@herbertgao/pi-extensions 2026.9.17 → 2026.9.19

package/node_modules/pi-mcp-adapter/session-approvals.ts

@@ -1,201 +0,0 @@
-import { createHash } from "node:crypto";
-import type { McpExtensionState } from "./state.ts";
-import type { ToolMetadata } from "./types.ts";
-import { logger } from "./logger.ts";
-import { stableStringify } from "./utils.ts";
-
-export const MCP_APPROVAL_CUSTOM_TYPE = "mcp-approval-v1";
-
-export type SessionApprovalEntry =
-  | {
-      version: 1;
-      kind: "tool";
-      decision: "allow_for_session";
-      serverName: string;
-      originalToolName: string;
-      definitionHash: string;
-      argsHash: string;
-    }
-  | {
-      version: 1;
-      kind: "iframe";
-      decision: "allow" | "deny";
-      serverName: string;
-    };
-
-export type SessionApprovalWriter = (record: SessionApprovalEntry) => void;
-
-const TOOL_APPROVAL_KEYS = [
-  "version",
-  "kind",
-  "decision",
-  "serverName",
-  "originalToolName",
-  "definitionHash",
-  "argsHash",
-] as const;
-const IFRAME_APPROVAL_KEYS = ["version", "kind", "decision", "serverName"] as const;
-const SHA256_HEX = /^[0-9a-f]{64}$/;
-
-export function computeToolArgumentsHash(args: unknown): string {
-  return createHash("sha256").update(stableStringify(args ?? {})).digest("hex");
-}
-
-export function computeToolDefinitionHash(
-  toolMeta: Pick<ToolMetadata, "originalName" | "inputSchema" | "resourceUri" | "uiResourceUri">,
-): string {
-  return createHash("sha256").update(stableStringify({
-    originalName: toolMeta.originalName,
-    inputSchema: toolMeta.inputSchema ?? null,
-    resourceUri: toolMeta.resourceUri ?? null,
-    uiResourceUri: toolMeta.uiResourceUri ?? null,
-  })).digest("hex");
-}
-
-export function makeToolApprovalKey(
-  serverName: string,
-  originalToolName: string,
-  definitionHash: string,
-  argsHash: string,
-): string {
-  return `${serverName}\u0000${originalToolName}\u0000${definitionHash}\u0000${argsHash}`;
-}
-
-export function getToolApprovalIdentity(
-  serverName: string,
-  toolMeta: Pick<ToolMetadata, "originalName" | "inputSchema" | "resourceUri" | "uiResourceUri">,
-  args: unknown,
-): { definitionHash: string; argsHash: string; cacheKey: string } {
-  const definitionHash = computeToolDefinitionHash(toolMeta);
-  const argsHash = computeToolArgumentsHash(args);
-  return {
-    definitionHash,
-    argsHash,
-    cacheKey: makeToolApprovalKey(serverName, toolMeta.originalName, definitionHash, argsHash),
-  };
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-function hasExactKeys(value: Record<string, unknown>, keys: readonly string[]): boolean {
-  const actualKeys = Object.keys(value);
-  return actualKeys.length === keys.length && keys.every(key => Object.hasOwn(value, key));
-}
-
-function isNonEmptyString(value: unknown): value is string {
-  return typeof value === "string" && value.length > 0;
-}
-
-function isSha256(value: unknown): value is string {
-  return typeof value === "string" && SHA256_HEX.test(value);
-}
-
-function isSessionApprovalEntry(value: unknown): value is SessionApprovalEntry {
-  if (!isRecord(value) || value.version !== 1 || !isNonEmptyString(value.serverName)) return false;
-
-  if (value.kind === "tool") {
-    return hasExactKeys(value, TOOL_APPROVAL_KEYS)
-      && value.decision === "allow_for_session"
-      && isNonEmptyString(value.originalToolName)
-      && isSha256(value.definitionHash)
-      && isSha256(value.argsHash);
-  }
-
-  if (value.kind === "iframe") {
-    return hasExactKeys(value, IFRAME_APPROVAL_KEYS)
-      && (value.decision === "allow" || value.decision === "deny");
-  }
-
-  return false;
-}
-
-function isApprovalCustomEntry(entry: unknown): entry is { type: "custom"; data?: unknown } {
-  return isRecord(entry)
-    && entry.type === "custom"
-    && entry.customType === MCP_APPROVAL_CUSTOM_TYPE;
-}
-
-export function createSessionApprovalWriter(
-  appendEntry: (customType: string, data?: unknown) => void,
-  canAppend: (() => boolean) | undefined = undefined,
-): SessionApprovalWriter {
-  return (record) => {
-    if (canAppend && !canAppend()) return;
-    try {
-      appendEntry(MCP_APPROVAL_CUSTOM_TYPE, record);
-    } catch (error) {
-      const detail = error instanceof Error ? error.message : String(error);
-      logger.debug(`MCP: failed to persist session approval: ${detail}`);
-    }
-  };
-}
-
-export function rememberToolApproval(
-  state: McpExtensionState,
-  serverName: string,
-  toolMeta: Pick<ToolMetadata, "originalName" | "inputSchema" | "resourceUri" | "uiResourceUri">,
-  args: unknown,
-): void {
-  const { definitionHash, argsHash, cacheKey } = getToolApprovalIdentity(serverName, toolMeta, args);
-  const approvedToolCalls = state.approvedToolCalls ??= new Map<string, true>();
-  if (approvedToolCalls.has(cacheKey)) return;
-
-  approvedToolCalls.set(cacheKey, true);
-  const record: SessionApprovalEntry = {
-    version: 1,
-    kind: "tool",
-    decision: "allow_for_session",
-    serverName,
-    originalToolName: toolMeta.originalName,
-    definitionHash,
-    argsHash,
-  };
-  try {
-    state.persistSessionApproval?.(record);
-  } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
-    logger.debug(`MCP: session approval persistence callback failed: ${detail}`);
-  }
-}
-
-/** Bind broad consent to this configured server, not a replacement with the same name. */
-export function getServerApprovalIdentity(state: McpExtensionState, serverName: string) {
-  if (!Object.hasOwn(state.config.mcpServers, serverName)) return undefined;
-  const definition = state.config.mcpServers[serverName];
-  if (!definition) return undefined;
-  return {
-    definition,
-    hash: createHash("sha256").update(stableStringify(definition)).digest("hex"),
-  };
-}
-
-export function restoreSessionApprovalState(
-  state: McpExtensionState,
-  branchEntries: readonly unknown[],
-): void {
-  const approvedToolCalls = state.approvedToolCalls ??= new Map<string, true>();
-  approvedToolCalls.clear();
-  // Replace the map so an approval dialog opened on the old branch cannot grant
-  // server-wide authority after navigation, resume, or session replacement.
-  state.approvedServers = new Map();
-  state.consentManager.clear();
-
-  for (const entry of branchEntries) {
-    if (!isApprovalCustomEntry(entry)) continue;
-    if (!isSessionApprovalEntry(entry.data)) continue;
-
-    if (entry.data.kind === "tool") {
-      approvedToolCalls.set(makeToolApprovalKey(
-        entry.data.serverName,
-        entry.data.originalToolName,
-        entry.data.definitionHash,
-        entry.data.argsHash,
-      ), true);
-      continue;
-    }
-
-    state.consentManager.restoreDecision(entry.data.serverName, entry.data.decision === "allow");
-  }
-}

package/node_modules/pi-mcp-adapter/session-recovery.ts

@@ -1,158 +0,0 @@
-// session-recovery.ts
-//
-// Streamable HTTP session recovery.
-//
-// Per the MCP spec (Streamable HTTP transport):
-//   "When a client receives HTTP 404 in response to a request containing an
-//   Mcp-Session-Id, it MUST start a new session by sending a new
-//   InitializeRequest without a session ID attached."
-//
-// A 404 for a request that carried a session ID is therefore the spec's own
-// definition of "this session no longer exists" (e.g. the remote server
-// process restarted and lost its in-memory session table). Because the spec
-// requires the server to reject the request *before* processing it, retrying
-// the same call against a freshly initialized session cannot double-execute
-// the original request.
-//
-// This module intentionally does NOT:
-//   - match broad error messages without a prior session id
-//   - match generic HTTP 400 responses, which are ambiguous and can mean
-//     many things other than "your session is gone"
-//   - treat generic -32000/ConnectionClosed errors as session expiry
-//   - treat AbortError/cancellation as a session failure
-import { ProtocolError, SdkHttpError, UnauthorizedError } from "@modelcontextprotocol/client";
-import { logger } from "./logger.ts";
-import { throwIfAborted } from "./abort.ts";
-import { isServerDisabled, type McpConfig } from "./types.ts";
-import { supportsOAuth } from "./mcp-auth-flow.ts";
-import { invalidateAuthEntryCache } from "./mcp-auth.ts";
-import type { McpServerManager, ServerConnection } from "./server-manager.ts";
-
-/**
- * True when `err` is a stale Streamable HTTP session signal for a request
- * sent while carrying an `Mcp-Session-Id`: the spec's 404 transport
- * response, or the narrowly-known `-32000 Server not initialized` protocol
- * gate response some servers emit before dispatching to a handler.
- *
- * `hadSessionId` must reflect the transport's session id from *before* the
- * call that produced `err` was made. Callers must capture it before the call
- * rather than rely on catch-time transport state.
- */
-const CONNECTION_CLOSED_PROTOCOL_CODE = -32000;
-const SERVER_NOT_INITIALIZED_MCP_MESSAGES = new Set([
-  "Server not initialized",
-  "Bad Request: Server not initialized",
-]);
-
-export function isTerminatedSession(err: unknown, hadSessionId: boolean): boolean {
-  if (!hadSessionId) return false;
-  if (err instanceof SdkHttpError) {
-    return err.status === 404
-      || (err.status === 400
-        && /"code"\s*:\s*-32000/.test(err.message)
-        && /"message"\s*:\s*"Bad Request: Server not initialized"/.test(err.message));
-  }
-  return err instanceof ProtocolError
-    && err.code === CONNECTION_CLOSED_PROTOCOL_CODE
-    && SERVER_NOT_INITIALIZED_MCP_MESSAGES.has(err.message);
-}
-
-function hasSessionId(connection: ServerConnection): boolean {
-  // Only StreamableHTTPClientTransport exposes `sessionId`; stdio/SSE
-  // transports (and test doubles that omit `transport` entirely) simply
-  // read as `undefined` here.
-  const transport = connection.transport as { sessionId?: string } | undefined;
-  return transport?.sessionId != null;
-}
-
-export class SessionRecoveryAuthRequiredError extends Error {
-  constructor(readonly serverName: string, readonly authMessage?: string) {
-    super(authMessage ?? `MCP server "${serverName}" requires OAuth authentication after reconnect.`);
-    this.name = "SessionRecoveryAuthRequiredError";
-  }
-}
-
-export interface SessionRecoveryDeps {
-  manager: McpServerManager;
-  config: McpConfig;
-  signal?: AbortSignal;
-  onNeedsAuth?: (serverName: string) => Promise<ServerConnection | undefined>;
-}
-
-/**
- * Runs `fn` against the current connection for `serverName`. If it fails
- * with a terminated Streamable HTTP session (see `isTerminatedSession`),
- * reconnects exactly once via `McpServerManager.reconnect` (single-flight,
- * identity-guarded — see server-manager.ts) and retries `fn` exactly once
- * against the fresh connection.
- *
- * Any other failure — including a second failure after reconnecting, or the
- * server having been removed from config in the meantime — propagates
- * unchanged through the caller's existing error handling.
- */
-export async function withSessionRecovery<T>(
-  deps: SessionRecoveryDeps,
-  serverName: string,
-  fn: (conn: ServerConnection) => Promise<T>,
-): Promise<T> {
-  if (isServerDisabled(deps.config.mcpServers[serverName])) {
-    throw new Error(`MCP server "${serverName}" is disabled`);
-  }
-  const connection = deps.manager.getConnection(serverName);
-  if (!connection) {
-    throw new Error(`Server "${serverName}" is not connected`);
-  }
-
-  const hadSessionId = hasSessionId(connection);
-
-  try {
-    return await fn(connection);
-  } catch (err) {
-    const definition = deps.config.mcpServers[serverName];
-    if (definition && supportsOAuth(definition)
-      && (err instanceof UnauthorizedError || (err instanceof SdkHttpError && err.status === 401))) {
-      invalidateAuthEntryCache(serverName);
-    }
-    if (!isTerminatedSession(err, hadSessionId)) {
-      throw err;
-    }
-
-    // Re-read the live definition rather than reusing the stale
-    // connection's definition, in case config changed since connect. If the
-    // server was removed from config in the meantime there is nothing to
-    // reconnect to, so surface the original error.
-    if (!definition) {
-      throw err;
-    }
-
-    throwIfAborted(deps.signal);
-    logger.debug(`MCP session for "${serverName}" expired; reconnecting`, {
-      server: serverName,
-    });
-    let freshConnection = deps.signal
-      ? await deps.manager.reconnect(serverName, definition, connection, deps.signal)
-      : await deps.manager.reconnect(serverName, definition, connection);
-    throwIfAborted(deps.signal);
-
-    if (freshConnection.status === "needs-auth") {
-      freshConnection = await deps.onNeedsAuth?.(serverName) ?? freshConnection;
-      throwIfAborted(deps.signal);
-    }
-
-    if (freshConnection.status === "needs-auth") {
-      throw new SessionRecoveryAuthRequiredError(serverName);
-    }
-    if (freshConnection.status !== "connected") {
-      throw err;
-    }
-
-    try {
-      deps.manager.publishMetadataChanged(serverName, freshConnection, "session-reconnect");
-    } catch (publicationError) {
-      const message = publicationError instanceof Error ? publicationError.message : String(publicationError);
-      logger.debug(`MCP metadata publication after reconnect failed for "${serverName}": ${message}`);
-    }
-    throwIfAborted(deps.signal);
-    return fn(freshConnection);
-  }
-}

package/node_modules/pi-mcp-adapter/skills/mcp-scripting/SKILL.md

@@ -1,49 +0,0 @@
----
-name: mcp-scripting
-description: Write mcpScript JavaScript for discovering, inspecting, and calling MCP tools.
-disable-model-invocation: true
----
-
-# MCP scripting
-
-For multi-call MCP work, write ordinary JavaScript with loops, filtering, chaining, fan-out, or other logic between calls. Run that source with `mcpScript`; it is the primary MCP orchestration surface. For a single MCP search, describe, status check, auth action, or tool call, use `mcp` instead.
-
-Write the source naturally, then pass it as `mcpScript`'s `code` argument:
-
-```js
-const { items } = await tools.search({ query: "search issues", server: "github" });
-const candidate = items[0];
-if (!candidate) return { error: "No matching tool" };
-
-const details = await tools.describe({ path: candidate.path });
-if (details.error) return details;
-
-const result = await tools.call(details.path, { query: "is:open label:bug" });
-if (!result.ok) return result;
-emit({ tool: details.path, completed: true });
-return result.data;
-```
-
-## Workflow
-
-1. Find candidate tools with `await tools.search({ query, server?, limit?, offset? })`.
-2. Inspect the exact returned path with `await tools.describe({ path })`.
-3. Call it with `tools.call(path, args)`.
-
-Descriptors include `inputTypeScript` (a compact parameter shape, or formatted schema fallback). When a compact shape would omit documented fields, `inputGuidance` preserves their descriptions, including formats and units. Undocumented inputs stay compact.
-
-When advertised by the server, `outputSchema` is the original JSON Schema and `outputSchemaTarget` is `"data.structuredContent"`: it describes structured output inside the successful `{ ok: true, data }` call envelope, not the envelope itself. Inspect this schema for result fields and constraints; unsupported constructs remain intact rather than being presented as an approximate TypeScript type. Both output fields are absent when no output schema is advertised. Discovery and cache refresh preserve these optional schemas; old cache entries gain them on the next server metadata refresh. Ordinary search results do not include schemas.
-
-Calls resolve to `{ ok: true, data }` or `{ ok: false, error }`; handle failed calls instead of expecting them to stop the script. `emit(value)` adds user-visible output before the final `return` value. `console` output is captured too.
-
-With `settings.jev.scriptEvaluation` enabled, call `jev.evaluate({ state, questions, sources })`; declare every MCP server represented in state. The host conservatively taints the whole script with every server-attributed call result or error, so every declared or observed source must remain enabled and allowed for later direct evaluations and semantic searches. Semantic search requires `searchMode: "semantic"`. Direct and semantic attempts share count, UTF-8 request-byte, deadline, and provider-reported token budgets. Scores do not bypass `tools.call` approval. Action loops must use fresh observations, positive step/time/evaluation budgets, validated operations and targets, and stop on uncertainty, staleness, no progress, no match, or missing information. Do not retry a possibly side-effectful action.
-
-On success, `data` may still be the raw MCP `CallToolResult` envelope rather than the domain payload. Check `data.structuredContent` for the fields your script expects; if they are absent, inspect text blocks in `data.content` too (some servers emit newline-delimited JSON). If neither shape is understood, return or emit the envelope for inspection instead of coercing it to `[]` or `{}`.
-
-`tools` is a non-enumerable proxy: `Object.keys(tools)` throws. Always use `tools.search` for discovery. When a known flat path is a valid identifier, direct calls such as `tools.github_search_issues(args)` are supported; use bracket syntax for hyphenated names: `tools["server_tool-name"](args)`. `search`, `call`, `describe`, and promise/serialization names (`then`, `catch`, `finally`, `toJSON`, `toString`, `valueOf`) are reserved on the proxy; if a flat path collides with one, call it via `tools.call("exact-path", args)`.
-
-Successful intermediate data bypasses presentation truncation, summarization, and artifact spill until the script emits, logs, or returns it. A fixed, non-configurable **16 MiB cumulative UTF-8 JSON transfer budget per script** covers sequential and parallel calls. A result exceeding the remaining budget returns `{ ok: false, error: { code: "intermediate_result_too_large", message } }` with a failed call trace; rejected calls do not consume the budget, but upstream side effects may already have happened. Resource calls retain transformed text or `"(empty resource)"`; emitted, logged, or returned output and ordinary MCP calls remain guarded. This is not a memory limit: responses, serialization, copies, concurrency, and script values still allocate memory, and synchronous serialization can delay deadline handling.
-
-`tools.search` and `tools.describe` are asynchronous and must be awaited. The default script timeout is 30 seconds; the worker is terminated at the deadline, including for infinite loops. Every invocation still uses normal lazy connection, authentication, and approval gates. Result details contain a concise `calls` trace with every search, describe, and call operation; each entry includes its query or path, outcome, and duration.
-
-Use plain JavaScript loops and Promise utilities for composition. Fluent helpers such as `tools.find(...).one()`, `tools.parallel(...)`, and `tools.retry(...)` are not provided.

package/node_modules/pi-mcp-adapter/state.ts

@@ -1,71 +0,0 @@
-import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { ConsentManager } from "./consent-manager.ts";
-import type { McpLifecycleManager } from "./lifecycle.ts";
-import type { McpServerManager } from "./server-manager.ts";
-import type { AuthStorageOptions } from "./mcp-auth.ts";
-import type { ServerDefinition, ToolMetadata, PromptMetadata, McpConfig, UiSessionMessages, UiStreamSummary, McpStatusEventBus, UiServerHandle } from "./types.ts";
-import type { UiResourceHandler } from "./ui-resource-handler.ts";
-import type { McpRuntimeOwner } from "./runtime-owner.ts";
-import type { McpOAuthRuntime } from "./mcp-auth-flow.ts";
-import type { SessionApprovalWriter } from "./session-approvals.ts";
-
-export interface CompletedUiSession {
-  serverName: string;
-  toolName: string;
-  completedAt: Date;
-  reason: string;
-  messages: UiSessionMessages;
-  stream?: UiStreamSummary;
-}
-
-export type SendMessageFn = (
-  message: {
-    customType: string;
-    content: Array<{ type: "text"; text: string }>;
-    display?: string;
-    details?: unknown;
-  },
-  options?: { triggerTurn?: boolean }
-) => void;
-
-export interface McpExtensionState {
-  owner: McpRuntimeOwner;
-  manager: McpServerManager;
-  lifecycle: McpLifecycleManager;
-  toolMetadata: Map<string, ToolMetadata[]>;
-  /** Number of tools currently registered directly with Pi, by server. */
-  directToolCounts: Map<string, number>;
-  /** Resource counts retained separately because tool metadata includes resource tools. */
-  resourceCounts: Map<string, number>;
-  promptMetadata: Map<string, PromptMetadata[]>;
-  /** Servers whose prompt inventory came from successful live discovery. */
-  promptMetadataLive: Set<string>;
-  serverInstructions: Map<string, string>;
-  config: McpConfig;
-  programmaticConfig?: boolean;
-  /** Install validations must not publish durable cache entries before config persistence. */
-  provisionalInstalls?: Set<string>;
-  oauthRuntime: McpOAuthRuntime;
-  authStorageOptions: AuthStorageOptions;
-  failureTracker: Map<string, number>;
-  failureMessages: Map<string, string>;
-  /** Session-only approvals keyed by server, tool definition, and arguments. */
-  approvedToolCalls: Map<string, true>;
-  /** Runtime-only server grants. Never persisted or restored from session entries. */
-  approvedServers?: Map<string, { definition: ServerDefinition; hash: string }>;
-  /** Optional active-session sink for approval decisions. */
-  persistSessionApproval?: SessionApprovalWriter;
-  /** Session manager used to reject stale session-tree contexts. */
-  sessionManager?: ExtensionContext["sessionManager"];
-  /** Shared event bus used by permission extensions to broker MCP approvals. */
-  approvalEvents?: ExtensionAPI["events"];
-  uiResourceHandler: UiResourceHandler;
-  consentManager: ConsentManager;
-  uiServer: UiServerHandle | null;
-  completedUiSessions: CompletedUiSession[];
-  openBrowser: (url: string) => Promise<void>;
-  ui?: ExtensionContext["ui"];
-  sendMessage?: SendMessageFn;
-  onToolMetadataUpdated?: (serverName: string, reason: string) => void | Promise<void>;
-  statusEvents?: McpStatusEventBus;
-}

package/node_modules/pi-mcp-adapter/tool-approval.ts

@@ -1,205 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { abortable } from "./abort.ts";
-import { combineAbortSignals } from "./runtime-owner.ts";
-import type { McpExtensionState } from "./state.ts";
-import { getServerApprovalIdentity, getToolApprovalIdentity, rememberToolApproval } from "./session-approvals.ts";
-import {
-  getToolNameCandidates,
-  matchesToolPattern,
-  resolveToolPrefix,
-  MCP_TOOL_APPROVAL_REQUEST_EVENT,
-  type McpConfig,
-  type McpToolApprovalDecision,
-  type McpToolApprovalHandler,
-  type McpToolApprovalOrigin,
-  type McpToolApprovalRequest,
-  type ToolMetadata,
-} from "./types.ts";
-import { sanitizeTerminalText } from "./utils.ts";
-
-export type ToolCallApprovalResult =
-  | { ok: true }
-  | { ok: false; reason: "denied" | "approval_required_headless" };
-
-export function isToolCallApprovalRequired(
-  config: McpConfig,
-  serverName: string,
-  toolMeta: Pick<ToolMetadata, "originalName">,
-  toolMetadata?: ReadonlyMap<string, readonly ToolMetadata[]>,
-): boolean {
-  const definition = config.mcpServers[serverName];
-  const serverApproval = definition?.approveTools;
-  const approval = serverApproval !== undefined ? serverApproval : config.settings?.approveTools;
-
-  if (approval === true) return true;
-  if (!Array.isArray(approval) || approval.length === 0) return false;
-
-  const prefix = resolveToolPrefix(definition, config.settings?.toolPrefix);
-  const currentCandidates = getToolNameCandidates(toolMeta.originalName, serverName, prefix, false);
-  if (serverApproval !== undefined) {
-    if (matchesToolPattern(currentCandidates, approval)) return true;
-    if (!toolMetadata) return matchesToolPattern(getToolNameCandidates(toolMeta.originalName, serverName, prefix), approval);
-    const legacyCandidates = getToolNameCandidates(toolMeta.originalName, serverName, prefix);
-    const legacyEmittedName = [...currentCandidates].find(candidate => candidate !== toolMeta.originalName)?.replace(/-/g, "_");
-    if (legacyEmittedName) legacyCandidates.add(legacyEmittedName);
-    for (const candidate of currentCandidates) legacyCandidates.delete(candidate);
-    const otherCurrentCandidates = new Set<string>();
-    for (const tool of toolMetadata.get(serverName) ?? []) {
-      for (const candidate of getToolNameCandidates(tool.originalName, serverName, prefix, false)) {
-        otherCurrentCandidates.add(candidate);
-      }
-    }
-    for (const candidate of currentCandidates) otherCurrentCandidates.delete(candidate);
-    return approval.some(pattern =>
-      matchesToolPattern(legacyCandidates, [pattern])
-      && !matchesToolPattern(otherCurrentCandidates, [pattern]),
-    );
-  }
-
-
-  if (matchesToolPattern(currentCandidates, approval)) return true;
-  if (!toolMetadata) return false;
-
-  const legacyCandidates = getToolNameCandidates(toolMeta.originalName, serverName, prefix);
-  const legacyEmittedName = [...currentCandidates].find(candidate => candidate !== toolMeta.originalName)?.replace(/-/g, "_");
-  if (legacyEmittedName) legacyCandidates.add(legacyEmittedName);
-  for (const candidate of currentCandidates) legacyCandidates.delete(candidate);
-  const otherCurrentCandidates = new Set<string>();
-  for (const [name, metadata] of toolMetadata) {
-    const otherPrefix = resolveToolPrefix(config.mcpServers[name], config.settings?.toolPrefix);
-    for (const tool of metadata) {
-      for (const candidate of getToolNameCandidates(tool.originalName, name, otherPrefix, false)) {
-        otherCurrentCandidates.add(candidate);
-      }
-    }
-  }
-  for (const candidate of currentCandidates) otherCurrentCandidates.delete(candidate);
-
-  return approval.some(pattern =>
-    matchesToolPattern(legacyCandidates, [pattern])
-    && !matchesToolPattern(otherCurrentCandidates, [pattern]),
-  );
-}
-
-function isMcpToolApprovalDecision(value: unknown): value is McpToolApprovalDecision {
-  return value === "allow_once"
-    || value === "allow_for_session"
-    || value === "deny"
-    || value === "abstain";
-}
-
-async function requestBrokerApproval(
-  state: McpExtensionState,
-  serverName: string,
-  toolMeta: ToolMetadata,
-  args: Record<string, unknown> | undefined,
-  origin: McpToolApprovalOrigin,
-  signal?: AbortSignal,
-): Promise<McpToolApprovalDecision> {
-  if (!state.approvalEvents) return "abstain";
-
-  let acceptingClaim = true;
-  let handler: McpToolApprovalHandler | undefined;
-  const request: McpToolApprovalRequest = {
-    requestId: randomUUID(),
-    serverName,
-    originalToolName: toolMeta.originalName,
-    prefixedToolName: toolMeta.name,
-    args: args ?? {},
-    origin,
-    ...(signal !== undefined ? { signal } : {}),
-    claim(candidate: McpToolApprovalHandler) {
-      if (!acceptingClaim || handler) return false;
-      handler = candidate;
-      return true;
-    },
-  };
-
-  state.approvalEvents.emit(MCP_TOOL_APPROVAL_REQUEST_EVENT, request);
-  acceptingClaim = false;
-  if (!handler) return "abstain";
-
-  try {
-    const decision = await abortable(Promise.resolve().then(handler), signal);
-    return isMcpToolApprovalDecision(decision) ? decision : "deny";
-  } catch (error) {
-    if (signal?.aborted) throw error;
-    return "deny";
-  }
-}
-
-export async function ensureToolCallApproved(
-  state: McpExtensionState,
-  serverName: string,
-  toolMeta: ToolMetadata,
-  args: Record<string, unknown> | undefined,
-  signal?: AbortSignal,
-  origin: McpToolApprovalOrigin = toolMeta.resourceUri ? "resource" : "proxy",
-  approvalMetadata?: ReadonlyMap<string, readonly ToolMetadata[]>,
-): Promise<ToolCallApprovalResult> {
-  const ownedSignal = combineAbortSignals(state.owner?.signal, signal);
-  const approvedServers = state.approvedServers ??= new Map();
-  const serverIdentity = getServerApprovalIdentity(state, serverName);
-  const brokerDecision = await requestBrokerApproval(state, serverName, toolMeta, args, origin, signal);
-  if (brokerDecision === "allow_once") return { ok: true };
-  if (brokerDecision === "allow_for_session") {
-    rememberToolApproval(state, serverName, toolMeta, args);
-    return { ok: true };
-  }
-  if (brokerDecision === "deny") return { ok: false, reason: "denied" };
-
-  const serverGrant = approvedServers.get(serverName);
-  const liveServerIdentity = getServerApprovalIdentity(state, serverName);
-  if (serverGrant && state.approvedServers === approvedServers
-    && serverGrant.definition === liveServerIdentity?.definition && serverGrant.hash === liveServerIdentity?.hash) {
-    ownedSignal?.throwIfAborted();
-    return { ok: true };
-  }
-  approvedServers.delete(serverName);
-
-  const { cacheKey } = getToolApprovalIdentity(serverName, toolMeta, args);
-  const approvedToolCalls = state.approvedToolCalls ??= new Map<string, true>();
-  if (approvedToolCalls.has(cacheKey)) {
-    return { ok: true };
-  }
-
-  if (!isToolCallApprovalRequired(state.config, serverName, toolMeta, approvalMetadata ?? state.toolMetadata)) {
-    return { ok: true };
-  }
-
-  if (!state.ui) {
-    return { ok: false, reason: "approval_required_headless" };
-  }
-
-  const json = JSON.stringify(args ?? {}, null, 2);
-  const sanitized = sanitizeTerminalText(json);
-  const preview = sanitized.length > 500 ? `${sanitized.slice(0, 500)}...` : sanitized;
-  const title = `MCP: ${sanitizeTerminalText(serverName)} wants to run ${sanitizeTerminalText(toolMeta.originalName)}`;
-  const serverScope = "Allow server for this session permits all tools and arguments on this server until reload or session/branch change. Other security and UI consent checks still apply.";
-  const decision = await abortable(
-    state.ui.select(
-      `${title}\n\nArguments:\n${preview}\n\n${serverScope}`,
-      ["Allow once", "Allow for session", "Allow server for this session", "Deny"],
-    ),
-    ownedSignal,
-  );
-
-  if (decision === "Allow server for this session") {
-    ownedSignal?.throwIfAborted();
-    const currentIdentity = getServerApprovalIdentity(state, serverName);
-    if (!serverIdentity || state.approvedServers !== approvedServers
-      || currentIdentity?.definition !== serverIdentity.definition || currentIdentity.hash !== serverIdentity.hash) {
-      return { ok: false, reason: "denied" };
-    }
-    approvedServers.set(serverName, serverIdentity);
-    return { ok: true };
-  }
-  if (decision === "Allow once") {
-    return { ok: true };
-  }
-  if (decision === "Allow for session") {
-    rememberToolApproval(state, serverName, toolMeta, args);
-    return { ok: true };
-  }
-  return { ok: false, reason: "denied" };
-}