@trops/dash-core 0.1.637 → 0.1.639

package/dist/electron/index.js

@@ -21,7 +21,7 @@ var require$$11 = require('https');
 var require$$0$8 = require('@modelcontextprotocol/sdk/client/index.js');
 var require$$1$6 = require('@modelcontextprotocol/sdk/client/stdio.js');
 var require$$0$7 = require('pkce-challenge');
-var require$$12 = require('child_process');
+var require$$13 = require('child_process');
 var require$$1$5 = require('http');
 var require$$2$2 = require('algoliasearch');
 var require$$3$2 = require('node:path');
@@ -982,6 +982,9 @@ const BOTS_RESUME_ALL$1 = "bots-resume-all";
 const BOTS_PAUSE_BOT$1 = "bots-pause-bot";
 const BOTS_RESUME_BOT$1 = "bots-resume-bot";
 const BOTS_GET_PAUSE_STATE$1 = "bots-get-pause-state";
+const BOTS_LIST_TOOL_SOURCES$1 = "bots-list-tool-sources";
+const BOTS_GET_GRANTS$1 = "bots-get-grants";
+const BOTS_REVOKE_GRANT$1 = "bots-revoke-grant";
 
 // --- Main → Renderer (send) ---
 const BOT_STREAM$2 = "bot-stream"; // { botId, event: BotEvent }
@@ -1008,6 +1011,9 @@ var botEvents$1 = {
   BOTS_PAUSE_BOT: BOTS_PAUSE_BOT$1,
   BOTS_RESUME_BOT: BOTS_RESUME_BOT$1,
   BOTS_GET_PAUSE_STATE: BOTS_GET_PAUSE_STATE$1,
+  BOTS_LIST_TOOL_SOURCES: BOTS_LIST_TOOL_SOURCES$1,
+  BOTS_GET_GRANTS: BOTS_GET_GRANTS$1,
+  BOTS_REVOKE_GRANT: BOTS_REVOKE_GRANT$1,
   BOT_STREAM: BOT_STREAM$2,
   BOT_APPROVAL_PENDING: BOT_APPROVAL_PENDING$2,
   BOT_BUDGET_ALERT: BOT_BUDGET_ALERT$2,
@@ -19490,7 +19496,7 @@ util$E.isObject = isObject;
 util$E.isPlainObject = isPlainObject;
 util$E.numKeys = numKeys;
 util$E.escapeRegex = escapeRegex;
-util$E.clone = clone;
+util$E.clone = clone$1;
 util$E.normalizeParams = normalizeParams;
 util$E.createTransparentProxy = createTransparentProxy;
 util$E.stringifyPrimitive = stringifyPrimitive;
@@ -19713,7 +19719,7 @@ function escapeRegex(str) {
     return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 // zod-specific utils
-function clone(inst, def, params) {
+function clone$1(inst, def, params) {
     const cl = new inst._zod.constr(def ?? inst._zod.def);
     if (!def || params?.parent)
         cl._zod.parent = inst;
@@ -19803,7 +19809,7 @@ function pick$1(schema, mask) {
         // pick key
         newShape[key] = currDef.shape[key];
     }
-    return clone(schema, {
+    return clone$1(schema, {
         ...schema._zod.def,
         shape: newShape,
         checks: [],
@@ -19820,7 +19826,7 @@ function omit(schema, mask) {
             continue;
         delete newShape[key];
     }
-    return clone(schema, {
+    return clone$1(schema, {
         ...schema._zod.def,
         shape: newShape,
         checks: [],
@@ -19839,10 +19845,10 @@ function extend(schema, shape) {
         },
         checks: [], // delete existing checks
     };
-    return clone(schema, def);
+    return clone$1(schema, def);
 }
 function merge(a, b) {
-    return clone(a, {
+    return clone$1(a, {
         ...a._zod.def,
         get shape() {
             const _shape = { ...a._zod.def.shape, ...b._zod.def.shape };
@@ -19883,7 +19889,7 @@ function partial(Class, schema, mask) {
                 : oldShape[key];
         }
     }
-    return clone(schema, {
+    return clone$1(schema, {
         ...schema._zod.def,
         shape,
         checks: [],
@@ -19915,7 +19921,7 @@ function required$3(Class, schema, mask) {
             });
         }
     }
-    return clone(schema, {
+    return clone$1(schema, {
         ...schema._zod.def,
         shape,
         // optional: [],
@@ -36672,7 +36678,7 @@ function _resolveIdentity({ token, widgetId }) {
 // Argument keys that look like paths. Different MCP servers use
 // different conventions; this list covers the common filesystem-style
 // servers. Extensible — add as new patterns surface.
-const PATH_ARG_KEYS = ["path", "uri", "filepath", "file", "directory"];
+const PATH_ARG_KEYS$1 = ["path", "uri", "filepath", "file", "directory"];
 
 // Heuristic: tool names matching this regex are treated as writes for
 // purposes of choosing readPaths vs writePaths. The match is intentionally
@@ -36681,7 +36687,7 @@ const PATH_ARG_KEYS = ["path", "uri", "filepath", "file", "directory"];
 const WRITE_TOOL_PATTERN =
   /(^|_)(write|create|edit|delete|remove|append|move|rename|chmod|chown|mkdir)/i;
 
-function isWriteTool(toolName) {
+function isWriteTool$1(toolName) {
   if (typeof toolName !== "string") return false;
   return WRITE_TOOL_PATTERN.test(toolName);
 }
@@ -36755,7 +36761,7 @@ function _evaluateGrant({
 
   // Path-argument containment. Only checked when the tool's args
   // include a path-shaped key.
-  const isWrite = isWriteTool(toolName);
+  const isWrite = isWriteTool$1(toolName);
   // Write tools must use writePaths; read tools may use either
   // readPaths or writePaths (write access implies read access).
   const allowedPaths = isWrite
@@ -36763,7 +36769,7 @@ function _evaluateGrant({
     : [...serverPerms.readPaths, ...serverPerms.writePaths];
 
   if (args && typeof args === "object") {
-    for (const key of PATH_ARG_KEYS) {
+    for (const key of PATH_ARG_KEYS$1) {
       const v = args[key];
       if (typeof v !== "string" || !v) continue;
       if (allowedPaths.length === 0) {
@@ -37132,8 +37138,8 @@ var permissionGate = {
   gateToolCall: gateToolCall$1,
   gateBotToolCall,
   gateToolCallWithJit: gateToolCallWithJit$1,
-  isWriteTool,
-  PATH_ARG_KEYS,
+  isWriteTool: isWriteTool$1,
+  PATH_ARG_KEYS: PATH_ARG_KEYS$1,
 };
 
 /**
@@ -37164,7 +37170,7 @@ var permissionGate = {
  * the trust boundary appears.
  */
 
-const NO_WORKSPACE = "__no_workspace__";
+const NO_WORKSPACE$1 = "__no_workspace__";
 const SEP = "::";
 
 function serverKey$1(workspaceId, serverName) {
@@ -37172,11 +37178,11 @@ function serverKey$1(workspaceId, serverName) {
     throw new Error("serverKey: serverName is required");
   }
   const wid =
-    typeof workspaceId === "string" && workspaceId ? workspaceId : NO_WORKSPACE;
+    typeof workspaceId === "string" && workspaceId ? workspaceId : NO_WORKSPACE$1;
   return wid + SEP + serverName;
 }
 
-function parseServerKey$1(key) {
+function parseServerKey$2(key) {
   if (typeof key !== "string") {
     throw new Error("parseServerKey: key must be a string");
   }
@@ -37194,11 +37200,265 @@ function parseServerKey$1(key) {
 
 var mcpServerKey = {
   serverKey: serverKey$1,
-  parseServerKey: parseServerKey$1,
-  NO_WORKSPACE,
+  parseServerKey: parseServerKey$2,
+  NO_WORKSPACE: NO_WORKSPACE$1,
   SEP,
 };
 
+/**
+ * toolSources.js — how a bot finds, starts, and uses the user's Dash MCP
+ * providers (the integrations configured under Settings → Providers).
+ *
+ * Portable (no electron import — NFR-006): the MCP controller, provider store
+ * and server map are injected by botController.
+ *
+ * Server reuse goes through the same `mcpController.startServer` factory the
+ * dashboards use: a server already connected — or already starting — for a
+ * given (workspace, server) bucket is reused, never spawned twice. Buckets are
+ * per-workspace on purpose (each workspace's processes carry that workspace's
+ * grants), so a bot uses its OWN bucket (its workspaceId, or the no-workspace
+ * bucket) and never borrows a dashboard workspace's process.
+ */
+
+const { parseServerKey: parseServerKey$1 } = mcpServerKey;
+
+const NO_WORKSPACE = "__no_workspace__";
+
+const normalizeWorkspace = (wid) =>
+  typeof wid === "string" && wid && wid !== NO_WORKSPACE ? wid : null;
+
+/**
+ * Summarize mcpController's `activeServers` Map (keyed "<workspace>::<server>")
+ * into connected servers with their REAL server name + workspace.
+ */
+function connectedServersFromMap$1(activeServers, connectedStatus) {
+  const out = [];
+  if (!activeServers || typeof activeServers.entries !== "function") return out;
+  for (const [key, server] of activeServers.entries()) {
+    if (!server || server.status !== connectedStatus) continue;
+    let serverName = key;
+    let workspaceId = null;
+    try {
+      const parsed = parseServerKey$1(key);
+      serverName = parsed.serverName;
+      workspaceId = normalizeWorkspace(parsed.workspaceId);
+    } catch (_) {
+      // Legacy un-prefixed key: treat as the no-workspace bucket.
+    }
+    out.push({
+      serverName,
+      workspaceId,
+      tools: server.tools || [],
+      resources: server.resources || [],
+      status: server.status,
+    });
+  }
+  return out;
+}
+
+const inBucket = (server, workspaceId) =>
+  normalizeWorkspace(server.workspaceId) === normalizeWorkspace(workspaceId);
+
+/**
+ * The bot form's provider list: every configured MCP provider (credential-only
+ * providers give a bot nothing to call, so they're excluded), with whether it's
+ * running in the bot's bucket and its tool count when known.
+ *
+ * `tools` is what the form offers for per-bot narrowing: the provider's
+ * declared `allowedTools` (set in Settings → Providers — known without starting
+ * the server); for a provider with no declared limit, the live tool names if
+ * it's running, else null (every tool, list not known yet). Never credentials.
+ */
+function listToolSources$1({
+  providers,
+  connected = [],
+  workspaceId = null,
+} = {}) {
+  if (!Array.isArray(providers)) return [];
+  return providers
+    .filter((p) => p && p.providerClass === "mcp" && p.name)
+    .map((p) => {
+      const live = (connected || []).find(
+        (s) => s.serverName === p.name && inBucket(s, workspaceId),
+      );
+      const declared = Array.isArray(p.allowedTools);
+      const liveNames = live
+        ? (live.tools || []).map((t) => t && t.name).filter(Boolean)
+        : null;
+      return {
+        name: p.name,
+        type: p.type || null,
+        running: !!live,
+        toolCount: live ? (live.tools || []).length : null,
+        declared,
+        tools: declared ? [...p.allowedTools] : liveNames,
+      };
+    })
+    .sort((a, b) => a.name.localeCompare(b.name));
+}
+
+/**
+ * The tools a bot may use on one provider: the provider's declared limit
+ * (Settings → Providers) is the ceiling; the bot's own selection narrows within
+ * it. null = no restriction (every tool the server exposes).
+ *
+ * @param {string[]|null|undefined} providerLimit  provider.allowedTools
+ * @param {string[]|null|undefined} selection      bot.toolSelections[provider]
+ * @returns {string[]|null}
+ */
+function effectiveAllowedTools(providerLimit, selection) {
+  const limit = Array.isArray(providerLimit) ? providerLimit : null;
+  const sel = Array.isArray(selection) ? selection : null;
+  if (limit && sel) return sel.filter((t) => limit.includes(t));
+  if (limit) return [...limit];
+  if (sel) return [...sel];
+  return null;
+}
+
+/**
+ * Before a run: start each of the bot's selected providers that isn't already
+ * connected in the bot's bucket, via the shared startServer factory (which
+ * itself dedupes concurrent starts). Never throws — returns per-provider
+ * failures so the run can surface them instead of silently running without
+ * those tools.
+ */
+async function ensureBotServers$1({
+  bot,
+  connected = [],
+  getProvider,
+  startServer,
+}) {
+  const failed = [];
+  const wanted = Array.isArray(bot && bot.mcpServers) ? bot.mcpServers : [];
+  const workspaceId = normalizeWorkspace(bot && bot.workspaceId);
+  for (const serverName of wanted) {
+    const running = (connected || []).some(
+      (s) => s.serverName === serverName && inBucket(s, workspaceId),
+    );
+    if (running) continue;
+    try {
+      // providerController.getProvider returns { provider } or
+      // { error, message }; accept a bare provider too.
+      const result = await getProvider(serverName);
+      if (result && result.error) {
+        failed.push({
+          serverName,
+          message:
+            result.message ||
+            `Provider "${serverName}" was not found in Settings → Providers`,
+        });
+        continue;
+      }
+      const provider = result && result.provider ? result.provider : result;
+      if (
+        !provider ||
+        provider.providerClass !== "mcp" ||
+        !provider.mcpConfig
+      ) {
+        failed.push({
+          serverName,
+          message: `Provider "${serverName}" was not found in Settings → Providers`,
+        });
+        continue;
+      }
+      const res = await startServer(
+        serverName,
+        provider.mcpConfig,
+        provider.credentials || {},
+        workspaceId,
+      );
+      if (res && res.error) {
+        failed.push({
+          serverName,
+          message: res.message || `Provider "${serverName}" failed to start`,
+        });
+      }
+    } catch (err) {
+      failed.push({
+        serverName,
+        message: (err && err.message) || String(err),
+      });
+    }
+  }
+  return { failed };
+}
+
+/**
+ * The bot's MCP tools: only its selected providers, only from its own bucket,
+ * and only the tools each provider allows (narrowed by the bot's own
+ * selection). Also returns `allowedFor` — the per-provider whitelist the
+ * caller passes to mcpController.callTool so a disallowed call is rejected
+ * there too (same double enforcement widgets get).
+ *
+ * When `providerLimits` is given it is authoritative and fails closed: a
+ * server with no entry (provider deleted, or provider info unreadable) gets no
+ * tools. Omit it only where no provider info exists at all (unit callers).
+ *
+ * @param {{ bot, connected, providerLimits?: Record<string, string[]|null> }} args
+ */
+function resolveBotTools$1({ bot, connected = [], providerLimits }) {
+  const wanted = new Set(
+    Array.isArray(bot && bot.mcpServers) ? bot.mcpServers : [],
+  );
+  const selections = (bot && bot.toolSelections) || {};
+  const workspaceId = bot && bot.workspaceId;
+  const tools = [];
+  const toolServer = Object.create(null);
+  const allowedFor = Object.create(null);
+  for (const server of connected || []) {
+    const name = server.serverName;
+    if (!wanted.has(name) || !inBucket(server, workspaceId)) continue;
+    if (providerLimits && !(name in providerLimits)) continue; // fail closed
+    const allowed = effectiveAllowedTools(
+      providerLimits ? providerLimits[name] : undefined,
+      selections[name],
+    );
+    allowedFor[name] = allowed;
+    for (const tool of server.tools || []) {
+      if (allowed && !allowed.includes(tool.name)) continue;
+      tools.push(tool);
+      toolServer[tool.name] = name;
+    }
+  }
+  return { tools, toolServer, allowedFor };
+}
+
+/**
+ * Last-line enforcement for a bot tool call. `allowedMap` is the
+ * `allowedFor` from this bot's resolveBotTools. Fails closed: unknown bot,
+ * unknown provider, or a tool outside the whitelist → rejected.
+ *
+ * @returns {{ ok: true, allowed: string[]|null } | { ok: false, message: string }}
+ */
+function checkToolCall$1(allowedMap, serverName, toolName) {
+  if (
+    !allowedMap ||
+    !Object.prototype.hasOwnProperty.call(allowedMap, serverName)
+  ) {
+    return {
+      ok: false,
+      message: `Tool "${toolName}" is not available to this bot (provider "${serverName}" isn't one of its providers).`,
+    };
+  }
+  const allowed = allowedMap[serverName];
+  if (Array.isArray(allowed) && !allowed.includes(toolName)) {
+    return {
+      ok: false,
+      message: `Tool "${toolName}" is not allowed for this bot on "${serverName}".`,
+    };
+  }
+  return { ok: true, allowed: Array.isArray(allowed) ? allowed : null };
+}
+
+var toolSources = {
+  checkToolCall: checkToolCall$1,
+  connectedServersFromMap: connectedServersFromMap$1,
+  listToolSources: listToolSources$1,
+  ensureBotServers: ensureBotServers$1,
+  resolveBotTools: resolveBotTools$1,
+  effectiveAllowedTools,
+};
+
 /**
  * mcpScopeResolver.js
  *
@@ -37577,6 +37837,7 @@ const os$2 = require$$2;
 const responseCache$2 = responseCache_1;
 const { gateToolCall, gateToolCallWithJit } = permissionGate;
 const { serverKey, parseServerKey } = mcpServerKey;
+const { connectedServersFromMap } = toolSources;
 const { applyPathScopeToCredentials } = mcpScopeResolver;
 const { readEnforceFlag: readEnforceFlag$1, readJitFlag: readJitFlag$1 } = securityFlags;
 const { app: app$8 } = require$$0$2;
@@ -37750,7 +38011,7 @@ function getShellPath$1() {
     return _shellPath$1;
   }
 
-  const { execSync } = require$$12;
+  const { execSync } = require$$13;
   const fallbackDirs = ["/usr/local/bin", "/opt/homebrew/bin"];
 
   // Scan nvm versions, tracking both latest and best compatible version
@@ -38854,24 +39115,16 @@ const mcpController$3 = {
   /**
    * listConnectedServers
    * Returns all connected servers with their cached tool lists.
-   * Used by llmController to discover available MCP tools.
+   * Used by bots + the LLM tool picker to discover available MCP tools.
    *
-   * @returns {Array<{ serverName, tools, resources, status }>}
+   * `serverName` is the real server name and `workspaceId` its bucket
+   * (null = no workspace) — activeServers is keyed "<workspace>::<server>",
+   * and returning that compound key as `serverName` broke name matching.
+   *
+   * @returns {Array<{ serverName, workspaceId, tools, resources, status }>}
    */
-  listConnectedServers: () => {
-    const servers = [];
-    for (const [serverName, server] of activeServers) {
-      if (server.status === STATUS$1.CONNECTED) {
-        servers.push({
-          serverName,
-          tools: server.tools || [],
-          resources: server.resources || [],
-          status: server.status,
-        });
-      }
-    }
-    return servers;
-  },
+  listConnectedServers: () =>
+    connectedServersFromMap(activeServers, STATUS$1.CONNECTED),
 
   /**
    * runAuth
@@ -38884,7 +39137,7 @@ const mcpController$3 = {
    * @returns {{ success } | { error, message }}
    */
   runAuth: async (win, mcpConfig, credentials, authCommand) => {
-    const { spawn } = require$$12;
+    const { spawn } = require$$13;
 
     const env = cleanEnvForChildProcess();
 
@@ -59749,7 +60002,7 @@ var mcpDashServerController_1 = mcpDashServerController$4;
  * can use the Chat widget without a separate API key.
  */
 
-const { spawn, execSync } = require$$12;
+const { spawn, execSync } = require$$13;
 const {
   LLM_STREAM_DELTA: LLM_STREAM_DELTA$2,
   LLM_STREAM_TOOL_CALL: LLM_STREAM_TOOL_CALL$2,
@@ -73788,6 +74041,10 @@ function withDefaults$1(def = {}) {
     // specific engine id here (e.g. "claude-agent").
     engine: null,
     mcpServers: [],
+    // Per-provider narrowing within each provider's declared tools:
+    // { [providerName]: string[] }. No entry → every tool the provider allows.
+    toolSelections: {},
+    // Tools that skip the approval prompt (NOT the tools the bot may use).
     allowedTools: [],
     approvalPolicy: "ask",
     schedules: [],
@@ -73849,6 +74106,22 @@ function validateBotDefinition$1(def) {
       errors.push(`${field} must be an array`);
     }
   }
+  // toolSelections: { [providerName]: string[] } — per-bot tool narrowing.
+  if (def.toolSelections !== undefined) {
+    const ts = def.toolSelections;
+    const ok =
+      ts &&
+      typeof ts === "object" &&
+      !Array.isArray(ts) &&
+      Object.values(ts).every(
+        (v) => Array.isArray(v) && v.every((t) => typeof t === "string"),
+      );
+    if (!ok) {
+      errors.push(
+        "toolSelections must map provider names to arrays of tool names",
+      );
+    }
+  }
   // Each subscription must name an eventType (PRD FR-009).
   if (Array.isArray(def.subscriptions)) {
     for (const sub of def.subscriptions) {
@@ -74915,6 +75188,9 @@ var agentToolBridge = {
 const { createEventStream } = eventStream;
 const { BOT_MCP_SERVER, buildBotMcpServer } = agentToolBridge;
 
+// The SDK names bridged tools "mcp__<server>__<tool>".
+const BRIDGED_PREFIX = `mcp__${BOT_MCP_SERVER}__`;
+
 // Test seam: injected fake `query` implementation (see __setQueryForTest).
 let _queryImpl = null;
 
@@ -74974,7 +75250,27 @@ function _makeCanUseTool(ctx) {
     if (ctx.approvalPolicy === "allow") {
       return { behavior: "allow", updatedInput: input };
     }
-    // Otherwise gate through the approval queue (shown in the Activity panel).
+    // Bridged Dash provider tools go through the SAME Dash permission gate as
+    // the tool-loop engine — grants, remembered approvals ("Always allow"),
+    // and the approval queue all apply, keyed by the real provider.
+    if (
+      typeof toolName === "string" &&
+      toolName.startsWith(BRIDGED_PREFIX) &&
+      typeof ctx.requestPermission === "function"
+    ) {
+      const decision = await ctx.requestPermission(
+        toolName.slice(BRIDGED_PREFIX.length),
+        input,
+      );
+      return decision && decision.allow
+        ? { behavior: "allow", updatedInput: input }
+        : {
+            behavior: "deny",
+            message: (decision && decision.reason) || "not permitted",
+          };
+    }
+    // Built-in tools (Bash, Write, …) ask every time via the approval queue
+    // (shown in the Activity panel) — they're never remembered.
     if (typeof ctx.createApproval !== "function") {
       return { behavior: "deny", message: "no approval channel available" };
     }
@@ -74998,18 +75294,29 @@ function _makeCanUseTool(ctx) {
 async function _runAgent(ctx, stream) {
   const query = await _loadQuery();
 
-  // Auth: prefer the Claude Code CLI session (zero-config); fall back to the
-  // bot's Anthropic API key. NOTE: this sets a process-global env var — fine for
-  // the common single-key case; per-run isolation is a follow-up.
+  // Per-run environment for the agent process. Auth: the Claude Code login by
+  // default; a bot's Anthropic API key, when set, goes in THIS run's env only —
+  // never process.env, which would leak it to the rest of the main process and
+  // to other bots.
+  const env = { ...process.env };
   if (ctx.credentials && ctx.credentials.apiKey) {
-    process.env.ANTHROPIC_API_KEY = ctx.credentials.apiKey;
+    env.ANTHROPIC_API_KEY = ctx.credentials.apiKey;
   }
+  // No claude.ai connectors from the user's Claude login.
+  env.ENABLE_CLAUDEAI_MCP_SERVERS = "false";
 
   const options = {
     model: ctx.model,
     systemPrompt: ctx.systemPrompt || { type: "preset", preset: "claude_code" },
     permissionMode: "default",
     canUseTool: _makeCanUseTool(ctx),
+    // Isolation: a bot sees only the SDK's built-in tools + the Dash providers
+    // it was granted (bridged below as "bot-mcp"). Don't load the user's
+    // ~/.claude settings/plugins/skills/hooks, and ignore every MCP config
+    // other than the servers passed in `mcpServers`.
+    settingSources: [],
+    strictMcpConfig: true,
+    env,
   };
   if (ctx.maxTurns) options.maxTurns = ctx.maxTurns;
   if (ctx.workingDir) options.cwd = ctx.workingDir;
@@ -75445,12 +75752,17 @@ let BotRunner$1 = class BotRunner {
         }
         return this._callTool(serverName, toolName, input, {
           workspaceId: bot.workspaceId,
+          // Lets the caller apply this bot's per-provider tool limits.
+          botId,
         });
       };
 
-      // Resume only when the stored session was produced by this engine.
+      // A run does the bot's job against current data → fresh conversation.
+      // Resume only when explicitly continuing (reply-to-continue) AND the
+      // stored session was produced by this engine. Anything a bot should
+      // carry between runs belongs in its memory tools.
       const session =
-        bot.session && bot.session.engine === engine.id
+        opts.continueSession && bot.session && bot.session.engine === engine.id
           ? bot.session.state
           : null;
 
@@ -76253,6 +76565,111 @@ function normalizeMcpResult$1(mcpResult) {
 
 var mcpResult = { normalizeMcpResult: normalizeMcpResult$1 };
 
+/**
+ * rememberGrant.js — turn an "Always allow" bot approval into a durable grant,
+ * and revoke it.
+ *
+ * Bot grants live in the shared grant store (electron/mcp/grantedPermissions)
+ * keyed by botId, shape `{ servers: { [provider]: { tools, readPaths,
+ * writePaths } } }`, and are enforced by the bot permission gate
+ * (gateBotToolCall). A remembered approval is scoped to this bot + this
+ * provider + this tool, plus — when the tool call carries a path argument —
+ * the folder of that path (write folder for write tools, read folder
+ * otherwise). Nothing broader.
+ *
+ * Pure (NFR-006): the gate's path rules (isWriteTool, path arg keys) and
+ * `dirname` are injected so this matches the real gate exactly.
+ */
+
+const LISTING_TOOL = /(list|director|tree|search)/i;
+
+/**
+ * The folder to remember for a path argument: a `directory` arg, or a
+ * directory-listing tool, names the folder itself; any other path is a file,
+ * so its parent folder is remembered.
+ */
+function folderForPathArg(key, value, toolName, dirname) {
+  if (key === "directory" || LISTING_TOOL.test(String(toolName || ""))) {
+    return value;
+  }
+  return dirname(value);
+}
+
+const clone = (perms) =>
+  perms && typeof perms === "object" ? JSON.parse(JSON.stringify(perms)) : {};
+
+const addUnique = (list, value) =>
+  list.includes(value) ? list : [...list, value];
+
+/**
+ * @param {object|null} perms  the bot's current grant (or null)
+ * @param {{ serverName: string, toolName: string, args?: object }} call
+ * @param {{ isWriteTool: Function, pathArgKeys: string[], dirname: Function }} helpers
+ * @returns {object} the new grant (input is not mutated)
+ */
+function rememberToolGrant$1(perms, call, helpers) {
+  const { serverName, toolName, args } = call;
+  const next = clone(perms);
+  next.grantOrigin = next.grantOrigin || "manual";
+  next.servers = next.servers || {};
+  const server = next.servers[serverName] || {
+    tools: [],
+    readPaths: [],
+    writePaths: [],
+  };
+  server.tools = addUnique(server.tools || [], toolName);
+  server.readPaths = server.readPaths || [];
+  server.writePaths = server.writePaths || [];
+
+  if (args && typeof args === "object") {
+    const isWrite = helpers.isWriteTool(toolName);
+    for (const key of helpers.pathArgKeys) {
+      const v = args[key];
+      if (typeof v !== "string" || !v) continue;
+      const folder = folderForPathArg(key, v, toolName, helpers.dirname);
+      if (isWrite) server.writePaths = addUnique(server.writePaths, folder);
+      else server.readPaths = addUnique(server.readPaths, folder);
+    }
+  }
+
+  next.servers[serverName] = server;
+  return next;
+}
+
+/**
+ * Revoke one remembered tool. When it was the provider's last remembered
+ * tool, the provider entry (and its folders) is removed entirely.
+ */
+function forgetToolGrant$1(perms, serverName, toolName) {
+  const server = perms && perms.servers && perms.servers[serverName];
+  if (!server || !(server.tools || []).includes(toolName)) return perms;
+  const next = clone(perms);
+  const tools = next.servers[serverName].tools.filter((t) => t !== toolName);
+  if (tools.length) next.servers[serverName].tools = tools;
+  else delete next.servers[serverName];
+  return next;
+}
+
+/** Remembered tools + folders per provider, for display in the bot form. */
+function summarizeGrants$1(perms) {
+  const out = {};
+  const servers = (perms && perms.servers) || {};
+  for (const [name, s] of Object.entries(servers)) {
+    out[name] = {
+      tools: [...(s.tools || [])],
+      folders: [...(s.readPaths || []), ...(s.writePaths || [])],
+    };
+  }
+  return out;
+}
+
+var rememberGrant = {
+  rememberToolGrant: rememberToolGrant$1,
+  forgetToolGrant: forgetToolGrant$1,
+  summarizeGrants: summarizeGrants$1,
+  folderForPathArg,
+};
+
 /**
  * botController.js
  *
@@ -76284,6 +76701,19 @@ const {
 const { matchSubscribedBots } = eventMatcher;
 const { EventDispatcher } = EventDispatcher_1;
 const { normalizeMcpResult } = mcpResult;
+const {
+  listToolSources,
+  ensureBotServers,
+  resolveBotTools,
+  checkToolCall,
+} = toolSources;
+const {
+  rememberToolGrant,
+  forgetToolGrant,
+  summarizeGrants,
+} = rememberGrant;
+const grantStore = grantedPermissions;
+const { isWriteTool, PATH_ARG_KEYS } = permissionGate;
 const {
   getProvider: getProvider$1,
   getDefaultModel,
@@ -76387,6 +76817,10 @@ const botController$1 = {
     // flood the runner with event-triggered runs.
     this._dispatcher = new EventDispatcher();
 
+    // botId → { [providerName]: allowed tool names | null }, set on each run's
+    // tool resolution and enforced in _callTool.
+    this._allowedByBot = new Map();
+
     this._runner = new BotRunner({
       engines,
       store: this._store,
@@ -76472,6 +76906,26 @@ const botController$1 = {
     return this._store.list();
   },
 
+  /**
+   * The user's Dash MCP providers a bot can use (Settings → Providers), with
+   * running status + tool count. Names/types only — never credentials.
+   */
+  listToolSources(workspaceId = null) {
+    let providers = [];
+    try {
+      const win = this._getMainWindow();
+      ({ providers = [] } =
+        this._providers.listProviders(win, this._appId) || {});
+    } catch (_e) {
+      providers = [];
+    }
+    return listToolSources({
+      providers,
+      connected: this._connectedServers(),
+      workspaceId,
+    });
+  },
+
   get(botId) {
     return this._store.get(botId);
   },
@@ -76487,6 +76941,8 @@ const botController$1 = {
 
   delete(botId) {
     this._scheduler.unregister(botId);
+    // A deleted bot's remembered approvals go with it.
+    grantStore.revokeGrant(botId);
     return this._store.delete(botId);
   },
 
@@ -76498,10 +76954,50 @@ const botController$1 = {
     return { stopped: this._runner.abort(botId) };
   },
 
+  /**
+   * Resolve a pending approval. `decision.remember` ("Always allow") also
+   * saves a durable grant for this bot + provider + tool (+ the folder of a
+   * path argument), so later runs use that tool without asking. Only provider
+   * tool approvals can be remembered — built-in agent tools have no provider
+   * and always ask.
+   */
   approve(approvalId, decision = {}) {
-    return decision.allow
-      ? { ok: this._approvals.resolve(approvalId, decision) }
-      : { ok: this._approvals.deny(approvalId, decision.reason) };
+    if (!decision.allow) {
+      return { ok: this._approvals.deny(approvalId, decision.reason) };
+    }
+    let remembered = false;
+    if (decision.remember) {
+      const pending = this._approvals.get(approvalId);
+      const req = pending && pending.request;
+      if (req && req.botId && req.serverName && req.toolName) {
+        const next = rememberToolGrant(
+          grantStore.getGrant(req.botId),
+          {
+            serverName: req.serverName,
+            toolName: req.toolName,
+            args: req.input,
+          },
+          { isWriteTool, pathArgKeys: PATH_ARG_KEYS, dirname: path$2.dirname },
+        );
+        remembered = grantStore.setGrant(req.botId, next) === true;
+      }
+    }
+    return { ok: this._approvals.resolve(approvalId, decision), remembered };
+  },
+
+  /** Remembered approvals for a bot: { [provider]: { tools, folders } }. */
+  getGrants(botId) {
+    return summarizeGrants(grantStore.getGrant(botId));
+  },
+
+  /** Revoke one remembered tool approval; returns the updated summary. */
+  revokeGrant(botId, serverName, toolName) {
+    const current = grantStore.getGrant(botId);
+    if (current) {
+      const next = forgetToolGrant(current, serverName, toolName);
+      if (next !== current) grantStore.setGrant(botId, next);
+    }
+    return this.getGrants(botId);
   },
 
   listApprovals() {
@@ -76638,23 +77134,58 @@ const botController$1 = {
     };
   },
 
-  /** Build the bot's tool set + tool→server resolver from connected servers. */
-  _resolveTools(bot) {
-    const connected = this._mcp.listConnectedServers
+  /** Connected MCP servers with real server names + workspace buckets. */
+  _connectedServers() {
+    return this._mcp && this._mcp.listConnectedServers
       ? this._mcp.listConnectedServers()
       : [];
-    const wanted = Array.isArray(bot.mcpServers)
-      ? new Set(bot.mcpServers)
-      : null;
-    const tools = [];
-    const toolServer = Object.create(null);
-    for (const server of connected) {
-      if (wanted && !wanted.has(server.serverName)) continue;
-      for (const tool of server.tools || []) {
-        tools.push(tool);
-        toolServer[tool.name] = server.serverName;
+  },
+
+  /**
+   * Build the bot's tool set + tool→server resolver. First starts any of the
+   * bot's selected providers that aren't running in its bucket — through the
+   * same deduping startServer factory the dashboards use — so a scheduled or
+   * event-triggered bot doesn't silently run without its tools. Start
+   * failures are surfaced in the run feed as warnings.
+   */
+  async _resolveTools(bot) {
+    if (this._mcp && this._mcp.startServer && this._providers) {
+      const win = this._getMainWindow();
+      const { failed } = await ensureBotServers({
+        bot,
+        connected: this._connectedServers(),
+        getProvider: async (name) =>
+          this._providers.getProvider(win, this._appId, name),
+        startServer: (name, mcpConfig, credentials, workspaceId) =>
+          this._mcp.startServer(
+            win,
+            name,
+            mcpConfig,
+            credentials,
+            workspaceId,
+            null,
+            this._appId,
+          ),
+      });
+      for (const f of failed) {
+        this._broadcast(BOT_STREAM$1, {
+          botId: bot.id,
+          event: {
+            type: "warning",
+            message: `${f.serverName} couldn't start, so its tools aren't available this run: ${f.message}`,
+          },
+        });
       }
     }
+    // Each provider's declared tools (Settings → Providers) are the ceiling;
+    // the bot's toolSelections narrow within them.
+    const { tools, toolServer, allowedFor } = resolveBotTools({
+      bot,
+      connected: this._connectedServers(),
+      providerLimits: this._providerToolLimits(),
+    });
+    // Remembered per bot so _callTool can hard-enforce the same whitelist.
+    this._allowedByBot.set(bot.id, allowedFor);
     // Always-available in-process memory tools (P1: FR-010).
     for (const tool of MEMORY_TOOLS) {
       tools.push(tool);
@@ -76674,20 +77205,54 @@ const botController$1 = {
       );
     }
     const win = this._getMainWindow();
+    // The bot's per-provider whitelist (provider limit ∩ bot selection), from
+    // the last _resolveTools for this bot. A tool outside it is rejected —
+    // mirroring the allowedTools enforcement widgets get. If no entry exists
+    // for this provider, the bot never had it resolved → deny.
+    const check = checkToolCall(
+      this._allowedByBot.get(opts.botId),
+      serverName,
+      toolName,
+    );
+    if (!check.ok) return { text: check.message, isError: true };
+    const { allowed } = check;
     // widgetId + token are null → the widget permission gate is bypassed; bot
-    // tool calls are gated upstream by the bot PermissionGate.
+    // tool calls are gated upstream by the bot PermissionGate. `allowed` is
+    // also passed as callTool's whitelist (defense in depth).
     const result = await this._mcp.callTool(
       win,
       serverName,
       toolName,
       args,
-      null,
+      allowed || null,
       null,
       opts.workspaceId || null,
       null,
     );
     return normalizeMcpResult(result);
   },
+
+  /** { [providerName]: allowedTools | null } for the user's MCP providers. */
+  _providerToolLimits() {
+    const limits = Object.create(null);
+    try {
+      const win = this._getMainWindow();
+      const { providers = [] } =
+        this._providers.listProviders(win, this._appId) || {};
+      for (const p of providers) {
+        if (p && p.providerClass === "mcp" && p.name) {
+          limits[p.name] = Array.isArray(p.allowedTools)
+            ? p.allowedTools
+            : null;
+        }
+      }
+    } catch (_e) {
+      // Provider info unreadable → empty map. resolveBotTools treats a
+      // provider with no entry as not configured, so the bot gets NO tools
+      // from it (fails closed) rather than every tool the server exposes.
+    }
+    return limits;
+  },
 };
 
 var botController_1 = botController$1;
@@ -80600,6 +81165,9 @@ const {
   BOTS_PAUSE_BOT,
   BOTS_RESUME_BOT,
   BOTS_GET_PAUSE_STATE,
+  BOTS_LIST_TOOL_SOURCES,
+  BOTS_GET_GRANTS,
+  BOTS_REVOKE_GRANT,
   BOT_STREAM,
   BOT_APPROVAL_PENDING,
   BOT_BUDGET_ALERT,
@@ -80648,6 +81216,16 @@ const botApi$1 = {
   resumeBot: (botId) => ipcRenderer$3.invoke(BOTS_RESUME_BOT, { botId }),
   getPauseState: () => ipcRenderer$3.invoke(BOTS_GET_PAUSE_STATE),
 
+  /** The user's Dash MCP providers a bot can use: [{ name, type, running, toolCount }]. */
+  listToolSources: (workspaceId = null) =>
+    ipcRenderer$3.invoke(BOTS_LIST_TOOL_SOURCES, { workspaceId }),
+
+  /** Remembered approvals ("Always allow"): { [provider]: { tools, folders } }. */
+  getGrants: (botId) => ipcRenderer$3.invoke(BOTS_GET_GRANTS, { botId }),
+  /** Revoke one remembered tool approval; resolves to the updated summary. */
+  revokeGrant: (botId, serverName, toolName) =>
+    ipcRenderer$3.invoke(BOTS_REVOKE_GRANT, { botId, serverName, toolName }),
+
   /** Subscribe to streamed run events: { botId, event }. */
   onStream: (callback) => _addListener(BOT_STREAM, callback),
   /** Subscribe to new pending approvals: { id, request }. */