pi-mcp-adapter 3.0.0 → 3.2.0

package/init.ts

@@ -3,7 +3,7 @@ import type { McpExtensionState } from "./state.ts";
 import { formatToolName, isServerDisabled, resolveToolPrefix, type McpAdapterOptions, type PromptMetadata, type ToolMetadata, type ToolSelectorCandidateIndex } from "./types.ts";
 import { existsSync } from "node:fs";
 import { cloneMcpConfig, loadMcpConfig, resolveConfiguredClaudePluginMcp } from "./config.ts";
-import { applyProjectServerTrustToConfig, describeProjectServerBlock } from "./project-server-trust.ts";
+import { applyProjectServerTrustToConfig, describeProjectServerBlock, excludeProjectServersAtLoadTime } from "./project-server-trust.ts";
 import { ConsentManager } from "./consent-manager.ts";
 import { McpLifecycleManager } from "./lifecycle.ts";
 import {
@@ -43,7 +43,7 @@ import {
   createSessionApprovalWriter,
   restoreSessionApprovalState,
 } from "./session-approvals.ts";
-export { getFailureAgeSeconds, getFailureMessage, isServerInActiveFailureBackoff } from "./failure-backoff.ts";
+export { getFailureAgeSeconds, getFailureMessage } from "./failure-backoff.ts";
 
 const MAX_FAILURE_MESSAGE_CHARS = 8 * 1024;
 const failureExpiryTimers = new WeakMap<McpExtensionState, Map<string, ReturnType<typeof setTimeout>>>();
@@ -103,6 +103,9 @@ export function isTuiMode(ctx: Pick<ExtensionContext, "hasUI" | "mode">): boolea
 type McpInitializationOptions = McpAdapterOptions & {
   oauthRuntime?: McpOAuthRuntime;
   statusEvents?: McpExtensionState["statusEvents"];
+  onProjectTrustResolved?: () => void;
+  /** Load-time runs have no Pi context, so project trust is unknown; session_start decides later. */
+  excludeProjectServers?: boolean;
 };
 
 export async function initializeMcp(
@@ -141,7 +144,10 @@ export async function initializeMcp(
   const runtimeSignal = combineAbortSignals(owner.signal, initialSignal);
   const trustResult = options.config !== undefined
     ? { config: resolveConfiguredClaudePluginMcp(cloneMcpConfig(options.config), cwd), blockedServers: new Map() }
-    : await applyProjectServerTrustToConfig(loadMcpConfig(configPath, cwd), ctx);
+    : options.excludeProjectServers
+      ? { config: excludeProjectServersAtLoadTime(loadMcpConfig(configPath, cwd)), blockedServers: new Map() }
+      : await applyProjectServerTrustToConfig(loadMcpConfig(configPath, cwd), ctx);
+  options.onProjectTrustResolved?.();
   const config = trustResult.config;
   const authStorageOptions = getAuthStorageOptions(config.settings?.oauthDir, cwd, config.settings?.oauthCredentialStore);
 
@@ -591,6 +597,7 @@ export function updateMetadataCache(
   if (!definition || isServerDisabled(definition)) return;
 
   const configHash = computeServerHash(definition);
+  if (connection.definition && computeServerHash(connection.definition) !== configHash) return;
   const existing = loadMetadataCache();
   const existingEntry = existing?.servers?.[serverName];
 
@@ -600,13 +607,13 @@ export function updateMetadataCache(
     ? existingEntry?.configHash === configHash ? existingEntry.prompts : undefined
     : serializePrompts(connection.prompts ?? []);
 
-  if (
-    definition.exposeResources !== false &&
-    connection.resourceDiscoveryFailed === true &&
-    existingEntry?.resources?.length &&
-    isServerCacheValid(existingEntry, definition)
-  ) {
-    resources = existingEntry.resources;
+  if (definition.exposeResources !== false && connection.resourceDiscoveryFailed === true) {
+    const sessionEntry = state.sessionMetadata?.get(serverName);
+    if (sessionEntry?.configHash === configHash) {
+      resources = sessionEntry.resources ?? [];
+    } else if (existingEntry?.resources?.length && isServerCacheValid(existingEntry, definition)) {
+      resources = existingEntry.resources;
+    }
   }
 
   const entry: ServerCacheEntry = {
@@ -620,6 +627,7 @@ export function updateMetadataCache(
     cachedAt: Date.now(),
   };
 
+  (state.sessionMetadata ??= new Map()).set(serverName, entry);
   saveMetadataCache({ version: 1, servers: { [serverName]: entry } });
 }
 

package/mcp-callback-server.ts

@@ -8,6 +8,7 @@
 import { createServer, type Server, type IncomingMessage, type ServerResponse } from "http"
 import { getAppName } from "./agent-dir.ts"
 import {
+  DEFAULT_OAUTH_CALLBACK_HOST,
   DEFAULT_OAUTH_CALLBACK_PATH,
   getConfiguredOAuthCallbackPort,
   getOAuthCallbackPath,
@@ -197,7 +198,6 @@ interface EnsureCallbackServerOptions {
   reserveState?: boolean
 }
 
-const DEFAULT_OAUTH_CALLBACK_HOST = "localhost"
 let callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST
 
 /**

package/mcp-code.ts

@@ -3,7 +3,7 @@ import { formatWithOptions } from "node:util";
 import { Worker } from "node:worker_threads";
 import { throwIfAborted } from "./abort.ts";
 import { guardMcpOutput, guardedMcpDetails, resolveMcpOutputGuardOptions } from "./mcp-output-guard.ts";
-import { loadMcpScriptWasm } from "./mcp-script-wasm.ts";
+import { loadMcpScriptWasm, resolveMcpScriptQuickJsUrl } from "./mcp-script-wasm.ts";
 import { evaluateJev, validateJevSettings } from "./jev-client.ts";
 import type { JevErrorCode, JevEvaluateInput, JevEvaluationEnvelope } from "./jev-contracts.ts";
 import { executeCall } from "./proxy-modes.ts";
@@ -408,7 +408,7 @@ export async function runMcpScript(
   try {
     const wasm = await Promise.race([loadMcpScriptWasm(), timeout, aborted]);
     worker = new Worker(new URL("./mcp-script-worker.mjs", import.meta.url), {
-      workerData: { code, wasm, interrupt, outputMaxBytes: MCP_SCRIPT_OUTPUT_MAX_BYTES },
+      workerData: { code, wasm, quickjsUrl: resolveMcpScriptQuickJsUrl(), interrupt, outputMaxBytes: MCP_SCRIPT_OUTPUT_MAX_BYTES },
       env: {},
       // The sandbox cannot open files, and the host always terminates this worker.
       // Disable Node's unmanaged FD bookkeeping, which emits false warnings when

package/mcp-oauth-provider.ts

@@ -89,6 +89,9 @@ function toOAuthTokens(tokens: StoredTokens): IssuerBoundTokens {
 }
 
 // Callback server configuration
+// RFC 8252 section 7.3: use the loopback IP literal, not "localhost". The
+// callback listener binds this same host so the advertised redirect reaches it.
+const DEFAULT_OAUTH_CALLBACK_HOST = "127.0.0.1"
 const DEFAULT_OAUTH_CALLBACK_PORT = 19876
 const DEFAULT_OAUTH_CALLBACK_PATH = "/callback"
 
@@ -287,7 +290,7 @@ export class McpOAuthProvider implements OAuthClientProvider {
     this.flowState = initialState
     this.redirectUrlSnapshot = config.grantType === "client_credentials"
       ? undefined
-      : config.redirectUri ?? `http://localhost:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`
+      : config.redirectUri ?? `http://${DEFAULT_OAUTH_CALLBACK_HOST}:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`
   }
 
   setAuthFetch(fetchFn: OAuthFetch): void {
@@ -816,4 +819,4 @@ export class McpOAuthProvider implements OAuthClientProvider {
   }
 }
 
-export { DEFAULT_OAUTH_CALLBACK_PORT, DEFAULT_OAUTH_CALLBACK_PATH }
+export { DEFAULT_OAUTH_CALLBACK_HOST, DEFAULT_OAUTH_CALLBACK_PORT, DEFAULT_OAUTH_CALLBACK_PATH }

package/mcp-panel.ts

@@ -612,12 +612,13 @@ class McpPanel {
 
     if (query && !this.authOnly) {
       this.visibleItems = this.visibleItems.filter((item) => {
-        if (item.type === "server") {
-          return this.visibleItems.some(
-            (other) => other.type === "tool" && other.serverIndex === item.serverIndex,
-          );
-        }
-        return true;
+        if (item.type !== "server") return true;
+        const server = this.servers[item.serverIndex];
+        // Servers without cached tools (disabled, never connected) can only match by name.
+        if (mode === "name" && server && fuzzyScore(query, server.name) > 0) return true;
+        return this.visibleItems.some(
+          (other) => other.type === "tool" && other.serverIndex === item.serverIndex,
+        );
       });
     }
   }

package/mcp-script-wasm.ts

@@ -1,12 +1,29 @@
 import { readFile } from "node:fs/promises";
 import { createRequire } from "node:module";
+import { pathToFileURL } from "node:url";
 
 export type McpScriptWasmModule = object;
 
 const cached = new Map<string, Promise<McpScriptWasmModule>>();
 
+function resolveQuickJsWasmPath(): string {
+  return createRequire(import.meta.url).resolve("quickjs-wasi/quickjs.wasm");
+}
+
+/**
+ * Resolve the quickjs-wasi entry on the host thread. The worker imports this
+ * file URL because Bun-compiled executables cannot resolve bare package names
+ * from a worker file loaded from disk.
+ * Those executables also fail to resolve the bare `quickjs-wasi` root on the
+ * host thread, while package subpaths resolve. So the entry is located next to
+ * the wasm file, which is how quickjs-wasi's `"."` export lays it out.
+ */
+export function resolveMcpScriptQuickJsUrl(): string {
+  return new URL("./dist/index.js", pathToFileURL(resolveQuickJsWasmPath())).href;
+}
+
 /** Load and compile the packaged QuickJS runtime once per host process. */
-export function loadMcpScriptWasm(path = createRequire(import.meta.url).resolve("quickjs-wasi/quickjs.wasm")): Promise<McpScriptWasmModule> {
+export function loadMcpScriptWasm(path = resolveQuickJsWasmPath()): Promise<McpScriptWasmModule> {
   let module = cached.get(path);
   if (!module) {
     const webAssembly = (globalThis as unknown as {

package/mcp-script-worker.mjs

@@ -1,16 +1,18 @@
 import { parentPort, workerData } from "node:worker_threads";
-import { JSException, MAX_STACK_SIZE, QuickJS } from "quickjs-wasi";
 
 const MEMORY_LIMIT_BYTES = 64 * 1024 * 1024;
 const ERROR_MAX_BYTES = 64 * 1024;
 const ERROR_TRUNCATION_MARKER = "\n...[mcpScript error truncated]";
 
+// Set once main() imports quickjs-wasi from the host-resolved file URL.
+let JSException;
+
 function post(message) {
   parentPort?.postMessage(message);
 }
 
 function errorText(error) {
-  if (error instanceof JSException) {
+  if (JSException && error instanceof JSException) {
     const head = error.message ? `${error.name}: ${error.message}` : error.name;
     return error.stack ? `${head}\n${error.stack}` : head;
   }
@@ -172,6 +174,11 @@ const PRELUDE_SOURCE = `(function (bridge) {
 })`;
 
 async function main() {
+  // Bun-compiled executables cannot resolve bare package names from this
+  // worker file, so import quickjs-wasi from the URL the host resolved.
+  const quickjs = await import(workerData.quickjsUrl);
+  JSException = quickjs.JSException;
+  const { MAX_STACK_SIZE, QuickJS } = quickjs;
   const interrupt = new Int32Array(workerData.interrupt);
   let outputBytes = 0;
   let outputExceeded = false;

package/mcp-setup-panel.ts

@@ -185,8 +185,11 @@ class McpSetupPanelView implements Component {
     }
     lines.push("");
 
-    const preview = this.getActionPreview(state, actions[state.actionCursor], this.previewWidth(innerWidth));
-    lines.push(...preview);
+    const previewWidth = this.previewWidth(innerWidth);
+    lines.push(...this.previewOrError(
+      () => this.getActionPreview(state, actions[state.actionCursor], previewWidth),
+      previewWidth,
+    ));
     lines.push("");
     const hint = compact ? "Enter select · Esc back" : "Enter selects, Esc goes back, Ctrl+C closes.";
     lines.push(this.theme.description(hint));
@@ -208,8 +211,11 @@ class McpSetupPanelView implements Component {
     const selected = state.discovery.imports
       .filter((entry) => state.selectedImports.has(entry.kind))
       .map((entry) => entry.kind);
-    const preview = this.callbacks.previewImports(selected);
-    lines.push(...this.formatWritePreview("Compatibility import write preview", preview, [], this.previewWidth(innerWidth)));
+    const previewWidth = this.previewWidth(innerWidth);
+    lines.push(...this.previewOrError(
+      () => this.formatWritePreview("Compatibility import write preview", this.callbacks.previewImports(selected), [], previewWidth),
+      previewWidth,
+    ));
     return lines;
   }
 
@@ -391,6 +397,14 @@ class McpSetupPanelView implements Component {
     return preview;
   }
 
+  private previewOrError(renderPreview: () => string[], width: number): string[] {
+    try {
+      return renderPreview();
+    } catch (error) {
+      return this.formatPreview([`Preview unavailable: ${error instanceof Error ? error.message : String(error)}`], width);
+    }
+  }
+
   private formatWritePreview(title: string, preview: ConfigWritePreview, intro: string[] = [], width = DESKTOP_PREVIEW_WIDTH): string[] {
     const lines: string[] = [];
     for (const line of intro) lines.push(...wrapText(line, width));

package/metadata-cache.ts

@@ -85,11 +85,14 @@ export function computeServerHash(definition: ServerEntry, environment: NodeJS.P
   // Hash only fields that affect server identity and tool/resource output.
   // Exclude lifecycle, idleTimeout, requestTimeoutMs, debug — those are runtime behavior settings
   // that don't change which tools a server exposes.
+  const isStdio = !!definition.command;
+  const literalEnv = isBuiltInAgentPlugin(definition, "env") || (isStdio && definition.literalEnv === true);
   const identity: Record<string, unknown> = {
     command: resolveConfigPath(definition.command, environment),
     args: definition.args,
     socket: resolveConfigPath(definition.socket, environment),
-    env: isBuiltInAgentPlugin(definition, "env") ? definition.env : interpolateEnvRecord(definition.env, environment),
+    env: literalEnv ? definition.env : interpolateEnvRecord(definition.env, environment),
+    ...(isStdio ? { inheritEnv: definition.inheritEnv !== false, literalEnv } : {}),
     cwd: isBuiltInAgentPlugin(definition, "cwd") ? definition.cwd : resolveConfigPath(definition.cwd, environment),
     url: resolveServerUrl(definition, environment),
     headers: isBuiltInAgentPlugin(definition, "headers") ? definition.headers : interpolateEnvRecord(definition.headers, environment),

package/namespace-tools.ts

@@ -190,6 +190,10 @@ export interface SyncNamespaceProxyToolsInput {
   activeDirectNames?: ReadonlySet<string>;
   existingNamespaceNames: Set<string>;
   unavailableServers?: ReadonlySet<string>;
+  // Names the adapter removed from Pi's active tools because Pi could not
+  // unregister them. Pi does not re-activate a name it already knows, so a
+  // later re-registration must add the name back.
+  fallbackDeactivatedNames?: Set<string>;
   pi: ExtensionAPI;
   getState: GetState;
   getInitPromise: GetInitPromise;
@@ -265,10 +269,19 @@ function registerNamespaceProxyTool(
     ),
   });
   input.guardReentrant?.();
+  if (input.fallbackDeactivatedNames?.delete(spec.toolName)) {
+    // Only undo a fallback deactivation the adapter still owns.
+    input.guardReentrant?.();
+    const activeTools = getActiveToolsIfReady(input.pi);
+    input.guardReentrant?.();
+    if (activeTools && !activeTools.includes(spec.toolName)) {
+      input.pi.setActiveTools([...activeTools, spec.toolName]);
+      input.guardReentrant?.();
+    }
+  }
 }
 
-function getActiveToolsForStaleCleanup(pi: ExtensionAPI, staleNames: string[]): string[] | undefined {
-  if (staleNames.length === 0) return undefined;
+function getActiveToolsIfReady(pi: ExtensionAPI): string[] | undefined {
   try {
     return pi.getActiveTools?.();
   } catch (error) {
@@ -277,6 +290,11 @@ function getActiveToolsForStaleCleanup(pi: ExtensionAPI, staleNames: string[]):
   }
 }
 
+function getActiveToolsForStaleCleanup(pi: ExtensionAPI, staleNames: string[]): string[] | undefined {
+  if (staleNames.length === 0) return undefined;
+  return getActiveToolsIfReady(pi);
+}
+
 function deactivateStaleNamespaceTools(input: SyncNamespaceProxyToolsInput, nextNames: Set<string>): string[] {
   const activeDirectNames = input.activeDirectNames ?? new Set<string>();
   const staleNames = [...input.existingNamespaceNames].filter(
@@ -298,12 +316,14 @@ function deactivateStaleNamespaceTools(input: SyncNamespaceProxyToolsInput, next
   if (!activeTools) return deactivated;
 
   const stale = new Set(staleNames);
+  const fallbackRemoved = staleNames.filter((name) => !deactivated.includes(name) && activeTools.includes(name));
   const nextActiveTools = activeTools.filter((name) => !stale.has(name));
   if (nextActiveTools.length === activeTools.length) return deactivated;
 
   input.guardReentrant?.();
   input.pi.setActiveTools(nextActiveTools);
   input.guardReentrant?.();
+  for (const name of fallbackRemoved) input.fallbackDeactivatedNames?.add(name);
   for (const name of staleNames) {
     if (!deactivated.includes(name)) deactivated.push(name);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-mcp-adapter",
-  "version": "3.0.0",
+  "version": "3.2.0",
   "description": "MCP (Model Context Protocol) adapter extension for Pi coding agent",
   "type": "module",
   "types": "./index.ts",
@@ -20,6 +20,11 @@
       "import": "./oauth.ts",
       "default": "./oauth.ts"
     },
+    "./host-managed": {
+      "types": "./host-managed.ts",
+      "import": "./host-managed.ts",
+      "default": "./host-managed.ts"
+    },
     "./config": {
       "types": "./dist/config.d.ts",
       "import": "./dist/config.js",
@@ -86,6 +91,8 @@
     "ts-shape.ts",
     "search-ranking.ts",
     "tool-approval.ts",
+    "tool-parameters.ts",
+    "host-managed.ts",
     "session-approvals.ts",
     "project-server-trust.ts",
     "init.ts",
@@ -183,7 +190,7 @@
     "open": "^10.2.0",
     "quickjs-wasi": "3.6.2",
     "recheck": "4.6.0-beta.3",
-    "smol-toml": "^1.6.1",
+    "smol-toml": "^1.9.0",
     "strip-json-comments": "^5.0.3",
     "undici": "^6.28.1",
     "zod": "^3.25.0 || ^4.0.0"

package/project-server-trust.ts

@@ -1,10 +1,10 @@
 import { createHash } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from "node:fs";
+import { basename, dirname, join, relative, resolve } from "node:path";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { getAgentPath } from "./agent-dir.ts";
 import type { LoadedMcpConfig } from "./config.ts";
-import type { McpConfig, ProjectServerBlock, ProjectServerBlockReason, ServerDefinition } from "./types.ts";
+import { isServerDisabled, type McpConfig, type ProjectServerBlock, type ProjectServerBlockReason, type ServerDefinition } from "./types.ts";
 
 const APPROVALS_VERSION = 1;
 const APPROVALS_FILE = "mcp-project-approvals.json";
@@ -82,6 +82,45 @@ export function canonicalProjectRoot(cwd: string): string {
   }
 }
 
+/**
+ * Git worktrees share approvals per repository, keyed by the same relative path. A `.git`
+ * file counts only when it is a regular file (not a symlink to a real worktree's) and git's
+ * admin entry for it links back to it; otherwise a directory could claim another checkout's
+ * approvals. Worktrees of a regular checkout use that checkout's path, so its existing
+ * approvals still apply. Bare repositories (even one stored as a `.git` folder, whose
+ * parent is not a checkout) and `--separate-git-dir` ones get a `git-dir:` key, which no
+ * canonical path equals, so an admin entry planted in a checkout's tracked files cannot
+ * borrow that checkout's approvals.
+ * A `--separate-git-dir` main checkout keeps its own path: git records no link back to it.
+ */
+function projectApprovalScope(cwd: string): string {
+  const root = canonicalProjectRoot(cwd);
+  for (let dir = root; ; dir = dirname(dir)) {
+    const dotGit = join(dir, ".git");
+    if (existsSync(dotGit)) {
+      const repoScope = linkedWorktreeRepoScope(dotGit);
+      return repoScope ? join(repoScope, relative(dir, root)) : root;
+    }
+    if (dirname(dir) === dir) return root;
+  }
+}
+
+function linkedWorktreeRepoScope(dotGit: string): string | undefined {
+  try {
+    if (!lstatSync(dotGit).isFile()) return undefined;
+    const pointer = /^gitdir: (.+)$/m.exec(readFileSync(dotGit, "utf8"))?.[1]?.trim();
+    if (!pointer) return undefined;
+    const adminDir = realpathSync(resolve(dirname(dotGit), pointer));
+    const backLink = readFileSync(join(adminDir, "gitdir"), "utf8").trim();
+    if (realpathSync(resolve(adminDir, backLink)) !== realpathSync(dotGit)) return undefined;
+    const commonDir = dirname(dirname(adminDir));
+    const bare = /^\s*bare\s*=\s*(true|yes|on|1)\s*$/im.test(readFileSync(join(commonDir, "config"), "utf8"));
+    return basename(commonDir) === ".git" && !bare ? dirname(commonDir) : `git-dir:${commonDir}`;
+  } catch {
+    return undefined;
+  }
+}
+
 function approvalPath(): string {
   return getAgentPath(APPROVALS_FILE);
 }
@@ -119,7 +158,7 @@ function saveApproval(record: ApprovalRecord): void {
 
 export function approveProjectServer(cwd: string, serverName: string, definition: ServerDefinition): void {
   saveApproval({
-    projectRoot: canonicalProjectRoot(cwd),
+    projectRoot: projectApprovalScope(cwd),
     serverName,
     definitionHash: hashProjectServerDefinition(definition),
     approvedAt: new Date().toISOString(),
@@ -149,12 +188,12 @@ export async function applyProjectServerTrust(
   } catch {
     projectTrusted = false;
   }
-  const projectRoot = canonicalProjectRoot(ctx.cwd);
+  const projectRoot = projectApprovalScope(ctx.cwd);
   const approvals = loadApprovals();
 
   for (const [name, source] of loaded.projectServers) {
     const definition = config.mcpServers[name];
-    if (!definition) continue;
+    if (!definition || isServerDisabled(definition)) continue;
     const definitionHash = hashProjectServerDefinition(definition);
     const approved = approvals.approvals.some(entry =>
       entry.projectRoot === projectRoot && entry.serverName === name && entry.definitionHash === definitionHash);
@@ -167,9 +206,9 @@ export async function applyProjectServerTrust(
       reason = "approval-required";
     } else if (await ctx.ui.confirm(
       `Allow project MCP server “${name}”?`,
-      `Source: ${source.path}\nEndpoint: ${describeServer(definition)}\n\nThis server can run local commands or make network requests with your user permissions.`,
+      `Project config: ${source.path}\nEndpoint: ${describeServer(definition)}\n\nThis server can run local commands or make network requests with your user permissions.`,
     )) {
-      approveProjectServer(projectRoot, name, definition);
+      approveProjectServer(ctx.cwd, name, definition);
       continue;
     } else {
       reason = "denied";

package/proxy-modes.ts

@@ -19,7 +19,7 @@ import { SessionRecoveryAuthRequiredError, withSessionRecovery } from "./session
 import { callToolViaTaskSession } from "./mcp-tasks.ts";
 import { paginate, rankSuggestions, rankToolMatches, resolveSearchKeywords } from "./search-ranking.ts";
 import { ensureToolCallApproved, isToolCallApprovalRequired } from "./tool-approval.ts";
-import { isServerInActiveFailureBackoff } from "./failure-backoff.ts";
+import { describeFailure, isServerInActiveFailureBackoff } from "./failure-backoff.ts";
 import { semanticSearch, type SemanticSearchBackend, type SemanticSearchEvaluator } from "./semantic-search.ts";
 import { getInputRequiredNeedsUiDetails } from "./errors.ts";
 import { createJsonSchemaValidator } from "./json-schema-validator.ts";
@@ -114,8 +114,7 @@ function getEnabledOriginalToolMatches(state: McpExtensionState, toolName: strin
 }
 
 function serverBackoffResult(state: McpExtensionState, mode: string, serverName: string): ProxyToolResult {
-  const failedAgo = getFailureAgeSeconds(state, serverName) ?? 0;
-  const message = `Server "${serverName}" not available (last failed ${failedAgo}s ago)`;
+  const message = `Server "${serverName}" not available (last ${describeFailure(state, serverName) ?? "failed 0s ago"})`;
   return {
     content: [{ type: "text" as const, text: message }],
     details: { mode, error: "server_backoff", server: serverName },
@@ -583,7 +582,7 @@ export function executeStatus(state: McpExtensionState): ProxyToolResult {
       continue;
     }
     if (server.status === "failed") {
-      text += `✗ ${server.name} (failed ${server.failedAgo ?? 0}s ago)\n`;
+      text += `✗ ${server.name} (${describeFailure(state, server.name) ?? `failed ${server.failedAgo ?? 0}s ago`})\n`;
       continue;
     }
     text += `○ ${server.name} (not listening; disconnected)\n`;
@@ -1286,10 +1285,10 @@ export async function executeCall(
       }
 
       if (!toolMeta) {
-        const failedAgo = getFailureAgeSeconds(state, serverName);
-        if (failedAgo !== null) {
+        const failure = describeFailure(state, serverName);
+        if (failure !== null) {
           return {
-            content: [{ type: "text" as const, text: `Server "${serverName}" not available (last failed ${failedAgo}s ago)` }],
+            content: [{ type: "text" as const, text: `Server "${serverName}" not available (last ${failure})` }],
             details: { mode: "call", error: "server_backoff", server: serverName, requestedTool: toolName },
           };
         }
@@ -1409,10 +1408,10 @@ export async function executeCall(
     }
   }
   if (!connection || connection.status !== "connected") {
-    const failedAgo = getFailureAgeSeconds(state, serverName);
-    if (failedAgo !== null) {
+    const failure = describeFailure(state, serverName);
+    if (failure !== null) {
       return {
-        content: [{ type: "text" as const, text: `Server "${serverName}" not available (last failed ${failedAgo}s ago)` }],
+        content: [{ type: "text" as const, text: `Server "${serverName}" not available (last ${failure})` }],
         details: { mode: "call", error: "server_backoff", ...callIdentity },
       };
     }

package/search-ranking.ts

@@ -107,7 +107,7 @@ export function tokenize(value: string): string[] {
       previous = character;
     }
   }
-  return tokens;
+  return [...new Set(tokens)];
 }
 
 function matchesAsciiStem(fieldToken: string, queryToken: string): boolean {

package/semantic-search.ts

@@ -40,7 +40,7 @@ function stableHash(value: string): string {
   return createHash("sha256").update(value).digest("hex");
 }
 
-function eligibleMatches(state: McpExtensionState, server: string | undefined, allowed: Set<string>): RankedToolMatch[] {
+function eligibleMatches(state: McpExtensionState, server: string | undefined, allowed: ReadonlySet<string>): RankedToolMatch[] {
   const matches: RankedToolMatch[] = [];
   for (const [serverName, metadata] of state.toolMetadata) {
     if ((server && serverName !== server) || !allowed.has(serverName)
@@ -83,10 +83,10 @@ function selectSemanticCandidates(
   state: McpExtensionState,
   query: string,
   server: string | undefined,
-  allowedServers: string[],
+  allowedServers: ReadonlySet<string>,
   limit: number,
 ): Candidate[] {
-  const eligible = eligibleMatches(state, server, new Set(allowedServers));
+  const eligible = eligibleMatches(state, server, allowedServers);
   let selected = eligible;
   if (eligible.length > limit) {
     const eligiblePaths = new Set(eligible.map(match => `${match.server}\0${match.tool.name}`));
@@ -131,7 +131,8 @@ export async function semanticSearch(
   if (query.trim().length === 0) {
     return { ok: false, error: { code: "empty_query", message: "Semantic search query cannot be empty." } };
   }
-  const candidates = selectSemanticCandidates(state, query, server, settings.allowedServers, settings.semanticCandidateLimit);
+  const allowedServers = new Set(settings.allowedServers);
+  const candidates = selectSemanticCandidates(state, query, server, allowedServers, settings.semanticCandidateLimit);
   if (candidates.length === 0) {
     return { ok: false, error: { code: "no_eligible_tools", message: "Semantic search has no eligible cached tools from the allowed servers. Connect an allowed server or update settings.jev.allowedServers." } };
   }
@@ -158,7 +159,7 @@ export async function semanticSearch(
     if (envelope.error.code === "timeout" || envelope.error.code === "rate_limited" || envelope.error.code === "service_unavailable") {
       return {
         ok: true,
-        matches: rankToolMatches(state, query, server),
+        matches: rankToolMatches(state, query, server).filter(match => allowedServers.has(match.server)),
         backend: { requested: "semantic", used: "lexical", degraded: true, reason: envelope.error.code },
       };
     }

package/state.ts

@@ -3,7 +3,7 @@ import type { ConsentManager } from "./consent-manager.ts";
 import type { McpLifecycleManager } from "./lifecycle.ts";
 import type { McpServerManager } from "./server-manager.ts";
 import type { AuthStorageOptions } from "./mcp-auth.ts";
-import type { ServerDefinition, ToolMetadata, PromptMetadata, McpConfig, UiSessionMessages, UiStreamSummary, McpStatusEventBus, UiServerHandle, ProjectServerBlock } from "./types.ts";
+import type { ServerDefinition, ToolMetadata, PromptMetadata, ServerCacheEntry, McpConfig, UiSessionMessages, UiStreamSummary, McpStatusEventBus, UiServerHandle, ProjectServerBlock } from "./types.ts";
 import type { UiResourceHandler } from "./ui-resource-handler.ts";
 import type { McpRuntimeOwner } from "./runtime-owner.ts";
 import type { McpOAuthRuntime } from "./mcp-auth-flow.ts";
@@ -33,6 +33,7 @@ export interface McpExtensionState {
   manager: McpServerManager;
   lifecycle: McpLifecycleManager;
   toolMetadata: Map<string, ToolMetadata[]>;
+  sessionMetadata?: Map<string, ServerCacheEntry>;
   /** Number of tools currently registered directly with Pi, by server. */
   directToolCounts: Map<string, number>;
   /** Resource counts retained separately because tool metadata includes resource tools. */

package/tool-approval.ts

@@ -1,4 +1,5 @@
 import { randomUUID } from "node:crypto";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { abortable } from "./abort.ts";
 import { combineAbortSignals } from "./runtime-owner.ts";
 import type { McpExtensionState } from "./state.ts";
@@ -88,15 +89,19 @@ function isMcpToolApprovalDecision(value: unknown): value is McpToolApprovalDeci
     || value === "abstain";
 }
 
-async function requestBrokerApproval(
-  state: McpExtensionState,
+/**
+ * Returns "abstain" when no handler claims the request. A handler that throws
+ * or returns an unknown value counts as "deny". Rethrows only when `signal` aborted.
+ */
+export async function requestBrokerApproval(
+  events: ExtensionAPI["events"] | undefined,
   serverName: string,
-  toolMeta: ToolMetadata,
+  toolMeta: Pick<ToolMetadata, "name" | "originalName">,
   args: Record<string, unknown> | undefined,
   origin: McpToolApprovalOrigin,
   signal?: AbortSignal,
 ): Promise<McpToolApprovalDecision> {
-  if (!state.approvalEvents) return "abstain";
+  if (!events) return "abstain";
 
   let acceptingClaim = true;
   let handler: McpToolApprovalHandler | undefined;
@@ -115,7 +120,7 @@ async function requestBrokerApproval(
     },
   };
 
-  state.approvalEvents.emit(MCP_TOOL_APPROVAL_REQUEST_EVENT, request);
+  events.emit(MCP_TOOL_APPROVAL_REQUEST_EVENT, request);
   acceptingClaim = false;
   if (!handler) return "abstain";
 
@@ -140,7 +145,7 @@ export async function ensureToolCallApproved(
   const ownedSignal = combineAbortSignals(state.owner?.signal, signal);
   const approvedServers = state.approvedServers ??= new Map();
   const serverIdentity = getServerApprovalIdentity(state, serverName);
-  const brokerDecision = await requestBrokerApproval(state, serverName, toolMeta, args, origin, signal);
+  const brokerDecision = await requestBrokerApproval(state.approvalEvents, serverName, toolMeta, args, origin, signal);
   if (brokerDecision === "allow_once") return { ok: true };
   if (brokerDecision === "allow_for_session") {
     rememberToolApproval(state, serverName, toolMeta, args);