@herbertgao/pi-extensions 2026.8.15 → 2026.9.0

package/node_modules/pi-mcp-adapter/host-html-template.ts

@@ -3,6 +3,8 @@ import type { UiHostContext, UiResourceContent, UiResourceCsp } from "./types.ts
 // Use locally bundled AppBridge to avoid CDN Zod bundling issues
 const DEFAULT_APP_BRIDGE_MODULE_URL = "/app-bridge.bundle.js";
 const APP_SANDBOX = "allow-scripts allow-forms allow-modals allow-popups allow-downloads";
+const APP_PROXY_SANDBOX = `${APP_SANDBOX} allow-same-origin`;
+const APP_INNER_SANDBOX = APP_PROXY_SANDBOX;
 
 export interface HostHtmlTemplateInput {
   sessionToken: string;
@@ -16,6 +18,7 @@ export interface HostHtmlTemplateInput {
   cacheToolConsent: boolean;
   hostContext?: UiHostContext;
   appBridgeModuleUrl?: string;
+  sandboxProxyUrl: string;
 }
 
 export function buildHostHtmlTemplate(input: HostHtmlTemplateInput): string {
@@ -31,6 +34,9 @@ export function buildHostHtmlTemplate(input: HostHtmlTemplateInput): string {
   const requireToolConsent = safeInlineJSON(input.requireToolConsent);
   const cacheToolConsent = safeInlineJSON(input.cacheToolConsent);
   const moduleUrl = safeInlineJSON(input.appBridgeModuleUrl ?? DEFAULT_APP_BRIDGE_MODULE_URL);
+  const sandboxProxyUrl = safeInlineJSON(input.sandboxProxyUrl);
+  const resourceCsp = safeInlineJSON(input.resource.meta.csp);
+  const resourcePermissions = safeInlineJSON(input.resource.meta.permissions);
 
   return `<!doctype html>
 <html lang="en">
@@ -112,7 +118,7 @@ export function buildHostHtmlTemplate(input: HostHtmlTemplateInput): string {
     </div>
   </header>
   <main>
-    <iframe id="mcp-app" sandbox="${APP_SANDBOX}" referrerpolicy="no-referrer"></iframe>
+    <iframe id="mcp-app" sandbox="${APP_PROXY_SANDBOX}" referrerpolicy="no-referrer"></iframe>
   </main>
   <div class="overlay" id="error-overlay">
     <div class="panel">
@@ -138,6 +144,10 @@ export function buildHostHtmlTemplate(input: HostHtmlTemplateInput): string {
     const ALLOW_ATTRIBUTE = ${allowAttribute};
     const REQUIRE_TOOL_CONSENT = ${requireToolConsent};
     const CACHE_TOOL_CONSENT = ${cacheToolConsent};
+    const SANDBOX_PROXY_URL = ${sandboxProxyUrl};
+    const RESOURCE_CSP = ${resourceCsp};
+    const RESOURCE_PERMISSIONS = ${resourcePermissions};
+    const INNER_SANDBOX = ${safeInlineJSON(APP_INNER_SANDBOX)};
     const STREAM_CONTEXT_KEY = "pi-mcp-adapter/stream";
     const STREAM_PATCH_METHOD = "notifications/pi-mcp-adapter/ui-result-patch";
 
@@ -148,6 +158,7 @@ export function buildHostHtmlTemplate(input: HostHtmlTemplateInput): string {
     const errorOverlay = document.getElementById("error-overlay");
     const completionOverlay = document.getElementById("completion-overlay");
     const errorMessage = document.getElementById("error-message");
+    const sandboxProxyOrigin = new URL(SANDBOX_PROXY_URL).origin;
 
     document.getElementById("server-name").textContent = SERVER_NAME;
     document.getElementById("tool-name").textContent = TOOL_NAME;
@@ -205,10 +216,41 @@ export function buildHostHtmlTemplate(input: HostHtmlTemplateInput): string {
     const bridge = new AppBridge(
       null,
       { name: "pi", version: "1.0.0" },
-      { serverTools: {}, openLinks: {}, logging: {}, updateModelContext: {}, message: {} },
+      {
+        serverTools: {},
+        openLinks: {},
+        logging: {},
+        updateModelContext: {},
+        message: {},
+        sandbox: {
+          ...(RESOURCE_CSP ? { csp: RESOURCE_CSP } : {}),
+          ...(RESOURCE_PERMISSIONS ? { permissions: RESOURCE_PERMISSIONS } : {}),
+        },
+      },
       { hostContext: HOST_CONTEXT }
     );
 
+    let sandboxResourceSent = false;
+    bridge.onsandboxready = async () => {
+      if (sandboxResourceSent) return;
+      sandboxResourceSent = true;
+      try {
+        const response = await fetch("/ui-app?resource=" + encodeURIComponent(UI_RESOURCE_TOKEN), {
+          headers: { Accept: "text/html" },
+        });
+        if (!response.ok) throw new Error("UI resource request failed: HTTP " + response.status);
+        const html = await response.text();
+        await bridge.sendSandboxResourceReady({
+          html,
+          sandbox: INNER_SANDBOX,
+          ...(RESOURCE_CSP ? { csp: RESOURCE_CSP } : {}),
+          ...(RESOURCE_PERMISSIONS ? { permissions: RESOURCE_PERMISSIONS } : {}),
+        });
+      } catch (error) {
+        showError("Failed to load MCP App resource: " + String(error));
+      }
+    };
+
     bridge.oncalltool = async (params) => {
       if (!consentGranted) {
         const accepted = window.confirm("Allow this UI to call server tools for this session?");
@@ -240,7 +282,7 @@ export function buildHostHtmlTemplate(input: HostHtmlTemplateInput): string {
     // Also listen for raw postMessage events with custom types (notify, prompt, intent, etc.)
     // These bypass the AppBridge protocol but are used by some MCP UI implementations
     window.addEventListener("message", async (event) => {
-      if (event.source !== iframe.contentWindow) return;
+      if (event.source !== iframe.contentWindow || event.origin !== sandboxProxyOrigin) return;
       const data = event.data;
       if (!data || typeof data !== "object") return;
       
@@ -304,6 +346,12 @@ export function buildHostHtmlTemplate(input: HostHtmlTemplateInput): string {
     }
 
     // Connect bridge BEFORE loading iframe to ensure we're listening when the app sends ui/initialize
+    const sandboxMessageGuard = (event) => {
+      if (event.source === iframe.contentWindow && event.origin !== sandboxProxyOrigin) {
+        event.stopImmediatePropagation();
+      }
+    };
+    window.addEventListener("message", sandboxMessageGuard, true);
     try {
       const transport = new PostMessageTransport(iframe.contentWindow, iframe.contentWindow);
       await bridge.connect(transport);
@@ -315,7 +363,7 @@ export function buildHostHtmlTemplate(input: HostHtmlTemplateInput): string {
     const iframeLoaded = new Promise((resolve) => {
       iframe.onload = resolve;
     });
-    iframe.src = "/ui-app?resource=" + encodeURIComponent(UI_RESOURCE_TOKEN);
+    iframe.src = SANDBOX_PROXY_URL;
     await iframeLoaded;
 
     const eventSource = new EventSource("/events?session=" + encodeURIComponent(SESSION_TOKEN));
@@ -340,6 +388,9 @@ export function buildHostHtmlTemplate(input: HostHtmlTemplateInput): string {
         showError("Failed to forward cancellation: " + String(error));
       }
     });
+    eventSource.addEventListener("resource-updated", () => {
+      setStatus("Resource updated on the server. Reopen this UI to load the latest version.");
+    });
     eventSource.addEventListener("result-patch", async (event) => {
       try {
         await bridge.notification({
@@ -443,7 +494,9 @@ function sanitizeCspDomains(domains: unknown): string[] {
 }
 
 function safeInlineJSON(value: unknown): string {
-  return JSON.stringify(value)
+  const json = JSON.stringify(value);
+  if (json === undefined) return "undefined";
+  return json
     .replace(/</g, "\\u003c")
     .replace(/>/g, "\\u003e")
     .replace(/&/g, "\\u0026")

package/node_modules/pi-mcp-adapter/index.ts

@@ -590,7 +590,7 @@ function installMcpAdapter(pi: ExtensionAPI, options: McpAdapterOptions) {
       initPromise = null;
       if (earlyConfig.settings?.freezeDirectTools === true) {
         directToolsFrozen = true;
-        logger.info("MCP: direct tools frozen after initial sync — reconnects won't rebuild the system prompt; use mcp({ connect: \"server\" }) to rediscover");
+        logger.info("MCP: direct tools frozen after initial sync — metadata can refresh without rebuilding the active tool surface");
       }
     }).catch(async err => {
       if (!owner.isActive() || generation !== lifecycleGeneration) {
@@ -817,7 +817,6 @@ function installMcpAdapter(pi: ExtensionAPI, options: McpAdapterOptions) {
         case "reconnect":
           commandOwner?.throwIfInactive();
           await reconnectServers(state, commandCtx, targetServer);
-          if (directToolsFrozen) syncToolSurface(commandCtx);
           break;
         case "tools":
           await showTools(state, commandCtx);
@@ -1168,7 +1167,7 @@ function installMcpAdapter(pi: ExtensionAPI, options: McpAdapterOptions) {
         }
         if (params.connect) {
           const result = await executeConnect(state, params.connect, signal);
-          syncToolSurface(_ctx as ExtensionContext);
+          if (!directToolsFrozen) syncToolSurface(_ctx as ExtensionContext);
           return result;
         }
         if (params.describe) {

package/node_modules/pi-mcp-adapter/init.ts

@@ -215,6 +215,10 @@ export async function initializeMcp(
     notifyToolMetadataUpdated(state, serverName, reason);
     updateStatusBar(state);
   });
+  manager.setListenStateChangedListener?.(() => {
+    if (!owner.isActive()) return;
+    updateStatusBar(state);
+  });
   owner.addCleanup(() => lifecycle.gracefulShutdown());
   owner.addCleanup(() => {
     if (state.uiServer) {
@@ -641,6 +645,7 @@ export async function lazyConnect(state: McpExtensionState, serverName: string,
     return false;
   }
   if (connection?.status === "connected") {
+    await state.manager.ensureListen?.(serverName, connection);
     updateServerMetadata(state, serverName);
     markKeepAliveAfterConnect(state, serverName);
     return true;

package/node_modules/pi-mcp-adapter/mcp-panel.ts

@@ -134,6 +134,8 @@ interface ServerState {
   includeTools?: string[];
   excludeTools?: string[];
   exposeResources: boolean;
+  disabled: boolean;
+  wasDisabled: boolean;
   connectionStatus: ConnectionStatus;
   failureMessage?: string | null;
   tools: ToolState[];
@@ -243,6 +245,7 @@ class McpPanel {
 
       const status = callbacks.getConnectionStatus(serverName);
       const failureMessage = callbacks.getFailureMessage?.(serverName) ?? null;
+      const serverDisabled = isServerDisabled(definition);
       let directCount = 0;
       let directTokens = 0;
       for (const tool of tools) {
@@ -258,6 +261,8 @@ class McpPanel {
         ...(definition.includeTools !== undefined ? { includeTools: definition.includeTools } : {}),
         ...(definition.excludeTools !== undefined ? { excludeTools: definition.excludeTools } : {}),
         exposeResources: definition.exposeResources !== false,
+        disabled: serverDisabled,
+        wasDisabled: serverDisabled,
         connectionStatus: status,
         failureMessage,
         tools,
@@ -275,7 +280,7 @@ class McpPanel {
     if (this.inactivityTimeout) clearTimeout(this.inactivityTimeout);
     this.inactivityTimeout = setTimeout(() => {
       this.cleanup();
-      this.done({ cancelled: true, changes: new Map() });
+      this.done({ cancelled: true, changes: new Map(), disabledChanges: new Map() });
     }, McpPanel.INACTIVITY_MS);
   }
 
@@ -334,12 +339,16 @@ class McpPanel {
   }
 
   private updateDirty(): void {
-    this.dirty = this.servers.some((s) => s.tools.some((t) => t.isDirect !== t.wasDirect));
+    this.dirty = this.servers.some((s) => s.disabled !== s.wasDisabled || s.tools.some((t) => t.isDirect !== t.wasDirect));
   }
 
   private buildResult(): McpPanelResult {
     const changes = new Map<string, true | string[] | false>();
+    const disabledChanges = new Map<string, boolean>();
     for (const server of this.servers) {
+      if (server.disabled !== server.wasDisabled) {
+        disabledChanges.set(server.name, server.disabled);
+      }
       const changed = server.tools.some((t) => t.isDirect !== t.wasDirect);
       if (!changed) continue;
       const directTools = server.tools.filter((t) => t.isDirect);
@@ -351,7 +360,7 @@ class McpPanel {
         changes.set(server.name, directTools.map((t) => t.name));
       }
     }
-    return { changes, cancelled: false };
+    return { changes, disabledChanges, cancelled: false };
   }
 
   handleInput(data: string): void {
@@ -367,7 +376,7 @@ class McpPanel {
     // Global shortcuts — always work, even during desc search
     if (matchesKey(data, "ctrl+c")) {
       this.cleanup();
-      this.done({ cancelled: true, changes: new Map() });
+      this.done({ cancelled: true, changes: new Map(), disabledChanges: new Map() });
       return;
     }
 
@@ -424,7 +433,7 @@ class McpPanel {
         return;
       }
       this.cleanup();
-      this.done({ cancelled: true, changes: new Map() });
+      this.done({ cancelled: true, changes: new Map(), disabledChanges: new Map() });
       return;
     }
 
@@ -477,6 +486,17 @@ class McpPanel {
       return;
     }
 
+    if (matchesKey(data, "ctrl+d")) {
+      const item = this.visibleItems[this.cursorIndex];
+      if (!item || item.type !== "server" || this.authOnly) return;
+      const server = this.servers[item.serverIndex];
+      if (!server) return;
+      server.disabled = !server.disabled;
+      this.updateDirty();
+      this.tui.requestRender();
+      return;
+    }
+
     if (matchesKey(data, "ctrl+y")) {
       const item = this.visibleItems[this.cursorIndex];
       if (!item) return;
@@ -632,7 +652,7 @@ class McpPanel {
   private handleDiscardInput(data: string): void {
     if (matchesKey(data, "ctrl+c")) {
       this.cleanup();
-      this.done({ cancelled: true, changes: new Map() });
+      this.done({ cancelled: true, changes: new Map(), disabledChanges: new Map() });
       return;
     }
     if (matchesKey(data, "escape") || data === "n" || data === "N") {
@@ -642,7 +662,7 @@ class McpPanel {
     if (this.keys.selectConfirm(data)) {
       this.cleanup();
       if (this.discardSelected === 0) {
-        this.done({ cancelled: true, changes: new Map() });
+        this.done({ cancelled: true, changes: new Map(), disabledChanges: new Map() });
       } else {
         this.done(this.buildResult());
       }
@@ -650,7 +670,7 @@ class McpPanel {
     }
     if (data === "y" || data === "Y") {
       this.cleanup();
-      this.done({ cancelled: true, changes: new Map() });
+      this.done({ cancelled: true, changes: new Map(), disabledChanges: new Map() });
       return;
     }
     if (matchesKey(data, "left") || matchesKey(data, "right") || matchesKey(data, "tab")) {
@@ -883,6 +903,7 @@ class McpPanel {
           italic("⏎") + " expand/auth",
           italic("ctrl+a") + " auth",
           italic("ctrl+r") + " reconnect",
+          italic("ctrl+d") + " disable/enable",
           ...(this.selectedServerHasFailureMessage() ? [italic("ctrl+y") + " copy error"] : []),
           italic("?") + " desc search",
           ...(saveLabel ? [italic(saveLabel) + " save"] : []),
@@ -995,7 +1016,7 @@ class McpPanel {
   private renderConnectionStatus(server: ServerState): string {
     const t = this.t;
     if (this.authInFlight === server.name) return `  ${fg(t.needsAuth, "authenticating")}`;
-    if (server.connectionStatus === "disabled") return `  ${fg(t.description, "disabled")}`;
+    if (server.disabled) return `  ${fg(t.description, "disabled")}`;
     if (server.connectionStatus === "needs-auth") return `  ${fg(t.needsAuth, "needs auth")}`;
     if (server.connectionStatus === "connecting") return `  ${fg(t.needsAuth, "connecting")}`;
     if (server.connectionStatus === "failed") return `  ${fg(t.cancel, "failed")}`;

package/node_modules/pi-mcp-adapter/mcp-setup-panel.ts

@@ -2,7 +2,7 @@ import { matchesKey, truncateToWidth, visibleWidth } from "@earendil-works/pi-tu
 import { createPanelKeys, type PanelKeybindings, type PanelKeys } from "./panel-keys.ts";
 import type { ImportKind } from "./types.ts";
 import { getConfigDirName } from "./agent-dir.ts";
-import { KNOWN_SERVER_PRESETS, type ConfigWritePreview, type KnownServerPreset, type McpDiscoverySummary } from "./config.ts";
+import { KNOWN_SERVER_PRESETS, type ConfigWritePreview, type KnownServerPreset, type McpDiscoverySummary, type SharedConfigTarget } from "./config.ts";
 import type { McpOnboardingState } from "./onboarding-state.ts";
 
 interface SetupTheme {
@@ -54,13 +54,13 @@ function wrapText(text: string, width: number): string[] {
 
 export interface SetupPanelCallbacks {
   previewImports: (imports: ImportKind[]) => ConfigWritePreview;
-  previewStarterProject: () => ConfigWritePreview;
-  previewRepoPrompt: () => ConfigWritePreview | null;
-  previewKnownServer: (preset: KnownServerPreset) => ConfigWritePreview;
+  previewStarterConfig: (target: SharedConfigTarget) => ConfigWritePreview;
+  previewRepoPrompt: (target: SharedConfigTarget) => ConfigWritePreview | null;
+  previewKnownServer: (preset: KnownServerPreset, target: SharedConfigTarget) => ConfigWritePreview;
   adoptImports: (imports: ImportKind[]) => Promise<{ added: ImportKind[]; path: string }>;
-  scaffoldProjectConfig: () => Promise<{ path: string }>;
-  addRepoPrompt: () => Promise<{ path: string; serverName: string }>;
-  addKnownServer: (preset: KnownServerPreset) => Promise<{ path: string; serverName: string }>;
+  scaffoldConfig: (target: SharedConfigTarget) => Promise<{ path: string }>;
+  addRepoPrompt: (target: SharedConfigTarget) => Promise<{ path: string; serverName: string }>;
+  addKnownServer: (preset: KnownServerPreset, target: SharedConfigTarget) => Promise<{ path: string; serverName: string }>;
   openPath: (path: string) => Promise<void>;
   markSetupCompleted: () => void;
 }
@@ -75,13 +75,14 @@ type Screen = "empty" | "setup" | "imports" | "paths";
 
 type ActionId =
   | "run-setup"
+  | "select-shared-target"
   | "adopt-imports"
   | "view-example"
   | "show-precedence"
   | "open-paths"
   | "add-repoprompt"
   | "add-known-server"
-  | "scaffold-project"
+  | "scaffold-shared-config"
   | "close";
 
 interface Action {
@@ -89,6 +90,7 @@ interface Action {
   label: string;
   description: string;
   preset?: KnownServerPreset;
+  target?: SharedConfigTarget;
 }
 
 export class McpSetupPanel {
@@ -96,6 +98,7 @@ export class McpSetupPanel {
   private actionCursor = 0;
   private importCursor = 0;
   private pathCursor = 0;
+  private sharedConfigTarget: SharedConfigTarget = "project";
   private selectedImports = new Set<ImportKind>();
   private busy = false;
   private notice: { text: string; tone: "success" | "warning" | "muted" } | null = null;
@@ -144,9 +147,13 @@ export class McpSetupPanel {
     if (this.discovery.imports.length > 0) {
       actions.push({ id: "adopt-imports", label: "Adopt detected compatibility imports", description: `Choose which host-specific MCP configs Pi should import into its own override file. ${this.discovery.imports.length} source${this.discovery.imports.length === 1 ? "" : "s"} found.` });
     }
-    actions.push({ id: "view-example", label: "View example `.mcp.json`", description: "Preview a working shared MCP config you can paste or adapt." });
-    if (!this.discovery.sources.some((source) => source.id === "shared-project" && source.exists)) {
-      actions.push({ id: "scaffold-project", label: "Scaffold project `.mcp.json`", description: "Write a minimal project config using the standard shared MCP file path, then reload Pi." });
+    actions.push(
+      { id: "select-shared-target", label: `${this.sharedConfigTarget === "project" ? "●" : "○"} Add to this project (.mcp.json)`, description: "Write new shared MCP servers to the project/team config.", target: "project" },
+      { id: "select-shared-target", label: `${this.sharedConfigTarget === "global" ? "●" : "○"} Add globally (~/.config/mcp/mcp.json)`, description: "Write new shared MCP servers to your all-projects config.", target: "global" },
+    );
+    actions.push({ id: "view-example", label: "View example shared config", description: "Preview a working shared MCP config you can paste or adapt." });
+    if (!this.selectedSharedConfigExists()) {
+      actions.push({ id: "scaffold-shared-config", label: `Scaffold ${this.sharedTargetLabel()}`, description: "Write a minimal config at the selected normal MCP setup path, then reload Pi." });
     }
     actions.push({ id: "show-precedence", label: "Explain config precedence", description: "Show the read order and where Pi writes compatibility settings." });
     if (this.getDetectedPaths().length > 0) {
@@ -156,7 +163,7 @@ export class McpSetupPanel {
       actions.push({ id: "add-known-server", label: preset.name, description: preset.summary, preset });
     }
     if (!this.discovery.repoPrompt.configured && this.discovery.repoPrompt.executablePath && this.discovery.repoPrompt.targetPath && this.discovery.repoPrompt.entry && this.discovery.repoPrompt.serverName) {
-      actions.push({ id: "add-repoprompt", label: "Add RepoPrompt to shared MCP config", description: "Write a standard MCP entry for RepoPrompt to the recommended shared target, then reload MCP in-session." });
+      actions.push({ id: "add-repoprompt", label: "Add RepoPrompt to selected shared config", description: "Write a standard MCP entry for RepoPrompt to the selected normal setup path, then reload MCP in-session." });
     }
     actions.push({ id: "close", label: "Close", description: "Exit the onboarding flow." });
     return actions;
@@ -170,6 +177,15 @@ export class McpSetupPanel {
     return [...new Set(paths)];
   }
 
+  private sharedTargetLabel(): string {
+    return this.sharedConfigTarget === "project" ? "project .mcp.json" : "global ~/.config/mcp/mcp.json";
+  }
+
+  private selectedSharedConfigExists(): boolean {
+    const sourceId = this.sharedConfigTarget === "project" ? "shared-project" : "shared-global";
+    return this.discovery.sources.some((source) => source.id === sourceId && source.exists);
+  }
+
   private getSelectedAction(): Action | undefined {
     const actions = this.getActions();
     return actions[this.actionCursor];
@@ -293,9 +309,15 @@ export class McpSetupPanel {
       this.tui.requestRender();
       return;
     }
-    if (action.id === "scaffold-project") {
+    if (action.id === "select-shared-target" && action.target) {
+      this.sharedConfigTarget = action.target;
+      this.notice = { text: `New shared servers will be written to ${this.sharedTargetLabel()}.`, tone: "muted" };
+      this.tui.requestRender();
+      return;
+    }
+    if (action.id === "scaffold-shared-config") {
       await this.runBusy(async () => {
-        const result = await this.callbacks.scaffoldProjectConfig();
+        const result = await this.callbacks.scaffoldConfig(this.sharedConfigTarget);
         this.callbacks.markSetupCompleted();
         this.notice = { text: `Wrote starter config to ${result.path}. Pi will reload after this panel closes.`, tone: "success" };
       });
@@ -303,7 +325,7 @@ export class McpSetupPanel {
     }
     if (action.id === "add-repoprompt") {
       await this.runBusy(async () => {
-        const result = await this.callbacks.addRepoPrompt();
+        const result = await this.callbacks.addRepoPrompt(this.sharedConfigTarget);
         this.callbacks.markSetupCompleted();
         this.notice = { text: `Added ${result.serverName} to ${result.path}. Pi will reload after this panel closes.`, tone: "success" };
       });
@@ -312,7 +334,7 @@ export class McpSetupPanel {
     if (action.id === "add-known-server" && action.preset) {
       const preset = action.preset;
       await this.runBusy(async () => {
-        const result = await this.callbacks.addKnownServer(preset);
+        const result = await this.callbacks.addKnownServer(preset, this.sharedConfigTarget);
         this.callbacks.markSetupCompleted();
         this.notice = { text: `Added ${result.serverName} to ${result.path}. Pi will reload after this panel closes.`, tone: "success" };
       });
@@ -416,8 +438,11 @@ export class McpSetupPanel {
     for (let index = start; index < end; index++) {
       const action = actions[index];
       if (!action) continue;
+      if (action.id === "select-shared-target" && (index === start || actions[index - 1]?.id !== "select-shared-target")) {
+        lines.push(this.padLine(fg(this.t.title, "Choose where new shared servers go"), innerW));
+      }
       if (action.id === "add-known-server" && (index === start || actions[index - 1]?.id !== "add-known-server")) {
-        lines.push(this.padLine(fg(this.t.title, "Add a known server"), innerW));
+        lines.push(this.padLine(fg(this.t.title, `Add a known server to ${this.sharedTargetLabel()}`), innerW));
       }
       const selected = index === this.actionCursor;
       const cursor = selected ? fg(this.t.selected, "›") : " ";
@@ -495,12 +520,12 @@ export class McpSetupPanel {
       ? ` ${this.discovery.conflicts.length} same-name conflict${this.discovery.conflicts.length === 1 ? "" : "s"} reported.`
       : "";
     if (!this.discovery.hasAnyConfig) {
-      return `Create a shared .mcp.json, adopt host imports, or quick-add RepoPrompt from this screen.${hostNote}${conflictNote}`;
+      return `Add shared servers to .mcp.json for this project/team or ~/.config/mcp/mcp.json for all projects. Adopt host imports or quick-add RepoPrompt from this screen.${hostNote}${conflictNote}`;
     }
     if (this.discovery.totalServerCount === 0 && this.discovery.imports.length > 0) {
       return `Detected ${this.discovery.imports.length} compatibility import source${this.discovery.imports.length === 1 ? "" : "s"}. Adopt them into Pi or inspect the underlying files.${hostNote}${conflictNote}`;
     }
-    return `Shared MCP files are preferred. Pi-owned files are only for compatibility imports and adapter-specific overrides.${hostNote}${conflictNote}`;
+    return `Use .mcp.json for project/team servers or ~/.config/mcp/mcp.json for all projects. Pi-owned files are for compatibility imports and adapter-specific overrides, not another normal setup path.${hostNote}${conflictNote}`;
   }
 
   private visibleActionRange(total: number): { start: number; end: number } {
@@ -534,6 +559,12 @@ export class McpSetupPanel {
           ],
           previewW,
         );
+      case "select-shared-target":
+        return this.formatPreview([
+          action.target === "project" ? "Project target: .mcp.json" : "Global target: ~/.config/mcp/mcp.json",
+          "Known server presets and starter configs will be written to the selected normal MCP setup path.",
+          "Pi-owned mcp.json files remain compatibility and adapter-only override state.",
+        ], previewW);
       case "view-example":
         return this.formatPreview([
           "Example shared `.mcp.json`:",
@@ -546,10 +577,17 @@ export class McpSetupPanel {
           "  }",
           "}",
           "",
-          "Use Scaffold project `.mcp.json` when you want a safe empty shell instead of a live example server.",
+          "Use Scaffold selected config when you want a safe empty shell instead of a live example server.",
         ], previewW);
       case "show-precedence":
         return this.formatPreview([
+          "Recommended shared config:",
+          "  project/team: .mcp.json",
+          "  all projects: ~/.config/mcp/mcp.json",
+          "",
+          "Advanced compatibility and Pi-owned layers:",
+          "  host imports, .agents files, package MCP manifests, and Pi overrides",
+          "",
           "Read order (later entries win):",
           "0. detected host configs (opt-in lowest-precedence fallback)",
           "1. ~/.config/mcp/mcp.json",
@@ -570,7 +608,7 @@ export class McpSetupPanel {
           : ["No config paths were detected."], previewW);
       case "add-repoprompt": {
         const repoPrompt = this.discovery.repoPrompt;
-        const preview = this.callbacks.previewRepoPrompt();
+        const preview = this.callbacks.previewRepoPrompt(this.sharedConfigTarget);
         if (!preview) {
           return this.formatPreview(["RepoPrompt is not available to add from this setup screen."], previewW);
         }
@@ -579,7 +617,7 @@ export class McpSetupPanel {
           preview,
           [
             `Executable: ${repoPrompt.executablePath ?? "not found"}`,
-            `Target: ${repoPrompt.targetPath ?? "n/a"}`,
+            `Target: ${this.sharedTargetLabel()}`,
             `Server name: ${repoPrompt.serverName ?? "repoprompt"}`,
           ],
           previewW,
@@ -590,17 +628,17 @@ export class McpSetupPanel {
         if (!preset) return this.formatPreview(["Known server preset is unavailable."], previewW);
         return this.formatWritePreview(
           `${preset.name} write preview`,
-          this.callbacks.previewKnownServer(preset),
-          [preset.summary],
+          this.callbacks.previewKnownServer(preset, this.sharedConfigTarget),
+          [preset.summary, `Target: ${this.sharedTargetLabel()}`],
           previewW,
         );
       }
-      case "scaffold-project":
+      case "scaffold-shared-config":
         return this.formatWritePreview(
-          "Starter project `.mcp.json` write preview",
-          this.callbacks.previewStarterProject(),
+          `${this.sharedTargetLabel()} starter write preview`,
+          this.callbacks.previewStarterConfig(this.sharedConfigTarget),
           [
-            "This writes a minimal `.mcp.json` in the current project using the shared MCP layout.",
+            "This writes a minimal config at the selected normal MCP setup path.",
             "It intentionally avoids adding a fake placeholder server that would fail on first reload.",
           ],
           previewW,

package/node_modules/pi-mcp-adapter/mcp-status.ts

@@ -48,7 +48,9 @@ export function createMcpStatusSnapshot(state: McpExtensionState): McpStatusSnap
     servers.push({
       name,
       status,
+      listenState: connection?.status === "connected" ? connection.listenState : "disconnected",
       toolCount,
+      ...(connection?.status === "connected" && connection.listenCatalogStale ? { catalogStale: true } : {}),
       ...(resourceCount !== undefined ? { resourceCount } : {}),
       ...(status === "failed" && failedAgoSeconds !== null ? { failedAgoSeconds } : {}),
       disabled,

package/node_modules/pi-mcp-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-mcp-adapter",
-  "version": "2.31.0",
+  "version": "2.32.1",
   "description": "MCP (Model Context Protocol) adapter extension for Pi coding agent",
   "type": "module",
   "types": "./index.ts",
@@ -125,6 +125,7 @@
     "mcp-status.ts",
     "metadata-cache.ts",
     "host-html-template.ts",
+    "sandbox-proxy-template.ts",
     "ui-resource-handler.ts",
     "consent-manager.ts",
     "ui-server.ts",