@herbertgao/pi-extensions 2026.8.3 → 2026.8.5

package/node_modules/pi-mcp-adapter/proxy-modes.ts

@@ -16,7 +16,7 @@ import { maybeStartUiSession, summarizeUiSessionResult, type UiSessionRuntime }
 import { formatAuthRequiredMessage, formatMcpStatus, resolveServerUrl, truncateAtWord } from "./utils.ts";
 import { authenticate, completeAuthFromInput, startAuth, supportsOAuth } from "./mcp-auth-flow.ts";
 import { SessionRecoveryAuthRequiredError, withSessionRecovery } from "./session-recovery.ts";
-import { paginate, rankSuggestions, rankToolMatches } from "./search-ranking.ts";
+import { paginate, rankSuggestions, rankToolMatches, resolveSearchKeywords } from "./search-ranking.ts";
 import { ensureToolCallApproved, isToolCallApprovalRequired } from "./tool-approval.ts";
 
 type ProxyToolResult = AgentToolResult<Record<string, unknown>>;
@@ -37,6 +37,36 @@ type AutoAuthResult =
   | { status: "success" }
   | { status: "failed"; message: string };
 
+function getToolMatches(metadata: ToolMetadata[] | undefined, toolName: string, exact: boolean): ToolMetadata[] {
+  if (!metadata) return [];
+  if (exact) return metadata.filter(tool => tool.name === toolName);
+  const normalizedName = toolName.replace(/-/g, "_");
+  return metadata.filter(tool => tool.name.replace(/-/g, "_") === normalizedName);
+}
+
+function getEnabledToolMatches(state: McpExtensionState, toolName: string, exact: boolean): { server: string; tool: ToolMetadata }[] {
+  const matches: { server: string; tool: ToolMetadata }[] = [];
+  for (const [server, metadata] of state.toolMetadata) {
+    if (isServerDisabled(state.config.mcpServers[server])) continue;
+    for (const tool of getToolMatches(metadata, toolName, exact)) matches.push({ server, tool });
+  }
+  return matches;
+}
+
+function getSingleToolMatch(metadata: ToolMetadata[] | undefined, toolName: string): ToolMetadata | "ambiguous" | undefined {
+  const exactMatches = getToolMatches(metadata, toolName, true);
+  const matches = exactMatches.length > 0 ? exactMatches : getToolMatches(metadata, toolName, false);
+  return matches.length > 1 ? "ambiguous" : matches[0];
+}
+
+function ambiguousToolResult(mode: "call" | "describe", toolName: string): ProxyToolResult {
+  const message = `Tool "${toolName}" matches multiple servers. Specify a server.`;
+  return {
+    content: [{ type: "text" as const, text: message }],
+    details: { mode, error: "ambiguous_tool", requestedTool: toolName, message },
+  };
+}
+
 function disabledResult(mode: string, serverName: string): ProxyToolResult {
   const message = `Server "${serverName}" is disabled. Run /mcp enable ${serverName} and /reload to enable it.`;
   return {
@@ -404,20 +434,28 @@ export async function executeAuthComplete(state: McpExtensionState, serverName:
 }
 
 export function executeDescribe(state: McpExtensionState, toolName: string): ProxyToolResult {
-  let serverName: string | undefined;
-  let toolMeta: ToolMetadata | undefined;
+  const exactMatches = getEnabledToolMatches(state, toolName, true);
+  if (exactMatches.length > 1) return ambiguousToolResult("describe", toolName);
+  if (exactMatches.length === 0 && getEnabledToolMatches(state, toolName, false).length > 1) {
+    return ambiguousToolResult("describe", toolName);
+  }
+
+  let serverName = exactMatches[0]?.server;
+  let toolMeta = exactMatches[0]?.tool;
   let disabledMatch: string | undefined;
 
-  for (const [server, metadata] of state.toolMetadata.entries()) {
-    const found = findToolByName(metadata, toolName);
-    if (!found) continue;
-    if (isServerDisabled(state.config.mcpServers[server])) {
-      disabledMatch ??= server;
-      continue;
+  if (!toolMeta) {
+    for (const [server, metadata] of state.toolMetadata.entries()) {
+      const found = findToolByName(metadata, toolName);
+      if (!found) continue;
+      if (isServerDisabled(state.config.mcpServers[server])) {
+        disabledMatch ??= server;
+        continue;
+      }
+      serverName = server;
+      toolMeta = found;
+      break;
     }
-    serverName = server;
-    toolMeta = found;
-    break;
   }
 
   if (!serverName || !toolMeta) {
@@ -430,7 +468,7 @@ export function executeDescribe(state: McpExtensionState, toolName: string): Pro
     };
   }
 
-  const approvalMarker = isToolCallApprovalRequired(state.config, serverName, toolMeta)
+  const approvalMarker = isToolCallApprovalRequired(state.config, serverName, toolMeta, state.toolMetadata)
     ? " (requires approval)"
     : "";
   let text = `${toolMeta.name}${approvalMarker}\n`;
@@ -503,11 +541,15 @@ export function executeSearch(
     }
 
     matches = [];
+    const globalPrefix = state.config.settings?.toolPrefix ?? "server";
     for (const [serverName, metadata] of state.toolMetadata.entries()) {
-      if (isServerDisabled(state.config.mcpServers[serverName])) continue;
+      const definition = state.config.mcpServers[serverName];
+      if (isServerDisabled(definition)) continue;
       if (server && serverName !== server) continue;
       for (const tool of metadata) {
-        if (pattern.test(tool.name) || pattern.test(tool.description)) matches.push({ server: serverName, tool, score: 0 });
+        const matched = pattern.test(tool.name) || pattern.test(tool.description)
+          || resolveSearchKeywords(definition, tool.originalName, serverName, globalPrefix).some(keyword => pattern.test(keyword));
+        if (matched) matches.push({ server: serverName, tool, score: 0 });
       }
     }
   } else if (query.trim().length === 0) {
@@ -553,7 +595,7 @@ export function executeSearch(
 
   let text = `Found ${page.total} tool${page.total === 1 ? "" : "s"} matching "${query}":\n\n`;
   for (const match of page.items) {
-    const approvalMarker = isToolCallApprovalRequired(state.config, match.server, match.tool)
+    const approvalMarker = isToolCallApprovalRequired(state.config, match.server, match.tool, state.toolMetadata)
       ? " (requires approval)"
       : "";
     if (showSchemas) {
@@ -733,7 +775,7 @@ export async function executeConnect(state: McpExtensionState, serverName: strin
       }
     }
     const prefix = state.config.settings?.toolPrefix ?? "server";
-    const { metadata } = buildToolMetadata(connection.tools, connection.resources, definition, serverName, prefix);
+    const { metadata } = buildToolMetadata(connection.tools, connection.resources, definition, serverName, prefix, state.config.mcpServers, state.toolMetadata);
     state.toolMetadata.set(serverName, metadata);
     if (!connection.promptDiscoveryFailed) {
       state.promptMetadata?.set(serverName, reconstructPromptMetadata(serverName, connection.prompts ?? [], prefix, definition));
@@ -801,14 +843,22 @@ export async function executeCall(
     };
   }
   if (serverName) {
-    toolMeta = findToolByName(state.toolMetadata.get(serverName), toolName);
+    const match = getSingleToolMatch(state.toolMetadata.get(serverName), toolName);
+    if (match === "ambiguous") return ambiguousToolResult("call", toolName);
+    toolMeta = match;
     if (isServerDisabled(state.config.mcpServers[serverName])) {
       return disabledCallResult(serverName, toolMeta);
     }
   } else {
+    const exactMatches = getEnabledToolMatches(state, toolName, true);
+    if (exactMatches.length > 1) return ambiguousToolResult("call", toolName);
+    if (exactMatches.length === 0 && getEnabledToolMatches(state, toolName, false).length > 1) {
+      return ambiguousToolResult("call", toolName);
+    }
+
     let disabledMatch: { serverName: string; toolMeta: ToolMetadata } | undefined;
     for (const [server, metadata] of state.toolMetadata.entries()) {
-      const found = findToolByName(metadata, toolName);
+      const found = metadata.find(tool => tool.name === toolName);
       if (!found) continue;
       if (isServerDisabled(state.config.mcpServers[server])) {
         disabledMatch ??= { serverName: server, toolMeta: found };
@@ -818,13 +868,28 @@ export async function executeCall(
       toolMeta = found;
       break;
     }
+    if (!toolMeta && !disabledMatch) {
+      for (const [server, metadata] of state.toolMetadata.entries()) {
+        const found = findToolByName(metadata, toolName);
+        if (!found) continue;
+        if (isServerDisabled(state.config.mcpServers[server])) {
+          disabledMatch ??= { serverName: server, toolMeta: found };
+          continue;
+        }
+        serverName = server;
+        toolMeta = found;
+        break;
+      }
+    }
     if (!toolMeta && disabledMatch) return disabledCallResult(disabledMatch.serverName, disabledMatch.toolMeta);
   }
 
   if (serverName && !toolMeta) {
     const connected = await lazyConnect(state, serverName, ownedSignal);
     if (connected) {
-      toolMeta = findToolByName(state.toolMetadata.get(serverName), toolName);
+      const match = getSingleToolMatch(state.toolMetadata.get(serverName), toolName);
+      if (match === "ambiguous") return ambiguousToolResult("call", toolName);
+      toolMeta = match;
     } else {
       const needsAuthConnection = state.manager.getConnection(serverName);
       if (needsAuthConnection?.status === "needs-auth") {
@@ -842,7 +907,9 @@ export async function executeCall(
             clearFailure(state, serverName);
             const connectedAfterAuth = await lazyConnect(state, serverName, ownedSignal);
             if (connectedAfterAuth) {
-              toolMeta = findToolByName(state.toolMetadata.get(serverName), toolName);
+              const match = getSingleToolMatch(state.toolMetadata.get(serverName), toolName);
+              if (match === "ambiguous") return ambiguousToolResult("call", toolName);
+              toolMeta = match;
               if (!toolMeta) {
                 const suggestions = rankSuggestions(state, toolName, 5);
                 const suggestionText = suggestions.length > 0 ? ` Did you mean: ${suggestions.join(", ")}` : "";
@@ -879,6 +946,8 @@ export async function executeCall(
   let prefixMatchedServer: string | undefined;
 
   if (!serverName && !toolMeta && prefixMode !== "none") {
+    const lazyExactMatches: { serverName: string; toolMeta: ToolMetadata }[] = [];
+    const lazyFallbackMatches: { serverName: string; toolMeta: ToolMetadata }[] = [];
     const candidates = Object.keys(state.config.mcpServers)
       .filter(name => !isServerDisabled(state.config.mcpServers[name]))
       .map(name => ({ name, prefix: getServerPrefix(name, prefixMode) }))
@@ -909,11 +978,22 @@ export async function executeCall(
 
       if (!connected) continue;
       if (!prefixMatchedServer) prefixMatchedServer = configuredServer;
-      toolMeta = findToolByName(state.toolMetadata.get(configuredServer), toolName);
-      if (toolMeta) {
-        serverName = configuredServer;
-        break;
+      const metadata = state.toolMetadata.get(configuredServer);
+      const exactMatches = getToolMatches(metadata, toolName, true);
+      if (exactMatches.length > 1) return ambiguousToolResult("call", toolName);
+      if (exactMatches.length === 1) {
+        lazyExactMatches.push({ serverName: configuredServer, toolMeta: exactMatches[0]! });
+        continue;
       }
+      const fallbackMatches = getToolMatches(metadata, toolName, false);
+      if (fallbackMatches.length > 1) return ambiguousToolResult("call", toolName);
+      if (fallbackMatches.length === 1) lazyFallbackMatches.push({ serverName: configuredServer, toolMeta: fallbackMatches[0]! });
+    }
+    const lazyMatches = lazyExactMatches.length > 0 ? lazyExactMatches : lazyFallbackMatches;
+    if (lazyMatches.length > 1) return ambiguousToolResult("call", toolName);
+    if (lazyMatches.length === 1) {
+      serverName = lazyMatches[0]!.serverName;
+      toolMeta = lazyMatches[0]!.toolMeta;
     }
   }
 
@@ -1026,7 +1106,9 @@ export async function executeCall(
       notifyToolMetadataUpdated(state, serverName, "proxy-call-reconnect");
       markKeepAliveAfterConnect(state, serverName);
       updateStatusBar(state);
-      toolMeta = findToolByName(state.toolMetadata.get(serverName), toolName);
+      const match = getSingleToolMatch(state.toolMetadata.get(serverName), toolName);
+      if (match === "ambiguous") return ambiguousToolResult("call", toolName);
+      toolMeta = match;
       if (!toolMeta) {
         const available = getToolNames(state, serverName);
         const hint = available.length > 0

package/node_modules/pi-mcp-adapter/search-ranking.ts

@@ -1,6 +1,6 @@
 import type { McpExtensionState } from "./state.ts";
-import type { ToolMetadata } from "./types.ts";
-import { getServerPrefix, isServerDisabled } from "./types.ts";
+import type { ServerEntry, ToolMetadata, ToolPrefix } from "./types.ts";
+import { getServerPrefix, getToolNameCandidates, isServerDisabled, matchesToolPattern, resolveToolPrefix } from "./types.ts";
 
 /**
  * Shortest field token allowed to stem-match a longer query token.
@@ -14,6 +14,7 @@ const FIELD_WEIGHTS = {
   originalName: 10,
   server: 8,
   description: 5,
+  keywords: 5,
 } as const;
 
 export interface RankedToolMatch {
@@ -22,6 +23,36 @@ export interface RankedToolMatch {
   score: number;
 }
 
+/**
+ * Resolve the configured searchKeywords entries that apply to a tool.
+ * Keys match by original name, prefixed name, or glob — the same candidate
+ * set includeTools/excludeTools use — and all matching entries are unioned.
+ */
+export function resolveSearchKeywords(
+  definition: ServerEntry | undefined,
+  toolOriginalName: string,
+  serverName: string,
+  globalPrefix: ToolPrefix,
+): string[] {
+  const map = definition?.searchKeywords;
+  if (!map || typeof map !== "object" || Array.isArray(map)) return [];
+  const candidates = getToolNameCandidates(toolOriginalName, serverName, resolveToolPrefix(definition, globalPrefix));
+  const keywords: string[] = [];
+  const seen = new Set<string>();
+  for (const [pattern, values] of Object.entries(map)) {
+    if (!Array.isArray(values)) continue;
+    if (!matchesToolPattern(candidates, [pattern])) continue;
+    for (const value of values) {
+      if (typeof value !== "string") continue;
+      const trimmed = value.trim();
+      if (!trimmed || seen.has(trimmed)) continue;
+      seen.add(trimmed);
+      keywords.push(trimmed);
+    }
+  }
+  return keywords;
+}
+
 export function normalizeSearchText(value: string): string {
   return value
     .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
@@ -33,7 +64,7 @@ export function tokenize(value: string): string[] {
   return normalizeSearchText(value).split(/[^a-z0-9]+/).filter(Boolean);
 }
 
-export function scoreToolMatch(tool: ToolMetadata, server: string, query: string): number | null {
+export function scoreToolMatch(tool: ToolMetadata, server: string, query: string, keywords?: string[]): number | null {
   const normalizedQuery = normalizeSearchText(query).trim();
   const queryTokens = tokenize(query);
   if (queryTokens.length === 0) return null;
@@ -78,6 +109,43 @@ export function scoreToolMatch(tool: ToolMetadata, server: string, query: string
     }
   }
 
+  // Configured keywords are discrete phrases, so the phrase-level bonus is
+  // computed per phrase (best match wins) rather than on a joined string,
+  // which would phrase-match queries spanning two unrelated keywords.
+  if (keywords !== undefined && keywords.length > 0) {
+    const weight = FIELD_WEIGHTS.keywords;
+    const phrases = keywords.map(keyword => normalizeSearchText(keyword).trim()).filter(Boolean);
+    let phraseScore = 0;
+    for (const phrase of phrases) {
+      if (phrase === normalizedQuery) {
+        phraseScore = Math.max(phraseScore, weight * 14);
+        phraseMatched = true;
+        wholeFieldExact = true;
+      } else if (phrase.startsWith(normalizedQuery)) {
+        phraseScore = Math.max(phraseScore, weight * 9);
+        phraseMatched = true;
+      } else if (phrase.includes(normalizedQuery)) {
+        phraseScore = Math.max(phraseScore, weight * 6);
+        phraseMatched = true;
+      }
+    }
+    score += phraseScore;
+
+    const keywordTokens = phrases.flatMap(tokenize);
+    for (const token of queryTokens) {
+      if (keywordTokens.includes(token)) {
+        score += weight * 4;
+        matchedTokens.add(token);
+      } else if (keywordTokens.some(keywordToken => keywordToken.startsWith(token) || (keywordToken.length >= MIN_STEM_LENGTH && token.startsWith(keywordToken)))) {
+        score += weight * 2;
+        matchedTokens.add(token);
+      } else if (phrases.some(phrase => phrase.includes(token))) {
+        score += weight;
+        matchedTokens.add(token);
+      }
+    }
+  }
+
   const coverage = matchedTokens.size / queryTokens.length;
   if (!phraseMatched && (queryTokens.length <= 2 ? coverage !== 1 : coverage < 0.6)) return null;
 
@@ -88,13 +156,24 @@ export function scoreToolMatch(tool: ToolMetadata, server: string, query: string
   return score;
 }
 
-export function rankToolMatches(state: McpExtensionState, query: string, server?: string): RankedToolMatch[] {
+export function rankToolMatches(
+  state: McpExtensionState,
+  query: string,
+  server?: string,
+  includeKeywords = true,
+): RankedToolMatch[] {
   const matches: RankedToolMatch[] = [];
+  const globalPrefix = state.config.settings?.toolPrefix ?? "server";
   for (const [serverName, metadata] of state.toolMetadata.entries()) {
     if (server && serverName !== server) continue;
-    if (isServerDisabled(state.config.mcpServers[serverName])) continue;
+    const definition = state.config.mcpServers[serverName];
+    if (isServerDisabled(definition)) continue;
+    const hasKeywords = includeKeywords && definition?.searchKeywords !== undefined;
     for (const tool of metadata) {
-      const score = scoreToolMatch(tool, serverName, query);
+      const keywords = hasKeywords
+        ? resolveSearchKeywords(definition, tool.originalName, serverName, globalPrefix)
+        : undefined;
+      const score = scoreToolMatch(tool, serverName, query, keywords);
       if (score !== null) matches.push({ server: serverName, tool, score });
     }
   }
@@ -123,5 +202,5 @@ export function rankSuggestions(state: McpExtensionState, name: string, limit: n
     .sort((a, b) => b.length - a.length)
     .map(candidate => name.slice(candidate.length + 1));
   const query = stripped[0] ?? name;
-  return rankToolMatches(state, query).slice(0, limit).map(match => match.tool.name);
+  return rankToolMatches(state, query, undefined, false).slice(0, limit).map(match => match.tool.name);
 }

package/node_modules/pi-mcp-adapter/server-manager.ts

@@ -31,7 +31,7 @@ import { createJsonSchemaValidator } from "./json-schema-validator.ts";
 import { logger } from "./logger.ts";
 import { McpOAuthProvider } from "./mcp-oauth-provider.ts";
 import { extractOAuthConfig, supportsOAuth, type McpOAuthRuntime } from "./mcp-auth-flow.ts";
-import type { AuthStorageOptions } from "./mcp-auth.ts";
+import { invalidateAuthEntryCache, type AuthStorageOptions } from "./mcp-auth.ts";
 import { registerSamplingHandler, type ServerSamplingConfig } from "./sampling-handler.ts";
 import {
   handleUrlElicitation,
@@ -39,6 +39,7 @@ import {
   type ServerElicitationConfig,
 } from "./elicitation-handler.ts";
 import {
+  interpolateEnvVars,
   resolveBearerToken,
   resolveCommandSecret,
   resolveCommandSecretsRecord,
@@ -129,8 +130,11 @@ export interface ServerConnection {
   lastUsedAt: number;
   inFlight: number;
   status: "connected" | "closed" | "needs-auth";
+  /** True once this needs-auth episode discarded the cached credential. */
+  credentialsInvalidated?: boolean;
 }
 
+
 type UiStreamListener = (serverName: string, notification: ServerStreamResultPatchNotification["params"]) => void;
 type MetadataListChangedListener = (serverName: string, reason: string) => void;
 
@@ -238,10 +242,12 @@ export class McpServerManager {
       return existing;
     }
 
+    const credentialsInvalidated = existing?.status === "needs-auth"
+      && existing.credentialsInvalidated === true;
     const generation = this.closeGenerations.get(name) ?? 0;
     const attemptController = new AbortController();
     const attemptSignal = combineAbortSignals(ownedSignal, attemptController.signal);
-    const connectionAttempt = this.createConnection(name, definition, attemptSignal, ownedSignal);
+    const connectionAttempt = this.createConnection(name, definition, attemptSignal, ownedSignal, credentialsInvalidated);
     const promise = definition.url
       ? connectionAttempt.catch(async error => { throw await this.enrichHttpConnectionError(definition, error); })
       : connectionAttempt;
@@ -324,6 +330,7 @@ export class McpServerManager {
     definition: ServerDefinition,
     signal?: AbortSignal,
     requestSignal?: AbortSignal,
+    credentialsInvalidated = false,
   ): Promise<ServerConnection> {
     throwIfAborted(signal);
 
@@ -338,6 +345,7 @@ export class McpServerManager {
     let client: Client;
     let transport: Transport;
     let clientConnected = false;
+    let invalidated = credentialsInvalidated;
     let transportAlreadyTraced = false;
     let stderrTail: Buffer<ArrayBufferLike> = Buffer.alloc(0);
     const configuredTransports = [definition.command, definition.url, definition.socket]
@@ -351,7 +359,7 @@ export class McpServerManager {
     if (definition.command) {
       client = this.createClient(name, definition);
       let command = definition.command;
-      let args = definition.args ?? [];
+      let args = (definition.args ?? []).map(interpolateEnvVars);
 
       if (command === "npx" || command === "npm") {
         const resolved = await resolveNpxBinary(command, args, signal);
@@ -387,9 +395,11 @@ export class McpServerManager {
         requestOptions,
         signal,
         traceObserver,
+        invalidated,
       );
       client = httpConnection.client;
       transport = httpConnection.transport;
+      invalidated = httpConnection.credentialsInvalidated;
       if (httpConnection.status === "needs-auth") {
         return {
           client,
@@ -401,6 +411,7 @@ export class McpServerManager {
           lastUsedAt: Date.now(),
           inFlight: 0,
           status: "needs-auth",
+          credentialsInvalidated: invalidated,
         };
       }
       clientConnected = true;
@@ -477,6 +488,10 @@ export class McpServerManager {
       // A cleanup failure remains a setup failure rather than being hidden
       // behind needs-auth.
       if (isUnauthorizedHttpError(error) && supportsOAuth(definition) && cleanupFailures.length === 0) {
+        if (!invalidated) {
+          invalidateAuthEntryCache(name);
+          invalidated = true;
+        }
         return {
           client,
           transport,
@@ -487,6 +502,7 @@ export class McpServerManager {
           lastUsedAt: Date.now(),
           inFlight: 0,
           status: "needs-auth",
+          credentialsInvalidated: invalidated,
         };
       }
 
@@ -694,7 +710,8 @@ export class McpServerManager {
     requestOptions: RequestOptions | undefined,
     signal?: AbortSignal,
     traceObserver?: McpTraceObserver,
-  ): Promise<{ client: Client; transport: Transport; status: "connected" | "needs-auth" }> {
+    credentialsInvalidated = false,
+  ): Promise<{ client: Client; transport: Transport; status: "connected" | "needs-auth"; credentialsInvalidated: boolean }> {
     throwIfAborted(signal);
     const serverUrl = resolveServerUrl(definition)!;
     const url = new URL(serverUrl);
@@ -791,9 +808,10 @@ export class McpServerManager {
     // OAuth challenge; use SSE only for definitive endpoint incompatibility.
     // Agent Plugins set httpTransport, and their declared transport is used without fallback.
     let kind: "streamable-http" | "sse" = definition.httpTransport ?? "streamable-http";
+    let invalidated = credentialsInvalidated;
     for (;;) {
       const result = await attempt(kind);
-      if (result.status === "connected") return result;
+      if (result.status === "connected") return { ...result, credentialsInvalidated: invalidated };
       if (result.error instanceof AggregateError
         && result.error.message === "MCP connection abort cleanup failed") {
         throw result.error;
@@ -806,7 +824,16 @@ export class McpServerManager {
       }
       if (isUnauthorizedHttpError(result.error)) {
         if (supportsOAuth(definition)) {
-          return { client: result.client, transport: result.transport, status: "needs-auth" };
+          if (!invalidated) {
+            invalidateAuthEntryCache(serverName);
+            invalidated = true;
+          }
+          return {
+            client: result.client,
+            transport: result.transport,
+            status: "needs-auth",
+            credentialsInvalidated: invalidated,
+          };
         }
         throw result.error;
       }
@@ -850,6 +877,7 @@ export class McpServerManager {
       return { prompts, failed: false };
     } catch (error) {
       if (requestOptions?.signal?.aborted) throwIfAborted(requestOptions.signal);
+      if (isUnauthorizedHttpError(error)) throw error;
       const message = error instanceof Error ? error.message : String(error);
       logger.debug(`MCP: prompts/list failed: ${message}`);
       return { prompts: [], failed: true };
@@ -871,10 +899,11 @@ export class McpServerManager {
       } while (cursor);
 
       return allResources;
-    } catch {
+    } catch (error) {
       if (requestOptions?.signal?.aborted) {
         throwIfAborted(requestOptions.signal);
       }
+      if (isUnauthorizedHttpError(error)) throw error;
       // The server advertises resources but the listing failed
       return [];
     }

package/node_modules/pi-mcp-adapter/session-recovery.ts

@@ -20,10 +20,12 @@
 //     many things other than "your session is gone"
 //   - treat generic -32000/ConnectionClosed errors as session expiry
 //   - treat AbortError/cancellation as a session failure
-import { ProtocolError, SdkHttpError } from "@modelcontextprotocol/client";
+import { ProtocolError, SdkHttpError, UnauthorizedError } from "@modelcontextprotocol/client";
 import { logger } from "./logger.ts";
 import { throwIfAborted } from "./abort.ts";
 import { isServerDisabled, type McpConfig } from "./types.ts";
+import { supportsOAuth } from "./mcp-auth-flow.ts";
+import { invalidateAuthEntryCache } from "./mcp-auth.ts";
 import type { McpServerManager, ServerConnection } from "./server-manager.ts";
 
 /**
@@ -106,6 +108,11 @@ export async function withSessionRecovery<T>(
   try {
     return await fn(connection);
   } catch (err) {
+    const definition = deps.config.mcpServers[serverName];
+    if (definition && supportsOAuth(definition)
+      && (err instanceof UnauthorizedError || (err instanceof SdkHttpError && err.status === 401))) {
+      invalidateAuthEntryCache(serverName);
+    }
     if (!isTerminatedSession(err, hadSessionId)) {
       throw err;
     }
@@ -114,7 +121,6 @@ export async function withSessionRecovery<T>(
     // connection's definition, in case config changed since connect. If the
     // server was removed from config in the meantime there is nothing to
     // reconnect to, so surface the original error.
-    const definition = deps.config.mcpServers[serverName];
     if (!definition) {
       throw err;
     }

package/node_modules/pi-mcp-adapter/tool-approval.ts

@@ -24,19 +24,59 @@ export function isToolCallApprovalRequired(
   config: McpConfig,
   serverName: string,
   toolMeta: Pick<ToolMetadata, "originalName">,
+  toolMetadata?: ReadonlyMap<string, readonly ToolMetadata[]>,
 ): boolean {
   const definition = config.mcpServers[serverName];
-  const approval = definition?.approveTools !== undefined
-    ? definition.approveTools
-    : config.settings?.approveTools;
+  const serverApproval = definition?.approveTools;
+  const approval = serverApproval !== undefined ? serverApproval : config.settings?.approveTools;
 
   if (approval === true) return true;
   if (!Array.isArray(approval) || approval.length === 0) return false;
 
   const prefix = resolveToolPrefix(definition, config.settings?.toolPrefix);
-  return matchesToolPattern(
-    getToolNameCandidates(toolMeta.originalName, serverName, prefix),
-    approval,
+  const currentCandidates = getToolNameCandidates(toolMeta.originalName, serverName, prefix, false);
+  if (serverApproval !== undefined) {
+    if (matchesToolPattern(currentCandidates, approval)) return true;
+    if (!toolMetadata) return matchesToolPattern(getToolNameCandidates(toolMeta.originalName, serverName, prefix), approval);
+    const legacyCandidates = getToolNameCandidates(toolMeta.originalName, serverName, prefix);
+    const legacyEmittedName = [...currentCandidates].find(candidate => candidate !== toolMeta.originalName)?.replace(/-/g, "_");
+    if (legacyEmittedName) legacyCandidates.add(legacyEmittedName);
+    for (const candidate of currentCandidates) legacyCandidates.delete(candidate);
+    const otherCurrentCandidates = new Set<string>();
+    for (const tool of toolMetadata.get(serverName) ?? []) {
+      for (const candidate of getToolNameCandidates(tool.originalName, serverName, prefix, false)) {
+        otherCurrentCandidates.add(candidate);
+      }
+    }
+    for (const candidate of currentCandidates) otherCurrentCandidates.delete(candidate);
+    return approval.some(pattern =>
+      matchesToolPattern(legacyCandidates, [pattern])
+      && !matchesToolPattern(otherCurrentCandidates, [pattern]),
+    );
+  }
+
+
+  if (matchesToolPattern(currentCandidates, approval)) return true;
+  if (!toolMetadata) return false;
+
+  const legacyCandidates = getToolNameCandidates(toolMeta.originalName, serverName, prefix);
+  const legacyEmittedName = [...currentCandidates].find(candidate => candidate !== toolMeta.originalName)?.replace(/-/g, "_");
+  if (legacyEmittedName) legacyCandidates.add(legacyEmittedName);
+  for (const candidate of currentCandidates) legacyCandidates.delete(candidate);
+  const otherCurrentCandidates = new Set<string>();
+  for (const [name, metadata] of toolMetadata) {
+    const otherPrefix = resolveToolPrefix(config.mcpServers[name], config.settings?.toolPrefix);
+    for (const tool of metadata) {
+      for (const candidate of getToolNameCandidates(tool.originalName, name, otherPrefix, false)) {
+        otherCurrentCandidates.add(candidate);
+      }
+    }
+  }
+  for (const candidate of currentCandidates) otherCurrentCandidates.delete(candidate);
+
+  return approval.some(pattern =>
+    matchesToolPattern(legacyCandidates, [pattern])
+    && !matchesToolPattern(otherCurrentCandidates, [pattern]),
   );
 }
 
@@ -94,6 +134,7 @@ export async function ensureToolCallApproved(
   args: Record<string, unknown> | undefined,
   signal?: AbortSignal,
   origin: McpToolApprovalOrigin = toolMeta.resourceUri ? "resource" : "proxy",
+  approvalMetadata?: ReadonlyMap<string, readonly ToolMetadata[]>,
 ): Promise<ToolCallApprovalResult> {
   const cacheKey = `${serverName}\u0000${toolMeta.originalName}`;
   const approvedToolCalls = state.approvedToolCalls ??= new Map<string, true>();
@@ -109,7 +150,7 @@ export async function ensureToolCallApproved(
   }
   if (brokerDecision === "deny") return { ok: false, reason: "denied" };
 
-  if (!isToolCallApprovalRequired(state.config, serverName, toolMeta)) {
+  if (!isToolCallApprovalRequired(state.config, serverName, toolMeta, approvalMetadata ?? state.toolMetadata)) {
     return { ok: true };
   }