@gotgenes/pi-permission-system 36.2.1 → 38.0.0

package/src/handlers/before-agent-start.ts

@@ -1,16 +1,20 @@
 import type {
   BeforeAgentStartEventResult,
   ExtensionContext,
+  NormalizedBuildSystemPromptOptions,
 } from "@earendil-works/pi-coding-agent";
 import type { SubagentDetector } from "#src/authority/subagent-detection";
-import { resolveSkillPromptEntries } from "#src/exposure/skill-prompt-sanitizer";
+import {
+  visibleSkillPromptEntries,
+  withoutDeniedSkills,
+} from "#src/exposure/skill-prompt-sanitizer";
 import {
   type RegisteredTools,
   readRegisteredTools,
   type ToolRegistry,
 } from "#src/exposure/tool-registry";
 import type { ToolSurfaceObservation } from "#src/exposure/tool-surface-baseline";
-import { renderToolSurface } from "#src/exposure/tool-surface-prompt";
+import { renderToolSurfaceSections } from "#src/exposure/tool-surface-prompt";
 import type { DebugLogger } from "#src/logging/session-logger";
 import type { PermissionResolver } from "#src/policy/permission-resolver";
 import type { PermissionSession } from "#src/session/permission-session";
@@ -18,22 +22,20 @@ import type { TurnPreparation } from "./session-turn-prep";
 
 /** Minimal subset of BeforeAgentStartEvent used by this handler. */
 interface BeforeAgentStartPayload {
-  systemPrompt: string;
+  /** The prompt rendered from `systemPromptOptions` as it stands right now. */
+  readonly systemPrompt: string;
   /**
-   * The parts Pi assembled the prompt from. `toolSnippets` is what lets this
-   * handler render the session's own tool list instead of editing the one Pi
-   * wrote — including in a child, whose inherited identity carries none.
-   * `customPrompt` says whether Pi wrote a preamble at all: under one, it
-   * writes no tool surface, so there is nothing of Pi's to remove, and a root
-   * node adds none either.
-   * `promptGuidelines` carries rules other extensions added, which removing
-   * Pi's own rules section would otherwise drop.
+   * The mutable parts Pi renders the prompt from; later handlers, and Pi
+   * itself, see what this handler writes here. `customPrompt` says whether Pi
+   * wrote a preamble at all: under one, it writes no tool surface.
+   * `toolSnippets` and `promptGuidelines` are what a child's own tool surface
+   * renders from, and `sections` is where it is stated. `skills` is the
+   * catalogue Pi renders, which policy narrows.
    */
-  systemPromptOptions?: {
-    customPrompt?: string;
-    toolSnippets?: Record<string, string>;
-    promptGuidelines?: readonly string[];
-  };
+  systemPromptOptions: Pick<
+    NormalizedBuildSystemPromptOptions,
+    "customPrompt" | "toolSnippets" | "promptGuidelines" | "sections" | "skills"
+  >;
 }
 
 /**
@@ -54,17 +56,16 @@ export function shouldExposeTool(
 /**
  * Handles the `before_agent_start` event: tool filtering + prompt sanitization.
  *
- * Recomputes the active tool set and the returned system-prompt override on
- * every fire (no memoization): the override must be returned each turn so that
- * skill filtering is reapplied and the wire prompt stays stable across turns,
- * rather than letting Pi reset to its skill-unfiltered base prompt on a cache
- * hit.
+ * Every change to the prompt is stated through `event.systemPromptOptions`,
+ * never as a returned `systemPrompt`: a returned prompt is frozen for the run,
+ * so the sections an extension later in the chain adds (Pi's own
+ * `<mcp_servers>` among them) would never reach the provider (#999).
  *
- * The tool surface is relocated rather than edited in place, so a subagent
- * child's inherited identity stays byte-identical to its parent's (#890).
- * A root node whose prompt Pi built from a custom one states no tool surface,
- * matching Pi, which writes none there; a subagent child's prompt is always a
- * custom one, and it still states its own tools.
+ * Narrowing the active set is enough for a prompt Pi wrote: Pi renders its
+ * `<tools>` and `<rules>` from the reconciled active set. A subagent child's
+ * prompt is always a custom one, under which Pi writes neither, so a child
+ * states its own as `sections`, which Pi places after its `<cwd>` section. A
+ * root under a custom prompt states none, matching Pi.
  *
  * Constructor deps:
  * - `turnPrep` — brings the node up to date for the turn before anything reads
@@ -116,40 +117,53 @@ export class AgentPrepHandler {
       });
     }
 
-    const toolSurfacePrompt = this.statesOwnToolSurface(event, ctx)
-      ? renderToolSurface(event.systemPrompt, {
-          allowedTools,
-          toolSnippets: event.systemPromptOptions?.toolSnippets ?? {},
-          guidelinesByTool: registered.guidelinesByTool,
-          promptGuidelines: event.systemPromptOptions?.promptGuidelines ?? [],
-          piAuthoredPreamble: !hasCustomPrompt(event),
-        })
-      : event.systemPrompt;
-    const skillPromptResult = resolveSkillPromptEntries(
-      toolSurfacePrompt,
+    const options = event.systemPromptOptions;
+    if (this.isSubagentUnderCustomPrompt(event, ctx)) {
+      const sections = renderToolSurfaceSections({
+        allowedTools,
+        toolSnippets: options.toolSnippets,
+        guidelinesByTool: registered.guidelinesByTool,
+        promptGuidelines: options.promptGuidelines,
+      });
+      // An empty section is one Pi leaves out, so this also clears a stale peer list.
+      options.sections.tools = sections.tools ?? "";
+      options.sections.rules = sections.rules;
+    }
+
+    // Path-match entries come from every catalogue the rendered prompt lists,
+    // read before the skill list is narrowed.
+    this.session.setActiveSkillEntries(
+      visibleSkillPromptEntries(
+        event.systemPrompt,
+        this.resolver,
+        agentName,
+        this.session.getPathNormalizer(),
+      ),
+    );
+    // Denials are judged on the list Pi renders `<skills>` from, not on the
+    // rendered prompt: that prompt predates this turn's tool changes, and on
+    // the turn `read`/`bash` return from a full denial it lists no catalogue.
+    options.skills = withoutDeniedSkills(
+      options.skills,
       this.resolver,
       agentName,
-      this.session.getPathNormalizer(),
     );
-    this.session.setActiveSkillEntries(skillPromptResult.entries);
-    return skillPromptResult.prompt !== event.systemPrompt
-      ? { systemPrompt: skillPromptResult.prompt }
-      : {};
+    return {};
   }
 
   /**
-   * Whether this node renders its own tool surface into the prompt.
+   * Whether this node states its own tool surface through `sections`.
    *
-   * Every node does except a root whose prompt Pi built from a custom one:
-   * there Pi writes no tool list or rules, and the operator's prompt is left
-   * as Pi built it. A subagent child's prompt is always a custom one, and its
-   * inherited identity carries no tool list, so it still states its own.
+   * Only a subagent child does: its prompt is always a custom one, under which
+   * Pi writes no tool list or rules, and its inherited identity carries none
+   * either. A root needs none — Pi renders its own from the narrowed active
+   * set, or, under an operator's custom prompt, deliberately writes none.
    */
-  private statesOwnToolSurface(
+  private isSubagentUnderCustomPrompt(
     event: BeforeAgentStartPayload,
     ctx: ExtensionContext,
   ): boolean {
-    return !hasCustomPrompt(event) || this.detector.isSubagent(ctx);
+    return hasCustomPrompt(event) && this.detector.isSubagent(ctx);
   }
 
   private observeToolSurface(
@@ -167,5 +181,5 @@ export class AgentPrepHandler {
  * test, so an empty string reads here the way it reads there: as none.
  */
 function hasCustomPrompt(event: BeforeAgentStartPayload): boolean {
-  return Boolean(event.systemPromptOptions?.customPrompt);
+  return Boolean(event.systemPromptOptions.customPrompt);
 }

package/src/handlers/gates/helpers.ts

@@ -116,6 +116,7 @@ export function deriveDecisionValue(
     case "bash":
       return check.command ?? toolName;
     case "mcp":
+    case "mcp-tool":
       return check.target ?? toolName;
     case "path":
     case "skill":

package/src/handlers/gates/tool.ts

@@ -6,6 +6,8 @@ import {
   type ShellInvocation,
 } from "#src/access-intent/tool-kind";
 import {
+  type SessionApprovalSuggestion,
+  suggestExactSessionPattern,
   suggestPathSessionPattern,
   suggestSessionPattern,
 } from "#src/presentation/pattern-suggest";
@@ -56,6 +58,45 @@ function deriveSuggestionValue(
   }
 }
 
+/**
+ * The surface a tool call is gated on.
+ *
+ * A shell invocation (native `bash` or an aliased shell tool) is gated on the
+ * `bash` surface, and a Pi MCP tool on the `mcp` surface — their session rule,
+ * decision value, and suggestion are shaped by that surface — while the
+ * invoked tool name is preserved in the prompt and review log so a user sees
+ * which tool actually ran (#574).
+ */
+function gateSurfaceOf(
+  toolName: string,
+  shell: ShellInvocation | null | undefined,
+): string {
+  if (shell) return "bash";
+  if (classifyToolKind(toolName) === "mcp-tool") return "mcp";
+  return toolName;
+}
+
+/**
+ * The session approval for a gate whose value is not a path.
+ *
+ * A Pi MCP tool is approved by its own full name, which is one of its `mcp`
+ * candidates: exactly the tool asked about, never the wider server prefix the
+ * proxy target heuristic would suggest.
+ */
+function suggestValueSessionPattern(
+  toolName: string,
+  gateSurface: string,
+  check: PermissionCheckResult,
+): SessionApprovalSuggestion {
+  if (classifyToolKind(toolName) === "mcp-tool") {
+    return suggestExactSessionPattern(gateSurface, toolName.trim());
+  }
+  return suggestSessionPattern(
+    gateSurface,
+    deriveSuggestionValue(gateSurface, check),
+  );
+}
+
 /**
  * Build a pure descriptor for the normal tool permission gate.
  *
@@ -69,11 +110,7 @@ export function describeToolGate(
   pathAccess?: ToolPathAccess,
   shell?: ShellInvocation | null,
 ): GateDescriptor {
-  // A shell invocation (native `bash` or an aliased shell tool) is gated on the
-  // `bash` surface — its session rule, decision value, and suggestion are
-  // bash-shaped — while the invoked tool name is preserved in the prompt and
-  // review log so a user sees which tool actually ran (#574).
-  const gateSurface = shell ? "bash" : tcc.toolName;
+  const gateSurface = gateSurfaceOf(tcc.toolName, shell);
 
   const permissionLogContext = formatter.getPermissionLogContext(
     check,
@@ -84,10 +121,7 @@ export function describeToolGate(
   // Compute session approval suggestion for the "for this session" option.
   const suggestion = pathAccess
     ? suggestPathSessionPattern(gateSurface, pathAccess.approvalPattern)
-    : suggestSessionPattern(
-        gateSurface,
-        deriveSuggestionValue(gateSurface, check),
-      );
+    : suggestValueSessionPattern(tcc.toolName, gateSurface, check);
 
   const payload = buildToolAskPayload({
     check,

package/src/policy/normalize.ts

@@ -1,4 +1,8 @@
 import { surfaceFamilyMembers } from "#src/access-intent/path-surfaces";
+import {
+  isPiMcpToolName,
+  PI_MCP_TOOL_PREFIX,
+} from "#src/access-intent/tool-kind";
 import type { FlatPermissionConfig, PatternValue } from "#src/types";
 import { isDenyWithReason, isPermissionState } from "#src/types";
 import type { Rule, Ruleset } from "./rule";
@@ -115,3 +119,46 @@ export function normalizeFlatConfig(permission: FlatPermissionConfig): Ruleset {
   }
   return rules;
 }
+
+/** The rules with relocated copies appended, and the keys that were copied. */
+export interface McpToolKeyRelocation {
+  rules: Ruleset;
+  /** Each relocated surface key, in rule order. */
+  relocatedKeys: string[];
+}
+
+/**
+ * Copy the catch-all rule of every top-level key that can name a Pi MCP tool
+ * onto the `mcp` surface, with the key as its pattern.
+ *
+ * A Pi MCP tool (`mcp__<server>__<tool>`) once resolved on its own name, so a
+ * top-level key naming it (or a surface wildcard such as `mcp__srv__*`) was the
+ * only rule that reached it. The tool now resolves on `mcp`, where its full
+ * name is one of its candidates, so the same key is the same rule there.
+ *
+ * The copies are appended after every other rule, in their original order:
+ * the key was the only rule that applied to the tool before, so it keeps the
+ * final say over the `mcp` rules that newly reach it. The original rule stays
+ * where it was, because a key such as `mcp__*` also matches tools that still
+ * resolve on their own name (`mcp__foo`), and moving it would drop them. A key
+ * that can name no Pi MCP tool (`mcp__foo`) is not copied, and a non-`*`
+ * pattern under any key never matched (a tool surface is evaluated with `*`).
+ */
+export function relocateMcpToolKeyRules(rules: Ruleset): McpToolKeyRelocation {
+  const relocated = rules
+    .filter((rule) => rule.pattern === "*" && canNamePiMcpTool(rule.surface))
+    .map((rule): Rule => ({ ...rule, surface: "mcp", pattern: rule.surface }));
+  return {
+    rules: [...rules, ...relocated],
+    relocatedKeys: relocated.map((rule) => rule.pattern),
+  };
+}
+
+/**
+ * Whether a top-level surface key can match a Pi MCP tool name: the name
+ * itself, or an `mcp__`-prefixed wildcard.
+ */
+function canNamePiMcpTool(surfaceKey: string): boolean {
+  if (isPiMcpToolName(surfaceKey)) return true;
+  return surfaceKey.startsWith(PI_MCP_TOOL_PREFIX) && /[*?]/.test(surfaceKey);
+}

package/src/policy/permission-manager.ts

@@ -21,7 +21,7 @@ import type {
   PermissionState,
 } from "#src/types";
 import { isPermissionState } from "#src/types";
-import { normalizeFlatConfig } from "./normalize";
+import { normalizeFlatConfig, relocateMcpToolKeyRules } from "./normalize";
 import type { Rule, RuleOrigin, Ruleset } from "./rule";
 import {
   evaluate,
@@ -30,7 +30,7 @@ import {
   isSurfaceFullyDenied,
   rewriteAsksToYolo,
 } from "./rule";
-import { mergeScopesWithOrigins } from "./scope-merge";
+import { type MergedScopes, mergeScopesWithOrigins } from "./scope-merge";
 import {
   composeRuleset,
   synthesizeBaseline,
@@ -62,6 +62,11 @@ type ResolvedPermissions = {
    * names also drive the fail-closed notice in {@link getConfigIssues}.
    */
   failClosedScopes: RuleOrigin[];
+  /**
+   * Top-level permission keys naming Pi MCP tools, relocated onto the `mcp`
+   * surface; they drive the port notice in {@link getConfigIssues}.
+   */
+  legacyMcpToolKeys: string[];
 };
 
 /**
@@ -152,7 +157,8 @@ export class PermissionManager implements ScopedPermissionManager {
 
   getConfigIssues(agentName?: string): string[] {
     // Trigger a load/resolve to ensure issues are collected.
-    const { failClosedScopes } = this.resolvePermissions(agentName);
+    const { failClosedScopes, legacyMcpToolKeys } =
+      this.resolvePermissions(agentName);
     const issues = [...this.loader.getConfigIssues()];
     if (failClosedScopes.length > 0) {
       issues.push(
@@ -161,6 +167,9 @@ export class PermissionManager implements ScopedPermissionManager {
           `until the configuration is corrected.`,
       );
     }
+    if (legacyMcpToolKeys.length > 0) {
+      issues.push(formatMcpToolKeyPortNotice(legacyMcpToolKeys));
+    }
     return issues;
   }
 
@@ -201,26 +210,16 @@ export class PermissionManager implements ScopedPermissionManager {
     const universalFallbackOrigin: RuleOrigin =
       origins.get("*")?.get("*") ?? "builtin";
 
-    // Build config rules from everything except the universal "*" key.
-    const permissionWithoutUniversal: FlatPermissionConfig = Object.fromEntries(
-      Object.entries(mergedPermission).filter(([k]) => k !== "*"),
-    );
-
-    // Normalize to config rules, tagged with "config" layer and their origin.
-    const configRules: Ruleset = normalizeFlatConfig(
-      permissionWithoutUniversal,
-    ).map(
-      (r): Rule => ({
-        ...r,
-        layer: "config",
-        origin: origins.get(r.surface)?.get(r.pattern) ?? "builtin",
-      }),
-    );
+    const configRules = buildConfigRules(mergedPermission, origins);
+    // A top-level `mcp__…` key now names an `mcp` candidate. The baseline reads
+    // the rules as written, so a relocated `allow` on one Pi MCP tool does not
+    // newly open the proxy's discovery targets.
+    const relocation = relocateMcpToolKeyRules(configRules);
 
     const composedRules = composeRuleset(
       synthesizeDefaults(universalFallback, universalFallbackOrigin),
       synthesizeBaseline(configRules),
-      configRules,
+      relocation.rules,
     );
 
     // Fail closed when a non-global scope's config is invalid: floor every
@@ -241,6 +240,7 @@ export class PermissionManager implements ScopedPermissionManager {
     const value: ResolvedPermissions = {
       composedRules: effectiveRules,
       failClosedScopes,
+      legacyMcpToolKeys: [...new Set(relocation.relocatedKeys)],
     };
     this.resolvedPermissionsCache.set(cacheKey, { stamp, value });
     return value;
@@ -263,10 +263,14 @@ export class PermissionManager implements ScopedPermissionManager {
    */
   getToolPermission(toolName: string, agentName?: string): PermissionState {
     const { composedRules } = this.resolvePermissions(agentName);
-    // Every surface (special, bash, mcp, skill, path-bearing, and extension
-    // tools) resolves its tool-level state identically: evaluate the surface
-    // name against the "*" catch-all value. There is no per-kind branch.
-    return evaluate(toolName.trim(), "*", composedRules, this.flavor).action;
+    const name = toolName.trim();
+    if (classifyToolKind(name) === "mcp-tool") {
+      return this.resolvePiMcpTool(name, composedRules);
+    }
+    // Every other surface (special, bash, mcp, skill, path-bearing, and
+    // extension tools) resolves its tool-level state identically: evaluate the
+    // surface name against the "*" catch-all value.
+    return evaluate(name, "*", composedRules, this.flavor).action;
   }
 
   /**
@@ -284,7 +288,30 @@ export class PermissionManager implements ScopedPermissionManager {
    */
   isToolFullyDenied(toolName: string, agentName?: string): boolean {
     const { composedRules } = this.resolvePermissions(agentName);
-    return isSurfaceFullyDenied(toolName.trim(), composedRules, this.flavor);
+    const name = toolName.trim();
+    if (classifyToolKind(name) === "mcp-tool") {
+      return this.resolvePiMcpTool(name, composedRules) === "deny";
+    }
+    return isSurfaceFullyDenied(name, composedRules, this.flavor);
+  }
+
+  /**
+   * The action a Pi MCP tool resolves to on the `mcp` surface.
+   *
+   * Its candidates come from its name alone, never its input, so this one
+   * answer is both its tool-level state and whether it is fully denied.
+   */
+  private resolvePiMcpTool(
+    toolName: string,
+    composedRules: Ruleset,
+  ): PermissionState {
+    const { surface, values } = normalizeInput(
+      toolName,
+      undefined,
+      this.loader.getConfiguredMcpServerNames(),
+    );
+    return evaluateAnyValue(surface, values, composedRules, this.flavor).rule
+      .action;
   }
 
   /**
@@ -389,6 +416,39 @@ function buildCheckResult(
   };
 }
 
+const MCP_TOOL_KEY_MIGRATION_GUIDE =
+  "https://github.com/gotgenes/pi-packages/blob/main/packages/pi-permission-system/docs/migration/1001-pi-mcp-tools-on-mcp-surface.md";
+
+/** The notice asking the operator to move top-level `mcp__…` keys under `mcp`. */
+function formatMcpToolKeyPortNotice(keys: readonly string[]): string {
+  const named = keys.map((key) => `"${key}"`).join(", ");
+  return (
+    `Top-level permission keys naming Pi MCP tools are applied as "mcp" rules: ${named}. ` +
+    `Move them under "mcp" — see ${MCP_TOOL_KEY_MIGRATION_GUIDE}`
+  );
+}
+
+/**
+ * Build the config-layer rules from the merged permission object: every key
+ * except the universal `"*"` (which feeds `synthesizeDefaults` only), each
+ * rule tagged with the `config` layer and the scope that contributed it.
+ */
+function buildConfigRules(
+  mergedPermission: FlatPermissionConfig,
+  origins: MergedScopes["origins"],
+): Ruleset {
+  const permissionWithoutUniversal: FlatPermissionConfig = Object.fromEntries(
+    Object.entries(mergedPermission).filter(([k]) => k !== "*"),
+  );
+  return normalizeFlatConfig(permissionWithoutUniversal).map(
+    (r): Rule => ({
+      ...r,
+      layer: "config",
+      origin: origins.get(r.surface)?.get(r.pattern) ?? "builtin",
+    }),
+  );
+}
+
 /**
  * Derive `PolicyLoaderOptions` from an agentDir + an optional cwd.
  * Setting agentsDir explicitly from agentDir removes the hidden
@@ -403,6 +463,9 @@ function derivePolicyLoaderOptions(
     agentsDir: join(agentDir, "agents"),
     projectGlobalConfigPath: cwd ? getProjectConfigPath(cwd) : undefined,
     projectAgentsDir: cwd ? getProjectAgentsDir(cwd) : undefined,
+    // Pi's built-in MCP reads these two files (`extensions/mcp/config.ts`).
+    globalMcpConfigPath: join(agentDir, "mcp.json"),
+    projectMcpConfigPath: cwd ? join(cwd, ".pi", "mcp.json") : undefined,
   };
 }
 
@@ -414,7 +477,7 @@ function derivePolicyLoaderOptions(
  *
  * - session          → "session" (always, all surfaces)
  * - mcp + default    → "default"
- * - mcp + other      → "mcp"
+ * - mcp + other      → "mcp" (the proxy and Pi MCP tools alike)
  * - special          → "special" (always)
  * - skill            → "skill" (always)
  * - bash             → "bash" (always)
@@ -431,6 +494,7 @@ function deriveSource(
 
   switch (classifyToolKind(toolName)) {
     case "mcp":
+    case "mcp-tool":
       return rule.layer === "default" ? "default" : "mcp";
     case "skill":
       return "skill";

package/src/presentation/pattern-suggest.ts

@@ -233,9 +233,16 @@ export function suggestPathSessionPattern(
   surface: string,
   approvalPattern: string,
 ): SessionApprovalSuggestion {
-  return {
-    surface,
-    pattern: approvalPattern,
-    label: buildLabel(approvalPattern, surface),
-  };
+  return suggestExactSessionPattern(surface, approvalPattern);
+}
+
+/**
+ * Build the suggestion for a pattern the caller already holds verbatim, such
+ * as a Pi MCP tool's full name on the `mcp` surface: no wildcard is derived.
+ */
+export function suggestExactSessionPattern(
+  surface: string,
+  pattern: string,
+): SessionApprovalSuggestion {
+  return { surface, pattern, label: buildLabel(pattern, surface) };
 }

package/src/presentation/permission-prompts.ts

@@ -18,8 +18,9 @@ export function formatUnknownToolReason(
   const availableList =
     preview.length > 0 ? `${preview.join(", ")}${suffix}` : "none";
 
+  const kind = classifyToolKind(toolName);
   const mcpHint =
-    classifyToolKind(toolName) === "mcp"
+    kind === "mcp" || kind === "mcp-tool"
       ? ""
       : ' If this was intended as an MCP server tool, call the registered \'mcp\' tool when available (for example: {"tool":"server:tool"}).';
 

package/src/presentation/tool-ask-payload.ts

@@ -1,4 +1,8 @@
-import { classifyToolKind, isMcpCheck } from "#src/access-intent/tool-kind";
+import {
+  classifyToolKind,
+  isMcpCheck,
+  isProxyMcpCheck,
+} from "#src/access-intent/tool-kind";
 import type { ToolPreviewFormatter } from "#src/tool-input/tool-preview-formatter";
 import type { PermissionCheckResult } from "#src/types";
 import { getNonEmptyString, toRecord } from "#src/value-guards";
@@ -45,7 +49,7 @@ export function buildToolAskPayload(facts: ToolAskFacts): PromptPayload {
     },
     evidence: bash
       ? fullCommandEvidence(facts)
-      : inputPreviewEvidence(facts, mcp),
+      : inputPreviewEvidence(facts, isProxyMcpCheck(check)),
     annotations: [],
   };
 }
@@ -86,15 +90,16 @@ function fullCommandEvidence(facts: ToolAskFacts): PromptEvidence[] {
 /**
  * The per-tool input preview, when a formatter is registered and produces one.
  *
- * An MCP ask previews under the `mcp` key rather than the qualified target, so
- * a registered MCP formatter is consulted for every server.
+ * A proxied MCP ask previews under the `mcp` key rather than the qualified
+ * target, so a registered MCP formatter is consulted for every server. A Pi
+ * MCP tool's input is its own arguments, so it previews under its own name.
  */
 function inputPreviewEvidence(
   facts: ToolAskFacts,
-  mcp: boolean,
+  proxyMcp: boolean,
 ): PromptEvidence[] {
   const preview = facts.formatter?.formatToolInputForPrompt(
-    mcp ? "mcp" : facts.check.toolName,
+    proxyMcp ? "mcp" : facts.check.toolName,
     facts.input,
   );
   return preview ? [{ label: "input", text: preview, detail: null }] : [];

package/src/service/permissions-service.ts

@@ -1,4 +1,7 @@
-import type { AccessIntent } from "#src/access-intent/access-intent";
+import type {
+  AccessIntent,
+  PathValuesAccessIntent,
+} from "#src/access-intent/access-intent";
 import { buildAccessIntentForSurface } from "#src/access-intent/input-normalizer";
 import type { Authorizer } from "#src/authority/authorizer";
 import type { AuthorizerRegistrar } from "#src/authority/authorizer-registry";
@@ -23,7 +26,7 @@ import { resolveBashAdvisoryCheck } from "./bash-advisory-check";
  * `PermissionResolver` satisfies it.
  */
 interface ResolverForService {
-  resolve(intent: AccessIntent): PermissionCheckResult;
+  resolve(intent: AccessIntent | PathValuesAccessIntent): PermissionCheckResult;
   getToolPermission(toolName: string, agentName?: string): PermissionState;
   isToolFullyDenied(toolName: string, agentName?: string): boolean;
 }

package/src/tool-input/tool-preview-formatter.ts

@@ -1,4 +1,7 @@
-import { classifyToolKind, isMcpCheck } from "#src/access-intent/tool-kind";
+import {
+  classifyToolKind,
+  isProxyMcpCheck,
+} from "#src/access-intent/tool-kind";
 import type { PermissionCheckResult } from "#src/types";
 import { getNonEmptyString, toRecord } from "#src/value-guards";
 import type { ToolInputFormatterLookup } from "./tool-input-formatter-registry";
@@ -157,7 +160,10 @@ export class ToolPreviewFormatter {
     input: unknown,
     pathBearingTools: ReadonlySet<string>,
   ): string | undefined {
-    if (classifyToolKind(result.toolName) === "bash" || isMcpCheck(result)) {
+    if (
+      classifyToolKind(result.toolName) === "bash" ||
+      isProxyMcpCheck(result)
+    ) {
       return undefined;
     }