one-code-extension 0.1.4 → 0.3.0

package/extensions/mcp/panel/state.ts

@@ -0,0 +1,108 @@
+/**
+ * /mcp panel state machine (pure).
+ *
+ * Two views: the server list (cursor over entries; group headings are
+ * render-only and never landed on) and the detail view for one server (cursor
+ * over its numbered action list). `applyMcpKey` mutates the state in place and
+ * returns an effect when a key demands I/O — reconnect, disable, enable,
+ * authenticate — which the wiring performs and reflects back through the entries
+ * it renders. The wiring passes the current entries so "the selected row" always
+ * matches what was drawn (async reconnects reorder the list).
+ */
+
+import type { McpKey } from "./keys.ts";
+import { actionsFor, type McpEntry } from "./model.ts";
+
+export interface McpPanelState {
+	cursor: number;
+	detail?: { name: string; actionCursor: number };
+}
+
+export type McpEffect =
+	| { kind: "close" }
+	| { kind: "reconnect"; entry: McpEntry }
+	| { kind: "disable"; entry: McpEntry }
+	| { kind: "enable"; entry: McpEntry }
+	| { kind: "authenticate"; entry: McpEntry };
+
+export function initialMcpState(): McpPanelState {
+	return { cursor: 0 };
+}
+
+export function clampMcpCursor(state: McpPanelState, entries: McpEntry[]): void {
+	state.cursor = entries.length === 0 ? 0 : Math.max(0, Math.min(state.cursor, entries.length - 1));
+}
+
+/** Resolve the detail view's entry against the current list (rows shift under async work). */
+export function detailEntry(state: McpPanelState, entries: McpEntry[]): McpEntry | undefined {
+	return state.detail ? entries.find((entry) => entry.name === state.detail!.name) : undefined;
+}
+
+function effectForAction(entry: McpEntry, index: number): McpEffect | undefined {
+	const action = actionsFor(entry)[index];
+	if (!action) return undefined;
+	switch (action.key) {
+		case "reconnect":
+			return { kind: "reconnect", entry };
+		case "disable":
+			return { kind: "disable", entry };
+		case "enable":
+			return { kind: "enable", entry };
+		case "authenticate":
+			return { kind: "authenticate", entry };
+	}
+}
+
+export function applyMcpKey(state: McpPanelState, key: McpKey, entries: McpEntry[]): McpEffect | undefined {
+	// Detail view.
+	if (state.detail) {
+		const entry = detailEntry(state, entries);
+		if (!entry) {
+			// The server vanished (e.g. config changed under an async refresh).
+			if (key.kind === "back" || key.kind === "enter") state.detail = undefined;
+			if (key.kind === "close") return { kind: "close" };
+			return undefined;
+		}
+		const actions = actionsFor(entry);
+		const detail = state.detail;
+		detail.actionCursor = Math.max(0, Math.min(detail.actionCursor, actions.length - 1));
+		switch (key.kind) {
+			case "up":
+				detail.actionCursor = Math.max(0, detail.actionCursor - 1);
+				return undefined;
+			case "down":
+				detail.actionCursor = Math.min(actions.length - 1, detail.actionCursor + 1);
+				return undefined;
+			case "enter":
+				return effectForAction(entry, detail.actionCursor);
+			case "digit":
+				return effectForAction(entry, key.value - 1);
+			case "back":
+				state.detail = undefined;
+				return undefined;
+			case "close":
+				return { kind: "close" };
+		}
+	}
+
+	// List view.
+	clampMcpCursor(state, entries);
+	switch (key.kind) {
+		case "up":
+			state.cursor = Math.max(0, state.cursor - 1);
+			return undefined;
+		case "down":
+			state.cursor = Math.min(Math.max(0, entries.length - 1), state.cursor + 1);
+			return undefined;
+		case "enter": {
+			const entry = entries[state.cursor];
+			if (entry) state.detail = { name: entry.name, actionCursor: 0 };
+			return undefined;
+		}
+		case "back":
+		case "close":
+			return { kind: "close" };
+		case "digit":
+			return undefined;
+	}
+}

package/extensions/mcp/schema.ts

@@ -9,12 +9,23 @@
 
 import { type TSchema, Type } from "typebox";
 
-/** Claude Code's namespacing: mcp__<server>__<tool>, sanitised for tool-name rules. */
+/**
+ * Claude Code's namespacing: `mcp__<server>__<tool>`. Hyphens are KEPT (CC's
+ * captures show `mcp__plugin_context7_context7__query-docs`), so a user's
+ * existing `mcp__…` permission rules and hook matchers keep matching; anything
+ * else outside `[A-Za-z0-9_-]` (a plugin server's `plugin:x:y` colons, dots)
+ * becomes `_`, as in CC.
+ */
 export function namespacedToolName(server: string, tool: string): string {
-	const clean = (part: string) => part.replace(/[^a-zA-Z0-9_]/g, "_");
+	const clean = (part: string) => part.replace(/[^a-zA-Z0-9_-]/g, "_");
 	return `mcp__${clean(server)}__${clean(tool)}`;
 }
 
+/** CC's name for a plugin-provided server: `plugin:<plugin>:<server>`, so two plugins' `github` servers cannot collide with each other or with the user's. */
+export function pluginServerName(pluginName: string, serverName: string): string {
+	return `plugin:${pluginName}:${serverName}`;
+}
+
 export function parseNamespacedToolName(name: string): { server: string; tool: string } | undefined {
 	if (!name.startsWith("mcp__")) return undefined;
 	const rest = name.slice("mcp__".length);
@@ -36,8 +47,26 @@ interface JsonSchema {
 	[key: string]: unknown;
 }
 
+/**
+ * A server's tool and parameter descriptions ride every request as
+ * deferred-definition bytes with no bound; a malicious or careless server can
+ * make each one arbitrarily large. Cap them at registration with a labelled
+ * marker (review L2). 4 KB is far more than any real description needs.
+ */
+export const DESCRIPTION_CAP = 4096;
+export function capDescription(text: string | undefined): string | undefined {
+	if (typeof text !== "string") return undefined;
+	return text.length > DESCRIPTION_CAP ? `${text.slice(0, DESCRIPTION_CAP)}… [truncated, ${text.length} chars]` : text;
+}
+
+/** TypeBox options carrying a (capped) description, or none. */
+function descriptionOptions(schema: JsonSchema): Record<string, unknown> {
+	const capped = capDescription(schema.description);
+	return capped ? { description: capped } : {};
+}
+
 function convertLeaf(schema: JsonSchema): TSchema | undefined {
-	const options = schema.description ? { description: schema.description } : {};
+	const options = descriptionOptions(schema);
 	const type = Array.isArray(schema.type) ? schema.type.find((t) => t !== "null") : schema.type;
 
 	switch (type) {
@@ -67,7 +96,7 @@ function convertLeaf(schema: JsonSchema): TSchema | undefined {
 export function jsonSchemaToTypeBox(schema: JsonSchema | undefined): TSchema {
 	if (!schema || typeof schema !== "object") return Type.Unknown();
 
-	const options = schema.description ? { description: schema.description } : {};
+	const options = descriptionOptions(schema);
 
 	if (Array.isArray(schema.enum) && schema.enum.length > 0) {
 		const literals = schema.enum
@@ -137,7 +166,53 @@ export function describeResourceContents(contents: McpResourceContents[] | undef
 	return parts.join("\n").trim();
 }
 
-export function describeContent(blocks: McpContentBlock[] | undefined): {
+/** Decoded size a single image block may occupy before it is refused. */
+const MAX_IMAGE_BYTES = 5 * 1024 * 1024;
+
+/**
+ * A server names an image's `mimeType`, but the provider decodes the bytes: an
+ * undecodable block (a truncated PNG, a base64 string with a wrong `mimeType`)
+ * makes the provider answer 400 "Could not process image" on that request and
+ * on every later one, since the block stays in the history. So the bytes are
+ * checked against a small magic-number allow-list here and `mimeType` is
+ * derived from them, never trusted; a block that fails becomes a text note.
+ */
+/** Base64 length that decodes to just over the byte ceiling (4 base64 chars per 3 bytes). */
+const MAX_IMAGE_BASE64_LENGTH = Math.ceil((MAX_IMAGE_BYTES * 4) / 3);
+
+export function validateImageData(
+	data: string,
+	claimedMime: string | undefined,
+): { ok: true; mimeType: string } | { ok: false; reason: string; bytes: number } {
+	// Bound and sniff from the base64 string itself: decoding the whole payload
+	// (up to ~6.7 MB) just to read a 12-byte magic number and a length is pure
+	// waste — the block ships as the original base64 string regardless. Cap on
+	// the string length, then decode only a 24-char (4-aligned) prefix to sniff.
+	if (data.length === 0) return { ok: false, reason: "empty image data", bytes: 0 };
+	const approxBytes = Math.floor((data.length * 3) / 4);
+	if (data.length > MAX_IMAGE_BASE64_LENGTH) {
+		return { ok: false, reason: `image is ~${approxBytes} bytes, over the ${MAX_IMAGE_BYTES}-byte ceiling`, bytes: approxBytes };
+	}
+	const head = Buffer.from(data.slice(0, 24), "base64");
+	if (head.length === 0) return { ok: false, reason: "empty after base64 decode", bytes: 0 };
+	const mime = sniffImageMime(head);
+	if (!mime) return { ok: false, reason: `unrecognised image format (claimed ${claimedMime ?? "none"})`, bytes: approxBytes };
+	return { ok: true, mimeType: mime };
+}
+
+/** Magic-number sniff for the formats Anthropic accepts. Returns undefined for anything else. */
+function sniffImageMime(buf: Buffer): string | undefined {
+	if (buf.length >= 8 && buf[0] === 0x89 && buf[1] === 0x50 && buf[2] === 0x4e && buf[3] === 0x47) return "image/png";
+	if (buf.length >= 3 && buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff) return "image/jpeg";
+	if (buf.length >= 6 && buf[0] === 0x47 && buf[1] === 0x49 && buf[2] === 0x46 && buf[3] === 0x38) return "image/gif";
+	if (buf.length >= 12 && buf.toString("ascii", 0, 4) === "RIFF" && buf.toString("ascii", 8, 12) === "WEBP") return "image/webp";
+	return undefined;
+}
+
+export function describeContent(
+	blocks: McpContentBlock[] | undefined,
+	serverName?: string,
+): {
 	text: string;
 	images: Array<{ data: string; mimeType: string }>;
 } {
@@ -148,7 +223,9 @@ export function describeContent(blocks: McpContentBlock[] | undefined): {
 		if (block.type === "text" && typeof block.text === "string") {
 			texts.push(block.text);
 		} else if (block.type === "image" && block.data) {
-			images.push({ data: block.data, mimeType: block.mimeType ?? "image/png" });
+			const checked = validateImageData(block.data, block.mimeType);
+			if (checked.ok) images.push({ data: block.data, mimeType: checked.mimeType });
+			else texts.push(`[image content${serverName ? ` from ${serverName}` : ""} could not be decoded: ${checked.reason}, ${checked.bytes} bytes]`);
 		} else if (block.type === "resource" && block.resource) {
 			const { text, uri } = block.resource;
 			texts.push(text ?? `[resource ${uri ?? "(no uri)"}]`);

package/extensions/mcp/trust.ts

@@ -0,0 +1,340 @@
+/**
+ * Project `.mcp.json` consent. A checked-in `.mcp.json` names commands that
+ * run on the user's machine the moment the repo is opened, so its servers
+ * connect only after the user approves them — Claude Code prompts "New MCP
+ * server found in .mcp.json" and remembers the answer in
+ * `enabledMcpjsonServers` / `disabledMcpjsonServers` /
+ * `enableAllProjectMcpServers`. One Code honours those three keys READ-ONLY
+ * (user and `.claude/settings.local.json` scopes — never the checked-in
+ * project `settings.json`, which would let a repo approve itself) and keeps its
+ * own answers under `~/.onecode`, keyed to a hash of each server's config so a
+ * changed command re-prompts (CC keys by name alone). Servers from
+ * `~/.claude.json` and plugins never prompt: the user wrote the first, and
+ * installing a plugin was the consent. Servers from `.claude/settings.local.json`
+ * ARE prompted (that file can be checked in — `git clone && onecode` would
+ * otherwise spawn its servers with no consent, review H1); CC never reads
+ * `mcpServers` from that file at all. Its `enableAll*`/`enabledMcpjsonServers`
+ * policy keys are honoured only when the file is not git-tracked, for the same
+ * reason.
+ *
+ * A "No" is persisted as a project-scope disable (`lib/mcp-overrides.ts`), so
+ * the server shows as disabled in `/mcp` and Enable there brings it back —
+ * that click is the consent, recorded here. Escape declines for this session
+ * only. Same shape as `hooks/trust.ts`.
+ */
+
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { promisify } from "node:util";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { readSettingsFile, settingsPaths } from "../lib/claude-settings.ts";
+import { boundConsentItems } from "../lib/consent-preview.ts";
+import { oneCodeStateDir } from "../lib/paths.ts";
+import type { McpServer } from "./config.ts";
+
+const execFileAsync = promisify(execFile);
+
+interface ProjectApprovals {
+	/** "Use this and all future MCP servers in this project" was chosen. */
+	enableAll?: boolean;
+	servers: Record<string, { configHash: string; approvedAt: string }>;
+}
+
+interface ApprovalStore {
+	version: 1;
+	projects: Record<string, ProjectApprovals>;
+}
+
+export function approvalStorePath(): string {
+	return join(oneCodeStateDir(), "mcp", "project-approvals.json");
+}
+
+/**
+ * A server whose config a repository can ship (a project `.mcp.json` or a
+ * checked-in `.claude/settings.local.json`) — so it is consent-gated. A
+ * plugin's `.mcp.json` (also named `.mcp.json`) is excluded: installing the
+ * plugin was the consent.
+ */
+export function isProjectScopedServer(server: McpServer, pluginConfigPaths: ReadonlySet<string>): boolean {
+	if (pluginConfigPaths.has(server.source)) return false;
+	const base = basename(server.source);
+	return base === ".mcp.json" || base === "settings.local.json";
+}
+
+/** The directory the `.mcp.json` lives in — approvals are per config file, not per cwd. */
+export function projectRootOf(server: McpServer): string {
+	return dirname(server.source);
+}
+
+function canonicalize(value: unknown): unknown {
+	if (Array.isArray(value)) return value.map(canonicalize);
+	if (value && typeof value === "object") {
+		return Object.fromEntries(
+			Object.entries(value as Record<string, unknown>)
+				.sort(([a], [b]) => a.localeCompare(b))
+				.map(([key, inner]) => [key, canonicalize(inner)]),
+		);
+	}
+	return value;
+}
+
+/** Everything that decides what the server runs or talks to; `source`/`missingEnv` are not part of it. */
+export function hashServerConfig(server: McpServer): string {
+	const material =
+		server.kind === "stdio"
+			? { kind: "stdio", command: server.command, args: server.args, env: server.env ?? {} }
+			: { kind: "http", url: server.url, headers: server.headers ?? {} };
+	return createHash("sha256").update(JSON.stringify(canonicalize(material))).digest("hex");
+}
+
+/** Claude Code's own answers, read from its settings (user + local scopes only). */
+export interface ClaudeMcpjsonPolicy {
+	enableAll: boolean;
+	enabled: Set<string>;
+	disabled: Set<string>;
+}
+
+function stringArray(value: unknown): string[] {
+	return Array.isArray(value) ? value.filter((v): v is string => typeof v === "string") : [];
+}
+
+/**
+ * Whether `.claude/settings.local.json`'s policy keys may be trusted: true ONLY
+ * when git ran to a verdict and the file is not a tracked file (untracked in a
+ * repo, or no repo at all — either way not something a `git clone` shipped).
+ * FAILS CLOSED: git missing, a timeout, or any result we cannot interpret
+ * returns false, so a checked-in file that we could not prove untracked is not
+ * trusted (review H1 — a fail-open here silently re-opens the self-approval
+ * hole). Async so it never blocks the event loop from the connect path
+ * (findings §15: never do slow synchronous work on the startup path).
+ */
+async function localPolicyFileIsTrusted(cwd: string, path: string): Promise<boolean> {
+	try {
+		await execFileAsync("git", ["ls-files", "--error-unmatch", "--", path], { cwd, timeout: 5_000 });
+		return false; // exit 0 → tracked → do not trust its policy keys
+	} catch (error) {
+		// execFile rejects with `code` = the numeric exit code on a non-zero exit
+		// (1 = untracked in a repo, 128 = not a repo — both mean "not tracked, safe
+		// to trust"); a spawn failure gives a string code (e.g. "ENOENT") and a
+		// timeout gives a non-numeric code — those are "could not decide" → closed.
+		return typeof (error as { code?: unknown }).code === "number";
+	}
+}
+
+export async function readClaudeMcpjsonPolicy(cwd: string, home: string): Promise<ClaudeMcpjsonPolicy> {
+	const paths = settingsPaths(cwd, home);
+	const policy: ClaudeMcpjsonPolicy = { enableAll: false, enabled: new Set(), disabled: new Set() };
+	// Deliberately not `paths.project`: a checked-in settings.json granting
+	// enableAllProjectMcpServers would be the repo approving its own servers.
+	// The local file is read only when it is provably not git-tracked (an
+	// untracked, user-authored file), for the same reason — a checked-in
+	// settings.local.json would otherwise approve the repo's own .mcp.json
+	// servers (review H1).
+	const sources = [paths.user];
+	if (await localPolicyFileIsTrusted(cwd, paths.local)) sources.push(paths.local);
+	for (const path of sources) {
+		const file = readSettingsFile(path);
+		if (!file) continue;
+		if (typeof file.enableAllProjectMcpServers === "boolean") policy.enableAll = file.enableAllProjectMcpServers;
+		for (const name of stringArray(file.enabledMcpjsonServers)) policy.enabled.add(name);
+		for (const name of stringArray(file.disabledMcpjsonServers)) policy.disabled.add(name);
+	}
+	return policy;
+}
+
+function readStore(storePath: string): ApprovalStore {
+	try {
+		const existing = JSON.parse(readFileSync(storePath, "utf-8")) as ApprovalStore;
+		if (existing && typeof existing === "object" && existing.projects) return existing;
+	} catch {
+		// Fresh store.
+	}
+	return { version: 1, projects: {} };
+}
+
+function writeStore(storePath: string, store: ApprovalStore): void {
+	try {
+		mkdirSync(dirname(storePath), { recursive: true });
+		writeFileSync(storePath, `${JSON.stringify(store, null, "\t")}\n`, { mode: 0o600 });
+	} catch {
+		// Approval still holds for this session; it will just re-prompt next run.
+	}
+}
+
+export function readStoredApproval(projectRoot: string, storePath = approvalStorePath()): ProjectApprovals | undefined {
+	return readStore(storePath).projects[projectRoot];
+}
+
+/** Record consent for one server's current config. */
+export function persistApproval(projectRoot: string, server: McpServer, storePath = approvalStorePath()): void {
+	const store = readStore(storePath);
+	const project = (store.projects[projectRoot] ??= { servers: {} });
+	project.servers[server.name] = { configHash: hashServerConfig(server), approvedAt: new Date().toISOString() };
+	writeStore(storePath, store);
+}
+
+/** Record "this and all future servers in this project". */
+export function persistEnableAll(projectRoot: string, storePath = approvalStorePath()): void {
+	const store = readStore(storePath);
+	const project = (store.projects[projectRoot] ??= { servers: {} });
+	project.enableAll = true;
+	writeStore(storePath, store);
+}
+
+export const CHOICE_ALL = "Use this and all future MCP servers in this project";
+export const CHOICE_THIS = "Use this MCP server";
+export const CHOICE_THESE = "Use these MCP servers";
+export const CHOICE_NO = "No";
+
+/** Claude Code's dialog title for one or several newly found servers. */
+export function promptTitle(names: string[]): string {
+	return names.length === 1
+		? `New MCP server found in .mcp.json: ${names[0]}`
+		: `${names.length} new MCP servers found in .mcp.json`;
+}
+
+/**
+ * One line per server naming what would run, for the dialog body. Commands and
+ * URLs are shown in full (a truncated one hides where a padded attack lives),
+ * env values are never echoed, but the variable NAMES a server's
+ * command/args/env/headers reference are listed (from `referencedEnv`, captured
+ * before expansion) — approving a URL should not silently ship a credential the
+ * header interpolates (review M5).
+ */
+export function describeServers(servers: McpServer[]): string {
+	const lines = servers.map((server) => {
+		const what =
+			server.kind === "stdio"
+				? `${server.name}: ${[server.command, ...server.args].join(" ")}`
+				: `${server.name}: ${server.url}`;
+		const vars = server.referencedEnv ?? [];
+		const headerNames = server.kind === "http" ? Object.keys(server.headers ?? {}) : [];
+		const notes = [
+			vars.length ? `uses ${vars.map((v) => `$${v}`).join(", ")}` : "",
+			headerNames.length ? `headers: ${headerNames.join(", ")}` : "",
+		].filter(Boolean);
+		return notes.length ? `${what}\n    (${notes.join("; ")})` : what;
+	});
+	// Bound the modal: a very long command/url or many servers cannot flood it.
+	return boundConsentItems(lines, "review .mcp.json before approving");
+}
+
+export interface McpTrustDeps {
+	hasUI: boolean;
+	/** `ctx.ui.select` — returns the chosen option, or undefined on Escape. */
+	select: (title: string, options: string[]) => Promise<string | undefined>;
+	notify: (message: string) => void;
+	/** Persist an explicit "No" (project-scope disable), so it does not re-prompt every start. */
+	disable: (server: McpServer) => void;
+	storePath?: string;
+}
+
+export interface McpTrustOutcome {
+	/** Servers that may connect (includes every non-project-`.mcp.json` server). */
+	approved: McpServer[];
+	/** Project `.mcp.json` servers that must not connect, with why. */
+	withheld: { server: McpServer; reason: "declined" | "not-approved" | "disabled-by-claude-settings" }[];
+}
+
+/** Process-lifetime memory per project+server+hash, so /clear (a new session_start) does not re-ask a "No". */
+const sessionDecisions = new Map<string, boolean>();
+const pendingPrompts = new Map<string, Promise<string | undefined>>();
+
+/**
+ * Split servers into those that may connect and those withheld, prompting
+ * once (one dialog for every new project server) when there is a UI.
+ */
+export async function approveMcpServers(
+	servers: McpServer[],
+	pluginConfigPaths: ReadonlySet<string>,
+	cwd: string,
+	home: string,
+	deps: McpTrustDeps,
+): Promise<McpTrustOutcome> {
+	const approved: McpServer[] = [];
+	const withheld: McpTrustOutcome["withheld"] = [];
+	const pending: McpServer[] = [];
+	// Reading CC's policy shells out to git (localPolicyFileIsTrusted), so only
+	// do it when a server actually needs consent — a session with only
+	// user-scope or plugin servers must not pay a git spawn at connect.
+	const anyProjectScoped = servers.some((s) => isProjectScopedServer(s, pluginConfigPaths));
+	const claude: ClaudeMcpjsonPolicy = anyProjectScoped
+		? await readClaudeMcpjsonPolicy(cwd, home)
+		: { enableAll: false, enabled: new Set<string>(), disabled: new Set<string>() };
+
+	for (const server of servers) {
+		if (!isProjectScopedServer(server, pluginConfigPaths)) {
+			approved.push(server);
+			continue;
+		}
+		if (claude.disabled.has(server.name)) {
+			withheld.push({ server, reason: "disabled-by-claude-settings" });
+			continue;
+		}
+		if (claude.enableAll || claude.enabled.has(server.name)) {
+			approved.push(server);
+			continue;
+		}
+		const root = projectRootOf(server);
+		const hash = hashServerConfig(server);
+		const stored = readStoredApproval(root, deps.storePath);
+		if (stored?.enableAll || stored?.servers[server.name]?.configHash === hash) {
+			approved.push(server);
+			continue;
+		}
+		const remembered = sessionDecisions.get(`${root}:${server.name}:${hash}`);
+		if (remembered === true) approved.push(server);
+		else if (remembered === false) withheld.push({ server, reason: "declined" });
+		else pending.push(server);
+	}
+
+	if (pending.length === 0) return { approved, withheld };
+
+	if (!deps.hasUI) {
+		for (const server of pending) withheld.push({ server, reason: "not-approved" });
+		deps.notify(
+			`Skipped ${pending.length} MCP server${pending.length === 1 ? "" : "s"} from .mcp.json (${pending.map((s) => s.name).join(", ")}): not yet approved and no UI to ask. Approve once in an interactive session, or set enabledMcpjsonServers in .claude/settings.local.json.`,
+		);
+		return { approved, withheld };
+	}
+
+	// One dialog for the batch; concurrent callers (a reconnect racing startup) share it.
+	const names = pending.map((s) => s.name);
+	const key = pending.map((s) => `${projectRootOf(s)}:${s.name}:${hashServerConfig(s)}`).join("|");
+	let prompt = pendingPrompts.get(key);
+	if (!prompt) {
+		const useLabel = pending.length === 1 ? CHOICE_THIS : CHOICE_THESE;
+		prompt = deps
+			.select(`${promptTitle(names)}\n\n${describeServers(pending)}\n\nThese run on your machine.`, [CHOICE_ALL, useLabel, CHOICE_NO])
+			.finally(() => pendingPrompts.delete(key));
+		pendingPrompts.set(key, prompt);
+	}
+	const choice = await prompt;
+
+	for (const server of pending) {
+		const root = projectRootOf(server);
+		const decisionKey = `${root}:${server.name}:${hashServerConfig(server)}`;
+		if (choice === CHOICE_ALL || choice === CHOICE_THIS || choice === CHOICE_THESE) {
+			sessionDecisions.set(decisionKey, true);
+			if (choice === CHOICE_ALL) persistEnableAll(root, deps.storePath);
+			persistApproval(root, server, deps.storePath);
+			approved.push(server);
+		} else {
+			sessionDecisions.set(decisionKey, false);
+			withheld.push({ server, reason: "declined" });
+			// An explicit "No" is remembered as a disable; Escape is this session only.
+			if (choice === CHOICE_NO) deps.disable(server);
+		}
+	}
+	if (choice !== CHOICE_ALL && choice !== CHOICE_THIS && choice !== CHOICE_THESE) {
+		deps.notify(`MCP server${pending.length === 1 ? "" : "s"} from .mcp.json not connected (${names.join(", ")}); enable in /mcp.`);
+	}
+	return { approved, withheld };
+}
+
+/** Test seam. */
+export function resetMcpTrustSessionState(): void {
+	sessionDecisions.clear();
+	pendingPrompts.clear();
+}