@herbertgao/pi-extensions 2026.8.3 → 2026.8.5

package/node_modules/pi-mcp-adapter/init.ts

@@ -1,6 +1,6 @@
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import type { McpExtensionState } from "./state.ts";
-import { isServerDisabled, type McpAdapterOptions, type PromptMetadata, type ToolMetadata } from "./types.ts";
+import { formatToolName, isServerDisabled, resolveToolPrefix, type McpAdapterOptions, type PromptMetadata, type ToolMetadata } from "./types.ts";
 import { existsSync } from "node:fs";
 import { cloneMcpConfig, loadMcpConfig } from "./config.ts";
 import { ConsentManager } from "./consent-manager.ts";
@@ -21,6 +21,7 @@ import {
 } from "./metadata-cache.ts";
 import { McpServerManager } from "./server-manager.ts";
 import { buildToolMetadata, totalToolCount } from "./tool-metadata.ts";
+import { resourceNameToToolName } from "./resource-tools.ts";
 import { UiResourceHandler } from "./ui-resource-handler.ts";
 import { formatMcpStatus, openUrl, parallelLimit, sanitizeTerminalText } from "./utils.ts";
 import { logger } from "./logger.ts";
@@ -242,7 +243,7 @@ export async function initializeMcp(
 
     const cachedEntry = cache?.servers?.[name];
     if (cachedEntry && isServerCacheValid(cachedEntry, definition)) {
-      const metadata = reconstructToolMetadata(name, cachedEntry, prefix, definition);
+      const metadata = reconstructToolMetadata(name, cachedEntry, prefix, definition, config.mcpServers, cache ?? undefined);
       toolMetadata.set(name, metadata);
       if (Array.isArray(cachedEntry.resources)) {
         resourceCounts.set(name, cachedEntry.resources.length);
@@ -288,6 +289,29 @@ export async function initializeMcp(
   if (initialSignal?.aborted) return state;
   owner.throwIfInactive();
 
+  const startupKnownMetadata = new Map<string, ToolMetadata[]>();
+  for (const { name, definition, connection } of results) {
+    if (!connection) continue;
+    const effectivePrefix = resolveToolPrefix(definition, prefix);
+    const metadata: ToolMetadata[] = [
+      ...connection.tools.filter(tool => tool?.name).map(tool => ({
+        name: formatToolName(tool.name, name, effectivePrefix),
+        originalName: tool.name,
+        description: tool.description ?? "",
+      })),
+      ...(definition.exposeResources !== false ? connection.resources.filter(resource => resource?.name && resource?.uri).map(resource => {
+        const originalName = `read_${resourceNameToToolName(resource.name)}`;
+        return {
+          name: formatToolName(originalName, name, effectivePrefix),
+          originalName,
+          description: resource.description ?? `Read resource: ${resource.uri}`,
+          resourceUri: resource.uri,
+        };
+      }) : []),
+    ];
+    startupKnownMetadata.set(name, metadata);
+  }
+
   for (const { name, definition, connection, error } of results) {
     owner.throwIfInactive();
     if (error || !connection) {
@@ -301,7 +325,7 @@ export async function initializeMcp(
       continue;
     }
 
-    const { metadata, failedTools } = buildToolMetadata(connection.tools, connection.resources, definition, name, prefix);
+    const { metadata, failedTools } = buildToolMetadata(connection.tools, connection.resources, definition, name, prefix, config.mcpServers, startupKnownMetadata, true);
     toolMetadata.set(name, metadata);
     resourceCounts.set(name, connection.resources.length);
     if (!connection.promptDiscoveryFailed) {
@@ -327,7 +351,7 @@ export async function initializeMcp(
 
   const connectedCount = results.filter(r => r.connection).length;
   const failedCount = results.filter(r => r.error).length;
-  if (ui && connectedCount > 0) {
+  if (ui && connectedCount > 0 && config.settings?.notifyOnStartupConnect !== false) {
     const totalTools = totalToolCount(state);
     const msg = failedCount > 0
       ? `MCP: ${connectedCount}/${startupServers.length} servers connected (${totalTools} tools)`
@@ -437,7 +461,7 @@ export function updateServerMetadata(state: McpExtensionState, serverName: strin
 
   const prefix = state.config.settings?.toolPrefix ?? "server";
 
-  const { metadata } = buildToolMetadata(connection.tools, connection.resources, definition, serverName, prefix);
+  const { metadata } = buildToolMetadata(connection.tools, connection.resources, definition, serverName, prefix, state.config.mcpServers, state.toolMetadata);
   state.toolMetadata.set(serverName, metadata);
   state.resourceCounts?.set(serverName, connection.resources.length);
   if (!connection.promptDiscoveryFailed) {

package/node_modules/pi-mcp-adapter/lifecycle.ts

@@ -19,7 +19,6 @@ export class McpLifecycleManager {
   private activeHealthCheck: Promise<void> | undefined;
   private shutdownPromise: Promise<void> | undefined;
   private stopped = false;
-  private healthSignal: AbortSignal | undefined;
   private removeHealthAbortListener: (() => void) | undefined;
 
   constructor(
@@ -58,10 +57,8 @@ export class McpLifecycleManager {
     const signal = typeof signalOrInterval === "number" ? undefined : signalOrInterval;
     const intervalMs = typeof signalOrInterval === "number" ? signalOrInterval : maybeIntervalMs;
     this.stopped = false;
-    this.healthSignal = signal;
     if (signal?.aborted) {
       this.stopped = true;
-      this.healthSignal = undefined;
       return;
     }
     const stop = () => {
@@ -138,7 +135,6 @@ export class McpLifecycleManager {
     this.healthCheckInterval = undefined;
     this.removeHealthAbortListener?.();
     this.removeHealthAbortListener = undefined;
-    this.healthSignal = undefined;
     await this.activeHealthCheck;
     this.activeHealthCheck = undefined;
     this.onReconnect = undefined;

package/node_modules/pi-mcp-adapter/mcp-auth-flow.ts

@@ -633,7 +633,6 @@ export async function completeAuthFromInput(
   const signal = combineAbortSignals(runtime.signal, options.signal)
   throwIfAborted(signal)
   const key = getPendingAuthKey(serverName, fallbackAuthStorageOptions)
-  const authStorageOptions = runtimeState.pendingAuths.get(key)?.authStorageOptions ?? fallbackAuthStorageOptions
   const oauthState = runtimeState.pendingAuthStates.get(key)
   throwIfAborted(signal)
   const parsed = parseAuthorizationRedirectInput(input, oauthState)
@@ -899,7 +898,7 @@ export async function getValidToken(
  * @returns The current auth status
  */
 export async function getAuthStatus(serverName: string, options: AuthenticateOptions = {}): Promise<AuthStatus> {
-  const runtime = getRuntime(options)
+  getRuntime(options)
   const authStorageOptions = options.authStorageOptions ?? {}
   const hasTokens = await hasStoredTokens(serverName, authStorageOptions)
   if (!hasTokens) return "not_authenticated"

package/node_modules/pi-mcp-adapter/mcp-auth.ts

@@ -37,6 +37,7 @@ const KEYRING_RECOVERY_KEYCTL_ENV = 'PI_MCP_ADAPTER_KEYRING_RECOVERY_KEYCTL';
 const KEYRING_RECOVERY_NODE_ENV = 'PI_MCP_ADAPTER_KEYRING_RECOVERY_NODE';
 const KEYRING_RECOVERY_HELPER_ENV = 'PI_MCP_ADAPTER_KEYRING_RECOVERY_HELPER';
 const TEST_LINUX_KEYRING_RECOVERY_ENV = 'PI_MCP_ADAPTER_TEST_LINUX_KEYRING_RECOVERY';
+const AUTH_CACHE_DISABLED_ENV = 'PI_MCP_ADAPTER_DISABLE_AUTH_CACHE';
 const KEYRING_RECOVERY_TIMEOUT_MS = 10_000;
 const AUTH_CHUNK_MANIFEST_KEY = '__piMcpAdapterOAuthChunked';
 
@@ -148,8 +149,20 @@ interface AuthEntryChunkManifest {
 let KeyringEntryClass: KeyringEntryConstructor | undefined;
 const memoryAuthEntries = new Map<string, string>();
 
+let testAuthSecretStoreReadCount = 0;
+const authEntryCache = new Map<string, AuthEntry | undefined>();
+
+function isAuthEntryCacheEnabled(): boolean {
+  return process.env[AUTH_CACHE_DISABLED_ENV] !== '1';
+}
+
+function cloneAuthEntry(entry: AuthEntry | undefined): AuthEntry | undefined {
+  return entry === undefined ? undefined : structuredClone(entry);
+}
+
 const memoryAuthSecretStore: AuthSecretStore = {
   read(account) {
+    testAuthSecretStoreReadCount++;
     return memoryAuthEntries.get(account);
   },
   write(account, payload) {
@@ -175,6 +188,7 @@ const keyringAuthSecretStore: AuthSecretStore = {
 /** Mimics the Windows Credential Manager per-value ceiling for tests. */
 const sizeLimitedAuthSecretStore: AuthSecretStore = {
   read(account) {
+    testAuthSecretStoreReadCount++;
     return memoryAuthEntries.get(account);
   },
   write(account, payload) {
@@ -190,6 +204,7 @@ const sizeLimitedAuthSecretStore: AuthSecretStore = {
 
 const unavailableAuthSecretStore: AuthSecretStore = {
   read() {
+    testAuthSecretStoreReadCount++;
     throw new Error('simulated secure credential store unavailable');
   },
   write() {
@@ -206,6 +221,7 @@ function createKeyRevokedTestError(): Error {
 
 const keyRevokedAuthSecretStore: AuthSecretStore = {
   read() {
+    testAuthSecretStoreReadCount++;
     throw createKeyRevokedTestError();
   },
   write() {
@@ -218,6 +234,16 @@ const keyRevokedAuthSecretStore: AuthSecretStore = {
 
 export function resetTestAuthSecretStore(): void {
   memoryAuthEntries.clear();
+  authEntryCache.clear();
+  testAuthSecretStoreReadCount = 0;
+}
+
+export function resetAuthEntryCache(): void {
+  authEntryCache.clear();
+}
+
+export function getTestAuthSecretStoreReadCount(): number {
+  return testAuthSecretStoreReadCount;
 }
 
 export function getTestAuthSecretStoreEntries(): [string, string][] {
@@ -649,6 +675,19 @@ function writeSecureAuthEntryToStore(store: AuthSecretStore, serverName: string,
       error,
     );
   }
+
+  publishAuthEntryToCache(serverName, payload);
+}
+
+function publishAuthEntryToCache(serverName: string, payload: string): void {
+  if (!isAuthEntryCacheEnabled()) return;
+  // Cache the same normalized shape a fresh persistent-store read returns.
+  const normalized = toAuthEntry(JSON.parse(payload) as unknown);
+  if (!normalized) {
+    authEntryCache.delete(serverName);
+    return;
+  }
+  authEntryCache.set(serverName, cloneAuthEntry(normalized));
 }
 
 function writeSecureAuthEntry(serverName: string, entry: AuthEntry): void {
@@ -704,12 +743,23 @@ function readAuthEntry(
   options?: AuthStorageOptions,
   behavior: { migrateLegacy?: boolean } = {},
 ): AuthEntry | undefined {
+  // Status-only reads deliberately bypass the cache because they do not
+  // migrate legacy entries.
+  const cacheable = behavior.migrateLegacy !== false && isAuthEntryCacheEnabled();
+  if (cacheable && authEntryCache.has(serverName)) {
+    return cloneAuthEntry(authEntryCache.get(serverName));
+  }
+
+  let entry: AuthEntry | undefined;
   try {
-    return readAuthEntryFromStore(getAuthSecretStore(), serverName, options, behavior);
+    entry = readAuthEntryFromStore(getAuthSecretStore(), serverName, options, behavior);
   } catch (error) {
     if (!shouldAttemptLinuxKeyringRecovery(error)) throw error;
-    return readAuthEntryFromStore(linuxKeyringRecoveryAuthSecretStore, serverName, options, behavior);
+    entry = readAuthEntryFromStore(linuxKeyringRecoveryAuthSecretStore, serverName, options, behavior);
   }
+
+  if (cacheable) authEntryCache.set(serverName, cloneAuthEntry(entry));
+  return entry;
 }
 
 /**
@@ -794,9 +844,17 @@ export function removeAuthEntry(serverName: string, options?: AuthStorageOptions
     if (!shouldAttemptLinuxKeyringRecovery(error)) throw error;
     removeAuthEntryFromStore(linuxKeyringRecoveryAuthSecretStore, serverName);
   }
+  authEntryCache.delete(serverName);
   removeLegacyAuthEntry(serverName, options);
 }
 
+/**
+ * Forget a cached entry so the next ordinary read reloads secure storage.
+ */
+export function invalidateAuthEntryCache(serverName: string): void {
+  authEntryCache.delete(serverName);
+}
+
 /**
  * Update tokens for a server.
  */

package/node_modules/pi-mcp-adapter/mcp-panel.ts

@@ -1,11 +1,12 @@
 import { matchesKey, truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
 import { copyToClipboard } from "@earendil-works/pi-coding-agent";
 import { createPanelKeys, type PanelKeybindings, type PanelKeys } from "./panel-keys.ts";
-import { isServerDisabled, isToolAllowed } from "./types.ts";
+import { getToolNameCandidates, isServerDisabled, isToolAllowed, resolveToolPrefix } from "./types.ts";
 import type { McpConfig, McpPanelCallbacks, McpPanelResult, ServerProvenance, ToolPrefix } from "./types.ts";
 import { resourceNameToToolName } from "./resource-tools.ts";
 import { sanitizeTerminalText, stripOscSequences } from "./utils.ts";
-import type { MetadataCache, ServerCacheEntry, CachedTool } from "./metadata-cache.ts";
+import { isServerCacheValid, type MetadataCache, type ServerCacheEntry, type CachedTool } from "./metadata-cache.ts";
+import { isUiToolVisibleToModel } from "./ui-tool-visibility.ts";
 
 interface PanelTheme {
   border: string;
@@ -170,8 +171,8 @@ class McpPanel {
   private static readonly INACTIVITY_MS = 60_000;
 
   constructor(
-    config: McpConfig,
-    cache: MetadataCache | null,
+    private config: McpConfig,
+    private cache: MetadataCache | null,
     provenance: Map<string, ServerProvenance>,
     private callbacks: McpPanelCallbacks,
     tui: { requestRender(): void },
@@ -187,7 +188,8 @@ class McpPanel {
     for (const [serverName, definition] of Object.entries(config.mcpServers)) {
       if (this.authOnly && !callbacks.canAuthenticate(serverName)) continue;
       const prov = provenance.get(serverName);
-      const serverCache = cache?.servers?.[serverName];
+      const cachedEntry = this.cache?.servers?.[serverName];
+      const serverCache = cachedEntry && isServerCacheValid(cachedEntry, definition) ? cachedEntry : undefined;
 
       const globalDirect = config.settings?.directTools;
       let toolFilter: true | string[] | false = false;
@@ -200,7 +202,8 @@ class McpPanel {
       const tools: ToolState[] = [];
       if (serverCache && !this.authOnly && !isServerDisabled(definition)) {
         for (const tool of serverCache.tools ?? []) {
-          if (!isToolAllowed(tool.name, serverName, this.prefix, definition.includeTools, definition.excludeTools)) {
+          if (!isUiToolVisibleToModel(tool.uiVisibility)) continue;
+          if (!isToolAllowed(tool.name, serverName, this.prefix, definition.includeTools, definition.excludeTools, this.getOtherCurrentCandidates(serverName, definition, serverCache, tool.name))) {
             continue;
           }
 
@@ -216,7 +219,7 @@ class McpPanel {
         if (definition.exposeResources !== false) {
           for (const resource of serverCache.resources ?? []) {
             const baseName = `read_${resourceNameToToolName(resource.name)}`;
-            if (!isToolAllowed(baseName, serverName, this.prefix, definition.includeTools, definition.excludeTools)) {
+            if (!isToolAllowed(baseName, serverName, this.prefix, definition.includeTools, definition.excludeTools, this.getOtherCurrentCandidates(serverName, definition, serverCache, baseName))) {
               continue;
             }
 
@@ -563,6 +566,8 @@ class McpPanel {
       if (server.connectionStatus === "connected") {
         const entry = this.callbacks.refreshCacheAfterReconnect(server.name);
         if (entry) {
+          this.cache ??= { version: 1, servers: {} };
+          this.cache.servers[server.name] = entry;
           this.rebuildServerTools(server, entry);
         }
         server.hasCachedData = true;
@@ -636,13 +641,44 @@ class McpPanel {
     this.cursorIndex = Math.max(0, Math.min(this.visibleItems.length - 1, this.cursorIndex + delta));
   }
 
+  private getOtherCurrentCandidates(
+    serverName: string,
+    definition: McpConfig["mcpServers"][string],
+    currentEntry: ServerCacheEntry,
+    toolName: string,
+  ): Set<string> {
+    const candidates = new Set<string>();
+    for (const [otherServerName, otherDefinition] of Object.entries(this.config.mcpServers)) {
+      if (isServerDisabled(otherDefinition)) continue;
+      const cachedEntry = this.cache?.servers?.[otherServerName];
+      const entry = otherServerName === serverName
+        ? currentEntry
+        : cachedEntry && isServerCacheValid(cachedEntry, otherDefinition) ? cachedEntry : undefined;
+      if (!entry) continue;
+      const otherPrefix = resolveToolPrefix(otherDefinition, this.prefix);
+      for (const tool of entry.tools ?? []) {
+        if (!isUiToolVisibleToModel(tool.uiVisibility)) continue;
+        for (const candidate of getToolNameCandidates(tool.name, otherServerName, otherPrefix, false)) candidates.add(candidate);
+      }
+      if (otherDefinition.exposeResources !== false) {
+        for (const resource of entry.resources ?? []) {
+          const baseName = `read_${resourceNameToToolName(resource.name)}`;
+          for (const candidate of getToolNameCandidates(baseName, otherServerName, otherPrefix, false)) candidates.add(candidate);
+        }
+      }
+    }
+    for (const candidate of getToolNameCandidates(toolName, serverName, resolveToolPrefix(definition, this.prefix), false)) candidates.delete(candidate);
+    return candidates;
+  }
+
   private rebuildServerTools(server: ServerState, entry: ServerCacheEntry): void {
     const existingState = new Map<string, boolean>();
     for (const t of server.tools) existingState.set(t.name, t.isDirect);
 
     const newTools: ToolState[] = [];
     for (const tool of entry.tools ?? []) {
-      if (!isToolAllowed(tool.name, server.name, this.prefix, server.includeTools, server.excludeTools)) {
+      if (!isUiToolVisibleToModel(tool.uiVisibility)) continue;
+      if (!isToolAllowed(tool.name, server.name, this.prefix, server.includeTools, server.excludeTools, this.getOtherCurrentCandidates(server.name, server, entry, tool.name))) {
         continue;
       }
 
@@ -660,7 +696,7 @@ class McpPanel {
     if (server.exposeResources) {
       for (const resource of entry.resources ?? []) {
         const baseName = `read_${resourceNameToToolName(resource.name)}`;
-        if (!isToolAllowed(baseName, server.name, this.prefix, server.includeTools, server.excludeTools)) {
+        if (!isToolAllowed(baseName, server.name, this.prefix, server.includeTools, server.excludeTools, this.getOtherCurrentCandidates(server.name, server, entry, baseName))) {
           continue;
         }
 

package/node_modules/pi-mcp-adapter/mcp-script-worker.mjs

@@ -106,23 +106,25 @@ const capturedConsole = Object.freeze({
   debug: (...args) => emit(`[console.debug] ${formatWithOptions({ colors: false, depth: 4 }, ...args)}`),
 });
 
-try {
-  const context = vm.createContext(Object.assign(Object.create(null), {
-    tools,
-    emit,
-    console: capturedConsole,
-  }), {
-    codeGeneration: { strings: false, wasm: false },
-    name: "mcpScript",
-  });
-  const script = new vm.Script(`(async () => {\n${workerData.code}\n})()`, { filename: "mcpScript.js" });
-  const returnValue = await Promise.resolve(script.runInContext(context));
-  parentPort.postMessage(returnValue === undefined
-    ? { type: "done" }
-    : { type: "done", returnBlock: toContentBlock(returnValue) });
-} catch (error) {
-  parentPort.postMessage({
-    type: "error",
-    message: error instanceof Error ? error.message : String(error),
-  });
-}
+void (async () => {
+  try {
+    const context = vm.createContext(Object.assign(Object.create(null), {
+      tools,
+      emit,
+      console: capturedConsole,
+    }), {
+      codeGeneration: { strings: false, wasm: false },
+      name: "mcpScript",
+    });
+    const script = new vm.Script(`(async () => {\n${workerData.code}\n})()`, { filename: "mcpScript.js" });
+    const returnValue = await Promise.resolve(script.runInContext(context));
+    parentPort.postMessage(returnValue === undefined
+      ? { type: "done" }
+      : { type: "done", returnBlock: toContentBlock(returnValue) });
+  } catch (error) {
+    parentPort.postMessage({
+      type: "error",
+      message: error instanceof Error ? error.message : String(error),
+    });
+  }
+})();

package/node_modules/pi-mcp-adapter/metadata-cache.ts

@@ -19,7 +19,7 @@ import type {
   ToolMetadata,
   PromptMetadata,
 } from "./types.ts";
-import { formatPromptCommandName, formatToolName, isServerDisabled, isToolAllowed, resolveToolPrefix, type ToolPrefix } from "./types.ts";
+import { formatPromptCommandName, formatToolName, getToolNameCandidates, isServerDisabled, isToolAllowed, resolveToolPrefix, type ToolPrefix } from "./types.ts";
 import { resourceNameToToolName } from "./resource-tools.ts";
 import {
   extractToolUiStreamMode,
@@ -177,18 +177,41 @@ export function reconstructToolMetadata(
   serverName: string,
   entry: ServerCacheEntry,
   prefix: ToolPrefix,
-  definition: Pick<ServerEntry, "exposeResources" | "includeTools" | "excludeTools" | "toolPrefix">
+  definition: Pick<ServerEntry, "exposeResources" | "includeTools" | "excludeTools" | "toolPrefix">,
+  configuredServers?: Record<string, ServerEntry>,
+  cache?: MetadataCache,
 ): ToolMetadata[] {
   const metadata: ToolMetadata[] = [];
   const seenNames = new Set<string>();
   const effectivePrefix = resolveToolPrefix(definition, prefix);
+  const getOtherCurrentCandidates = (toolName: string): Set<string> | undefined => {
+    if (!configuredServers || !cache) return undefined;
+    const candidates = new Set<string>();
+    for (const [otherServerName, otherDefinition] of Object.entries(configuredServers)) {
+      const otherEntry = cache.servers[otherServerName];
+      if (!otherEntry || !isServerCacheValid(otherEntry, otherDefinition) || isServerDisabled(otherDefinition)) continue;
+      const otherPrefix = resolveToolPrefix(otherDefinition, prefix);
+      for (const otherTool of otherEntry.tools ?? []) {
+        if (!isUiToolVisibleToModel(otherTool.uiVisibility)) continue;
+        for (const candidate of getToolNameCandidates(otherTool.name, otherServerName, otherPrefix, false)) candidates.add(candidate);
+      }
+      if (otherDefinition.exposeResources !== false) {
+        for (const resource of otherEntry.resources ?? []) {
+          const baseName = `read_${resourceNameToToolName(resource.name)}`;
+          for (const candidate of getToolNameCandidates(baseName, otherServerName, otherPrefix, false)) candidates.add(candidate);
+        }
+      }
+    }
+    for (const candidate of getToolNameCandidates(toolName, serverName, effectivePrefix, false)) candidates.delete(candidate);
+    return candidates;
+  };
 
   for (const tool of entry.tools ?? []) {
     if (!tool?.name) continue;
     if (!isUiToolVisibleToModel(tool.uiVisibility)) {
       continue;
     }
-    if (!isToolAllowed(tool.name, serverName, effectivePrefix, definition.includeTools, definition.excludeTools)) {
+    if (!isToolAllowed(tool.name, serverName, effectivePrefix, definition.includeTools, definition.excludeTools, getOtherCurrentCandidates(tool.name))) {
       continue;
     }
 
@@ -213,7 +236,7 @@ export function reconstructToolMetadata(
     for (const resource of entry.resources ?? []) {
       if (!resource?.name || !resource?.uri) continue;
       const baseName = `read_${resourceNameToToolName(resource.name)}`;
-      if (!isToolAllowed(baseName, serverName, effectivePrefix, definition.includeTools, definition.excludeTools)) {
+      if (!isToolAllowed(baseName, serverName, effectivePrefix, definition.includeTools, definition.excludeTools, getOtherCurrentCandidates(baseName))) {
         continue;
       }
 

package/node_modules/pi-mcp-adapter/npx-resolver.ts

@@ -1,11 +1,11 @@
 // npx-resolver.ts - Resolve npx/npm exec binaries to avoid npm parent processes
-import { existsSync, readFileSync, realpathSync, readdirSync, statSync, writeFileSync, renameSync, mkdirSync, openSync, readSync, closeSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync, readdirSync, statSync, writeFileSync, renameSync, mkdirSync, openSync, readSync, closeSync, unlinkSync } from "node:fs";
 import { join, dirname, extname, resolve, sep } from "node:path";
 import { getAgentPath } from "./agent-dir.ts";
 import { throwIfAborted } from "./abort.ts";
 import crossSpawn from "cross-spawn";
 
-const CACHE_VERSION = 1;
+const CACHE_VERSION = 2;
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 const EXACT_PACKAGE_VERSION_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z][0-9A-Za-z.-]*)?(?:\+[0-9A-Za-z][0-9A-Za-z.-]*)?$/;
 
@@ -53,7 +53,7 @@ export async function resolveNpxBinary(
   if (!parsed) return null;
 
   const packageSpec = parsePackageSpec(parsed.packageSpec);
-  const cacheKey = JSON.stringify([command, ...args]);
+  const cacheKey = JSON.stringify([command, parsed.packageSpec, parsed.binName ?? ""]);
   const cache = loadCache();
   const cached = cache?.entries?.[cacheKey];
 
@@ -434,41 +434,96 @@ function getNpxCachePath(): string {
   return getAgentPath("mcp-npx-cache.json");
 }
 
-function loadCache(): NpxCache | null {
-  const cachePath = getNpxCachePath();
+function readNpxCachePayload(cachePath: string): unknown | null {
   if (!existsSync(cachePath)) return null;
   try {
-    const raw = JSON.parse(readFileSync(cachePath, "utf-8"));
-    if (!raw || typeof raw !== "object") return null;
-    if (raw.version !== CACHE_VERSION) return null;
-    if (!raw.entries || typeof raw.entries !== "object") return null;
-    return raw as NpxCache;
+    return JSON.parse(readFileSync(cachePath, "utf-8")) as unknown;
   } catch {
     return null;
   }
 }
 
-function saveCacheEntry(key: string, entry: NpxCacheEntry): void {
-  const cachePath = getNpxCachePath();
-  const dir = dirname(cachePath);
-  mkdirSync(dir, { recursive: true });
+function asRecord(value: unknown): Record<string, unknown> | null {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : null;
+}
+
+function createCacheEntries(): Record<string, NpxCacheEntry> {
+  return Object.create(null) as Record<string, NpxCacheEntry>;
+}
+
+function toNpxCacheEntry(value: unknown): NpxCacheEntry | null {
+  const raw = asRecord(value);
+  if (!raw) return null;
+  if (typeof raw.resolvedBin !== "string") return null;
+  if (typeof raw.resolvedAt !== "number" || !Number.isFinite(raw.resolvedAt)) return null;
+  if (typeof raw.isJs !== "boolean") return null;
+  if (raw.packageVersion !== undefined && typeof raw.packageVersion !== "string") return null;
+  return {
+    resolvedBin: raw.resolvedBin,
+    resolvedAt: raw.resolvedAt,
+    ...(raw.packageVersion !== undefined ? { packageVersion: raw.packageVersion } : {}),
+    isJs: raw.isJs,
+  };
+}
+
+function toNpxCache(value: unknown): NpxCache | null {
+  const raw = asRecord(value);
+  if (!raw || raw.version !== CACHE_VERSION) return null;
+  const rawEntries = asRecord(raw.entries);
+  if (!rawEntries) return null;
+
+  const entries = createCacheEntries();
+  for (const [key, rawEntry] of Object.entries(rawEntries)) {
+    const entry = toNpxCacheEntry(rawEntry);
+    if (entry) entries[key] = entry;
+  }
+  return { version: CACHE_VERSION, entries };
+}
 
-  let merged: NpxCache = { version: CACHE_VERSION, entries: {} };
+function clearLegacyCache(): boolean {
+  const cachePath = getNpxCachePath();
+  const raw = asRecord(readNpxCachePayload(cachePath));
+  if (raw?.version !== 1) return false;
   try {
-    if (existsSync(cachePath)) {
-      const existing = JSON.parse(readFileSync(cachePath, "utf-8")) as NpxCache;
-      if (existing && existing.version === CACHE_VERSION && existing.entries) {
-        merged.entries = { ...existing.entries };
-      }
-    }
+    unlinkSync(cachePath);
   } catch {
-    // Ignore parse errors
+    try {
+      writeFileSync(cachePath, "", "utf-8");
+    } catch {
+      // Cache cleanup is best effort; resolution must still proceed.
+    }
   }
+  return true;
+}
 
-  merged.entries[key] = entry;
-  const tmpPath = `${cachePath}.${process.pid}.tmp`;
-  writeFileSync(tmpPath, JSON.stringify(merged, null, 2), "utf-8");
-  renameSync(tmpPath, cachePath);
+clearLegacyCache();
+
+function loadCache(): NpxCache | null {
+  if (clearLegacyCache()) return null;
+
+  return toNpxCache(readNpxCachePayload(getNpxCachePath()));
+}
+
+function saveCacheEntry(key: string, entry: NpxCacheEntry): void {
+  try {
+    const cachePath = getNpxCachePath();
+    const dir = dirname(cachePath);
+    mkdirSync(dir, { recursive: true });
+
+    const existing = toNpxCache(readNpxCachePayload(cachePath));
+    const entries = createCacheEntries();
+    if (existing) Object.assign(entries, existing.entries);
+    const merged: NpxCache = { version: CACHE_VERSION, entries };
+
+    merged.entries[key] = entry;
+    const tmpPath = `${cachePath}.${process.pid}.tmp`;
+    writeFileSync(tmpPath, JSON.stringify(merged, null, 2), "utf-8");
+    renameSync(tmpPath, cachePath);
+  } catch {
+    // Cache writes are best effort; resolution must still proceed.
+  }
 }
 
 function safeRealpath(path: string): string {

package/node_modules/pi-mcp-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-mcp-adapter",
-  "version": "2.23.0",
+  "version": "2.25.0",
   "description": "MCP (Model Context Protocol) adapter extension for Pi coding agent",
   "type": "module",
   "types": "./index.ts",
@@ -34,8 +34,8 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
-    "test:oauth": "PI_MCP_ADAPTER_TEST_AUTH_STORE=memory node --import tsx --test --test-concurrency=1 oauth-public-api.test.ts mcp-auth.test.ts mcp-auth-flow.test.ts mcp-callback-server.test.ts mcp-oauth-provider.test.ts",
-    "test:oauth-provider": "PI_MCP_ADAPTER_TEST_AUTH_STORE=memory node --import tsx --test mcp-oauth-provider.test.ts",
+    "test:oauth": "PI_MCP_ADAPTER_TEST_AUTH_STORE=memory PI_MCP_ADAPTER_DISABLE_AUTH_CACHE=1 node --import tsx --test --test-concurrency=1 oauth-public-api.test.ts mcp-auth.test.ts mcp-auth-flow.test.ts mcp-callback-server.test.ts mcp-oauth-provider.test.ts",
+    "test:oauth-provider": "PI_MCP_ADAPTER_TEST_AUTH_STORE=memory PI_MCP_ADAPTER_DISABLE_AUTH_CACHE=1 node --import tsx --test mcp-oauth-provider.test.ts",
     "test:conformance": "bash conformance/run.sh"
   },
   "repository": {