@gajae-code/coding-agent 0.18.8 → 0.18.10

package/src/session/internal/managed-session-storage.ts

@@ -1280,8 +1280,8 @@ export function retainManagedDirectoryAuthority(
 	expected?: { dev: bigint; ino: bigint },
 ): RecoveryFsRoot | undefined {
 	assertManagedDirectoryRoot(root);
-	managedRelativePath(root, directory);
-	const resolved = path.resolve(directory);
+	const resolved = canonicalizeManagedPathWithinRoot(root.canonicalPath, directory);
+	const relative = managedRelativePath(root, resolved).join("/");
 	if (process.platform !== "linux") return undefined;
 	const named = fs.lstatSync(resolved, { bigint: true });
 	if (!named.isDirectory() || named.isSymbolicLink()) throw new Error("Managed directory authority is unavailable");
@@ -1297,7 +1297,6 @@ export function retainManagedDirectoryAuthority(
 			retainedRoot.identity.ino !== root.ino.toString()
 		)
 			throw new Error("Managed root authority changed");
-		const relative = path.relative(root.canonicalPath, resolved).split(path.sep).join("/");
 		const rootRecovery = rootAuthority.recoveryReaperMetrics();
 		const rootRecoveryUnhealthy = !rootRecovery.ok || Boolean(rootRecovery.code);
 		if (rootRecoveryUnhealthy)
@@ -1366,14 +1365,79 @@ function ensureManagedRoot(root: ManagedDirectoryRoot): void {
 	assertManagedDirectoryRoot(root);
 }
 
-function managedRelativePath(root: ManagedDirectoryRoot, pathname: string): readonly string[] {
-	const relative = path.relative(root.canonicalPath, path.resolve(pathname));
+/** Resolve aliases above a managed root without following descendant symlinks. */
+function canonicalizeManagedPathWithinRoot(rootPath: string, pathname: string): string {
+	const canonicalRootPath = path.resolve(rootPath);
+	const namedRoot = fs.lstatSync(canonicalRootPath);
+	if (!namedRoot.isDirectory() || namedRoot.isSymbolicLink())
+		throw new Error(`Managed root authority changed: ${canonicalRootPath}`);
+	const resolvedPath = path.resolve(pathname);
+	const filesystemRoot = path.parse(resolvedPath).root;
+	const components = path.relative(filesystemRoot, resolvedPath).split(path.sep).filter(Boolean);
+	let currentPath = filesystemRoot;
+	let reachedManagedRoot = currentPath === canonicalRootPath;
+	if (reachedManagedRoot) currentPath = canonicalRootPath;
+
+	for (let index = 0; index < components.length; index++) {
+		const component = components[index]!;
+		const nextPath = path.join(currentPath, component);
+		if (!reachedManagedRoot) {
+			let canonicalPrefix: string;
+			try {
+				canonicalPrefix = fs.realpathSync.native(nextPath);
+			} catch (error) {
+				const code = (error as NodeJS.ErrnoException).code;
+				if (code === "ENOENT" || code === "ENOTDIR")
+					throw new Error(`Managed path escapes configured root: ${pathname}`, { cause: error });
+				throw error;
+			}
+			if (canonicalPrefix === canonicalRootPath) {
+				reachedManagedRoot = true;
+				currentPath = canonicalRootPath;
+				continue;
+			}
+			currentPath = nextPath;
+			continue;
+		}
+
+		let named: fs.Stats;
+		try {
+			named = fs.lstatSync(nextPath);
+		} catch (error) {
+			const code = (error as NodeJS.ErrnoException).code;
+			if (code === "ENOENT") return path.join(currentPath, ...components.slice(index));
+			throw error;
+		}
+		if (named.isSymbolicLink()) throw new Error(`Managed path contains symlink: ${nextPath}`);
+		if (index < components.length - 1 && !named.isDirectory())
+			throw new Error(`Managed path component is not a directory: ${nextPath}`);
+		currentPath = nextPath;
+	}
+
+	if (!reachedManagedRoot) throw new Error(`Managed path escapes configured root: ${pathname}`);
+	return currentPath;
+}
+
+function relativeWithinManagedRoot(rootPath: string, pathname: string): readonly string[] {
+	const canonicalPath = canonicalizeManagedPathWithinRoot(rootPath, pathname);
+	const relative = path.relative(rootPath, canonicalPath);
+	if (process.platform === "win32") {
+		const canonicalRoot = path.win32.normalize(rootPath);
+		const canonicalCandidate = path.win32.normalize(canonicalPath);
+		const rootPrefix = canonicalRoot.endsWith(path.win32.sep) ? canonicalRoot : `${canonicalRoot}${path.win32.sep}`;
+		if (canonicalCandidate !== canonicalRoot && !canonicalCandidate.startsWith(rootPrefix))
+			throw new Error(`Managed path escapes configured root: ${pathname}`);
+	}
 	if (relative === "") return [];
 	if (path.isAbsolute(relative) || relative.split(path.sep).includes(".."))
 		throw new Error(`Managed path escapes configured root: ${pathname}`);
 	return relative.split(path.sep);
 }
 
+function managedRelativePath(root: ManagedDirectoryRoot, pathname: string): readonly string[] {
+	return relativeWithinManagedRoot(root.canonicalPath, pathname);
+}
+
 const PROCESS_START_ID = randomUUID();
 
 class ManagedSecurityError extends Error {
@@ -1538,16 +1602,46 @@ export class ManagedSessionDescendantStore {
 		if (access === "read-only" && retained) throw new Error("managed_read_store_cannot_borrow_authority");
 		if (access === "read-only" && !expectedSubtreeRoot)
 			throw new Error("managed_read_store_requires_existing_identity");
-		managedRelativePath(root, baseDir);
+		assertManagedDirectoryRoot(root);
+		let canonicalBaseDir: string;
+		try {
+			canonicalBaseDir = canonicalizeManagedPathWithinRoot(root.canonicalPath, baseDir);
+		} catch (error) {
+			// If canonicalization fails with a symlink error on a retained path,
+			// the binding has changed: the path no longer resolves to the original inode.
+			if (retained && error instanceof Error && error.message.startsWith("Managed path contains symlink:")) {
+				throw new Error("Managed descendant root binding changed");
+			}
+			throw error;
+		}
+		let canonicalAuthorityBaseDir: string;
+		if (retained) {
+			try {
+				canonicalAuthorityBaseDir = canonicalizeManagedPathWithinRoot(
+					root.canonicalPath,
+					retained.authorityBaseDir,
+				);
+			} catch (error) {
+				// If canonicalization fails with a symlink error on a retained path,
+				// the binding has changed: the path no longer resolves to the original inode.
+				if (error instanceof Error && error.message.startsWith("Managed path contains symlink:")) {
+					throw new Error("Managed descendant root binding changed");
+				}
+				throw error;
+			}
+		} else {
+			canonicalAuthorityBaseDir = canonicalBaseDir;
+		}
+		managedRelativePath(root, canonicalBaseDir);
 
 		this.#root = root;
-		this.#baseDir = path.resolve(baseDir);
+		this.#baseDir = canonicalBaseDir;
 		this.#policy = policy ?? "default";
 		this.#access = access;
 		this.#profileAgentDir = profileAgentDir ?? root.canonicalPath;
-		this.#authorityBaseDir = retained?.authorityBaseDir ?? this.#baseDir;
+		this.#authorityBaseDir = canonicalAuthorityBaseDir;
 		if (retained) {
-			const relative = path.relative(retained.authorityBaseDir, this.#baseDir).split(path.sep).join("/");
+			const relative = relativeWithinManagedRoot(canonicalAuthorityBaseDir, this.#baseDir).join("/");
 			// For the root case (authorityBaseDir === baseDir, relative === ""), the
 			// stable identity() result carries the exact root dev/inode without
 			// snapshotting the entire live session tree. snapshotManagedTree("")
@@ -2668,12 +2762,18 @@ export class ManagedSessionDescendantStore {
 				canonicalFileId(rootBefore.ino) !== this.#subtreeRoot.ino
 			)
 				throw new Error("Managed descendant root binding changed");
-			let fd: number | undefined;
+			let fd: number;
 			try {
 				fd = fs.openSync(
 					resolved,
 					fs.constants.O_RDONLY | fs.constants.O_NONBLOCK | (fs.constants.O_NOFOLLOW ?? 0),
 				);
+			} catch (error) {
+				if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
+				throw error;
+			}
+			let descriptor: SessionStorageStat;
+			try {
 				const opened = fs.fstatSync(fd, { bigint: true });
 				const named = fs.lstatSync(resolved, { bigint: true });
 				if (
@@ -2695,7 +2795,7 @@ export class ManagedSessionDescendantStore {
 				)
 					throw new Error("Managed descendant root binding changed");
 				this.#assertBound();
-				return managedAppendReceiptFromIdentity({
+				descriptor = managedAppendReceiptFromIdentity({
 					dev: canonicalFileId(opened.dev),
 					ino: canonicalFileId(opened.ino),
 					nlink: opened.nlink,
@@ -2704,11 +2804,13 @@ export class ManagedSessionDescendantStore {
 					ctimeNs: opened.ctimeNs,
 				}).descriptor;
 			} catch (error) {
-				if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
+				try {
+					fs.closeSync(fd);
+				} catch {}
 				throw error;
-			} finally {
-				if (fd !== undefined) fs.closeSync(fd);
 			}
+			fs.closeSync(fd);
+			return descriptor;
 		}
 		const stat = this.#authority.stat(this.#relative(resolved));
 		if (!stat.ok) {
@@ -2759,6 +2861,7 @@ export class ManagedSessionDescendantStore {
 			resolved,
 			fs.constants.O_RDONLY | fs.constants.O_NONBLOCK | (fs.constants.O_NOFOLLOW ?? 0),
 		);
+		let snapshot: SessionStorageRangeSnapshot;
 		try {
 			const before = fs.fstatSync(fd, { bigint: true });
 			if (!before.isFile() || before.nlink > 1n) throw new Error("source_changed");
@@ -2820,7 +2923,7 @@ export class ManagedSessionDescendantStore {
 			)
 				throw new Error("Managed descendant root binding changed");
 			this.#assertBound();
-			return {
+			snapshot = {
 				bytes,
 				stat: {
 					dev: canonicalFileId(after.dev),
@@ -2834,9 +2937,14 @@ export class ManagedSessionDescendantStore {
 					isFile: true,
 				},
 			};
-		} finally {
-			fs.closeSync(fd);
+		} catch (error) {
+			try {
+				fs.closeSync(fd);
+			} catch {}
+			throw error;
 		}
+		fs.closeSync(fd);
+		return snapshot;
 	}
 
 	/** Open an identity-bound stream lease; Darwin uses exact bounded range reads per chunk. */

package/src/session/session-manager.ts

@@ -17274,6 +17274,18 @@ export class SessionManager {
 		if (observedPersistError && outcome.kind === "closed") {
 			return { kind: "close_unknown", error: observedPersistError };
 		}
+		// Always release managed sidecar cache to prevent file handle leaks on Windows (#6566).
+		// This must happen even if the close is retryable, because the sidecar cache holds
+		// directory handles that prevent temp directory deletion during test cleanup.
+		if (!observedPersistError && !this.#persistWriter && outcome.kind === "closed") {
+			try {
+				this.#releaseManagedSidecarCache();
+			} catch (error) {
+				logger.warn("Failed to release managed sidecar cache during closeStrict", {
+					error: String(error),
+				});
+			}
+		}
 		return outcome;
 	}
 

package/src/session/session-storage.ts

@@ -822,6 +822,34 @@ function secureOwnerOnlyFileDescriptor(
 	if (!result.ok) throw new Error(`Owner-only security rejected ${pathname}: ${result.code}`);
 }
 
+/**
+ * Replace an explicit session file. Creation mode `0600` does not install a
+ * Windows owner-only DACL, so this applies and verifies the same native path a
+ * primary transcript uses when it has no managed security context. POSIX mode
+ * stays `0600`.
+ */
+export function writeExplicitOwnerOnlyTextSync(pathname: string, content: string): void {
+	const fd = fs.openSync(
+		pathname,
+		fs.constants.O_WRONLY | fs.constants.O_CREAT | (fs.constants.O_NOFOLLOW ?? 0),
+		0o600,
+	);
+	try {
+		secureOwnerOnlyFileDescriptor(pathname, fd, "apply", undefined);
+		fs.ftruncateSync(fd, 0);
+		const bytes = Buffer.from(content, "utf8");
+		let offset = 0;
+		while (offset < bytes.byteLength) {
+			const written = fs.writeSync(fd, bytes, offset, bytes.byteLength - offset);
+			if (written === 0) throw new Error("Short write");
+			offset += written;
+		}
+		secureOwnerOnlyFileDescriptor(pathname, fd, "verify", undefined);
+	} finally {
+		fs.closeSync(fd);
+	}
+}
+
 /** Reject a symlink/junction/reparse component before a storage path is created or opened. */
 function assertNoReparsePath(pathname: string): void {
 	const resolved = path.resolve(pathname);
@@ -2073,7 +2101,8 @@ export class FileSessionStorage implements SessionStorage {
 
 	writeTextSync(fpath: string, content: string): void {
 		this.ensureDirSync(path.dirname(fpath));
-		fs.writeFileSync(fpath, content);
+		// New fork and branch transcripts are created here.
+		writeExplicitOwnerOnlyTextSync(fpath, content);
 	}
 
 	readTextSync(fpath: string): string {

package/src/skill-state/active-state.ts

@@ -17,6 +17,7 @@ import {
 	rebuildActiveSnapshot,
 	removeActiveEntry,
 	setActiveStateCacheInvalidator,
+	workflowEnvelopeChecksumStatus,
 	writeActiveEntry,
 } from "../gjc-runtime/state-writer";
 import { getSkillManifest } from "../gjc-runtime/workflow-manifest";
@@ -519,6 +520,18 @@ async function readModeStatePhase(
 		const phase = safeString(record.current_phase).trim();
 		if (!phase) return undefined;
 		if (record.active === false && !getSkillManifest("ralplan").canonicalOverrides.includes(phase)) return undefined;
+		const claimedSession = safeString(record.session_id).trim();
+		if (claimedSession && claimedSession !== sessionId) return undefined;
+		// A mode-state phase may replace the active entry only when the writer
+		// stamp still matches. A checksum mismatch is an out-of-band edit. An
+		// unsigned releasing phase is not a seal and must not paint "complete"
+		// onto a planning entry. Non-releasing canonical phases (final, handoff)
+		// still overlay, and a matching stamp still overlays a releasing phase.
+		const checksum = workflowEnvelopeChecksumStatus(record);
+		if (checksum === "mismatch") return undefined;
+		if (checksum === "absent" && getSkillManifest(skill).stopReleasingPhases.includes(phase.trim().toLowerCase())) {
+			return undefined;
+		}
 		return phase;
 	} catch {
 		return undefined;

package/src/skill-state/workflow-mutation-guard.ts

@@ -8,8 +8,10 @@ import { expandApplyPatchToEntries } from "../edit/modes/apply-patch";
 import { GJC_SESSION_PREFIX, modeStatePath as sessionModeStatePath } from "../gjc-runtime/session-layout";
 import { resolveGjcSessionForRead } from "../gjc-runtime/session-resolution";
 import { ModeStateSchema } from "../gjc-runtime/state-schema";
+import { workflowEnvelopeChecksumStatus } from "../gjc-runtime/state-writer";
 import { getSkillManifest } from "../gjc-runtime/workflow-manifest";
 import { LocalProtocolHandler, resolveLocalUrlToPath } from "../internal-urls/local-protocol";
+import { isGithubReadOnlyArgs } from "../tools/github-side-effect";
 import { resolveToCwd } from "../tools/path-utils";
 import { ToolError } from "../tools/tool-errors";
 import { listActiveSkills, readVisibleSkillActiveState, type SkillActiveEntry } from "./active-state";
@@ -38,7 +40,14 @@ function planningPhaseBlockMessage(skill: CanonicalGjcWorkflowSkill): string {
 	return DEEP_INTERVIEW_MUTATION_BLOCK_MESSAGE;
 }
 
-const BLOCKED_TOOL_NAMES = new Set(["edit", "write", "ast_edit", "bash"]);
+/** Tools whose execute path can mutate product state. `github` is included so side-effect ops share this guard. */
+export const WORKFLOW_MUTATION_TOOL_NAMES = ["edit", "write", "ast_edit", "bash", "github"] as const;
+
+const BLOCKED_TOOL_NAMES = new Set<string>(WORKFLOW_MUTATION_TOOL_NAMES);
+
+export function isWorkflowMutationTool(name: string): boolean {
+	return BLOCKED_TOOL_NAMES.has(name);
+}
 /**
  * Only `/dev/null` is exempt. `/dev/stdout`, `/dev/stderr`, and `/dev/fd/<n>` are descriptor
  * aliases: `exec 1<>src/product.ts; printf x >/dev/stdout` reaches a real repository file
@@ -317,10 +326,20 @@ function resolveCurrentWorkflowEntry(entries: SkillActiveEntry[], topLevelSkill:
  * governs, so a stale planning entry can never block while an executor runs and
  * a resumed planning phase reliably re-blocks.
  *
- * Fail-open contract: a missing or invalid durable mode-state releases the block
- * (a corrupt state file must not lock all mutation), matching the guard's
- * historical behavior — this is intentionally looser than the Stop hook, which
- * fails closed for handoff-required skills.
+ * Fail-open contract: a missing or schema-invalid durable mode-state releases
+ * the block (a corrupt state file must not lock all mutation), matching the
+ * guard's historical behavior — this is intentionally looser than the Stop
+ * hook, which fails closed for handoff-required skills. A checksum mismatch is
+ * not that case: the file is still schema-valid, and the CLI already refuses
+ * it as an out-of-band edit. The guard keeps the active entry's phase instead
+ * of letting the forged `current_phase` or `active: false` release the block.
+ * An unsigned envelope may restate that entry, but it may not release a block
+ * the entry still holds. It may still name a stricter blocking phase: the
+ * pre-fix guard honored that phase, and dropping it would allow an edit the
+ * base rejected. A `session_id` or `thread_id` that does not match this
+ * session is the same kind of claim: it does not make the file someone else's,
+ * and it does not open the block. A matching `content_sha256` whose context
+ * also matches is the existing writer stamp and is trusted.
  */
 async function getActivePlanningSkill(
 	cwd: string,
@@ -343,11 +362,73 @@ async function getActivePlanningSkill(
 	const modeState = guardContext.modeStates.get(current.skill) ?? null;
 
 	if (!modeState) return null;
-	if (modeState.active !== true) return null;
-	if (!modeStateMatchesContext(modeState, resolvedSessionId, threadId)) return null;
-	const phase = String(modeState.current_phase ?? current.phase ?? "").trim();
-	if (!isBlockingPlanningPhase(current.skill, phase)) return null;
-	return { skill: current.skill, phase };
+	const activePhase = String(current.phase ?? "").trim();
+	const posture = planningPostureFromModeState(current.skill, activePhase, modeState, resolvedSessionId, threadId);
+	if (posture.tampered) {
+		warnInvalidModeState(
+			modeStatePath(cwd, current.skill, resolvedSessionId),
+			"out-of-band edit detected (content_sha256 mismatch)",
+		);
+	}
+	if (!posture.blocking) return null;
+	return { skill: current.skill, phase: posture.phase };
+}
+
+/**
+ * Decide whether `modeState` may release the planning block.
+ *
+ * The active entry is the seal. A mode-state file releases that seal only when
+ * its writer-stamped `content_sha256` matches and its session context matches,
+ * or when an unsigned file in the same context does not claim a looser posture
+ * than the entry. An unsigned file may still impose a stricter blocking phase.
+ * Checksum mismatch ignores the file. A context mismatch does not release the
+ * entry's block: the file was read from this session's path.
+ */
+function planningPostureFromModeState(
+	skill: MutationGatedSkill,
+	activePhase: string,
+	modeState: ModeState,
+	sessionId?: string,
+	threadId?: string,
+): { blocking: boolean; phase: string; tampered: boolean } {
+	const status = workflowEnvelopeChecksumStatus(modeState);
+	if (status === "mismatch") {
+		return {
+			blocking: isBlockingPlanningPhase(skill, activePhase),
+			phase: activePhase,
+			tampered: true,
+		};
+	}
+	if (!modeStateMatchesContext(modeState, sessionId, threadId)) {
+		return {
+			blocking: isBlockingPlanningPhase(skill, activePhase),
+			phase: activePhase,
+			tampered: false,
+		};
+	}
+	if (status === "match") {
+		if (modeState.active !== true) return { blocking: false, phase: activePhase, tampered: false };
+		const phase = String(modeState.current_phase ?? activePhase).trim();
+		return { blocking: isBlockingPlanningPhase(skill, phase), phase, tampered: false };
+	}
+	if (!isBlockingPlanningPhase(skill, activePhase)) {
+		const stricterPhase = String(modeState.current_phase ?? "").trim();
+		if (modeState.active === true && stricterPhase && isBlockingPlanningPhase(skill, stricterPhase)) {
+			return { blocking: true, phase: stricterPhase, tampered: false };
+		}
+		return { blocking: false, phase: activePhase, tampered: false };
+	}
+	if (modeState.active !== true) return { blocking: true, phase: activePhase, tampered: false };
+	const modePhase = String(modeState.current_phase ?? "").trim();
+	if (
+		modePhase &&
+		!isBlockingPlanningPhase(skill, modePhase) &&
+		modePhase.trim().toLowerCase() !== activePhase.trim().toLowerCase()
+	) {
+		return { blocking: true, phase: activePhase, tampered: false };
+	}
+	const phase = modePhase || activePhase;
+	return { blocking: isBlockingPlanningPhase(skill, phase), phase, tampered: false };
 }
 
 function normalizePosix(value: string): string {
@@ -1607,11 +1688,22 @@ function extractBashTargets(args: unknown, depth = 0): ExtractedTargets {
 	}
 	return targets;
 }
+/**
+ * Read-only github ops extract no mutation. Every other op fails closed during
+ * planning: remote push, PR creation, and worktree/config writes are not a
+ * filesystem path the planning allowlist can clear.
+ */
+function extractGithubTargets(args: unknown): ExtractedTargets {
+	if (isGithubReadOnlyArgs(args)) return { paths: [], unknown: false };
+	return { paths: [], unknown: true, explicitMutation: true };
+}
+
 function extractTargets(tool: ToolWithEditMode, args: unknown): ExtractedTargets {
 	if (tool.name === "write") return extractWriteTargets(args);
 	if (tool.name === "ast_edit") return extractAstEditTargets(args);
 	if (tool.name === "edit") return extractEditTargets(args, tool);
 	if (tool.name === "bash") return extractBashTargets(args);
+	if (tool.name === "github") return extractGithubTargets(args);
 	return { paths: [], unknown: true };
 }
 

package/src/slash-commands/builtin-registry.ts

@@ -1050,7 +1050,6 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 						runtime,
 					);
 				}
-				if (targetIds.some(targetId => targetId !== "default")) runtime.session.markUserModelSelection();
 				// Preset shortcut: when the selector names a known model profile
 				// (optionally `gajae-code/`-prefixed) and the target is implicit,
 				// activate the profile immediately instead of treating the preset name
@@ -1113,6 +1112,7 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 							throw new Error(`No API key for ${selection.model.provider}/${selection.model.id}`);
 						}
 					}
+					if (includesRoleAgent && !includesDefault) runtime.session.markUserModelSelection();
 
 					const overrides = runtime.settings.get("task.agentModelOverrides");
 					const assignments = new Map<GjcModelAssignmentTargetId, string>();

package/src/slash-commands/helpers/mcp.ts

@@ -9,6 +9,7 @@ import {
 	updateMCPServer,
 } from "../../runtime-mcp/config-writer";
 import { MCPManager } from "../../runtime-mcp/manager";
+import { nativeMcpSource } from "../../runtime-mcp/project-host-values";
 import { getSmitheryApiKey } from "../../runtime-mcp/smithery-auth";
 import { searchSmitheryRegistry } from "../../runtime-mcp/smithery-registry";
 import type { MCPServerConfig, MCPServerConnection } from "../../runtime-mcp/types";
@@ -199,6 +200,7 @@ async function withPreparedMcpConnection<T>(
 	runtime: SlashCommandRuntime,
 	name: string,
 	config: MCPServerConfig,
+	scope: AcpMcpScope,
 	fn: (connection: MCPServerConnection) => Promise<T>,
 ): Promise<T> {
 	const manager = new MCPManager(runtime.cwd, null, {
@@ -207,7 +209,9 @@ async function withPreparedMcpConnection<T>(
 	// Auth storage must be wired in before the prepared lease so OAuth-backed
 	// servers can refresh credentials and inject Authorization headers.
 	manager.setAuthStorage(runtime.session.modelRegistry.authStorage);
-	return manager.withPreparedLease(name, config, lease => fn(lease.connectionForLease()));
+	return manager.withPreparedLease(name, config, lease => fn(lease.connectionForLease()), {
+		source: nativeMcpSource(scope, getMCPConfigPath(scope, runtime.cwd)),
+	});
 }
 
 async function collectConnectedMcpLines(
@@ -218,9 +222,9 @@ async function collectConnectedMcpLines(
 	if (servers.length === 0) return undefined;
 
 	const lines: string[] = [];
-	for (const { name, config } of servers) {
+	for (const { name, config, scope } of servers) {
 		try {
-			const collected = await withPreparedMcpConnection(runtime, name, config, connection =>
+			const collected = await withPreparedMcpConnection(runtime, name, config, scope, connection =>
 				collect(name, connection),
 			);
 			lines.push(...collected);
@@ -265,7 +269,7 @@ async function handleTestCommand(rest: string, runtime: SlashCommandRuntime): Pr
 	if (!server) return usage(`Server "${name}" not found. Run /mcp list to see configured servers.`, runtime);
 
 	try {
-		return await withPreparedMcpConnection(runtime, name, server.config, async connection => {
+		return await withPreparedMcpConnection(runtime, name, server.config, server.scope, async connection => {
 			const tools = await listTools(connection);
 			const lines = [`Server "${name}" connected (${tools.length} tools).`];
 			for (const tool of tools) lines.push(`  - ${tool.name}`);