@vanillagreen/pi-claude-bridge 3.2.2 → 4.0.1

package/src/query-options.ts

@@ -83,7 +83,7 @@ export function buildClaudeQueryOptions(input: BuildClaudeQueryOptionsInput): Bu
 	const connectorWriteMode = connectorWriteModeFor(bridgeConfig);
 	// Declare the account's connected connectors explicitly so `alwaysLoad` can
 	// hold startup until they attach — otherwise the turn-1 manifest is built
-	// before the CLI has fetched them (vstack#832).
+	// before the CLI has fetched them.
 	const connectorServers = enableCloudMcp ? connectorServersSnapshot(accountScope.claudeConfigDir) : {};
 	const appendSystemPrompt = providerSettings.appendSystemPrompt !== false;
 	const agentsAppend = appendSystemPrompt ? extractAgentsAppend() : undefined;
@@ -98,7 +98,7 @@ export function buildClaudeQueryOptions(input: BuildClaudeQueryOptionsInput): Bu
 	// ignores auto-discovered filesystem MCP servers while Pi owns tool execution.
 	// Connectors mode needs settings resolution ON but restricted to USER scope
 	// only — project/local settings files can smuggle `env`/`apiKeyHelper` from
-	// a hostile checkout (vstack#990). Full rationale on settingSourcesForQuery.
+	// a hostile checkout. Full rationale on settingSourcesForQuery.
 	const settingSources: SettingSource[] | undefined = settingSourcesForQuery(
 		enableCloudMcp, appendSystemPrompt, providerSettings.settingSources);
 	const strictMcpConfigEnabled = !appendSystemPrompt && providerSettings.strictMcpConfig !== false;
@@ -113,7 +113,7 @@ export function buildClaudeQueryOptions(input: BuildClaudeQueryOptionsInput): Bu
 
 	const extraArgs: Record<string, string | null> = {};
 	// Opus 4.7 defaults thinking.display to "omitted" (empty thinking text in stream).
-	// Force summarized so thinking_delta events arrive. See anthropics/claude-agent-sdk-python#830.
+	// Force summarized so thinking_delta events arrive.
 	// Deliberately the raw flag, NOT the typed `thinking` option: every non-disabled
 	// ThinkingConfig also emits `--thinking adaptive` or `--max-thinking-tokens`
 	// (verified in sdk.mjs flag mapping), so the typed form cannot set display
@@ -136,7 +136,7 @@ export function buildClaudeQueryOptions(input: BuildClaudeQueryOptionsInput): Bu
 	// DISABLE_AUTO_COMPACT=1: pi owns context-management and propagates its own
 	// /compact via session_compact (see handler in the extension entry). Letting CC
 	// also autocompact would double-flush the prompt cache and races pi's
-	// threshold with CC's, including CC's anti-thrashing guard (issue #8).
+		// threshold with CC's, including CC's anti-thrashing guard.
 	// Manual /compact in CC still works (we never invoke it).
 	// When connectors are enabled, allow claude.ai cloud MCP servers so the
 	// authenticated account's Gmail/Calendar/Drive tools load. Default stays "0".

package/src/query-state.ts

@@ -2,9 +2,8 @@
 //
 // All per-query and per-turn mutable state lives here. Reentrant queries
 // (subagents) push the parent context onto a stack and get a fresh instance.
-// Adding a new field = one property on the class.
 //
-// Extracted from index.ts so tests can import without activating the extension.
+// Separate from index.ts so tests can import it without activating the extension.
 
 import type { ContentBlockParam } from "@anthropic-ai/sdk/resources";
 import type { AssistantMessage, AssistantMessageEventStream, Model } from "@earendil-works/pi-ai";
@@ -15,8 +14,7 @@ import { currentRequestLaneId } from "./request-lane.js";
 /** A mid-query user run captured for replay after the active query ends.
  *  `text` is the joined text form (previews, and the replay prompt when no
  *  image blocks were captured). `blocks` is present when the run carried
- *  images — the replay must send the blocks or the images are silently lost
- *  (vstack#993). */
+ *  images — the replay must send the blocks or the images are silently lost. */
 export interface DeferredUserMessage {
 	text: string;
 	blocks?: ContentBlockParam[];
@@ -25,7 +23,7 @@ export interface DeferredUserMessage {
 /** Diag payload for a deferred-message drop: counts, sites, and lengths only.
  *  The messages are user-authored prompt text and the diag log sits outside
  *  any host app's retention boundary, so no content — not even a preview —
- *  may appear in the entry (VST-15). */
+ *  may appear in the entry. */
 export function summarizeDroppedUserMessages(site: string, dropped: DeferredUserMessage[]): Record<string, unknown> {
 	return {
 		site,
@@ -40,7 +38,7 @@ export interface PendingToolCall {
 	/** The MCP invocation's schema-validated arguments. The SDK hands the handler
 	 *  the COMPLETE input, so this is the authoritative copy — the grace-timer
 	 *  finalize settles a still-partial streamed block from here instead of from
-	 *  its truncated partial JSON (vstack#1469: a `{}` settle made Pi execute
+	 *  its truncated partial JSON (a `{}` settle would make Pi execute
 	 *  empty-argument calls). */
 	args: Record<string, unknown>;
 	/** `QueryContext.callbackGeneration` at registration. A handler from an older
@@ -106,7 +104,7 @@ export function strandedToolCallResult(): McpResult {
  *  forwarded (Pi owes it a result — steer-split deliveries arrive turns later)
  *  or nothing is waiting. Marks the id dead so a lagging stream replay can
  *  never forward it AFTER the model was told it failed — that late forward
- *  would execute the call a second time behind the model's back (vstack#1469).
+ *  would execute the call a second time behind the model's back.
  *  Returns true when a handler was failed. */
 export function failStrandedToolCall(queryCtx: QueryContext, id: string): boolean {
 	if (queryCtx.forwardedToolCallIds.has(id)) return false;
@@ -166,7 +164,7 @@ export function takeQueuedOrParkedResult(queryCtx: QueryContext, id: string): Mc
 export interface ConnectorCallAuditState {
 	name: string;
 	/** The child session that issued it, captured when the call was seen — a
-	 *  continuation query gets a new one, and a call is audited against the session
+	 *  continuation query gets its own, and a call is audited against the session
 	 *  that actually made it. */
 	childSessionId?: string;
 	recorded: boolean;
@@ -253,19 +251,18 @@ export class QueryContext {
 	pendingToolCalls = new Map<string, PendingToolCall>();
 	pendingResults = new Map<string, McpResult>();
 	/** Results a message-boundary reap moved OUT of pendingResults so they stop
-	 *  poisoning mismatch reports, kept CONSUMABLE for a handler that fires later.
-	 *  The 2026-08-17 deadlock session showed the reap's "no consumer will ever
-	 *  come" assumption failing routinely: Pi delivers a turn's results in one
-	 *  callback while the SDK staggers handler invocations past the next message
-	 *  boundary. Query-scoped, bounded by the query's tool-call count. */
+	 *  poisoning mismatch reports, kept CONSUMABLE for a handler that fires later:
+	 *  Pi delivers a turn's results in one callback while the SDK staggers handler
+	 *  invocations past the next message boundary, so a boundary never proves that
+	 *  no consumer will come. Query-scoped, bounded by the query's tool-call count. */
 	reapedResults = new Map<string, McpResult>();
 	/** Every tool-call id this query has handed to Pi inside an ENDED turn — the
 	 *  set endToolUseTurn stamps from the turn's content. A forwarded id is one Pi
 	 *  will execute and answer; it must never be emitted again (a lagging stream
 	 *  replays the same tool_use into the NEXT turn, and per-message turnBlocks
-	 *  dedup cannot see across turns — vstack#1469's duplicate executions), and a
-	 *  handler waiting on it must be left waiting at the stranded-handler drains.
-	 *  Query-scoped, never reset per message. */
+	 *  dedup cannot see across turns), and a handler waiting on it must be left
+	 *  waiting at the stranded-handler drains. Query-scoped, never reset per
+	 *  message. */
 	forwardedToolCallIds = new Set<string>();
 	/** Ids whose waiting handler was resolved with strandedToolCallResult. The
 	 *  model has been told these calls failed; forwarding one later would execute
@@ -287,15 +284,15 @@ export class QueryContext {
 	 * resets at every message boundary, but `pendingResults` is query-scoped, so a
 	 * result stranded there outlives the message that named it. Without this map a
 	 * teardown report can only say "1 queued" with empty toolNames and 0/0
-	 * counters — which is exactly the unactionable record the 2026-07-28 diag log
-	 * showed. Bounded by the number of tool calls in one query.
+	 * counters — an unactionable record. Bounded by the number of tool calls in
+	 * one query.
 	 */
 	queryToolNames = new Map<string, string>();
 	/** id → last-known arguments, query-scoped like queryToolNames and for the
 	 *  same reason: a late handler firing after resetToolTracking wiped the
 	 *  per-message records must still be able to exact-match the parked/queued
 	 *  result of ITS OWN call — without stored args the only fallback is
-	 *  sole-same-name, which can hand it a LIVE sibling's id (vstack#1469). */
+	 *  sole-same-name, which can hand it a LIVE sibling's id. */
 	queryToolArgs = new Map<string, Record<string, unknown>>();
 	claimedToolCallIds = new Set<string>();
 	deliveredToolResultIds = new Set<string>();
@@ -305,13 +302,13 @@ export class QueryContext {
 	deferredUserMessages: DeferredUserMessage[] = [];
 	handledTerminalError = false;
 	// Once visible text/thinking, a complete tool call, or a child-executed
-	// CONNECTOR dispatch reaches Pi, the request must never be replayed on
-	// another account (duplicate side effects). Query-scoped, not per-turn:
+	// connector/foreign-MCP dispatch reaches Pi, the request must never be
+	// replayed on another account (duplicate side effects). Query-scoped, not per-turn:
 	// resetTurnState must not clear it.
 	committedOutput = false;
 	/** True when this query holds NO claim on the module-level shared session
-	 *  record: a reentrant (subagent) query, or a foreign-conversation one-shot
-	 *  (vstack#1001). Every shared-record mutation reachable from this context —
+	 *  record: a reentrant (subagent) query, or a foreign-conversation one-shot.
+	 *  Every shared-record mutation reachable from this context —
 	 *  reportToolResultMismatch's needsRebuild/forceRotate mark, the cursor
 	 *  advances on the tool-result-delivery and orphaned-result paths — must
 	 *  no-op so the PARENT's record stays untouched. Assigned at fresh-query
@@ -349,18 +346,17 @@ export class QueryContext {
 	childSessionId: string | undefined;
 	/** Anthropic content-block indexes of the current assistant message that carry
 	 *  a child-executed tool_use. Scoped to one message: cleared at message_start,
-	 *  and an index is released as soon as a new block starts there. */
+	 *  and an index is released as soon as another block starts there. */
 	childExecutedStreamIndexes = new Set<number>();
 
 	// Usage accounting for a Pi turn that spans SEVERAL child assistant messages.
 	//
 	// Every child message is a separate billed API call, and each reports its own
 	// counters — `message_start`/`message_delta` REPLACE rather than accumulate. A
-	// Pi turn used to end at the first tool call, so one Pi message meant one child
-	// message and replacing was right. A turn containing a child-executed connector
-	// call now keeps running across the child's follow-up messages, so replacing
-	// would silently drop everything the earlier ones billed (measured: 55,685
-	// cache-write tokens lost on a single connector turn).
+	// Pi turn that ends at its first tool call spans one child message, where
+	// replacing is right. A turn containing a child-executed connector call keeps
+	// running across the child's follow-up messages, so replacing would silently
+	// drop everything the earlier ones billed.
 	//
 	// So: `turnUsageCarry` holds the totals of the child messages already COMPLETE
 	// in this Pi turn, `currentMessageUsage` holds the one in flight, and the Pi
@@ -420,8 +416,8 @@ export class QueryContext {
 		this.turnSawStreamEvent = false;
 		this.turnSawToolCall = false;
 		this.handledTerminalError = false;
-		// A new pi message means the previous turn's stream is done with; an armed
-		// end-timer for it must not fire into the new turn's state.
+		// A fresh pi message means the previous turn's stream is done with; an
+		// armed end-timer for it must not fire into this turn's state.
 		if (this.scheduledToolUseEnd) {
 			clearTimeout(this.scheduledToolUseEnd.timer);
 			this.scheduledToolUseEnd = null;
@@ -432,8 +428,8 @@ export class QueryContext {
 		this.currentMessageUsage = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
 		this.currentMessageId = undefined;
 		// Tool-call tracking is NOT reset here — it persists across the
-		// tool-result delivery callback for the same assistant message. New
-		// assistant messages call resetToolTracking() explicitly.
+		// tool-result delivery callback for the same assistant message. Each
+		// assistant message boundary calls resetToolTracking() explicitly.
 	}
 
 	resetToolTracking(): void {
@@ -517,7 +513,7 @@ export class QueryContext {
 		// Ids whose RESULT already sits queued or parked. A handler can fire after
 		// the message boundary wiped the per-message records — by then Pi has
 		// executed its call and only these query-scoped stores still know it
-		// (vstack#1469: the boundary reap used to make such a handler error out
+		// (dropping them at the boundary would make such a handler error out
 		// and the model re-run an already-executed side-effectful call). An
 		// exact-args match here outranks the live sole-same-name fallback below,
 		// so a late handler can never steal a live sibling's id while its own
@@ -556,10 +552,9 @@ export class QueryContext {
 			//   - the handler receives the MCP server's schema-VALIDATED copy of
 			//     the input (zod may strip unknown keys or apply defaults) while
 			//     the record holds the raw streamed input.
-			// Refusing here stranded the call outright: the handler errored into
-			// the child while pi's real result sat queued forever (diag log
-			// 2026-07-28, `edit` with argKeys [edits, path] on both sides). A
-			// same-type sole-candidate claim is strictly safer than that. With
+			// Refusing here strands the call outright: the handler errors into
+			// the child while pi's real result sits queued forever. A same-type
+			// sole-candidate claim is strictly safer than that. With
 			// SEVERAL same-name candidates and no exact match we still refuse —
 			// cross-pairing two live calls is the one outcome worse than failing.
 			chosen = byName[0];
@@ -585,9 +580,8 @@ export class QueryContext {
 	 * assistant fallback). Left in pendingResults, each entry poisons every later
 	 * mismatch report for the whole query (queued>0 with 0/0 counters and no tool
 	 * names) and forces a session rebuild per turn. But the boundary does NOT
-	 * prove the handler gave up — the SDK staggers handler invocations, and the
-	 * 2026-08-17 deadlock session (vstack#1469) had three of five parallel
-	 * handlers fire after this reap destroyed their results. So the reap parks
+	 * prove the handler gave up — the SDK staggers handler invocations, and
+	 * handlers in a parallel batch routinely fire after it. So the reap parks
 	 * instead of dropping: reports stay clean, and a late handler still gets its
 	 * real result through takeQueuedOrParkedResult.
 	 */
@@ -629,9 +623,9 @@ export class QueryContext {
 		const counts = new Map<string, number>();
 		if (affectedIds.size > 0) {
 			// Name the affected ids from the query-scoped map, not just this
-			// message's records: a queued straggler from an earlier child message is
+		// message's records: a queued straggler from a prior child message is
 			// exactly the case a mismatch report exists for, and this message's
-			// turnToolCalls no longer knows it.
+			// turnToolCalls does not know it.
 			for (const id of affectedIds) {
 				const name = this.queryToolNames.get(id)
 					?? this.turnToolCalls.find((call) => call.id === id)?.toolName
@@ -675,7 +669,7 @@ interface QueryLaneStoreV1 {
 	sessionLanes: Map<string, QueryLaneState>;
 }
 
-const QUERY_LANES_SYMBOL = Symbol.for("vstack.pi.claude-bridge.query-lanes.v1");
+const QUERY_LANES_SYMBOL = Symbol.for("kendex.pi.claude-bridge.query-lanes.v1");
 
 function queryLaneStore(): QueryLaneStoreV1 {
 	const host = globalThis as Record<symbol, unknown>;

package/src/query-teardown.ts

@@ -2,8 +2,8 @@
 // operates on the ONE context captured at query start — never the live ctx().
 // The two only differ while a reentrant (subagent) context is pushed, which is
 // exactly when a parent query ending abnormally (abort, child process death)
-// used to run this against the subagent's state: the parent's drain, audit
-// flush, and activeQuery clear were skipped, leaking its pending MCP handlers.
+// teardown must run against the parent state. Using the subagent state skips
+// the parent's drain, audit flush, and activeQuery clear, which leaks handlers.
 
 import { reportToolResultMismatch } from "./bridge-state.js";
 import { flushConnectorCallAudit } from "./connector-audit.js";
@@ -11,7 +11,7 @@ import { debug } from "./debug.js";
 import { drainPendingToolCalls, popContextFor, type QueryContext, type ToolCallDrainCause } from "./query-state.js";
 
 /** Tear down `queryCtx` after its SDK query settled. No-ops when the query is
- *  no longer the context's active one (a continuation replaced it, or teardown
+ *  is not the context's active one (a continuation replaced it, or teardown
  *  already ran). Returns true when teardown actually ran. */
 export function teardownQuery(
 	queryCtx: QueryContext,

package/src/rate-limit.ts

@@ -1,6 +1,6 @@
 import { USAGE_LIMIT_ERROR_PREFIXES } from "@anthropic-ai/claude-agent-sdk";
 
-export const RATE_LIMIT_AUTO_RESUME_EVENT = "vstack:rate-limit";
+export const RATE_LIMIT_AUTO_RESUME_EVENT = "kendex:rate-limit";
 export const RATE_LIMIT_TOKEN = "\x1b[31m[rate-limit]\x1b[39m";
 
 // The SDK export is @alpha — degrade to "no match" (pre-0.3.220 behavior) if a
@@ -79,7 +79,7 @@ export function normalizeRateLimitUtilization(value: unknown): number | undefine
 	// (100%) because that is the fail-closed direction — under the fraction
 	// convention 1 is the fully-consumed case the warning exists to surface,
 	// while under the percent convention 1% sits below the threshold anyway,
-	// so nothing is lost by warning (VST-16).
+	// so nothing is lost by warning.
 	if (value > 0 && value <= 1) return value * 100;
 	if (value > 1 && value <= 100) return value;
 	return undefined;

package/src/request-lane.ts

@@ -10,7 +10,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
  * keeps that identity attached to every promise, SDK iterator, and timer born
  * during the provider call without threading the id through every helper.
  */
-const REQUEST_LANE_SYMBOL = Symbol.for("vstack.pi.claude-bridge.request-lane.v1");
+const REQUEST_LANE_SYMBOL = Symbol.for("kendex.pi.claude-bridge.request-lane.v1");
 
 function requestLaneStorage(): AsyncLocalStorage<string> {
 	const host = globalThis as Record<symbol, unknown>;

package/src/session-persistence.ts

@@ -155,7 +155,7 @@ function canonicalize(p: string | undefined): string | undefined {
 // Decides whether a persisted bridge-session marker is safe to restore.
 //
 // The fork case is the load-bearing one: pi/core's createBranchedSession copies
-// every non-label entry from root→leaf into the new session file. That includes
+// every non-label entry from root→leaf into the fork session file. That includes
 // our claude-bridge-session markers from the parent. Restoring from them would
 // --resume parent's Claude jsonl on the fork's first turn, leaking conversation
 // past the fork point.
@@ -226,7 +226,7 @@ export function restoreSharedSessionFromPi(ctx: { sessionManager?: unknown; cwd?
 // instance can differ. Scheduling again for the same manager REPLACES the
 // pending timer: each fire appends the record's state as of its schedule and
 // restore reads the last marker, so the superseded entry is a stale duplicate.
-const SCHEDULED_PERSISTENCE_SYMBOL = Symbol.for("vstack.pi.claude-bridge.scheduled-persistence.v1");
+const SCHEDULED_PERSISTENCE_SYMBOL = Symbol.for("kendex.pi.claude-bridge.scheduled-persistence.v1");
 
 type PersistenceTimer = ReturnType<typeof setTimeout>;
 
@@ -287,7 +287,7 @@ export function schedulePersistSharedSession(ctxLike?: { sessionManager?: unknow
 			// A failed persist means the next startup restores a stale (or no)
 			// bridge marker and silently rebuilds — worth a diagnostic entry.
 			// Like all diagDump output this lands only under CLAUDE_BRIDGE_DEBUG=1
-			// (VST-15); the failure itself stays non-fatal either way.
+			// and the failure itself stays non-fatal either way.
 			diagDump("persist_shared_session_failed", {
 				sessionId: snapshot.sessionId.slice(0, 8),
 				cursor: snapshot.cursor,
@@ -391,7 +391,7 @@ export function planIncrementalPromptBatch(
 
 	// A cursor past the end is PROOF this messages array is not the conversation
 	// the cursor describes (e.g. a reentrant subagent's short context arriving
-	// while the parent's cursor is large). Clamping it used to fabricate a REUSE
+	// while the parent's cursor is large). Clamping it would fabricate a REUSE
 	// plan against foreign history — reject so the caller takes the rebuild path.
 	if (cursor > lastIndex) {
 		debug(`planIncrementalPromptBatch: rejected — cursor=${cursor} beyond last index ${lastIndex}; messages are not the conversation this cursor describes`);
@@ -438,7 +438,7 @@ function verifyWrittenSession(
 		safeNotify(
 			`Session file issue: ${msg}\n` +
 			`cwd=${displayPath(cwd)} realpath=${displayPath(safeRealpath(cwd))}\n` +
-			`Please copy and paste this message into a new issue at https://github.com/vanillagreencom/vstack/issues/new` +
+			`Please copy and paste this message into a new issue at https://github.com/vanillagreencom/kendex/issues/new` +
 			(DEBUG ? ` and attach ${DEBUG_LOG_PATH}` : ` (rerun with CLAUDE_BRIDGE_DEBUG=1 to capture a debug log)`),
 			"warning",
 		);
@@ -479,7 +479,7 @@ function debugSessionPaths(label: string, cwd: string, jsonlPath: string, claude
 //     promptStart can never land on a user message Claude already persisted:
 //     Claude owns [0, cursor), promptStart starts at the cursor and only ever
 //     advances (past the one optional assistant), so everything from
-//     promptStart on is new input. Returns the existing sessionId. Keeps CC's
+//     promptStart on is uncaptured input. Returns the existing sessionId. Keeps CC's
 //     prompt cache warm.
 //   REBUILD — no session yet, or pi's history has diverged (non-trailing
 //     missed messages, e.g. another provider took a turn). Wipes the existing
@@ -509,12 +509,12 @@ export function syncSharedSession(
 	account?: AccountSessionScope,
 ): SyncResult {
 	const sharedSession = getSharedSession();
-	const priorMessages = messages.slice(0, -1); // everything before the new user prompt
+	const priorMessages = messages.slice(0, -1); // everything before the current user prompt
 	const accountProfileId = account?.accountProfileId;
 	const scopeConfigDir = account?.claudeConfigDir; // resolved dir for managed, undefined for legacy
 	// What cc-session-io reads/writes. Managed requests always carry a resolved
 	// dir (accountSessionScope) so this never falls back to the process env the
-	// child no longer sees; legacy keeps the env rule unchanged.
+	// child does not see; legacy keeps the env rule unchanged.
 	const claudeDir = scopeConfigDir ?? process.env.CLAUDE_CONFIG_DIR;
 	const sameAccount = Boolean(
 		sharedSession &&
@@ -523,7 +523,7 @@ export function syncSharedSession(
 	);
 	const incomingFingerprint = conversationFingerprint(messages);
 
-	// FOREIGN-CONVERSATION guard (Case 6, vstack#1001). A subagent-shaped query
+	// FOREIGN-CONVERSATION guard. A subagent-shaped query
 	// arriving while the parent is IDLE is not reentrant, so it lands here as an
 	// outermost query. Without an identity check its short foreign context takes
 	// the REBUILD path — rewriting the PARENT's session file from foreign
@@ -568,7 +568,7 @@ export function syncSharedSession(
 			// Read the pre-update cursor first: setSharedSession reassigns the live
 			// binding, so comparing against sharedSession.cursor afterwards would
 			// always be equal and the "advanced past trailing assistant" debug
-			// branch could never print (vstack#993).
+			// branch could never print.
 			const cursorBeforeUpdate = sharedSession.cursor;
 			// A REUSE match proves identity, so the anchor may only strengthen here:
 			// a pre-3.1.1 record adopts it outright, and a turn-1 user-only anchor

package/src/tool-mapping.ts

@@ -1,11 +1,48 @@
+import { isMcpResourceTool } from "./connectors.js";
 import { MCP_SERVER_NAME, MCP_TOOL_PREFIX } from "./skills.js";
 
 const SDK_TO_PI_TOOL_NAME: Record<string, string> = {
 	read: "read", write: "write", edit: "edit", bash: "bash",
 };
 
+const BRIDGED_TOOL_PREFIXES = [
+	MCP_TOOL_PREFIX,
+	`mcp__${MCP_SERVER_NAME.replace(/-/g, "_")}__`,
+	`mcp/${MCP_SERVER_NAME}/`,
+	`mcp/${MCP_SERVER_NAME.replace(/-/g, "_")}/`,
+];
+
 // --- Provider helpers: tool name mapping ---
 
+function bridgedToolSuffix(normalized: string): string | undefined {
+	const prefix = BRIDGED_TOOL_PREFIXES.find((candidate) => normalized.startsWith(candidate));
+	return prefix ? normalized.slice(prefix.length) : undefined;
+}
+
+export function isForeignMcpTool(name: unknown): boolean {
+	if (typeof name !== "string") return false;
+	const normalized = name.toLowerCase();
+	return (normalized.startsWith("mcp__") || normalized.startsWith("mcp/")) && bridgedToolSuffix(normalized) === undefined;
+}
+
+export function isPiDispatchable(name: unknown, customToolNameToPi?: Map<string, string>): boolean {
+	if (typeof name !== "string" || !name) return false;
+	const normalized = name.toLowerCase();
+	const hasManifest = Boolean(customToolNameToPi?.size);
+	if (customToolNameToPi?.has(name) || customToolNameToPi?.has(normalized)) return true;
+	const bridgedSuffix = bridgedToolSuffix(normalized);
+	if (bridgedSuffix !== undefined) {
+		if (!hasManifest) return true;
+		return customToolNameToPi?.has(`${MCP_TOOL_PREFIX}${bridgedSuffix}`) ?? false;
+	}
+	// A foreign MCP namespace belongs to a child-loaded server, not Pi's bridge.
+	if (isForeignMcpTool(name)) return false;
+	// Resource discovery is deliberately mirrored as Pi's account-access audit.
+	if (isMcpResourceTool(name)) return true;
+	// A populated manifest is authoritative: every other bare name is a naming slip.
+	return !hasManifest;
+}
+
 export function mapToolName(name: string, customToolNameToPi?: Map<string, string>): string {
 	const normalized = name.toLowerCase();
 	const builtin = SDK_TO_PI_TOOL_NAME[normalized];
@@ -14,19 +51,15 @@ export function mapToolName(name: string, customToolNameToPi?: Map<string, strin
 		const mapped = customToolNameToPi.get(name) ?? customToolNameToPi.get(normalized);
 		if (mapped) return mapped;
 	}
-	for (const prefix of [
-		MCP_TOOL_PREFIX,
-		`mcp__${MCP_SERVER_NAME.replace(/-/g, "_")}__`,
-		`mcp/${MCP_SERVER_NAME}/`,
-		`mcp/${MCP_SERVER_NAME.replace(/-/g, "_")}/`,
-	]) {
-		if (normalized.startsWith(prefix)) return normalized.slice(prefix.length);
+	const bridgedSuffix = bridgedToolSuffix(normalized);
+	if (bridgedSuffix !== undefined) {
+		return customToolNameToPi?.get(`${MCP_TOOL_PREFIX}${bridgedSuffix}`) ?? bridgedSuffix;
 	}
 	return name;
 }
 
 // Renames for Claude Code SDK param names that differ from pi's native names.
-// Keys not listed here pass through unchanged, so new pi params work automatically.
+// Keys not listed here pass through unchanged, so additional Pi parameters work automatically.
 const SDK_KEY_RENAMES: Record<string, Record<string, string>> = {
 	read:  { file_path: "path" },
 	write: { file_path: "path" },

package/src/tool-pairing-audit.ts

@@ -131,13 +131,12 @@ export const LOST_TOOL_RESULT_TEXT =
  * IN PLACE, before cc-session-io's repairToolPairing runs.
  *
  * repairToolPairing backfills with a bare "[no tool result recorded]" — a
- * placeholder the model reads as tool OUTPUT and keeps reasoning on (observed:
- * two bash calls in the 2026-07-28 token test, silently treated as if they had
- * returned). An is_error result that says what happened and what to do turns a
+ * placeholder the model reads as tool OUTPUT and continues to reason from.
+ * An is_error result that says what happened and what to do turns a
  * silent correctness hazard into a recoverable failure.
  *
  * Results are prepended to the immediately following user message (tool_result
- * blocks must lead a user message), or a new user message is inserted when none
+ * blocks must lead a user message), or a synthetic user message is inserted when none
  * follows. `missing` must come from findUnpairedToolUses on the same array.
  */
 export function insertLostToolResultPlaceholders(
@@ -151,8 +150,8 @@ export function insertLostToolResultPlaceholders(
 		group.push(item);
 		byAssistant.set(item.assistantIndex, group);
 	}
-	// Descending order so inserting a new user message never shifts an index a
-	// later (earlier-in-array) group still needs.
+	// Descending order ensures that inserting a user message does not shift an index
+	// for a group that is earlier in the array.
 	for (const assistantIndex of [...byAssistant.keys()].sort((a, b) => b - a)) {
 		const group = byAssistant.get(assistantIndex)!;
 		const blocks = group.map((item) => block(item.id));