@herbertgao/pi-extensions 2026.8.1 → 2026.8.2

package/node_modules/pi-mcp-adapter/server-manager.ts

@@ -1,18 +1,17 @@
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
-import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
+import { mkdirSync } from "node:fs";
 import {
+  Client,
+  SdkHttpError,
+  SSEClientTransport,
   StreamableHTTPClientTransport,
-  StreamableHTTPError,
-} from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
-import type { RequestOptions } from "@modelcontextprotocol/sdk/shared/protocol.js";
-import {
-  ElicitationCompleteNotificationSchema,
+  UnauthorizedError,
   type GetPromptResult,
   type ReadResourceResult,
+  type RequestOptions,
   type UrlElicitationRequiredError,
-} from "@modelcontextprotocol/sdk/types.js";
+  type VersionNegotiationOptions,
+} from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
 import { UnixSocketClientTransport } from "./unix-socket-transport.ts";
 import { probeMcpEndpoint } from "./mcp-probe.ts";
 import {
@@ -24,6 +23,7 @@ import {
   type ServerStreamResultPatchNotification,
   type Transport,
   type McpTraceSettings,
+  SERVER_STREAM_RESULT_PATCH_METHOD,
   serverStreamResultPatchNotificationSchema,
 } from "./types.ts";
 import { resolveNpxBinary } from "./npx-resolver.ts";
@@ -67,7 +67,26 @@ type HttpAuthProviderState =
   | { status: "implicit-challenged"; provider: McpOAuthProvider };
 
 function isUnauthorizedHttpError(error: unknown): boolean {
-  return error instanceof UnauthorizedError || (error instanceof StreamableHTTPError && error.code === 401);
+  return error instanceof UnauthorizedError || (error instanceof SdkHttpError && error.status === 401);
+}
+
+function shouldFallbackToSse(error: unknown, definition: ServerDefinition): boolean {
+  if (definition.protocolVersion === "2026-07-28") return false;
+  return error instanceof SdkHttpError && [404, 405, 406, 415].includes(error.status);
+}
+
+function resolveVersionNegotiation(definition: ServerDefinition): VersionNegotiationOptions | undefined {
+  switch (definition.protocolVersion) {
+    case undefined:
+    case "legacy":
+      return undefined;
+    case "auto":
+      return { mode: "auto" };
+    case "2026-07-28":
+      return { mode: { pin: "2026-07-28" } };
+    default:
+      throw new Error(`Invalid MCP protocolVersion: ${String(definition.protocolVersion)}`);
+  }
 }
 
 function boundedStderrChunk(chunk: Buffer | string): Buffer {
@@ -307,7 +326,6 @@ export class McpServerManager {
     requestSignal?: AbortSignal,
   ): Promise<ServerConnection> {
     throwIfAborted(signal);
-    const client = this.createClient(name);
 
     const tracingEnabled = isMcpTraceEnabled(definition, this.traceSettings);
     const traceWriter = tracingEnabled
@@ -317,7 +335,10 @@ export class McpServerManager {
       ? { record: event => traceWriter.write(event) }
       : undefined;
 
+    let client: Client;
     let transport: Transport;
+    let clientConnected = false;
+    let transportAlreadyTraced = false;
     let stderrTail: Buffer<ArrayBufferLike> = Buffer.alloc(0);
     const configuredTransports = [definition.command, definition.url, definition.socket]
       .filter(value => typeof value === "string" && value.length > 0);
@@ -325,7 +346,10 @@ export class McpServerManager {
       throw new Error(`Server ${name} must configure exactly one of command, url, or socket`);
     }
 
+    const requestOptions = this.buildRequestOptions(definition, requestSignal);
+
     if (definition.command) {
+      client = this.createClient(name, definition);
       let command = definition.command;
       let args = definition.args ?? [];
 
@@ -339,11 +363,13 @@ export class McpServerManager {
       }
       throwIfAborted(signal);
 
+      if (definition.pluginDataDir) mkdirSync(definition.pluginDataDir, { recursive: true });
+      const cwd = resolveConfigPath(definition.cwd) ?? this.defaultCwd;
       const stdioTransport = new StdioClientTransport({
         command,
         args,
-        env: resolveEnv(definition.env, name),
-        cwd: resolveConfigPath(definition.cwd) ?? this.defaultCwd,
+        env: resolveEnv(definition.env, name, definition.literalEnv === true),
+        ...(cwd !== undefined ? { cwd } : {}),
         stderr: definition.debug ? "inherit" : "pipe",
       });
       // Keep non-debug child diagnostics available for connection failures without
@@ -355,24 +381,48 @@ export class McpServerManager {
       }
       transport = stdioTransport;
     } else if (definition.url) {
-      // HTTP transport with fallback
-      transport = await this.createHttpTransport(definition, name, signal, requestSignal, traceObserver);
+      const httpConnection = await this.connectHttpClient(
+        definition,
+        name,
+        requestOptions,
+        signal,
+        traceObserver,
+      );
+      client = httpConnection.client;
+      transport = httpConnection.transport;
+      if (httpConnection.status === "needs-auth") {
+        return {
+          client,
+          transport,
+          definition,
+          tools: [],
+          resources: [],
+          prompts: [],
+          lastUsedAt: Date.now(),
+          inFlight: 0,
+          status: "needs-auth",
+        };
+      }
+      clientConnected = true;
+      transportAlreadyTraced = traceObserver !== undefined;
     } else {
+      client = this.createClient(name, definition);
       transport = new UnixSocketClientTransport(resolveConfigPath(definition.socket!)!);
     }
 
-    if (traceObserver) {
+    if (traceObserver && !transportAlreadyTraced) {
       const traceTransportKindValue = traceTransportKind(definition, transport);
       transport = wrapTransportWithMcpTrace(transport, name, traceTransportKindValue, traceObserver);
     }
 
-    throwIfAborted(signal);
-    const requestOptions = this.buildRequestOptions(definition, requestSignal);
-
     try {
-      await this.connectClientWithAbort(client, transport, requestOptions, signal);
+      throwIfAborted(signal);
+      if (!clientConnected) {
+        await this.connectClientWithAbort(client, transport, requestOptions, signal);
+      }
       this.attachAdapterNotificationHandlers(name, client);
 
+      const instructions = client.getInstructions?.();
       const connection: ServerConnection = {
         client,
         transport,
@@ -380,22 +430,15 @@ export class McpServerManager {
         tools: [],
         resources: [],
         prompts: [],
-        instructions: client.getInstructions?.(),
+        ...(instructions !== undefined ? { instructions } : {}),
         lastUsedAt: Date.now(),
         inFlight: 0,
         status: "connected",
       };
 
       // Reflect the SDK's own close signal in connection status, guarded by
-      // identity so a stale connection's late close (e.g. the old
-      // connection from before a session-recovery reconnect) can never
-      // clobber a fresh connection that has since taken its place in
-      // `this.connections`. This intentionally uses `client.onclose`
-      // (Protocol's public hook), not `transport.onclose` — the SDK's
-      // Protocol takes ownership of that one internally for pending-request
-      // rejection, and overwriting it would break that. `client.onerror` is
-      // avoided too: it can fire on benign events (e.g. the optional GET
-      // SSE stream failing) that don't mean the connection is closed.
+      // identity so a stale connection's late close can never clobber a fresh
+      // connection. The SDK client owns the transport callbacks.
       client.onclose = () => {
         if (this.connections.get(name) === connection) {
           connection.status = "closed";
@@ -417,8 +460,7 @@ export class McpServerManager {
       return connection;
     } catch (error) {
       // If connectClientWithAbort closed the transport, await that exact close.
-      // Otherwise the SDK client owns its transport, so client.close() is the
-      // single cleanup operation rather than closing the transport twice.
+      // Otherwise the SDK client owns its transport and performs cleanup once.
       const abortCleanup = abortCleanupPromises.get(transport);
       const abortCleanupFailed = error instanceof AggregateError && error.message === "MCP connection abort cleanup failed";
       const cleanupResults = abortCleanupFailed
@@ -432,8 +474,8 @@ export class McpServerManager {
         reportedError = new AggregateError([error, ...cleanupFailures], "MCP connection setup failed");
       }
 
-      // Check for UnauthorizedError - server requires OAuth. A cleanup failure
-      // remains a setup failure rather than being hidden behind needs-auth.
+      // A cleanup failure remains a setup failure rather than being hidden
+      // behind needs-auth.
       if (isUnauthorizedHttpError(error) && supportsOAuth(definition) && cleanupFailures.length === 0) {
         return {
           client,
@@ -515,13 +557,15 @@ export class McpServerManager {
     };
   }
 
-  private createClient(serverName: string): Client {
+  private createClient(serverName: string, definition: ServerDefinition): Client {
     const capabilities = this.buildClientCapabilities();
+    const versionNegotiation = resolveVersionNegotiation(definition);
     let client: Client;
     client = new Client(
       { name: `pi-mcp-${serverName}`, version: "1.0.0" },
       {
         jsonSchemaValidator: createJsonSchemaValidator(),
+        ...(versionNegotiation ? { versionNegotiation } : {}),
         ...(Object.keys(capabilities).length > 0 ? { capabilities } : {}),
         listChanged: {
           tools: {
@@ -552,7 +596,7 @@ export class McpServerManager {
         onUrlAccepted: elicitationId => this.rememberUrlElicitation(serverName, elicitationId),
       });
       if (this.elicitationConfig.allowUrl) {
-        client.setNotificationHandler(ElicitationCompleteNotificationSchema, notification => {
+        client.setNotificationHandler("notifications/elicitation/complete", notification => {
           if (this.runtimeSignal?.aborted) return;
           const accepted = this.acceptedUrlElicitations.get(serverName);
           if (!accepted?.delete(notification.params.elicitationId)) return;
@@ -644,18 +688,19 @@ export class McpServerManager {
     accepted.add(elicitationId);
   }
 
-  private async createHttpTransport(
+  private async connectHttpClient(
     definition: ServerDefinition,
     serverName: string,
+    requestOptions: RequestOptions | undefined,
     signal?: AbortSignal,
-    requestSignal?: AbortSignal,
     traceObserver?: McpTraceObserver,
-  ): Promise<Transport> {
+  ): Promise<{ client: Client; transport: Transport; status: "connected" | "needs-auth" }> {
     throwIfAborted(signal);
     const serverUrl = resolveServerUrl(definition)!;
     const url = new URL(serverUrl);
 
-    // Resolve secret commands only for this connection attempt, without mutating config.
+    // Resolve secret commands only for this connection attempt, without
+    // mutating the persisted configuration.
     const hasCommandHeader = Object.values(definition.headers ?? {})
       .some(value => value.startsWith("!") && !value.startsWith("!!"));
     const headers = resolveCommandSecretsRecord(
@@ -663,7 +708,8 @@ export class McpServerManager {
       key => `MCP server "${serverName}" HTTP header "${key}"`,
     ) ?? {};
 
-    // For bearer auth, add the token to headers BEFORE creating requestInit
+    // Resolve bearer auth before creating requestInit so every attempted
+    // transport receives the same headers.
     const commandBearer = definition.bearerToken?.startsWith("!") && !definition.bearerToken.startsWith("!!")
       ? definition.bearerToken
       : undefined;
@@ -682,98 +728,94 @@ export class McpServerManager {
       }
     }
 
-    // Create request init with headers (Authorization now included for bearer auth)
     const requestInit = Object.keys(headers).length > 0 ? { headers } : undefined;
     const createAuthProvider = (): McpOAuthProvider => new McpOAuthProvider(
       serverName,
       serverUrl,
       extractOAuthConfig(definition),
-      {
-        onRedirect: async (_authUrl) => {
-          // URL is captured by startAuth, no need to log
-        },
-      },
+      { onRedirect: async () => {} },
       this.authStorageOptions,
       this.oauthRuntime?.signal,
     );
 
-    // Explicit OAuth must check the secure credential store before connecting.
+    // Explicit OAuth checks secure storage immediately. Implicit OAuth defers
+    // provider construction until the server proves authentication is needed.
     let authState: HttpAuthProviderState = supportsOAuth(definition)
       ? definition.auth === undefined
         ? { status: "implicit-deferred" }
         : { status: "explicit", provider: createAuthProvider() }
       : { status: "disabled" };
 
-    // Try StreamableHTTP first (modern MCP servers). For implicit OAuth, defer
-    // creating the provider until the server proves that authentication is needed.
-    for (;;) {
+    const attempt = async (
+      kind: "streamable-http" | "sse",
+    ): Promise<
+      | { status: "connected"; client: Client; transport: Transport }
+      | { status: "failed"; client: Client; transport: Transport; error: unknown }
+    > => {
       const authProvider = "provider" in authState ? authState.provider : undefined;
-      const streamableTransport = new StreamableHTTPClientTransport(url, {
-        requestInit,
-        authProvider,
-      });
-      const probeTransport = traceObserver
-        ? wrapTransportWithMcpTrace(streamableTransport, serverName, "streamable-http", traceObserver)
-        : streamableTransport;
-      const testClient = new Client({ name: "pi-mcp-probe", version: "2.1.2" });
-      let probeCleanupAttempted = false;
-      try {
-        await this.connectClientWithAbort(
-          testClient,
-          probeTransport,
-          this.buildRequestOptions(definition, requestSignal),
-          signal,
-        );
-        probeCleanupAttempted = true;
-        try {
-          await testClient.close();
-        } catch (cleanupError) {
-          throw new AggregateError([cleanupError], "MCP HTTP probe cleanup failed");
-        }
+      const transportOptions = {
+        ...(requestInit !== undefined ? { requestInit } : {}),
+        ...(authProvider !== undefined ? { authProvider } : {}),
+        ...(authProvider !== undefined
+          && definition.oauth !== false
+          && definition.oauth?.skipIssuerMetadataValidation === true
+          ? { skipIssuerMetadataValidation: true }
+          : {}),
+      };
+      const baseTransport: Transport = kind === "streamable-http"
+        ? new StreamableHTTPClientTransport(url, transportOptions)
+        : new SSEClientTransport(url, transportOptions);
+      const transport = traceObserver
+        ? wrapTransportWithMcpTrace(baseTransport, serverName, kind, traceObserver)
+        : baseTransport;
+      const client = this.createClient(serverName, definition);
 
-        // StreamableHTTP works - create fresh transport for actual use
-        return new StreamableHTTPClientTransport(url, { requestInit, authProvider });
+      try {
+        await this.connectClientWithAbort(client, transport, requestOptions, signal);
+        return { status: "connected", client, transport };
       } catch (error) {
-        if (error instanceof AggregateError && (
-          error.message === "MCP connection abort cleanup failed" ||
-          error.message === "MCP HTTP probe cleanup failed"
-        )) {
-          throw error;
-        }
-
-        // StreamableHTTP failed, close through the SDK client and try SSE fallback.
-        // If connectClientWithAbort already owned the close, await that operation
-        // instead of closing the same transport twice.
-        if (!probeCleanupAttempted) {
-          probeCleanupAttempted = true;
+        const abortCleanupFailed = error instanceof AggregateError
+          && error.message === "MCP connection abort cleanup failed";
+        if (!abortCleanupFailed) {
           try {
-            await (abortCleanupPromises.get(probeTransport) ?? testClient.close());
+            await (abortCleanupPromises.get(transport) ?? client.close());
           } catch (cleanupError) {
-            throw new AggregateError([error, cleanupError], "MCP HTTP probe cleanup failed");
+            throw new AggregateError([error, cleanupError], "MCP HTTP connection cleanup failed");
           }
         }
+        return { status: "failed", client, transport, error };
+      }
+    };
 
-        // Host cancellation is not transport capability evidence; do not fall
-        // through to SSE when the caller is trying to cancel the connect.
-        if (signal?.aborted) {
-          throwIfAborted(signal);
-        }
-
-        // An implicit URL-only server gets a provider only after a real auth
-        // challenge. This keeps unauthenticated servers independent of storage.
-        if (authState.status === "implicit-deferred" && isUnauthorizedHttpError(error)) {
-          authState = { status: "implicit-challenged", provider: createAuthProvider() };
-          continue;
-        }
+    // Connect the real client once. Retry Streamable HTTP only for an implicit
+    // OAuth challenge; use SSE only for definitive endpoint incompatibility.
+    // Agent Plugins set httpTransport, and their declared transport is used without fallback.
+    let kind: "streamable-http" | "sse" = definition.httpTransport ?? "streamable-http";
+    for (;;) {
+      const result = await attempt(kind);
+      if (result.status === "connected") return result;
+      if (result.error instanceof AggregateError
+        && result.error.message === "MCP connection abort cleanup failed") {
+        throw result.error;
+      }
+      if (signal?.aborted) throwIfAborted(signal);
 
-        // If this was an UnauthorizedError, don't try SSE - the server needs auth
-        if (isUnauthorizedHttpError(error)) {
-          throw error;
+      if (authState.status === "implicit-deferred" && isUnauthorizedHttpError(result.error)) {
+        authState = { status: "implicit-challenged", provider: createAuthProvider() };
+        continue;
+      }
+      if (isUnauthorizedHttpError(result.error)) {
+        if (supportsOAuth(definition)) {
+          return { client: result.client, transport: result.transport, status: "needs-auth" };
         }
+        throw result.error;
+      }
 
-        // SSE is the legacy transport
-        return new SSEClientTransport(url, { requestInit, authProvider });
+      if (definition.httpTransport === undefined && kind === "streamable-http" && shouldFallbackToSse(result.error, definition)) {
+        kind = "sse";
+        continue;
       }
+      throw result.error;
     }
   }
 
@@ -839,11 +881,15 @@ export class McpServerManager {
   }
 
   private attachAdapterNotificationHandlers(serverName: string, client: Client): void {
-    client.setNotificationHandler(serverStreamResultPatchNotificationSchema, notification => {
-      const listener = this.uiStreamListeners.get(notification.params.streamToken);
-      if (!listener) return;
-      listener(serverName, notification.params);
-    });
+    client.setNotificationHandler(
+      SERVER_STREAM_RESULT_PATCH_METHOD,
+      { params: serverStreamResultPatchNotificationSchema.shape.params },
+      params => {
+        const listener = this.uiStreamListeners.get(params.streamToken);
+        if (!listener) return;
+        listener(serverName, params);
+      },
+    );
   }
 
   registerUiStreamListener(streamToken: string, listener: UiStreamListener): void {
@@ -984,6 +1030,10 @@ export class McpServerManager {
     return false;
   }
 
+  isConnecting(name: string): boolean {
+    return this.connectPromises.has(name);
+  }
+
   getConnection(name: string): ServerConnection | undefined {
     return this.connections.get(name);
   }
@@ -1024,11 +1074,13 @@ export class McpServerManager {
 /**
  * Resolve environment variables with interpolation.
  */
-function resolveEnv(env: Record<string, string> | undefined, serverName: string): Record<string, string> {
+function resolveEnv(env: Record<string, string> | undefined, serverName: string, literalEnv = false): Record<string, string> {
   const resolved: Record<string, string> = {};
   for (const [key, value] of Object.entries(process.env)) {
     if (value !== undefined) resolved[key] = value;
   }
+  if (literalEnv) return env ? { ...resolved, ...env } : resolved;
+
   const overrides = resolveCommandSecretsRecord(
     env,
     key => `MCP server "${serverName}" stdio env "${key}"`,

package/node_modules/pi-mcp-adapter/session-recovery.ts

@@ -20,8 +20,7 @@
 //     many things other than "your session is gone"
 //   - treat generic -32000/ConnectionClosed errors as session expiry
 //   - treat AbortError/cancellation as a session failure
-import { StreamableHTTPError } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { ErrorCode, McpError } from "@modelcontextprotocol/sdk/types.js";
+import { ProtocolError, SdkHttpError } from "@modelcontextprotocol/client";
 import { logger } from "./logger.ts";
 import { throwIfAborted } from "./abort.ts";
 import { isServerDisabled, type McpConfig } from "./types.ts";
@@ -34,25 +33,25 @@ import type { McpServerManager, ServerConnection } from "./server-manager.ts";
  * gate response some servers emit before dispatching to a handler.
  *
  * `hadSessionId` must reflect the transport's session id from *before* the
- * call that produced `err` was made. The installed SDK (1.30.0) does not
- * clear `transport.sessionId` on a 404 response, so callers must capture it
- * before the call rather than rely on catch-time transport state.
+ * call that produced `err` was made. Callers must capture it before the call
+ * rather than rely on catch-time transport state.
  */
+const CONNECTION_CLOSED_PROTOCOL_CODE = -32000;
 const SERVER_NOT_INITIALIZED_MCP_MESSAGES = new Set([
-  `MCP error ${ErrorCode.ConnectionClosed}: Server not initialized`,
-  `MCP error ${ErrorCode.ConnectionClosed}: Bad Request: Server not initialized`,
+  "Server not initialized",
+  "Bad Request: Server not initialized",
 ]);
 
 export function isTerminatedSession(err: unknown, hadSessionId: boolean): boolean {
   if (!hadSessionId) return false;
-  if (err instanceof StreamableHTTPError) {
-    return err.code === 404
-      || (err.code === 400
+  if (err instanceof SdkHttpError) {
+    return err.status === 404
+      || (err.status === 400
         && /"code"\s*:\s*-32000/.test(err.message)
         && /"message"\s*:\s*"Bad Request: Server not initialized"/.test(err.message));
   }
-  return err instanceof McpError
-    && err.code === ErrorCode.ConnectionClosed
+  return err instanceof ProtocolError
+    && err.code === CONNECTION_CLOSED_PROTOCOL_CODE
     && SERVER_NOT_INITIALIZED_MCP_MESSAGES.has(err.message);
 }
 

package/node_modules/pi-mcp-adapter/skills/mcp-scripting/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: mcp-scripting
-description: Write mcp_script JavaScript for discovering, inspecting, and calling MCP tools.
+description: Write mcpScript JavaScript for discovering, inspecting, and calling MCP tools.
 ---
 
 # MCP scripting
 
-For multi-call MCP work, write ordinary JavaScript with loops, filtering, chaining, fan-out, or other logic between calls. Run that source with `mcp_script`; it is the primary MCP orchestration surface. For a single MCP search, describe, status check, auth action, or tool call, use `mcp` instead.
+For multi-call MCP work, write ordinary JavaScript with loops, filtering, chaining, fan-out, or other logic between calls. Run that source with `mcpScript`; it is the primary MCP orchestration surface. For a single MCP search, describe, status check, auth action, or tool call, use `mcp` instead.
 
-Write the source naturally, then pass it as `mcp_script`'s `code` argument:
+Write the source naturally, then pass it as `mcpScript`'s `code` argument:
 
 ```js
 const { items } = await tools.search({ query: "search issues", server: "github" });

package/node_modules/pi-mcp-adapter/state.ts

@@ -1,4 +1,4 @@
-import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import type { ConsentManager } from "./consent-manager.ts";
 import type { McpLifecycleManager } from "./lifecycle.ts";
 import type { McpServerManager } from "./server-manager.ts";
@@ -48,6 +48,8 @@ export interface McpExtensionState {
   failureMessages: Map<string, string>;
   /** Session-only approvals keyed by server and original tool name. */
   approvedToolCalls: Map<string, true>;
+  /** Shared event bus used by permission extensions to broker MCP approvals. */
+  approvalEvents?: ExtensionAPI["events"];
   uiResourceHandler: UiResourceHandler;
   consentManager: ConsentManager;
   uiServer: UiServerHandle | null;

package/node_modules/pi-mcp-adapter/tool-approval.ts

@@ -1,3 +1,4 @@
+import { randomUUID } from "node:crypto";
 import { abortable } from "./abort.ts";
 import { combineAbortSignals } from "./runtime-owner.ts";
 import type { McpExtensionState } from "./state.ts";
@@ -5,7 +6,12 @@ import {
   getToolNameCandidates,
   matchesToolPattern,
   resolveToolPrefix,
+  MCP_TOOL_APPROVAL_REQUEST_EVENT,
   type McpConfig,
+  type McpToolApprovalDecision,
+  type McpToolApprovalHandler,
+  type McpToolApprovalOrigin,
+  type McpToolApprovalRequest,
   type ToolMetadata,
 } from "./types.ts";
 import { sanitizeTerminalText } from "./utils.ts";
@@ -34,19 +40,76 @@ export function isToolCallApprovalRequired(
   );
 }
 
+function isMcpToolApprovalDecision(value: unknown): value is McpToolApprovalDecision {
+  return value === "allow_once"
+    || value === "allow_for_session"
+    || value === "deny"
+    || value === "abstain";
+}
+
+async function requestBrokerApproval(
+  state: McpExtensionState,
+  serverName: string,
+  toolMeta: ToolMetadata,
+  args: Record<string, unknown> | undefined,
+  origin: McpToolApprovalOrigin,
+  signal?: AbortSignal,
+): Promise<McpToolApprovalDecision> {
+  if (!state.approvalEvents) return "abstain";
+
+  let acceptingClaim = true;
+  let handler: McpToolApprovalHandler | undefined;
+  const request: McpToolApprovalRequest = {
+    requestId: randomUUID(),
+    serverName,
+    originalToolName: toolMeta.originalName,
+    prefixedToolName: toolMeta.name,
+    args: args ?? {},
+    origin,
+    ...(signal !== undefined ? { signal } : {}),
+    claim(candidate: McpToolApprovalHandler) {
+      if (!acceptingClaim || handler) return false;
+      handler = candidate;
+      return true;
+    },
+  };
+
+  state.approvalEvents.emit(MCP_TOOL_APPROVAL_REQUEST_EVENT, request);
+  acceptingClaim = false;
+  if (!handler) return "abstain";
+
+  try {
+    const decision = await abortable(Promise.resolve().then(handler), signal);
+    return isMcpToolApprovalDecision(decision) ? decision : "deny";
+  } catch (error) {
+    if (signal?.aborted) throw error;
+    return "deny";
+  }
+}
+
 export async function ensureToolCallApproved(
   state: McpExtensionState,
   serverName: string,
   toolMeta: ToolMetadata,
   args: Record<string, unknown> | undefined,
   signal?: AbortSignal,
+  origin: McpToolApprovalOrigin = toolMeta.resourceUri ? "resource" : "proxy",
 ): Promise<ToolCallApprovalResult> {
-  if (!isToolCallApprovalRequired(state.config, serverName, toolMeta)) {
+  const cacheKey = `${serverName}\u0000${toolMeta.originalName}`;
+  const approvedToolCalls = state.approvedToolCalls ??= new Map<string, true>();
+  if (approvedToolCalls.has(cacheKey)) {
     return { ok: true };
   }
 
-  const cacheKey = `${serverName}\u0000${toolMeta.originalName}`;
-  if (state.approvedToolCalls.has(cacheKey)) {
+  const brokerDecision = await requestBrokerApproval(state, serverName, toolMeta, args, origin, signal);
+  if (brokerDecision === "allow_once") return { ok: true };
+  if (brokerDecision === "allow_for_session") {
+    approvedToolCalls.set(cacheKey, true);
+    return { ok: true };
+  }
+  if (brokerDecision === "deny") return { ok: false, reason: "denied" };
+
+  if (!isToolCallApprovalRequired(state.config, serverName, toolMeta)) {
     return { ok: true };
   }
 
@@ -71,7 +134,7 @@ export async function ensureToolCallApproved(
     return { ok: true };
   }
   if (decision === "Allow for session") {
-    state.approvedToolCalls.set(cacheKey, true);
+    approvedToolCalls.set(cacheKey, true);
     return { ok: true };
   }
   return { ok: false, reason: "denied" };