@vanillagreen/pi-claude-bridge 4.0.0 → 4.0.2

package/src/config.ts

@@ -44,7 +44,7 @@ export interface Config {
 		modelEffortOverrides?: Record<string, BridgeEffortLevel>;
 		/**
 		 * Verbatim override for the child's filesystem setting sources.
-		 * Defaults (see settingSourcesForQuery in connectors.ts): connectors
+		 * Defaults (see settingSourcesForQuery in connectors.ts) : connectors
 		 * mode uses ["user"] only, so repo-controlled `.claude/settings.json`
 		 * (project/local scope) cannot inject `env`/`apiKeyHelper` into the
 		 * child. Listing "project"/"local" here reopens that surface — only do
@@ -95,17 +95,25 @@ function expandHome(input: string): string {
 	return input;
 }
 
+/** Root-anchored as `crates/core/src/harness/pi.rs::pi_root_is_absolute_for`
+ * means it, which `isAbsolute` is not: it calls a driveless `\root` absolute
+ * where the renderer does not, putting the two on different roots. Hoisted, so
+ * a circular import cannot reach it inside a temporal dead zone. */
+function rootAnchored(path: string, windows: boolean): boolean { return windows ? /^(?:[A-Za-z]:[\\/]|[\\/]{2}[^\\/]+[\\/][^\\/]+)/.test(path) : path.startsWith("/"); }
+
 /**
- * The Pi agent config dir: `PI_CODING_AGENT_DIR` when set, else `~/.pi/agent`.
- * Every bridge default that used to hardcode `~/.pi/agent` routes through this
- * so a host app that owns the agent dir owns those paths too.
+ * The Pi agent config dir: `PI_CODING_AGENT_DIR` when it names a root-anchored
+ * path, else `~/.pi/agent`. Every bridge default routes through this function
+ * so a host app that owns the agent dir owns
+ * those paths too.
  */
 export function piUserDir(): string {
-	return resolve(expandHome(process.env.PI_CODING_AGENT_DIR?.trim() || "~/.pi/agent"));
+	const override = expandHome(process.env.PI_CODING_AGENT_DIR?.trim() || "");
+	return resolve(rootAnchored(override, process.platform === "win32") ? override : expandHome("~/.pi/agent"));
 }
 
 /**
- * Isolated mode (`CLAUDE_BRIDGE_ISOLATED=1`): a host app embedding the bridge
+ * Isolated mode (`CLAUDE_BRIDGE_ISOLATED=1`) : a host app embedding the bridge
  * declares that nothing outside its explicitly configured dirs may be read.
  * Disables every cwd/home discovery fallback — all AGENTS.md discovery,
  * extension-manager settings, project `.pi/` settings + claude-bridge.json,

package/src/connector-audit.ts

@@ -2,11 +2,9 @@
 //
 // A claude.ai connector tool runs INSIDE the child, on the child's own MCP
 // servers, and is deliberately never mirrored into the Pi stream (see
-// isChildExecutedTool). That is the honest behaviour — mirroring wrote
-// `Tool <name> not found` into the transcript for calls that had SUCCEEDED
-// (drovr#311 / memsira#320) — but it leaves the Pi session with no record that
-// the call happened at all, so "did it really look that up?" could only be
-// answered from the child's own transcript.
+// isChildExecutedTool). Mirroring would write `Tool <name> not found` into the
+// transcript for a successful call. Not mirroring leaves the Pi session with no
+// record that the call happened, so the audit entry records it without dispatch.
 //
 // A pi `CustomEntry` closes that gap without reintroducing the bug: it is
 // persisted in the session file, is NOT a content block, and is documented as
@@ -91,17 +89,15 @@ let auditSink: ConnectorCallAuditSink | undefined;
  * Install (or clear, with `undefined`) a host sink for connector-call records.
  *
  * **The sink ADDS a destination, it never replaces `appendEntry`.** A host that
- * drives real `AgentSession`s gets the transcript-local entries for free, and a
- * replacing sink would take those away and reopen the very audit gap this
- * feature closes (memsira, 2026-07-28 — their `apps/sidecar/src/runtime.ts` is
- * session-backed, and 122 of their app-chat session files carry the bridge's
- * `claude-bridge-session` markers). A host with both a session and a sink has
+ * drives real `AgentSession`s gets transcript-local entries automatically. A
+ * replacing sink would remove those entries and make the session record
+ * incomplete. A host with both a session and a sink has
  * asked for both and gets both.
  *
  * It exists because the OTHER embedding shape gets nothing at all: drovr loads
  * the bundle through a throwaway resource loader over
  * `createAgentSessionServices` with no session, so `extensionApi` is undefined
- * and every record it appended went nowhere (drovr #317, measured live). The
+ * and every record it appended went nowhere (measured live). The
  * sink is the seam such a host can reach without one.
  *
  * A callback rather than another `Symbol.for` global on purpose: the bundle
@@ -164,10 +160,12 @@ export function recordConnectorCallResult(
 	isError: boolean,
 	byteSize: number | undefined,
 ): boolean {
-	const pending = queryCtx.connectorCallAudit.get(toolUseId);
+	const pending = queryCtx.childSideCalls.get(toolUseId);
 	if (pending?.recorded) return false;
 	const childSessionId = pending?.childSessionId ?? queryCtx.childSessionId;
-	queryCtx.connectorCallAudit.set(toolUseId, { ...pending, name, childSessionId, recorded: true });
+	// Reached only for a child-executed connector result, so an entry this call
+	// never saw noted is a connector's.
+	queryCtx.childSideCalls.set(toolUseId, { ...pending, kind: pending?.kind ?? "connector", name, childSessionId, recorded: true });
 	return appendConnectorCallAudit({
 		name,
 		toolUseId,
@@ -187,9 +185,11 @@ export function recordConnectorCallResult(
  */
 export function flushConnectorCallAudit(queryCtx: QueryContext, reason: ToolCallDrainCause): number {
 	let appended = 0;
-	for (const [toolUseId, state] of queryCtx.connectorCallAudit) {
-		if (state.recorded) continue;
-		queryCtx.connectorCallAudit.set(toolUseId, { ...state, recorded: true });
+	for (const [toolUseId, state] of queryCtx.childSideCalls) {
+		// Foreign MCP calls share the map but not the trail: its entries are
+		// `claude-bridge-connector-call` records naming a claude.ai connector.
+		if (state.recorded || state.kind !== "connector") continue;
+		queryCtx.childSideCalls.set(toolUseId, { ...state, recorded: true });
 		const childSessionId = state.childSessionId ?? queryCtx.childSessionId;
 		if (appendConnectorCallAudit({
 			name: state.name,

package/src/connector-cache.ts

@@ -1,13 +1,12 @@
-// Cross-PROCESS cache of the connector inventory (kendex#870).
+// Cross-PROCESS cache of the connector inventory.
 //
-// #868 primes the inventory at provider registration, but the fetch takes ~1.5s
+//  primes the inventory at provider registration, but the fetch takes ~1.5s
 // while the first query is built at ~0.5-0.8s, so turn 1 of a cold sidecar goes
-// out with no declarations and gets exactly the #832 bug it was meant to fix.
+// out with no declarations and preserves the failure this cache prevents.
 //
 // An in-process cache cannot help the consumer that needs it most. drovr builds
 // a sidecar lazily on the first bridge round and, since their sidecars are
-// per-SESSION, that is a fresh process for every new chat — so their exposure is
-// once per chat, indefinitely, and every one of those is a cold process. The
+// per-SESSION, each chat starts a separate cold process. The
 // cache therefore has to survive process boundaries.
 //
 // Keyed by credential scope, because that is what selects the account: the org
@@ -18,7 +17,7 @@
 // wrong-version cache returns undefined and the caller falls back to today's
 // behaviour — the same fail-open contract as the inventory call itself.
 //
-// The ON-DISK FORMAT HAS AN EXTERNAL READER (kendex#892). drovr quarantines this
+// The ON-DISK FORMAT HAS AN EXTERNAL READER. drovr quarantines this
 // bundle to its sidecar process, so rather than calling `listAccountConnectors`
 // in-process it re-implements the reader half — path
 // `<piUserDir()>/connector-cache/<sha256(CLAUDE_CONFIG_DIR).hex[0..16]>.json`,
@@ -43,7 +42,7 @@ import type { ConnectorEntry } from "./connector-inventory.js";
 const CACHE_VERSION = 2;
 /** Long enough to be useful across a machine's lifetime, short enough that a
  *  removed connector stops being declared without needing a manual purge. A
- *  stale entry is not dangerous — a connector that no longer resolves simply
+ *  stale entry is not dangerous — a connector that does not resolve simply
  *  fails to connect, which is the fail-open path — so this is hygiene, not a
  *  correctness boundary. */
 const MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;

package/src/connector-inventory.ts

@@ -5,7 +5,7 @@
 // nothing in the result distinguishes "these are the connectors" from "these are
 // the connectors the search happened to return this time". Downstream then stored
 // that lower bound as authoritative, so an account with Slack attached could
-// report an inventory without Slack and no failure signal (kendex#838).
+// report an inventory without Slack and no failure signal.
 //
 // This module asks the account instead of the model. Verified live against a
 // personal claude_max org: the endpoint is POST (a GET returns 405) and each
@@ -18,12 +18,11 @@
 // installed. It says nothing about whether a given connector's MCP server has
 // finished attaching inside the `claude` child that is about to run a turn —
 // this is a plain HTTPS call and does not consult that process at all. The two
-// were previously conflated by accident: the ToolSearch probe could only report
-// what was already attached, so an inventory implied availability (wrongly, but
-// conservatively — it under-reported, which fails safe). They are now separately
+// are separate: the ToolSearch probe can report only what is attached, so an
+// inventory must not imply availability. They are
 // observable and can legitimately disagree: a correct `complete: true` inventory
 // can name Slack while `mcp__claude_ai_Slack__*` is not yet callable in this
-// process (kendex#832). Treat an inventory as NECESSARY BUT NOT SUFFICIENT for
+// process. Treat an inventory as NECESSARY BUT NOT SUFFICIENT for
 // availability and keep an attach-time check on the call path; do not derive
 // "can I call this tool right now" from this result.
 //
@@ -47,8 +46,7 @@ export type ConnectorEntry = {
 	/**
 	 * Account-side install state. `"connected"` marks the connectors the CLI
 	 * actually attempts; everything else it never gives a `Starting connection`
-	 * line at all. Verified live 2026-07-26: 7 `connected` / 20 `unknown` on the
-	 * app account, and the CLI connected exactly those 7.
+	 * line at all. The CLI attempts exactly the entries marked `connected`.
 	 */
 	installState?: string;
 	description?: string;
@@ -246,8 +244,8 @@ export async function listAccountConnectors(deps: ListConnectorsDeps): Promise<C
 	// fetch/proxy layer is free to put the request headers — and therefore the
 	// bearer token — into the message it throws, and that message would otherwise
 	// land in a reason string that callers log.
-	const fail = (reason: string): ConnectorInventory =>
-		({ ok: false, complete: false, reason: redactSecret(reason, credentials.accessToken) });
+	const fail = (key: string, value: string | number, reason: string): ConnectorInventory =>
+		({ ok: false, complete: false, reason: redactSecret(`${key}=${JSON.stringify(value)}\n${reason}`, credentials.accessToken) });
 
 	let response: Response;
 	try {
@@ -262,32 +260,32 @@ export async function listAccountConnectors(deps: ListConnectorsDeps): Promise<C
 			signal,
 		});
 	} catch (error) {
-		return fail(`connector list request failed: ${errorText(error)}`);
+		return fail("connector-request", "transport", `connector list request failed: ${errorText(error)}`);
 	}
 
 	let bodyText: string;
 	try {
 		bodyText = await response.text();
 	} catch (error) {
-		return fail(`connector list response unreadable: ${errorText(error)}`);
+		return fail("connector-response", "unreadable", `connector list response unreadable: ${errorText(error)}`);
 	}
 
 	if (!response.ok) {
-		return fail(`connector list returned HTTP ${response.status}${apiErrorSuffix(bodyText)}`);
+		return fail("connector-http", response.status, `connector list returned HTTP ${response.status}${apiErrorSuffix(bodyText)}`);
 	}
 
 	let parsed: Json;
 	try {
 		parsed = JSON.parse(bodyText) as Json;
 	} catch {
-		return fail("connector list returned a non-JSON body");
+		return fail("connector-json", "invalid", "connector list returned a non-JSON body");
 	}
 
 	// A missing/!Array `results` is a protocol change, not an empty account. Treat
 	// it as failure — reporting "no connectors" here would recreate exactly the
 	// silent-wrong-answer failure this module exists to remove.
 	if (!Array.isArray(parsed?.results)) {
-		return fail("connector list response had no results array");
+		return fail("connector-results", "not-array", "connector list response had no results array");
 	}
 
 	const connectors: ConnectorEntry[] = [];
@@ -298,7 +296,7 @@ export async function listAccountConnectors(deps: ListConnectorsDeps): Promise<C
 		// so silently keeping it would understate the inventory in a way the
 		// caller could not detect. Fail instead.
 		if (!name) {
-			return fail("connector list contained an entry with no name");
+			return fail("connector-name", connectors.length, "connector list contained an entry with no name");
 		}
 		connectors.push({
 			name,

package/src/connector-runtime.ts

@@ -1,5 +1,5 @@
 // Connector prime/snapshot host: the per-credential-scope inventory cache the
-// query path reads synchronously (kendex#832/#870). Extracted from index.ts —
+// query path reads synchronously. Extracted from index.ts —
 // this is process-lifetime runtime state, not provider streaming logic.
 //
 // Connector declarations for the query path, cached per credential scope. The
@@ -32,15 +32,15 @@ export function readCredentialFile(path: string): string | undefined {
 const connectorServerCache = new Map<string, Record<string, unknown>>();
 const connectorServerPending = new Set<string>();
 // Epoch ms of the last FAILED inventory attempt per scope, so a persistently
-// failing account cools down instead of issuing one new HTTPS request per turn
-// (VST-14). Missing credentials are exempt: that check is a local file read
+// failing account cools down instead of issuing one HTTPS request per turn
+//  Missing credentials are exempt: that check is a local file read
 // with no request to bound, and a just-completed `claude login` must take
 // effect on the next turn.
 const connectorServerFailureAt = new Map<string, number>();
 
 // Deadline on the inventory round trip. Without one, a hung claude.ai request
 // held the pending flag forever — same budget as the account-host probe's
-// ACCOUNT_PROBE_DEADLINE_MS (VST-14).
+// ACCOUNT_PROBE_DEADLINE_MS.
 const CONNECTOR_PRIME_TIMEOUT_MS = 10_000;
 const CONNECTOR_PRIME_FAILURE_COOLDOWN_MS = 60_000;
 
@@ -81,12 +81,12 @@ export function connectorCredentialEnv(claudeConfigDir: string | undefined = pro
 //
 // FAILS OPEN throughout: no credentials, a failed inventory, or a thrown call
 // all resolve to "declare nothing" rather than breaking the turn. Failures are
-// NOT cached — a transient blip at registration used to pin `{}` for the
+// NOT cached. Caching a transient registration failure would pin `{}` for the
 // process lifetime, keeping every later turn undeclared and the disk-cache
 // fallback unreachable. Leaving the key unset makes the next snapshot retry;
 // the pending set dedupes concurrent fetches, and a failed inventory attempt
 // stamps a per-scope cooldown so a persistently failing account backs off
-// instead of re-priming on every turn (VST-14).
+// instead of re-priming on every turn.
 export function primeConnectorServers(claudeConfigDir?: string, overrides: PrimeConnectorOverrides = {}): void {
 	const key = connectorScopeKey(claudeConfigDir);
 	if (connectorServerCache.has(key) || connectorServerPending.has(key)) return;
@@ -124,7 +124,7 @@ export function primeConnectorServers(claudeConfigDir?: string, overrides: Prime
 			connectorServerFailureAt.delete(key);
 			// Persist so the NEXT cold process has this synchronously. Priming always
 			// loses the race against turn 1 in its own process; a cache written by an
-			// earlier run is the only thing turn 1 can read in time (kendex#870).
+			// earlier run is the only thing turn 1 can read in time.
 			if (writeCachedConnectors(inventory.connectors, key)) {
 				debug(`connectors: cached ${inventory.connectors.length} entries`);
 			}
@@ -148,7 +148,7 @@ export function connectorServersSnapshot(claudeConfigDir?: string): Record<strin
 	primeConnectorServers(claudeConfigDir);
 	// Fall back to the previous run's inventory, read synchronously. This is the
 	// only thing that can populate turn 1 of a cold process, because priming
-	// cannot finish before the first query is built (kendex#870).
+	// cannot finish before the first query is built.
 	const cached = readCachedConnectors(key);
 	if (!cached) return {};
 	const servers = connectorMcpServers({ ok: true, complete: true, connectors: cached });

package/src/connectors.ts

@@ -57,7 +57,7 @@ export function connectorsEnabledFor(config?: Config): boolean {
 // isolation (no sources), which drops the connectors even with
 // ENABLE_CLAUDEAI_MCP_SERVERS=1. So connectors mode must pass SOME source list.
 //
-// It must be `["user"]` and nothing more (kendex#990). Connector state lives in
+// It must be `["user"]` and nothing more. Connector state lives in
 // USER scope — the account's config dir (CLAUDE_CONFIG_DIR for managed router
 // profiles) — so user scope is sufficient for connectors to surface. Claude
 // Code settings files can also carry an `env` map and `apiKeyHelper`; including
@@ -98,7 +98,7 @@ export const CLAUDE_AI_CONNECTOR_TOOL_PATTERNS = [
 	"mcp__claude_ai_Atlassian__*",
 ];
 
-// --- The SDK's two-name trap for built-in tools (kendex#1007, kendex#1011) ---
+// --- The SDK's two-name trap for built-in tools ---
 //
 // The CLI gives some built-ins TWO spellings, and which one you see depends on
 // which SURFACE the name crosses:
@@ -118,9 +118,9 @@ export const CLAUDE_AI_CONNECTOR_TOOL_PATTERNS = [
 // This map declares each alias pair ONCE; every delivered-side membership set
 // derives its spellings from it instead of hand-copying names. Both prior
 // instances of the trap were exactly that hand-copy: CHILD_INTERNAL_TOOLS held
-// request-side spellings that no stream name ever matched (kendex#1007), and
+// request-side spellings that no stream name ever matched, and
 // the connectors allowlist hook DENIED the two discovery tools it exists to
-// permit (kendex#1011). Delivered-side sets accept BOTH spellings, so a CLI
+// permit. Delivered-side sets accept BOTH spellings, so a CLI
 // version that drops the aliasing cannot reintroduce the bug in either
 // direction.
 const SDK_TOOL_ALIASES: Record<string, string> = {
@@ -144,14 +144,18 @@ function deliveredSpellings(name: string): string[] {
 // REQUEST-side spellings: this list feeds the SDK option surface (the
 // disallowedTools filter in toolIsolationForQuery) and is the exported public
 // name. Delivered-side checks use CONNECTOR_DISCOVERY_TOOL_NAMES below.
-export const CONNECTOR_DISCOVERY_TOOLS = ["ToolSearch", "ListMcpResources", "ReadMcpResource"];
+const MCP_RESOURCE_TOOLS = ["ListMcpResources", "ReadMcpResource"];
+export const CONNECTOR_DISCOVERY_TOOLS = ["ToolSearch", ...MCP_RESOURCE_TOOLS];
 
-// Delivered-side membership set for the discovery tools: both spellings of
-// each entry, derived from SDK_TOOL_ALIASES. A PreToolUse hook's `tool_name`
-// carries the canonical spelling (`ListMcpResourcesTool`), so testing the
-// request-side list directly made the fail-closed allowlist hook DENY the two
-// resource tools it exists to permit (kendex#1011).
+// Delivered-side membership sets carry both spellings, derived from the one
+// alias declaration above. The resource-only set keeps those audit calls
+// dispatchable without making ToolSearch a Pi call.
 const CONNECTOR_DISCOVERY_TOOL_NAMES = new Set(CONNECTOR_DISCOVERY_TOOLS.flatMap(deliveredSpellings));
+const MCP_RESOURCE_TOOL_NAMES = new Set(MCP_RESOURCE_TOOLS.flatMap(deliveredSpellings));
+
+export function isMcpResourceTool(name: string): boolean {
+	return MCP_RESOURCE_TOOL_NAMES.has(name);
+}
 
 // --- Connector WRITE tool control (read-inline / write-by-approval) ---
 //
@@ -243,12 +247,12 @@ function connectorNameWords(segment: string): string[] {
 // exact tool id (the CLI matcher only supports exact ids or a whole-server glob).
 //
 // PUBLIC CONTRACT — this list and `isConnectorWriteTool` have downstream
-// dependents that gate real user-facing approvals on them (kendex#892):
+// dependents that gate real user-facing approvals on them:
 //
 //   memsira  routes connector writes through its own gated approval flow
 //   drovr    keeps its chat sidecar permanently write-`deny` and runs an
 //            approved write as a separate one-shot `claude -p` scoped by
-//            `--allowedTools` to exactly one connector tool (drovr#288)
+//            `--allowedTools` to exactly one connector tool
 //
 // Both pin the actions they expose against this classification, because "the
 // sidecar structurally cannot do this itself" is THIS module's claim, not
@@ -329,23 +333,21 @@ export function isConnectorTool(name: string | undefined): boolean {
 // `content_block_start` / assistant-message blocks, the exact fields
 // processStreamEvent/processAssistantMessage read. Stream names are a
 // DELIVERED surface (see SDK_TOOL_ALIASES): the two MCP-resource built-ins'
-// request-side spellings used to sit in this set and never matched anything
-// (kendex#1007). If an aliased name is ever added here, derive its spellings
-// via deliveredSpellings rather than hand-copying them.
+// request-side spellings do not belong in this set because they match nothing.
+// Derive every aliased name via deliveredSpellings rather than hand-copying it.
 //
-// The MCP-resource tools are now EXCLUDED deliberately, under BOTH spellings:
+// The MCP-resource tools are EXCLUDED under BOTH spellings:
 // a resource read is a real account-surface access, and both consumer hosts
 // audit it through the Pi mirror (an out-of-process sidecar has no view of the
 // bridge's own connector-call entries or the child transcript), so it stays
-// mirrored into Pi. Do not re-add either spelling without revisiting that
-// decision in kendex#1007. The allowlist hook is what lets those calls run at
-// all — see isAllowlistedConnectorSessionTool (kendex#1011).
+// mirrored into Pi. Do not add either spelling to this set. The allowlist hook
+// is what lets those calls run; see isAllowlistedConnectorSessionTool.
 const CHILD_INTERNAL_TOOLS = new Set(["ToolSearch", "ScheduleWakeup"]);
 
 /**
  * True for a Claude Code built-in meta-tool the child resolves in-process.
  *
- * Mirroring one into the Pi stream (kendex#980) made Pi's agent loop dispatch a
+ * Mirroring one into the Pi stream would make Pi's agent loop dispatch a
  * tool it does not have and deliver an error result for an id no MCP handler
  * ever claimed. The result queued in `pendingResults` until the reaper dropped
  * it — one "dropped 1 tool result(s) whose handler never matched (ToolSearch)"
@@ -375,13 +377,13 @@ export function isChildInternalTool(name: string | undefined): boolean {
  *    miss, and write a synthetic `Tool <name> not found` error result into the
  *    transcript — while the child went on and executed the real call. The Pi
  *    transcript then RECORDED A FAILURE FOR A CALL THAT SUCCEEDED, next to an
- *    answer built from the real payload, so the model's correct answer read as
- *    a fabrication (drovr#311, memsira#320). The false result is also projected
+ *    answer built from the real payload, so the model's correct answer appears
+ *    fabricated. The false result is also projected
  *    back into the child's session on a rebuild (`syncSharedSession`), which is
  *    how a lie in a mirror becomes a lie in the conversation of record.
  *
  * 2. Claude Code's own in-process meta-tools (`isChildInternalTool`), which the
- *    child resolves without any dispatcher at all (kendex#980).
+ *    child resolves without any dispatcher at all.
  *
  * Takes the RAW SDK tool name, before `mapToolName` — child-executed names have
  * no Pi-side counterpart, so mapping them is meaningless. Accepts a missing
@@ -487,7 +489,7 @@ export function connectorWriteDenyHook(): HookCallback {
 		// the tool call proceed (fail OPEN) — so any exception in this body
 		// must convert to a deny, never an allow. Today's body is pure string
 		// checks on schema-validated input; the catch pins that invariant for
-		// whatever gets added here later.
+		// subsequent changes to this body.
 		try {
 			if (input.hook_event_name !== "PreToolUse") return { continue: true };
 			// A non-string tool name cannot be classified, and this hook fails
@@ -507,7 +509,7 @@ export function connectorWriteDenyHook(): HookCallback {
 // stay PRODUCT-NEUTRAL: this is shared source and every consuming app shows it.
 // Naming one host told a different app's model to use a product it has never
 // heard of, which is confusing at exactly the moment someone is debugging a
-// refused write (kendex#892). Each host describes its own approval flow in its
+// refused write. Each host describes its own approval flow in its
 // own prompt; this string only has to say that one exists.
 function connectorWriteDenyOutput(toolName: string) {
 	return {
@@ -515,6 +517,7 @@ function connectorWriteDenyOutput(toolName: string) {
 			hookEventName: "PreToolUse" as const,
 			permissionDecision: "deny" as const,
 			permissionDecisionReason:
+				`connector-write-denied=${JSON.stringify(toolName)}\n` +
 				`Connector write tool "${toolName}" is blocked in read-only connector mode. ` +
 				`Connector writes must go through the host application's gated approval flow.`,
 		},
@@ -533,8 +536,8 @@ function connectorWriteDenyOutput(toolName: string) {
 //
 // This is a DELIVERED-side check — `name` is a hook's `input.tool_name`, which
 // carries the canonical spelling — so membership is tested against
-// CONNECTOR_DISCOVERY_TOOL_NAMES (both spellings), not the request-side list
-// (kendex#1011). That also carries kendex#1007's mirroring decision: the
+// CONNECTOR_DISCOVERY_TOOL_NAMES (both spellings), not the request-side list.
+// The allowlist hook also carries the mirroring rule: the
 // MCP-resource tools are deliberately NOT child-internal so every resource
 // read mirrors into Pi as the consumers' audit surface — a mirror that can
 // only exist if this allowlist lets the call execute. Denying the canonical
@@ -669,14 +672,12 @@ export function toolIsolationForQuery(connectorsEnabled: boolean, writeMode: Con
 /**
  * Explicit `mcpServers` declarations for the account's CONNECTED connectors.
  *
- * Why this exists (kendex#832): claude.ai connectors load async and non-blocking,
+ * Why this exists: claude.ai connectors load async and non-blocking,
  * and the turn-1 tool manifest is built at +410-665ms — roughly 300ms BEFORE the
  * CLI has even fetched the connector list. The model therefore composes its first
  * answer against a manifest containing no connectors and says it has no access,
- * while the connector attaches ~1s later and is never asked. Measured end to end
- * on 40 cold sidecars (memsira, 2026-07-26): a connector tool call happened in
- * 7/20 baseline runs versus 20/20 with the declaration, and "I don't have access"
- * went 13/20 → 0/20, one-sided Fisher exact p = 6.4e-6. Confirmed at seven
+ * while the connector attaches later and is never asked. The declaration must
+ * be available before the first query. Confirmed at seven
  * declarations over a further 30 runs: 5/10 → 10/10 calls, 5/10 → 0/10 denials.
  *
  * It is also FASTER, which is the opposite of what the startup barrier suggests.
@@ -736,9 +737,8 @@ export function connectorMcpServers(inventory: ConnectorInventory): Record<strin
 
 /**
  * `CLAUDE_BRIDGE_CONNECTOR_DECLARE=off` (or `0`/`false`/`no`) disables explicit
- * connector declarations while leaving connectors themselves enabled. Falls back
- * to the pre-#832 behaviour: connectors still load, they just race the turn-1
- * manifest again.
+ * connector declarations while leaving connectors themselves enabled. Without
+ * declarations, connector loading races the turn-1 manifest.
  */
 export function connectorDeclarationsDisabled(env: NodeJS.ProcessEnv = process.env): boolean {
 	const v = (env.CLAUDE_BRIDGE_CONNECTOR_DECLARE ?? "").trim().toLowerCase();

package/src/consume-query.ts

@@ -3,7 +3,7 @@
 // generator and pushes events into the query's captured Pi stream.
 
 import { type Model } from "@earendil-works/pi-ai";
-import { type query } from "@anthropic-ai/claude-agent-sdk";
+import { type AccountInfo, type query } from "@anthropic-ai/claude-agent-sdk";
 import {
 	classifyClaudeFailure,
 	rateLimitResetFromInfo,
@@ -88,6 +88,7 @@ export async function consumeQuery(
 	model: Model<any>,
 	bridgeConfig: Config,
 	wasAborted: () => boolean,
+	recordBillingIdentity: (info: AccountInfo) => void,
 	account?: ClaudeAccountRoute,
 	router?: ClaudeAccountRouterV1,
 	// Mirror of the held failure for the caller's .catch: the SDK iterator can
@@ -100,6 +101,7 @@ export async function consumeQuery(
 	let capturedSessionId: string | undefined;
 	let failure: ClaudeAttemptFailure | undefined;
 	let accountProbe: Promise<void> | undefined;
+	let accountInfoProbe: Promise<AccountInfo> | undefined;
 	const holdFailure = (next: ClaudeAttemptFailure | undefined): void => {
 		failure = next;
 		if (attemptFailureBox) attemptFailureBox.failure = next;
@@ -111,7 +113,7 @@ export async function consumeQuery(
 		if (account) {
 			// Thunk, not a value: this runs once per SDK message — including one
 			// stream_event per streamed token — and debug() only evaluates function
-			// args after its DEBUG early return (VST-15).
+			// args after its DEBUG early return.
 			debug("consumeQuery: managed message", () => JSON.stringify({
 				type: message.type,
 				subtype: (message as any).subtype,
@@ -203,8 +205,8 @@ export async function consumeQuery(
 					}
 					// Other non-success subtypes (error_max_turns,
 					// error_during_execution) surface at completion via the held
-					// failure — an explicit error event where these turns previously
-					// ended silently. Session persistence and deferred replay still run.
+					// failure. These turns require an explicit error event instead of
+					// silent completion. Session persistence and deferred replay still run.
 				}
 				break;
 			case "system":
@@ -216,9 +218,22 @@ export async function consumeQuery(
 					// from the teardown flush, which runs outside this function's scope.
 					queryCtx.childSessionId = capturedSessionId;
 					noteFastModeDisabledReason(message, bridgeConfig);
+					// Which login this child authenticated as is published for other
+					// extensions, for every child rather than only a routed one:
+					// an unrouted child is the common case and its identity is
+					// just as unknowable from outside the SDK. Nothing waits for
+					// it, so it stays off the turn's critical path. The call sits
+					// in an async IIFE so a synchronous throw arrives as a
+					// rejection the debug line below names.
+					if (!accountInfoProbe) {
+						accountInfoProbe = (async () => sdkQuery.accountInfo())();
+						void accountInfoProbe
+							.then((info) => recordBillingIdentity(info))
+							.catch((error) => debug("consumeQuery: billing identity probe rejected:", error));
+					}
 					if (account && router && !accountProbe) {
 						accountProbe = Promise.allSettled([
-							sdkQuery.accountInfo().then((info) => router.recordIdentity(account.profileId, {
+							accountInfoProbe.then((info) => router.recordIdentity(account.profileId, {
 								email: info.email,
 								organization: info.organization,
 								subscriptionType: info.subscriptionType,

package/src/convert.ts

@@ -28,7 +28,7 @@ export function mapPiToolNameToSdk(name: string, customToolNameToSdk?: Map<strin
 	// `McpClaudeAiSlackSlackSearchChannels`) that appeared in the child's
 	// projected history, so the model imitated it on the next turn and got a
 	// real `Tool ... not found` from the MCP dispatcher before retrying the
-	// canonical name — one wasted round-trip per affected call (memsira#320).
+	// canonical name — one wasted round-trip per affected call.
 	//
 	// Connector names stopped reaching this function at all once they stopped
 	// being mirrored as Pi tool calls (isChildExecutedTool), so this is the

package/src/debug.ts

@@ -50,7 +50,7 @@ export function debug(...args: unknown[]) {
 		if (a instanceof Error) return `${a.name}: ${a.message}${a.stack ? "\n" + a.stack : ""}`;
 		// A function argument is a lazy payload: hot-path call sites (per-token
 		// stream events) pass a thunk so the expensive formatting only runs when
-		// DEBUG is on — fmt is only reached past the early return (VST-15).
+		// DEBUG is on — fmt is only reached past the early return.
 		if (typeof a === "function") return fmt((a as () => unknown)());
 		return JSON.stringify(a);
 	};
@@ -121,7 +121,7 @@ export function makeCliDebugOptions(tag: string): { debug?: boolean; debugFile?:
 /** Diagnostic dump — for "should never happen" paths. Gated on the same
  *  CLAUDE_BRIDGE_DEBUG flag as debug(): the entries carry session metadata
  *  and land in a log outside any host app's retention/cleanup boundary, so
- *  a host that has not opted into debugging must get no disk write (VST-15). */
+ *  a host that has not opted into debugging must get no disk write. */
 export function diagDump(label: string, data: Record<string, unknown>) {
 	if (!DEBUG) return;
 	try {