@herbertgao/pi-extensions 2026.8.4 → 2026.8.5

package/node_modules/pi-lens/rules/ast-grep-rules/rules/no-bare-host-path-in-win32-branch.yml

@@ -0,0 +1,25 @@
+id: no-bare-host-path-in-win32-branch
+language: TypeScript
+severity: warning
+message: "Use win32 path operations inside a branch committed to Windows path semantics"
+note: |
+  A branch guarded by isWindowsPath/isFullyQualifiedWin32 has committed to
+  Windows path parsing. Host-default dirname/basename/join/relative/sep
+  follows the process OS and is wrong for a Windows-shaped path on POSIX.
+
+  SCOPE (review-verified, #1339): same-function consequence only. The
+  original #1150 defect — a bare dirname inside an UNGUARDED helper that
+  the guarded branch calls (cross-function) — is NOT reachable by this
+  engine and stays review-enforced via AGENTS.md defect-shape 2. The
+  rule's fixture file encodes that miss as a documented negative; flip it
+  to a positive only if cross-function reach is ever added. What this
+  rule does catch is the in-branch shape (#1152 class).
+rule:
+  all:
+    - kind: if_statement
+    - has:
+        field: condition
+        regex: "\\b(isWindowsPath|isFullyQualifiedWin32)\\s*\\("
+    - has:
+        field: consequence
+        regex: "(?s)\\bpath\\.(dirname|basename|join|relative)\\s*\\(|\\bpath\\.sep\\b|(^|[^.])\\b(dirname|basename|join|relative)\\s*\\("

package/node_modules/pi-lens/rules/ast-grep-rules/rules/no-nested-links.yml

@@ -8,6 +8,12 @@ note: |
 rule:
   all:
     - kind: jsx_element
+    - has:
+        field: open_tag
+        kind: jsx_opening_element
+        has:
+          field: name
+          regex: "^a$"
     - has:
         kind: jsx_element
         stopBy: end
@@ -20,6 +26,7 @@ rule:
   not:
     inside:
       kind: jsx_element
+      stopBy: end
       has:
         field: open_tag
         kind: jsx_opening_element

package/node_modules/pi-lens/rules/ast-grep-rules/rules/no-raw-json-store-write.yml

@@ -0,0 +1,30 @@
+id: no-raw-json-store-write
+language: TypeScript
+severity: warning
+message: "Use the atomic write seam for JSON stores instead of writeFileSync"
+note: |
+  JSON-backed durable state must be committed through clients/durable-store.ts
+  when read-modify-write isolation is required; that seam publishes through
+  clients/atomic-write.ts. This rule covers the direct
+  writeFileSync(path, JSON.stringify(data)) shape. Build scripts and the
+  installer's wx lock writes are intentionally outside this rule's scope.
+ignores:
+  - "**/clients/atomic-write.ts"
+  - "**/clients/installer/index.ts"
+  - "**/scripts/**"
+rule:
+  any:
+    - pattern: writeFileSync($PATH, JSON.stringify($$$ARGS))
+    - pattern: $FS.writeFileSync($PATH, JSON.stringify($$$ARGS))
+    - pattern: writeFileSync($PATH, JSON.stringify($$$ARGS), $OPTS)
+    - pattern: $FS.writeFileSync($PATH, JSON.stringify($$$ARGS), $OPTS)
+    - kind: expression_statement
+      has:
+        pattern: writeFileSync($PATH, $PAYLOAD)
+      follows:
+        pattern: const $PAYLOAD = JSON.stringify($DATA)
+    - kind: expression_statement
+      has:
+        pattern: $FS.writeFileSync($PATH, $PAYLOAD)
+      follows:
+        pattern: const $PAYLOAD = JSON.stringify($DATA)

package/node_modules/pi-lens/rules/ast-grep-rules/rules/no-win32-isabsolute-for-qualification.yml

@@ -0,0 +1,23 @@
+id: no-win32-isabsolute-for-qualification
+language: TypeScript
+severity: warning
+message: "Use isFullyQualified for path qualification instead of win32.isAbsolute"
+note: |
+  Qualification must follow the input path's shape. Use clients/path-utils.ts
+  isFullyQualified(), which distinguishes drive-absolute, UNC, rooted-relative,
+  POSIX-absolute, and relative paths across host operating systems. The
+  implementation of isFullyQualified itself is excluded because it is the
+  compatibility seam that owns the win32 parser call.
+
+  SCOPE (review-verified, #1349): direct call forms only --
+  path.win32.isAbsolute(...) and a destructured win32.isAbsolute(...). An
+  ALIASED parser (const w = path.win32; w.isAbsolute(p) -- the shape the
+  actual pre-#1330 defect used) is beyond the engine's reach and stays
+  review-enforced; the fixture file encodes that miss as a documented
+  negative, matching the #1339 precedent.
+ignores:
+  - "**/clients/path-utils.ts"
+rule:
+  any:
+    - pattern: path.win32.isAbsolute($P)
+    - pattern: win32.isAbsolute($P)

package/node_modules/pi-lens/rules/tree-sitter-queries/tsx/no-nested-links.yml

@@ -18,15 +18,13 @@ query: |
   (jsx_element
     open_tag: (jsx_opening_element
       (identifier) @OUTER
-      (#eq? @OUTER "a"))
-    (jsx_element
-      open_tag: (jsx_opening_element
-        (identifier) @INNER
-        (#eq? @INNER "a"))))
+      (#eq? @OUTER "a"))) @OUTER_ELEMENT
 
 metavars:
   - OUTER
-  - INNER
+  - OUTER_ELEMENT
+
+post_filter: no_nested_anchor_chain
 
 tags:
   - correctness

package/node_modules/pi-lens/rules/tree-sitter-queries/typescript/duplicate-function-arg.yml

@@ -22,8 +22,8 @@ description: |
 
 query: |
   (formal_parameters
-    (required_parameter (identifier) @PARAM1)
-    (required_parameter (identifier) @NAME))
+    (_ pattern: (_) @PARAM1)
+    (_ pattern: (_) @NAME))
 
 metavars:
   - PARAM1

package/node_modules/pi-lens/scripts/analyze-pi-lens-logs.mjs

@@ -8,6 +8,7 @@
  *   ~/.pi-lens/cascade*.log          JSONL impact-cascade logs
  *   ~/.pi-lens/read-guard*.log       JSONL read-guard friction logs
  *   ~/.pi-lens/tree-sitter*.log      JSONL structural runner logs
+ *   ~/.pi-lens/extension*.log        JSONL extension diagnostics and console-guard telemetry
  *   ~/.pi-lens/actionable-warnings*.log  JSONL advisory pipeline (inject/suppress)
  *   ~/.pi-lens/ast-grep-tools*.log   JSONL MCP ast-grep search/replace telemetry
  *   ~/.pi-lens/logs/*.jsonl          JSONL diagnostic findings
@@ -18,10 +19,12 @@ import os from "node:os";
 import path from "node:path";
 import readline from "node:readline";
 import { fileURLToPath } from "node:url";
+import { minimatch } from "minimatch";
 
 const DEFAULT_ROOT = path.join(os.homedir(), ".pi-lens");
 const DEFAULT_SINCE = "2d";
 const DEFAULT_LIMIT = 12;
+const DEFAULT_EXCLUDE_GLOBS = ["**/AppData/Local/Temp/claude/**", "**/heap-corpus*/**", "**/.plegma/work/**"];
 
 const args = parseArgs(process.argv.slice(2));
 const root = path.resolve(expandHome(args.root ?? DEFAULT_ROOT));
@@ -30,6 +33,10 @@ const limit =
 	Number.parseInt(args.limit ?? `${DEFAULT_LIMIT}`, 10) || DEFAULT_LIMIT;
 const outputJson = Boolean(args.json);
 const includeArchived = Boolean(args.archived);
+const excludeGlobs = [
+	...DEFAULT_EXCLUDE_GLOBS,
+	...(Array.isArray(args.exclude) ? args.exclude : args.exclude ? [args.exclude] : []),
+];
 
 const thresholds = {
 	startupSlowMs: Number.parseInt(args.startupSlowMs ?? "500", 10),
@@ -83,7 +90,14 @@ function parseArgs(argv) {
 			const key = arg.slice(2);
 			const next = argv[i + 1];
 			if (!next || next.startsWith("--")) out[key] = "true";
-			else out[key] = argv[++i];
+			else if (key === "exclude") {
+				const value = argv[++i];
+				out.exclude = out.exclude
+					? Array.isArray(out.exclude)
+						? [...out.exclude, value]
+						: [out.exclude, value]
+					: value;
+			} else out[key] = argv[++i];
 		}
 	}
 	return out;
@@ -158,6 +172,7 @@ function createState(files) {
 		window: { since: since?.toISOString() ?? "all", root },
 		files,
 		parseErrors: counter(),
+		excludedRows: 0,
 		seen: counter(),
 		projects: counter(),
 		smellTotals: counter(),
@@ -557,6 +572,10 @@ async function analyzeSessionStart(files, state) {
 			const ts = dateOf(match[1]);
 			if (!inWindow(ts)) return;
 			const message = match[2];
+			if (isExcludedText(message)) {
+				state.excludedRows++;
+				return;
+			}
 			state.seen.inc("sessionstart");
 
 			const cwd = /session_start cwd:\s*(.*)$/.exec(message)?.[1];
@@ -722,13 +741,45 @@ async function forEachJsonLine(file, bucket, state, visitor) {
 	await forEachLine(file, async (line) => {
 		if (!line.trim()) return;
 		try {
-			visitor(JSON.parse(line));
+			const entry = JSON.parse(line);
+			if (isExcludedEntry(entry)) {
+				state.excludedRows++;
+				return;
+			}
+			visitor(entry);
 		} catch {
 			state.parseErrors.inc(`${bucket}:${path.basename(file)}`);
 		}
 	});
 }
 
+function isExcludedEntry(entry) {
+	return pathValues(entry).some((value) =>
+		excludeGlobs.some((glob) =>
+			minimatch(value, glob, { nocase: true, dot: true }),
+		),
+	);
+}
+
+function pathValues(value, key = "") {
+	if (typeof value === "string") {
+		return /(file|path|cwd|root|project)/i.test(key) ? [normalizePath(value)] : [];
+	}
+	if (!value || typeof value !== "object") return [];
+	return Object.entries(value).flatMap(([childKey, child]) =>
+		pathValues(child, childKey),
+	);
+}
+
+function isExcludedText(text) {
+	const cwd = /session_start cwd:\s*(.*)$/.exec(text)?.[1];
+	return cwd
+		? excludeGlobs.some((glob) =>
+				minimatch(normalizePath(cwd), glob, { nocase: true, dot: true }),
+			)
+		: false;
+}
+
 async function forEachLine(file, visitor) {
 	if (!fs.existsSync(file)) return;
 	const rl = readline.createInterface({
@@ -1129,6 +1180,7 @@ function buildReport(state) {
 			Object.entries(state.files).map(([key, list]) => [key, list.length]),
 		),
 		rowsSeen: state.seen.toJSON(),
+		rowsExcluded: state.excludedRows,
 		parseErrors: state.parseErrors.toJSON(),
 		projects: state.projects.top(limit),
 		smells,
@@ -1232,6 +1284,7 @@ function printReport(report) {
 			.map(([k, v]) => `${k}=${v}`)
 			.join(", ")}`,
 	);
+	console.log(`${report.rowsExcluded} rows excluded (synthetic corpora)`);
 	if (Object.keys(report.parseErrors).length)
 		console.log(`parse errors: ${JSON.stringify(report.parseErrors)}`);
 

package/node_modules/pi-mcp-adapter/CHANGELOG.md

@@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.25.0] - 2026-08-13
+
+### Added
+- Added `settings.notifyOnStartupConnect` to suppress successful MCP startup connection notices. Thanks @pierre-mgmt for issue #341.
+- Added compact self-rendered MCP proxy and direct-tool result rows by default, with `settings.toolResultRendering: "boxed"` for the legacy boxed row and `settings.collapsedResultLines` for 1-3 collapsed result lines. Thanks @pierre-mgmt for issue #349.
+
+### Changed
+- Removed unused TypeScript declarations found by stricter compiler checks.
+
+### Fixed
+- Kept `mcpScript` tool-call replies flowing when Pi runs as a Bun-compiled binary by starting worker execution without module-level top-level await. Thanks @AndreiKopylov for issue #340 and @thesobercoder for the verified fix.
+- Fixed direct-tool server prefixes to preserve provider-valid underscores and hyphens, including `codebase-memory-mcp`, while retaining safe escaping, collision handling, and exact proxy routing. Thanks @mightymatth for issue #342 and @JasonLandbridge for issue #343.
+
+## [2.24.0] - 2026-08-13
+
+### Added
+- Added per-server `searchKeywords` so `mcp({ search })` and `mcpScript` `tools.search` understand user-defined synonyms and aliases for tools. Keywords are keyed by tool name or glob and boost ranked and regex search only. They never appear in tool schemas, describe output, or the metadata cache. Thanks @Serisium for PR #336.
+
+### Fixed
+- Interpolated environment placeholders in stdio server arguments. Thanks @vjik for issue #333.
+- Kept remote `/mcp-auth` authorization links reachable before the callback input opens. Thanks @trevorleibert-mixpanel for PR #331.
+- Cached OAuth credentials in memory and refreshed them after OAuth-backed 401 responses. Thanks @daniel-sampliner for PR #335.
+- Sanitized MCP server-name prefixes for provider-safe tool names while preserving server resolution. Thanks @triple-dex for issue #334.
+- Validated persisted npx resolver cache entries before reuse, including malformed and prototype-sensitive persisted keys.
+
 ## [2.23.0] - 2026-08-11
 
 ### Added

package/node_modules/pi-mcp-adapter/README.md

@@ -227,6 +227,7 @@ In the configuration examples below, `30000` is illustrative only. If `requestTi
 | `toolPrefix` | Override global `settings.toolPrefix` for this server (`"server"`, `"short"`, `"none"`, or `"mcp"`) |
 | `includeTools` | `string[]` of tool names or glob patterns to expose (matches original names like `get_screenshot`, generated resource names like `read_figjam`, and prefixed names like `figma_get_screenshot`) |
 | `excludeTools` | `string[]` of tool names or glob patterns to hide (applied after `includeTools`) |
+| `searchKeywords` | `{ "tool-or-glob": ["keyword", ...] }` — extra keywords that boost `mcp({ search })` ranking for matching tools; never shown to the model |
 | `debug` | Show server stderr (default: false) |
 | `trace` | Enable metadata-only JSONL protocol tracing for this server; payloads, prompts, tool arguments/results, authorization data, and URLs are never persisted |
 | `disabled` | Keep the server visible in config and status, but prevent connections, authentication, tools, and resource calls (only literal `true` disables it) |
@@ -265,7 +266,7 @@ The adapter owns only its client socket and closes that connection when the Pi r
 
 ### Remote/headless OAuth
 
-If Pi is running on a remote server, `/mcp-auth <server>` prints the authorization URL and opens a callback input. Open the URL in your local browser. After approval, the browser may fail to load the localhost callback page because localhost refers to your workstation; copy the full URL from its address bar and paste it into Pi. The input closes automatically instead when the browser can reach Pi's callback directly.
+If Pi is running on a remote server, `/mcp-auth <server>` shows a clickable authorization URL first. Open it in your local browser and approve access, then select **Yes** in Pi to open the callback input. The browser may fail to load the localhost callback page because localhost refers to your workstation; copy the full URL from its address bar and paste it into Pi. The authorization screen closes automatically instead when the browser can reach Pi's callback directly.
 
 The same flow is available through the proxy tool for non-interactive clients. Persistent OAuth still requires an available OS credential store; on headless Linux that usually means an unlocked Secret Service/libsecret keyring. The adapter fails closed instead of falling back to plaintext credentials when the secure store is unavailable.
 
@@ -306,6 +307,9 @@ When any enabled server uses `eager` or `keep-alive`, initialization also starts
     "requestTimeoutMs": 30000,
     "showStatusIcon": true,
     "mcpFooterStatus": "full",
+    "toolResultRendering": "compact",
+    "collapsedResultLines": 1,
+    "notifyOnStartupConnect": true,
     "hostConfigDiscovery": "off",
     "approveTools": ["github_delete_*", "notion_update_*"],
     "oauthDir": ".pi/mcp-oauth",
@@ -327,6 +331,9 @@ When any enabled server uses `eager` or `keep-alive`, initialization also starts
 | `requestTimeoutMs` | Global request timeout in milliseconds for live MCP calls (if omitted or `<= 0`, the MCP SDK default timeout is used) |
 | `showStatusIcon` | Show the plug icon in MCP status and connection text (default: `true`). Set to `false` for plain `MCP: ...` text. |
 | `mcpFooterStatus` | MCP footer verbosity: `"full"` (default), `"compact"` for `MCP connected/enabled`, or `"off"` to clear the persistent footer status. `/mcp status` remains available. |
+| `toolResultRendering` | MCP tool result row style: `"compact"` (default) uses self-rendered rows, or `"boxed"` restores the legacy Pi boxed tool row. |
+| `collapsedResultLines` | Number of result text lines to show before expansion: `1`, `2`, or `3`. Defaults to `1` in compact mode and `3` in boxed mode. |
+| `notifyOnStartupConnect` | Show successful startup connection notices (default: `true`). Set to `false` to suppress routine `MCP: N servers connected (M tools)` notices. Connection errors and authentication warnings remain visible. |
 | `hostConfigDiscovery` | Host-specific config policy: `"off"` (default), `"prompt"` (detect/report only), or `"on"` (explicitly load detected host configs as the lowest-precedence fallback) |
 | `agentPluginPaths` | Agent Plugins package directories to load MCP servers from. Relative paths resolve from the active project cwd. |
 | `approveTools` | `true` to require approval before every MCP tool call, or an array of glob patterns such as `["github_delete_*", "notion_update_*"]`. Per-server `approveTools` overrides this. |
@@ -648,12 +655,35 @@ Prefer `.mcp.json` for project-local shared MCP config. Use `.pi/mcp.json` only
 
 `mcp({ connect: "server-name" })` refreshes an already connected server, so new tools, resources, prompts, and instructions can load without restarting Pi.
 
-MCP proxy and direct-tool results render compactly by default: long text shows the first three terminal-wrapped lines plus a `Ctrl+O to expand` hint, while the full result remains available when expanded and is still returned unchanged to the model.
+MCP proxy and direct-tool results use compact self-rendered rows by default. Collapsed success output shows the call title and the first result line, with a `Ctrl+O to expand` hint when more text is hidden. The full result remains available when expanded and is still returned unchanged to the model. Set `settings.toolResultRendering` to `"boxed"` to restore the legacy boxed Pi row, or set `settings.collapsedResultLines` to `2` or `3` when you want more collapsed text.
 
-Search includes both MCP tools and Pi tools (from extensions). Pi tools appear first with `[pi tool]` prefix. Space-separated words are ranked by weighted matches across name, server, and description, then returned one page at a time (`limit` defaults to 12). Use `details.nextOffset` for the next page. Regex search is still available with `regex: true`, but regex results are paginated without ranking.
+Search includes both MCP tools and Pi tools (from extensions). Pi tools appear first with `[pi tool]` prefix. Space-separated words are ranked by weighted matches across name, server, description, and any configured `searchKeywords`, then returned one page at a time (`limit` defaults to 12). Use `details.nextOffset` for the next page. Regex search is still available with `regex: true`, but regex results are paginated without ranking.
 
 Tool names are fuzzy-matched on hyphens and underscores — `context7_resolve_library_id` finds `context7_resolve-library-id`. When `describe` or `tool` cannot resolve a name, the result includes top suggestions so the agent can correct a typo or missing prefix in the same turn.
 
+### Search keywords
+
+Search uses literal matching so a tool whose name and description use different vocabulary than the query won't be found. Per-server `searchKeywords` adds extra vocabulary for matching tools:
+
+```json
+{
+  "mcpServers": {
+    "github": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-github"],
+      "searchKeywords": {
+        "search_code": ["grep"],
+        "*": ["gh"]
+      }
+    }
+  }
+}
+```
+
+With this config, `mcp({ search: "grep" })` finds `github_search_code` even though neither its name nor description contains that word. Similarly, `mcp({ search: "gh" })` finds all tools provided by the github server.
+
+Keys match a tool's original name, prefixed name, or a glob (`*` applies to every tool on the server) and all matching entries combine. Keywords are weighted like description text, with an extra boost when the query exactly matches a configured phrase. They affect ranked and regex search only (including `tools.search` in `mcpScript`): they never appear in tool schemas, `describe` output, direct-tool registration, or the metadata cache, and search with keywords works offline from cached metadata.
+
 When `includeSchemas` is enabled, search and describe render common JSON Schema parameters as compact TypeScript shapes like `{ query: string; limit?: number; }`, with the older schema formatter retained as a fallback for unsupported schemas.
 
 For HTTP servers, failed connects run a one-request shape probe that can turn opaque transport errors into setup hints such as `endpoint returned HTML (200) — this URL does not appear to speak MCP`. Healthy connections are not probed.
@@ -699,4 +729,5 @@ Advertised tool `outputSchema` values support JSON Schema draft-07 and 2020-12.
 
 - Cross-session server sharing not yet implemented (each Pi session runs its own server processes)
 - Compact MCP result rendering summarizes text, but inline images are still controlled by Pi's image display settings and may render below the compact text summary.
+- Pi still owns one separator row before self-rendered tool output, so compact mode reduces adapter rendering height but cannot promise true zero-gap rows.
 - MCP sampling support is text-only; context inclusion, tools, stop sequences, audio, and image content are rejected with explicit errors.

package/node_modules/pi-mcp-adapter/agent-plugin-loader.ts

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, readFileSync, statSync } from "node:fs";
+import { existsSync, readFileSync, statSync } from "node:fs";
 import { isAbsolute, relative, resolve, sep } from "node:path";
 import { getAgentPath } from "./agent-dir.ts";
 import type { McpConfig, ServerEntry } from "./types.ts";

package/node_modules/pi-mcp-adapter/commands.ts

@@ -12,7 +12,6 @@ import {
   previewSharedServerEntry,
   previewStarterProjectConfig,
   writeDirectToolsConfig,
-  writeProjectServerDisabledOverride,
   writeSharedServerEntry,
   writeStarterProjectConfig,
 } from "./config.ts";
@@ -170,7 +169,7 @@ export async function reconnectServer(
     }
 
     const prefix = state.config.settings?.toolPrefix ?? "server";
-    const { metadata, failedTools } = buildToolMetadata(connection.tools, connection.resources, definition, name, prefix);
+    const { metadata, failedTools } = buildToolMetadata(connection.tools, connection.resources, definition, name, prefix, state.config.mcpServers, state.toolMetadata);
     state.toolMetadata.set(name, metadata);
     if (!connection.promptDiscoveryFailed) {
       state.promptMetadata?.set(name, reconstructPromptMetadata(name, connection.prompts ?? [], prefix, definition));
@@ -283,11 +282,20 @@ export async function authenticateServer(
           "info"
         );
       },
-      onAuthorizationInput: (_authorizationUrl, inputSignal) => ui.input(
-        `Complete ${serverName} OAuth`,
-        "Paste the full callback URL, or wait for automatic completion",
-        { signal: inputSignal },
-      ),
+      onAuthorizationInput: async (authorizationUrl, inputSignal) => {
+        const readyToPaste = await ui.confirm(
+          `Authorize ${serverName}`,
+          `Open this link in your browser:\n${terminalHyperlink(authorizationUrl, authorizationUrl)}\n\n` +
+          "After approving access, select Yes to paste the callback URL.",
+          { signal: inputSignal },
+        );
+        if (!readyToPaste || inputSignal.aborted) return undefined;
+        return ui.input(
+          `Complete ${serverName} OAuth`,
+          "Paste the full callback URL",
+          { signal: inputSignal },
+        );
+      },
       ...(signal ? { signal } : {}),
       ...(runtime ? { runtime } : {}),
     });

package/node_modules/pi-mcp-adapter/direct-tools.ts

@@ -11,7 +11,8 @@ import { formatSchema } from "./tool-metadata.ts";
 import { resolveMcpResultContent, transformMcpContent, transformMcpResourceContents } from "./tool-registrar.ts";
 import { guardMcpOutput, guardedMcpDetails, resolveMcpOutputGuardOptions } from "./mcp-output-guard.ts";
 import { maybeStartUiSession, summarizeUiSessionResult, type UiSessionRuntime } from "./ui-session.ts";
-import { formatToolName, isServerDisabled, isToolAllowed, resolveToolPrefix } from "./types.ts";
+import { formatToolName, getToolNameCandidates, isServerDisabled, isToolAllowed, resolveToolPrefix } from "./types.ts";
+import { isUiToolVisibleToModel } from "./ui-tool-visibility.ts";
 import { resourceNameToToolName } from "./resource-tools.ts";
 import { authenticate, supportsOAuth } from "./mcp-auth-flow.ts";
 import { formatAuthRequiredMessage, resolveServerUrl, truncateAtWord } from "./utils.ts";
@@ -149,10 +150,31 @@ export function resolveDirectTools(
     if (!toolFilter) continue;
 
     const effectivePrefix = resolveToolPrefix(definition, prefix);
+    const getOtherCurrentCandidates = (toolName: string): Set<string> => {
+      const candidates = new Set<string>();
+      for (const [otherServerName, otherDefinition] of Object.entries(config.mcpServers)) {
+        const otherCache = cache.servers[otherServerName];
+        if (!otherCache || !isServerCacheValid(otherCache, otherDefinition) || isServerDisabled(otherDefinition)) continue;
+        const otherPrefix = resolveToolPrefix(otherDefinition, prefix);
+        for (const otherTool of otherCache.tools ?? []) {
+          if (!isUiToolVisibleToModel(otherTool.uiVisibility)) continue;
+          for (const candidate of getToolNameCandidates(otherTool.name, otherServerName, otherPrefix, false)) candidates.add(candidate);
+        }
+        if (otherDefinition.exposeResources !== false) {
+          for (const resource of otherCache.resources ?? []) {
+            const baseName = `read_${resourceNameToToolName(resource.name)}`;
+            for (const candidate of getToolNameCandidates(baseName, otherServerName, otherPrefix, false)) candidates.add(candidate);
+          }
+        }
+      }
+      for (const candidate of getToolNameCandidates(toolName, serverName, effectivePrefix, false)) candidates.delete(candidate);
+      return candidates;
+    };
 
     for (const tool of serverCache.tools ?? []) {
+      if (!isUiToolVisibleToModel(tool.uiVisibility)) continue;
       if (toolFilter !== true && !toolFilter.includes(tool.name)) continue;
-      if (!isToolAllowed(tool.name, serverName, effectivePrefix, definition.includeTools, definition.excludeTools)) continue;
+      if (!isToolAllowed(tool.name, serverName, effectivePrefix, definition.includeTools, definition.excludeTools, getOtherCurrentCandidates(tool.name))) continue;
       const prefixedName = formatToolName(tool.name, serverName, effectivePrefix);
       if (BUILTIN_NAMES.has(prefixedName)) {
         console.warn(`MCP: skipping direct tool "${prefixedName}" (collides with builtin)`);
@@ -178,7 +200,7 @@ export function resolveDirectTools(
       for (const resource of serverCache.resources ?? []) {
         const baseName = `read_${resourceNameToToolName(resource.name)}`;
         if (toolFilter !== true && !toolFilter.includes(baseName)) continue;
-        if (!isToolAllowed(baseName, serverName, effectivePrefix, definition.includeTools, definition.excludeTools)) continue;
+        if (!isToolAllowed(baseName, serverName, effectivePrefix, definition.includeTools, definition.excludeTools, getOtherCurrentCandidates(baseName))) continue;
         const prefixedName = formatToolName(baseName, serverName, effectivePrefix);
         if (BUILTIN_NAMES.has(prefixedName)) {
           console.warn(`MCP: skipping direct resource tool "${prefixedName}" (collides with builtin)`);
@@ -230,15 +252,38 @@ export function buildProxyDescription(
   for (const serverName of Object.keys(config.mcpServers)) {
     const definition = config.mcpServers[serverName];
     if (!definition || isServerDisabled(definition)) continue;
-    const entry = cache?.servers?.[serverName];
+    const cachedEntry = cache?.servers?.[serverName];
+    const entry = cachedEntry && isServerCacheValid(cachedEntry, definition) ? cachedEntry : undefined;
     const effectivePrefix = resolveToolPrefix(definition, prefix);
+    const getOtherCurrentCandidates = (toolName: string): Set<string> | undefined => {
+      if (!cache) return undefined;
+      const candidates = new Set<string>();
+      for (const [otherServerName, otherDefinition] of Object.entries(config.mcpServers)) {
+        const otherEntry = cache.servers[otherServerName];
+        if (!otherEntry || !isServerCacheValid(otherEntry, otherDefinition) || isServerDisabled(otherDefinition)) continue;
+        const otherPrefix = resolveToolPrefix(otherDefinition, prefix);
+        for (const otherTool of otherEntry.tools ?? []) {
+          if (!isUiToolVisibleToModel(otherTool.uiVisibility)) continue;
+          for (const candidate of getToolNameCandidates(otherTool.name, otherServerName, otherPrefix, false)) candidates.add(candidate);
+        }
+        if (otherDefinition.exposeResources !== false) {
+          for (const resource of otherEntry.resources ?? []) {
+            const baseName = `read_${resourceNameToToolName(resource.name)}`;
+            for (const candidate of getToolNameCandidates(baseName, otherServerName, otherPrefix, false)) candidates.add(candidate);
+          }
+        }
+      }
+      for (const candidate of getToolNameCandidates(toolName, serverName, effectivePrefix, false)) candidates.delete(candidate);
+      return candidates;
+    };
     const toolCount = (entry?.tools ?? []).filter(
-      (tool) => isToolAllowed(tool.name, serverName, effectivePrefix, definition.includeTools, definition.excludeTools),
+      (tool) => isUiToolVisibleToModel(tool.uiVisibility)
+        && isToolAllowed(tool.name, serverName, effectivePrefix, definition.includeTools, definition.excludeTools, getOtherCurrentCandidates(tool.name)),
     ).length;
     const resourceCount = definition?.exposeResources !== false
       ? (entry?.resources ?? []).filter((resource) => {
           const baseName = `read_${resourceNameToToolName(resource.name)}`;
-          return isToolAllowed(baseName, serverName, effectivePrefix, definition.includeTools, definition.excludeTools);
+          return isToolAllowed(baseName, serverName, effectivePrefix, definition.includeTools, definition.excludeTools, getOtherCurrentCandidates(baseName));
         }).length
       : 0;
     const totalItems = toolCount + resourceCount;
@@ -264,7 +309,9 @@ export function buildProxyDescription(
   const instructionSummaries: string[] = [];
   for (const serverName of Object.keys(config.mcpServers)) {
     if (isServerDisabled(config.mcpServers[serverName])) continue;
-    const instructions = cache?.servers?.[serverName]?.instructions;
+    const definition = config.mcpServers[serverName];
+    const entry = definition && cache?.servers?.[serverName];
+    const instructions = entry && definition && isServerCacheValid(entry, definition) ? entry.instructions : undefined;
     if (!instructions) continue;
     const snippet = truncateAtWord(instructions.replace(/\s+/g, " ").trim(), INSTRUCTIONS_SNIPPET_LENGTH);
     instructionSummaries.push(`  ${serverName}: ${snippet}`);

package/node_modules/pi-mcp-adapter/host-html-template.ts

@@ -459,11 +459,3 @@ function escapeHtml(value: string): string {
     .replace(/"/g, """)
     .replace(/'/g, "'");
 }
-
-function escapeHtmlAttribute(value: string): string {
-  return value
-    .replace(/&/g, "&")
-    .replace(/"/g, """)
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;");
-}

package/node_modules/pi-mcp-adapter/index.ts

@@ -14,7 +14,7 @@ import { logger } from "./logger.ts";
 import { executeAuthComplete, executeAuthStart, executeCall, executeConnect, executeDescribe, executeInstructions, executeList, executeSearch, executeStatus, executeUiMessages } from "./proxy-modes.ts";
 import { formatTerminalError, getConfigPathFromArgv, normalizeDirectToolInputSchema, truncateAtWord } from "./utils.ts";
 import { createOAuthRuntime, shutdownOAuth } from "./mcp-auth-flow.ts";
-import { createMcpDirectToolCallRenderer, renderMcpProxyToolCall, renderMcpToolResult } from "./tool-result-renderer.ts";
+import { createMcpDirectToolCallRenderer, createMcpProxyToolCallRenderer, createMcpToolResultRenderer, resolveMcpToolRenderOptions } from "./tool-result-renderer.ts";
 import { toolErrorOverride } from "./error-signal.ts";
 import { createMcpRuntimeOwner, createOwnedUi, isAbortError, type McpRuntimeOwner } from "./runtime-owner.ts";
 import { publishMcpStatusShutdown } from "./mcp-status.ts";
@@ -124,6 +124,9 @@ function installMcpAdapter(pi: ExtensionAPI, options: McpAdapterOptions) {
   const envDirectToolOverride = envRaw?.split(",").map(s => s.trim()).filter(Boolean);
   const registeredDirectTools = new Map<string, string>();
   const fallbackDeactivatedTools = new Set<string>();
+  const toolRenderOptions = resolveMcpToolRenderOptions(earlyConfig.settings);
+  const toolRenderShell = toolRenderOptions.resultRendering === "compact" ? "self" : "default";
+  const renderMcpToolResult = createMcpToolResultRenderer(toolRenderOptions);
   let proxyToolRegistered = false;
   let proxyToolDescription: string | null = null;
   let directToolsFrozen = false;
@@ -158,7 +161,8 @@ function installMcpAdapter(pi: ExtensionAPI, options: McpAdapterOptions) {
       promptSnippet: truncateAtWord(spec.description, 100) || `MCP tool from ${spec.serverName}`,
       parameters: toToolParameters(normalizeDirectToolInputSchema(spec.inputSchema)),
       execute: createDirectToolExecutor(() => state, () => initPromise, spec),
-      renderCall: createMcpDirectToolCallRenderer(spec.prefixedName),
+      renderShell: toolRenderShell,
+      renderCall: createMcpDirectToolCallRenderer(spec.prefixedName, toolRenderOptions),
       renderResult: renderMcpToolResult,
     });
   }
@@ -695,7 +699,8 @@ function installMcpAdapter(pi: ExtensionAPI, options: McpAdapterOptions) {
       label: "MCP",
       description,
       promptSnippet: "MCP gateway — status, search, describe, auth, and single MCP tool calls",
-      renderCall: renderMcpProxyToolCall,
+      renderShell: toolRenderShell,
+      renderCall: createMcpProxyToolCallRenderer(toolRenderOptions),
       parameters: Type.Object({
         tool: Type.Optional(Type.String({ description: "Tool name to call (e.g., 'xcodebuild_list_sims')" })),
         args: Type.Optional(Type.Union([