@humain/terminal 0.0.3-beta.3 → 0.0.4-beta.2

package/dist/humain/mcp-adapter/vendor/index.bundle.mjs

@@ -662,15 +662,155 @@ var init_agent_plugin_loader = __esm({
   }
 });
 
+// packages/coding-agent/src/humain/mcp-adapter/vendor/package-mcp-loader.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3, realpathSync, statSync as statSync2 } from "node:fs";
+import { isAbsolute as isAbsolute2, join as join2, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
+import stripJsonComments from "strip-json-comments";
+function loadPackageMcpConfigs(cwd = process.cwd()) {
+  const mcpServers = {};
+  const seen = /* @__PURE__ */ new Set();
+  for (const packageRoot of getConfiguredPackageRoots(cwd)) {
+    const manifest = readPackageManifest(packageRoot);
+    if (!manifest || typeof manifest.name !== "string" || !manifest.name) continue;
+    const paths = getManifestMcpPaths(manifest.pi?.mcp, manifest.name);
+    if (!paths) continue;
+    const packagePrefix = formatPackageName(manifest.name);
+    const packageServers = /* @__PURE__ */ new Set();
+    for (const path2 of paths) {
+      const configPath = resolvePackageConfigPath(packageRoot, path2);
+      if (!configPath) {
+        console.warn(`Pi package ${manifest.name} skips MCP config ${path2}: file must stay inside the package`);
+        continue;
+      }
+      const config = readMcpConfig(configPath, manifest.name);
+      if (!config) continue;
+      for (const [serverName, server2] of Object.entries(config.mcpServers)) {
+        const normalizedName = `${packagePrefix}__${formatServerName(serverName)}`;
+        if (packageServers.has(normalizedName) || seen.has(normalizedName)) {
+          console.warn(`Pi package ${manifest.name} skips duplicate normalized MCP server ${normalizedName}`);
+          continue;
+        }
+        packageServers.add(normalizedName);
+        seen.add(normalizedName);
+        mcpServers[normalizedName] = server2;
+      }
+    }
+  }
+  return { mcpServers };
+}
+function getConfiguredPackageRoots(cwd) {
+  const roots = [];
+  for (const [settingsPath, scope] of [
+    [join2(cwd, getConfigDirName(), "settings.json"), "project"],
+    [join2(getAgentDir(), "settings.json"), "user"]
+  ]) {
+    const settings = readOptionalJson(settingsPath, `${scope} Pi settings`);
+    if (settings === void 0) continue;
+    if (typeof settings !== "object" || settings === null || Array.isArray(settings)) {
+      throw new Error(`${scope} Pi settings ${settingsPath} must be a JSON object`);
+    }
+    const packages = settings.packages;
+    if (packages === void 0) continue;
+    if (!Array.isArray(packages)) throw new Error(`${scope} Pi settings ${settingsPath} packages must be an array`);
+    for (const entry of packages) {
+      const source = typeof entry === "string" ? entry : entry && typeof entry === "object" && !Array.isArray(entry) && typeof entry.source === "string" ? entry.source : void 0;
+      if (!source) throw new Error(`${scope} Pi settings ${settingsPath} package entries must be strings or objects with a string source`);
+      const root = resolvePackageRoot(source, scope, cwd);
+      if (root && !roots.includes(root)) roots.push(root);
+    }
+  }
+  return roots;
+}
+function resolvePackageRoot(source, scope, cwd) {
+  const baseDir = scope === "user" ? getAgentDir() : join2(cwd, getConfigDirName());
+  if (source.startsWith("npm:")) {
+    const name = source.slice(4).trim().match(/^(@?[^@]+(?:\/[^@]+)?)/)?.[1];
+    return name ? resolveContainedPath2(join2(baseDir, "npm", "node_modules"), name) : null;
+  }
+  const gitSource = source.startsWith("git:") ? source.slice(4).trim() : /^(?:(?:https?|ssh):\/\/|git@[^:]+:)/.test(source) ? source : null;
+  if (gitSource) {
+    const value = gitSource.replace(/^ssh:\/\/git@/, "").replace(/^git@([^:]+):/, "$1/").replace(/^[a-z]+:\/\//i, "");
+    const path2 = value.replace(/@[^/]+$/, "").replace(/\.git$/, "");
+    return path2 && !path2.startsWith("/") ? resolveContainedPath2(join2(baseDir, "git"), path2) : null;
+  }
+  return isAbsolute2(source) ? resolve3(source) : resolve3(baseDir, source);
+}
+function readPackageManifest(packageRoot) {
+  const manifest = readOptionalJson(join2(packageRoot, "package.json"), `Pi package manifest ${packageRoot}`);
+  return manifest && typeof manifest === "object" && !Array.isArray(manifest) ? manifest : null;
+}
+function getManifestMcpPaths(value, packageName) {
+  const paths = typeof value === "string" ? [value] : Array.isArray(value) && value.every((path2) => typeof path2 === "string") ? value : null;
+  if (value !== void 0 && !paths) console.warn(`Pi package ${packageName} ignores invalid pi.mcp manifest entry`);
+  return paths;
+}
+function readMcpConfig(path2, packageName) {
+  const config = readRequiredJson(path2, `Pi package ${packageName} MCP config`);
+  if (!config || typeof config !== "object" || Array.isArray(config)) {
+    throw new Error(`Pi package ${packageName} MCP config ${path2} must be a JSON object`);
+  }
+  const servers = config.mcpServers;
+  if (!servers || typeof servers !== "object" || Array.isArray(servers)) {
+    throw new Error(`Pi package ${packageName} MCP config ${path2} must contain a JSON object mcpServers field`);
+  }
+  const mcpServers = {};
+  for (const [name, server2] of Object.entries(servers)) {
+    if (!server2 || typeof server2 !== "object" || Array.isArray(server2)) {
+      throw new Error(`Pi package ${packageName} MCP config ${path2} server ${name} must be a JSON object`);
+    }
+    mcpServers[name] = server2;
+  }
+  return { mcpServers };
+}
+function readRequiredJson(path2, description) {
+  try {
+    return JSON.parse(stripJsonComments(readFileSync3(path2, "utf8"), { trailingCommas: true }));
+  } catch (error) {
+    throw new Error(`${description} ${path2} contains invalid JSON: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+  }
+}
+function readOptionalJson(path2, description) {
+  if (!existsSync2(path2)) return void 0;
+  return readRequiredJson(path2, description);
+}
+function resolveContainedPath2(root, path2) {
+  const resolved = resolve3(root, path2);
+  const rel = relative2(root, resolved);
+  return rel === "" || !rel.startsWith("..") && !rel.startsWith(sep2) && !isAbsolute2(rel) ? resolved : null;
+}
+function resolvePackageConfigPath(packageRoot, path2) {
+  const lexicalPath = resolveContainedPath2(packageRoot, path2);
+  if (!lexicalPath || !existsSync2(lexicalPath) || !statSync2(lexicalPath).isFile()) return null;
+  try {
+    const realPackageRoot = realpathSync(packageRoot);
+    const realConfigPath = realpathSync(lexicalPath);
+    return resolveContainedPath2(realPackageRoot, realConfigPath);
+  } catch {
+    return null;
+  }
+}
+function formatPackageName(name) {
+  return name.replace(/[^A-Za-z0-9_-]+/g, "_").replace(/^[_-]+|[_-]+$/g, "") || "package";
+}
+function formatServerName(name) {
+  return name.replace(/[^A-Za-z0-9_-]+/g, "_").replace(/^[_-]+|[_-]+$/g, "") || "server";
+}
+var init_package_mcp_loader = __esm({
+  "packages/coding-agent/src/humain/mcp-adapter/vendor/package-mcp-loader.ts"() {
+    "use strict";
+    init_agent_dir();
+  }
+});
+
 // packages/coding-agent/src/humain/mcp-adapter/vendor/utils.ts
 import { spawnSync } from "node:child_process";
 import { homedir as homedir2, platform } from "node:os";
-import { extname, isAbsolute as isAbsolute2, join as join2 } from "node:path";
+import { extname, isAbsolute as isAbsolute3, join as join3 } from "node:path";
 async function execOpen(pi, target, browser, signal) {
   const os = platform();
   if (os === "darwin") {
     if (browser) {
-      return isAbsolute2(browser) && extname(browser).toLowerCase() !== ".app" ? pi.exec(browser, [target], signal ? { signal } : {}) : pi.exec("open", ["-a", browser, target], signal ? { signal } : {});
+      return isAbsolute3(browser) && extname(browser).toLowerCase() !== ".app" ? pi.exec(browser, [target], signal ? { signal } : {}) : pi.exec("open", ["-a", browser, target], signal ? { signal } : {});
     }
     return pi.exec("open", [target], signal ? { signal } : {});
   }
@@ -798,7 +938,7 @@ function resolveConfigPath(value) {
   const resolved = interpolateEnvVars(value);
   if (resolved === "~") return homedir2();
   if (resolved.startsWith("~/") || resolved.startsWith("~\\")) {
-    return join2(homedir2(), resolved.slice(2));
+    return join3(homedir2(), resolved.slice(2));
   }
   return resolved;
 }
@@ -870,6 +1010,67 @@ function normalizeDirectToolInputSchema(schema) {
   const { $schema, additionalProperties, ...normalized } = inputSchema;
   return normalized;
 }
+function normalizeToolArguments(value, context = "tool arguments") {
+  if (value === void 0 || value === null || value === "") return {};
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    if (trimmed === "") return {};
+    let parsed;
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch (error) {
+      throw new Error(
+        `${context}: invalid args JSON (${error instanceof SyntaxError ? error.message : String(error)}); pass args as a JSON object, or as a valid JSON string encoding one`,
+        { cause: error }
+      );
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      throw new Error(
+        `${context}: expected a JSON object, got ${Array.isArray(parsed) ? "array" : typeof parsed}`
+      );
+    }
+    return parsed;
+  }
+  if (typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(
+      `${context}: expected a JSON object, got ${Array.isArray(value) ? "array" : typeof value}`
+    );
+  }
+  assertJsonSerializable(value, context);
+  try {
+    return JSON.parse(JSON.stringify(value));
+  } catch (error) {
+    throw new Error(
+      `${context}: value is not JSON-serializable: ${error instanceof Error ? error.message : String(error)}`,
+      { cause: error }
+    );
+  }
+}
+function assertJsonSerializable(value, context, path2 = "") {
+  if (value === null) return;
+  if (typeof value === "string" || typeof value === "boolean") return;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new Error(`${context}: value at ${path2 || "root"} is not a finite number`);
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const [index, item] of value.entries()) assertJsonSerializable(item, context, `${path2}[${index}]`);
+    return;
+  }
+  if (typeof value === "object") {
+    if (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) {
+      throw new Error(`${context}: value at ${path2 || "root"} is not a plain JSON object`);
+    }
+    if (Object.getOwnPropertySymbols(value).length > 0) {
+      throw new Error(`${context}: value at ${path2 || "root"} has symbol keys`);
+    }
+    for (const [key, item] of Object.entries(value)) {
+      assertJsonSerializable(item, context, path2 ? `${path2}.${key}` : key);
+    }
+    return;
+  }
+  throw new Error(`${context}: value at ${path2 || "root"} is not JSON-serializable`);
+}
 function formatAuthRequiredMessage(config, serverName, defaultMessage) {
   const template = config.settings?.authRequiredMessage;
   return template ? template.replaceAll("${server}", serverName) : defaultMessage;
@@ -897,19 +1098,19 @@ var init_utils = __esm({
 });
 
 // packages/coding-agent/src/humain/mcp-adapter/vendor/config.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3, writeFileSync, mkdirSync, renameSync } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync4, writeFileSync, mkdirSync, renameSync } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { dirname, join as join3, resolve as resolve3 } from "node:path";
+import { dirname, join as join4, resolve as resolve4 } from "node:path";
 import { parse as parseToml } from "smol-toml";
-import stripJsonComments from "strip-json-comments";
+import stripJsonComments2 from "strip-json-comments";
 function getPiGlobalConfigPath(overridePath) {
-  return overridePath ? resolve3(overridePath) : getAgentPath("mcp.json");
+  return overridePath ? resolve4(overridePath) : getAgentPath("mcp.json");
 }
 function getProjectConfigPath(cwd = process.cwd()) {
-  return resolve3(cwd, PROJECT_CONFIG_NAME);
+  return resolve4(cwd, PROJECT_CONFIG_NAME);
 }
 function getProjectPiConfigPath(cwd = process.cwd()) {
-  return resolve3(cwd, getConfigDirName(), PROJECT_PI_CONFIG_NAME);
+  return resolve4(cwd, getConfigDirName(), PROJECT_PI_CONFIG_NAME);
 }
 function getConfigSourceSummaries(sourceSpecs) {
   return sourceSpecs.map((source) => {
@@ -918,7 +1119,7 @@ function getConfigSourceSummaries(sourceSpecs) {
       id: source.id,
       label: source.label,
       path: source.readPath,
-      exists: existsSync2(source.readPath),
+      exists: existsSync3(source.readPath),
       scope: source.scope,
       kind: source.shared ? "shared" : "pi",
       serverCount: loaded ? Object.keys(loaded.mcpServers).length : 0
@@ -993,8 +1194,12 @@ function loadMcpConfig(overridePath, cwd = process.cwd()) {
     if (!loaded) continue;
     config = mergeConfigs(config, expandImports(loaded, cwd));
   }
+  const packageConfig = loadPackageMcpConfigs(cwd);
   const pluginConfig = loadAgentPluginConfigs(config.settings?.agentPluginPaths, cwd);
-  return mergeConfigs(pluginConfig, config);
+  const packageServers = Object.fromEntries(
+    Object.entries(packageConfig.mcpServers).filter(([name]) => !Object.hasOwn(pluginConfig.mcpServers, name))
+  );
+  return mergeConfigs({ mcpServers: packageServers }, mergeConfigs(pluginConfig, config));
 }
 function getMergedSettings(overridePath, cwd = process.cwd()) {
   let settings;
@@ -1134,25 +1339,54 @@ function mergeServerMaps(base, next) {
   for (const [name, definition] of Object.entries(next)) {
     const existing = merged[name];
     let baseEntry = existing ?? {};
-    if (existing && typeof definition.socket === "string") {
+    if (existing && typeof definition.command === "string") {
+      baseEntry = { ...existing };
+      for (const field of [
+        "url",
+        "headers",
+        "requestHeadersCommand",
+        "auth",
+        "bearerToken",
+        "bearerTokenEnv",
+        "oauth",
+        "httpTransport",
+        "socket"
+      ]) {
+        delete baseEntry[field];
+      }
+    } else if (existing && typeof definition.url === "string") {
       baseEntry = { ...existing };
       for (const field of [
         "command",
         "args",
         "env",
         "cwd",
+        "pluginDataDir",
+        "literalEnv",
+        "socket"
+      ]) {
+        delete baseEntry[field];
+      }
+    } else if (existing && typeof definition.socket === "string") {
+      baseEntry = { ...existing };
+      for (const field of [
+        "command",
+        "args",
+        "env",
+        "cwd",
+        "pluginDataDir",
+        "literalEnv",
         "url",
         "headers",
+        "requestHeadersCommand",
         "auth",
         "bearerToken",
         "bearerTokenEnv",
-        "oauth"
+        "oauth",
+        "httpTransport"
       ]) {
         delete baseEntry[field];
       }
-    } else if (existing?.socket && (typeof definition.command === "string" || typeof definition.url === "string")) {
-      baseEntry = { ...existing };
-      delete baseEntry.socket;
     }
     if (existing && typeof definition.url === "string" && definition.url !== existing.url) {
       if (baseEntry === existing) baseEntry = { ...existing };
@@ -1194,11 +1428,11 @@ function expandImports(config, cwd = process.cwd()) {
 function resolveImportCandidates(importKind, cwd) {
   return (IMPORT_PATHS[importKind] ?? []).map((candidate) => {
     if (importKind === "opencode" && candidate === "./opencode.json") {
-      const start = resolve3(cwd);
+      const start = resolve4(cwd);
       let gitRoot;
       let current = start;
       while (true) {
-        if (existsSync2(join3(current, ".git"))) {
+        if (existsSync3(join4(current, ".git"))) {
           gitRoot = current;
           break;
         }
@@ -1206,22 +1440,22 @@ function resolveImportCandidates(importKind, cwd) {
         if (parent === current) break;
         current = parent;
       }
-      if (!gitRoot) return join3(start, "opencode.json");
+      if (!gitRoot) return join4(start, "opencode.json");
       current = start;
       while (true) {
-        const projectConfig = join3(current, "opencode.json");
-        if (existsSync2(projectConfig) || current === gitRoot) return projectConfig;
+        const projectConfig = join4(current, "opencode.json");
+        if (existsSync3(projectConfig) || current === gitRoot) return projectConfig;
         current = dirname(current);
       }
     }
-    return candidate.startsWith(".") ? resolve3(cwd, candidate) : candidate;
+    return candidate.startsWith(".") ? resolve4(cwd, candidate) : candidate;
   });
 }
 function parseJsonConfig(raw) {
-  return JSON.parse(stripJsonComments(raw, { trailingCommas: true }));
+  return JSON.parse(stripJsonComments2(raw, { trailingCommas: true }));
 }
 function readImportedConfig(path2) {
-  const raw = readFileSync3(path2, "utf-8");
+  const raw = readFileSync4(path2, "utf-8");
   return path2.endsWith(".toml") ? parseToml(raw) : parseJsonConfig(raw);
 }
 function loadImportedConfig(importKind, cwd, warningPrefix) {
@@ -1229,7 +1463,7 @@ function loadImportedConfig(importKind, cwd, warningPrefix) {
     let merged = {};
     let highestPrecedencePath;
     for (const path2 of resolveImportCandidates(importKind, cwd)) {
-      if (!existsSync2(path2)) continue;
+      if (!existsSync3(path2)) continue;
       try {
         const value = readImportedConfig(path2);
         if (value && typeof value === "object" && !Array.isArray(value)) {
@@ -1243,7 +1477,7 @@ function loadImportedConfig(importKind, cwd, warningPrefix) {
     return highestPrecedencePath ? { path: highestPrecedencePath, value: merged } : null;
   }
   for (const path2 of resolveImportCandidates(importKind, cwd)) {
-    if (!existsSync2(path2)) continue;
+    if (!existsSync3(path2)) continue;
     try {
       return { path: path2, value: readImportedConfig(path2) };
     } catch (error) {
@@ -1253,9 +1487,9 @@ function loadImportedConfig(importKind, cwd, warningPrefix) {
   return null;
 }
 function readValidatedConfig(path2, label) {
-  if (!existsSync2(path2)) return null;
+  if (!existsSync3(path2)) return null;
   try {
-    return validateConfig(parseJsonConfig(readFileSync3(path2, "utf-8")));
+    return validateConfig(parseJsonConfig(readFileSync4(path2, "utf-8")));
   } catch (error) {
     console.warn(`Failed to load ${label}:`, error);
     return null;
@@ -1467,7 +1701,7 @@ function buildUnifiedDiff(beforeText, afterText) {
   return lines.join("\n");
 }
 function buildConfigWritePreview(filePath, nextRaw) {
-  const existed = existsSync2(filePath);
+  const existed = existsSync3(filePath);
   const beforeRaw = readRawConfigObject(filePath);
   const beforeText = existed ? serializeRawConfig(beforeRaw) : "";
   const afterText = serializeRawConfig(nextRaw);
@@ -1481,9 +1715,9 @@ function buildConfigWritePreview(filePath, nextRaw) {
   };
 }
 function readRawConfigObject(filePath) {
-  if (!existsSync2(filePath)) return {};
+  if (!existsSync3(filePath)) return {};
   try {
-    const raw = parseJsonConfig(readFileSync3(filePath, "utf-8"));
+    const raw = parseJsonConfig(readFileSync4(filePath, "utf-8"));
     return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
   } catch {
     return {};
@@ -1510,9 +1744,9 @@ function setServersObject(raw, servers) {
 function writeProjectServerDisabledOverride(overridePath, cwd, serverName, disabled) {
   const filePath = getProjectPiConfigPath(cwd);
   let raw = {};
-  if (existsSync2(filePath)) {
+  if (existsSync3(filePath)) {
     try {
-      const parsed = parseJsonConfig(readFileSync3(filePath, "utf-8"));
+      const parsed = parseJsonConfig(readFileSync4(filePath, "utf-8"));
       if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
         throw new Error("root value must be an object");
       }
@@ -1572,9 +1806,9 @@ function isRepoPromptServer(name, entry) {
   return (entry.args ?? []).some((arg) => typeof arg === "string" && arg.toLowerCase().includes("repoprompt"));
 }
 function findProjectRoot(cwd = process.cwd()) {
-  let current = resolve3(cwd);
+  let current = resolve4(cwd);
   while (true) {
-    if (existsSync2(join3(current, ".git")) || existsSync2(join3(current, "package.json")) || existsSync2(join3(current, PROJECT_CONFIG_NAME)) || existsSync2(join3(current, ".pi"))) {
+    if (existsSync3(join4(current, ".git")) || existsSync3(join4(current, "package.json")) || existsSync3(join4(current, PROJECT_CONFIG_NAME)) || existsSync3(join4(current, ".pi"))) {
       return current;
     }
     const parent = dirname(current);
@@ -1600,12 +1834,12 @@ function detectRepoPrompt(summary, cwd = process.cwd()) {
       }
     }
   }
-  const executablePath = REPOPROMPT_BINARY_CANDIDATES.find((candidate) => existsSync2(candidate));
+  const executablePath = REPOPROMPT_BINARY_CANDIDATES.find((candidate) => existsSync3(candidate));
   if (!executablePath) {
     return { configured: false };
   }
   const projectRoot = findProjectRoot(cwd);
-  const targetPath = projectRoot ? join3(projectRoot, PROJECT_CONFIG_NAME) : GENERIC_GLOBAL_CONFIG_PATH;
+  const targetPath = projectRoot ? join4(projectRoot, PROJECT_CONFIG_NAME) : GENERIC_GLOBAL_CONFIG_PATH;
   return {
     configured: false,
     executablePath,
@@ -1740,7 +1974,7 @@ function resolveConfiguredOAuthDir(raw, cwd = process.cwd()) {
   }
   const trimmed = raw.trim();
   if (!trimmed) return void 0;
-  return resolve3(cwd, trimmed);
+  return resolve4(cwd, trimmed);
 }
 var GENERIC_GLOBAL_CONFIG_PATH, AGENTS_GLOBAL_CONFIG_PATHS, PROJECT_CONFIG_NAME, PROJECT_PI_CONFIG_NAME, REPOPROMPT_BINARY_CANDIDATES, KNOWN_SERVER_PRESETS, IMPORT_PATHS, URL_BOUND_AUTH_FIELDS;
 var init_config = __esm({
@@ -1748,17 +1982,18 @@ var init_config = __esm({
     "use strict";
     init_agent_dir();
     init_agent_plugin_loader();
+    init_package_mcp_loader();
     init_types();
     init_utils();
-    GENERIC_GLOBAL_CONFIG_PATH = join3(homedir3(), ".config", "mcp", "mcp.json");
+    GENERIC_GLOBAL_CONFIG_PATH = join4(homedir3(), ".config", "mcp", "mcp.json");
     AGENTS_GLOBAL_CONFIG_PATHS = [
-      join3(homedir3(), ".agents", "mcp.json"),
-      join3(homedir3(), ".agents", "mcp", "mcp.json")
+      join4(homedir3(), ".agents", "mcp.json"),
+      join4(homedir3(), ".agents", "mcp", "mcp.json")
     ];
     PROJECT_CONFIG_NAME = ".mcp.json";
     PROJECT_PI_CONFIG_NAME = "mcp.json";
     REPOPROMPT_BINARY_CANDIDATES = [
-      join3(homedir3(), "RepoPrompt", "repoprompt_cli"),
+      join4(homedir3(), "RepoPrompt", "repoprompt_cli"),
       "/Applications/Repo Prompt.app/Contents/MacOS/repoprompt-mcp"
     ];
     KNOWN_SERVER_PRESETS = [
@@ -1794,25 +2029,25 @@ var init_config = __esm({
       }
     ];
     IMPORT_PATHS = {
-      cursor: [join3(homedir3(), ".cursor", "mcp.json")],
+      cursor: [join4(homedir3(), ".cursor", "mcp.json")],
       "claude-code": [
-        join3(homedir3(), ".claude", "mcp.json"),
-        join3(homedir3(), ".claude.json"),
-        join3(homedir3(), ".claude", "claude_desktop_config.json")
+        join4(homedir3(), ".claude", "mcp.json"),
+        join4(homedir3(), ".claude.json"),
+        join4(homedir3(), ".claude", "claude_desktop_config.json")
       ],
-      "claude-desktop": [join3(homedir3(), "Library", "Application Support", "Claude", "claude_desktop_config.json")],
+      "claude-desktop": [join4(homedir3(), "Library", "Application Support", "Claude", "claude_desktop_config.json")],
       codex: [
-        join3(homedir3(), ".codex", "config.toml"),
-        join3(homedir3(), ".codex", "config.json")
+        join4(homedir3(), ".codex", "config.toml"),
+        join4(homedir3(), ".codex", "config.json")
       ],
       opencode: [
-        join3(homedir3(), ".config", "opencode", "opencode.json"),
+        join4(homedir3(), ".config", "opencode", "opencode.json"),
         "./opencode.json"
       ],
-      windsurf: [join3(homedir3(), ".windsurf", "mcp.json")],
+      windsurf: [join4(homedir3(), ".windsurf", "mcp.json")],
       vscode: [".vscode/mcp.json"]
     };
-    URL_BOUND_AUTH_FIELDS = ["headers", "bearerToken", "bearerTokenEnv", "requestHeadersCommand"];
+    URL_BOUND_AUTH_FIELDS = ["headers", "bearerToken", "bearerTokenEnv", "bearerTokenStore", "requestHeadersCommand"];
   }
 });
 
@@ -1896,7 +2131,7 @@ var init_ui_tool_visibility = __esm({
 });
 
 // packages/coding-agent/src/humain/mcp-adapter/vendor/metadata-cache.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync2, renameSync as renameSync2, mkdirSync as mkdirSync2 } from "node:fs";
+import { existsSync as existsSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync2, renameSync as renameSync2, mkdirSync as mkdirSync2 } from "node:fs";
 import { dirname as dirname3 } from "node:path";
 import { createHash as createHash2 } from "node:crypto";
 function getMetadataCachePath() {
@@ -1904,9 +2139,9 @@ function getMetadataCachePath() {
 }
 function loadMetadataCache() {
   const cachePath = getMetadataCachePath();
-  if (!existsSync4(cachePath)) return null;
+  if (!existsSync5(cachePath)) return null;
   try {
-    const raw = JSON.parse(readFileSync5(cachePath, "utf-8"));
+    const raw = JSON.parse(readFileSync6(cachePath, "utf-8"));
     if (!raw || typeof raw !== "object") return null;
     if (raw.version !== CACHE_VERSION) return null;
     if (!raw.servers || typeof raw.servers !== "object") return null;
@@ -1921,8 +2156,8 @@ function saveMetadataCache(cache) {
   mkdirSync2(dir, { recursive: true });
   let merged = { version: CACHE_VERSION, servers: {} };
   try {
-    if (existsSync4(cachePath)) {
-      const existing = JSON.parse(readFileSync5(cachePath, "utf-8"));
+    if (existsSync5(cachePath)) {
+      const existing = JSON.parse(readFileSync6(cachePath, "utf-8"));
       if (existing && existing.version === CACHE_VERSION && existing.servers) {
         merged.servers = { ...existing.servers };
       }
@@ -1932,7 +2167,7 @@ function saveMetadataCache(cache) {
   merged.version = CACHE_VERSION;
   merged.servers = { ...merged.servers, ...cache.servers };
   const tmpPath = `${cachePath}.${process.pid}.tmp`;
-  writeFileSync2(tmpPath, JSON.stringify(merged, null, 2), "utf-8");
+  writeFileSync2(tmpPath, JSON.stringify(merged), "utf-8");
   renameSync2(tmpPath, cachePath);
 }
 function computeServerHash(definition) {
@@ -2008,30 +2243,12 @@ function getMissingConfiguredDirectToolServers(config, cache, envOverride) {
   }
   return missing;
 }
-function reconstructToolMetadata(serverName, entry, prefix, definition, configuredServers, cache) {
+function reconstructToolMetadata(serverName, entry, prefix, definition, configuredServers, cache, sharedSelectorCandidateIndex) {
   const metadata = [];
   const seenNames = /* @__PURE__ */ new Set();
   const effectivePrefix = resolveToolPrefix(definition, prefix);
   const hasToolFilters = Array.isArray(definition.includeTools) && definition.includeTools.length > 0 || Array.isArray(definition.excludeTools) && definition.excludeTools.length > 0;
-  const selectorCandidateIndex = hasToolFilters && configuredServers && cache ? (() => {
-    const candidates = /* @__PURE__ */ new Set();
-    for (const [otherServerName, otherDefinition] of Object.entries(configuredServers)) {
-      const otherEntry = cache.servers[otherServerName];
-      if (!otherEntry || !isServerCacheValid(otherEntry, otherDefinition) || isServerDisabled(otherDefinition)) continue;
-      const otherPrefix = resolveToolPrefix(otherDefinition, prefix);
-      for (const otherTool of otherEntry.tools ?? []) {
-        if (!isUiToolVisibleToModel(otherTool.uiVisibility)) continue;
-        for (const candidate of getToolNameCandidates(otherTool.name, otherServerName, otherPrefix, false)) candidates.add(candidate);
-      }
-      if (otherDefinition.exposeResources !== false) {
-        for (const resource of otherEntry.resources ?? []) {
-          const baseName = `read_${resourceNameToToolName(resource.name)}`;
-          for (const candidate of getToolNameCandidates(baseName, otherServerName, otherPrefix, false)) candidates.add(candidate);
-        }
-      }
-    }
-    return createToolSelectorCandidateIndex(candidates);
-  })() : void 0;
+  const selectorCandidateIndex = hasToolFilters ? sharedSelectorCandidateIndex ?? (configuredServers && cache ? createCachedToolSelectorCandidateIndex(configuredServers, cache, prefix) : void 0) : void 0;
   for (const tool of entry.tools ?? []) {
     if (!tool?.name) continue;
     if (!isUiToolVisibleToModel(tool.uiVisibility)) {
@@ -2077,6 +2294,25 @@ function reconstructToolMetadata(serverName, entry, prefix, definition, configur
   }
   return metadata;
 }
+function createCachedToolSelectorCandidateIndex(configuredServers, cache, prefix) {
+  const candidates = /* @__PURE__ */ new Set();
+  for (const [serverName, definition] of Object.entries(configuredServers)) {
+    const entry = cache.servers[serverName];
+    if (!entry || !isServerCacheValid(entry, definition) || isServerDisabled(definition)) continue;
+    const effectivePrefix = resolveToolPrefix(definition, prefix);
+    for (const tool of entry.tools ?? []) {
+      if (!isUiToolVisibleToModel(tool.uiVisibility)) continue;
+      for (const candidate of getToolNameCandidates(tool.name, serverName, effectivePrefix, false)) candidates.add(candidate);
+    }
+    if (definition.exposeResources !== false) {
+      for (const resource of entry.resources ?? []) {
+        const baseName = `read_${resourceNameToToolName(resource.name)}`;
+        for (const candidate of getToolNameCandidates(baseName, serverName, effectivePrefix, false)) candidates.add(candidate);
+      }
+    }
+  }
+  return createToolSelectorCandidateIndex(candidates);
+}
 function serializeTools(tools) {
   return tools.filter((t) => t?.name).map((t) => {
     const uiResourceUri = tryGetToolUiResourceUri(t);
@@ -2759,8 +2995,8 @@ var init_mcp_setup_panel = __esm({
 });
 
 // packages/coding-agent/src/utils/clipboard-native.ts
-import { createRequire as createRequire2 } from "module";
-import { dirname as dirname7, join as join6 } from "path";
+import { createRequire as createRequire3 } from "module";
+import { dirname as dirname8, join as join8 } from "path";
 import { pathToFileURL } from "url";
 function loadClipboardNative(requires = [moduleRequire, executableDirRequire]) {
   for (const requireClipboard of requires) {
@@ -2775,21 +3011,21 @@ var moduleRequire, executableDirRequire, hasDisplay, clipboard;
 var init_clipboard_native = __esm({
   "packages/coding-agent/src/utils/clipboard-native.ts"() {
     "use strict";
-    moduleRequire = createRequire2(import.meta.url);
-    executableDirRequire = createRequire2(pathToFileURL(join6(dirname7(process.execPath), "package.json")).href);
+    moduleRequire = createRequire3(import.meta.url);
+    executableDirRequire = createRequire3(pathToFileURL(join8(dirname8(process.execPath), "package.json")).href);
     hasDisplay = process.platform !== "linux" || Boolean(process.env.DISPLAY || process.env.WAYLAND_DISPLAY);
     clipboard = !process.env.TERMUX_VERSION && hasDisplay ? loadClipboardNative() : null;
   }
 });
 
 // packages/coding-agent/src/utils/photon.ts
-import { createRequire as createRequire3 } from "module";
-var require3, fs;
+import { createRequire as createRequire4 } from "module";
+var require4, fs;
 var init_photon = __esm({
   "packages/coding-agent/src/utils/photon.ts"() {
     "use strict";
-    require3 = createRequire3(import.meta.url);
-    fs = require3("fs");
+    require4 = createRequire4(import.meta.url);
+    fs = require4("fs");
   }
 });
 
@@ -2866,10 +3102,10 @@ async function copyToClipboard(text) {
           if (isWayland && hasWaylandDisplay) {
             try {
               execSync("which wl-copy", { stdio: "ignore" });
-              const wlCopyExit = await new Promise((resolve6) => {
+              const wlCopyExit = await new Promise((resolve7) => {
                 const proc = spawn2("wl-copy", [], { stdio: ["pipe", "ignore", "ignore"] });
-                proc.on("error", () => resolve6(1));
-                proc.on("close", (code) => resolve6(code ?? 1));
+                proc.on("error", () => resolve7(1));
+                proc.on("close", (code) => resolve7(code ?? 1));
                 proc.stdin.on("error", () => {
                 });
                 proc.stdin.write(text);
@@ -3100,6 +3336,13 @@ var init_mcp_panel = __esm({
           }
           const status = callbacks.getConnectionStatus(serverName);
           const failureMessage = callbacks.getFailureMessage?.(serverName) ?? null;
+          let directCount = 0;
+          let directTokens = 0;
+          for (const tool of tools) {
+            if (!tool.isDirect) continue;
+            directCount++;
+            directTokens += tool.estimatedTokens;
+          }
           this.servers.push({
             name: serverName,
             expanded: false,
@@ -3111,6 +3354,8 @@ var init_mcp_panel = __esm({
             connectionStatus: status,
             failureMessage,
             tools,
+            directCount,
+            directTokens,
             hasCachedData: !!serverCache
           });
         }
@@ -3297,7 +3542,7 @@ var init_mcp_panel = __esm({
           } else if (item.toolIndex !== void 0) {
             const tool = server2.tools[item.toolIndex];
             if (!tool) return;
-            tool.isDirect = !tool.isDirect;
+            this.toggleToolDirect(server2, tool);
             if (tool.isDirect && server2.source === "import") {
               this.importNotice = `Imported from ${sanitizeDisplayText(server2.importKind ?? "external")} \u2014 will copy to user config on save`;
             }
@@ -3430,17 +3675,28 @@ var init_mcp_panel = __esm({
           if (server2.source === "import" && newState) {
             this.importNotice = `Imported from ${sanitizeDisplayText(server2.importKind ?? "external")} \u2014 will copy to user config on save`;
           }
-          for (const t of server2.tools) t.isDirect = newState;
+          let directTokens = 0;
+          for (const tool of server2.tools) {
+            tool.isDirect = newState;
+            if (newState) directTokens += tool.estimatedTokens;
+          }
+          server2.directCount = newState ? server2.tools.length : 0;
+          server2.directTokens = directTokens;
         } else if (item.toolIndex !== void 0) {
           const tool = server2.tools[item.toolIndex];
           if (!tool) return;
-          tool.isDirect = !tool.isDirect;
+          this.toggleToolDirect(server2, tool);
           if (tool.isDirect && server2.source === "import") {
             this.importNotice = `Imported from ${sanitizeDisplayText(server2.importKind ?? "external")} \u2014 will copy to user config on save`;
           }
         }
         this.updateDirty();
       }
+      toggleToolDirect(server2, tool) {
+        tool.isDirect = !tool.isDirect;
+        server2.directCount += tool.isDirect ? 1 : -1;
+        server2.directTokens += tool.isDirect ? tool.estimatedTokens : -tool.estimatedTokens;
+      }
       handleDiscardInput(data) {
         if (matchesKey3(data, "ctrl+c")) {
           this.cleanup();
@@ -3536,6 +3792,13 @@ var init_mcp_panel = __esm({
           }
         }
         server2.tools = newTools;
+        server2.directCount = 0;
+        server2.directTokens = 0;
+        for (const tool of newTools) {
+          if (!tool.isDirect) continue;
+          server2.directCount++;
+          server2.directTokens += tool.estimatedTokens;
+        }
         this.rebuildVisibleItems();
         this.updateDirty();
       }
@@ -3625,12 +3888,13 @@ var init_mcp_panel = __esm({
           if (this.authOnly) {
             lines.push(row(fg2(t.description, "select a server to authenticate")));
           } else {
-            const directCount = this.servers.reduce((sum, s) => sum + s.tools.filter((t2) => t2.isDirect).length, 0);
-            const totalTokens = this.servers.reduce(
-              (sum, s) => sum + s.tools.filter((t2) => t2.isDirect).reduce((ts, t2) => ts + t2.estimatedTokens, 0),
-              0
-            );
-            const stats = directCount > 0 ? `${directCount} direct  ~${totalTokens.toLocaleString()} tokens` : "no direct tools";
+            let directCount = 0;
+            let directTokens = 0;
+            for (const server2 of this.servers) {
+              directCount += server2.directCount;
+              directTokens += server2.directTokens;
+            }
+            const stats = directCount > 0 ? `${directCount} direct  ~${directTokens.toLocaleString()} tokens` : "no direct tools";
             lines.push(row(fg2(t.description, stats + (this.dirty ? fg2(t.needsAuth, "  (unsaved)") : ""))));
           }
         }
@@ -3688,7 +3952,7 @@ var init_mcp_panel = __esm({
         if (!server2.hasCachedData && !this.authOnly) {
           return `${prefix}   ${nameStr}${importLabel}  ${fg2(t.description, "(not cached)")}${statusLabel}`;
         }
-        const directCount = server2.tools.filter((t2) => t2.isDirect).length;
+        const directCount = server2.directCount;
         const totalCount = server2.tools.length;
         let toggleIcon = fg2(t.description, "\u25CB");
         if (directCount === totalCount && totalCount > 0) {
@@ -3700,8 +3964,7 @@ var init_mcp_panel = __esm({
         if (totalCount > 0) {
           toolInfo = `${directCount}/${totalCount}`;
           if (directCount > 0) {
-            const tokens = server2.tools.filter((t2) => t2.isDirect).reduce((s, t2) => s + t2.estimatedTokens, 0);
-            toolInfo += `  ~${tokens.toLocaleString()}`;
+            toolInfo += `  ~${server2.directTokens.toLocaleString()}`;
           }
           toolInfo = fg2(t.description, toolInfo);
         }
@@ -3788,7 +4051,7 @@ init_config();
 // packages/coding-agent/src/humain/mcp-adapter/vendor/init.ts
 init_types();
 init_config();
-import { existsSync as existsSync6 } from "node:fs";
+import { existsSync as existsSync7 } from "node:fs";
 
 // packages/coding-agent/src/humain/mcp-adapter/vendor/errors.ts
 var McpUiError = class extends Error {
@@ -4053,6 +4316,7 @@ var ConsentManager = class {
 
 // packages/coding-agent/src/humain/mcp-adapter/vendor/lifecycle.ts
 init_types();
+import { SdkError, SdkErrorCode } from "@modelcontextprotocol/client";
 
 // packages/coding-agent/src/humain/mcp-adapter/vendor/mcp-auth-flow.ts
 import {
@@ -4074,8 +4338,8 @@ init_config();
 import { spawnSync as spawnSync2 } from "child_process";
 import { createHash } from "crypto";
 import { createRequire } from "module";
-import { readFileSync as readFileSync4, existsSync as existsSync3, rmSync } from "fs";
-import { dirname as dirname2, join as join4 } from "path";
+import { readFileSync as readFileSync5, existsSync as existsSync4, rmSync } from "fs";
+import { dirname as dirname2, join as join5 } from "path";
 import { fileURLToPath } from "url";
 var require2 = createRequire(import.meta.url);
 var AUTH_SECRET_SERVICE = "pi-mcp-adapter.oauth";
@@ -4230,7 +4494,7 @@ function loadKeyringNativeBindingFallback(keyringRequire, platform4, arch) {
   for (const target of targets) {
     try {
       const packageJsonPath = keyringRequire.resolve(`${target.packageName}/package.json`);
-      return keyringRequire(join4(dirname2(packageJsonPath), target.bindingFile));
+      return keyringRequire(join5(dirname2(packageJsonPath), target.bindingFile));
     } catch (error) {
       lastError = error;
     }
@@ -4335,7 +4599,7 @@ function getServerDir(serverName, options) {
     throw new Error(`Invalid MCP server name: ${JSON.stringify(serverName)}`);
   }
   const storageKey = getAuthEntryAccount(serverName);
-  return join4(getAuthBaseDir(options), storageKey);
+  return join5(getAuthBaseDir(options), storageKey);
 }
 function getAuthEntryAccount(serverName) {
   if (typeof serverName !== "string") {
@@ -4344,7 +4608,7 @@ function getAuthEntryAccount(serverName) {
   return `sha256-${createHash("sha256").update(serverName, "utf8").digest("hex")}`;
 }
 function getAuthEntryFilePath(serverName, options) {
-  return join4(getServerDir(serverName, options), "tokens.json");
+  return join5(getServerDir(serverName, options), "tokens.json");
 }
 function parseJsonPayload(serverName, payload, source) {
   try {
@@ -4455,8 +4719,8 @@ function readExistingChunkManifest(store, serverName, account) {
   }
 }
 function removeChunkPayloads(store, account, manifest) {
-  for (const chunkAccount of getAuthEntryChunkAccounts(account, manifest)) {
-    store.remove(chunkAccount);
+  for (const chunkAccount2 of getAuthEntryChunkAccounts(account, manifest)) {
+    store.remove(chunkAccount2);
   }
 }
 function tryRemoveChunkPayloads(store, account, manifest) {
@@ -4474,11 +4738,11 @@ function createChunkManifest(payload) {
   };
 }
 function readChunkedAuthEntry(store, serverName, account, manifest) {
-  const chunks = getAuthEntryChunkAccounts(account, manifest).map((chunkAccount) => {
+  const chunks = getAuthEntryChunkAccounts(account, manifest).map((chunkAccount2) => {
     try {
-      const chunk = store.read(chunkAccount);
+      const chunk = store.read(chunkAccount2);
       if (chunk === void 0) {
-        throw new Error(`Missing OAuth credential chunk ${chunkAccount} for ${serverName}`);
+        throw new Error(`Missing OAuth credential chunk ${chunkAccount2} for ${serverName}`);
       }
       return chunk;
     } catch (error) {
@@ -4493,13 +4757,13 @@ function readChunkedAuthEntry(store, serverName, account, manifest) {
 }
 function readLegacyAuthEntry(serverName, options) {
   const filePath = getAuthEntryFilePath(serverName, options);
-  if (!existsSync3(filePath)) return void 0;
-  const data = readFileSync4(filePath, "utf-8");
+  if (!existsSync4(filePath)) return void 0;
+  const data = readFileSync5(filePath, "utf-8");
   return parseAuthEntryPayload(serverName, data, filePath);
 }
 function removeLegacyAuthEntry(serverName, options) {
   const filePath = getAuthEntryFilePath(serverName, options);
-  if (!existsSync3(filePath)) return;
+  if (!existsSync4(filePath)) return;
   try {
     rmSync(filePath, { force: true });
   } catch (error) {
@@ -5260,6 +5524,7 @@ function htmlError(error) {
 var server;
 var bindingPromise;
 var stoppingPromise;
+var restartableStoppingPromise;
 var callbackGeneration = 0;
 var pendingAuths = /* @__PURE__ */ new Map();
 var reservedAuthStates = /* @__PURE__ */ new Set();
@@ -5327,10 +5592,16 @@ function handleRequest(req, res) {
   res.end(htmlSuccess());
 }
 async function ensureCallbackServer(options = {}) {
+  const generation = callbackGeneration;
   if (stoppingPromise) {
-    throw new Error("OAuth callback server stopped");
+    if (!restartableStoppingPromise) {
+      throw new Error("OAuth callback server stopped");
+    }
+    await restartableStoppingPromise;
+    if (generation !== callbackGeneration) {
+      throw new Error("OAuth callback server stopped");
+    }
   }
-  const generation = callbackGeneration;
   while (bindingPromise) {
     await bindingPromise;
     if (generation !== callbackGeneration) {
@@ -5389,12 +5660,12 @@ async function ensureCallbackServerLocked(options = {}) {
   const candidateServer = createServer(handleRequest);
   const listenPort = strictPort ? requiredPort : 0;
   try {
-    await new Promise((resolve6, reject) => {
+    await new Promise((resolve7, reject) => {
       candidateServer.once("error", (err) => {
         reject(err);
       });
       candidateServer.listen(listenPort, requestedHost, () => {
-        resolve6();
+        resolve7();
       });
     });
     if (strictPort) {
@@ -5407,8 +5678,8 @@ async function ensureCallbackServerLocked(options = {}) {
       setOAuthCallbackPort(address.port);
     }
     if (previousServer && (needsStrictRebind || needsHostSwitch)) {
-      await new Promise((resolve6) => {
-        previousServer.close(() => resolve6());
+      await new Promise((resolve7) => {
+        previousServer.close(() => resolve7());
       });
     }
     callbackServerHost = requestedHost;
@@ -5424,8 +5695,8 @@ async function ensureCallbackServerLocked(options = {}) {
       reservedAuthStates.delete(reservedState);
     }
     const nodeError = error;
-    await new Promise((resolve6) => {
-      candidateServer.close(() => resolve6());
+    await new Promise((resolve7) => {
+      candidateServer.close(() => resolve7());
     });
     if (strictPort && nodeError.code === "EADDRINUSE") {
       throw new Error(
@@ -5441,14 +5712,14 @@ function releaseCallbackServer(oauthState) {
 }
 function waitForCallback(oauthState) {
   reservedAuthStates.delete(oauthState);
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     const timeout = setTimeout(() => {
       if (pendingAuths.has(oauthState)) {
         pendingAuths.delete(oauthState);
         reject(new Error("OAuth callback timeout - authorization took too long"));
       }
     }, CALLBACK_TIMEOUT_MS);
-    pendingAuths.set(oauthState, { resolve: resolve6, reject, timeout });
+    pendingAuths.set(oauthState, { resolve: resolve7, reject, timeout });
   });
 }
 function cancelPendingCallback(oauthState) {
@@ -5461,7 +5732,11 @@ function cancelPendingCallback(oauthState) {
   }
 }
 function stopCallbackServer() {
-  if (stoppingPromise) return stoppingPromise;
+  if (stoppingPromise) {
+    restartableStoppingPromise = void 0;
+    callbackGeneration += 1;
+    return stoppingPromise;
+  }
   callbackGeneration += 1;
   const cleanup = (async () => {
     while (bindingPromise) {
@@ -5469,9 +5744,9 @@ function stopCallbackServer() {
       });
     }
     if (server) {
-      await new Promise((resolve6) => {
+      await new Promise((resolve7) => {
         server.close(() => {
-          resolve6();
+          resolve7();
         });
       });
       server = void 0;
@@ -5495,6 +5770,17 @@ function stopCallbackServer() {
   stoppingPromise = operation;
   return operation;
 }
+function stopCallbackServerIfIdle() {
+  if (stoppingPromise) return stoppingPromise;
+  if (bindingPromise || !server || pendingAuths.size > 0 || reservedAuthStates.size > 0) {
+    return Promise.resolve();
+  }
+  const operation = stopCallbackServer().finally(() => {
+    if (restartableStoppingPromise === operation) restartableStoppingPromise = void 0;
+  });
+  restartableStoppingPromise = operation;
+  return operation;
+}
 
 // packages/coding-agent/src/humain/mcp-adapter/vendor/mcp-auth-flow.ts
 init_types();
@@ -5508,7 +5794,7 @@ function throwIfAborted(signal) {
 async function abortable(promise, signal) {
   if (!signal) return promise;
   throwIfAborted(signal);
-  return await new Promise((resolve6, reject) => {
+  return await new Promise((resolve7, reject) => {
     let settled = false;
     const cleanup = () => signal.removeEventListener("abort", onAbort);
     const onAbort = () => {
@@ -5523,7 +5809,7 @@ async function abortable(promise, signal) {
         if (settled) return;
         settled = true;
         cleanup();
-        resolve6(value);
+        resolve7(value);
       },
       (error) => {
         if (settled) return;
@@ -5867,7 +6153,7 @@ async function startAuth(serverName, serverUrl, definition, options = {}) {
   } catch (error) {
     releaseCallbackServer(oauthState);
     try {
-      await clearOAuthState(serverName, authStorageOptions);
+      await cleanupAndReleaseCallbackServerIfIdle(() => clearOAuthState(serverName, authStorageOptions));
     } catch (cleanupError) {
       throw new AggregateError([error, cleanupError], "OAuth startup cleanup failed");
     }
@@ -5905,6 +6191,7 @@ async function startAuth(serverName, serverUrl, definition, options = {}) {
       authProvider.deactivate();
       releaseCallbackServer(oauthState);
       await clearOAuthState(serverName, authStorageOptions);
+      await stopCallbackServerIfIdle();
       return { authorizationUrl: "" };
     }
     if (!capturedUrl) {
@@ -5915,7 +6202,7 @@ async function startAuth(serverName, serverUrl, definition, options = {}) {
   } catch (error) {
     authProvider.deactivate();
     try {
-      await clearPendingAuth(runtime, serverName, oauthState, authStorageOptions);
+      await clearPendingAuthAndReleaseIfIdle(runtime, serverName, oauthState, authStorageOptions);
     } catch (cleanupError) {
       throw new AggregateError([error, cleanupError], "OAuth startup cleanup failed");
     }
@@ -5931,7 +6218,7 @@ async function setPendingAuth(runtime, serverName, pendingAuth, oauthState, sign
   state.pendingAuths.set(key, pendingAuth);
   state.pendingAuthStates.set(key, oauthState);
   const cleanupTimer = setTimeout(() => {
-    void clearPendingAuth(runtime, serverName, oauthState, pendingAuth.authStorageOptions).catch((error) => {
+    void clearPendingAuthAndReleaseIfIdle(runtime, serverName, oauthState, pendingAuth.authStorageOptions).catch((error) => {
       console.error(`MCP Auth: Timed-out flow cleanup failed: ${formatTerminalError(error)}`);
     });
   }, MANUAL_AUTH_TIMEOUT_MS);
@@ -5962,6 +6249,28 @@ async function clearPendingAuth(runtime, serverName, oauthState, fallbackStorage
     }
   }
 }
+async function clearPendingAuthAndReleaseIfIdle(runtime, serverName, oauthState, fallbackStorageOptions = {}) {
+  await cleanupAndReleaseCallbackServerIfIdle(
+    () => clearPendingAuth(runtime, serverName, oauthState, fallbackStorageOptions)
+  );
+}
+async function cleanupAndReleaseCallbackServerIfIdle(cleanup) {
+  let cleanupFailure;
+  try {
+    await cleanup();
+  } catch (error) {
+    cleanupFailure = { error };
+  }
+  try {
+    await stopCallbackServerIfIdle();
+  } catch (releaseError) {
+    if (cleanupFailure) {
+      throw new AggregateError([cleanupFailure.error, releaseError], "OAuth callback cleanup failed");
+    }
+    throw releaseError;
+  }
+  if (cleanupFailure) throw cleanupFailure.error;
+}
 function getSearchParamsFromInput(input) {
   try {
     const url = new URL(input);
@@ -6099,7 +6408,7 @@ async function completeAuth(serverName, authorizationCode, options = {}) {
   } finally {
     if (!keepPendingForRetry) {
       try {
-        await clearPendingAuth(runtime, serverName, oauthState, authStorageOptions);
+        await clearPendingAuthAndReleaseIfIdle(runtime, serverName, oauthState, authStorageOptions);
       } catch (cleanupError) {
         if (caughtError !== void 0) {
           throw new AggregateError([caughtError, cleanupError], "OAuth completion cleanup failed");
@@ -6171,7 +6480,7 @@ ${authorizationUrl}`);
     } catch (error) {
       if (oauthState) cancelPendingCallback(oauthState);
       try {
-        await clearPendingAuth(runtime, serverName, oauthState, authStorageOptions);
+        await clearPendingAuthAndReleaseIfIdle(runtime, serverName, oauthState, authStorageOptions);
       } catch (cleanupError) {
         throw new AggregateError([error, cleanupError], "OAuth cancellation cleanup failed");
       }
@@ -6197,7 +6506,7 @@ async function removeAuth(serverName, options = {}) {
   if (oauthState) {
     cancelPendingCallback(oauthState);
   }
-  await clearPendingAuth(runtime, serverName, oauthState, authStorageOptions);
+  await clearPendingAuthAndReleaseIfIdle(runtime, serverName, oauthState, authStorageOptions);
   throwIfAborted(signal);
   clearAllCredentials(serverName, authStorageOptions);
   await clearOAuthState(serverName, authStorageOptions);
@@ -6230,6 +6539,87 @@ async function shutdownOAuth(runtime = legacyRuntime) {
 
 // packages/coding-agent/src/humain/mcp-adapter/vendor/lifecycle.ts
 init_utils();
+
+// packages/coding-agent/src/humain/mcp-adapter/vendor/session-recovery.ts
+import { ProtocolError, SdkHttpError, UnauthorizedError as UnauthorizedError3 } from "@modelcontextprotocol/client";
+init_types();
+var CONNECTION_CLOSED_PROTOCOL_CODE = -32e3;
+var SERVER_NOT_INITIALIZED_MCP_MESSAGES = /* @__PURE__ */ new Set([
+  "Server not initialized",
+  "Bad Request: Server not initialized"
+]);
+function isTerminatedSession(err, hadSessionId) {
+  if (!hadSessionId) return false;
+  if (err instanceof SdkHttpError) {
+    return err.status === 404 || err.status === 400 && /"code"\s*:\s*-32000/.test(err.message) && /"message"\s*:\s*"Bad Request: Server not initialized"/.test(err.message);
+  }
+  return err instanceof ProtocolError && err.code === CONNECTION_CLOSED_PROTOCOL_CODE && SERVER_NOT_INITIALIZED_MCP_MESSAGES.has(err.message);
+}
+function hasSessionId(connection) {
+  const transport = connection.transport;
+  return transport?.sessionId != null;
+}
+var SessionRecoveryAuthRequiredError = class extends Error {
+  constructor(serverName, authMessage) {
+    super(authMessage ?? `MCP server "${serverName}" requires OAuth authentication after reconnect.`);
+    this.serverName = serverName;
+    this.authMessage = authMessage;
+    this.name = "SessionRecoveryAuthRequiredError";
+  }
+};
+async function withSessionRecovery(deps, serverName, fn) {
+  if (isServerDisabled(deps.config.mcpServers[serverName])) {
+    throw new Error(`MCP server "${serverName}" is disabled`);
+  }
+  const connection = deps.manager.getConnection(serverName);
+  if (!connection) {
+    throw new Error(`Server "${serverName}" is not connected`);
+  }
+  const hadSessionId = hasSessionId(connection);
+  try {
+    return await fn(connection);
+  } catch (err) {
+    const definition = deps.config.mcpServers[serverName];
+    if (definition && supportsOAuth(definition) && (err instanceof UnauthorizedError3 || err instanceof SdkHttpError && err.status === 401)) {
+      invalidateAuthEntryCache(serverName);
+    }
+    if (!isTerminatedSession(err, hadSessionId)) {
+      throw err;
+    }
+    if (!definition) {
+      throw err;
+    }
+    throwIfAborted(deps.signal);
+    logger.debug(`MCP session for "${serverName}" expired; reconnecting`, {
+      server: serverName
+    });
+    let freshConnection = deps.signal ? await deps.manager.reconnect(serverName, definition, connection, deps.signal) : await deps.manager.reconnect(serverName, definition, connection);
+    throwIfAborted(deps.signal);
+    if (freshConnection.status === "needs-auth") {
+      freshConnection = await deps.onNeedsAuth?.(serverName) ?? freshConnection;
+      throwIfAborted(deps.signal);
+    }
+    if (freshConnection.status === "needs-auth") {
+      throw new SessionRecoveryAuthRequiredError(serverName);
+    }
+    if (freshConnection.status !== "connected") {
+      throw err;
+    }
+    try {
+      deps.manager.publishMetadataChanged(serverName, freshConnection, "session-reconnect");
+    } catch (publicationError) {
+      const message = publicationError instanceof Error ? publicationError.message : String(publicationError);
+      logger.debug(`MCP metadata publication after reconnect failed for "${serverName}": ${message}`);
+    }
+    throwIfAborted(deps.signal);
+    return fn(freshConnection);
+  }
+}
+
+// packages/coding-agent/src/humain/mcp-adapter/vendor/lifecycle.ts
+var KEEP_ALIVE_RETRY_BASE_MS = 3e4;
+var KEEP_ALIVE_RETRY_MAX_MS = 5 * 6e4;
+var KEEP_ALIVE_CHECK_CONCURRENCY = 10;
 var McpLifecycleManager = class {
   constructor(manager, hasPendingAuthForServer = hasPendingAuth) {
     this.manager = manager;
@@ -6238,6 +6628,8 @@ var McpLifecycleManager = class {
     this.allServers = /* @__PURE__ */ new Map();
     this.serverSettings = /* @__PURE__ */ new Map();
     this.globalIdleTimeout = 10 * 60 * 1e3;
+    this.retryStates = /* @__PURE__ */ new Map();
+    this.pendingMetadataPublications = /* @__PURE__ */ new Set();
     this.stopped = false;
   }
   setReconnectCallback(callback) {
@@ -6246,6 +6638,12 @@ var McpLifecycleManager = class {
   setReconnectFailureCallback(callback) {
     this.onReconnectFailure = callback;
   }
+  setHealthRestoredCallback(callback) {
+    this.onHealthRestored = callback;
+  }
+  setAuthRequiredCallback(callback) {
+    this.onAuthRequired = callback;
+  }
   markKeepAlive(name, definition) {
     if (isServerDisabled(definition)) return;
     this.keepAliveServers.set(name, definition);
@@ -6255,6 +6653,13 @@ var McpLifecycleManager = class {
     this.allServers.set(name, definition);
     if (settings?.idleTimeout !== void 0) this.serverSettings.set(name, settings);
   }
+  unregisterServer(name) {
+    this.allServers.delete(name);
+    this.keepAliveServers.delete(name);
+    this.serverSettings.delete(name);
+    this.retryStates.delete(name);
+    this.pendingMetadataPublications.delete(name);
+  }
   setGlobalIdleTimeout(minutes) {
     this.globalIdleTimeout = minutes * 60 * 1e3;
   }
@@ -6287,29 +6692,21 @@ var McpLifecycleManager = class {
     }, intervalMs);
     this.healthCheckInterval.unref();
   }
-  async checkConnections(signal) {
+  async ensureConverged(signal) {
     if (this.stopped || signal?.aborted) return;
-    for (const [name, definition] of this.keepAliveServers) {
-      if (isServerDisabled(definition)) continue;
-      const connection = this.manager.getConnection(name);
-      if (!connection || connection.status !== "connected") {
-        if (this.hasPendingAuthForServer(name)) {
-          logger.debug(`Skipping reconnect for ${name} while OAuth authorization is pending`);
-          continue;
-        }
-        try {
-          await this.manager.connect(name, definition, signal);
-          if (this.stopped || signal?.aborted) return;
-          logger.debug(`Reconnected to ${name}`);
-          this.onReconnect?.(name);
-        } catch (error) {
-          if (this.stopped || signal?.aborted) return;
-          this.onReconnectFailure?.(name, error);
-          const message = error instanceof Error ? error.message : String(error);
-          console.error(`MCP: Failed to reconnect to ${name}: ${sanitizeTerminalText(message)}`);
-        }
-      }
+    if (this.activeConvergence) return this.activeConvergence;
+    const check = this.checkKeepAliveConnections(signal);
+    this.activeConvergence = check;
+    try {
+      await check;
+    } finally {
+      if (this.activeConvergence === check) this.activeConvergence = void 0;
     }
+  }
+  async checkConnections(signal) {
+    if (this.stopped || signal?.aborted) return;
+    await this.ensureConverged(signal);
+    if (this.stopped || signal?.aborted) return;
     for (const [name] of this.allServers) {
       if (this.keepAliveServers.has(name)) continue;
       const timeout = this.getIdleTimeout(name);
@@ -6320,6 +6717,202 @@ var McpLifecycleManager = class {
       }
     }
   }
+  async checkKeepAliveConnections(signal) {
+    if (this.stopped || signal?.aborted) return;
+    await parallelLimit(
+      [...this.keepAliveServers],
+      KEEP_ALIVE_CHECK_CONCURRENCY,
+      ([name, definition]) => this.checkKeepAliveConnection(name, definition, signal)
+    );
+  }
+  async checkKeepAliveConnection(name, definition, signal, retrySuperseded = true) {
+    if (isServerDisabled(definition) || this.stopped || signal?.aborted) return;
+    if (this.keepAliveServers.get(name) !== definition) return;
+    const connection = this.manager.getConnection(name);
+    if (connection?.status === "needs-auth") {
+      this.pendingMetadataPublications.delete(name);
+      return;
+    }
+    if (!this.shouldAttemptConnection(name, connection)) return;
+    if (!connection || connection.status !== "connected") {
+      if (this.hasPendingAuthForServer(name)) {
+        logger.debug(`Skipping reconnect for ${name} while OAuth authorization is pending`);
+        return;
+      }
+      let freshConnection;
+      try {
+        freshConnection = await this.manager.connect(name, definition, signal);
+      } catch (error) {
+        if (this.stopped || signal?.aborted) return;
+        this.reportConnectionFailure(name, definition, error, "reconnect", this.manager.getConnection(name));
+        return;
+      }
+      if (this.stopped || signal?.aborted) return;
+      if (freshConnection.status === "needs-auth") {
+        await this.notifyAuthRequired(name, definition, freshConnection);
+        return;
+      }
+      if (freshConnection.status !== "connected") {
+        this.reportConnectionFailure(
+          name,
+          definition,
+          new Error(`MCP server ${name} did not return a connected session`),
+          "reconnect",
+          freshConnection
+        );
+        return;
+      }
+      logger.debug(`Reconnected to ${name}`);
+      await this.publishConnectedMetadata(name, definition, freshConnection);
+      return;
+    }
+    if (this.pendingMetadataPublications.has(name)) {
+      await this.publishConnectedMetadata(name, definition, connection);
+      return;
+    }
+    if (!definition.url) return;
+    const hadSessionId = connection.transport?.sessionId != null;
+    let refreshResult;
+    try {
+      refreshResult = await this.manager.refreshTools(name, connection, signal);
+    } catch (error) {
+      if (this.stopped || signal?.aborted) return;
+      const current = this.manager.getConnection(name);
+      if (current !== connection || connection.status !== "connected") {
+        await this.handleSupersededConnection(name, definition, connection, signal, retrySuperseded);
+        return;
+      }
+      if (!shouldReconnectAfterRefresh(error, hadSessionId)) {
+        this.reportConnectionFailure(name, definition, error, "refresh", connection);
+        return;
+      }
+      if (this.hasPendingAuthForServer(name)) {
+        logger.debug(`Skipping reconnect for ${name} while OAuth authorization is pending`);
+        return;
+      }
+      let freshConnection;
+      try {
+        freshConnection = await this.manager.reconnect(name, definition, connection, signal);
+      } catch (reconnectError) {
+        if (this.stopped || signal?.aborted) return;
+        this.reportConnectionFailure(name, definition, reconnectError, "reconnect", this.manager.getConnection(name));
+        return;
+      }
+      if (this.stopped || signal?.aborted) return;
+      if (freshConnection.status === "needs-auth") {
+        await this.notifyAuthRequired(name, definition, freshConnection);
+        return;
+      }
+      if (freshConnection.status !== "connected") {
+        this.reportConnectionFailure(
+          name,
+          definition,
+          new Error(`MCP server ${name} did not return a connected session`),
+          "reconnect",
+          freshConnection
+        );
+        return;
+      }
+      logger.debug(`Reconnected stale MCP session for ${name}`);
+      await this.publishConnectedMetadata(name, definition, freshConnection);
+      return;
+    }
+    if (refreshResult === "superseded") {
+      await this.handleSupersededConnection(name, definition, connection, signal, retrySuperseded);
+      return;
+    }
+    if (refreshResult === "refresh-timeout") {
+      this.deferRefreshTimeout(name, definition, connection);
+      return;
+    }
+    if (this.keepAliveServers.get(name) !== definition) return;
+    if (this.retryStates.delete(name)) {
+      await this.onHealthRestored?.(name);
+    }
+  }
+  async handleSupersededConnection(name, definition, staleConnection, signal, retrySuperseded) {
+    const current = this.manager.getConnection(name);
+    if (this.keepAliveServers.get(name) !== definition) return;
+    if (current === staleConnection && current.status === "connected") {
+      if (this.retryStates.delete(name)) await this.onHealthRestored?.(name);
+      return;
+    }
+    if (current?.status === "connected") {
+      await this.publishConnectedMetadata(name, definition, current);
+      return;
+    }
+    if (current?.status === "needs-auth") {
+      await this.notifyAuthRequired(name, definition, current);
+      return;
+    }
+    if (retrySuperseded) {
+      await this.checkKeepAliveConnection(name, definition, signal, false);
+    }
+  }
+  async publishConnectedMetadata(name, definition, connection) {
+    if (this.keepAliveServers.get(name) !== definition) {
+      if (this.manager.getConnection(name) === connection) await this.manager.close(name);
+      return;
+    }
+    this.pendingMetadataPublications.add(name);
+    try {
+      await this.onReconnect?.(name);
+      this.pendingMetadataPublications.delete(name);
+      this.retryStates.delete(name);
+    } catch (error) {
+      if (this.stopped) return;
+      this.reportConnectionFailure(name, definition, error, "publish", connection);
+    }
+  }
+  async notifyAuthRequired(name, definition, connection) {
+    if (this.keepAliveServers.get(name) !== definition) {
+      if (this.manager.getConnection(name) === connection) await this.manager.close(name);
+      return;
+    }
+    this.pendingMetadataPublications.delete(name);
+    this.retryStates.delete(name);
+    try {
+      await this.onAuthRequired?.(name);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      logger.debug(`MCP: auth-required callback failed for ${name}: ${sanitizeTerminalText(message)}`);
+    }
+  }
+  shouldAttemptConnection(name, connection) {
+    const retry = this.retryStates.get(name);
+    if (!retry) return true;
+    if (retry.connection !== connection || retry.status !== connection?.status) {
+      this.retryStates.delete(name);
+      return true;
+    }
+    return Date.now() >= retry.nextAttemptAt;
+  }
+  reportConnectionFailure(name, definition, error, action, connection) {
+    if (!this.recordRetry(name, definition, connection)) return;
+    this.onReconnectFailure?.(name, error);
+    const message = error instanceof Error ? error.message : String(error);
+    const target = action === "reconnect" ? `reconnect to ${name}` : action === "publish" ? `publish metadata for ${name}` : `refresh ${name}`;
+    console.error(`MCP: Failed to ${target}: ${sanitizeTerminalText(message)}`);
+  }
+  deferRefreshTimeout(name, definition, connection) {
+    if (!this.recordRetry(name, definition, connection)) return;
+    logger.debug(`MCP: keep-alive tools/list refresh timed out for ${name}; retrying after backoff`);
+  }
+  recordRetry(name, definition, connection) {
+    if (this.keepAliveServers.get(name) !== definition) return false;
+    const attempts = (this.retryStates.get(name)?.attempts ?? 0) + 1;
+    const delay = Math.min(
+      KEEP_ALIVE_RETRY_BASE_MS * 2 ** Math.min(attempts - 1, 10),
+      KEEP_ALIVE_RETRY_MAX_MS
+    );
+    this.retryStates.set(name, {
+      attempts,
+      nextAttemptAt: Date.now() + delay,
+      connection,
+      status: connection?.status
+    });
+    return true;
+  }
   getIdleTimeout(name) {
     const perServer = this.serverSettings.get(name)?.idleTimeout;
     if (perServer !== void 0) return perServer * 60 * 1e3;
@@ -6338,26 +6931,39 @@ var McpLifecycleManager = class {
     this.removeHealthAbortListener = void 0;
     await this.activeHealthCheck;
     this.activeHealthCheck = void 0;
+    await this.activeConvergence;
+    this.activeConvergence = void 0;
     this.onReconnect = void 0;
     this.onReconnectFailure = void 0;
+    this.onHealthRestored = void 0;
+    this.onAuthRequired = void 0;
     this.onIdleShutdown = void 0;
+    this.retryStates.clear();
+    this.pendingMetadataPublications.clear();
     if (typeof this.manager.closeAll === "function") {
       await this.manager.closeAll();
     }
   }
 };
+function shouldReconnectAfterRefresh(error, hadSessionId) {
+  if (isTerminatedSession(error, hadSessionId)) return true;
+  return error instanceof SdkError && (error.code === SdkErrorCode.NotConnected || error.code === SdkErrorCode.ConnectionClosed);
+}
 
 // packages/coding-agent/src/humain/mcp-adapter/vendor/init.ts
 init_metadata_cache();
 
 // packages/coding-agent/src/humain/mcp-adapter/vendor/server-manager.ts
 import { mkdirSync as mkdirSync4 } from "node:fs";
+import { isDeepStrictEqual } from "node:util";
 import {
   Client,
-  SdkHttpError,
+  SdkError as SdkError2,
+  SdkErrorCode as SdkErrorCode2,
+  SdkHttpError as SdkHttpError2,
   SSEClientTransport,
   StreamableHTTPClientTransport,
-  UnauthorizedError as UnauthorizedError3
+  UnauthorizedError as UnauthorizedError4
 } from "@modelcontextprotocol/client";
 import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
 
@@ -6373,13 +6979,13 @@ var UnixSocketClientTransport = class {
     if (this.socket) {
       throw new Error("UnixSocketClientTransport already started");
     }
-    await new Promise((resolve6, reject) => {
+    await new Promise((resolve7, reject) => {
       const socket = createConnection(this.socketPath);
       this.socket = socket;
       let connected = false;
       socket.once("connect", () => {
         connected = true;
-        resolve6();
+        resolve7();
       });
       socket.on("data", (chunk) => {
         try {
@@ -6411,12 +7017,12 @@ var UnixSocketClientTransport = class {
     this.socket = void 0;
     this.readBuffer.clear();
     if (!socket || socket.destroyed) return;
-    await new Promise((resolve6) => {
+    await new Promise((resolve7) => {
       const timeout = setTimeout(() => socket.destroy(), 2e3);
       timeout.unref();
       socket.once("close", () => {
         clearTimeout(timeout);
-        resolve6();
+        resolve7();
       });
       socket.end();
     });
@@ -6424,10 +7030,10 @@ var UnixSocketClientTransport = class {
   async send(message) {
     const socket = this.socket;
     if (!socket || socket.destroyed) throw new Error("Unix socket is not connected");
-    await new Promise((resolve6, reject) => {
+    await new Promise((resolve7, reject) => {
       socket.write(serializeMessage(message), (error) => {
         if (error) reject(error);
-        else resolve6();
+        else resolve7();
       });
     });
   }
@@ -6578,8 +7184,8 @@ init_types();
 
 // packages/coding-agent/src/humain/mcp-adapter/vendor/npx-resolver.ts
 init_agent_dir();
-import { existsSync as existsSync5, readFileSync as readFileSync6, realpathSync, readdirSync, statSync as statSync2, writeFileSync as writeFileSync3, renameSync as renameSync3, mkdirSync as mkdirSync3, openSync, readSync, closeSync, unlinkSync } from "node:fs";
-import { join as join5, dirname as dirname4, extname as extname2, resolve as resolve4, sep as sep2 } from "node:path";
+import { existsSync as existsSync6, readFileSync as readFileSync7, realpathSync as realpathSync2, readdirSync, statSync as statSync3, writeFileSync as writeFileSync3, renameSync as renameSync3, mkdirSync as mkdirSync3, openSync, readSync, closeSync, unlinkSync } from "node:fs";
+import { join as join6, dirname as dirname4, extname as extname2, resolve as resolve5, sep as sep3 } from "node:path";
 import crossSpawn from "cross-spawn";
 var CACHE_VERSION2 = 2;
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
@@ -6592,7 +7198,7 @@ async function resolveNpxBinary(command, args, signal) {
   const cacheKey = JSON.stringify([command, parsed.packageSpec, parsed.binName ?? ""]);
   const cache = loadCache();
   const cached = cache?.entries?.[cacheKey];
-  if (cached && Date.now() - cached.resolvedAt < CACHE_TTL_MS && existsSync5(cached.resolvedBin) && (!packageSpec?.exactVersion || cached.packageVersion === packageSpec.exactVersion)) {
+  if (cached && Date.now() - cached.resolvedAt < CACHE_TTL_MS && existsSync6(cached.resolvedBin) && (!packageSpec?.exactVersion || cached.packageVersion === packageSpec.exactVersion)) {
     return { binPath: cached.resolvedBin, extraArgs: parsed.extraArgs, isJs: cached.isJs };
   }
   const resolved = resolveFromNpmCache(parsed.packageSpec, parsed.binName);
@@ -6699,11 +7305,11 @@ function resolveFromNpmCache(packageSpec, binName) {
   const { packageName, exactVersion } = parsedSpec;
   const packageDir = findCachedPackageDir(cacheDir, packageName, exactVersion);
   if (!packageDir) return null;
-  const packageJsonPath = join5(packageDir, "package.json");
-  if (!existsSync5(packageJsonPath)) return null;
+  const packageJsonPath = join6(packageDir, "package.json");
+  if (!existsSync6(packageJsonPath)) return null;
   let pkg = null;
   try {
-    pkg = JSON.parse(readFileSync6(packageJsonPath, "utf-8"));
+    pkg = JSON.parse(readFileSync7(packageJsonPath, "utf-8"));
   } catch {
     return null;
   }
@@ -6733,11 +7339,11 @@ function resolveFromNpmCache(packageSpec, binName) {
   }
   if (!binRel) return null;
   const nodeModulesDir = findNodeModulesDir(packageDir);
-  const binLink = chosenBinName ? join5(nodeModulesDir, ".bin", chosenBinName) : null;
-  let resolvedBin = binLink && existsSync5(binLink) ? safeRealpath(binLink) : "";
+  const binLink = chosenBinName ? join6(nodeModulesDir, ".bin", chosenBinName) : null;
+  let resolvedBin = binLink && existsSync6(binLink) ? safeRealpath(binLink) : "";
   if (!resolvedBin) {
-    resolvedBin = resolve4(packageDir, binRel);
-    if (!existsSync5(resolvedBin)) return null;
+    resolvedBin = resolve5(packageDir, binRel);
+    if (!existsSync6(resolvedBin)) return null;
   }
   const isJs = detectJsBinary(resolvedBin);
   return {
@@ -6751,7 +7357,7 @@ var FORCE_CACHE_TIMEOUT_MS = 3e4;
 async function forceNpxCache(packageSpec, signal) {
   throwIfAborted(signal);
   try {
-    await new Promise((resolve6, reject) => {
+    await new Promise((resolve7, reject) => {
       const proc = crossSpawn(
         "npm",
         ["exec", "--yes", "--package", packageSpec, "--", "node", "-e", "1"],
@@ -6770,7 +7376,7 @@ async function forceNpxCache(packageSpec, signal) {
       proc.on("close", () => {
         clearTimeout(timer);
         signal?.removeEventListener("abort", abort);
-        resolve6();
+        resolve7();
       });
       proc.on("error", (err) => {
         clearTimeout(timer);
@@ -6835,21 +7441,21 @@ function defaultBinName(packageName) {
   return packageName;
 }
 function findCachedPackageDir(cacheDir, packageName, exactVersion) {
-  const npxDir = join5(cacheDir, "_npx");
-  if (!existsSync5(npxDir)) return null;
+  const npxDir = join6(cacheDir, "_npx");
+  if (!existsSync6(npxDir)) return null;
   const packagePathParts = packageName.startsWith("@") ? packageName.split("/") : [packageName];
   const candidates = readdirSync(npxDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => {
-    const full = join5(npxDir, entry.name);
+    const full = join6(npxDir, entry.name);
     const mtime = safeStatMtime(full);
     return { name: entry.name, mtime };
   }).sort((a, b) => b.mtime - a.mtime);
   for (const entry of candidates) {
-    const pkgDir = join5(npxDir, entry.name, "node_modules", ...packagePathParts);
-    const packageJsonPath = join5(pkgDir, "package.json");
-    if (!existsSync5(packageJsonPath)) continue;
+    const pkgDir = join6(npxDir, entry.name, "node_modules", ...packagePathParts);
+    const packageJsonPath = join6(pkgDir, "package.json");
+    if (!existsSync6(packageJsonPath)) continue;
     if (exactVersion) {
       try {
-        const pkg = JSON.parse(readFileSync6(packageJsonPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync7(packageJsonPath, "utf-8"));
         if (pkg.version !== exactVersion) continue;
       } catch {
         continue;
@@ -6860,12 +7466,12 @@ function findCachedPackageDir(cacheDir, packageName, exactVersion) {
   return null;
 }
 function findNodeModulesDir(packageDir) {
-  const parts = packageDir.split(sep2);
+  const parts = packageDir.split(sep3);
   const idx = parts.lastIndexOf("node_modules");
   if (idx >= 0) {
-    return parts.slice(0, idx + 1).join(sep2);
+    return parts.slice(0, idx + 1).join(sep3);
   }
-  return join5(packageDir, "..");
+  return join6(packageDir, "..");
 }
 function detectJsBinary(binPath) {
   const ext = extname2(binPath).toLowerCase();
@@ -6909,9 +7515,9 @@ function getNpxCachePath() {
   return getAgentPath("mcp-npx-cache.json");
 }
 function readNpxCachePayload(cachePath) {
-  if (!existsSync5(cachePath)) return null;
+  if (!existsSync6(cachePath)) return null;
   try {
-    return JSON.parse(readFileSync6(cachePath, "utf-8"));
+    return JSON.parse(readFileSync7(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -6985,14 +7591,14 @@ function saveCacheEntry(key, entry) {
 }
 function safeRealpath(path2) {
   try {
-    return realpathSync(path2);
+    return realpathSync2(path2);
   } catch {
     return "";
   }
 }
 function safeStatMtime(path2) {
   try {
-    return statSync2(path2).mtimeMs;
+    return statSync3(path2).mtimeMs;
   } catch {
     return 0;
   }
@@ -7053,6 +7659,245 @@ function createJsonSchemaValidator() {
   };
 }
 
+// packages/coding-agent/src/humain/mcp-adapter/vendor/mcp-bearer-store.ts
+import { createHash as createHash3 } from "node:crypto";
+import { createRequire as createRequire2 } from "node:module";
+import { dirname as dirname5, join as join7 } from "node:path";
+var require3 = createRequire2(import.meta.url);
+var BEARER_SECRET_SERVICE = "pi-mcp-adapter.bearer";
+var TEST_AUTH_STORE_ENV2 = "PI_MCP_ADAPTER_TEST_AUTH_STORE";
+var BEARER_SECRET_VALUE_LIMIT = 1280;
+var KeyringEntryClass2;
+var memoryBearerEntries = /* @__PURE__ */ new Map();
+var testBearerSecretStoreReadCount = 0;
+var BearerCredentialStoreError = class extends Error {
+  // No parameter properties: cli.js loads this module under plain Node
+  // type stripping, which rejects non-erasable TypeScript syntax.
+  constructor(message, operation, cause) {
+    super(message, { cause });
+    this.code = "BEARER_CREDENTIAL_STORE_UNAVAILABLE";
+    this.name = "BearerCredentialStoreError";
+    this.operation = operation;
+  }
+};
+var memoryBearerSecretStore = {
+  read(account) {
+    testBearerSecretStoreReadCount++;
+    return memoryBearerEntries.get(account);
+  },
+  write(account, payload) {
+    memoryBearerEntries.set(account, payload);
+  },
+  remove(account) {
+    memoryBearerEntries.delete(account);
+  }
+};
+var sizeLimitedBearerSecretStore = {
+  read(account) {
+    testBearerSecretStoreReadCount++;
+    return memoryBearerEntries.get(account);
+  },
+  write(account, payload) {
+    if (payload.length > BEARER_SECRET_VALUE_LIMIT) {
+      throw new Error(`Value of 'password encoded as UTF-16' is longer than the platform limit of ${BEARER_SECRET_VALUE_LIMIT * 2} chars`);
+    }
+    memoryBearerEntries.set(account, payload);
+  },
+  remove(account) {
+    memoryBearerEntries.delete(account);
+  }
+};
+var unavailableBearerSecretStore = {
+  read() {
+    testBearerSecretStoreReadCount++;
+    throw new Error("simulated secure credential store unavailable");
+  },
+  write() {
+    throw new Error("simulated secure credential store unavailable");
+  },
+  remove() {
+    throw new Error("simulated secure credential store unavailable");
+  }
+};
+var keyringBearerSecretStore = {
+  read(account) {
+    return getKeyringEntry2(account).getPassword() ?? void 0;
+  },
+  write(account, payload) {
+    getKeyringEntry2(account).setPassword(payload);
+  },
+  remove(account) {
+    getKeyringEntry2(account).deleteCredential();
+  }
+};
+function getBearerSecretStore() {
+  if (process.env[TEST_AUTH_STORE_ENV2] === "memory") return memoryBearerSecretStore;
+  if (process.env[TEST_AUTH_STORE_ENV2] === "sizelimited") return sizeLimitedBearerSecretStore;
+  if (process.env[TEST_AUTH_STORE_ENV2] === "unavailable") return unavailableBearerSecretStore;
+  return keyringBearerSecretStore;
+}
+function getKeyringEntry2(account) {
+  try {
+    KeyringEntryClass2 ??= loadKeyringEntryClass2();
+    return new KeyringEntryClass2(BEARER_SECRET_SERVICE, account);
+  } catch (error) {
+    throw new Error("Bearer token secure credential storage is unavailable. Configure the OS credential store and retry.", { cause: error });
+  }
+}
+function loadKeyringEntryClass2(keyringRequire = require3, platform4 = process.platform, arch = process.arch) {
+  try {
+    return keyringRequire("@napi-rs/keyring").Entry;
+  } catch (loaderError) {
+    try {
+      return loadKeyringNativeBindingFallback2(keyringRequire, platform4, arch).Entry;
+    } catch (fallbackError) {
+      const message = fallbackError instanceof Error ? fallbackError.message : String(fallbackError);
+      throw new Error(`Failed to load @napi-rs/keyring; absolute-path native binding fallback also failed: ${message}`, { cause: loaderError });
+    }
+  }
+}
+function loadKeyringNativeBindingFallback2(keyringRequire, platform4, arch) {
+  const targets = getKeyringNativeBindingSuffixes2(platform4, arch).map((suffix) => ({
+    packageName: `@napi-rs/keyring-${suffix}`,
+    bindingFile: `keyring.${suffix}.node`
+  }));
+  let lastError;
+  for (const target of targets) {
+    try {
+      const packageJsonPath = keyringRequire.resolve(`${target.packageName}/package.json`);
+      return keyringRequire(join7(dirname5(packageJsonPath), target.bindingFile));
+    } catch (error) {
+      lastError = error;
+    }
+  }
+  throw lastError instanceof Error ? lastError : new Error(String(lastError));
+}
+function getKeyringNativeBindingSuffixes2(platform4, arch) {
+  if (platform4 === "darwin") {
+    if (arch === "arm64") return ["darwin-arm64"];
+    if (arch === "x64") return ["darwin-x64"];
+  }
+  if (platform4 === "win32") {
+    if (arch === "arm64") return ["win32-arm64-msvc"];
+    if (arch === "x64") return ["win32-x64-msvc"];
+    if (arch === "ia32") return ["win32-ia32-msvc"];
+  }
+  if (platform4 === "linux") {
+    if (arch === "arm64") return ["linux-arm64-gnu", "linux-arm64-musl"];
+    if (arch === "arm") return ["linux-arm-gnueabihf"];
+    if (arch === "riscv64") return ["linux-riscv64-gnu"];
+    if (arch === "x64") return ["linux-x64-gnu", "linux-x64-musl"];
+  }
+  if (platform4 === "freebsd" && arch === "x64") return ["freebsd-x64"];
+  return [];
+}
+function getBearerAccount(serverName) {
+  if (typeof serverName !== "string") {
+    throw new Error(`Invalid MCP server name: ${JSON.stringify(serverName)}`);
+  }
+  return `sha256-${createHash3("sha256").update(serverName, "utf8").digest("hex")}`;
+}
+function parseBearerPayload(serverName, payload) {
+  const parsed = parseStoredBearerJson(serverName, payload);
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`Stored bearer token record for ${serverName} has invalid shape`);
+  }
+  const record = parsed;
+  if (typeof record.token !== "string" || typeof record.serverUrl !== "string") {
+    throw new Error(`Stored bearer token record for ${serverName} has invalid shape`);
+  }
+  return { token: record.token, serverUrl: record.serverUrl };
+}
+function parseStoredBearerJson(serverName, payload) {
+  try {
+    return JSON.parse(payload);
+  } catch {
+    throw new Error(`Failed to parse stored bearer token record for ${serverName}`);
+  }
+}
+function isBearerChunkManifest(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const manifest = value;
+  return manifest.__piMcpAdapterBearerChunked === 1 && typeof manifest.chunkCount === "number" && Number.isInteger(manifest.chunkCount) && manifest.chunkCount > 0 && typeof manifest.chunkDigest === "string" && /^[a-f0-9]{16}$/.test(manifest.chunkDigest);
+}
+function readManifest(serverName, payload) {
+  const parsed = parseStoredBearerJson(serverName, payload);
+  return isBearerChunkManifest(parsed) ? parsed : void 0;
+}
+function chunkAccount(account, manifest, index) {
+  return `${account}.chunk.${manifest.chunkDigest}.${index}`;
+}
+function chunkAccounts(account, manifest) {
+  return Array.from({ length: manifest.chunkCount }, (_, index) => chunkAccount(account, manifest, index));
+}
+function removeChunks(store, account, manifest) {
+  if (!manifest) return;
+  for (const accountName of chunkAccounts(account, manifest)) store.remove(accountName);
+}
+function readBearerRecordFromStore(store, serverName) {
+  const account = getBearerAccount(serverName);
+  let payload;
+  try {
+    payload = store.read(account);
+  } catch (error) {
+    throw new BearerCredentialStoreError(
+      `Failed to read bearer token for ${serverName} from the OS secure credential store`,
+      "read",
+      error
+    );
+  }
+  if (payload === void 0) return void 0;
+  try {
+    const manifest = readManifest(serverName, payload);
+    const recordPayload = manifest ? chunkAccounts(account, manifest).map((chunkName) => {
+      const chunk = store.read(chunkName);
+      if (chunk === void 0) throw new Error(`Missing bearer token chunk for ${serverName}`);
+      return chunk;
+    }).join("") : payload;
+    return parseBearerPayload(serverName, recordPayload);
+  } catch (error) {
+    throw new BearerCredentialStoreError(
+      `Failed to read bearer token for ${serverName} from the OS secure credential store`,
+      "read",
+      error
+    );
+  }
+}
+function removeBearerRecordFromStore(store, serverName) {
+  const account = getBearerAccount(serverName);
+  try {
+    const payload = store.read(account);
+    const manifest = payload === void 0 ? void 0 : readManifest(serverName, payload);
+    removeChunks(store, account, manifest);
+    store.remove(account);
+  } catch (error) {
+    throw new BearerCredentialStoreError(
+      `Failed to remove bearer token for ${serverName} from the OS secure credential store`,
+      "remove",
+      error
+    );
+  }
+}
+function getBearerTokenForUrl(serverName, serverUrl) {
+  const record = readBearerRecordFromStore(getBearerSecretStore(), serverName);
+  if (!record) return void 0;
+  return record.serverUrl === serverUrl ? record.token : void 0;
+}
+function removeBearerToken(serverName) {
+  removeBearerRecordFromStore(getBearerSecretStore(), serverName);
+}
+function inspectBearerTokenForUrl(serverName, serverUrl) {
+  try {
+    const record = readBearerRecordFromStore(getBearerSecretStore(), serverName);
+    if (!record) return { status: "missing" };
+    if (record.serverUrl !== serverUrl) return { status: "url-mismatch" };
+    return { status: "present" };
+  } catch (error) {
+    if (!(error instanceof BearerCredentialStoreError)) throw error;
+    return { status: "unavailable", message: "Bearer token secure credential store unavailable. Configure or unlock the OS credential store and retry." };
+  }
+}
+
 // packages/coding-agent/src/humain/mcp-adapter/vendor/sampling-handler.ts
 init_utils();
 import { complete } from "@earendil-works/pi-ai/compat";
@@ -7272,7 +8117,7 @@ function zeroUsage() {
 
 // packages/coding-agent/src/humain/mcp-adapter/vendor/elicitation-handler.ts
 import {
-  ProtocolError,
+  ProtocolError as ProtocolError2,
   ProtocolErrorCode
 } from "@modelcontextprotocol/client";
 import { AjvJsonSchemaValidator as AjvJsonSchemaValidator2 } from "@modelcontextprotocol/client/validators/ajv";
@@ -7501,15 +8346,15 @@ function formatReview(serverName, properties, content) {
   return [`Review input for ${serverName}`, "", ...rows].join("\n");
 }
 async function handleUrlElicitation(options, params) {
-  if (!options.allowUrl) throw new ProtocolError(ProtocolErrorCode.InvalidParams, "URL elicitation is not supported");
+  if (!options.allowUrl) throw new ProtocolError2(ProtocolErrorCode.InvalidParams, "URL elicitation is not supported");
   let parsed;
   try {
     parsed = new URL(params.url);
   } catch {
-    throw new ProtocolError(ProtocolErrorCode.InvalidParams, "URL elicitation supplied an invalid URL");
+    throw new ProtocolError2(ProtocolErrorCode.InvalidParams, "URL elicitation supplied an invalid URL");
   }
   if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new ProtocolError(ProtocolErrorCode.InvalidParams, "URL elicitation only supports HTTP and HTTPS URLs");
+    throw new ProtocolError2(ProtocolErrorCode.InvalidParams, "URL elicitation only supports HTTP and HTTPS URLs");
   }
   const decision = await options.ui.select([
     "MCP Browser Request",
@@ -7544,7 +8389,7 @@ init_utils();
 // packages/coding-agent/src/humain/mcp-adapter/vendor/mcp-trace.ts
 import { appendFile, mkdir, writeFile } from "node:fs/promises";
 import { Buffer as Buffer2 } from "node:buffer";
-import { dirname as dirname5, isAbsolute as isAbsolute3, resolve as resolve5 } from "node:path";
+import { dirname as dirname6, isAbsolute as isAbsolute4, resolve as resolve6 } from "node:path";
 var MCP_TRACE_SCHEMA_VERSION = 1;
 var DEFAULT_MCP_TRACE_MAX_BYTES = 256 * 1024;
 var DEFAULT_MCP_TRACE_MAX_EVENTS = 1e4;
@@ -7622,7 +8467,7 @@ var McpTraceWriter = class {
       await mkdir(path2, { recursive: true });
       return void 0;
     });
-    this.fileReady = this.makeDirectory(dirname5(this.options.filePath), { recursive: true }).then(() => this.resetFile(this.options.filePath, "", { encoding: "utf8" })).catch(() => {
+    this.fileReady = this.makeDirectory(dirname6(this.options.filePath), { recursive: true }).then(() => this.resetFile(this.options.filePath, "", { encoding: "utf8" })).catch(() => {
       this.initializationFailed = true;
       this.disabled = true;
     });
@@ -7669,7 +8514,7 @@ var McpTraceWriter = class {
 function createMcpTraceWriter(sessionCwd, settings = {}, randomSuffix = Math.random().toString(36).slice(2, 10)) {
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const configuredPath = settings.file;
-  const filePath = configuredPath ? isAbsolute3(configuredPath) ? configuredPath : resolve5(sessionCwd ?? process.cwd(), configuredPath) : resolve5(sessionCwd ?? process.cwd(), ".pi", "mcp-traces", `mcp-${timestamp}-${randomSuffix}.jsonl`);
+  const filePath = configuredPath ? isAbsolute4(configuredPath) ? configuredPath : resolve6(sessionCwd ?? process.cwd(), configuredPath) : resolve6(sessionCwd ?? process.cwd(), ".pi", "mcp-traces", `mcp-${timestamp}-${randomSuffix}.jsonl`);
   return new McpTraceWriter({
     filePath,
     ...settings.maxBytes !== void 0 ? { maxBytes: settings.maxBytes } : {},
@@ -7745,56 +8590,50 @@ var DEFAULT_TIMEOUT_MS = 1e4;
 var MAX_OUTPUT_BYTES = 64 * 1024;
 var USE_PROCESS_GROUP = process.platform !== "win32";
 var CLEANUP_TOKEN_ENV = "PI_MCP_REQUEST_HEADERS_CLEANUP_TOKEN";
+var PS_MAX_BUFFER_BYTES = 8 * 1024 * 1024;
 function isNoSuchProcessError(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "ESRCH";
 }
 function runPosixPs(args) {
-  if (process.env.PI_MCP_ADAPTER_TEST_FAIL_PS === "1") return { status: 1, stdout: "" };
-  return spawnSync3("ps", args, { encoding: "utf8" });
+  if (process.env.PI_MCP_ADAPTER_TEST_FAIL_PS === "1") return { status: 1, signal: null, stdout: "" };
+  const result = spawnSync3("ps", args, { encoding: "utf8", maxBuffer: PS_MAX_BUFFER_BYTES });
+  return { status: result.status, signal: result.signal, stdout: result.stdout };
+}
+function psFailureReason(result) {
+  return result.status === null ? `ps was killed by signal ${result.signal ?? "unknown"}` : `ps exited with code ${result.status}`;
 }
-function collectPosixDescendantPids(rootPid) {
-  const result = runPosixPs(["-axo", "pid=,ppid="]);
+function collectPosixProcessPids(rootPid, cleanupToken) {
+  const result = runPosixPs(["axeww", "-o", "pid=,ppid=,command="]);
   if (result.status !== 0) {
-    throw new Error(`HTTP request headers command cleanup failed: ps exited with code ${result.status ?? "unknown"}`);
+    throw new Error(`HTTP request headers command cleanup failed: ${psFailureReason(result)}`);
   }
   const childrenByParent = /* @__PURE__ */ new Map();
+  const processPids = /* @__PURE__ */ new Set();
+  const needle = cleanupToken ? `${CLEANUP_TOKEN_ENV}=${cleanupToken}` : void 0;
   for (const line of result.stdout.split("\n")) {
-    const [pidText, ppidText] = line.trim().split(/\s+/, 2);
-    const pid = Number(pidText);
-    const ppid = Number(ppidText);
+    const match = /^\s*(\d+)\s+(\d+)(?:\s+(.*))?$/.exec(line);
+    if (!match) continue;
+    const pid = Number(match[1]);
+    const ppid = Number(match[2]);
     if (!Number.isInteger(pid) || !Number.isInteger(ppid)) continue;
     const children = childrenByParent.get(ppid);
     if (children) children.push(pid);
     else childrenByParent.set(ppid, [pid]);
+    if (needle && pid !== process.pid && match[3]?.includes(needle)) processPids.add(pid);
   }
-  const descendants = [];
   const stack = [...childrenByParent.get(rootPid) ?? []];
   while (stack.length > 0) {
     const pid = stack.pop();
-    descendants.push(pid);
+    processPids.add(pid);
     stack.push(...childrenByParent.get(pid) ?? []);
   }
-  return descendants;
+  return [...processPids];
 }
-function collectPosixCleanupTokenPids(cleanupToken) {
-  const result = runPosixPs(["axeww", "-o", "pid=,command="]);
+function assertPosixProcessDiscoveryAvailable() {
+  const result = runPosixPs(["axeww", "-o", "pid=,ppid=,command="]);
   if (result.status !== 0) {
-    throw new Error(`HTTP request headers command cleanup failed: ps exited with code ${result.status ?? "unknown"}`);
-  }
-  const needle = `${CLEANUP_TOKEN_ENV}=${cleanupToken}`;
-  const pids = [];
-  for (const line of result.stdout.split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed.includes(needle)) continue;
-    const [pidText] = trimmed.split(/\s+/, 1);
-    const pid = Number(pidText);
-    if (Number.isInteger(pid) && pid !== process.pid) pids.push(pid);
+    throw new Error(`HTTP request headers command cleanup failed: ${psFailureReason(result)}`);
   }
-  return pids;
-}
-function assertPosixProcessDiscoveryAvailable() {
-  collectPosixDescendantPids(process.pid);
-  collectPosixCleanupTokenPids(`${process.pid}-preflight`);
 }
 function isTaskkillNoSuchProcess(result) {
   return `${result.stdout ?? ""}
@@ -7834,10 +8673,7 @@ function killRequestHeadersCommand(child, trackedPosixDescendantPids = /* @__PUR
       }
       let stablePasses = 0;
       for (let pass = 0; pass < 16; pass++) {
-        const candidates = [
-          ...collectPosixDescendantPids(child.pid),
-          ...cleanupToken ? collectPosixCleanupTokenPids(cleanupToken) : []
-        ];
+        const candidates = collectPosixProcessPids(child.pid, cleanupToken);
         const newPids = candidates.filter((pid) => !frozenPids.has(pid));
         if (newPids.length === 0) {
           stablePasses++;
@@ -7894,7 +8730,7 @@ function resolvedCommand(config) {
 async function invokeRequestHeadersCommand(config, envelope, signal) {
   const resolved = resolvedCommand(config);
   if (USE_PROCESS_GROUP) assertPosixProcessDiscoveryAvailable();
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     let stdout = Buffer.alloc(0);
     let settled = false;
     const cleanupToken = randomUUID();
@@ -7909,8 +8745,7 @@ async function invokeRequestHeadersCommand(config, envelope, signal) {
     const trackPosixDescendants = () => {
       if (!USE_PROCESS_GROUP || child.pid === void 0 || settled || trackingError) return;
       try {
-        for (const pid of collectPosixDescendantPids(child.pid)) trackedPosixDescendantPids.add(pid);
-        for (const pid of collectPosixCleanupTokenPids(cleanupToken)) trackedPosixDescendantPids.add(pid);
+        for (const pid of collectPosixProcessPids(child.pid, cleanupToken)) trackedPosixDescendantPids.add(pid);
       } catch (error) {
         trackingError = error instanceof Error ? error : new Error(String(error));
       }
@@ -7924,7 +8759,7 @@ async function invokeRequestHeadersCommand(config, envelope, signal) {
       if (descendantTracker) clearInterval(descendantTracker);
       signal.removeEventListener("abort", abort);
       if (result.status === "error") reject(result.error);
-      else resolve6(result.headers);
+      else resolve7(result.headers);
     };
     const finishAfterKill = (result) => {
       try {
@@ -8028,11 +8863,11 @@ var MAX_CAPTURED_STDERR_BYTES = 8 * 1024;
 var MAX_CAPTURED_STDERR_LINES = 3;
 var abortCleanupPromises = /* @__PURE__ */ new WeakMap();
 function isUnauthorizedHttpError(error) {
-  return error instanceof UnauthorizedError3 || error instanceof SdkHttpError && error.status === 401;
+  return error instanceof UnauthorizedError4 || error instanceof SdkHttpError2 && error.status === 401;
 }
 function shouldFallbackToSse(error, definition) {
   if (definition.protocolVersion === "2026-07-28") return false;
-  return error instanceof SdkHttpError && [404, 405, 406, 415].includes(error.status);
+  return error instanceof SdkHttpError2 && [404, 405, 406, 415].includes(error.status);
 }
 function resolveVersionNegotiation(definition) {
   switch (definition.protocolVersion) {
@@ -8063,6 +8898,7 @@ function appendStderrTail(tail, chunk) {
   const combined = Buffer.concat([tail, bytes]);
   return combined.length > MAX_CAPTURED_STDERR_BYTES ? Buffer.from(combined.subarray(combined.length - MAX_CAPTURED_STDERR_BYTES)) : combined;
 }
+var KEEP_ALIVE_REFRESH_TIMEOUT_MS = 5e3;
 var McpServerManager = class {
   /** Default cwd for stdio servers without an explicit config `cwd`. */
   constructor(defaultCwd) {
@@ -8071,6 +8907,7 @@ var McpServerManager = class {
     this.connectPromises = /* @__PURE__ */ new Map();
     this.reconnectPromises = /* @__PURE__ */ new Map();
     this.uiStreamListeners = /* @__PURE__ */ new Map();
+    this.pendingMetadataPublications = /* @__PURE__ */ new Map();
     this.authStorageOptions = {};
     this.acceptedUrlElicitations = /* @__PURE__ */ new Map();
     this.closePromises = /* @__PURE__ */ new Map();
@@ -8084,6 +8921,20 @@ var McpServerManager = class {
   setMetadataListChangedListener(listener) {
     this.metadataListChangedListener = listener;
   }
+  publishMetadataChanged(name, expectedConnection, reason) {
+    const current = this.connections.get(name);
+    if (current !== expectedConnection || current.status !== "connected") return false;
+    try {
+      this.metadataListChangedListener?.(name, reason);
+      this.pendingMetadataPublications.delete(name);
+      return true;
+    } catch (error) {
+      this.pendingMetadataPublications.set(name, { connection: expectedConnection, reason });
+      const message = error instanceof Error ? error.message : String(error);
+      logger.debug(`MCP: metadata publication failed for ${name}; queued for retry: ${message}`);
+      return false;
+    }
+  }
   setElicitationConfig(config) {
     this.elicitationConfig = config;
   }
@@ -8189,6 +9040,88 @@ var McpServerManager = class {
     this.reconnectPromises.set(name, promise);
     return abortable(promise, ownedSignal);
   }
+  /**
+   * Fetch the authoritative tool catalog for a connection that still appears
+   * connected. The SDK response cache is explicitly bypassed so this request
+   * also proves the remote Streamable HTTP session is usable. Results are
+   * identity-guarded: a late response from a replaced connection is ignored.
+   */
+  async refreshTools(name, expectedConnection, signal) {
+    if (this.stopped) throw new Error("MCP server manager is closed");
+    const ownedSignal = combineAbortSignals(this.runtimeSignal, signal);
+    throwIfAborted(ownedSignal);
+    const current = this.connections.get(name);
+    if (current !== expectedConnection || current.status !== "connected") {
+      return "superseded";
+    }
+    const requestOptions = this.buildRequestOptions(expectedConnection.definition, signal);
+    const timeout = Math.min(requestOptions?.timeout ?? KEEP_ALIVE_REFRESH_TIMEOUT_MS, KEEP_ALIVE_REFRESH_TIMEOUT_MS);
+    const healthOptions = {
+      ...requestOptions,
+      timeout
+    };
+    if (!expectedConnection.client.getServerCapabilities?.()?.tools) {
+      await expectedConnection.client.ping(healthOptions);
+      throwIfAborted(ownedSignal);
+      if (this.connections.get(name) !== expectedConnection || expectedConnection.status !== "connected") {
+        return "superseded";
+      }
+      this.retryPendingMetadataPublication(name, expectedConnection);
+      return "unchanged";
+    }
+    const toolsRevision = expectedConnection.toolsRevision ?? 0;
+    const refreshSignal = combineAbortSignals(healthOptions.signal, AbortSignal.timeout(timeout));
+    let tools;
+    try {
+      tools = await this.fetchAllTools(expectedConnection.client, {
+        ...healthOptions,
+        ...refreshSignal ? { signal: refreshSignal } : {},
+        cacheMode: "refresh"
+      });
+    } catch (error) {
+      throwIfAborted(ownedSignal);
+      if (this.connections.get(name) !== expectedConnection || expectedConnection.status !== "connected") {
+        return "superseded";
+      }
+      if (error instanceof SdkError2 && error.code === SdkErrorCode2.RequestTimeout) {
+        return "refresh-timeout";
+      }
+      throw error;
+    }
+    throwIfAborted(ownedSignal);
+    if (this.connections.get(name) !== expectedConnection || expectedConnection.status !== "connected") {
+      return "superseded";
+    }
+    if ((expectedConnection.toolsRevision ?? 0) !== toolsRevision) {
+      return "superseded";
+    }
+    if (isDeepStrictEqual(expectedConnection.tools, tools)) {
+      this.retryPendingMetadataPublication(name, expectedConnection);
+      return "unchanged";
+    }
+    const previousTools = expectedConnection.tools;
+    expectedConnection.tools = tools;
+    expectedConnection.toolsRevision = toolsRevision + 1;
+    try {
+      await this.metadataListChangedListener?.(name, "keep-alive-refresh");
+      this.pendingMetadataPublications.delete(name);
+    } catch (error) {
+      if (this.connections.get(name) === expectedConnection && expectedConnection.tools === tools) {
+        expectedConnection.tools = previousTools;
+        expectedConnection.toolsRevision = toolsRevision;
+      }
+      throw error;
+    }
+    return "updated";
+  }
+  retryPendingMetadataPublication(name, connection) {
+    const pendingPublication = this.pendingMetadataPublications.get(name);
+    if (pendingPublication?.connection !== connection) return;
+    this.metadataListChangedListener?.(name, pendingPublication.reason);
+    if (this.pendingMetadataPublications.get(name) === pendingPublication) {
+      this.pendingMetadataPublications.delete(name);
+    }
+  }
   async doReconnect(name, definition, staleConnection, signal) {
     throwIfAborted(signal);
     const current = this.connections.get(name);
@@ -8293,6 +9226,7 @@ var McpServerManager = class {
         transport,
         definition,
         tools: [],
+        toolsRevision: 0,
         resources: [],
         prompts: [],
         ...instructions !== void 0 ? { instructions } : {},
@@ -8461,7 +9395,9 @@ var McpServerManager = class {
     const connection = this.connections.get(serverName);
     if (!connection || connection.client !== client || connection.status !== "connected") return;
     connection.tools = tools;
+    connection.toolsRevision = (connection.toolsRevision ?? 0) + 1;
     this.metadataListChangedListener?.(serverName, "tools-list-changed");
+    this.pendingMetadataPublications.delete(serverName);
   }
   handlePromptsListChanged(serverName, client, error, prompts) {
     if (error) {
@@ -8474,6 +9410,7 @@ var McpServerManager = class {
     connection.prompts = prompts;
     connection.promptDiscoveryFailed = false;
     this.metadataListChangedListener?.(serverName, "prompts-list-changed");
+    this.pendingMetadataPublications.delete(serverName);
   }
   handleResourcesListChanged(serverName, client, error, resources) {
     if (error) {
@@ -8485,6 +9422,7 @@ var McpServerManager = class {
     if (!connection || connection.client !== client || connection.status !== "connected") return;
     connection.resources = resources;
     this.metadataListChangedListener?.(serverName, "resources-list-changed");
+    this.pendingMetadataPublications.delete(serverName);
   }
   async handleUrlElicitationRequired(serverName, error) {
     if (this.runtimeSignal?.aborted || !this.elicitationConfig?.allowUrl) return "cancel";
@@ -8518,7 +9456,7 @@ var McpServerManager = class {
     ) ?? {};
     const commandBearer = definition.bearerToken?.startsWith("!") && !definition.bearerToken.startsWith("!!") ? definition.bearerToken : void 0;
     if (definition.auth === "bearer") {
-      const token = commandBearer ? resolveCommandSecret(commandBearer, `MCP server "${serverName}" HTTP bearer token`) : resolveBearerToken(definition);
+      const token = commandBearer ? resolveCommandSecret(commandBearer, `MCP server "${serverName}" HTTP bearer token`) : resolveBearerToken(definition) ?? (definition.bearerToken === void 0 && definition.bearerTokenEnv === void 0 && definition.bearerTokenStore === true ? getBearerTokenForUrl(serverName, serverUrl) : void 0);
       if (token) headers["Authorization"] = `Bearer ${token}`;
     }
     if (hasCommandHeader || commandBearer) {
@@ -8705,6 +9643,7 @@ var McpServerManager = class {
   async close(name) {
     this.closeGenerations.set(name, (this.closeGenerations.get(name) ?? 0) + 1);
     this.connectAttempts.get(name)?.abort(new Error(`MCP connection ${name} was closed`));
+    this.pendingMetadataPublications.delete(name);
     const connection = this.connections.get(name);
     if (!connection) {
       const pendingClose = this.closePromises.get(name);
@@ -8756,6 +9695,7 @@ var McpServerManager = class {
     const failures = [...pendingResults, ...results, ...lateResults].flatMap((result) => result.status === "rejected" ? [result.reason] : []).filter((error) => this.containsCleanupFailure(error));
     this.uiStreamListeners.clear();
     this.acceptedUrlElicitations.clear();
+    this.pendingMetadataPublications.clear();
     this.samplingConfig = void 0;
     this.elicitationConfig = void 0;
     await this.traceWriter?.flush();
@@ -9071,77 +10011,6 @@ init_resource_tools();
 // packages/coding-agent/src/humain/mcp-adapter/vendor/ui-resource-handler.ts
 init_ui_app_bridge_helpers();
 import { UrlElicitationRequiredError } from "@modelcontextprotocol/client";
-
-// packages/coding-agent/src/humain/mcp-adapter/vendor/session-recovery.ts
-import { ProtocolError as ProtocolError2, SdkHttpError as SdkHttpError2, UnauthorizedError as UnauthorizedError4 } from "@modelcontextprotocol/client";
-init_types();
-var CONNECTION_CLOSED_PROTOCOL_CODE = -32e3;
-var SERVER_NOT_INITIALIZED_MCP_MESSAGES = /* @__PURE__ */ new Set([
-  "Server not initialized",
-  "Bad Request: Server not initialized"
-]);
-function isTerminatedSession(err, hadSessionId) {
-  if (!hadSessionId) return false;
-  if (err instanceof SdkHttpError2) {
-    return err.status === 404 || err.status === 400 && /"code"\s*:\s*-32000/.test(err.message) && /"message"\s*:\s*"Bad Request: Server not initialized"/.test(err.message);
-  }
-  return err instanceof ProtocolError2 && err.code === CONNECTION_CLOSED_PROTOCOL_CODE && SERVER_NOT_INITIALIZED_MCP_MESSAGES.has(err.message);
-}
-function hasSessionId(connection) {
-  const transport = connection.transport;
-  return transport?.sessionId != null;
-}
-var SessionRecoveryAuthRequiredError = class extends Error {
-  constructor(serverName, authMessage) {
-    super(authMessage ?? `MCP server "${serverName}" requires OAuth authentication after reconnect.`);
-    this.serverName = serverName;
-    this.authMessage = authMessage;
-    this.name = "SessionRecoveryAuthRequiredError";
-  }
-};
-async function withSessionRecovery(deps, serverName, fn) {
-  if (isServerDisabled(deps.config.mcpServers[serverName])) {
-    throw new Error(`MCP server "${serverName}" is disabled`);
-  }
-  const connection = deps.manager.getConnection(serverName);
-  if (!connection) {
-    throw new Error(`Server "${serverName}" is not connected`);
-  }
-  const hadSessionId = hasSessionId(connection);
-  try {
-    return await fn(connection);
-  } catch (err) {
-    const definition = deps.config.mcpServers[serverName];
-    if (definition && supportsOAuth(definition) && (err instanceof UnauthorizedError4 || err instanceof SdkHttpError2 && err.status === 401)) {
-      invalidateAuthEntryCache(serverName);
-    }
-    if (!isTerminatedSession(err, hadSessionId)) {
-      throw err;
-    }
-    if (!definition) {
-      throw err;
-    }
-    throwIfAborted(deps.signal);
-    logger.debug(`MCP session for "${serverName}" expired; reconnecting`, {
-      server: serverName
-    });
-    let freshConnection = deps.signal ? await deps.manager.reconnect(serverName, definition, connection, deps.signal) : await deps.manager.reconnect(serverName, definition, connection);
-    throwIfAborted(deps.signal);
-    if (freshConnection.status === "needs-auth") {
-      freshConnection = await deps.onNeedsAuth?.(serverName) ?? freshConnection;
-      throwIfAborted(deps.signal);
-    }
-    if (freshConnection.status === "needs-auth") {
-      throw new SessionRecoveryAuthRequiredError(serverName);
-    }
-    if (freshConnection.status !== "connected") {
-      throw err;
-    }
-    return fn(freshConnection);
-  }
-}
-
-// packages/coding-agent/src/humain/mcp-adapter/vendor/ui-resource-handler.ts
 init_types();
 var UiResourceHandler = class {
   constructor(manager, config = void 0) {
@@ -9532,8 +10401,20 @@ async function initializeMcp(pi, ctx, owner = createMcpRuntimeOwner(), options =
     },
     ...ui !== void 0 ? { ui } : {},
     sendMessage: (message, options2) => {
-      if (!owner.isActive()) return;
-      pi.sendMessage(message, options2);
+      const deliver = () => {
+        if (!owner.isActive()) return;
+        pi.sendMessage(message, options2);
+      };
+      if (!options2?.triggerTurn) {
+        deliver();
+        return;
+      }
+      void lifecycle.ensureConverged(owner.signal).then(deliver, (error) => {
+        if (!owner.isActive() || isAbortError(error, owner.signal)) return;
+        const detail = error instanceof Error ? error.message : String(error);
+        logger.debug(`MCP: pre-turn keep-alive convergence failed: ${sanitizeTerminalText(detail)}`);
+        deliver();
+      });
     },
     ...options.statusEvents !== void 0 ? { statusEvents: options.statusEvents } : {}
   };
@@ -9564,7 +10445,7 @@ async function initializeMcp(pi, ctx, owner = createMcpRuntimeOwner(), options =
   const idleSetting = typeof config.settings?.idleTimeout === "number" ? config.settings.idleTimeout : 10;
   lifecycle.setGlobalIdleTimeout(idleSetting);
   const cachePath = getMetadataCachePath();
-  const cacheFileExists = existsSync6(cachePath);
+  const cacheFileExists = existsSync7(cachePath);
   let cache = loadMetadataCache();
   let bootstrapAll = false;
   if (!cacheFileExists) {
@@ -9575,6 +10456,7 @@ async function initializeMcp(pi, ctx, owner = createMcpRuntimeOwner(), options =
     saveMetadataCache(cache);
   }
   const prefix = config.settings?.toolPrefix ?? "server";
+  let cachedSelectorCandidateIndex;
   for (const [name, definition] of serverEntries) {
     const lifecycleMode = definition.lifecycle ?? "lazy";
     const persistsAfterFirstSpawn = lifecycleMode === "eager" || lifecycleMode === "lazy-keep-alive";
@@ -9589,7 +10471,11 @@ async function initializeMcp(pi, ctx, owner = createMcpRuntimeOwner(), options =
     }
     const cachedEntry = cache?.servers?.[name];
     if (cachedEntry && isServerCacheValid(cachedEntry, definition)) {
-      const metadata = reconstructToolMetadata(name, cachedEntry, prefix, definition, config.mcpServers, cache ?? void 0);
+      const hasToolFilters = Array.isArray(definition.includeTools) && definition.includeTools.length > 0 || Array.isArray(definition.excludeTools) && definition.excludeTools.length > 0;
+      if (hasToolFilters && !cachedSelectorCandidateIndex && cache) {
+        cachedSelectorCandidateIndex = createCachedToolSelectorCandidateIndex(config.mcpServers, cache, prefix);
+      }
+      const metadata = reconstructToolMetadata(name, cachedEntry, prefix, definition, config.mcpServers, cache ?? void 0, cachedSelectorCandidateIndex);
       toolMetadata.set(name, metadata);
       if (Array.isArray(cachedEntry.resources)) {
         resourceCounts.set(name, cachedEntry.resources.length);
@@ -9747,6 +10633,16 @@ async function initializeMcp(pi, ctx, owner = createMcpRuntimeOwner(), options =
     recordFailure(state, serverName, message);
     updateStatusBar(state);
   });
+  lifecycle.setHealthRestoredCallback((serverName) => {
+    if (!owner.isActive()) return;
+    clearFailure(state, serverName);
+    updateStatusBar(state);
+  });
+  lifecycle.setAuthRequiredCallback((serverName) => {
+    if (!owner.isActive()) return;
+    clearFailure(state, serverName);
+    updateStatusBar(state);
+  });
   lifecycle.setIdleShutdownCallback((serverName) => {
     if (!owner.isActive()) return;
     const idleMinutes = getEffectiveIdleTimeoutMinutes(state, serverName);
@@ -9942,8 +10838,8 @@ init_metadata_cache();
 
 // packages/coding-agent/src/humain/mcp-adapter/vendor/onboarding-state.ts
 init_agent_dir();
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync4, renameSync as renameSync4 } from "node:fs";
-import { dirname as dirname6 } from "node:path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync4, renameSync as renameSync4 } from "node:fs";
+import { dirname as dirname7 } from "node:path";
 var DEFAULT_STATE = {
   version: 1,
   sharedConfigHintShown: false,
@@ -9954,9 +10850,9 @@ function getOnboardingStatePath() {
 }
 function loadOnboardingState() {
   const path2 = getOnboardingStatePath();
-  if (!existsSync7(path2)) return { ...DEFAULT_STATE };
+  if (!existsSync8(path2)) return { ...DEFAULT_STATE };
   try {
-    const raw = JSON.parse(readFileSync7(path2, "utf-8"));
+    const raw = JSON.parse(readFileSync8(path2, "utf-8"));
     if (!raw || typeof raw !== "object") return { ...DEFAULT_STATE };
     return {
       version: 1,
@@ -9970,7 +10866,7 @@ function loadOnboardingState() {
 }
 function saveOnboardingState(state) {
   const path2 = getOnboardingStatePath();
-  mkdirSync5(dirname6(path2), { recursive: true });
+  mkdirSync5(dirname7(path2), { recursive: true });
   const tmpPath = `${path2}.${process.pid}.tmp`;
   writeFileSync4(tmpPath, `${JSON.stringify(state, null, 2)}
 `, "utf-8");
@@ -10007,6 +10903,9 @@ init_utils();
 function terminalHyperlink(label, url) {
   return `\x1B]8;;${sanitizeTerminalText(url)}\x1B\\${sanitizeTerminalText(label)}\x1B]8;;\x1B\\`;
 }
+function canRenderPanel(ctx) {
+  return ctx.hasUI && ctx.mode === "tui";
+}
 async function showStatus(state, ctx) {
   if (!ctx.hasUI) return;
   const lines = ["MCP Server Status:", ""];
@@ -10206,29 +11105,18 @@ Set "auth": "oauth" or omit auth for auto-detection.`,
     const authStorageOptions = getAuthStorageOptions(config.settings?.oauthDir, cwd);
     const status = await authenticate(serverName, serverUrl, definition, {
       ...authStorageOptions.baseDir ? { authStorageOptions } : {},
-      onAuthorizationUrl: (authorizationUrl) => {
-        ui.notify(
-          `Open this URL to authenticate ${serverName}:
-
-${terminalHyperlink(authorizationUrl, authorizationUrl)}
-
-After approving, Pi will complete automatically if the browser can reach its localhost callback. On a remote machine, copy the full localhost URL from the browser address bar and paste it into Pi.`,
-          "info"
-        );
+      onAuthorizationUrl: () => {
       },
       onAuthorizationInput: async (authorizationUrl, inputSignal) => {
-        const readyToPaste = await ui.confirm(
-          `Authorize ${serverName}`,
-          `Open this link in your browser:
-${terminalHyperlink(authorizationUrl, authorizationUrl)}
-
-After approving access, select Yes to paste the callback URL.`,
-          { signal: inputSignal }
-        );
-        if (!readyToPaste || inputSignal.aborted) return void 0;
+        if (inputSignal.aborted) return void 0;
         return ui.input(
-          `Complete ${serverName} OAuth`,
-          "Paste the full callback URL",
+          `Complete ${serverName} OAuth
+
+${terminalHyperlink("Open authorization page", authorizationUrl)}
+${authorizationUrl}
+
+Approve access, then paste the full localhost callback URL below.`,
+          void 0,
           { signal: inputSignal }
         );
       },
@@ -10292,6 +11180,53 @@ async function logoutServer(serverName, state, ctx) {
   if (ui) ui.notify(message, "info");
   return { ok: true, message };
 }
+function validateBearerTokenStoreServer(serverName, state) {
+  const safeName = sanitizeTerminalText(serverName);
+  const definition = state.config.mcpServers[serverName];
+  if (!definition) return { ok: false, message: `Server "${safeName}" not found in config`, type: "error" };
+  if (isServerDisabled(definition)) return { ok: false, message: `Server "${safeName}" is disabled. Run /mcp enable ${safeName}, then /reload.`, type: "warning" };
+  if (definition.auth !== "bearer" || definition.bearerTokenStore !== true) {
+    return { ok: false, message: `Server "${safeName}" is not configured for bearerTokenStore.`, type: "error" };
+  }
+  let serverUrl;
+  try {
+    serverUrl = resolveServerUrl(definition);
+  } catch {
+    return { ok: false, message: `Server "${safeName}" has an invalid or unresolvable URL.`, type: "error" };
+  }
+  if (!serverUrl) return { ok: false, message: `Server "${safeName}" has no URL configured.`, type: "error" };
+  return { ok: true, serverUrl };
+}
+async function manageBearerToken(action, serverName, state, ctx) {
+  const ui = ctx.hasUI ? ctx.ui : void 0;
+  const safeName = sanitizeTerminalText(serverName);
+  const validation = validateBearerTokenStoreServer(serverName, state);
+  if (!validation.ok) {
+    if (ui) ui.notify(validation.message, validation.type);
+    return { ok: false, message: validation.message };
+  }
+  if (action === "set") {
+    const message2 = `Cannot store bearer token here: Pi extension UI has no masked secret input primitive. Run \`pi-mcp-adapter token set ${safeName}\` in a terminal; it reads the token from stdin only.`;
+    if (ui) ui.notify(message2, "error");
+    return { ok: false, message: message2 };
+  }
+  if (action === "status") {
+    const status = inspectBearerTokenForUrl(serverName, validation.serverUrl);
+    const message2 = status.status === "present" ? `Bearer token is stored for "${safeName}".` : status.status === "url-mismatch" ? `Bearer token is stored for "${safeName}", but its URL does not match the current server URL.` : status.status === "unavailable" ? status.message : `No bearer token is stored for "${safeName}".`;
+    if (ui) ui.notify(message2, status.status === "unavailable" ? "error" : "info");
+    return { ok: status.status !== "unavailable", message: message2 };
+  }
+  try {
+    removeBearerToken(serverName);
+  } catch (error) {
+    const message2 = error instanceof Error ? error.message : String(error);
+    if (ui) ui.notify(`Failed to remove bearer token for "${safeName}": ${sanitizeTerminalText(message2)}`, "error");
+    return { ok: false, message: message2 };
+  }
+  const message = `Bearer token removed for "${safeName}".`;
+  if (ui) ui.notify(message, "info");
+  return { ok: true, message };
+}
 function buildSharedConfigNoticeLines(configOverridePath, cwd) {
   const discovery = getMcpStandardConfigSummary(configOverridePath, cwd);
   const onboardingState = loadOnboardingState();
@@ -10310,6 +11245,10 @@ function buildSharedConfigNoticeLines(configOverridePath, cwd) {
 }
 async function openMcpSetup(state, pi, ctx, configOverridePath, mode = "setup", options = {}) {
   if (!ctx.hasUI) return { configChanged: false };
+  if (!canRenderPanel(ctx)) {
+    ctx.ui.notify(`The interactive MCP setup panel is only available in the terminal UI (current mode: ${ctx.mode}). Edit .mcp.json directly, or run /mcp status to review servers.`, "info");
+    return { configChanged: false };
+  }
   if (state.programmaticConfig) {
     ctx.ui.notify("MCP setup is unavailable when config is supplied by createMcpAdapter().", "info");
     return { configChanged: false };
@@ -10358,19 +11297,19 @@ async function openMcpSetup(state, pi, ctx, configOverridePath, mode = "setup",
       markSetupCompleted(discovery.fingerprint);
     }
   };
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     ctx.ui.custom(
       (tui, _theme, keybindings, done) => {
         return createMcpSetupPanel2(discovery, callbacks, { mode, onboardingState, keybindings }, tui, () => {
           done(void 0);
-          resolve6({ configChanged });
+          resolve7({ configChanged });
         });
       },
       { overlay: true, overlayOptions: { anchor: "center", width: 92 } }
     );
   });
 }
-function buildMcpPanelCallbacks(state, config, ctx) {
+function buildMcpPanelCallbacks(state, config, ctx, getOverlayHandle) {
   const authStatusFailures = /* @__PURE__ */ new Map();
   return {
     reconnect: (serverName) => reconnectServer(state, ctx, serverName),
@@ -10378,7 +11317,16 @@ function buildMcpPanelCallbacks(state, config, ctx) {
       const definition = config.mcpServers[serverName];
       return definition ? !isServerDisabled(definition) && supportsOAuth(definition) : false;
     },
-    authenticate: (serverName) => authenticateServer(serverName, config, ctx, state.owner?.signal, state.oauthRuntime),
+    authenticate: async (serverName) => {
+      const overlay = getOverlayHandle?.();
+      overlay?.setHidden(true);
+      try {
+        return await authenticateServer(serverName, config, ctx, state.owner?.signal, state.oauthRuntime);
+      } finally {
+        overlay?.setHidden(false);
+        overlay?.focus();
+      }
+    },
     getConnectionStatus: (serverName) => {
       authStatusFailures.delete(serverName);
       const definition = config.mcpServers[serverName];
@@ -10420,6 +11368,10 @@ async function openMcpPanel(state, pi, ctx, configOverridePath, onDirectToolsCon
     }
     return { configChanged: false };
   }
+  if (!canRenderPanel(ctx)) {
+    await showStatus(state, ctx);
+    return { configChanged: false };
+  }
   if (Object.keys(state.config.mcpServers).length === 0) {
     return openMcpSetup(state, pi, ctx, configOverridePath, "empty", { includeHostConfigs: false });
   }
@@ -10428,10 +11380,11 @@ async function openMcpPanel(state, pi, ctx, configOverridePath, onDirectToolsCon
   const configPath = pi.getFlag("mcp-config") ?? configOverridePath;
   const provenanceMap = getServerProvenance(configPath, ctx.cwd);
   const { lines: noticeLines, fingerprint } = buildSharedConfigNoticeLines(configPath, ctx.cwd);
-  const callbacks = buildMcpPanelCallbacks(state, config, ctx);
+  let overlayHandle;
+  const callbacks = buildMcpPanelCallbacks(state, config, ctx, () => overlayHandle);
   const { createMcpPanel: createMcpPanel2 } = await Promise.resolve().then(() => (init_mcp_panel(), mcp_panel_exports));
   let configChanged = false;
-  await new Promise((resolve6) => {
+  await new Promise((resolve7) => {
     ctx.ui.custom(
       (tui, _theme, keybindings, done) => {
         return createMcpPanel2(config, cache, provenanceMap, callbacks, tui, (result) => {
@@ -10442,17 +11395,23 @@ async function openMcpPanel(state, pi, ctx, configOverridePath, onDirectToolsCon
               ctx.ui.notify("Direct tools updated for this session.", "info");
             }
             done(void 0);
-            resolve6();
+            resolve7();
           })().catch((error) => {
             const message = error instanceof Error ? error.message : String(error);
             ctx.ui.notify(`Direct tools updated, but live refresh failed: ${message}`, "error");
             configChanged = true;
             done(void 0);
-            resolve6();
+            resolve7();
           });
         }, { noticeLines, keybindings });
       },
-      { overlay: true, overlayOptions: { anchor: "center", width: 82 } }
+      {
+        overlay: true,
+        overlayOptions: { anchor: "center", width: 82 },
+        onHandle: (handle) => {
+          overlayHandle = handle;
+        }
+      }
     );
   });
   if (noticeLines.length > 0 && fingerprint) {
@@ -10462,6 +11421,10 @@ async function openMcpPanel(state, pi, ctx, configOverridePath, onDirectToolsCon
 }
 async function openMcpAuthPanel(state, pi, ctx, configOverridePath) {
   if (!ctx.hasUI) return { configChanged: false };
+  if (!canRenderPanel(ctx)) {
+    ctx.ui.notify(`The interactive MCP auth panel is only available in the terminal UI (current mode: ${ctx.mode}). Use /mcp-auth <server> to authenticate a specific server.`, "info");
+    return { configChanged: false };
+  }
   if (state.programmaticConfig) {
     ctx.ui.notify("Use /mcp-auth <server> to authenticate a server from the in-memory SDK config.", "info");
     return { configChanged: false };
@@ -10477,21 +11440,28 @@ async function openMcpAuthPanel(state, pi, ctx, configOverridePath) {
   const cache = loadMetadataCache();
   const configPath = pi.getFlag("mcp-config") ?? configOverridePath;
   const provenanceMap = getServerProvenance(configPath, ctx.cwd);
-  const callbacks = buildMcpPanelCallbacks(state, config, ctx);
+  let overlayHandle;
+  const callbacks = buildMcpPanelCallbacks(state, config, ctx, () => overlayHandle);
   const { createMcpPanel: createMcpPanel2 } = await Promise.resolve().then(() => (init_mcp_panel(), mcp_panel_exports));
-  await new Promise((resolve6) => {
+  await new Promise((resolve7) => {
     ctx.ui.custom(
       (tui, _theme, keybindings, done) => {
         return createMcpPanel2(config, cache, provenanceMap, callbacks, tui, () => {
           done(void 0);
-          resolve6();
+          resolve7();
         }, {
           authOnly: true,
           keybindings,
           noticeLines: ["Select an OAuth MCP server and press Enter or ctrl+a to authenticate."]
         });
       },
-      { overlay: true, overlayOptions: { anchor: "center", width: 82 } }
+      {
+        overlay: true,
+        overlayOptions: { anchor: "center", width: 82 },
+        onHandle: (handle) => {
+          overlayHandle = handle;
+        }
+      }
     );
   });
   return { configChanged: false };
@@ -10508,7 +11478,7 @@ init_metadata_cache();
 // packages/coding-agent/src/humain/mcp-adapter/vendor/tool-registrar.ts
 import { mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join7 } from "node:path";
+import { join as join9 } from "node:path";
 var MAX_BINARY_RESOURCE_BYTES = 10 * 1024 * 1024;
 var MAX_SESSION_RESOURCE_BYTES = 100 * 1024 * 1024;
 var MAX_SESSION_RESOURCE_FILES = 1e4;
@@ -10615,11 +11585,11 @@ function materializeBinaryResource(resource, scope) {
     return omitBinaryResource(resource, "session resource limit reached");
   }
   try {
-    session.directory ??= mkdtempSync(join7(tmpdir(), "pi-mcp-resource-"));
+    session.directory ??= mkdtempSync(join9(tmpdir(), "pi-mcp-resource-"));
   } catch {
     return omitBinaryResource(resource, "could not be saved");
   }
-  const filePath = join7(session.directory, `resource-${++session.sequence}.bin`);
+  const filePath = join9(session.directory, `resource-${++session.sequence}.bin`);
   session.bytes += decodedBytes;
   session.files += 1;
   try {
@@ -10712,7 +11682,7 @@ function stringifyStructuredContent(value) {
 import { randomBytes } from "node:crypto";
 import { mkdtemp, writeFile as writeFile2 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join8 } from "node:path";
+import { join as join10 } from "node:path";
 var DEFAULT_MCP_OUTPUT_MAX_BYTES = 50 * 1024;
 var DEFAULT_MCP_OUTPUT_MAX_LINES = 2e3;
 var DEFAULT_MCP_DETAILS_MAX_BYTES = 16 * 1024;
@@ -10952,8 +11922,8 @@ function truncateKey(key) {
 }
 async function saveArtifact(kind, text) {
   try {
-    const dir = await mkdtemp(join8(tmpdir2(), "pi-mcp-output-"));
-    const path2 = join8(dir, `${kind}-${randomBytes(4).toString("hex")}.txt`);
+    const dir = await mkdtemp(join10(tmpdir2(), "pi-mcp-output-"));
+    const path2 = join10(dir, `${kind}-${randomBytes(4).toString("hex")}.txt`);
     await writeFile2(path2, text, { encoding: "utf8", mode: 384 });
     return { path: path2 };
   } catch (error) {
@@ -11427,9 +12397,20 @@ function escapeHtml2(value) {
 }
 
 // packages/coding-agent/src/humain/mcp-adapter/vendor/tool-approval.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { createHash as createHash4, randomUUID as randomUUID2 } from "node:crypto";
 init_types();
 init_utils();
+function stableStringify2(value) {
+  if (value === null || value === void 0 || typeof value !== "object") {
+    const serialized = JSON.stringify(value);
+    return serialized === void 0 ? "undefined" : serialized;
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => stableStringify2(item)).join(",")}]`;
+  }
+  const object = value;
+  return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${stableStringify2(object[key])}`).join(",")}}`;
+}
 function isToolCallApprovalRequired(config, serverName, toolMeta, toolMetadata) {
   const definition = config.mcpServers[serverName];
   const serverApproval = definition?.approveTools;
@@ -11509,7 +12490,8 @@ async function requestBrokerApproval(state, serverName, toolMeta, args, origin,
   }
 }
 async function ensureToolCallApproved(state, serverName, toolMeta, args, signal, origin = toolMeta.resourceUri ? "resource" : "proxy", approvalMetadata) {
-  const cacheKey = `${serverName}\0${toolMeta.originalName}`;
+  const argsHash = createHash4("sha256").update(stableStringify2(args ?? {})).digest("hex");
+  const cacheKey = `${serverName}\0${toolMeta.originalName}\0${argsHash}`;
   const approvedToolCalls = state.approvedToolCalls ??= /* @__PURE__ */ new Map();
   if (approvedToolCalls.has(cacheKey)) {
     return { ok: true };
@@ -11581,6 +12563,7 @@ async function startUiServer(options) {
   let currentDisplayMode = options.hostContext?.displayMode ?? "inline";
   let nextEventId = 1;
   const eventLog = [];
+  let latestCheckpointEventId;
   let streamSummary;
   const sessionMessages = {
     prompts: [],
@@ -11641,9 +12624,12 @@ async function startUiServer(options) {
   const touchHeartbeat = () => {
     lastHeartbeatAt = Date.now();
   };
-  const updateStreamSummary = (payload) => {
+  const updateStreamSummary = (eventId, payload) => {
     const envelope = getVisualizationStreamEnvelope(payload?.structuredContent);
     if (!envelope) return;
+    if (envelope.frameType === "checkpoint" || envelope.frameType === "final") {
+      latestCheckpointEventId = eventId;
+    }
     if (!streamSummary) {
       streamSummary = {
         streamId: envelope.streamId,
@@ -11668,15 +12654,9 @@ data: ${JSON.stringify(payload)}
 `;
   };
   const getLatestCheckpointIndex = () => {
-    for (let index = eventLog.length - 1; index >= 0; index -= 1) {
-      const entry = eventLog[index];
-      if (!entry) continue;
-      const envelope = getVisualizationStreamEnvelope(entry.payload?.structuredContent);
-      if (envelope?.frameType === "checkpoint" || envelope?.frameType === "final") {
-        return index;
-      }
-    }
-    return -1;
+    const firstEventId = eventLog[0]?.id;
+    if (latestCheckpointEventId === void 0 || firstEventId === void 0 || latestCheckpointEventId < firstEventId) return -1;
+    return latestCheckpointEventId - firstEventId;
   };
   const pruneEventLog = () => {
     if (eventLog.length <= MAX_EVENT_LOG) return;
@@ -11692,7 +12672,7 @@ data: ${JSON.stringify(payload)}
     if (completed) return;
     const eventId = nextEventId++;
     eventLog.push({ id: eventId, name, payload });
-    updateStreamSummary(payload);
+    updateStreamSummary(eventId, payload);
     pruneEventLog();
     const chunk = serializeEvent(eventId, name, payload);
     for (const client of sseClients) {
@@ -11868,9 +12848,16 @@ data: ${JSON.stringify(payload)}
           sendJson(res, 403, { ok: false, error: `MCP tool "${callParams.name}" is not callable by apps` });
           return;
         }
+        let normalizedArguments;
+        try {
+          normalizedArguments = normalizeToolArguments(callParams.arguments, `tool "${callParams.name}" arguments`);
+        } catch (error) {
+          sendJson(res, 400, { ok: false, error: error instanceof Error ? error.message : String(error) });
+          return;
+        }
         const callArgs = {
           name: callParams.name,
-          arguments: callParams.arguments && typeof callParams.arguments === "object" && !Array.isArray(callParams.arguments) ? callParams.arguments : {}
+          arguments: normalizedArguments
         };
         const toolMeta = {
           name: callParams.name,
@@ -12077,7 +13064,7 @@ data: ${JSON.stringify(payload)}
     closeSse();
   }, WATCHDOG_INTERVAL_MS);
   watchdog.unref();
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     const candidates = resolvePortCandidates(options.port);
     let candidateIndex = 0;
     const listen = () => {
@@ -12142,7 +13129,7 @@ data: ${JSON.stringify(payload)}
         getSessionMessages: () => ({ ...sessionMessages }),
         getStreamSummary: () => streamSummary ? { ...streamSummary, phases: [...streamSummary.phases] } : void 0
       };
-      resolve6(handle);
+      resolve7(handle);
     };
     listen();
   });
@@ -12161,7 +13148,7 @@ async function parseBody(req, res) {
   }
 }
 function readBody(req) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     let size = 0;
     const chunks = [];
     req.on("data", (chunk) => {
@@ -12175,7 +13162,7 @@ function readBody(req) {
     });
     req.on("end", () => {
       try {
-        resolve6(JSON.parse(Buffer.concat(chunks).toString("utf-8")));
+        resolve7(JSON.parse(Buffer.concat(chunks).toString("utf-8")));
       } catch (error) {
         reject(error);
       }
@@ -12232,11 +13219,11 @@ function sendText(res, status, text) {
 }
 
 // packages/coding-agent/src/humain/mcp-adapter/vendor/glimpse-ui.ts
-import { existsSync as existsSync8 } from "node:fs";
+import { existsSync as existsSync9 } from "node:fs";
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { join as join9, dirname as dirname8 } from "node:path";
+import { join as join11, dirname as dirname9 } from "node:path";
 import { platform as platform3 } from "node:os";
-import { createRequire as createRequire4 } from "node:module";
+import { createRequire as createRequire5 } from "node:module";
 var glimpseAvailable = null;
 var resolvedBinaryPath = null;
 function isGlimpseAvailable() {
@@ -12250,26 +13237,26 @@ function isGlimpseAvailable() {
   return glimpseAvailable;
 }
 function getGlimpseBinaryPath() {
-  if (process.env.GLIMPSE_BINARY && existsSync8(process.env.GLIMPSE_BINARY)) {
+  if (process.env.GLIMPSE_BINARY && existsSync9(process.env.GLIMPSE_BINARY)) {
     return process.env.GLIMPSE_BINARY;
   }
   try {
-    const require5 = createRequire4(import.meta.url);
-    const glimpseuiPath = require5.resolve("glimpseui");
-    const binaryPath = join9(dirname8(glimpseuiPath), "glimpse");
-    if (existsSync8(binaryPath)) return binaryPath;
+    const require6 = createRequire5(import.meta.url);
+    const glimpseuiPath = require6.resolve("glimpseui");
+    const binaryPath = join11(dirname9(glimpseuiPath), "glimpse");
+    if (existsSync9(binaryPath)) return binaryPath;
   } catch {
   }
   try {
     const globalRoot = execFileSync2("npm", ["root", "-g"], { encoding: "utf-8" }).trim();
-    const binaryPath = join9(globalRoot, "glimpseui", "src", "glimpse");
-    if (existsSync8(binaryPath)) return binaryPath;
+    const binaryPath = join11(globalRoot, "glimpseui", "src", "glimpse");
+    if (existsSync9(binaryPath)) return binaryPath;
   } catch {
   }
   return null;
 }
 async function openGlimpseWindow(html, options) {
-  const modulePath = resolvedBinaryPath ? join9(dirname8(resolvedBinaryPath), "glimpse.mjs") : "glimpseui";
+  const modulePath = resolvedBinaryPath ? join11(dirname9(resolvedBinaryPath), "glimpse.mjs") : "glimpseui";
   const glimpse = await import(modulePath);
   let active = true;
   const win = glimpse.open(html, {
@@ -12356,22 +13343,22 @@ function isRemoteSession2() {
   return Boolean(process.env.SSH_CONNECTION || process.env.SSH_TTY);
 }
 function hasActiveRemoteLogin() {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     execFile("who", { encoding: "utf8", timeout: 2e3 }, (error, out) => {
       if (error) {
-        resolve6(false);
+        resolve7(false);
         return;
       }
-      resolve6(/\(.+\)\s*$/m.test(out));
+      resolve7(/\(.+\)\s*$/m.test(out));
     });
   });
 }
 function probeMoshiGateway() {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const socket = net.connect({ host: "127.0.0.1", port: 24543 });
     const done = (ok) => {
       socket.destroy();
-      resolve6(ok);
+      resolve7(ok);
     };
     socket.setTimeout(300);
     socket.once("connect", () => done(true));
@@ -13084,6 +14071,7 @@ function createDirectToolExecutor(getState, getInitPromise, spec) {
         details: { error: "not_connected", server: spec.serverName }
       };
     }
+    const normalizedParams = spec.resourceUri ? params : normalizeToolArguments(params);
     const approval = await ensureToolCallApproved(state, spec.serverName, {
       name: spec.prefixedName,
       originalName: spec.originalName,
@@ -13092,7 +14080,7 @@ function createDirectToolExecutor(getState, getInitPromise, spec) {
       ...spec.resourceUri !== void 0 ? { resourceUri: spec.resourceUri } : {},
       ...spec.uiResourceUri !== void 0 ? { uiResourceUri: spec.uiResourceUri } : {},
       ...spec.uiStreamMode !== void 0 ? { uiStreamMode: spec.uiStreamMode } : {}
-    }, params, ownedSignal, spec.resourceUri ? "resource" : "direct");
+    }, normalizedParams, ownedSignal, spec.resourceUri ? "resource" : "direct");
     if (approval.ok === false) {
       const denied = approval.reason === "denied";
       const message = denied ? `The user declined approval to run MCP tool "${spec.originalName}" on server "${spec.serverName}".` : `MCP tool "${spec.originalName}" on server "${spec.serverName}" is approval-gated and requires an interactive session.`;
@@ -13155,7 +14143,7 @@ function createDirectToolExecutor(getState, getInitPromise, spec) {
       uiSession = hasUi ? await maybeStartUiSession(state, {
         serverName: spec.serverName,
         toolName: spec.originalName,
-        toolArgs: params ?? {},
+        toolArgs: normalizedParams,
         uiResourceUri: spec.uiResourceUri,
         ...spec.uiStreamMode !== void 0 ? { streamMode: spec.uiStreamMode } : {},
         ...signal ? { signal } : {},
@@ -13171,7 +14159,7 @@ function createDirectToolExecutor(getState, getInitPromise, spec) {
         spec.serverName,
         (conn) => abortable(conn.client.callTool({
           name: spec.originalName,
-          arguments: params ?? {},
+          arguments: normalizedParams,
           _meta: uiSession?.requestMeta
         }, requestOptions), ownedSignal)
       );
@@ -13506,7 +14494,7 @@ function buildCommandDescription(metadata) {
 // packages/coding-agent/src/humain/mcp-adapter/vendor/proxy-modes.ts
 init_types();
 import { UrlElicitationRequiredError as UrlElicitationRequiredError4 } from "@modelcontextprotocol/client";
-import { createRequire as createRequire5 } from "node:module";
+import { createRequire as createRequire6 } from "node:module";
 
 // packages/coding-agent/src/humain/mcp-adapter/vendor/ts-shape.ts
 var UNSUPPORTED_KEYWORDS = ["if", "then", "else", "allOf", "not", "patternProperties", "additionalProperties"];
@@ -13657,6 +14645,7 @@ var FIELD_WEIGHTS = {
   description: 5,
   keywords: 5
 };
+var searchCache = /* @__PURE__ */ new WeakMap();
 function resolveSearchKeywords(definition, toolOriginalName, serverName, globalPrefix) {
   const map = definition?.searchKeywords;
   if (!map || typeof map !== "object" || Array.isArray(map)) return [];
@@ -13682,23 +14671,30 @@ function normalizeSearchText(value) {
 function tokenize(value) {
   return normalizeSearchText(value).split(/[^a-z0-9]+/).filter(Boolean);
 }
-function scoreToolMatch(tool, server2, query, keywords) {
-  const normalizedQuery = normalizeSearchText(query).trim();
-  const queryTokens = tokenize(query);
-  if (queryTokens.length === 0) return null;
+function prepareToolSearch(tool, server2, keywords) {
   const fields = {
     name: normalizeSearchText(tool.name),
     originalName: normalizeSearchText(tool.originalName),
     server: normalizeSearchText(server2),
     description: normalizeSearchText(tool.description)
   };
+  const preparedFields = Object.entries(fields).map(([field, value]) => [field, value, tokenize(value)]);
+  const keywordPhrases = keywords?.map((keyword) => normalizeSearchText(keyword).trim()).filter(Boolean) ?? [];
+  return {
+    tool,
+    fields: preparedFields,
+    nameTokens: preparedFields[0][2],
+    keywordPhrases,
+    keywordTokens: keywordPhrases.flatMap(tokenize)
+  };
+}
+function scorePreparedToolMatch(prepared, normalizedQuery, queryTokens) {
   let score = 0;
   let phraseMatched = false;
   let wholeFieldExact = false;
   const matchedTokens = /* @__PURE__ */ new Set();
-  for (const [field, value] of Object.entries(fields)) {
+  for (const [field, value, fieldTokens] of prepared.fields) {
     const weight = FIELD_WEIGHTS[field];
-    const fieldTokens = tokenize(value);
     if (value === normalizedQuery) {
       score += weight * 14;
       phraseMatched = true;
@@ -13723,11 +14719,10 @@ function scoreToolMatch(tool, server2, query, keywords) {
       }
     }
   }
-  if (keywords !== void 0 && keywords.length > 0) {
+  if (prepared.keywordPhrases.length > 0) {
     const weight = FIELD_WEIGHTS.keywords;
-    const phrases = keywords.map((keyword) => normalizeSearchText(keyword).trim()).filter(Boolean);
     let phraseScore = 0;
-    for (const phrase of phrases) {
+    for (const phrase of prepared.keywordPhrases) {
       if (phrase === normalizedQuery) {
         phraseScore = Math.max(phraseScore, weight * 14);
         phraseMatched = true;
@@ -13741,15 +14736,14 @@ function scoreToolMatch(tool, server2, query, keywords) {
       }
     }
     score += phraseScore;
-    const keywordTokens = phrases.flatMap(tokenize);
     for (const token of queryTokens) {
-      if (keywordTokens.includes(token)) {
+      if (prepared.keywordTokens.includes(token)) {
         score += weight * 4;
         matchedTokens.add(token);
-      } else if (keywordTokens.some((keywordToken) => keywordToken.startsWith(token) || keywordToken.length >= MIN_STEM_LENGTH && token.startsWith(keywordToken))) {
+      } else if (prepared.keywordTokens.some((keywordToken) => keywordToken.startsWith(token) || keywordToken.length >= MIN_STEM_LENGTH && token.startsWith(keywordToken))) {
         score += weight * 2;
         matchedTokens.add(token);
-      } else if (phrases.some((phrase) => phrase.includes(token))) {
+      } else if (prepared.keywordPhrases.some((phrase) => phrase.includes(token))) {
         score += weight;
         matchedTokens.add(token);
       }
@@ -13759,22 +14753,47 @@ function scoreToolMatch(tool, server2, query, keywords) {
   if (!phraseMatched && (queryTokens.length <= 2 ? coverage !== 1 : coverage < 0.6)) return null;
   score += coverage === 1 ? 25 : Math.round(coverage * 10);
   const firstQueryToken = queryTokens[0];
-  if (firstQueryToken !== void 0 && tokenize(fields.name).includes(firstQueryToken)) score += 8;
+  if (firstQueryToken !== void 0 && prepared.nameTokens.includes(firstQueryToken)) score += 8;
   if (wholeFieldExact) score += 20;
   return score;
 }
+function getPreparedTools(state, serverName, metadata, definition, globalPrefix, includeKeywords) {
+  let stateCache = searchCache.get(state);
+  if (!stateCache) {
+    stateCache = /* @__PURE__ */ new Map();
+    searchCache.set(state, stateCache);
+  }
+  const toolPrefix = resolveToolPrefix(definition, globalPrefix);
+  let cached = stateCache.get(serverName);
+  if (cached?.metadata !== metadata || cached.searchKeywords !== definition?.searchKeywords || cached.toolPrefix !== toolPrefix) {
+    cached = { metadata, searchKeywords: definition?.searchKeywords, toolPrefix };
+    stateCache.set(serverName, cached);
+  }
+  const cacheKey = includeKeywords ? "withKeywords" : "withoutKeywords";
+  let prepared = cached[cacheKey];
+  if (!prepared) {
+    prepared = metadata.map((tool) => prepareToolSearch(
+      tool,
+      serverName,
+      includeKeywords && definition?.searchKeywords !== void 0 ? resolveSearchKeywords(definition, tool.originalName, serverName, globalPrefix) : void 0
+    ));
+    cached[cacheKey] = prepared;
+  }
+  return prepared;
+}
 function rankToolMatches(state, query, server2, includeKeywords = true) {
   const matches = [];
+  const normalizedQuery = normalizeSearchText(query).trim();
+  const queryTokens = tokenize(query);
+  if (queryTokens.length === 0) return matches;
   const globalPrefix = state.config.settings?.toolPrefix ?? "server";
   for (const [serverName, metadata] of state.toolMetadata.entries()) {
     if (server2 && serverName !== server2) continue;
     const definition = state.config.mcpServers[serverName];
     if (isServerDisabled(definition)) continue;
-    const hasKeywords = includeKeywords && definition?.searchKeywords !== void 0;
-    for (const tool of metadata) {
-      const keywords = hasKeywords ? resolveSearchKeywords(definition, tool.originalName, serverName, globalPrefix) : void 0;
-      const score = scoreToolMatch(tool, serverName, query, keywords);
-      if (score !== null) matches.push({ server: serverName, tool, score });
+    for (const prepared of getPreparedTools(state, serverName, metadata, definition, globalPrefix, includeKeywords)) {
+      const score = scorePreparedToolMatch(prepared, normalizedQuery, queryTokens);
+      if (score !== null) matches.push({ server: serverName, tool: prepared.tool, score });
     }
   }
   return matches.sort((a, b) => b.score - a.score || a.tool.name.localeCompare(b.tool.name));
@@ -13799,7 +14818,7 @@ function rankSuggestions(state, name, limit) {
 }
 
 // packages/coding-agent/src/humain/mcp-adapter/vendor/proxy-modes.ts
-var require4 = createRequire5(import.meta.url);
+var require5 = createRequire6(import.meta.url);
 var MAX_REGEX_SEARCH_QUERY_LENGTH = 256;
 var INSTRUCTIONS_PREVIEW_LENGTH = 300;
 var REGEX_SAFETY_CHECK_PARAMS = {
@@ -14222,7 +15241,7 @@ function executeSearch(state, query, regex, server2, includeSchemas, limit = 12,
       pattern = new RegExp(query, "i");
       let safety;
       try {
-        const { checkSync } = require4("recheck");
+        const { checkSync } = require5("recheck");
         safety = checkSync(query, "i", REGEX_SAFETY_CHECK_PARAMS);
       } catch (error) {
         const reason = error instanceof Error ? error.message : String(error);
@@ -14782,11 +15801,12 @@ async function executeCall(state, toolName, args, serverOverride, getPiTools, si
   if (isServerDisabled(state.config.mcpServers[serverName])) {
     return disabledCallResult(serverName, toolMeta);
   }
+  const normalizedArgs = toolMeta.resourceUri ? args ?? {} : normalizeToolArguments(args);
   const approval = await ensureToolCallApproved(
     state,
     serverName,
     toolMeta,
-    args,
+    normalizedArgs,
     ownedSignal,
     origin ?? (toolMeta.resourceUri ? "resource" : "proxy")
   );
@@ -14854,7 +15874,7 @@ async function executeCall(state, toolName, args, serverOverride, getPiTools, si
     uiSession = toolMeta.uiResourceUri ? await maybeStartUiSession(state, {
       serverName,
       toolName: toolMeta.originalName,
-      toolArgs: args ?? {},
+      toolArgs: normalizedArgs,
       uiResourceUri: toolMeta.uiResourceUri,
       ...toolMeta.uiStreamMode !== void 0 ? { streamMode: toolMeta.uiStreamMode } : {},
       ...signal ? { signal } : {},
@@ -14870,7 +15890,7 @@ async function executeCall(state, toolName, args, serverOverride, getPiTools, si
       serverName,
       (conn) => abortable(conn.client.callTool({
         name: toolMeta.originalName,
-        arguments: args ?? {},
+        arguments: normalizedArgs,
         _meta: uiSession?.requestMeta
       }, requestOptions), ownedSignal)
     );
@@ -14974,6 +15994,7 @@ init_utils();
 import { Text, truncateToWidth as truncateToWidth3, visibleWidth as visibleWidth3 } from "@earendil-works/pi-tui";
 var plainTheme = { fg: (_name, text) => text };
 var DEFAULT_MAX_CALL_INPUT_CHARS = 1500;
+var DEFAULT_MAX_COMPACT_INPUT_CHARS = 240;
 var DEFAULT_BOXED_COLLAPSED_LINES = 3;
 var DEFAULT_COMPACT_COLLAPSED_LINES = 1;
 var DEFAULT_MAX_COLLAPSED_CHARS = 8e3;
@@ -14986,8 +16007,9 @@ var EmptyComponent = class {
   }
 };
 var CompactMcpToolResult = class {
-  constructor(title, display, theme) {
+  constructor(title, inputPreview, display, theme) {
     this.title = title;
+    this.inputPreview = inputPreview;
     this.display = display;
     this.theme = theme;
     this.rendered = null;
@@ -15000,7 +16022,7 @@ var CompactMcpToolResult = class {
     });
     const lines = resultLines.length > 0 ? resultLines : [""];
     const bodies = lines.map((line, index) => {
-      const prefix = index === 0 && this.title ? `${this.theme.fg("toolTitle", this.title)} \u2192 ` : "";
+      const prefix = index === 0 ? this.renderPrefix(safeWidth) : "";
       return `${prefix}${this.theme.fg("toolOutput", line)}`;
     });
     const hiddenText = this.display.truncated || bodies.some((body) => visibleWidth3(body) > safeWidth);
@@ -15022,6 +16044,19 @@ var CompactMcpToolResult = class {
   invalidate() {
     this.rendered = null;
   }
+  renderPrefix(width) {
+    if (!this.title) return "";
+    const arrow = " \u2192 ";
+    if (!this.inputPreview) return `${this.theme.fg("toolTitle", this.title)}${arrow}`;
+    const maxPrefixWidth = Math.max(12, Math.floor(width * 0.55));
+    const titleWidth = visibleWidth3(this.title);
+    const inputWidth = Math.max(0, maxPrefixWidth - titleWidth - 1);
+    if (inputWidth <= 3) {
+      return `${this.theme.fg("toolTitle", truncateToWidth3(this.title, maxPrefixWidth, "\u2026"))}${arrow}`;
+    }
+    const input = truncateToWidth3(this.inputPreview, inputWidth, "\u2026");
+    return `${this.theme.fg("toolTitle", this.title)} ${this.theme.fg("muted", input)}${arrow}`;
+  }
 };
 var CollapsibleText = class {
   constructor(text, expanded, maxCollapsedLines, ellipsis, expandHint, preTruncated = false) {
@@ -15122,6 +16157,9 @@ function renderToolCallLines(lines, theme) {
   const styledRest = rest.map((line) => activeTheme.fg("muted", line));
   return new Text([styledTitle, ...styledRest].join("\n"), 0, 0);
 }
+function formatCompactInputPreview(lines, maxChars = DEFAULT_MAX_COMPACT_INPUT_CHARS) {
+  return truncateText(lines.slice(1).join(" ").replace(/\s+/g, " ").trim(), maxChars);
+}
 function resolveMcpToolRenderOptions(settings) {
   const resultRendering = settings?.toolResultRendering === "boxed" ? "boxed" : "compact";
   const collapsedLines = settings?.collapsedResultLines;
@@ -15135,7 +16173,10 @@ function shouldUseCompactFinalRender(options, context) {
   return options.resultRendering === "compact" && context !== void 0 && context.isPartial === false && context.expanded !== true && context.isError !== true;
 }
 function renderToolCall(lines, theme, context, options) {
-  if (context?.state) context.state.compactTitle = lines[0] ?? "mcp";
+  if (context?.state) {
+    context.state.compactTitle = lines[0] ?? "mcp";
+    context.state.compactInputPreview = formatCompactInputPreview(lines);
+  }
   if (shouldUseCompactFinalRender(options, context)) return new EmptyComponent();
   return renderToolCallLines(lines, theme);
 }
@@ -15161,6 +16202,18 @@ function collectCollapsedResultLines(content, maxLines, maxChars) {
   let remainingChars = maxChars;
   let truncated = false;
   const appendLine = (line) => {
+    if (lines.length === 0) {
+      const previewWidth = Math.min(line.length, remainingChars);
+      if (line.slice(0, previewWidth).trim() === "") {
+        if (line.length >= remainingChars) {
+          truncated = true;
+          remainingChars = 0;
+          return false;
+        }
+        remainingChars -= line.length + 1;
+        return true;
+      }
+    }
     if (lines.length >= maxLines || remainingChars <= 0) {
       truncated = true;
       return false;
@@ -15190,7 +16243,7 @@ function collectCollapsedResultLines(content, maxLines, maxChars) {
     }
     if (truncated) break;
   }
-  if (lines.length === 0) lines.push("");
+  if (lines.length === 0) lines.push(truncated ? "(leading blank output omitted)" : "");
   if (truncated && lines.length >= maxLines) lines.push("\u2026");
   return { lines, truncated };
 }
@@ -15221,7 +16274,8 @@ function renderMcpToolResult(result, options, theme, context, renderOptions = re
   if (!expanded && renderOptions.resultRendering === "compact") {
     const display2 = formatMcpToolResultLines(result, false, renderOptions.collapsedResultLines);
     const title = context?.state?.compactTitle ?? formatMcpToolResultIdentity(result.details) ?? "";
-    return new CompactMcpToolResult(title, display2, activeTheme);
+    const inputPreview = context?.state?.compactInputPreview ?? "";
+    return new CompactMcpToolResult(title, inputPreview, display2, activeTheme);
   }
   const display = formatMcpToolResultLines(result, expanded, renderOptions.collapsedResultLines);
   const identity = formatMcpToolResultIdentity(result.details);
@@ -15431,10 +16485,14 @@ async function runMcpScript(state, code, timeoutMs = DEFAULT_MCP_SCRIPT_TIMEOUT_
     }
     worker = new Worker(new URL("./mcp-script-worker.mjs", import.meta.url), {
       workerData: { code },
-      env: {}
+      env: {},
+      // The sandbox cannot open files, and the host always terminates this worker.
+      // Disable Node's unmanaged FD bookkeeping, which emits false warnings when
+      // short-lived workers are terminated on Node 24.
+      trackUnmanagedFds: false
     });
     const activeWorker = worker;
-    const execution = new Promise((resolve6, reject) => {
+    const execution = new Promise((resolve7, reject) => {
       let completed = false;
       activeWorker.on("message", (value) => {
         const message = parseWorkerMessage(value);
@@ -15446,7 +16504,7 @@ async function runMcpScript(state, code, timeoutMs = DEFAULT_MCP_SCRIPT_TIMEOUT_
         if (message.type === "done") {
           completed = true;
           if ("returnBlock" in message) output.push(toContentBlock(message.returnBlock));
-          resolve6();
+          resolve7();
           return;
         }
         if (message.type === "error") {
@@ -15531,13 +16589,14 @@ async function runMcpScript(state, code, timeoutMs = DEFAULT_MCP_SCRIPT_TIMEOUT_
 init_types();
 var INIT_WAIT_TIMEOUT_MS = 3e4;
 var INIT_WAIT_TIMED_OUT = /* @__PURE__ */ Symbol("init-wait-timed-out");
+var runtimeRegistrars = /* @__PURE__ */ new WeakMap();
 async function awaitWithTimeout(promise, timeoutMs) {
   let timer;
   try {
     return await Promise.race([
       promise,
-      new Promise((resolve6) => {
-        timer = setTimeout(() => resolve6(INIT_WAIT_TIMED_OUT), timeoutMs);
+      new Promise((resolve7) => {
+        timer = setTimeout(() => resolve7(INIT_WAIT_TIMED_OUT), timeoutMs);
         timer.unref?.();
       })
     ]);
@@ -15603,6 +16662,14 @@ function installMcpAdapter(pi, options) {
   let proxyToolRegistered = false;
   let proxyToolDescription = null;
   let directToolsFrozen = false;
+  const runtimeServers = /* @__PURE__ */ new Map();
+  function attachRuntimeServerLifecycle(targetState, name, definition) {
+    const lifecycleMode = definition.lifecycle ?? "lazy";
+    const persistsAfterFirstSpawn = lifecycleMode === "eager" || lifecycleMode === "lazy-keep-alive";
+    const idleOverride = definition.idleTimeout ?? (persistsAfterFirstSpawn ? 0 : void 0);
+    targetState.lifecycle.registerServer(name, definition, idleOverride !== void 0 ? { idleTimeout: idleOverride } : void 0);
+    if (lifecycleMode === "keep-alive") targetState.lifecycle.markKeepAlive(name, definition);
+  }
   const toToolParameters = (schema) => typeof Type.Unsafe === "function" ? Type.Unsafe(schema) : schema;
   function directToolFingerprint(spec) {
     return JSON.stringify({
@@ -15725,6 +16792,42 @@ function installMcpAdapter(pi, options) {
     registerPromptCommands([...state?.promptMetadata?.values() ?? []].flat());
   }
   registerPromptCommands(resolveCachedPrompts(earlyConfig));
+  runtimeRegistrars.set(pi, (name, definition) => {
+    if (typeof name !== "string" || name.trim() === "") {
+      throw new Error("MCP server name must be a non-empty string");
+    }
+    if (typeof definition !== "object" || definition === null || Array.isArray(definition)) {
+      throw new Error(`MCP server definition for "${name}" must be an object`);
+    }
+    const effective = state?.config ?? earlyConfig;
+    if (runtimeServers.has(name) || Object.hasOwn(effective.mcpServers, name)) {
+      throw new Error(`MCP server "${name}" is already registered`);
+    }
+    const entry = { ...structuredClone(definition), directTools: false };
+    runtimeServers.set(name, entry);
+    const registeredState = state;
+    if (registeredState) {
+      registeredState.config.mcpServers[name] = entry;
+      attachRuntimeServerLifecycle(registeredState, name, entry);
+      syncToolSurface();
+      updateStatusBar(registeredState);
+    }
+    let disposed = false;
+    return {
+      dispose: async () => {
+        if (disposed) return;
+        disposed = true;
+        runtimeServers.delete(name);
+        const currentState = state;
+        if (!currentState || currentState.config.mcpServers[name] !== entry) return;
+        delete currentState.config.mcpServers[name];
+        currentState.lifecycle.unregisterServer(name);
+        await currentState.manager.close(name);
+        syncToolSurface();
+        updateStatusBar(currentState);
+      }
+    };
+  });
   const getPiTools = () => pi.getAllTools();
   pi.registerFlag("mcp-config", {
     description: "Path to MCP config file",
@@ -15737,8 +16840,7 @@ function installMcpAdapter(pi, options) {
         ...earlyConfigPath !== void 0 ? { configPath: earlyConfigPath } : {},
         ...sessionConfig !== void 0 ? { config: sessionConfig } : {}
       } : {},
-      oauthRuntime,
-      statusEvents: pi.events
+      oauthRuntime
     });
     initPromise = promise;
     return promise.then(async (nextState) => {
@@ -15751,6 +16853,14 @@ function installMcpAdapter(pi, options) {
         return;
       }
       state = nextState;
+      for (const [name, definition] of runtimeServers) {
+        if (Object.hasOwn(nextState.config.mcpServers, name)) {
+          console.error(`MCP: runtime-registered server "${name}" now collides with a configured server; keeping the configured server`);
+          continue;
+        }
+        nextState.config.mcpServers[name] = definition;
+        attachRuntimeServerLifecycle(nextState, name, definition);
+      }
       nextState.onToolMetadataUpdated = (_serverName, _reason) => {
         if (state !== nextState || !owner.isActive()) return;
         syncPromptCommands();
@@ -15762,6 +16872,7 @@ function installMcpAdapter(pi, options) {
       };
       syncPromptCommands();
       syncToolSurface(ctx);
+      nextState.statusEvents = pi.events;
       updateStatusBar(nextState);
       initPromise = null;
       if (earlyConfig.settings?.freezeDirectTools === true) {
@@ -15845,6 +16956,26 @@ function installMcpAdapter(pi, options) {
       }
     }
   });
+  pi.on("input", async () => {
+    const inputOwner = currentOwner;
+    if (!inputOwner?.isActive()) return;
+    if (!state && initPromise) {
+      try {
+        await awaitWithTimeout(initPromise, INIT_WAIT_TIMEOUT_MS);
+      } catch {
+        return;
+      }
+    }
+    const inputState = state;
+    if (!inputState || !inputOwner.isActive()) return;
+    try {
+      await inputState.lifecycle.ensureConverged(inputOwner.signal);
+    } catch (error) {
+      if (!isAbortError(error, inputOwner.signal)) {
+        logger.debug(`MCP: keep-alive convergence failed before input: ${formatTerminalError(error)}`);
+      }
+    }
+  });
   pi.on("session_shutdown", async () => {
     ++lifecycleGeneration;
     const currentState = state;
@@ -15866,7 +16997,7 @@ function installMcpAdapter(pi, options) {
     }
   });
   pi.on("tool_result", (event) => toolErrorOverride(event.details));
-  pi.registerCommand("mcp", {
+  const registerMcpCommand = (commandName) => pi.registerCommand(commandName, {
     description: "Show MCP server status",
     getArgumentCompletions: (prefix) => {
       const normalized = prefix.trimStart();
@@ -15878,6 +17009,7 @@ function installMcpAdapter(pi, options) {
           { value: "prompts", label: "prompts \u2014 List all MCP prompts" },
           { value: "setup", label: "setup \u2014 Configure MCP servers" },
           { value: "logout", label: "logout \u2014 Clear server credentials" },
+          { value: "token", label: "token \u2014 Manage stored bearer tokens" },
           { value: "disable", label: "disable \u2014 Disable a server" },
           { value: "enable", label: "enable \u2014 Enable a server" },
           { value: "status", label: "status \u2014 Show server status" }
@@ -15885,7 +17017,18 @@ function installMcpAdapter(pi, options) {
         return subcommands.length > 0 ? subcommands : null;
       }
       const [, subcommand, argumentPrefix] = argumentMatch;
-      if (subcommand !== "reconnect" && subcommand !== "logout" && subcommand !== "disable" && subcommand !== "enable" || argumentPrefix === void 0 || !state) return null;
+      if (subcommand !== "reconnect" && subcommand !== "logout" && subcommand !== "disable" && subcommand !== "enable" && subcommand !== "token" || argumentPrefix === void 0 || !state) return null;
+      if (subcommand === "token") {
+        const tokenMatch = argumentPrefix.trimStart().match(/^(set|remove|status)\s+(.*)$/);
+        if (!tokenMatch) {
+          const actions = ["set", "remove", "status"].filter((action2) => action2.startsWith(argumentPrefix.trimStart())).map((action2) => ({ value: `token ${action2} `, label: `${action2} \u2014 Bearer token ${action2}` }));
+          return actions.length > 0 ? actions : null;
+        }
+        const action = tokenMatch[1] ?? "";
+        const serverPrefix = tokenMatch[2] ?? "";
+        const servers2 = Object.keys(state.config.mcpServers).filter((serverName) => serverName.startsWith(serverPrefix.trimStart())).map((serverName) => ({ value: `token ${action} ${serverName}`, label: serverName }));
+        return servers2.length > 0 ? servers2 : null;
+      }
       const servers = Object.keys(state.config.mcpServers).filter((serverName) => serverName.startsWith(argumentPrefix.trimStart())).map((serverName) => ({ value: `${subcommand} ${serverName}`, label: serverName }));
       return servers.length > 0 ? servers : null;
     },
@@ -15956,6 +17099,21 @@ function installMcpAdapter(pi, options) {
           await logoutServer(serverName, state, commandCtx);
           break;
         }
+        case "token": {
+          const action = parts[1];
+          const serverName = parts.slice(2).join(" ");
+          if (action !== "set" && action !== "remove" && action !== "status") {
+            if (commandCtx.hasUI) commandCtx.ui?.notify("Usage: /mcp token set|remove|status <server>", "error");
+            return;
+          }
+          if (!serverName) {
+            if (commandCtx.hasUI) commandCtx.ui?.notify("Usage: /mcp token set|remove|status <server>", "error");
+            return;
+          }
+          commandOwner?.throwIfInactive();
+          await manageBearerToken(action, serverName, state, commandCtx);
+          break;
+        }
         case "disable":
         case "enable": {
           const serverName = rest;
@@ -16006,6 +17164,8 @@ function installMcpAdapter(pi, options) {
       }
     }
   });
+  registerMcpCommand("mcp");
+  registerMcpCommand("pi-mcp");
   pi.registerCommand("mcp-auth", {
     description: "Authenticate with an MCP server (OAuth)",
     handler: async (args, ctx) => {
@@ -16127,12 +17287,12 @@ function installMcpAdapter(pi, options) {
       renderResult: renderMcpToolResult2,
       async execute(_toolCallId, params, signal, _onUpdate, _ctx) {
         const executeOwner = currentOwner;
-        let parsedArgs;
-        if (params.args !== void 0 && params.args !== "") {
+        const parseArgs = (value) => {
+          if (value === void 0 || value === "") return void 0;
           let args;
-          if (typeof params.args === "string") {
+          if (typeof value === "string") {
             try {
-              args = JSON.parse(params.args);
+              args = JSON.parse(value);
             } catch (error) {
               if (error instanceof SyntaxError) {
                 throw new Error(`Invalid args JSON: ${error.message}`, { cause: error });
@@ -16140,13 +17300,49 @@ function installMcpAdapter(pi, options) {
               throw error;
             }
           } else {
-            args = params.args;
+            args = value;
           }
           if (typeof args !== "object" || args === null || Array.isArray(args)) {
             const gotType = Array.isArray(args) ? "array" : args === null ? "null" : typeof args;
             throw new Error(`Invalid args: expected a JSON object, got ${gotType}`);
           }
-          parsedArgs = args;
+          return args;
+        };
+        const validateNestedGatewayParams = (value) => {
+          for (const key of ["tool", "connect", "describe", "instructions", "search", "server", "action"]) {
+            if (value[key] !== void 0 && typeof value[key] !== "string") {
+              throw new Error(`Invalid nested gateway param \`${key}\`: expected string, got ${Array.isArray(value[key]) ? "array" : typeof value[key]}`);
+            }
+          }
+          for (const key of ["regex", "includeSchemas"]) {
+            if (value[key] !== void 0 && typeof value[key] !== "boolean") {
+              throw new Error(`Invalid nested gateway param \`${key}\`: expected boolean, got ${Array.isArray(value[key]) ? "array" : typeof value[key]}`);
+            }
+          }
+          for (const key of ["limit", "offset"]) {
+            if (value[key] !== void 0 && typeof value[key] !== "number") {
+              throw new Error(`Invalid nested gateway param \`${key}\`: expected number, got ${Array.isArray(value[key]) ? "array" : typeof value[key]}`);
+            }
+          }
+          const args = value.args;
+          if (args !== void 0 && typeof args !== "string" && (typeof args !== "object" || args === null || Array.isArray(args))) {
+            throw new Error(`Invalid nested gateway param \`args\`: expected JSON object or JSON string, got ${Array.isArray(args) ? "array" : args === null ? "null" : typeof args}`);
+          }
+          return value;
+        };
+        let parsedArgs = parseArgs(params.args);
+        let dispatchParams = params;
+        const hasGatewayMode = (value) => value.tool !== void 0 || value.connect !== void 0 || value.describe !== void 0 || value.instructions !== void 0 || value.search !== void 0 || value.server !== void 0 || value.action !== void 0;
+        if (!hasGatewayMode(params) && parsedArgs) {
+          const nestedParams = validateNestedGatewayParams(parsedArgs);
+          if (hasGatewayMode(nestedParams)) {
+            dispatchParams = nestedParams;
+            parsedArgs = parseArgs(nestedParams.args);
+          } else {
+            throw new Error('Gateway params were nested inside `args`; pass them top-level (for example, mcp({ search: "..." }) or mcp({ tool: "...", args: {} })).');
+          }
+        } else if (!hasGatewayMode(params) && params.args !== void 0) {
+          throw new Error('Gateway params were nested inside `args`; pass them top-level (for example, mcp({ search: "..." }) or mcp({ tool: "...", args: {} })).');
         }
         if (!state && initPromise) {
           try {
@@ -16175,20 +17371,20 @@ function installMcpAdapter(pi, options) {
           };
         }
         executeOwner?.throwIfInactive();
-        if (params.action === "ui-messages") {
+        if (dispatchParams.action === "ui-messages") {
           return executeUiMessages(state);
         }
-        if (params.action === "auth-start") {
-          if (!params.server) {
+        if (dispatchParams.action === "auth-start") {
+          if (!dispatchParams.server) {
             return {
               content: [{ type: "text", text: 'auth-start requires `server`. Example: mcp({ action: "auth-start", server: "linear-server" })' }],
               details: { mode: "auth-start", error: "missing_server" }
             };
           }
-          return signal ? executeAuthStart(state, params.server, signal) : executeAuthStart(state, params.server);
+          return signal ? executeAuthStart(state, dispatchParams.server, signal) : executeAuthStart(state, dispatchParams.server);
         }
-        if (params.action === "auth-complete") {
-          if (!params.server) {
+        if (dispatchParams.action === "auth-complete") {
+          if (!dispatchParams.server) {
             return {
               content: [{ type: "text", text: "auth-complete requires `server`." }],
               details: { mode: "auth-complete", error: "missing_server" }
@@ -16201,27 +17397,27 @@ function installMcpAdapter(pi, options) {
               details: { mode: "auth-complete", error: "missing_input" }
             };
           }
-          return signal ? executeAuthComplete(state, params.server, input, signal) : executeAuthComplete(state, params.server, input);
+          return signal ? executeAuthComplete(state, dispatchParams.server, input, signal) : executeAuthComplete(state, dispatchParams.server, input);
         }
-        if (params.tool) {
-          return executeCall(state, params.tool, parsedArgs, params.server, getPiTools, signal);
+        if (dispatchParams.tool) {
+          return executeCall(state, dispatchParams.tool, parsedArgs, dispatchParams.server, getPiTools, signal);
         }
-        if (params.connect) {
-          const result = await executeConnect(state, params.connect, signal);
+        if (dispatchParams.connect) {
+          const result = await executeConnect(state, dispatchParams.connect, signal);
           syncToolSurface(_ctx);
           return result;
         }
-        if (params.describe) {
-          return executeDescribe(state, params.describe);
+        if (dispatchParams.describe) {
+          return executeDescribe(state, dispatchParams.describe);
         }
-        if (params.instructions) {
-          return executeInstructions(state, params.instructions);
+        if (dispatchParams.instructions) {
+          return executeInstructions(state, dispatchParams.instructions);
         }
-        if (params.search !== void 0) {
-          return executeSearch(state, params.search, params.regex, params.server, params.includeSchemas, params.limit, params.offset);
+        if (dispatchParams.search !== void 0) {
+          return executeSearch(state, dispatchParams.search, dispatchParams.regex, dispatchParams.server, dispatchParams.includeSchemas, dispatchParams.limit, dispatchParams.offset);
         }
-        if (params.server) {
-          return executeList(state, params.server);
+        if (dispatchParams.server) {
+          return executeList(state, dispatchParams.server);
         }
         return executeStatus(state);
       }
@@ -16269,11 +17465,20 @@ function createMcpAdapter(options = {}) {
     });
   };
 }
+function registerMcpServer(options) {
+  const { pi, name, definition } = options;
+  const register = runtimeRegistrars.get(pi);
+  if (!register) {
+    throw new Error("pi-mcp-adapter is not installed for this Pi instance");
+  }
+  return register(name, definition);
+}
 var index_default = createMcpAdapter();
 export {
   MCP_STATUS_EVENT,
   MCP_STATUS_SNAPSHOT_VERSION,
   MCP_TOOL_APPROVAL_REQUEST_EVENT,
   createMcpAdapter,
-  index_default as default
+  index_default as default,
+  registerMcpServer
 };