@yagni-app/code 1.0.4 → 1.0.6

package/README.md

@@ -179,11 +179,16 @@ children and subagents — emits a per-prompt span tree: interaction → LLM
 request → tool calls, following the OTel GenAI semantic conventions. Nothing is
 exported unless you configure an endpoint.
 
-Enable it one of three ways (first match wins):
-
-- `OTEL_EXPORTER_OTLP_ENDPOINT=http://<collector>:4317` in the environment
-  (a personal override — handy for pointing one session at a scratch
-  collector), or
+Enable it one of four ways (first match wins):
+
+- `OTEL_EXPORTER_OTLP_ENDPOINT=…` in the environment (a personal override —
+  handy for pointing one session at a scratch collector), or
+- `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=…` in the environment — the per-signal
+  form Claude Code setups use (e.g.
+  `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=https://otlp.datadoghq.com/v1/traces`
+  with `OTEL_EXPORTER_OTLP_TRACES_PROTOCOL=http/protobuf`); the launcher
+  bridges it to the generic var pi-otel reads, so a Claude Code OTel env
+  lights up YAGNI Code traces with no extra config, or
 - **workspace settings** (the zero-setup path): a workspace admin sets the
   endpoint, protocol, and any collector headers (e.g. a Datadog API key) once
   in the web app under Settings → YAGNI Code → Trace export. Every session in
@@ -197,7 +202,26 @@ Enable it one of three ways (first match wins):
 Standard OTel env vars are honored (`OTEL_EXPORTER_OTLP_PROTOCOL`,
 `OTEL_EXPORTER_OTLP_HEADERS`, `OTEL_SERVICE_NAME` — defaults to `yagni-code`),
 and `PI_OTEL_DISABLED=1` is the kill switch. `yagni doctor` shows the current
-export state.
+export state and probes the endpoint live (unreachable → a warning with a
+hint, never an exit-code flip).
+
+Two recipes for common collectors:
+
+- **Datadog, direct SaaS (no agent):** endpoint
+  `https://otlp.datadoghq.com/v1/traces` (US1; other sites have their own
+  host — `otlp.us3.datadoghq.com`, `otlp.us5.datadoghq.com`,
+  `otlp.datadoghq.eu`, `otlp.ap1.datadoghq.com`), protocol `http/protobuf`
+  (Datadog's direct trace intake does not accept gRPC), header
+  `dd-api-key=<your Datadog API key>`. Use the full path, not `/v1/` — the
+  endpoint is passed through verbatim, no path is appended for you.
+- **Datadog Agent:** endpoint `http://<agent-host>:4317`, protocol `grpc`, no
+  key (the agent forwards with its own). OTLP ingest ships in the agent but
+  is off by default — enable it with
+  `otlp_config.receiver.protocols.grpc.endpoint: 0.0.0.0:4317` in
+  `datadog.yaml`.
+- **Grafana Cloud:** endpoint `https://otlp-gateway-prod-…-0.grafana.net:443/otlp`,
+  protocol `http/protobuf`, header `authorization=<the raw MTgx… value>` (the
+  `Basic ` scheme is added for you).
 
 Two things are enforced and not configurable:
 

package/dist/claudePlugins.d.ts

@@ -18,7 +18,9 @@
  *    disabled via `enabledPlugins`.
  *
  * Deliberately NOT here: network installation of any kind, plugin hooks, MCP
- * servers, LSP servers, themes, output styles. Discovery is read-only.
+ * servers (standard MCP support lives in `src/mcpCommand.ts` + the extension's
+ * `mcp/` module — see `yagni mcp --help`), LSP servers, themes, output styles.
+ * Discovery is read-only.
  *
  * Everything is fail-soft: malformed JSON, missing dirs, or hostile path
  * entries degrade to "that plugin absent" — never a failed launch. Path

package/dist/claudePlugins.js

@@ -18,7 +18,9 @@
  *    disabled via `enabledPlugins`.
  *
  * Deliberately NOT here: network installation of any kind, plugin hooks, MCP
- * servers, LSP servers, themes, output styles. Discovery is read-only.
+ * servers (standard MCP support lives in `src/mcpCommand.ts` + the extension's
+ * `mcp/` module — see `yagni mcp --help`), LSP servers, themes, output styles.
+ * Discovery is read-only.
  *
  * Everything is fail-soft: malformed JSON, missing dirs, or hostile path
  * entries degrade to "that plugin absent" — never a failed launch. Path

package/dist/cli.js

@@ -23,6 +23,7 @@ import { agentDir, credentialsDir, piPackageDir } from "./credentials.js";
 import { DISTRIBUTION } from "./distribution.js";
 import { connectCommand } from "./connectClaudeCode.js";
 import { goCommand } from "./goHeadless.js";
+import { mcpCommand } from "./mcpCommand.js";
 import { login } from "./login.js";
 import { logout } from "./logout.js";
 import { tokenCommand } from "./token.js";
@@ -515,6 +516,10 @@ export const HELP_TEXT = [
     "  yagni connect claude-code  Route Claude Code through the YAGNI model proxy",
     "                           (--project scopes to this repo; --off disconnects).",
     "  yagni connect codex      Route Codex CLI through the YAGNI model proxy.",
+    "  yagni mcp <subcommand>    Manage MCP servers: add, remove, list, get,",
+    "                           add-from-claude, and more — run `yagni mcp` for",
+    "                           details. OAuth servers authenticate via the",
+    "                           /mcp panel in a session.",
     "  yagni token              Output the active environment's API token (for helpers).",
     "  yagni use <name>         Switch the active environment (sticky).",
     "                           Presets: prod, local. Others need --base-url <url>.",
@@ -536,6 +541,7 @@ export const HELP_TEXT = [
     "  /mode plan|review|auto   Hold writes for planning, or confirm each change.",
     "  /todos                   Show the agent's live task list.",
     "  /cost                    Session usage and credit headroom.",
+    "  /mcp                     Manage MCP servers; authenticate OAuth servers.",
     "",
     "The active environment is sticky; `use` switches it (prod is the default).",
     "Set YAGNI_BASE_URL to override the base URL for a single run.",
@@ -653,6 +659,12 @@ export async function main(argv) {
     if (command === "connect") {
         return connectCommand(rest);
     }
+    // MCP server configuration: same three-scope model and file homes the
+    // in-session /mcp panel uses, shared code via the bundled extension's
+    // config entry. `list` runs real health-check connections.
+    if (command === "mcp") {
+        return mcpCommand(rest);
+    }
     // The headless pipeline entry. `go` is a real subcommand, not passthrough:
     // the interactive run stays `/go` inside a session, and a `yagni go` without
     // --headless is refused with usage rather than launched as an agent prompt.

package/dist/doctor.d.ts

@@ -13,7 +13,7 @@
  * Advisory checks (loose perms, missing `gh`) never flip the exit code.
  */
 import { type TokenExpiryStatus } from "./launch.js";
-import { type OtelLaunchConfig } from "./otel.js";
+import { probeOtelEndpoint, type OtelLaunchConfig } from "./otel.js";
 import { type Profile } from "./profiles.js";
 export type CheckStatus = "ok" | "warn" | "fail";
 export interface CheckResult {
@@ -63,10 +63,33 @@ export declare function checkCliUpdate(probe: {
 export declare function checkGh(onPath: boolean): CheckResult;
 /**
  * Advisory OTel-export line: says whether sessions will stream traces to an
- * OTLP collector, and from which config source. Never flips the exit code —
+ * OTLP collector, from which config source, and — when a collector is
+ * configured — whether the endpoint answers TCP right now (scheme-default
+ * ports included: https with no port probes 443). Never flips the exit code —
  * most machines have no collector, and that is the healthy default.
  */
-export declare function checkOtelExport(config: OtelLaunchConfig | undefined): CheckResult;
+export declare function checkOtelExport(config: OtelLaunchConfig | undefined, deps?: {
+    probeEndpoint?: typeof probeOtelEndpoint;
+    probeTimeoutMs?: number;
+}): Promise<CheckResult>;
+/** Config-only MCP snapshot (no connections — health checks live in `mcp list`/`get`). */
+export interface McpProbe {
+    /** YAGNI_CODE_MCP_DISABLED kill-switch is active. */
+    disabled: boolean;
+    /** Count of configured servers (post-merge, before the approval gate). */
+    serverCount: number;
+    /** Project-scope servers that are neither enabled nor disabled. */
+    undecidedProjectServers: string[];
+    /** Config parse/validation errors (already human-readable). */
+    errors: string[];
+}
+/**
+ * Advisory (never required) MCP line: reports config health without connecting
+ * to anything — `yagni mcp list`/`get` already run the real health checks, and
+ * doctor must never spawn an unapproved server process. The kill-switch and
+ * pending-approval cases read as `warn`, config errors as `fail` (non-required).
+ */
+export declare function checkMcpConfig(probe: McpProbe): CheckResult;
 /** What the Windows bash probe found (pi needs a bash — Git Bash — on win32). */
 export interface BashProbe {
     found: boolean;
@@ -95,6 +118,8 @@ export interface DoctorDeps {
     probeBash?: () => BashProbe;
     currentVersion?: string;
     probeLatestVersion?: () => Promise<string | null>;
+    /** MCP config snapshot (config-only, no connections). */
+    probeMcp?: () => Promise<McpProbe>;
     log?: (msg: string) => void;
 }
 /** Whether a `gh` executable is resolvable on PATH (no subprocess spawn). */

package/dist/doctor.js

@@ -17,9 +17,10 @@ import { delimiter, join } from "node:path";
 import { credentialsDir } from "./credentials.js";
 import { currentCliVersion, fetchLatestVersion, isNewerVersion } from "./upgrade.js";
 import { classifyTokenExpiry } from "./launch.js";
-import { resolveOtelLaunchWithWorkspace } from "./otel.js";
+import { probeOtelEndpoint, resolveOtelLaunchWithWorkspace, } from "./otel.js";
 import { resolveExtensionPath, resolvePiCliPath, resolvePiPackageDir } from "./paths.js";
 import { readActiveProfile } from "./profiles.js";
+import { resolveMcpConfigPath } from "./mcpCommand.js";
 // ── Pure check builders ─────────────────────────────────────────────────────
 export function checkPiEngine(probe) {
     if (!probe.binPath || !probe.binExists) {
@@ -201,10 +202,12 @@ export function checkGh(onPath) {
 }
 /**
  * Advisory OTel-export line: says whether sessions will stream traces to an
- * OTLP collector, and from which config source. Never flips the exit code —
+ * OTLP collector, from which config source, and — when a collector is
+ * configured — whether the endpoint answers TCP right now (scheme-default
+ * ports included: https with no port probes 443). Never flips the exit code —
  * most machines have no collector, and that is the healthy default.
  */
-export function checkOtelExport(config) {
+export async function checkOtelExport(config, deps = {}) {
     if (!config) {
         return {
             name: "otel export (optional)",
@@ -214,14 +217,88 @@ export function checkOtelExport(config) {
         };
     }
     const source = config.source === "env"
-        ? "OTEL_EXPORTER_OTLP_ENDPOINT"
+        ? (config.envVar ?? "OTEL_EXPORTER_OTLP_ENDPOINT")
         : config.source === "workspace"
             ? "workspace settings"
             : ".pi/settings.json";
+    const base = `on → ${config.endpoint} (${source}, metadata-only)`;
+    const doProbe = deps.probeEndpoint ?? probeOtelEndpoint;
+    try {
+        const reachable = await doProbe(config.endpoint, deps.probeTimeoutMs ?? 1_000);
+        return reachable
+            ? {
+                name: "otel export (optional)",
+                status: "ok",
+                detail: `${base}, TCP reachable`,
+                required: false,
+            }
+            : {
+                name: "otel export (optional)",
+                status: "warn",
+                detail: `${base}, endpoint not reachable`,
+                hint: "the collector is down, unreachable from this machine, or the URL is wrong — traces will not export until it answers",
+                required: false,
+            };
+    }
+    catch {
+        // The probe itself errored (not "endpoint down" — the check could not
+        // run). Distinct from a verified-healthy line so nobody reads an
+        // unverified config as checked-and-good.
+        return {
+            name: "otel export (optional)",
+            status: "warn",
+            detail: `${base}, reachability probe failed`,
+            hint: "the reachability check could not run (network error) — export is configured but unverified; traces may still export normally",
+            required: false,
+        };
+    }
+}
+/**
+ * Advisory (never required) MCP line: reports config health without connecting
+ * to anything — `yagni mcp list`/`get` already run the real health checks, and
+ * doctor must never spawn an unapproved server process. The kill-switch and
+ * pending-approval cases read as `warn`, config errors as `fail` (non-required).
+ */
+export function checkMcpConfig(probe) {
+    if (probe.disabled) {
+        return {
+            name: "mcp servers",
+            status: "warn",
+            detail: "disabled (YAGNI_CODE_MCP_DISABLED=1)",
+            hint: "unset YAGNI_CODE_MCP_DISABLED to re-enable MCP servers",
+            required: false,
+        };
+    }
+    if (probe.errors.length > 0) {
+        return {
+            name: "mcp servers",
+            status: "fail",
+            detail: `${probe.serverCount} configured, ${probe.errors.length} config error${probe.errors.length === 1 ? "" : "s"}`,
+            hint: `run \`yagni mcp list\` (first error: ${probe.errors[0]})`,
+            required: false,
+        };
+    }
+    if (probe.serverCount === 0) {
+        return {
+            name: "mcp servers",
+            status: "ok",
+            detail: "none configured",
+            required: false,
+        };
+    }
+    if (probe.undecidedProjectServers.length > 0) {
+        return {
+            name: "mcp servers",
+            status: "warn",
+            detail: `${probe.serverCount} configured, ${probe.undecidedProjectServers.length} awaiting approval`,
+            hint: "run /mcp to approve the project servers",
+            required: false,
+        };
+    }
     return {
-        name: "otel export (optional)",
+        name: "mcp servers",
         status: "ok",
-        detail: `on → ${config.endpoint} (${source}, metadata-only)`,
+        detail: `${probe.serverCount} configured`,
         required: false,
     };
 }
@@ -312,6 +389,37 @@ function defaultProbeStateDir() {
         return { path, exists: false, mode: null };
     }
 }
+async function defaultProbeMcp(env = process.env) {
+    const disabled = env.YAGNI_CODE_MCP_DISABLED === "1";
+    if (disabled)
+        return { disabled: true, serverCount: 0, undecidedProjectServers: [], errors: [] };
+    try {
+        const mod = (await import(resolveMcpConfigPath()));
+        if (typeof mod?.loadMcpServers !== "function") {
+            return { disabled: false, serverCount: 0, undecidedProjectServers: [], errors: ["extension MCP config entry missing"] };
+        }
+        const loaded = mod.loadMcpServers(process.cwd(), env);
+        const repoRoot = mod.resolveProjectRoot(process.cwd());
+        const { state } = mod.readProjectApproval(repoRoot);
+        const undecided = loaded.servers
+            .filter((s) => s.scope === "project" && mod.decisionFor(state, s.name) === "undecided")
+            .map((s) => s.name);
+        return {
+            disabled: false,
+            serverCount: loaded.servers.length,
+            undecidedProjectServers: undecided,
+            errors: loaded.errors.map((e) => (e.serverName ? `${e.serverName}: ${e.message}` : e.message)),
+        };
+    }
+    catch (err) {
+        return {
+            disabled: false,
+            serverCount: 0,
+            undecidedProjectServers: [],
+            errors: [err instanceof Error ? err.message : String(err)],
+        };
+    }
+}
 async function defaultProbeBackend(baseUrl, token) {
     if (!token)
         return { kind: "skipped" };
@@ -378,6 +486,7 @@ export async function gatherChecks(deps = {}) {
     const readProfile = deps.readActiveProfile ?? readActiveProfile;
     const probeBackend = deps.probeBackend ?? defaultProbeBackend;
     const probeStateDir = deps.probeStateDir ?? defaultProbeStateDir;
+    const probeMcp = deps.probeMcp ?? (() => defaultProbeMcp());
     const ghOnPath = deps.ghOnPath ?? (() => ghOnPathDefault());
     const platform = deps.platform ?? process.platform;
     const probeBash = deps.probeBash ?? (() => bashOnWindowsDefault());
@@ -406,7 +515,8 @@ export async function gatherChecks(deps = {}) {
     checks.push(checkBackend(backend));
     checks.push(checkStateDir(probeStateDir()));
     checks.push(checkGh(ghOnPath()));
-    checks.push(checkOtelExport(await resolveOtelLaunchWithWorkspace({
+    checks.push(checkMcpConfig(await probeMcp()));
+    checks.push(await checkOtelExport(await resolveOtelLaunchWithWorkspace({
         env: process.env,
         cwd: process.cwd(),
         creds: profile.token ? { baseUrl: profile.baseUrl, token: profile.token } : null,

package/dist/extension/index.d.ts

@@ -1,7 +1,7 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { type SpendResponse } from "./costHud.js";
 import { runInitPass as defaultRunInitPass } from "./initPass.js";
-import { fetchMcpServers as defaultFetchMcpServers } from "./mcpTools.js";
+import { startMcp as defaultStartMcp } from "./mcp/startup.js";
 import { type FlushOutcome, type SpoolClientOpts } from "./spool.js";
 import { type TokenProvider } from "./tokenProvider.js";
 import { type CatalogResult, type ContextBrief } from "./config.js";
@@ -53,11 +53,11 @@ export interface RegisterYagniDeps {
     /** The beat's once-per-repo marker store. Injectable (no disk in tests). */
     mineBeatMarkers?: MineBeatMarkers;
     /**
-     * Workspace MCP server list seam (YAG-446). The default hits
-     * `/api/yagni-code/mcp/servers` and is fail-soft: older backends and
-     * un-rescoped tokens yield `[]`, never a startup error.
+     * Local-MCP startup seam: injectable so tests assert the wiring (approval
+     * skip, kill-switch, mutating-tool gate) without touching real config
+     * homes or spawning servers. Default runs the real startup.
      */
-    fetchMcpServers?: typeof defaultFetchMcpServers;
+    startMcp?: typeof defaultStartMcp;
     /**
      * The CLI init pass (Onramp Door B). Injectable so tests assert it fires on a
      * fresh-workspace first-run and is skipped otherwise, without a network or disk.

package/dist/extension/index.js

@@ -29,7 +29,8 @@ import { createYagniFooterFactory, cyclePermissionMode, formatCwd, GIT_MUTATING_
 import { RerouteNotifier } from "./rerouteNotice.js";
 import { isFreshWorkspace, registerTeamSetupCommand, runInitPass as defaultRunInitPass } from "./initPass.js";
 import { isInitDone as defaultIsInitDone, markInitDone as defaultMarkInitDone } from "./initDone.js";
-import { fetchMcpServers as defaultFetchMcpServers, registerMcpCommand, registerMcpTools, } from "./mcpTools.js";
+import { looksMutating } from "./mcp/tools.js";
+import { startMcp as defaultStartMcp, wireShutdown, deriveStartupConnectivityNotices } from "./mcp/startup.js";
 import { registerGoCommand } from "./pipeline/goCommand.js";
 import { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
 import { DEFAULT_PERMISSION_POLICY, createModeHolder, registerPermissionGate } from "./permission/gate.js";
@@ -293,16 +294,65 @@ export async function registerYagni(pi, deps = {}) {
     const decisionCapture = evalMode ? undefined : makeDecisionCapture(decisionClientOpts);
     if (!evalMode)
         registerDecisionCommands(pi, decisionClientOpts);
-    // Workspace MCP servers (YAG-446): register one tool per enabled server
-    // tool, executing through the backend proxy, plus the /mcp listing
-    // command. Fail-soft fetch (older backend / un-rescoped token → no MCP
-    // tools); skipped in eval mode like the other external-side-effect tools.
-    const fetchMcp = deps.fetchMcpServers ?? defaultFetchMcpServers;
-    const mcpServers = evalMode
-        ? []
-        : await fetchMcp({ baseUrl, getToken: getTokenFn, fetchImpl: authedFetch });
-    const { mutatingToolNames: mcpMutatingTools } = registerMcpTools(pi, mcpServers, { baseUrl, getToken: getTokenFn, fetchImpl: authedFetch });
-    registerMcpCommand(pi, mcpServers, { baseUrl });
+    // Local MCP servers (standard client, replaces the backend-proxy /mcp of
+    // the YAG-446 era): load user/project/local config, approval-gate project
+    // servers, connect, register one tool per server tool plus /mcp panel.
+    // Fail-soft everywhere; skipped entirely in eval mode (external side
+    // effects) and under the YAGNI_CODE_MCP_DISABLED kill-switch.
+    const startMcpImpl = deps.startMcp ?? defaultStartMcp;
+    // One-shot notices queued by startMcp at session start (the `.mcp.json`
+    // approval prompt); flushed once on the first provider response. Connectivity
+    // notices are NOT here — they are recomputed live at flush (see below).
+    const mcpApprovalNotices = [];
+    const mcpOutcome = evalMode
+        ? { manager: undefined, mutatingToolNames: [] }
+        : await startMcpImpl(pi, {
+            cwd: process.cwd(),
+            env,
+            hasUI: true,
+            notify: (msg) => mcpApprovalNotices.push(msg),
+        });
+    const mcpMutatingSet = new Set(mcpOutcome.mutatingToolNames);
+    // Wire names carry the original tool name after the second `__`: parse it
+    // out and re-run the heuristic for tools registered after startup (a
+    // reconnect can re-register tools the original classification never saw).
+    const mcpStartupIsMutating = (wireName) => {
+        const parts = wireName.split("__");
+        const original = parts.slice(2).join("__");
+        if (!original)
+            return false;
+        return looksMutating(original);
+    };
+    if (!evalMode && mcpOutcome.manager) {
+        wireShutdown(pi, mcpOutcome.manager);
+        // Startup notify (documented CC deviation): one quiet line per notice on
+        // the first provider response — never raw stdout, never blocking.
+        //
+        // Connectivity notices are recomputed against LIVE manager state at flush
+        // time (not the frozen startMcp snapshot): if the user healed a server via
+        // /mcp before the first turn, it must no longer read as broken/unauth.
+        // The static queue only carries non-connectivity notices (e.g. the
+        // `.mcp.json` approval prompt), which stay one-shot.
+        let connectivityNoticesFlushed = false;
+        pi.on("after_provider_response", (_event, ctx) => {
+            try {
+                if (!ctx.hasUI)
+                    return;
+                const connectivity = connectivityNoticesFlushed
+                    ? []
+                    : deriveStartupConnectivityNotices(mcpOutcome.manager);
+                connectivityNoticesFlushed = true;
+                for (const notice of connectivity)
+                    ctx.ui.notify(notice, "info");
+                while (mcpApprovalNotices.length > 0) {
+                    ctx.ui.notify(mcpApprovalNotices.shift(), "info");
+                }
+            }
+            catch {
+                // A notice must never break a turn.
+            }
+        });
+    }
     // P3 + W4: interactive permission tiers + plan mode via /mode, now with a
     // session bless store (three-way review-mode select) and a capture hook that
     // drafts a decision on "don't ask again". Default auto, so still additive.
@@ -336,12 +386,18 @@ export async function registerYagni(pi, deps = {}) {
     const guardianLogSink = (payload) => {
         const event = typeof payload.event === "string" ? payload.event : "guardian_event";
         const { event: _ignored, ...fields } = payload;
+        // `malformed` (repair failed — still really failing) and a failed
+        // telemetry POST are errors. `repaired: true` (the ladder salvaged the
+        // verdict) is a warn — it worked, but we keep counting it. Everything
+        // else is routine info.
+        const level = event === "guardian_event_post_failed" || payload.outcome === "malformed"
+            ? "error"
+            : payload.repaired === true && payload.outcome !== undefined
+                ? "warn"
+                : "info";
         logEvent({
             source: "guardian",
-            // `malformed` is a real failure (this is the "unclear verdict" bug the
-            // whole capture exists to diagnose) — an error, not routine info. The
-            // failed-telemetry event is already an error.
-            level: event === "guardian_event_post_failed" || payload.outcome === "malformed" ? "error" : "info",
+            level,
             event,
             sessionId: env.YAGNI_SESSION_ID ?? undefined,
             fields,
@@ -369,15 +425,20 @@ export async function registerYagni(pi, deps = {}) {
         guardianReview: (command, deps) => reviewCommand(command, { ...deps, modelTier: guardianTier }),
         onGuardianReview: (ev) => {
             guardianLogSink(ev);
-            // A malformed verdict is a real failure on our side that must reach
-            // Sentry for EVERY workspace (independent of the opt-in storage tier).
-            // Fire-and-forget to the dedicated telemetry endpoint; fail-soft, and
+            // A malformed verdict (repair FAILED — still really failing) is a real
+            // failure on our side that must reach Sentry for EVERY workspace
+            // (independent of the opt-in storage tier). A REPAIRED verdict (repair
+            // salvaged it) posts too, with outcome "malformed_repaired" so the
+            // backend can count salvage hits on their own Sentry issue. Both
+            // fire-and-forget to the dedicated telemetry endpoint; fail-soft, and
             // suppressed under test/eval so a CI run never phones prod.
-            if (ev.outcome === "malformed" && !evalMode && !runningUnderTest(env)) {
+            const isMalformed = ev.outcome === "malformed";
+            const isRepaired = ev.outcome !== "malformed" && ev.repaired === true;
+            if ((isMalformed || isRepaired) && !evalMode && !runningUnderTest(env)) {
                 void (async () => {
                     try {
                         const body = {
-                            outcome: ev.outcome,
+                            outcome: isRepaired ? "malformed_repaired" : ev.outcome,
                             ...(ev.rawOutput ? { rawOutput: ev.rawOutput } : {}),
                             ...(ev.durationMs !== undefined ? { durationMs: ev.durationMs } : {}),
                             ...(ev.tier ? { tier: ev.tier } : {}),
@@ -461,18 +522,17 @@ export async function registerYagni(pi, deps = {}) {
                     }
                 })();
             },
-        ...(mcpMutatingTools.length > 0
+        ...(mcpMutatingSet.size > 0 || mcpOutcome.manager
             ? {
                 policy: {
-                    planBlockTools: [
-                        ...DEFAULT_PERMISSION_POLICY.planBlockTools,
-                        ...mcpMutatingTools,
-                    ],
-                    reviewConfirmTools: [
-                        ...DEFAULT_PERMISSION_POLICY.reviewConfirmTools,
-                        ...mcpMutatingTools,
-                    ],
+                    planBlockTools: [...DEFAULT_PERMISSION_POLICY.planBlockTools],
+                    reviewConfirmTools: [...DEFAULT_PERMISSION_POLICY.reviewConfirmTools],
                     alwaysConfirmTools: DEFAULT_PERMISSION_POLICY.alwaysConfirmTools,
+                    // Predicate (not a static spread): matches any registered
+                    // mcp__* tool that startup classified as mutating, including
+                    // tools re-registered after a /mcp reconnect.
+                    isMutating: (toolName) => mcpMutatingSet.has(toolName) ||
+                        (toolName.startsWith("mcp__") && mcpStartupIsMutating(toolName)),
                 },
             }
             : {}),
@@ -885,9 +945,12 @@ export async function registerYagni(pi, deps = {}) {
         // Surface Pi's native find/grep/ls on the driver. These are Pi's
         // equivalents of Claude Code's Glob/Grep/LS; the /go stages and subagents
         // already pass them explicitly, but the driver defaults to read/bash/edit/write
-        // and otherwise reaches for `bash` find/grep/ls.
+        // and otherwise reaches for `bash` find/grep/ls. Dedupe against the active
+        // set — condensedTools re-registers these built-ins, so they can already be
+        // active here, and a duplicated name in the request's tool list is a hard
+        // 400 on some providers (Baseten: "Tool names must be unique.").
         try {
-            pi.setActiveTools([...pi.getActiveTools(), "grep", "find", "ls"]);
+            pi.setActiveTools([...new Set([...pi.getActiveTools(), "grep", "find", "ls"])]);
         }
         catch {
             // Tool enrichment must never break session start.

package/dist/extension/mcp/approval.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Approval gate for project-scope `.mcp.json` servers, mirroring Claude Code's
+ * decision shape: a `.mcp.json` in the repo (shared, VCS-controlled) cannot
+ * spawn processes until the user has approved it. Choices live in the
+ * per-project entry of `~/.yagni-code/mcp.json` under Claude Code's exact key
+ * names (`enabledMcpjsonServers` / `disabledMcpjsonServers` /
+ * `enableAllProjectMcpServers`), so a decision made in one tool is respected
+ * by the other.
+ */
+import { McpConfigError, UserMcpProjectEntry } from "./config.js";
+export type ProjectApprovalDecision = "enabled" | "disabled" | "undecided";
+export interface ProjectApprovalState {
+    enabledMcpjsonServers: string[];
+    disabledMcpjsonServers: string[];
+    enableAllProjectMcpServers: boolean;
+}
+/** Read the approval state for one project (abs path). Missing file/entry → fresh state. */
+export declare function readProjectApproval(repoRoot: string): {
+    state: ProjectApprovalState;
+    errors: McpConfigError[];
+};
+/** Effective decision for one project-scope server. Undecided by default. */
+export declare function decisionFor(state: ProjectApprovalState, serverName: string): ProjectApprovalDecision;
+/** Which configured project servers await a decision (drives the session-start prompt). */
+export declare function undecidedProjectServers(state: ProjectApprovalState, projectServerNames: string[]): string[];
+/**
+ * Record a decision. `enableAll: true` mirrors Claude Code's "Yes, approve all
+ * project servers in this repo" (sets the blanket flag); a single enable/disable
+ * appends to the corresponding list. Idempotent.
+ */
+export declare function recordProjectDecision(repoRoot: string, serverName: string | "all", decision: "enabled" | "disabled"): {
+    errors: McpConfigError[];
+};
+/** Clear this project's `.mcp.json` decisions (`yagni mcp reset-project-choices`). */
+export declare function resetProjectChoices(repoRoot: string): {
+    errors: McpConfigError[];
+};
+/**
+ * Mutate `~/.yagni-code/mcp.json`'s per-project entry under a read-modify-write
+ * helper shared with CLI commands (add/remove at local scope).
+ */
+export declare function updateProjectEntry(repoRoot: string, mutate: (entry: UserMcpProjectEntry) => void): {
+    errors: McpConfigError[];
+};
+//# sourceMappingURL=approval.d.ts.map