@superblocksteam/gateway 2.0.166 → 2.0.168-next.0

package/dist/transports/mcp/mount.js

@@ -5,6 +5,8 @@ import { z } from "zod";
 import { assertEnterprisePlan, EntitlementError, } from "@superblocksteam/mcp-server";
 import { getIntegrationMetadata } from "../../capabilities/integration-metadata.js";
 import { askUser, checkAppProgress, checkPublishProgress, editApp, getApp, getPreviewStatus, previewApp, publishApp, publishAppInput, startApp, uploadArtifact, } from "../../capabilities/lifecycle.js";
+import { LiveStateAttaches } from "../../capabilities/live-state-attaches.js";
+import { ToolPermissionReply } from "../../capabilities/tool-permission-reply.js";
 import { IMPORT_ZIP_BASE64_MAX_CHARS } from "../../capabilities/types.js";
 import { HOST_BROWSER_TOOLS_COWORK, HOST_BROWSER_TOOLS_UNKNOWN, } from "../../capture/browser-contract.js";
 import { BROWSER_DRIVER_INSTRUCTIONS } from "../../capture/browser-instructions.js";
@@ -12,17 +14,18 @@ import { captureLibraryScreenshotWithPlaywright } from "../../capture/capture-li
 import { withCoworkEditorHost } from "../../capture/cowork-editor-url.js";
 import { gatewayDebug, gatewayDebugStack } from "../../debug.js";
 import { capturePreviewScreenshotWithPlaywright } from "../../preview/capture-screenshot.js";
+import { createStores } from "../../stores/memory.js";
 import { registerAdminTools } from "./admin-tools.js";
 import { APP_STATUS_HTML, APP_STATUS_RESOURCE_URI } from "./app-status-html.js";
-import { clientPresentationCapabilities, } from "./client-presentation.js";
-import { APP_DECISION_HTML, APP_DECISION_RESOURCE_URI, CONFIRM_PLAN_APPROVAL_TOOL, PLAN_APPROVAL_TOKEN_META_KEY, } from "./decision-card-html.js";
+import { clientPresentationCapabilities, collectsUserApproval, } from "./client-presentation.js";
+import { APP_DECISION_HTML, APP_DECISION_RESOURCE_URI, CONFIRM_PLAN_APPROVAL_TOOL, PLAN_APPROVAL_TOKEN_META_KEY, PLAN_MARKUP_META_KEY, } from "./decision-card-html.js";
 import { clientSupportsFormElicitation, elicitDecision, pendingDecision, resolveDecisionByElicitation, resultApplicationId, resultBranch, } from "./decision-elicitation.js";
 import { createEditorDocumentProbe, } from "./editor-document-probe.js";
 import { EDITOR_SETUP_RECENT_APP_WINDOW_MS, editorIntegrationSetupUrl, } from "./editor-integration-setup-url.js";
-import { formatMcpToolContent } from "./format-tool-content.js";
+import { formatMcpToolContent, withDisplayedMentions, } from "./format-tool-content.js";
 import { attachAgentInstructions, instructionFor, } from "./instructions/index.js";
 import { isRecord, readResult } from "./instructions/result.js";
-import { APP_LOAD_CHECK, COWORK_BROWSER_TOOLSEARCH, } from "./instructions/tools/copy.js";
+import { APP_LOAD_CHECK, COWORK_BROWSER_TOOLSEARCH, PLAIN_HOST_TOOL_PERMISSION, } from "./instructions/tools/copy.js";
 import { NativeBrowserPresence, nativeBrowserPresenceDirectory, } from "./native-browser-presence.js";
 import { planApprovalDirectory, PlanApprovalChallenges, } from "./plan-approval.js";
 import { createProgressNotifier } from "./progress-notifier.js";
@@ -96,18 +99,20 @@ function plansMatch(left, right) {
         left.plan === right.plan &&
         left.title === right.title);
 }
-// Narration before a plan or question reads like model reasoning, which trips
-// Claude's reasoning_extraction safeguard when a host repeats it.
+const NARRATED_DECISIONS = new Set(["multi_choice", "plan", "tool_permission"]);
+// Narration before a plan, question, or permission reads like model reasoning,
+// which trips Claude's reasoning_extraction safeguard when a host repeats it.
 function withoutDecisionNarration(result, progress) {
-    // Only a plan or question changes; every other result passes through as is.
+    // Only such a decision changes; every other result passes through as is.
     const { decisionKind, status, value: flat } = readResult(result);
     if (result.kind !== "ok" ||
         status !== "needs_decision" ||
-        (decisionKind !== "plan" && decisionKind !== "multi_choice")) {
+        !decisionKind ||
+        !NARRATED_DECISIONS.has(decisionKind)) {
         return result;
     }
     const { activity: _activity, reply: _reply, ...value } = flat;
-    // On a plan or question, drop the lead-up lines checkAppProgress also sent as progress events.
+    // Drop the lead-up lines checkAppProgress also sent as progress events.
     for (let index = progress.length - 1; index >= 0; index -= 1) {
         if (progress[index]?.type === "progress") {
             progress.splice(index, 1);
@@ -115,22 +120,38 @@ function withoutDecisionNarration(result, progress) {
     }
     return { ...result, value };
 }
-function deliveredNativePlan(result) {
-    const value = result
-        ?.structuredContent;
-    if (!value || typeof value !== "object") {
+function deliveredNativeDecision(result) {
+    if (!isRecord(result) || !isRecord(result.structuredContent)) {
         return undefined;
     }
-    const delivered = value;
-    return delivered.status === "needs_decision" &&
-        typeof delivered.applicationId === "string" &&
-        delivered.decision?.kind === "plan"
-        ? {
-            applicationId: delivered.applicationId,
-            plan: planFromDecision(typeof delivered.branch === "string" ? delivered.branch : undefined, delivered.decision),
-        }
+    const delivered = {
+        kind: "ok",
+        value: result.structuredContent,
+    };
+    const shown = pendingDecision(delivered);
+    const planMarkup = isRecord(result._meta)
+        ? result._meta[PLAN_MARKUP_META_KEY]
+        : undefined;
+    // structuredContent carries the display plan; approvals match the tagged one.
+    const decision = shown?.kind === "plan" && typeof planMarkup === "string"
+        ? { ...shown, plan: planMarkup }
+        : shown;
+    const applicationId = resultApplicationId(delivered);
+    return decision && applicationId
+        ? { applicationId, branch: resultBranch(delivered), decision }
         : undefined;
 }
+function deliveredApprovalMatches(target, delivered) {
+    if (target.applicationId !== delivered.applicationId ||
+        target.branch !== delivered.branch) {
+        return false;
+    }
+    return target.kind === "plan"
+        ? delivered.decision.kind === "plan" &&
+            plansMatch(target.plan, planFromDecision(delivered.branch, delivered.decision))
+        : delivered.decision.kind === "tool_permission" &&
+            target.messageId === delivered.decision.messageId;
+}
 function rememberDisplayedPlan(appState, applicationId, branch, decision) {
     if (!applicationId) {
         return undefined;
@@ -150,16 +171,15 @@ function rememberDisplayedPlan(appState, applicationId, branch, decision) {
 }
 /**
  * Builds the principal from the CLI session this Gateway was started with.
- * Identity is the already-logged-in Superblocks user; there is no second PAT
- * and no OAuth authInfo on stdio.
+ * OAuth sessions resolve their current credential before each tool call.
  *
  * When `cliIdentity` is already known, it is handed over fully resolved so no
  * capability spends a `/users/me` round trip (ENG-5806). Otherwise
  * `ensurePrincipal` resolves it once through the guarded identity read.
  */
-function principalFrom(deps) {
+async function principalFrom(deps) {
     return {
-        apiKey: deps.cliApiKey,
+        apiKey: deps.getAccessToken ? await deps.getAccessToken() : deps.cliApiKey,
         ...(deps.cliIdentity ?? {}),
     };
 }
@@ -195,6 +215,8 @@ The user you are interacting with is a non-technical business user. Keep discuss
 
 Use these tools whenever the user asks to build, change, import, or ship an app, whichever of those names they reach for. They can also inspect what data the org has rather than building an app to explore it: list_integrations names the datasources, and get_integration_metadata reads the tables and columns inside one. Create a persistent app or API only when the user explicitly asks for one.
 
+For app-behavior questions, debugging questions, and investigation of bug reports, call edit_app in Plan mode with the user's words verbatim. When no decision is pending, Superblocks can answer without changing the app or requiring plan approval. While a plan or question is pending (needs_decision), a new prompt revises that plan or answers that question, so settle that decision first, or ask the user whether their question should change the plan. Prefer this route over get_application_structure unless the user explicitly asks to inspect source files. When a Plan-mode question ends as no_changes with a reply and no pendingAction on check_app_progress or get_app, Superblocks answered it: report that reply and stop. Every other no_changes carries a pendingAction to follow.
+
 After create_integration creates an integration or list_integrations selects one for an app, include the returned mention unchanged in the next edit_app prompt. The mention gives Superblocks the exact integration ID; do not construct one from the display name.
 
 Superblocks is itself an agent, not a code library: prompts sent through start_app and edit_app are handed to it verbatim, and it decides how to build the application. Your role is to facilitate the user's interaction with Superblocks, not to build anything yourself — pass the user's own request through unchanged, without inventing, embellishing, or adding requirements, scope, or design detail they did not ask for.
@@ -215,13 +237,13 @@ For a migrated app with missing integrations, call list_integrations first. Reus
 
 This connector is the single Superblocks MCP: Builder tools (upload_artifact, start_app, edit_app, check_app_progress, ask_user, get_app, build_app, publish_app, check_publish_progress) and Admin tools (integrations, apps, users, folders, deploy_application, and the rest of the customer Admin surface) share this endpoint. Prefer create_integration / list_integrations here over sending the user to a second MCP. create_integration takes name, plugin_id, and configuration, never the raw integrations API envelope. create_integration is Admin CRUD for org datasources; start_app creates an application and hands it a prompt. deploy_application is Admin deploy of an existing commit; publish_app is the Builder path that commits current work and waits for it to go live. Omit base_url on Admin tools unless targeting a different control plane. checkout_application is not exposed on this network surface (host filesystem writes); use the CLI/workspace checkout path instead.
 
-This connection is already authenticated against one Superblocks Server — there is no setup, login, or auth-status call to make first. Call the tool that does the job and read its error if something is genuinely wrong; there is no tool that reports credentials or environments.
+This connection may be established before browser sign-in. Call the tool that does the user's job. If it reports "MCP browser login required" or "Saved Superblocks login changed outside this task", explicitly call login when available, then retry the requested tool in this current task. Account-dependent tools never start browser sign-in themselves. Do not ask the user to restart Claude. Do not call whoami as a preflight. If the user asks which Superblocks account is in use, call whoami. If the user asks to sign in or switch accounts, call login when available. If the user asks to change the Superblocks server, use a native question form when available to confirm https://app.superblocks.com or collect another server URL, then call set_server; continue in the current Cowork task after sign-in succeeds. Report the sign-in status from set_server's result; a successful whoami does not show whether browser sign-in occurred.
 
 Never tell the user to restart the MCP server; keep the MCP server running.
 
 A cancelled tool call does not undo work Superblocks already did. The application still exists; read applicationId on the error and follow agentInstructions (or pendingAction) instead of starting over.
 
-get_app's previewUrl opens the current development app with existing app permissions; it is not a published end-user URL. For a requested live-preview link, return that exact URL; do not open Share, change permissions, invite anyone, or publish. Call build_app only when the user explicitly requests an unpublished build or a shareable versioned preview, never automatically after an ordinary app creation, edit, or get_app. It creates a commit preview without publishing; retain its previewUrl and use get_preview_status for subsequent checks. If a sharing request is ambiguous (including "Can I share this app?"), ask before calling any tools whether they mean live preview, an unpublished commit preview, or publishing. Access permissions and deployment history cannot resolve this intent; an empty deployment history does not mean publishing is required to share a preview. Call publish_app or deploy_application only when the user explicitly asks to publish or deploy. Otherwise prefer MCP Apps Open editor / Open preview buttons over dumping editUrl / previewUrl / publishUrl into chat, especially preview JWTs. Claude Desktop can only openLink https URLs; when a URL is http, say so and rely on any screenshot instead.
+get_app's previewUrl opens the current development app with existing app permissions; it is not a published end-user URL. Live-editor previews, including fullscreen links, require app edit/build permission (apps:update); End-User or READ access alone is insufficient. For a requested live-preview link, return that exact URL; do not open Share, change permissions, invite anyone, or publish. Call build_app only when the user explicitly requests an unpublished build or a shareable versioned preview, never automatically after an ordinary app creation, edit, or get_app. It creates a commit preview without publishing; retain its previewUrl and use get_preview_status for subsequent checks. If a sharing request is ambiguous (including "Can I share this app?"), ask before calling any tools whether they mean live preview, an unpublished commit preview, or publishing. Access permissions and deployment history cannot resolve this intent; an empty deployment history does not mean publishing is required to share a preview. Call publish_app or deploy_application only when the user explicitly asks to publish or deploy. Publishing does not extend the hosting environment's lifetime; URLs in ephemeral environments remain temporary. Otherwise prefer MCP Apps Open editor / Open preview buttons over dumping editUrl / previewUrl / publishUrl into chat, especially preview JWTs. Claude Desktop can only openLink https URLs; when a URL is http, say so and rely on any screenshot instead.
 
 ${BROWSER_DRIVER_INSTRUCTIONS}`;
 const COWORK_EMBEDDED_BROWSER_TOOLS = `Load your browser pane tools, you will need them. Call ToolSearch with query ${COWORK_BROWSER_TOOLSEARCH}. When a check_app_progress or get_app result includes browserNavigation, ensure its exact URL is open in Cowork's embedded Page browser before any other action. If that app is already open, do not reload it; otherwise, focus the Page URL field, enter that exact URL, and press Enter. Verify the app loaded; normal authentication or canonical URL redirects are allowed. A blank tab is insufficient. Keep the Page open so the user can watch the live canvas update.`;
@@ -261,13 +283,13 @@ function withClientInstructions(message, client) {
 /**
  * The MCP server behind one stdio session.
  *
- * Tools run as the already-logged-in CLI user. There is no per-request OAuth
- * token to expire independently of the process.
+ * Tools run as the authenticated Superblocks user.
  */
 export function createMcpServer(deps, probeEditorDocument = createEditorDocumentProbe()) {
     // `cliIdentity` is optional and the stdio runtime does not set it, so the
     // only identity this session has is whatever a capability already resolved.
     let resolvedIdentity;
+    const liveStateAttaches = new LiveStateAttaches();
     const context = async (progress, notify, signal) => ({
         appState: deps.appState,
         captureLibraryScreenshot: captureLibraryScreenshotWithPlaywright,
@@ -276,6 +298,7 @@ export function createMcpServer(deps, probeEditorDocument = createEditorDocument
         hostBrowserTools: clientPresentationCapabilities(server.server.getClientVersion()).hasNativeBrowser
             ? HOST_BROWSER_TOOLS_COWORK
             : HOST_BROWSER_TOOLS_UNKNOWN,
+        liveStateAttaches,
         onProgress: (event) => {
             progress.push(event);
             notify?.(event.message);
@@ -287,7 +310,7 @@ export function createMcpServer(deps, probeEditorDocument = createEditorDocument
             };
             deps.mcpTelemetry?.setOrganizationId(principal.organizationId);
         },
-        principal: principalFrom(deps),
+        principal: await principalFrom(deps),
         progress: deps.progress,
         recentApps: deps.recentApps,
         server: deps.server,
@@ -317,7 +340,7 @@ export function createMcpServer(deps, probeEditorDocument = createEditorDocument
         const progress = [];
         const notify = createProgressNotifier(extra);
         const execute = async () => {
-            if (!deps.cliApiKey) {
+            if (!deps.cliApiKey && !deps.getAccessToken) {
                 gatewayDebug("tool short-circuited", {
                     "tool.name": toolName,
                     "tool.reason": "missing_cli_session",
@@ -329,16 +352,17 @@ export function createMcpServer(deps, probeEditorDocument = createEditorDocument
                 };
             }
             try {
-                if (!deps.config.localAgentMode) {
-                    // Same ENTERPRISE/POC gate as Admin tools; skipped for local-agent.
-                    await assertEnterprisePlan(deps.config.serverUrl.replace(/\/$/, ""), deps.cliApiKey);
-                }
                 // The SDK aborts this on `notifications/cancelled` and on a dropped
                 // connection. Handing it to the capability is what turns "the host
                 // stopped listening" into "stop waiting", instead of leaving a timer
                 // and a waiter running for an answer nobody will read.
                 const signal = extra?.signal;
                 const capabilityContext = await context(progress, notify, signal);
+                signal?.throwIfAborted();
+                if (!deps.config.localAgentMode) {
+                    // Same ENTERPRISE/POC gate as Admin tools; skipped for local-agent.
+                    await assertEnterprisePlan(deps.config.serverUrl.replace(/\/$/, ""), capabilityContext.principal.apiKey);
+                }
                 return await capability(capabilityContext, () => {
                     for (let index = progress.length - 1; index >= 0; index -= 1) {
                         if (progress[index]?.type === "completed") {
@@ -405,25 +429,31 @@ export function createMcpServer(deps, probeEditorDocument = createEditorDocument
         });
         // structuredContent lets MCP Apps hosts hand the capability value to the
         // status card without making it re-parse the JSON text block.
-        const structuredContent = result.kind === "ok" &&
-            result.value &&
-            typeof result.value === "object" &&
-            !Array.isArray(result.value)
+        const displayed = withDisplayedMentions(result);
+        const structuredContent = displayed.kind === "ok" &&
+            displayed.value &&
+            typeof displayed.value === "object" &&
+            !Array.isArray(displayed.value)
             ? (() => {
-                const value = { ...result.value };
+                const value = { ...displayed.value };
                 delete value.screenshotBase64;
                 return value;
             })()
             : undefined;
+        const planMarkup = displayed !== result ? pendingDecision(result) : undefined;
         return {
             content: formatMcpToolContent(result, progress, profile),
             ...(structuredContent ? { structuredContent } : {}),
+            ...(planMarkup?.kind === "plan"
+                ? { _meta: { [PLAN_MARKUP_META_KEY]: planMarkup.plan } }
+                : {}),
         };
     };
     const clientProfileFor = () => {
         const presentation = clientPresentationCapabilities(server.server.getClientVersion());
         return {
             ...presentation,
+            supportsDecisionCard: clientSupportsDecisionCard(),
             supportsFormElicitation: clientSupportsFormElicitation(server.server.getClientCapabilities()),
         };
     };
@@ -434,19 +464,46 @@ export function createMcpServer(deps, probeEditorDocument = createEditorDocument
         title: "Superblocks",
         version: "0.0.1",
     }, { instructions: SERVER_INSTRUCTIONS });
-    const planApprovals = new PlanApprovalChallenges({
-        directory: planApprovalDirectory(deps.cliApiKey, deps.config.serverUrl),
+    let planApprovals = new PlanApprovalChallenges({
+        directory: planApprovalDirectory(deps.sessionKey ?? deps.cliApiKey, deps.config.serverUrl),
     });
-    const nativeBrowsers = new NativeBrowserPresence({
-        directory: nativeBrowserPresenceDirectory(deps.cliApiKey, deps.config.serverUrl),
+    let nativeBrowsers = new NativeBrowserPresence({
+        directory: nativeBrowserPresenceDirectory(deps.sessionKey ?? deps.cliApiKey, deps.config.serverUrl),
     });
-    const nativePlanApprovals = new Map();
-    const pendingNativePlanApprovals = new Map();
+    const nativeDecisionApprovals = new Map();
+    const pendingNativeDecisionApprovals = new Map();
     let announcedNativeBrowser = false;
     let stopWatchingNativeBrowsers;
     let askUserTool;
     let confirmPlanApprovalTool;
     let publishAppTool;
+    const resetForLogin = (sessionKey) => {
+        deps.sessionPeer.resetForLogin();
+        deps.appState.reset();
+        const stores = createStores();
+        deps.progress = stores.progress;
+        deps.recentApps = stores.recentApps;
+        deps.stepUpTurns = stores.stepUpTurns;
+        resolvedIdentity = undefined;
+        nativeDecisionApprovals.clear();
+        pendingNativeDecisionApprovals.clear();
+        stopWatchingNativeBrowsers?.();
+        if (announcedNativeBrowser)
+            nativeBrowsers.withdraw();
+        deps.sessionKey = sessionKey;
+        planApprovals = new PlanApprovalChallenges({
+            directory: planApprovalDirectory(sessionKey, deps.config.serverUrl),
+        });
+        nativeBrowsers = new NativeBrowserPresence({
+            directory: nativeBrowserPresenceDirectory(sessionKey, deps.config.serverUrl),
+        });
+        if (announcedNativeBrowser)
+            nativeBrowsers.announce();
+        else if (clientSupportsAppCard() && nativeBrowsers.active()) {
+            stopWatchingNativeBrowsers =
+                nativeBrowsers.whenInactive(enableStatusCards);
+        }
+    };
     const statusCardTools = [];
     const enableStatusCards = () => {
         for (const tool of statusCardTools) {
@@ -457,23 +514,23 @@ export function createMcpServer(deps, probeEditorDocument = createEditorDocument
     const clientSupportsDecisionCard = () => !clientPresentationCapabilities(server.server.getClientVersion())
         .hasNativeAskForm && clientSupportsAppCard();
     server.onResultDelivered = (result, requestId) => {
-        const deliveredPlan = deliveredNativePlan(result);
-        if (deliveredPlan) {
-            const pending = pendingNativePlanApprovals.get(deliveredPlan.applicationId);
+        const delivered = deliveredNativeDecision(result);
+        if (delivered) {
+            const pending = pendingNativeDecisionApprovals.get(delivered.applicationId);
             if (pending?.requestId === requestId &&
-                plansMatch(pending.plan, deliveredPlan.plan)) {
-                pendingNativePlanApprovals.delete(deliveredPlan.applicationId);
-                nativePlanApprovals.set(deliveredPlan.applicationId, pending.plan);
+                deliveredApprovalMatches(pending.target, delivered)) {
+                pendingNativeDecisionApprovals.delete(delivered.applicationId);
+                nativeDecisionApprovals.set(delivered.applicationId, pending.target);
             }
         }
     };
     server.onResultDeliveryFailed = (result, requestId) => {
-        const deliveredPlan = deliveredNativePlan(result);
-        if (deliveredPlan) {
-            const pending = pendingNativePlanApprovals.get(deliveredPlan.applicationId);
+        const delivered = deliveredNativeDecision(result);
+        if (delivered) {
+            const pending = pendingNativeDecisionApprovals.get(delivered.applicationId);
             if (pending?.requestId === requestId &&
-                plansMatch(pending.plan, deliveredPlan.plan)) {
-                pendingNativePlanApprovals.delete(deliveredPlan.applicationId);
+                deliveredApprovalMatches(pending.target, delivered)) {
+                pendingNativeDecisionApprovals.delete(delivered.applicationId);
             }
         }
     };
@@ -574,25 +631,29 @@ export function createMcpServer(deps, probeEditorDocument = createEditorDocument
             ? { planAction: "approve" }
             : answer.kind === "refine"
                 ? { planAction: "refine", prompt: answer.feedback }
-                : { prompt: answer.prompt }),
+                : {
+                    permissionMessageId: answer.permissionMessageId,
+                    prompt: answer.prompt,
+                }),
     }, answer.kind === "approve" ? approvedPlan : undefined);
-    const stageNativePlanApproval = (result, requestId) => {
+    const stageNativeDecisionApproval = (result, requestId) => {
         const decision = pendingDecision(result);
         const applicationId = resultApplicationId(result);
         if (!clientProfileFor().hasNativeAskForm || !decision || !applicationId) {
             return;
         }
-        nativePlanApprovals.delete(applicationId);
-        if (decision.kind !== "plan") {
-            pendingNativePlanApprovals.delete(applicationId);
+        nativeDecisionApprovals.delete(applicationId);
+        pendingNativeDecisionApprovals.delete(applicationId);
+        const branch = resultBranch(result);
+        if (decision.kind === "plan" &&
+            !rememberDisplayedPlan(deps.appState, applicationId, branch, decision)) {
             return;
         }
-        const plan = rememberDisplayedPlan(deps.appState, applicationId, resultBranch(result), decision);
-        if (plan) {
-            pendingNativePlanApprovals.set(applicationId, { plan, requestId });
-        }
-        else {
-            pendingNativePlanApprovals.delete(applicationId);
+        const target = PlanApprovalChallenges.currentTarget(deps.appState, applicationId, branch);
+        if (target &&
+            (target.kind === "plan" || target.decision?.decision === decision) &&
+            deliveredApprovalMatches(target, { applicationId, branch, decision })) {
+            pendingNativeDecisionApprovals.set(applicationId, { target, requestId });
         }
     };
     /**
@@ -623,7 +684,9 @@ export function createMcpServer(deps, probeEditorDocument = createEditorDocument
         const { hasNativeAskForm } = profile;
         // Which surface the agent should ask on is a property of the host, not of
         // whether this particular poll managed to show a form.
-        const agentInstructions = decision.kind === "plan" || decision.kind === "multi_choice"
+        const agentInstructions = decision.kind === "plan" ||
+            decision.kind === "multi_choice" ||
+            decision.kind === "tool_permission"
             ? instructionFor("check_app_progress", result, profile)
             : undefined;
         const instructionsChosen = agentInstructions
@@ -647,7 +710,7 @@ export function createMcpServer(deps, probeEditorDocument = createEditorDocument
             ? rememberDisplayedPlan(context.appState, decidedApp, decidedBranch, decision)
             : undefined;
         if (!clientSupportsFormElicitation(server.server.getClientCapabilities())) {
-            stageNativePlanApproval(result, extra.requestId);
+            stageNativeDecisionApproval(result, extra.requestId);
             gatewayDebug("progress decision flow finished", {
                 "decision.kind": decision.kind,
                 "decision.instructions": instructionsChosen,
@@ -678,6 +741,195 @@ export function createMcpServer(deps, probeEditorDocument = createEditorDocument
         });
         return resolved ?? unresolvedDecision();
     };
+    server.registerTool("whoami", {
+        annotations: READ_ONLY_TOOL_ANNOTATIONS,
+        description: "Show the Superblocks user and organization for this connection. Use when the user asks which account is in use, not before every task. If sign-in is needed, call Login explicitly.",
+        inputSchema: {},
+        title: "Current Superblocks Account",
+    }, async (_input, extra) => {
+        try {
+            const principal = await principalFrom(deps);
+            extra.signal?.throwIfAborted();
+            const identity = await deps.server.validateApiKey(principal.apiKey);
+            if (!identity) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: "Superblocks login is not valid. Use the Login tool if available.",
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `User: ${identity.email ?? identity.userId}\nOrganization: ${identity.organizationName ?? identity.organizationId}\nOrganization ID: ${identity.organizationId}\nUser ID: ${identity.userId}`,
+                    },
+                ],
+            };
+        }
+        catch (error) {
+            const message = error instanceof Error &&
+                error.message.startsWith("Saved Superblocks login changed outside this task.")
+                ? "Saved Superblocks login changed outside this task. Call Login to confirm the account in this current task."
+                : error instanceof Error &&
+                    error.message.startsWith("MCP browser login required.")
+                    ? "MCP browser login required. Call Login to continue in this current task."
+                    : "Could not check the Superblocks account. Try again or use Login if available.";
+            if (message.startsWith("Could not check"))
+                console.error("gateway whoami failed", {
+                    errorType: error instanceof Error ? error.name : typeof error,
+                });
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: message,
+                    },
+                ],
+                isError: true,
+            };
+        }
+    });
+    if (deps.reconnect) {
+        server.registerTool("login", {
+            annotations: DESTRUCTIVE_TOOL_ANNOTATIONS,
+            description: "Open browser sign-in to log in or switch the Superblocks account. Call when the user explicitly asks or a tool reports MCP browser login required or Saved Superblocks login changed outside this task. The existing login remains saved if sign-in is cancelled. After success, continue in this Cowork task with the updated account.",
+            inputSchema: {},
+            title: "Login to Superblocks",
+        }, async (_input, extra) => {
+            try {
+                const sessionKey = await deps.reconnect(extra.signal);
+                resetForLogin(sessionKey);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: "Signed in to Superblocks. This current task now uses the updated account.",
+                        },
+                    ],
+                };
+            }
+            catch (error) {
+                if (error instanceof Error &&
+                    error.message === "MCP browser login cancelled.")
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: "Superblocks sign-in was cancelled. The saved login was not changed. Do not retry unless the user asks.",
+                            },
+                        ],
+                    };
+                console.error("gateway login failed", {
+                    errorType: error instanceof Error ? error.name : typeof error,
+                });
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: "Superblocks sign-in did not finish. The existing saved login was not replaced.",
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+        });
+    }
+    if (deps.setServerUrl) {
+        server.registerTool("set_server", {
+            annotations: DESTRUCTIVE_TOOL_ANNOTATIONS,
+            description: "Switch to a Superblocks server and save its origin across plugin updates. Call only when the user explicitly asks to configure or change the server. Ask for the server URL first. HTTPS is required except for localhost or loopback HTTP. Browser sign-in may open. Continue in this Cowork task after success.",
+            inputSchema: { server_url: z.string().min(1) },
+            title: "Set Superblocks Server",
+        }, async ({ server_url }, extra) => {
+            try {
+                const previousSessionKey = deps.sessionKey;
+                const previousServerUrl = deps.config.serverUrl;
+                const origin = new URL(server_url).origin;
+                const hostname = new URL(origin).hostname;
+                const firstParty = [
+                    "app.superblocks.com",
+                    "eu.superblocks.com",
+                    "app.superblockshq.com",
+                    "api.superblocks.link",
+                    "staging.superblocks.com",
+                    "superblocks.dev",
+                ].includes(hostname) || hostname.endsWith(".superblocks.dev");
+                if (!firstParty) {
+                    if (!clientSupportsFormElicitation(server.server.getClientCapabilities())) {
+                        throw new Error("Unrecognized Superblocks servers require a host confirmation form before sign-in.");
+                    }
+                    const choice = `Use ${origin}`;
+                    const confirmation = await elicitDecision(extra)({
+                        message: `Switch Superblocks to ${origin}? Continue only if you trust this server.`,
+                        mode: "form",
+                        requestedSchema: {
+                            properties: {
+                                confirmation: {
+                                    enum: [choice, "Cancel"],
+                                    type: "string",
+                                },
+                            },
+                            required: ["confirmation"],
+                            type: "object",
+                        },
+                    });
+                    if (confirmation.action !== "accept" ||
+                        confirmation.content?.confirmation !== choice) {
+                        throw new Error("Server change cancelled. The previous server remains active.");
+                    }
+                }
+                const { serverUrl, sessionKey } = await deps.setServerUrl(server_url, extra.signal);
+                if (serverUrl !== previousServerUrl ||
+                    sessionKey !== previousSessionKey)
+                    resetForLogin(sessionKey);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `Connected to Superblocks server ${serverUrl}. ${sessionKey === previousSessionKey ? "Existing sign-in reused; no new browser sign-in started." : "Browser sign-in completed."} This current task now uses it.`,
+                        },
+                    ],
+                };
+            }
+            catch (error) {
+                if (error instanceof Error &&
+                    (error.message ===
+                        "Server change cancelled. The previous server remains active." ||
+                        error.message === "MCP browser login cancelled."))
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: "Server change was cancelled. The previous server remains active. Do not retry unless the user asks.",
+                            },
+                        ],
+                    };
+                const message = error instanceof Error &&
+                    (error.message.startsWith("MCP server URL must") ||
+                        error.message.startsWith("Unrecognized Superblocks servers"))
+                    ? error.message
+                    : "Could not switch the Superblocks server. Try again.";
+                if (message.startsWith("Could not switch"))
+                    console.error("gateway set_server failed", {
+                        errorType: error instanceof Error ? error.name : typeof error,
+                    });
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: message,
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+        });
+    }
     // Cloud-Prem Admin laptop agent: this machine has no Playwright Chromium
     // and never opens a live-edit session, so the Builder surface (start_app,
     // edit_app, ...) is skipped entirely rather than registered and left to
@@ -778,7 +1030,7 @@ export function createMcpServer(deps, probeEditorDocument = createEditorDocument
         }), extra, { filePath, files, zipBase64 }));
         server.registerTool("edit_app", {
             annotations: DESTRUCTIVE_TOOL_ANNOTATIONS,
-            description: 'Forward a prompt to Superblocks for the recent or specified application. Pass the user\'s request directly as prompt, verbatim. DO NOT invent, embellish, or add requirements, scope, or design detail they did not ask for. This will cause Superblocks to do things the user did not ask for. Defaults to Plan mode on every call - an edit never inherits Build mode from an earlier turn. Pass mode "BUILD" only when the user asks for it explicitly (e.g. "use build mode" or "skip the plan") on this edit. Answering a multi_choice question is not skipping the plan: omit mode and stay in Plan until Superblocks has proposed a plan and the user approves it. The result reports the "mode" the turn ran in. When status was needs_decision with a plan and the user says "Build it" / approve / go ahead, call edit_app with planAction "approve" and omit prompt - do not put "approve" or "Build it" in prompt (that is refine feedback, not the Build-it path). Use planAction "refine" with their feedback as prompt to change the plan. Also use edit_app to answer multi_choice questions. Returns status "building"; follow with check_app_progress. When a later result includes "browserNavigation", open its exact URL in the browser pane and verify the app loaded. An error from this call still names the application it was working on in "applicationId". When migrating or resuming source uploaded with upload_artifact, or when Superblocks should read any other uploaded file, pass its returned artifact unchanged in artifacts.',
+            description: 'Forward a prompt to Superblocks for the recent or specified application. Pass the user\'s request directly as prompt, verbatim. DO NOT invent, embellish, or add requirements, scope, or design detail they did not ask for. This will cause Superblocks to do things the user did not ask for. For app-behavior questions, debugging questions, and investigation of bug reports, use Plan mode; when no plan or question is pending, Superblocks can answer without changing code or requiring plan approval. Requests to fix an app also default to Plan mode, so the user can approve proposed changes before implementation. Pass the user\'s words verbatim, and prefer this over reading source files yourself. Defaults to Plan mode on every call - an edit never inherits Build mode from an earlier turn. Pass mode "BUILD" only when the user asks for it explicitly (e.g. "use build mode" or "skip the plan") on this edit. Answering a multi_choice question is not skipping the plan: omit mode and stay in Plan until Superblocks has proposed a plan and the user approves it. The result reports the "mode" the turn ran in. When status was needs_decision with a plan and the user says "Build it" / approve / go ahead, call edit_app with planAction "approve" and omit prompt - do not put "approve" or "Build it" in prompt (that is refine feedback, not the Build-it path). Use planAction "refine" with their feedback as prompt to change the plan. Also use edit_app to answer multi_choice questions. Returns status "building"; follow with check_app_progress. When a later result includes "browserNavigation", open its exact URL in the browser pane and verify the app loaded. An error from this call still names the application it was working on in "applicationId". When migrating or resuming source uploaded with upload_artifact, or when Superblocks should read any other uploaded file, pass its returned artifact unchanged in artifacts.',
             inputSchema: {
                 applicationId: z.string().uuid().optional(),
                 artifacts: z.array(ARTIFACT_SCHEMA).min(1).max(20).optional(),
@@ -786,70 +1038,88 @@ export function createMcpServer(deps, probeEditorDocument = createEditorDocument
                 idempotencyKey: z.string().optional(),
                 mode: z.enum(["BUILD", "PLAN"]).optional(),
                 planAction: z.enum(["approve", "refine"]).optional(),
+                permissionMessageId: z
+                    .string()
+                    .min(1)
+                    .optional()
+                    .describe("For tool-permission responses, copy decision.messageId from the request shown to the user."),
                 prompt: z.string().min(1).optional(),
             },
             title: "Edit App",
-        }, async ({ applicationId, artifacts, branch, idempotencyKey, mode, planAction, prompt, }, extra) => run("edit_app", async (context) => {
+        }, async ({ applicationId, artifacts, branch, idempotencyKey, mode, planAction, permissionMessageId, prompt, }, extra) => run("edit_app", async (context) => {
             const { hasNativeAskForm } = clientPresentationCapabilities(server.server.getClientVersion());
-            const nativeApprovalApplicationId = planAction === "approve" && hasNativeAskForm
+            const approvalRequest = planAction === "approve"
+                ? { kind: "plan" }
+                : permissionMessageId &&
+                    prompt &&
+                    ToolPermissionReply.parse(prompt).isGrant
+                    ? { kind: "tool_permission", messageId: permissionMessageId }
+                    : undefined;
+            const nativeApprovalApplicationId = approvalRequest && hasNativeAskForm
                 ? (applicationId ??
-                    (nativePlanApprovals.size === 1
-                        ? nativePlanApprovals.keys().next().value
+                    (nativeDecisionApprovals.size === 1
+                        ? nativeDecisionApprovals.keys().next().value
                         : undefined))
                 : undefined;
-            const nativePlan = nativeApprovalApplicationId
-                ? nativePlanApprovals.get(nativeApprovalApplicationId)
+            const nativeTarget = nativeApprovalApplicationId
+                ? nativeDecisionApprovals.get(nativeApprovalApplicationId)
                 : undefined;
             const consumedNativeApplicationId = applicationId ?? nativeApprovalApplicationId;
             let restoreNative;
             if (hasNativeAskForm && consumedNativeApplicationId) {
-                const approved = nativePlanApprovals.get(consumedNativeApplicationId);
-                const staged = pendingNativePlanApprovals.get(consumedNativeApplicationId);
-                nativePlanApprovals.delete(consumedNativeApplicationId);
-                pendingNativePlanApprovals.delete(consumedNativeApplicationId);
+                const approved = nativeDecisionApprovals.get(consumedNativeApplicationId);
+                const staged = pendingNativeDecisionApprovals.get(consumedNativeApplicationId);
+                nativeDecisionApprovals.delete(consumedNativeApplicationId);
+                pendingNativeDecisionApprovals.delete(consumedNativeApplicationId);
                 // Put back only what nothing newer replaced: a form shown since
                 // is the one the user is answering now.
                 restoreNative = () => {
-                    if (nativePlanApprovals.has(consumedNativeApplicationId) ||
-                        pendingNativePlanApprovals.has(consumedNativeApplicationId)) {
+                    if (nativeDecisionApprovals.has(consumedNativeApplicationId) ||
+                        pendingNativeDecisionApprovals.has(consumedNativeApplicationId)) {
                         return;
                     }
                     if (approved) {
-                        nativePlanApprovals.set(consumedNativeApplicationId, approved);
+                        nativeDecisionApprovals.set(consumedNativeApplicationId, approved);
                     }
                     if (staged) {
-                        pendingNativePlanApprovals.set(consumedNativeApplicationId, staged);
+                        pendingNativeDecisionApprovals.set(consumedNativeApplicationId, staged);
                     }
                 };
             }
-            const nativeApproval = nativePlan &&
-                (branch === undefined || nativePlan.branch === branch) &&
-                nativeApprovalApplicationId
-                ? {
-                    applicationId: nativeApprovalApplicationId,
-                    branch: nativePlan.branch,
-                    plan: nativePlan,
-                }
+            const matchingNativeTarget = nativeTarget &&
+                approvalRequest &&
+                (branch === undefined || nativeTarget.branch === branch) &&
+                PlanApprovalChallenges.matchesRequest(nativeTarget, approvalRequest)
+                ? nativeTarget
                 : undefined;
-            const confirmedApproval = planAction === "approve" && !hasNativeAskForm
-                ? await planApprovals.claimConfirmed(context.appState, applicationId, branch)
+            const nativeApproval = matchingNativeTarget &&
+                PlanApprovalChallenges.isCurrent(context.appState, matchingNativeTarget)
+                ? matchingNativeTarget
+                : undefined;
+            const confirmedApproval = approvalRequest && !hasNativeAskForm
+                ? await planApprovals.claimConfirmed(context.appState, applicationId, branch, approvalRequest)
                 : undefined;
             const approval = nativeApproval ??
                 (confirmedApproval?.kind === "approved"
                     ? confirmedApproval.target
                     : undefined);
-            if (planAction === "approve" && !approval) {
-                if (confirmedApproval?.kind === "stale") {
+            if (approvalRequest && !approval) {
+                if (confirmedApproval?.kind === "stale" || matchingNativeTarget) {
                     return {
                         kind: "error",
-                        code: "plan_approval_stale",
-                        message: "The plan changed after the user approved it. Show the current plan and ask again.",
+                        code: approvalRequest.kind === "plan"
+                            ? "plan_approval_stale"
+                            : "tool_permission_stale",
+                        message: "The decision changed after the user approved it. Show the current decision and ask again.",
                     };
                 }
                 return {
                     kind: "error",
                     code: "approval_not_from_user",
-                    message: "Provide the applicationId for the current plan the user approved through a supported decision form, or show the current plan and ask again.",
+                    message: approvalRequest.kind === "tool_permission" &&
+                        !collectsUserApproval(clientProfileFor())
+                        ? PLAIN_HOST_TOOL_PERMISSION
+                        : "Provide the applicationId for the current decision the user approved through a supported decision form, or show the current decision and ask again.",
                 };
             }
             // The approval is spent once Superblocks accepts the prompt, and
@@ -885,9 +1155,10 @@ export function createMcpServer(deps, probeEditorDocument = createEditorDocument
                 idempotencyKey: idempotencyKey ?? `mcp-edit:${randomUUID()}`,
                 mode,
                 planAction,
+                permissionMessageId,
                 prompt,
                 wait: "ack",
-            }, approval?.plan, approvalSettlement);
+            }, approval?.kind === "plan" ? approval.plan : undefined, approvalSettlement);
             // An error here came back before any prompt went out. Settling
             // twice is a no-op, so a start that also reports it is harmless.
             if (result.kind !== "ok") {
@@ -901,6 +1172,7 @@ export function createMcpServer(deps, probeEditorDocument = createEditorDocument
             idempotencyKey,
             mode,
             planAction,
+            permissionMessageId,
             prompt,
         }));
         server.registerTool("check_app_progress", {
@@ -913,7 +1185,7 @@ export function createMcpServer(deps, probeEditorDocument = createEditorDocument
             // by hand in the elicitation form. It writes nothing the model decided
             // on its own.
             annotations: READ_ONLY_TOOL_ANNOTATIONS,
-            description: `Polls for the given application's current Superblocks turn. Use this after start_app or edit_app. The result includes the "activity" field, which carries Superblocks' updates since the previous call (or a short heartbeat when Superblocks is quiet). Possible statuses are: "building", "ready", "checkpoint_failed", "needs_decision", "no_changes", "live_edit_terminated", "timeout", "cancelled", "detached", "unknown". The result may carry "agentInstructions" on any poll; follow it whenever present. CRITICAL DO NOT IGNORE: When this result includes "browserNavigation", open its exact URL in the browser pane and verify the app loaded. Always follow "agentInstructions" in the result. When "building", continue polling. When "ready", call get_app to get the editor and preview URLs. When status "checkpoint_failed", follow "agentInstructions": open the editor only when "browserNavigation" is present; when it says the editor is temporarily unavailable, call get_app again. Do not claim the app was saved or keep polling. When "no_changes", do not present the edit URL as a finished app. For "no_changes", "timeout", "cancelled", or "live_edit_terminated", follow "pendingAction"; "retry_build" means call edit_app, while "start_new_app" means call start_app once with the same prompt and set replacesApplicationId to this result's applicationId. A terminal "live_edit_terminated" with no pendingAction means stop and report its reply; do not retry or create another application. When "detached", stop polling and point the user at the edit URL. When "unknown", the gateway is not following a turn for that app; the build may still be running, so follow "agentInstructions". The user sees nothing while this call is outstanding, so you MUST summarize Superblocks' updates between every pair of calls: before calling again, summarize the new "activity" lines in your own user-facing words, oldest first, without quoting or reproducing the source wording. Summarize every line, not just the latest - two different lines are two things to watch happen, not one. Never make two check_app_progress calls in a row with no message of your own in between, and never save the lines for a recap at the end. A heartbeat with no new words just means still working - say how long, then poll again. A checkpointCommitId means work is saved and the edit URL opens the finished app. Superblocks tests what it builds: it opens the app in a browser and runs its APIs, and the test run arrives as ordinary activity lines ("Testing the orders page", "Test passed: ...", "Tests failed: ..."). Summarize those like any other activity and say which cases passed and failed. A failing test is a build signal, not an auth problem: keep polling, and never tell the user to re-authenticate over one. This tool also surfaces integration errors from mid-build queries run through the orchestrator.`,
+            description: `Polls for the given application's current Superblocks turn. Use this after start_app or edit_app. The result includes the "activity" field, which carries Superblocks' updates since the previous call (or a short heartbeat when Superblocks is quiet). Possible statuses are: "building", "ready", "checkpoint_failed", "needs_decision", "no_changes", "live_edit_terminated", "timeout", "cancelled", "detached", "unknown". The result may carry "agentInstructions" on any poll; follow it whenever present. CRITICAL DO NOT IGNORE: When this result includes "browserNavigation", open its exact URL in the browser pane and verify the app loaded. Always follow "agentInstructions" in the result. When "building", continue polling. When "ready", call get_app to get the editor and preview URLs. When status "checkpoint_failed", follow "agentInstructions": open the editor only when "browserNavigation" is present; when it says the editor is temporarily unavailable, call get_app again. Do not claim the app was saved or keep polling. When "no_changes", do not present the edit URL as a finished app. A direct app question, an answer to a multi_choice question, or a change Superblocks finds already done can terminate as "no_changes" when Superblocks replies without app edits: with a reply and no pendingAction, report the reply to the user and stop. A "no_changes" with a "pendingAction" asks you to follow it. A "cancelled" with no pendingAction was replaced by a newer prompt on the same app: do not send it again; call check_app_progress again to follow the newer turn. For "no_changes", "timeout", "cancelled", or "live_edit_terminated", follow "pendingAction"; "retry_build" means call edit_app, while "start_new_app" means call start_app once with the same prompt and set replacesApplicationId to this result's applicationId. A terminal "live_edit_terminated" with no pendingAction means stop and report its reply; do not retry or create another application. When "detached", stop polling and point the user at the edit URL. When "unknown", the gateway is not following a turn for that app; the build may still be running, so follow "agentInstructions". The user sees nothing while this call is outstanding, so you MUST summarize Superblocks' updates between every pair of calls: before calling again, summarize the new "activity" lines in your own user-facing words, oldest first, without quoting or reproducing the source wording. Summarize every line, not just the latest - two different lines are two things to watch happen, not one. Never make two check_app_progress calls in a row with no message of your own in between, and never save the lines for a recap at the end. A heartbeat with no new words just means still working - say how long, then poll again. A checkpointCommitId means work is saved and the edit URL opens the finished app. Superblocks tests what it builds: it opens the app in a browser and runs its APIs, and the test run arrives as ordinary activity lines ("Testing the orders page", "Test passed: ...", "Tests failed: ..."). Summarize those like any other activity and say which cases passed and failed. A failing test is a build signal, not an auth problem: keep polling, and never tell the user to re-authenticate over one. This tool also surfaces integration errors from mid-build queries run through the orchestrator.`,
             inputSchema: {
                 applicationId: z.string().uuid().optional(),
                 branch: z.string().optional(),
@@ -950,7 +1222,7 @@ export function createMcpServer(deps, probeEditorDocument = createEditorDocument
             const decision = asked ? pendingDecision(asked) : undefined;
             if (!clientSupportsDecisionCard() ||
                 !asked ||
-                decision?.kind !== "plan") {
+                (decision?.kind !== "plan" && decision?.kind !== "tool_permission")) {
                 return response;
             }
             const decidedApp = resultApplicationId(asked) ?? applicationId;
@@ -958,20 +1230,29 @@ export function createMcpServer(deps, probeEditorDocument = createEditorDocument
                 return response;
             }
             const decidedBranch = resultBranch(asked) ?? branch;
-            if (!rememberDisplayedPlan(deps.appState, decidedApp, decidedBranch, decision)) {
+            if (decision.kind === "plan" &&
+                !rememberDisplayedPlan(deps.appState, decidedApp, decidedBranch, decision)) {
+                return response;
+            }
+            if (decision.kind === "tool_permission" &&
+                deps.appState.pendingDecision(decidedApp, decidedBranch)?.decision !==
+                    decision) {
                 return response;
             }
             const approvalToken = await planApprovals.issue(deps.appState, decidedApp, decidedBranch);
             return approvalToken
                 ? {
                     ...response,
-                    _meta: { [PLAN_APPROVAL_TOKEN_META_KEY]: approvalToken },
+                    _meta: {
+                        ...response._meta,
+                        [PLAN_APPROVAL_TOKEN_META_KEY]: approvalToken,
+                    },
                 }
                 : response;
         });
         confirmPlanApprovalTool = registerAppTool(server, CONFIRM_PLAN_APPROVAL_TOOL, {
             annotations: NON_DESTRUCTIVE_WRITE_TOOL_ANNOTATIONS,
-            description: "Internal to the decision card: confirms that the user clicked Build it for the current plan.",
+            description: "Internal to the decision card: confirms that the user approved the current decision.",
             inputSchema: {
                 approvalToken: z.string().uuid(),
             },
@@ -1010,7 +1291,7 @@ export function createMcpServer(deps, probeEditorDocument = createEditorDocument
         }));
         const getAppTool = server.registerTool("get_app", {
             annotations: READ_ONLY_TOOL_ANNOTATIONS,
-            description: 'Return editor and live fullscreen-preview URLs for the recent or specified Superblocks application without committing or building it. While a plan or question is outstanding it returns status "needs_decision" with the "decision" and a "pendingAction" of "approve_plan", "answer_question", or "decide_in_editor" (nothing to show in chat — point the user at the edit URL), while a turn is running it returns status "building", and when the last turn ended without writing anything it returns "timeout", "live_edit_terminated", "no_changes" or "cancelled" with no preview URLs or screenshot. When status "checkpoint_failed", follow "agentInstructions": open the editor only when "browserNavigation" is present; when it says the editor is temporarily unavailable, call get_app again. Do not claim the app was saved. Except for this checkpoint retry, follow "pendingAction" instead of calling this again; "retry_build" means call edit_app, while "start_new_app" means call start_app once with the same prompt and set replacesApplicationId to this result\'s applicationId. A terminal "live_edit_terminated" with no pendingAction means stop and report its reply; do not retry or create another application. A "detached" turn may still be running, so do not retry it; open the existing application in the editor. Prefer this after check_app_progress reaches status "ready". Also the right call when you do not know where a build stands — after a reconnect, when no turn of yours is running, or when the conversation moved to another channel: read "status" from the result rather than guessing. Hosts with a native browser receive a browserNavigation request without a duplicate status card; open its exact URL in that browser. Other hosts that support MCP Apps show Open editor / Open preview buttons. When Superblocks has written code the result includes a screenshot of the live Vite canvas — never the edit URL. When this result includes a screenshot, inspect it yourself before reporting that the app looks correct. Skeletons, spinners, empty tables or charts, or "Loading..." — call get_app again a few seconds later rather than treating it as a defect. Do not test, debug, or correct a visible problem unless the user requests it; report what you see.',
+            description: 'Return editor and live fullscreen-preview URLs for the recent or specified Superblocks application without committing or building it. While a plan or question is outstanding it returns status "needs_decision" with the "decision" and a "pendingAction" of "approve_plan", "answer_question", or "decide_in_editor" (nothing to show in chat; point the user at the edit URL), while a turn is running it returns status "building", and when the last turn ended without writing anything it returns "timeout", "live_edit_terminated", "no_changes" or "cancelled" with no preview URLs or screenshot. A "no_changes" with a "reply" and no "pendingAction" is Superblocks\' finished answer: report the reply and stop. A "no_changes" with a "pendingAction" asks you to follow it. When status "checkpoint_failed", follow "agentInstructions": open the editor only when "browserNavigation" is present; when it says the editor is temporarily unavailable, call get_app again. Do not claim the app was saved. Except for this checkpoint retry, follow "pendingAction" instead of calling this again; "retry_build" means call edit_app, while "start_new_app" means call start_app once with the same prompt and set replacesApplicationId to this result\'s applicationId. A terminal "live_edit_terminated" with no pendingAction means stop and report its reply; do not retry or create another application. A "detached" turn may still be running, so do not retry it; open the existing application in the editor. Prefer this after check_app_progress reaches status "ready". Also the right call when you do not know where a build stands (after a reconnect, when no turn of yours is running, or when the conversation moved to another channel): read "status" from the result rather than guessing. Hosts with a native browser receive a browserNavigation request without a duplicate status card; open its exact URL in that browser. Other hosts that support MCP Apps show Open editor / Open preview buttons. When Superblocks has written code the result includes a screenshot of the live Vite canvas, never the edit URL. When this result includes a screenshot, inspect it yourself before reporting that the app looks correct. If it shows skeletons, spinners, empty tables or charts, or "Loading...", call get_app again a few seconds later rather than treating it as a defect. Do not test, debug, or correct a visible problem unless the user requests it; report what you see.',
             inputSchema: {
                 applicationId: z.uuid().optional(),
                 branch: z.string().optional(),
@@ -1028,7 +1309,7 @@ export function createMcpServer(deps, probeEditorDocument = createEditorDocument
                     ? false
                     : includeScreenshot,
             });
-            stageNativePlanApproval(result, extra.requestId);
+            stageNativeDecisionApproval(result, extra.requestId);
             return result;
         }, extra, "status", { applicationId, branch, includeScreenshot }));
         statusCardTools.push(getAppTool);
@@ -1137,13 +1418,15 @@ export function createMcpServer(deps, probeEditorDocument = createEditorDocument
             annotations: READ_ONLY_TOOL_ANNOTATIONS,
         }, async ({ applicationId, commitId }, extra) => run("check_publish_progress", (context) => checkPublishProgress(context, { applicationId, commitId }), extra, { applicationId, commitId }));
     }
-    // Customer Admin tools (integrations, apps, users, deploy_application, ...)
-    // on the same MCP surface. Credential is the CLI session this process
-    // started with; base_url defaults to this gateway's Server URL.
+    const getActiveAccessToken = deps.getAccessToken
+        ? () => deps.getAccessToken()
+        : undefined;
     registerAdminTools(server, {
         apiKey: deps.cliApiKey,
         clientProfile: clientProfileFor,
+        getAccessToken: getActiveAccessToken,
         localAgentMode: deps.config.localAgentMode,
+        resolveApiKey: getActiveAccessToken,
         resolveEditorIntegrationSetupUrl: (integrationId, applicationId) => {
             // Only the caller knows which application its conversation is building.
             // This process serves every chat in the client and stdio carries no chat
@@ -1170,7 +1453,7 @@ export function createMcpServer(deps, probeEditorDocument = createEditorDocument
                 uiBaseUrl: deps.config.uiBaseUrl,
             });
         },
-        serverUrl: deps.config.serverUrl,
+        serverUrl: () => deps.config.serverUrl,
     });
     return server;
 }