@trops/dash-core 0.1.560 → 0.1.562

package/dist/electron/index.js

@@ -2397,9 +2397,27 @@ var mountTokenRegistry = { register: register$1, lookup, unregister: unregister$
  * Conversion: registry keys are scoped (`@trops/google-drive`); grant
  * keys are dotted (`trops.google-drive.GDriveFileList`). The mapping
  * for each entry is `@<scope>/<name>` + `<componentName>` →
- * `<scope>.<name>.<componentName>`. Bare-name lookup uses the LAST
- * dot-segment of the input widgetId so 3-part scope.pkg.component ids
- * resolve correctly.
+ * `<scope>.<name>.<componentName>`.
+ *
+ * Resolution strategy:
+ *
+ *   1. SCOPED PATH (preferred): a 3-part widgetId carries the package
+ *      identity in its first two segments. We rebuild `@scope/pkg` from
+ *      those segments and look the package up directly in the registry.
+ *      That keeps two packages exporting the same bare component name
+ *      from cross-contaminating each other's grant scope.
+ *
+ *   2. LEGACY BARE-NAME FALLBACK: for legacy widget ids that don't
+ *      carry scope (1- or 2-segment ids), walk the registry and match
+ *      on the last dot-segment. Honours `entry.packageId` when present
+ *      so the returned sibling set is correctly mapped.
+ *
+ * The scoped-first strategy was added after a bare-name collision
+ * caused JIT consent for a widget in `@ai-built/prompt-validation` to
+ * resolve siblings under `@trops/google-drive` (both packages
+ * happened to ship a `GoogleDriveRecentFiles` component). The grant
+ * subsequently landed on the wrong package's widgets entirely. Don't
+ * regress this — the test file pins the collision case explicitly.
  */
 
 const FALLBACK = (widgetId) => ({
@@ -2412,6 +2430,18 @@ function _bareNameFromWidgetId(widgetId) {
   return idx >= 0 ? widgetId.slice(idx + 1) : widgetId;
 }
 
+/**
+ * Pull `@scope/pkg` out of a 3-part dotted widgetId. Returns null for
+ * any input that isn't exactly 3 dot-segments — 1- and 2-segment ids
+ * fall through to the legacy bare-name path.
+ */
+function _packageIdFromScopedWidgetId(widgetId) {
+  const parts = widgetId.split(".");
+  if (parts.length !== 3) return null;
+  if (!parts[0] || !parts[1] || !parts[2]) return null;
+  return `@${parts[0]}/${parts[1]}`;
+}
+
 function _toGrantId(packageId, componentName) {
   // "@trops/google-drive" + "GDriveFileList" → "trops.google-drive.GDriveFileList"
   // Strip leading "@" and replace the first "/" with ".".
@@ -2432,6 +2462,26 @@ function _entries(snapshot) {
   return [];
 }
 
+/**
+ * Look up an exact registry entry by packageId (either the registry
+ * key OR the entry's own `packageId` field). Returns the entry or
+ * null. We accept both shapes because some registry persistence
+ * paths historically keyed by `name` instead of `packageId`.
+ */
+function _findEntryByPackageId(packageId, registrySnapshot) {
+  for (const [key, entry] of _entries(registrySnapshot)) {
+    if (key === packageId) return entry;
+    if (
+      entry &&
+      typeof entry.packageId === "string" &&
+      entry.packageId === packageId
+    ) {
+      return entry;
+    }
+  }
+  return null;
+}
+
 /**
  * @param {string} widgetId — grant-keyed widget id
  * @param {Map<string, object>|object} registrySnapshot — getWidgetRegistry().widgets
@@ -2440,6 +2490,30 @@ function _entries(snapshot) {
 function resolveSiblings$3(widgetId, registrySnapshot) {
   if (typeof widgetId !== "string" || !widgetId) return FALLBACK(widgetId);
 
+  // SCOPED PATH — the widgetId is already scoped, so we know its
+  // package directly. No cross-package matching, no collision risk.
+  const derivedPackageId = _packageIdFromScopedWidgetId(widgetId);
+  if (derivedPackageId) {
+    const entry = _findEntryByPackageId(derivedPackageId, registrySnapshot);
+    const names = Array.isArray(entry?.componentNames)
+      ? entry.componentNames
+      : null;
+    if (entry && names && names.length > 0) {
+      return {
+        packageId: derivedPackageId,
+        siblingWidgetIds: names.map((n) => _toGrantId(derivedPackageId, n)),
+      };
+    }
+    // Package is known by id but the registry entry is missing or
+    // empty (race: package just installed, registry write hasn't
+    // landed). Don't fall through to bare-name search — that would
+    // cross-contaminate by matching another package whose component
+    // happens to share the bare name. Return the single widget.
+    return FALLBACK(widgetId);
+  }
+
+  // LEGACY BARE-NAME FALLBACK — only for widget ids that don't carry
+  // scope (1- or 2-segment ids).
   const bareName = _bareNameFromWidgetId(widgetId);
   if (!bareName) return FALLBACK(widgetId);
 
@@ -3528,14 +3602,60 @@ function expandHome(p) {
 /**
  * Parse a widget's package.json contents into a normalized permissions
  * object. Returns null if no `dash.permissions.mcp` block exists.
+ *
+ * When `componentName` is provided AND the package ships a
+ * `dash.permissions.mcpByComponent` block, the parser returns the
+ * declaration for that specific widget instead of the package-level
+ * union. This is what closes the cross-pollination gap: multi-widget
+ * packages give each widget its own server/tools list, scanned from
+ * the widget's own component file.
+ *
+ * If `componentName` is omitted (or the per-component block doesn't
+ * exist), we fall back to the package-level `mcp` block — the
+ * back-compat path for older packages that haven't been re-scanned.
  */
-function parseManifestPermissions(packageJson) {
+function parseManifestPermissions(packageJson, componentName = null) {
   if (!packageJson || typeof packageJson !== "object") return null;
+
+  const byComponent = packageJson?.dash?.permissions?.mcpByComponent;
+  const hasByComponent =
+    byComponent &&
+    typeof byComponent === "object" &&
+    Object.keys(byComponent).length > 0;
+
+  // If the package ships a per-component breakdown, that's
+  // authoritative for any widget we're asking about. Widgets not
+  // listed there are widgets the scanner found NO MCP usage in —
+  // they declare nothing, not the package-level union. Falling
+  // back to the package union for an unlisted widget would defeat
+  // the whole point of the breakdown (re-merging every sibling's
+  // tools into each unlisted widget).
+  if (componentName && hasByComponent) {
+    if (byComponent[componentName]) {
+      return _normalizeServers(byComponent[componentName]?.servers);
+    }
+    // Component exists in this package but the scanner found no
+    // MCP usage in its source. Declare nothing.
+    return null;
+  }
+
+  // No per-component data (older package) OR no componentName
+  // supplied by the caller — fall back to the package-level union
+  // for back-compat.
   const mcp = packageJson?.dash?.permissions?.mcp;
   if (!mcp || typeof mcp !== "object") return null;
+  return _normalizeServers(mcp);
+}
 
+/**
+ * Normalize a `{server: {tools, readPaths, writePaths}}` block into
+ * the standard `{servers: {...}}` shape used by the gate and panel.
+ * Filters non-string entries and expands `~/` paths.
+ */
+function _normalizeServers(rawServers) {
+  if (!rawServers || typeof rawServers !== "object") return null;
   const servers = {};
-  for (const [serverName, raw] of Object.entries(mcp)) {
+  for (const [serverName, raw] of Object.entries(rawServers)) {
     if (!raw || typeof raw !== "object") continue;
     const tools = Array.isArray(raw.tools)
       ? raw.tools.filter((t) => typeof t === "string")
@@ -3548,7 +3668,6 @@ function parseManifestPermissions(packageJson) {
       : [];
     servers[serverName] = { tools, readPaths, writePaths };
   }
-
   return { servers };
 }
 
@@ -3591,15 +3710,36 @@ function resolveWidgetPackagePath(widgetId) {
   return path$f.join(widgetsRoot, ...parts, "package.json");
 }
 
+/**
+ * Pull the bare component name (last dot-segment) from a dotted
+ * widget id. Returns null for npm-form ids (`@scope/pkg`) or 1-segment
+ * ids — those have no per-widget component to scope by.
+ */
+function _componentNameFromWidgetId(widgetId) {
+  if (typeof widgetId !== "string" || !widgetId) return null;
+  if (widgetId.startsWith("@")) return null;
+  const parts = widgetId.split(".");
+  if (parts.length < 3) return null;
+  return parts[parts.length - 1] || null;
+}
+
 /**
  * Read and parse a widget's MCP permissions. Returns null if:
  *   - the widget directory doesn't exist
  *   - package.json is unreadable / malformed
  *   - the widget hasn't declared dash.permissions.mcp
  *
- * Result is cached per widgetId for the lifetime of this process.
+ * For 3-part scoped widget ids (`scope.pkg.component`), prefers the
+ * package's `dash.permissions.mcpByComponent[component]` block when
+ * present. Falls back to the package-level `mcp` block when the
+ * per-component breakdown isn't available — preserves the previous
+ * behavior for older packages that haven't been re-scanned.
+ *
+ * Result is cached per widgetId for the lifetime of this process —
+ * each component gets its own cache entry, so a 10-widget package
+ * has 10 entries, each with its own server/tools subset.
  */
-function getWidgetMcpPermissions$1(widgetId) {
+function getWidgetMcpPermissions$2(widgetId) {
   if (_cache.has(widgetId)) return _cache.get(widgetId);
   const pkgPath = resolveWidgetPackagePath(widgetId);
   if (!pkgPath || !fs$c.existsSync(pkgPath)) {
@@ -3609,7 +3749,8 @@ function getWidgetMcpPermissions$1(widgetId) {
   try {
     const raw = fs$c.readFileSync(pkgPath, "utf8");
     const pkg = JSON.parse(raw);
-    const perms = parseManifestPermissions(pkg);
+    const componentName = _componentNameFromWidgetId(widgetId);
+    const perms = parseManifestPermissions(pkg, componentName);
     _cache.set(widgetId, perms);
     return perms;
   } catch (e) {
@@ -3629,7 +3770,7 @@ function clearCache() {
 }
 
 var widgetPermissions = {
-  getWidgetMcpPermissions: getWidgetMcpPermissions$1,
+  getWidgetMcpPermissions: getWidgetMcpPermissions$2,
   parseManifestPermissions,
   dottedComponentIdToPackageId,
   expandHome,
@@ -4037,15 +4178,85 @@ function requireScanWidgetPackagePermissions () {
 	  return out;
 	}
 
+	/**
+	 * Locate the package's `widgets/` directory and enumerate every
+	 * `<Name>.js` paired with a `<Name>.dash.js` config. That pair is the
+	 * canonical widget shape across the repo (see
+	 * `widgetCompiler.findWidgetsDir`). Returns
+	 *   [{componentName, componentFilePath}].
+	 *
+	 * Files without a sibling `.dash.js` (utils, helpers, contexts) are
+	 * skipped — they're not widgets, so attributing their MCP usage to a
+	 * specific component is ambiguous.
+	 */
+	function _findComponentFiles(packageDir) {
+	  const candidates = [
+	    path.join(packageDir, "widgets"),
+	    path.join(packageDir, "src", "widgets"),
+	  ];
+	  const out = [];
+	  for (const widgetsDir of candidates) {
+	    if (!fs.existsSync(widgetsDir)) continue;
+	    let entries;
+	    try {
+	      entries = fs.readdirSync(widgetsDir, { withFileTypes: true });
+	    } catch (_) {
+	      continue;
+	    }
+	    for (const entry of entries) {
+	      if (!entry.isFile()) continue;
+	      const m = entry.name.match(/^(.+)\.dash\.(?:js|jsx|ts|tsx)$/);
+	      if (!m) continue;
+	      const componentName = m[1];
+	      // Prefer .js, then .jsx, .ts, .tsx — first-match wins.
+	      for (const ext of [".js", ".jsx", ".ts", ".tsx"]) {
+	        const componentFilePath = path.join(
+	          widgetsDir,
+	          `${componentName}${ext}`,
+	        );
+	        if (fs.existsSync(componentFilePath)) {
+	          out.push({ componentName, componentFilePath });
+	          break;
+	        }
+	      }
+	    }
+	  }
+	  return out;
+	}
+
 	/**
 	 * Walk packageDir, scan every source file, return the canonical
 	 * `dash.permissions.mcp` block. Returns `{}` when no MCP usage found.
+	 *
+	 * Per-file pairing — providers and tools are paired at the source-file
+	 * level, not unioned across the whole package. The vast majority of
+	 * widget source files use a single `useMcpProvider("type")` hook and
+	 * call its tools in the same file; pairing per file produces the
+	 * correct provider→tools mapping for that case.
+	 *
+	 * Multi-widget packages (one package shipping N widgets, each with a
+	 * different provider) used to be miscompiled by the old whole-package
+	 * union: every provider in the package got credit for every tool any
+	 * sibling widget called. The result was a manifest where, e.g., the
+	 * `slack` server claimed `list_pull_requests` and `list_directory`
+	 * tools simply because the same package also shipped a GitHub widget
+	 * and a Filesystem widget. Per-file pairing eliminates that
+	 * cross-pollination because each file's tools attach only to that
+	 * file's providers.
+	 *
+	 * Files containing multiple providers (a widget that orchestrates two
+	 * MCP servers in the same component) attribute their tools to each
+	 * provider in that file — an acceptable over-grant within the single
+	 * widget's own scope, and a rare-enough case that we don't try to
+	 * parse expression scoping. Tools called in files with NO provider
+	 * hook (e.g. a helper module called from a parent widget) are ignored
+	 * — a runtime hint without static evidence of which provider it
+	 * targets falls through to the gate's JIT consent.
 	 */
 	function scanWidgetPackagePermissions(packageDir) {
 	  if (typeof packageDir !== "string" || !fs.existsSync(packageDir)) return {};
 
-	  const allProviders = new Set();
-	  const allTools = new Set();
+	  const providerToTools = new Map();
 	  for (const filePath of _walkSourceFiles(packageDir)) {
 	    let code;
 	    try {
@@ -4054,15 +4265,81 @@ function requireScanWidgetPackagePermissions () {
 	      continue;
 	    }
 	    const { providers, tools } = scanFileForMcpUsage(code);
-	    for (const p of providers) allProviders.add(p);
-	    for (const t of tools) allTools.add(t);
+	    // No provider in this file → tools have no statically-known
+	    // server to attach to. Skip rather than cross-pollinate.
+	    if (providers.length === 0) continue;
+	    // No tools in this file → still register the provider with an
+	    // empty set so the manifest knows the widget declares this
+	    // server. (Edge case: helper file that mounts useMcpProvider but
+	    // calls callTool via an indirection we can't statically read.)
+	    for (const p of providers) {
+	      if (!providerToTools.has(p)) providerToTools.set(p, new Set());
+	      const bucket = providerToTools.get(p);
+	      for (const t of tools) bucket.add(t);
+	    }
 	  }
 
-	  if (allProviders.size === 0 || allTools.size === 0) return {};
+	  // Drop providers that ended up with no tools across the whole
+	  // package — declaring a server with an empty tool list is
+	  // misleading downstream (the Permissions panel renders an empty
+	  // section, the gate treats it as "all tools require JIT"). The
+	  // runtime gate is the safety net for tools we couldn't statically
+	  // pair.
+	  const out = {};
+	  for (const [provider, toolSet] of providerToTools.entries()) {
+	    if (toolSet.size === 0) continue;
+	    out[provider] = { tools: Array.from(toolSet).sort() };
+	  }
+	  return out;
+	}
 
+	/**
+	 * Per-component scanner. Walks each `widgets/<Name>.js` paired with
+	 * `widgets/<Name>.dash.js` and produces a map
+	 *   { [componentName]: { [server]: { tools: [...] } } }
+	 *
+	 * Each component's entry contains ONLY the providers + tools its own
+	 * file uses. Sibling widgets in the same package don't bleed into
+	 * each other — the bug the package-level `mcp` block carries by
+	 * design (one shared block for the whole package) is closed here at
+	 * the widget granularity.
+	 *
+	 * Used by `widgetPermissions.getWidgetMcpPermissions(scopedWidgetId)`
+	 * to answer "what does THIS specific widget declare" instead of
+	 * "what does the WHOLE package declare", which is what fixes:
+	 *   - Permissions panel showing every sibling's declarations under
+	 *     every widget
+	 *   - JIT consent's sibling-fanout writing grants to widgets that
+	 *     don't actually use the granted tool
+	 *
+	 * Returns `{}` when no component file declares any MCP usage.
+	 */
+	function scanWidgetPackagePermissionsByComponent(packageDir) {
+	  if (typeof packageDir !== "string" || !fs.existsSync(packageDir)) return {};
 	  const out = {};
-	  for (const provider of allProviders) {
-	    out[provider] = { tools: Array.from(allTools).sort() };
+	  for (const { componentName, componentFilePath } of _findComponentFiles(
+	    packageDir,
+	  )) {
+	    let code;
+	    try {
+	      code = fs.readFileSync(componentFilePath, "utf8");
+	    } catch (_) {
+	      continue;
+	    }
+	    const { providers, tools } = scanFileForMcpUsage(code);
+	    if (providers.length === 0) continue;
+	    // Pair this file's providers with this file's tools — same
+	    // per-file logic as `scanWidgetPackagePermissions`, scoped to
+	    // a single widget's component file.
+	    const servers = {};
+	    for (const provider of providers) {
+	      const sorted = Array.from(new Set(tools)).sort();
+	      if (sorted.length === 0) continue;
+	      servers[provider] = { tools: sorted };
+	    }
+	    if (Object.keys(servers).length > 0) {
+	      out[componentName] = { servers };
+	    }
 	  }
 	  return out;
 	}
@@ -4099,8 +4376,21 @@ function requireScanWidgetPackagePermissions () {
 
 	/**
 	 * Apply the scanner's findings to `package.json` in `packageDir` —
-	 * read, merge with any existing `dash.permissions.mcp` block, write
-	 * back. Returns the resulting block (or null if no package.json).
+	 * read, merge with any existing manifest, write back. Returns the
+	 * resulting package-level `mcp` block (or null if no package.json AND
+	 * no usage to write).
+	 *
+	 * Writes BOTH blocks:
+	 *   - `dash.permissions.mcp` — package-level union (back-compat with
+	 *     the gate's pre-per-component lookup path)
+	 *   - `dash.permissions.mcpByComponent` — per-widget breakdown so the
+	 *     Permissions panel and JIT-consent sibling fanout can answer
+	 *     "which specific widgets declare this tool" without cross-
+	 *     contaminating siblings
+	 *
+	 * The per-component block is fully scanner-derived (no hand-merge) —
+	 * editing it by hand is unsupported. Package-level `mcp` continues
+	 * to honor hand-authored entries.
 	 */
 	function applyScanToPackageJson(packageDir) {
 	  const pkgPath = path.join(packageDir, "package.json");
@@ -4115,18 +4405,42 @@ function requireScanWidgetPackagePermissions () {
 	  const scanned = scanWidgetPackagePermissions(packageDir);
 	  const human = existing.dash?.permissions?.mcp || null;
 	  const merged = mergePermissions(human, scanned);
-	  if (Object.keys(merged).length === 0) {
+	  const byComponent = scanWidgetPackagePermissionsByComponent(packageDir);
+	  // Existing stale `mcpByComponent` from a prior scan must be dropped
+	  // when this run finds no qualifying components — otherwise leftover
+	  // entries for deleted widgets keep applying permissions the user
+	  // didn't actually re-approve. Treat "has existing block but new
+	  // scan empty" as a write trigger (with the side effect of removing
+	  // the block via the delete below).
+	  const hadByComponent =
+	    !!existing.dash?.permissions?.mcpByComponent &&
+	    typeof existing.dash.permissions.mcpByComponent === "object" &&
+	    Object.keys(existing.dash.permissions.mcpByComponent).length > 0;
+	  if (
+	    Object.keys(merged).length === 0 &&
+	    Object.keys(byComponent).length === 0 &&
+	    !hadByComponent
+	  ) {
 	    // Nothing to write. Don't churn the file.
 	    return null;
 	  }
+	  const nextPermissions = {
+	    ...((existing.dash || {}).permissions || {}),
+	  };
+	  if (Object.keys(merged).length > 0) nextPermissions.mcp = merged;
+	  if (Object.keys(byComponent).length > 0) {
+	    nextPermissions.mcpByComponent = byComponent;
+	  } else {
+	    // Drop a stale `mcpByComponent` block when re-scanning finds no
+	    // qualifying component files. Prevents leftover entries from a
+	    // prior install lingering after the user deletes a widget.
+	    delete nextPermissions.mcpByComponent;
+	  }
 	  const next = {
 	    ...existing,
 	    dash: {
 	      ...(existing.dash || {}),
-	      permissions: {
-	        ...((existing.dash || {}).permissions || {}),
-	        mcp: merged,
-	      },
+	      permissions: nextPermissions,
 	    },
 	  };
 	  fs.writeFileSync(pkgPath, JSON.stringify(next, null, 2), "utf8");
@@ -4163,6 +4477,7 @@ function requireScanWidgetPackagePermissions () {
 	scanWidgetPackagePermissions_1 = {
 	  scanFileForMcpUsage,
 	  scanWidgetPackagePermissions,
+	  scanWidgetPackagePermissionsByComponent,
 	  mergePermissions,
 	  applyScanToPackageJson,
 	  backfillPackagePermissions,
@@ -26546,6 +26861,7 @@ const { safePath: safePath$1 } = safePath_1;
 const { requestApproval } = jitConsent$1;
 const { lookup: lookupMountToken } = mountTokenRegistry;
 const { resolveSiblings } = resolveSiblings_1;
+const { getWidgetMcpPermissions: getWidgetMcpPermissions$1 } = widgetPermissions;
 
 // Lazy default for the registry snapshot — `widgetRegistry.js` pulls
 // in a lot, so we don't want to require it at module-load time. The
@@ -26696,6 +27012,66 @@ function gateToolCall$1({ widgetId, token, serverName, toolName, args }) {
   return { allow: true };
 }
 
+/**
+ * Filter a sibling-widget list down to widgets whose static manifest
+ * declares the given `serverName + toolName`. The originating widget
+ * (`originatingWidgetId`) is always retained — the call IS proof of
+ * use even if the manifest hasn't been re-scanned to declare the tool
+ * (e.g., variable-indirect `callTool(name, …)` calls that the scanner
+ * intentionally skips).
+ *
+ * Back-compat: if no sibling has any per-widget declaration at all
+ * (package never re-scanned with the per-component scanner), the
+ * filter returns the unmodified list — the user's pre-per-component
+ * "Apply to all in package" behavior is preserved for those packages.
+ *
+ * Used by the JIT consent path to:
+ *   - Set the modal's "Apply to all N widgets" count to the actually-
+ *     applicable subset
+ *   - Limit the grant fanout on approval to the same subset
+ *
+ * Pure helper modulo `getWidgetMcpPermissions` (which is cached + fs
+ * memo-ish per process).
+ */
+function _filterSiblingsByDeclaration(
+  siblingWidgetIds,
+  originatingWidgetId,
+  serverName,
+  toolName,
+) {
+  if (!Array.isArray(siblingWidgetIds) || siblingWidgetIds.length === 0) {
+    return [originatingWidgetId];
+  }
+  // Look up each sibling's per-widget manifest. We need to know
+  // whether ANY sibling has the per-component breakdown — if not,
+  // we're in back-compat territory and should not filter.
+  const lookups = siblingWidgetIds.map((sibId) => ({
+    sibId,
+    perms: getWidgetMcpPermissions$1(sibId),
+  }));
+  const anyManifested = lookups.some(
+    (l) =>
+      l.perms && l.perms.servers && Object.keys(l.perms.servers).length > 0,
+  );
+  if (!anyManifested) return siblingWidgetIds;
+
+  const out = [];
+  for (const { sibId, perms } of lookups) {
+    if (sibId === originatingWidgetId) {
+      out.push(sibId);
+      continue;
+    }
+    const tools = perms?.servers?.[serverName]?.tools;
+    if (Array.isArray(tools) && tools.includes(toolName)) {
+      out.push(sibId);
+    }
+  }
+  // Defensive: if filtering somehow eliminated everything (shouldn't
+  // happen since the originating widget is always retained), fall
+  // back to the single originating widget.
+  return out.length > 0 ? out : [originatingWidgetId];
+}
+
 /**
  * Merge `addition` (a grant blob) into the widget's existing grant. Used
  * by the JIT path to extend an existing grant with a new tool/path
@@ -26787,6 +27163,25 @@ async function gateToolCallWithJit$1(req, opts = {}) {
     opts.getRegistrySnapshot || _defaultRegistrySnapshot;
   const siblingInfo = resolveSiblings(verifiedWidgetId, getRegistrySnapshot());
 
+  // Filter siblings to those whose per-component manifest actually
+  // declares the requested `serverName + toolName`. Without this
+  // filter, "Apply to all in package" writes the grant to every
+  // sibling regardless of whether that sibling uses the tool — a
+  // Counter widget ends up with Google Drive grants it doesn't
+  // need. The originating widget is always included (its runtime
+  // call IS proof) even if its manifest hasn't been re-scanned to
+  // declare the tool.
+  //
+  // Falls back to the unfiltered sibling list when no per-component
+  // data exists on ANY sibling (back-compat for older packages that
+  // haven't been re-scanned with the new scanner).
+  const applicableSiblingIds = _filterSiblingsByDeclaration(
+    siblingInfo.siblingWidgetIds,
+    verifiedWidgetId,
+    req.serverName,
+    req.toolName,
+  );
+
   let decision;
   try {
     decision = await requestApproval(
@@ -26800,7 +27195,7 @@ async function gateToolCallWithJit$1(req, opts = {}) {
           args: req.args || {},
         },
         packageId: siblingInfo.packageId,
-        siblingWidgetIds: siblingInfo.siblingWidgetIds,
+        siblingWidgetIds: applicableSiblingIds,
       },
       { timeoutMs: opts.timeoutMs },
     );
@@ -26851,11 +27246,17 @@ async function gateToolCallWithJit$1(req, opts = {}) {
   // its prior grants on other servers/tools. When the option is off
   // (or no siblings were resolved), behave as before: single-widget
   // write to the requesting widget only.
+  //
+  // Use the FILTERED sibling list (`applicableSiblingIds`) here — the
+  // grant only fans out to widgets whose manifest actually declares
+  // the server+tool. The modal showed the same filtered count, so
+  // the user's "Apply to all N widgets" decision was already made
+  // against the correct set.
   const targetWidgetIds =
     decision.applyToSiblings === true &&
-    Array.isArray(siblingInfo.siblingWidgetIds) &&
-    siblingInfo.siblingWidgetIds.length > 1
-      ? siblingInfo.siblingWidgetIds
+    Array.isArray(applicableSiblingIds) &&
+    applicableSiblingIds.length > 1
+      ? applicableSiblingIds
       : [verifiedWidgetId];
 
   try {