause === undefined ? value : nestedCause),
 	};
 }
 function safeReadCleanupDiagnostic(value: unknown): unknown {
@@ -1520,7 +1575,33 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 	let asyncJobManagerOwned = false;
 	let asyncJobManagerAdmitted = false;
 	let priorAsyncJobManager: AsyncJobManager | undefined;
-	let cleanupOwnedMcpManager: (() => Promise<void>) | undefined;
+	type OwnedMcpManagerCleanup = () => Promise<void>;
+	let cleanupOwnedMcpManager: OwnedMcpManagerCleanup | undefined;
+	let cleanupOwnedMcpManagerOwner: MCPManager | undefined;
+	const registerOwnedMcpManagerCleanup = (owned: MCPManager): OwnedMcpManagerCleanup => {
+		let cleanupAttempt: Promise<void> | undefined;
+		const cleanup: OwnedMcpManagerCleanup = () => {
+			if (cleanupAttempt) return cleanupAttempt;
+			cleanupAttempt = Promise.resolve()
+				.then(() => owned.disconnectAll())
+				.then(
+					() => {
+						if (cleanupOwnedMcpManager === cleanup) {
+							cleanupOwnedMcpManager = undefined;
+							cleanupOwnedMcpManagerOwner = undefined;
+						}
+					},
+					error => {
+						cleanupAttempt = undefined;
+						throw error;
+					},
+				);
+			return cleanupAttempt;
+		};
+		cleanupOwnedMcpManager = cleanup;
+		cleanupOwnedMcpManagerOwner = owned;
+		return cleanup;
+	};
 	const agentRegistry = options.agentRegistry ?? AgentRegistry.global();
 	const resolvedAgentId = options.agentId ?? options.parentTaskPrefix ?? MAIN_AGENT_ID;
 	const resolvedAgentDisplayName = options.agentDisplayName ?? (isCanonicalSubSession ? "sub" : "main");
@@ -1558,6 +1639,14 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 		unsubscribeCredentialDisabled = undefined;
 		unsubscribe?.();
 	};
+	let inheritedMcpToolsPublisher: ((tools: readonly CustomTool[]) => void) | undefined;
+	let inheritedMcpToolsUnsubscribe: (() => void) | undefined;
+	const stopInheritedMcpToolsSubscription = (): void => {
+		inheritedMcpToolsPublisher = undefined;
+		const unsubscribe = inheritedMcpToolsUnsubscribe;
+		inheritedMcpToolsUnsubscribe = undefined;
+		unsubscribe?.();
+	};
 
 	try {
 		// Subscribe before any getApiKey() call so startup model probes can't fire a
@@ -1904,6 +1993,19 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			);
 		}
 		if (!options.modelRegistry && !attemptedStartupCacheAdmission) {
+			// Match the CLI's awaited startup discovery: the background refresh below
+			// is not a readiness barrier, so resolving a fresh configured default first
+			// can reject a model that the provider would discover moments later.
+			const startupModelSelectors = resolveStartupModelRefreshSelectors(
+				{
+					model: options.modelPattern ?? (options.model ? formatModelString(options.model) : undefined),
+					credential: options.credentialSelector ? "session" : undefined,
+					resume: hasExistingSession,
+					hasStartupProfile: Boolean(options.activeModelProfile || settings.get("modelProfile.default")),
+				},
+				settings,
+			);
+			await refreshMissingQualifiedModelProviders(startupModelSelectors, modelRegistry, credentialSessionId);
 			modelRegistry.refreshInBackground("online-if-uncached", credentialSessionId);
 		}
 
@@ -2357,11 +2459,18 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 		};
 		let mcpManager: MCPManager | undefined = options.mcpManager;
 		let ownsMcpManager = false;
+		let ownedMcpToolCache: MCPToolCache | null | undefined;
+		const getOwnedMcpToolCache = async (): Promise<MCPToolCache | null> => {
+			if (ownedMcpToolCache === undefined)
+				ownedMcpToolCache = await resolveMCPToolCache(undefined, getAgentDbPath(agentDir));
+			return ownedMcpToolCache;
+		};
 		const cwdCapturingToolNames: string[] = [];
 		const ownedConventionalMcpServerNames = new Set<string>();
-		let ownedConventionalMcpToolNames: string[] = [];
-		let publishOwnedConventionalMcpTools = false;
-		let ownedPluginServersConnected = false;
+		const cachedConventionalMcpServerNames = new Set<string>();
+		let ownedMcpManagerToolNames: string[] = [];
+		let ownedMcpManagerTools: readonly CustomTool[] = [];
+		let publishOwnedMcpTools = false;
 		const notificationDebounceTimers = new Map<string, Timer>();
 		const wireMcpManagerCallbacks = (manager: MCPManager): void => {
 			manager.setOnPromptsChanged(serverName => {
@@ -2416,6 +2525,11 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 				if (previousManager) await previousManager.disconnectAll().catch(() => {});
 				pluginMcpToolNames.length = 0;
 				conventionalMcpToolNames.length = 0;
+				ownedConventionalMcpServerNames.clear();
+				cachedConventionalMcpServerNames.clear();
+				ownedMcpManagerToolNames = [];
+				ownedMcpManagerTools = [];
+				publishOwnedMcpTools = false;
 				let nextManager: MCPManager | undefined;
 				try {
 					const loaded = await loadAllMCPConfigs(to, {
@@ -2439,11 +2553,51 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 							]),
 						),
 					};
+					const conventionalCacheServerNames = new Set(
+						Object.keys(loaded.configs).filter(name => !pluginNames.has(name)),
+					);
+					for (const name of conventionalCacheServerNames) ownedConventionalMcpServerNames.add(name);
+					publishOwnedMcpTools = Object.keys(mergedConfigs).length > 0;
 					if (Object.keys(mergedConfigs).length > 0) {
-						nextManager = new MCPManager(to, null, { sharedPoolIdleMs: settings.get("mcp.sharedPoolIdleMs") });
+						nextManager = new MCPManager(
+							to,
+							conventionalCacheServerNames.size > 0 ? await getOwnedMcpToolCache() : null,
+							{
+								sharedPoolIdleMs: settings.get("mcp.sharedPoolIdleMs"),
+								toolCacheServerNames: conventionalCacheServerNames,
+							},
+						);
 						nextManager.setAuthStorage(authStorage);
 						wireMcpManagerCallbacks(nextManager);
 						const result = await nextManager.connectServers(mergedConfigs, mergedSources as never);
+						const connectedPluginNames = new Set(result.connectedServers.filter(name => pluginNames.has(name)));
+						pluginMcpManagerServers.set(nextManager, new Set(pluginNames));
+						conventionalMcpManagerServers.set(nextManager, conventionalCacheServerNames);
+						failedPluginMcpManagerServers.set(nextManager, new Set());
+						for (const tool of result.tools) {
+							const serverName = tool.mcpServerName;
+							if (
+								tool instanceof DeferredMCPTool &&
+								serverName &&
+								conventionalCacheServerNames.has(serverName)
+							) {
+								cachedConventionalMcpServerNames.add(serverName);
+							}
+						}
+						ownedMcpManagerTools = result.tools as CustomTool[];
+						ownedMcpManagerToolNames = result.tools.map(tool => tool.name);
+						const unsettledConventionalNames = [...conventionalCacheServerNames].filter(
+							name =>
+								nextManager?.getConnectionStatus(name) === "connecting" ||
+								cachedConventionalMcpServerNames.has(name),
+						);
+						if (pluginNames.size > 0) {
+							if (connectedPluginNames.size > 0 && unsettledConventionalNames.length === 0) {
+								nextManager.sealConnectionSet();
+							} else {
+								nextManager.freezeConnectionSet();
+							}
+						}
 						nextCustomTools.push(...(result.tools as CustomTool[]));
 						nextCwdCapturing.push(...result.tools.map(tool => tool.name));
 						for (const tool of result.tools) {
@@ -2461,14 +2615,18 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 				mcpManager = nextManager;
 				ownsMcpManager = Boolean(nextManager);
 				await session.replaceOwnedMcpManager(nextManager);
-				await session.refreshMCPTools((nextManager?.getTools() ?? []) as CustomTool[]);
+				await session.refreshMCPTools((nextManager?.getTools() ?? []) as CustomTool[], {
+					mandatoryMCPToolNames: pluginMcpToolNames,
+				});
 			}
 			cwdCapturingToolNames.length = 0;
 			cwdCapturingToolNames.push(...nextCwdCapturing);
 			await session.replaceNamedCustomTools(
 				previousCwdCapturing.filter(name => !nextCustomTools.some(tool => tool.name === name)),
 				nextCustomTools,
+				{ mandatoryMCPToolNames: pluginMcpToolNames },
 			);
+			wireOwnedMcpToolSync();
 		};
 
 		/**
@@ -3031,10 +3189,15 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 		const exactMcpToolNames: string[] = [];
 		const pluginMcpToolNames: string[] = [];
 		const conventionalMcpToolNames: string[] = [];
+		let inheritedMcpManager: MCPManager | undefined;
+		let inheritedMcpManagerToolNames: string[] = [];
+		let inheritedMcpToolsSnapshot: readonly CustomTool[] = [];
+		let pendingInheritedMcpToolsSnapshot: readonly CustomTool[] | undefined;
 		let deferredExactMcpConfig: { manager: MCPManager; configPath: string } | undefined;
 		let deferredConventionalMcp:
 			| {
 					manager: MCPManager;
+					cleanup: OwnedMcpManagerCleanup;
 					configs: Record<string, MCPServerConfig>;
 					sources: Record<string, SourceMeta>;
 					conventionalConfigs: Record<string, MCPServerConfig>;
@@ -3154,76 +3317,179 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			mergedSources: Record<string, SourceMeta>,
 			conventionalConfigs: Record<string, MCPServerConfig>,
 			pluginNames: ReadonlySet<string>,
+			pluginMcpProvenance: ReadonlyMap<string, GjcPluginMcpServerProvenance>,
+			cleanupOwned: OwnedMcpManagerCleanup,
 		): Promise<MCPLoadResult> => {
 			let result: MCPLoadResult;
 			try {
 				result = await owned.connectServers(mergedConfigs, mergedSources as never);
 			} catch (error) {
-				if (safeIsInstanceOf(error, McpManagerCleanupError)) throw error;
+				if (
+					safeIsInstanceOf(error, McpManagerCleanupError) ||
+					safeIsInstanceOf(error, McpManagerCleanupDiagnosticError) ||
+					safeReadCleanupDiagnostic(error) !== undefined
+				)
+					throw error;
 				// Avoid leaking partially-started server processes on failure.
+				const retryAfterStartupCleanupFailure = options.enableMCP === false && !options.deferMcpConfigStartup;
 				let cleanupError: unknown;
+				let cleanupFailed = false;
 				try {
-					await owned.disconnectAll();
+					await cleanupOwned();
 				} catch (disconnectError) {
+					cleanupFailed = true;
 					cleanupError = disconnectError;
-				} finally {
-					cleanupOwnedMcpManager = undefined;
 				}
-				if (cleanupError !== undefined) throw attachMcpCleanupDiagnostic(error, cleanupError);
+				if (cleanupFailed) {
+					if (retryAfterStartupCleanupFailure) throw new McpStartupCleanupRetryError(error);
+					if (pluginNames.size > 0) {
+						throw new McpPluginStartupCleanupDiagnosticError(error, cleanupError);
+					}
+					throw attachMcpCleanupDiagnostic(error, cleanupError);
+				}
 				throw error;
 			}
+			const conventionalServerNames = new Set(
+				Object.keys(conventionalConfigs).filter(name => !pluginNames.has(name)),
+			);
+			for (const tool of result.tools) {
+				if (tool instanceof DeferredMCPTool && conventionalServerNames.has(tool.mcpServerName)) {
+					cachedConventionalMcpServerNames.add(tool.mcpServerName);
+				}
+			}
 			for (const [server, err] of result.errors) {
-				// A server that failed to connect leaves this generation incomplete: its
-				// surfaces produced no evidence, so publishing would present a partial
-				// pass as a clear one. On the deferred path this flag is already
-				// consumed (publication happens before the starter can run), which is
-				// acceptable only because deferral never carries plugin-bundle servers.
-				gjcProducersComplete = false;
-				if (!isMCPStartupTimeoutError(err)) {
-					logger.warn("GJC plugin MCP connect failed", {
+				const provenance = pluginMcpProvenance.get(server);
+				if (provenance) {
+					gjcFindings.add({
+						identity: provenance.identity,
+						surfaceId: provenance.surfaceId,
+						code: "runtime_mismatch",
+						message: `MCP server connection failed: ${safePluginMcpDiagnostic(err)}`,
+						decision: "error",
+						provenance: {
+							source: "plugin-bundle",
+							plugin: provenance.identity.name,
+							scope: provenance.identity.scope,
+						},
+					});
+				}
+				if (provenance) {
+					logger.error("GJC plugin MCP connection failed", {
+						path: `mcp:${server}`,
+						error: safePluginMcpDiagnostic(err),
+					});
+				} else if (!isMCPStartupTimeoutError(err)) {
+					logger.warn("MCP server connection failed", {
 						path: `mcp:${server}`,
-						error: safeErrorForLog(err),
+						// MCPLoadResult stores failures as strings, so their original
+						// type is unavailable here; use the manager classifier's safe fallback.
+						error: "transport-error",
 					});
 				}
 			}
-			const connectedPluginNames = new Set(result.connectedServers.filter(name => pluginNames.has(name)));
-			// Retain while any conventional server is still live: "connecting"
-			// covers the declared-timeout window, and a server that landed in
-			// "connected" inside the microtask between connectServers() resolving
-			// and this synchronous check must not be torn down either.
-			const unsettledConventionalNames = Object.keys(conventionalConfigs).filter(
-				name => owned.getConnectionStatus(name) !== "disconnected",
+			const failedPluginNames = new Set([...result.errors.keys()].filter(name => pluginMcpProvenance.has(name)));
+			const connectedPluginNames = new Set(
+				result.connectedServers.filter(name => pluginNames.has(name) && !failedPluginNames.has(name)),
 			);
-			const retainOwnedManager = result.connectedServers.length > 0 || unsettledConventionalNames.length > 0;
+			const trustedPluginServerNames = new Set(
+				[...pluginMcpProvenance.keys()].filter(name => !failedPluginNames.has(name)),
+			);
+			const connectedTrustedPluginNames = new Set(
+				[...connectedPluginNames].filter(name => trustedPluginServerNames.has(name)),
+			);
+			const unsettledPluginNames = [...pluginNames].filter(
+				name =>
+					!failedPluginNames.has(name) &&
+					!connectedPluginNames.has(name) &&
+					owned.getConnectionStatus(name) !== "disconnected",
+			);
+			let pluginCleanupFailed = false;
+			for (const server of unsettledPluginNames) {
+				const provenance = pluginMcpProvenance.get(server);
+				if (!provenance) continue;
+				let message =
+					"MCP server did not produce a complete startup result within its declared startup window; its tools are unavailable for this session";
+				let cleanupDiagnostic: string | undefined;
+				failedPluginNames.add(server);
+				try {
+					await owned.disconnectServer(server);
+				} catch (error) {
+					pluginCleanupFailed = true;
+					cleanupDiagnostic = safePluginMcpDiagnostic(error);
+				}
+				if (owned.getConnectionStatus(server) !== "disconnected") {
+					pluginCleanupFailed = true;
+					cleanupDiagnostic ??= "server remained connected or connecting after disconnect";
+				}
+				if (cleanupDiagnostic !== undefined) message += `; cleanup diagnostic: ${cleanupDiagnostic}`;
+				gjcFindings.add({
+					identity: provenance.identity,
+					surfaceId: provenance.surfaceId,
+					code: "runtime_mismatch",
+					message,
+					decision: "error",
+					provenance: {
+						source: "plugin-bundle",
+						plugin: provenance.identity.name,
+						scope: provenance.identity.scope,
+					},
+				});
+				logger.error("GJC plugin MCP startup did not settle", {
+					path: `mcp:${server}`,
+					error: message,
+					...(cleanupDiagnostic === undefined ? {} : { cleanupDiagnostic }),
+				});
+			}
+			failedPluginMcpManagerServers.set(owned, new Set(failedPluginNames));
+			if (pluginCleanupFailed) pluginMcpCleanupFailures.add(owned);
+			const successfulTools = result.tools.filter(
+				tool => tool.mcpServerName === undefined || !failedPluginNames.has(tool.mcpServerName),
+			);
+			// Only a connection still in its startup window or a cached fallback
+			// needs the mixed manager to remain mutable. Successfully connected
+			// ordinary tools do not delay the synchronous seal; cached fallbacks keep
+			// their reconnect path available while they remain published.
+			const unsettledConventionalNames = [...conventionalServerNames].filter(
+				name => owned.getConnectionStatus(name) === "connecting" || cachedConventionalMcpServerNames.has(name),
+			);
+			const retainOwnedManager =
+				result.connectedServers.length > 0 ||
+				unsettledConventionalNames.length > 0 ||
+				successfulTools.length > 0 ||
+				pluginCleanupFailed;
 			if (retainOwnedManager) {
 				mcpManager = owned;
 				ownsMcpManager = true;
-				customTools.push(...(result.tools as CustomTool[]));
-				cwdCapturingToolNames.push(...result.tools.map(tool => tool.name));
-				for (const name of Object.keys(conventionalConfigs)) ownedConventionalMcpServerNames.add(name);
-				pluginMcpManagerServers.set(owned, connectedPluginNames);
-				conventionalMcpManagerServers.set(owned, new Set(Object.keys(conventionalConfigs)));
-				for (const tool of result.tools) {
+				customTools.push(...(successfulTools as CustomTool[]));
+				ownedMcpManagerTools = successfulTools as CustomTool[];
+				ownedMcpManagerToolNames = successfulTools.map(tool => tool.name);
+				cwdCapturingToolNames.push(...successfulTools.map(tool => tool.name));
+				for (const name of conventionalServerNames) ownedConventionalMcpServerNames.add(name);
+				pluginMcpManagerServers.set(owned, trustedPluginServerNames);
+				conventionalMcpManagerServers.set(owned, conventionalServerNames);
+				for (const tool of successfulTools) {
 					const serverName = tool.mcpServerName;
 					if (serverName === undefined) continue;
-					if (connectedPluginNames.has(serverName)) pluginMcpToolNames.push(tool.name);
+					if (connectedTrustedPluginNames.has(serverName)) pluginMcpToolNames.push(tool.name);
 					else {
 						conventionalMcpToolNames.push(tool.name);
-						ownedConventionalMcpToolNames.push(tool.name);
 					}
 				}
-				publishOwnedConventionalMcpTools = ownedConventionalMcpServerNames.size > 0;
-				ownedPluginServersConnected = connectedPluginNames.size > 0;
-				// Plugin-bundle connections are fixed for the session lifetime only
-				// when no conventional server is still connecting in the same manager;
-				// otherwise the seal is re-applied once they settle (below).
-				if (connectedPluginNames.size > 0 && unsettledConventionalNames.length === 0) owned.sealConnectionSet();
+				publishOwnedMcpTools = true;
+				// Keep plugin config authority fixed even while a conventional cached
+				// fallback needs reconnects; a full reload would disconnect and lose the
+				// plugin-bundle configs because native discovery does not reload them.
+				if (pluginNames.size > 0) {
+					if (connectedTrustedPluginNames.size > 0 && unsettledConventionalNames.length === 0) {
+						owned.sealConnectionSet();
+					} else {
+						owned.freezeConnectionSet();
+					}
+				}
 			} else {
 				try {
-					await owned.disconnectAll();
-					cleanupOwnedMcpManager = undefined;
+					await cleanupOwned();
 				} catch (cleanupError) {
-					cleanupOwnedMcpManager = undefined;
 					throw new McpManagerCleanupError(cleanupError);
 				}
 			}
@@ -3240,7 +3506,7 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			owned.setAuthStorage(authStorage);
 			mcpManager = owned;
 			ownsMcpManager = true;
-			cleanupOwnedMcpManager = () => owned.disconnectAll();
+			registerOwnedMcpManagerCleanup(owned);
 			if (options.deferMcpConfigStartup) {
 				deferredExactMcpConfig = { manager: owned, configPath: explicitMcpConfigPath };
 			} else {
@@ -3308,7 +3574,7 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			// tools are surfaced as always-on tools rather than gated behind MCP
 			// selection.
 			try {
-				const { configs, quarantine } = await buildPluginMcpConfigs({ cwd });
+				const { configs, quarantine, serverProvenance: pluginMcpProvenance } = await buildPluginMcpConfigs({ cwd });
 				for (const q of quarantine) {
 					gjcFindings.add({
 						identity: q.identity,
@@ -3335,9 +3601,30 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 				// own bypass of the same mismatch at the manager boundary).
 				const mergedSourceMetas = mergedSources as Record<string, SourceMeta>;
 				if (Object.keys(mergedConfigs).length > 0) {
-					const owned = new MCPManager(cwd, null, { sharedPoolIdleMs: settings.get("mcp.sharedPoolIdleMs") });
+					const conventionalCacheServerNames = new Set(
+						Object.keys(conventionalConfigs).filter(name => !pluginNames.has(name)),
+					);
+					const maxPluginMcpTimeoutMs = Object.values(configs).reduce((maximum, config) => {
+						const timeout = config.timeout;
+						return typeof timeout === "number" && Number.isFinite(timeout) && timeout > 0
+							? Math.max(maximum, timeout)
+							: maximum;
+					}, 0);
+					const maxPluginMcpStartupWaitMs =
+						maxPluginMcpTimeoutMs > 0 ? maxPluginMcpTimeoutMs + MCP_STARTUP_WAIT_GRACE_MS : undefined;
+					const owned = new MCPManager(
+						cwd,
+						conventionalCacheServerNames.size > 0 ? await getOwnedMcpToolCache() : null,
+						{
+							sharedPoolIdleMs: settings.get("mcp.sharedPoolIdleMs"),
+							toolCacheServerNames: conventionalCacheServerNames,
+							...(maxPluginMcpStartupWaitMs === undefined
+								? {}
+								: { maxStartupTimeoutMs: maxPluginMcpStartupWaitMs }),
+						},
+					);
 					owned.setAuthStorage(authStorage);
-					cleanupOwnedMcpManager = () => owned.disconnectAll();
+					const cleanupOwned = registerOwnedMcpManagerCleanup(owned);
 					// Interactive launches may paint before MCP connects; the deferred
 					// starter reconnects this manager after first paint and a startup
 					// turn barrier keeps the first prompt from racing tool registration.
@@ -3347,6 +3634,7 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 					if (options.deferMcpConfigStartup && pluginNames.size === 0) {
 						deferredConventionalMcp = {
 							manager: owned,
+							cleanup: cleanupOwned,
 							configs: mergedConfigs,
 							sources: mergedSourceMetas,
 							conventionalConfigs,
@@ -3363,37 +3651,60 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 							mergedSourceMetas,
 							conventionalConfigs,
 							pluginNames,
+							pluginMcpProvenance,
+							cleanupOwned,
 						);
 					}
 				}
 			} catch (error) {
-				if (safeIsInstanceOf(error, McpManagerCleanupError)) throw error;
+				if (safeIsInstanceOf(error, McpStartupCleanupRetryError)) {
+					throw (error as McpStartupCleanupRetryError).primaryError;
+				}
+				const pluginStartupCleanupFailure = safeIsInstanceOf(error, McpPluginStartupCleanupDiagnosticError)
+					? (error as McpPluginStartupCleanupDiagnosticError)
+					: undefined;
+				if (
+					!pluginStartupCleanupFailure &&
+					(safeIsInstanceOf(error, McpManagerCleanupError) ||
+						safeIsInstanceOf(error, McpManagerCleanupDiagnosticError) ||
+						safeReadCleanupDiagnostic(error) !== undefined)
+				)
+					throw error;
 				gjcProducersComplete = false;
-				const cleanupDiagnostic = safeReadCleanupDiagnostic(error);
+				const cleanupDiagnostic =
+					pluginStartupCleanupFailure?.cleanupDiagnostic ?? safeReadCleanupDiagnostic(error);
 				logger.warn("Failed to wire GJC plugin MCP servers", {
-					error: safeErrorForLog(error),
+					error: pluginStartupCleanupFailure
+						? safePluginMcpDiagnostic(pluginStartupCleanupFailure.primaryError)
+						: safeErrorForLog(error),
 					cleanupDiagnostic: safeCleanupDiagnosticForLog(cleanupDiagnostic),
 				});
 			}
 		} else if (isCanonicalSubSession) {
-			// Subagents inherit the parent's always-on plugin and conventional MCP
-			// tools WITHOUT owning the manager (no connect, no callbacks, no
-			// disposal). The facade is carried explicitly by the parent session
-			// scope; process-global state is never consulted for MCP routing.
+			// Subagents inherit the parent's MCP tools without owning the manager.
+			// They subscribe to catalog changes but never connect or dispose it; the
+			// facade is carried explicitly by the parent scope.
 			const inherited = mcpManager ?? options.inheritedMcpManager;
 			if (inherited) {
 				try {
-					const inheritedTools = inherited.getTools();
-					if (inheritedTools.length > 0) customTools.push(...(inheritedTools as CustomTool[]));
-					const pluginServers = pluginMcpManagerServers.get(inherited);
-					const conventionalServers = conventionalMcpManagerServers.get(inherited);
-					for (const tool of inheritedTools) {
-						const serverName = tool.mcpServerName;
-						if (serverName === undefined) continue;
-						if (pluginServers?.has(serverName)) pluginMcpToolNames.push(tool.name);
-						else if (conventionalServers?.has(serverName)) conventionalMcpToolNames.push(tool.name);
-					}
+					inheritedMcpManager = inherited;
+					inheritedMcpToolsUnsubscribe = inherited.subscribeToToolsChanged(tools => {
+						const snapshot = tools.map(tool => tool as CustomTool);
+						if (inheritedMcpToolsPublisher) inheritedMcpToolsPublisher(snapshot);
+						else pendingInheritedMcpToolsSnapshot = snapshot;
+					});
+					const inheritedTools = inherited.getTools() as CustomTool[];
+					inheritedMcpToolsSnapshot = inheritedTools;
+					inheritedMcpManagerToolNames = inheritedTools.map(tool => tool.name);
+					customTools.push(...inheritedTools);
+					const classifiedTools = classifyInheritedMcpToolNames(inherited, inheritedTools);
+					pluginMcpToolNames.push(...classifiedTools.pluginMcpToolNames);
+					conventionalMcpToolNames.push(...classifiedTools.conventionalMcpToolNames);
 				} catch (error) {
+					stopInheritedMcpToolsSubscription();
+					inheritedMcpManager = undefined;
+					inheritedMcpToolsSnapshot = [];
+					pendingInheritedMcpToolsSnapshot = undefined;
 					logger.warn("Failed to inherit MCP tools in subagent", { error: safeErrorForLog(error) });
 				}
 			}
@@ -4960,6 +5271,11 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 		// carried by the host replay ring through the internal runtime seam above.
 		if (autoroutingInactive) session.configWarnings.push(AUTOROUTING_INACTIVE_WARNING);
 		hasSession = true;
+		const cleanupOwnedManager = cleanupOwnedMcpManager;
+		const sessionOwnedMcpManager = ownsMcpManager ? mcpManager : undefined;
+		if (cleanupOwnedManager && cleanupOwnedMcpManagerOwner !== sessionOwnedMcpManager) {
+			session.registerToolSessionCleanup(cleanupOwnedManager);
+		}
 		if (masterModeContext) {
 			// One scoped, no-probe peer snapshot immediately before the FIRST accepted
 			// provider request; see createMasterPeerSnapshotContributor for the
@@ -5141,59 +5457,166 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 		// createAgentSession rather than surfacing as an unhandled rejection.
 		if (!options.deferMemoryBackendStartup) await startMemoryBackend();
 
-		// Wire the owned manager's late tool publications into the live session.
-		// Shared by the eager startup path below and by the deferred conventional
-		// starter once its connect lands. No-op when there is no owned manager or
-		// nothing conventional to publish.
-		const wireOwnedConventionalToolSync = (): void => {
-			if (!mcpManager || !publishOwnedConventionalMcpTools) return;
-			// Late conventional connections can publish near-simultaneously.
+		// Wire late catalog publications from every owned manager into the live
+		// session. Plugin-only managers also change after startup through
+		// tools/list_changed; mixed managers additionally publish cached fallbacks.
+		// Shared by eager startup and the deferred starter.
+		const wireOwnedMcpToolSync = (initialTools?: readonly CustomTool[]): void => {
+			const manager = mcpManager;
+			if (!manager || !publishOwnedMcpTools || manager.isToolsOnly()) return;
+			// Late MCP connections can publish near-simultaneously.
 			// Serialize the swaps so an older snapshot cannot interleave with a
 			// newer one inside replaceNamedCustomTools and leave a stale list.
 			// Each link swallows (and logs) its own failure so one bad
 			// publication cannot kill the chain for every later one.
-			let conventionalToolsSync: Promise<void> = Promise.resolve();
-			const syncConventionalTools = (tools: CustomTool[]): Promise<void> => {
-				conventionalToolsSync = conventionalToolsSync
+			let ownedMcpToolsSync: Promise<void> = Promise.resolve();
+			let acceptingOwnedMcpTools = true;
+			const syncOwnedMcpTools = (tools: readonly CustomTool[]): Promise<void> => {
+				if (!acceptingOwnedMcpTools) return ownedMcpToolsSync;
+				ownedMcpToolsSync = ownedMcpToolsSync
 					.then(async () => {
-						if (session.isDisposed) return;
-						const nextTools = tools.filter(tool =>
-							tool.mcpServerName ? ownedConventionalMcpServerNames.has(tool.mcpServerName) : false,
-						);
-						const previousNames = ownedConventionalMcpToolNames;
-						ownedConventionalMcpToolNames = nextTools.map(tool => tool.name);
+						if (session.isDisposed || mcpManager !== manager) return;
+						const pluginServerNames = new Set(pluginMcpManagerServers.get(manager));
+						const conventionalServerNames = new Set(conventionalMcpManagerServers.get(manager));
+						// Plugin authority is fixed from validated bundle provenance when
+						// this manager is created. SourceMeta can be caller-supplied later.
+						for (const serverName of manager.getAllServerNames()) {
+							if (!pluginServerNames.has(serverName)) conventionalServerNames.add(serverName);
+						}
+						for (const tool of tools) {
+							const serverName = tool.mcpServerName;
+							if (!serverName) continue;
+							if (!pluginServerNames.has(serverName)) conventionalServerNames.add(serverName);
+						}
+						conventionalMcpManagerServers.set(manager, conventionalServerNames);
+						const failedPluginServers = failedPluginMcpManagerServers.get(manager);
+						const nextCachedConventionalMcpServerNames = new Set(cachedConventionalMcpServerNames);
+						for (const serverName of nextCachedConventionalMcpServerNames) {
+							if (!tools.some(tool => tool.mcpServerName === serverName)) {
+								nextCachedConventionalMcpServerNames.delete(serverName);
+							}
+						}
+						for (const tool of tools) {
+							if (
+								tool instanceof DeferredMCPTool &&
+								tool.mcpServerName &&
+								conventionalServerNames.has(tool.mcpServerName)
+							) {
+								nextCachedConventionalMcpServerNames.add(tool.mcpServerName);
+							}
+						}
+						const nextTools = tools.filter(tool => {
+							const serverName = tool.mcpServerName;
+							if (!serverName) return false;
+							if (
+								failedPluginServers?.has(serverName) &&
+								manager.getConnectionStatus(serverName) !== "connected"
+							) {
+								return false;
+							}
+							return pluginServerNames.has(serverName) || conventionalServerNames.has(serverName);
+						});
+						const previousNames = ownedMcpManagerToolNames;
+						const nextToolNames = nextTools.map(tool => tool.name);
 						const previousSet = new Set(previousNames);
-						cwdCapturingToolNames.splice(
-							0,
-							cwdCapturingToolNames.length,
+						const nextPluginToolNames = nextTools
+							.filter(tool => tool.mcpServerName && pluginServerNames.has(tool.mcpServerName))
+							.map(tool => tool.name);
+						const nextConventionalToolNames = nextTools
+							.filter(tool => tool.mcpServerName && conventionalServerNames.has(tool.mcpServerName))
+							.map(tool => tool.name);
+						const nextMandatoryMcpToolNames = [
+							...pluginMcpToolNames.filter(name => !previousSet.has(name)),
+							...nextPluginToolNames,
+						];
+						const nextConventionalMcpToolNames = [
+							...conventionalMcpToolNames.filter(name => !previousSet.has(name)),
+							...nextConventionalToolNames,
+						];
+						const nextCwdCapturingToolNames = [
 							...cwdCapturingToolNames.filter(name => !previousSet.has(name)),
-							...ownedConventionalMcpToolNames,
+							...nextToolNames,
+						];
+						const nextOwnedPluginServersConnected = [...pluginServerNames].some(
+							name => manager.getConnectionStatus(name) === "connected",
 						);
-						await session.replaceNamedCustomTools(previousNames, nextTools);
-						// Mixed plugin + conventional sessions deferred the seal while
-						// a conventional server was still connecting; restore the
-						// fixed-connection plugin contract once every conventional
-						// server has reached a terminal state.
+						const nextOwnedConventionalMcpServerNames = new Set(conventionalServerNames);
+						const hasPublishedCachedTool = nextTools.some(
+							tool =>
+								tool.mcpServerName !== undefined &&
+								nextCachedConventionalMcpServerNames.has(tool.mcpServerName),
+						);
+						try {
+							await session.replaceNamedCustomTools(previousNames, nextTools, {
+								mandatoryMCPToolNames: nextMandatoryMcpToolNames,
+								activateNewTools: false,
+							});
+						} catch (error) {
+							ownedMcpManagerToolNames = [...new Set([...previousNames, ...nextToolNames])];
+							throw error;
+						}
+						ownedMcpManagerToolNames = nextToolNames;
+						ownedMcpManagerTools = nextTools;
+						pluginMcpToolNames.splice(0, pluginMcpToolNames.length, ...nextMandatoryMcpToolNames);
+						conventionalMcpToolNames.splice(0, conventionalMcpToolNames.length, ...nextConventionalMcpToolNames);
+						cwdCapturingToolNames.splice(0, cwdCapturingToolNames.length, ...nextCwdCapturingToolNames);
+						ownedConventionalMcpServerNames.clear();
+						for (const name of nextOwnedConventionalMcpServerNames) ownedConventionalMcpServerNames.add(name);
+						cachedConventionalMcpServerNames.clear();
+						for (const name of nextCachedConventionalMcpServerNames) cachedConventionalMcpServerNames.add(name);
+						// Mixed plugin + conventional sessions defer the seal while a
+						// conventional server is connecting. Cached fallback servers retain
+						// their reconnect path while any of their tools remain published,
+						// including after reconnect replaces DeferredMCPTool with MCPTool.
+						// Derive that hold from this snapshot so removing/replacing the tools
+						// restores the fixed-connection plugin contract.
 						if (
-							ownedPluginServersConnected &&
-							mcpManager !== undefined &&
-							!mcpManager.isConnectionSetSealed() &&
-							![...ownedConventionalMcpServerNames].some(
-								name => mcpManager?.getConnectionStatus(name) === "connecting",
-							)
+							nextOwnedPluginServersConnected &&
+							!manager.isConnectionSetSealed() &&
+							![...nextOwnedConventionalMcpServerNames].some(
+								name => manager.getConnectionStatus(name) === "connecting",
+							) &&
+							!hasPublishedCachedTool
 						) {
-							mcpManager.sealConnectionSet();
+							manager.sealConnectionSet();
 						}
 					})
 					.catch(error => {
-						logger.warn("Failed to publish conventional MCP tools", { error: safeErrorForLog(error) });
+						logger.warn("Failed to publish owned MCP tools", { error: safeErrorForLog(error) });
 					});
-				return conventionalToolsSync;
+				return ownedMcpToolsSync;
 			};
-			mcpManager.setOnToolsChanged(tools => {
-				void syncConventionalTools(tools as CustomTool[]);
+			session.registerToolSessionCleanup(async () => {
+				acceptingOwnedMcpTools = false;
+				await ownedMcpToolsSync;
+			});
+			manager.setOnToolsChanged(tools => {
+				void syncOwnedMcpTools(tools);
 			});
-			void syncConventionalTools(mcpManager.getTools() as CustomTool[]);
+			const catalog = manager.getToolCatalogSnapshot();
+			if (initialTools !== undefined) {
+				// Deferred startup already registered its captured result. Re-read
+				// after that await so a publication during registration is not lost.
+				const currentTools =
+					catalog.publication === "published" ? catalog.tools.map(tool => tool as CustomTool) : initialTools;
+				void syncOwnedMcpTools(currentTools);
+			} else if (catalog.publication === "published") {
+				const failedPluginServers = failedPluginMcpManagerServers.get(manager);
+				const catalogTools = catalog.tools
+					.filter(tool => {
+						const serverName = tool.mcpServerName;
+						return (
+							serverName !== undefined &&
+							(!failedPluginServers?.has(serverName) || manager.getConnectionStatus(serverName) === "connected")
+						);
+					})
+					.map(tool => tool as CustomTool);
+				if (!sameMcpToolSnapshot(catalogTools, ownedMcpManagerTools)) {
+					void syncOwnedMcpTools(catalog.tools.map(tool => tool as CustomTool));
+				}
+			} else if (!pluginMcpCleanupFailures.has(manager)) {
+				void syncOwnedMcpTools(ownedMcpManagerTools);
+			}
 		};
 		const wireOwnedMcpManagerLifecycle = (): void => {
 			if (!mcpManager) return;
@@ -5204,20 +5627,66 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			postmortem.register("mcp-notification-cleanup", clearDebounceTimers);
 			wireMcpManagerCallbacks(mcpManager);
 		};
+		const wireInheritedMcpToolSync = async (): Promise<void> => {
+			const manager = inheritedMcpManager;
+			if (!manager) return;
+			let inheritedMcpToolsSync: Promise<void> = Promise.resolve();
+			const syncInheritedTools = (tools: readonly CustomTool[]): Promise<void> => {
+				const snapshot = [...tools];
+				inheritedMcpToolsSync = inheritedMcpToolsSync
+					.then(async () => {
+						if (session.isDisposed) return;
+						const previousNames = inheritedMcpManagerToolNames;
+						const nextNames = snapshot.map(tool => tool.name);
+						const classifiedTools = classifyInheritedMcpToolNames(manager, snapshot);
+						try {
+							await session.replaceNamedCustomTools(previousNames, snapshot, {
+								mandatoryMCPToolNames: classifiedTools.pluginMcpToolNames,
+								activateNewTools: false,
+							});
+						} catch (error) {
+							inheritedMcpManagerToolNames = [...new Set([...previousNames, ...nextNames])];
+							throw error;
+						}
+						inheritedMcpManagerToolNames = nextNames;
+						pluginMcpToolNames.splice(0, pluginMcpToolNames.length, ...classifiedTools.pluginMcpToolNames);
+						conventionalMcpToolNames.splice(
+							0,
+							conventionalMcpToolNames.length,
+							...classifiedTools.conventionalMcpToolNames,
+						);
+					})
+					.catch(error => {
+						logger.warn("Failed to publish inherited MCP tools", { error: safeErrorForLog(error) });
+					});
+				return inheritedMcpToolsSync;
+			};
+			inheritedMcpToolsPublisher = tools => {
+				void syncInheritedTools(tools);
+			};
+			session.registerToolSessionCleanup(async () => {
+				stopInheritedMcpToolsSubscription();
+				await inheritedMcpToolsSync;
+			});
+			const initialSnapshot = pendingInheritedMcpToolsSnapshot ?? inheritedMcpToolsSnapshot;
+			pendingInheritedMcpToolsSnapshot = undefined;
+			await syncInheritedTools(initialSnapshot);
+		};
 		// Exact-config managers do not receive reactive callbacks; their tools are
 		// registered once in the session-owned catalog. A pending conventional
 		// deferral wires its own callbacks from the starter after it connects, so
 		// nothing is wired here yet.
 		if (mcpManager && !options.mcpManager && explicitMcpConfigPath === undefined && !deferredConventionalMcp) {
-			if (publishOwnedConventionalMcpTools) {
-				wireOwnedConventionalToolSync();
+			if (publishOwnedMcpTools) {
+				wireOwnedMcpToolSync();
 			} else if (!ownsMcpManager) {
 				mcpManager.setOnToolsChanged(tools => {
-					void session.refreshMCPTools(tools);
+					void session.refreshMCPTools(tools.map(tool => tool as CustomTool));
 				});
 			}
 			wireOwnedMcpManagerLifecycle();
 		}
+		await wireInheritedMcpToolSync();
 
 		// Constructor-time workflow-gate tool restoration is deferred by one
 		// microtask (the ToolSession closure needs `session` assigned). Await it
@@ -5289,6 +5758,8 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 								conventional.sources,
 								conventional.conventionalConfigs,
 								new Set<string>(),
+								new Map<string, GjcPluginMcpServerProvenance>(),
+								conventional.cleanup,
 							);
 							const resultTools = result.tools as CustomTool[];
 							if (!cancelled && !session.isDisposed) {
@@ -5298,7 +5769,7 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 								// before this registration would therefore drop a persisted conventional
 								// MCP selection and persist the empty set.
 								await session.refreshMCPTools(resultTools);
-								wireOwnedConventionalToolSync();
+								wireOwnedMcpToolSync(resultTools);
 								wireOwnedMcpManagerLifecycle();
 								if (
 									!session.isDisposed &&
@@ -5356,6 +5827,7 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 	} catch (error) {
 		// Release the subscription if the throw happened after install but before the
 		// dispose-wrap took ownership.
+		stopInheritedMcpToolsSubscription();
 		releaseCredentialDisabledSubscription();
 		let cleanupDiagnostic: unknown;
 		try {