pi-mcp-client 0.8.0 → 0.9.0

package/dist/index.js

@@ -1,4 +1,5 @@
 // src/index.ts
+import { existsSync } from "node:fs";
 import { join as join4 } from "node:path";
 import {
   BorderedLoader as BorderedLoader2,
@@ -1769,9 +1770,9 @@ var defaultOptions = {
   fields: void 0,
   searchOptions: void 0,
   storeFields: [],
-  logger: (level, message) => {
+  logger: (level, message2) => {
     if (typeof (console === null || console === void 0 ? void 0 : console[level]) === "function")
-      console[level](message);
+      console[level](message2);
   },
   autoVacuum: true
 };
@@ -1877,6 +1878,9 @@ var messages = {
   subscriptions_unsupported: "The server did not accept resource subscriptions.",
   subscription_limit: "The connection has reached its limit of 50 resource subscriptions.",
   catalog_changed: "The catalog kept changing during discovery.",
+  elicitation_required: "The server requires a browser step before this tool can run.",
+  elicitation_declined: "The browser step required by the server was declined or dismissed.",
+  elicitation_completed: "The browser step required by the server is complete.",
   oauth_failed: "OAuth authentication did not complete.",
   oauth_client_required: "OAuth requires a registered client: this server does not support dynamic client registration.",
   oauth_registration_rejected: "The authorization server rejected OAuth client registration.",
@@ -1920,6 +1924,9 @@ function diagnostic(code, context) {
     subscriptions_unsupported: "Choose a server with resource subscription support, or read the resource explicitly when needed.",
     subscription_limit: "Unsubscribe from another resource before adding a new watch.",
     catalog_changed: "Retry discovery once the server catalog has settled.",
+    elicitation_required: "The tool didn't run. Use an interactive Pi session, where the user can review and open the server's page, then retry.",
+    elicitation_declined: "The tool didn't run. Retry only if the user asks.",
+    elicitation_completed: "The tool didn't run yet. Call it again to continue.",
     oauth_failed: `Check the service's OAuth requirements and /mcp get ${target} for the client type, requested scopes, and callback address. Only public clients with PKCE are supported; clients requiring a client secret are not. Retry /mcp login ${target} after correcting the setup.`,
     oauth_client_required: `Configure oauthClientId with a registered public/PKCE client ID in this server's definition. Register the exact callback URL shown by /mcp get ${target}, then run /mcp reload and /mcp login ${target}. Clients requiring a client secret are not supported. --no-browser does not fix client registration.`,
     oauth_registration_rejected: `Check whether the service allows public/native client registration and the callback URL shown by /mcp get ${target}. If registration is restricted, configure an approved public client with oauthClientId, run /mcp reload, then retry /mcp login ${target}.`,
@@ -2032,6 +2039,8 @@ function diagnose(error, context) {
       const code2 = sdkOAuthFallback(current);
       if (code2) return diagnostic(code2, context);
     }
+    if (current instanceof ProtocolError && current.code === ProtocolErrorCode.UrlElicitationRequired)
+      return diagnostic("elicitation_required", context);
     if (current instanceof ProtocolError) return diagnostic(
       context.operation === "read" && (current instanceof ResourceNotFoundError || current.code === ProtocolErrorCode.ResourceNotFound) ? "resource_not_found" : "protocol_error",
       context
@@ -2329,7 +2338,7 @@ async function inspectConfigScopes(agentDir, cwd, trusted) {
 async function updateServerConfig(agentDir, cwd, trusted, mutation, validate) {
   const scoped = mutation.action !== "toggle";
   if (scoped && mutation.scope === "project" && !trusted)
-    throw new ConfigMutationError("Project configuration requires a trusted project. Use global scope or trust the project first.");
+    throw new ConfigMutationError("Project configuration requires a trusted project. Use global scope, or run /trust to trust this folder first.");
   const paths = [join(agentDir, "mcp.json"), ...trusted ? [join(cwd, ".mcp.json")] : []];
   const targets = await Promise.all(paths.map(configTarget));
   if (scoped && targets.length === 2 && targets[0] === targets[1])
@@ -2683,9 +2692,9 @@ function configCommandCompletions(input, servers) {
   const match = /^(add|remove|import)\s+(.*)$/su.exec(input.trimStart());
   if (!match) return void 0;
   const [, action, rest] = match;
-  const choices = ["--scope global", "--scope project"];
+  const choices2 = ["--scope global", "--scope project"];
   if (!/^--scope\s+(global|project)\s/u.test(rest)) {
-    return choices.filter((choice) => choice.startsWith(rest)).map((choice) => ({
+    return choices2.filter((choice) => choice.startsWith(rest)).map((choice) => ({
       value: `${action} ${choice}`,
       label: choice
     }));
@@ -2705,13 +2714,13 @@ function identifier(value) {
   return typeof value === "string" && !!value && value.length <= 512 && line(value) === value;
 }
 function preparePrompt(server, identity, value) {
-  const invalid2 = () => failure("protocol_error", { server, operation: "search" });
-  if (!object(value) || !identifier(value.name) || value.description !== void 0 && typeof value.description !== "string" || value.title !== void 0 && typeof value.title !== "string" || value.arguments !== void 0 && !Array.isArray(value.arguments)) throw invalid2();
+  const invalid3 = () => failure("protocol_error", { server, operation: "search" });
+  if (!object(value) || !identifier(value.name) || value.description !== void 0 && typeof value.description !== "string" || value.title !== void 0 && typeof value.title !== "string" || value.arguments !== void 0 && !Array.isArray(value.arguments)) throw invalid3();
   const args = value.arguments ?? [];
-  if (args.length > 100) throw invalid2();
+  if (args.length > 100) throw invalid3();
   const seen = /* @__PURE__ */ new Set();
   const arguments_ = args.map((argument) => {
-    if (!object(argument) || !identifier(argument.name) || seen.has(argument.name) || argument.description !== void 0 && typeof argument.description !== "string" || argument.required !== void 0 && typeof argument.required !== "boolean") throw invalid2();
+    if (!object(argument) || !identifier(argument.name) || seen.has(argument.name) || argument.description !== void 0 && typeof argument.description !== "string" || argument.required !== void 0 && typeof argument.required !== "boolean") throw invalid3();
     seen.add(argument.name);
     return { name: argument.name, description: plain(argument.description ?? "").slice(0, 8e3), required: argument.required === true };
   });
@@ -2733,14 +2742,14 @@ function promptCommand(prompt) {
 }
 var promptText = (value) => plain(value).replace(/\r\n?/g, "\n");
 function preparePromptSnapshot(result, server) {
-  const invalid2 = () => failure("protocol_error", { server, operation: "prompt" });
-  if (!object(result) || !Array.isArray(result.messages) || !result.messages.length) throw invalid2();
+  const invalid3 = () => failure("protocol_error", { server, operation: "prompt" });
+  if (!object(result) || !Array.isArray(result.messages) || !result.messages.length) throw invalid3();
   if (Buffer.byteLength(JSON.stringify(result)) > 50 * 1024) throw failure("prompt_too_large", { server, operation: "prompt" });
   let usable = true;
   const previews = [];
-  const messages2 = result.messages.map((message, index) => {
-    if (!["user", "assistant"].includes(message.role) || !object(message.content)) throw invalid2();
-    const content = message.content;
+  const messages2 = result.messages.map((message2, index) => {
+    if (!["user", "assistant"].includes(message2.role) || !object(message2.content)) throw invalid3();
+    const content = message2.content;
     let block;
     let preview2;
     if (content.type === "text" && typeof content.text === "string") {
@@ -2760,9 +2769,9 @@ ${promptText(content.resource.text)}`;
       block = { type: line(String(content.type)), unsupported: true, bytes: Buffer.byteLength(JSON.stringify(content)) };
       preview2 = `Unsupported ${line(String(content.type))} content \xB7 ${Buffer.byteLength(JSON.stringify(content))} bytes`;
     }
-    previews.push(`Message ${index + 1} \xB7 ${message.role} (server supplied)
+    previews.push(`Message ${index + 1} \xB7 ${message2.role} (server supplied)
 ${preview2}`);
-    return { role: message.role, content: block };
+    return { role: message2.role, content: block };
   });
   const description = typeof result.description === "string" ? promptText(result.description) : void 0;
   const body = JSON.stringify({ server, ...description === void 0 ? {} : { description }, messages: messages2 }, null, 2);
@@ -2774,9 +2783,26 @@ ${preview2}`);
 
 // src/prompt-selector.ts
 import { SelectList, Text } from "@earendil-works/pi-tui";
-function promptSelector(title, choices, theme, keys, done, render) {
+async function chooseOption(ctx, title, choices2, signal) {
+  if (signal.aborted) return;
+  if (ctx.mode !== "tui") return ctx.ui.select(title, choices2, { signal });
+  return ctx.ui.custom((tui, theme, keys, done) => {
+    let settled = false;
+    const finish = (choice) => {
+      if (settled) return;
+      settled = true;
+      signal.removeEventListener("abort", abort);
+      done(choice);
+    };
+    const abort = () => finish(void 0);
+    signal.addEventListener("abort", abort, { once: true });
+    const selector = promptSelector(title, choices2, theme, keys, finish, () => tui.requestRender());
+    return { ...selector, dispose: () => signal.removeEventListener("abort", abort) };
+  });
+}
+function promptSelector(title, choices2, theme, keys, done, render) {
   const [heading, ...body] = title.split("\n");
-  const list = new SelectList(choices.map((value) => ({ value, label: value })), 8, {
+  const list = new SelectList(choices2.map((value) => ({ value, label: value })), 8, {
     selectedPrefix: (text) => theme.fg("accent", text),
     selectedText: (text) => theme.fg("accent", text),
     description: (text) => theme.fg("muted", text),
@@ -2798,11 +2824,11 @@ function promptSelector(title, choices, theme, keys, done, render) {
       ];
     },
     handleInput(data) {
-      const index = choices.indexOf(list.getSelectedItem()?.value ?? "");
+      const index = choices2.indexOf(list.getSelectedItem()?.value ?? "");
       if (keys.matches(data, "tui.select.cancel")) done(void 0);
       else if (keys.matches(data, "tui.select.confirm")) done(list.getSelectedItem()?.value);
       else if (keys.matches(data, "tui.select.up") || data === "k") list.setSelectedIndex(Math.max(0, index - 1));
-      else if (keys.matches(data, "tui.select.down") || data === "j") list.setSelectedIndex(Math.min(choices.length - 1, index + 1));
+      else if (keys.matches(data, "tui.select.down") || data === "j") list.setSelectedIndex(Math.min(choices2.length - 1, index + 1));
       render();
     },
     invalidate() {
@@ -2834,21 +2860,9 @@ async function runPromptCommand(input, ctx, runtime, signal, assertCurrent, use)
     signal.throwIfAborted();
     assertCurrent();
   };
-  const select = async (title, choices) => {
+  const select = async (title, choices2) => {
     guard();
-    const selected = ctx.mode !== "tui" ? await ctx.ui.select(title, choices, { signal }) : await ctx.ui.custom((tui, theme, keys, done) => {
-      let settled = false;
-      const finish = (choice) => {
-        if (settled) return;
-        settled = true;
-        signal.removeEventListener("abort", abort);
-        done(choice);
-      };
-      const abort = () => finish(void 0);
-      signal.addEventListener("abort", abort, { once: true });
-      const selector = promptSelector(title, choices, theme, keys, finish, () => tui.requestRender());
-      return { ...selector, dispose: () => signal.removeEventListener("abort", abort) };
-    });
+    const selected = await chooseOption(ctx, title, choices2, signal);
     guard();
     return selected;
   };
@@ -3178,10 +3192,10 @@ var TomlError = class extends Error {
   line;
   column;
   codeblock;
-  constructor(message, options) {
+  constructor(message2, options) {
     const [line2, column] = getLineColFromPtr(options.toml, options.ptr);
     const codeblock = makeCodeBlock(options.toml, line2, column);
-    super(`Invalid TOML document: ${message}
+    super(`Invalid TOML document: ${message2}
 
 ${codeblock}`, options);
     this.line = line2;
@@ -3947,12 +3961,12 @@ function validateImportCandidate(candidate, cwd) {
   }
   return void 0;
 }
-function importPreview(candidate, problem) {
+function importPreview(candidate, problem2) {
   const definition = candidate.definition;
   return [
     `${candidate.label} \xB7 ${candidate.transport}`,
     ...candidate.group ? [`Source: ${candidate.group}`] : [],
-    ...problem ? [problem] : [],
+    ...problem2 ? [problem2] : [],
     ...definition ? [
       "Connection values are hidden; review and trust the source file before importing.",
       `Arguments: ${definition.args?.length ?? 0}; environment: ${Object.keys(definition.env ?? {}).length}; headers: ${Object.keys(definition.headers ?? {}).length} (values hidden)`,
@@ -3973,23 +3987,23 @@ function importAction(name, scope, scopes) {
   if (scope === "project" && Object.hasOwn(scopes.global, name)) return "Override global definition";
   return `Add ${scope} definition`;
 }
-async function runImportCommand(input, ctx, agentDir, signal, assertCurrent, save) {
+async function runImportCommand(input, ctx, agentDir, projectTrusted, signal, assertCurrent, save) {
   if (!ctx.hasUI) throw new ConfigMutationError("Configuration imports require an interactive session (TUI or RPC).");
   const { scope, path } = parseImportCommand(input);
-  const trusted = ctx.isProjectTrusted();
+  const trusted = projectTrusted();
   if (scope === "project" && !trusted)
-    throw new ConfigMutationError("Project configuration requires a trusted project. Use global scope or trust the project first.");
+    throw new ConfigMutationError("Project configuration requires a trusted project. Use global scope, or run /trust to trust this folder first.");
   const guard = () => {
     signal.throwIfAborted();
     assertCurrent();
-    if (ctx.isProjectTrusted() !== trusted)
+    if (projectTrusted() !== trusted)
       throw new ConfigMutationError("Project trust changed during the preview. Run /mcp import again; nothing was saved.");
   };
-  const select = async (title, choices) => {
+  const select = async (title, choices2) => {
     guard();
-    const result = await ctx.ui.select(title, choices, { signal });
+    const result = await ctx.ui.select(title, choices2, { signal });
     guard();
-    return result !== void 0 && choices.includes(result) ? result : void 0;
+    return result !== void 0 && choices2.includes(result) ? result : void 0;
   };
   guard();
   const source = await readImportSource(path, ctx.cwd, signal);
@@ -4029,22 +4043,22 @@ Only MCP server definitions are imported. Other settings, permissions, and crede
     if (group !== "All groups") candidates = candidates.filter((candidate) => candidate.group === group);
   }
   for (const [index, candidate] of candidates.entries()) {
-    const problem = validateImportCandidate(candidate, ctx.cwd);
+    const problem2 = validateImportCandidate(candidate, ctx.cwd);
     let name = candidate.name;
     while (true) {
       const duplicate = name !== void 0 && Object.hasOwn(selected, name);
-      const action = name && !duplicate && !problem ? importAction(name, scope, scopes) : void 0;
+      const action = name && !duplicate && !problem2 ? importAction(name, scope, scopes) : void 0;
       const conflict = name ? [
         Object.hasOwn(scopes.global, name) ? "global" : void 0,
         Object.hasOwn(scopes.project, name) ? "project" : void 0
       ].filter(Boolean).join(" and ") : "";
       const choice = await select([
         `Import preview ${index + 1}/${candidates.length} \xB7 ${scope} scope \xB7 ${source.format === "codex" ? "Codex TOML" : "JSON"}`,
-        importPreview(candidate, problem),
+        importPreview(candidate, problem2),
         ...name ? [`Destination name: ${name}`] : [],
         ...conflict ? [`Existing definition in ${conflict} scope; fields and credentials are never merged.`] : [],
         ...duplicate ? ["This destination name is already selected; choose a different name."] : []
-      ].join("\n"), ["Skip", ...action ? [action] : [], ...!problem ? ["Choose a different name"] : [], "Cancel import"]);
+      ].join("\n"), ["Skip", ...action ? [action] : [], ...!problem2 ? ["Choose a different name"] : [], "Cancel import"]);
       if (choice === void 0 || choice === "Cancel import") {
         cancel();
         return;
@@ -4114,7 +4128,7 @@ import {
 // src/oauth-page.ts
 function oauthCallbackHtml(status) {
   const heading = status === "received" ? "Authorization response received" : status === "denied" ? "Authorization not granted" : "Invalid OAuth callback";
-  const message = status === "received" ? "Return to Pi to finish signing in. You can close this tab." : "Return to Pi and try signing in again. You can close this tab.";
+  const message2 = status === "received" ? "Return to Pi to finish signing in. You can close this tab." : "Return to Pi and try signing in again. You can close this tab.";
   return `<!doctype html>
 <html lang="en">
 <head>
@@ -4177,7 +4191,7 @@ function oauthCallbackHtml(status) {
     <div class="logo"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 800 800" aria-hidden="true"><path fill="#fff" fill-rule="evenodd" d="M165.29 165.29 H517.36 V400 H400 V517.36 H282.65 V634.72 H165.29 Z M282.65 282.65 V400 H400 V282.65 Z"/><path fill="#fff" d="M517.36 400 H634.72 V634.72 H517.36 Z"/></svg></div>
     <p class="brand">Pi MCP Client</p>
     <h1>${heading}</h1>
-    <p>${message}</p>
+    <p>${message2}</p>
   </main>
 </body>
 </html>`;
@@ -4188,17 +4202,17 @@ function callbackUrl(options = {}) {
   return `http://127.0.0.1:${options.oauthCallbackPort ?? 19847}/callback`;
 }
 function parseCallback(value, redirect, state) {
-  const invalid2 = () => failure("oauth_failed", { operation: "auth" });
-  if (value.length > 16384 || /[\u0000-\u0020\u007f]/u.test(value)) throw invalid2();
+  const invalid3 = () => failure("oauth_failed", { operation: "auth" });
+  if (value.length > 16384 || /[\u0000-\u0020\u007f]/u.test(value)) throw invalid3();
   let target;
   try {
     target = new URL(value);
   } catch {
-    throw invalid2();
+    throw invalid3();
   }
   const expected = new URL(redirect);
   const params = target.searchParams;
-  if (target.origin !== expected.origin || target.pathname !== expected.pathname || target.username || target.password || target.hash || [...params.keys()].some((key) => params.getAll(key).length !== 1) || params.get("state") !== state || params.has("code") === params.has("error") || !(params.get("code") || params.get("error"))) throw invalid2();
+  if (target.origin !== expected.origin || target.pathname !== expected.pathname || target.username || target.password || target.hash || [...params.keys()].some((key) => params.getAll(key).length !== 1) || params.get("state") !== state || params.has("code") === params.has("error") || !(params.get("code") || params.get("error"))) throw invalid3();
   return params;
 }
 function credentialKey({ server, url, clientId }) {
@@ -4705,9 +4719,82 @@ import { join as join2 } from "node:path";
 import { randomUUID as randomUUID3 } from "node:crypto";
 import {
   Client,
+  ProtocolError as ProtocolError3,
+  ProtocolErrorCode as ProtocolErrorCode3,
+  SdkError as SdkError2,
+  SdkErrorCode,
   StreamableHTTPClientTransport,
   UriTemplate as UriTemplate2
 } from "@modelcontextprotocol/client";
+
+// package.json
+var package_default = {
+  name: "pi-mcp-client",
+  version: "0.9.0",
+  description: "MCP tools for Pi, discovered on demand and called natively through the official SDK.",
+  type: "module",
+  license: "MIT",
+  author: "Matthias Vallentin",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/mavam/pi-mcp-client.git"
+  },
+  keywords: [
+    "pi-package",
+    "pi-extension",
+    "mcp",
+    "model-context-protocol"
+  ],
+  engines: {
+    node: ">=22"
+  },
+  files: [
+    "dist",
+    "docs",
+    "README.md",
+    "LICENSE"
+  ],
+  pi: {
+    extensions: [
+      "./dist/index.js"
+    ]
+  },
+  publishConfig: {
+    access: "public"
+  },
+  scripts: {
+    build: "rm -rf dist && esbuild src/index.ts --bundle --format=esm --platform=node --outfile=dist/index.js --external:@earendil-works/pi-coding-agent --external:@earendil-works/pi-ai --external:@earendil-works/pi-tui --external:typebox --external:@modelcontextprotocol/client --external:@modelcontextprotocol/client/* --external:@napi-rs/keyring",
+    check: "tsc --noEmit && bun test",
+    test: "bun test",
+    prepack: "bun run build"
+  },
+  dependencies: {
+    "@modelcontextprotocol/client": "2.0.0",
+    "@napi-rs/keyring": "^1.3.0",
+    minisearch: "^7.2.0",
+    "smol-toml": "^1.8.0"
+  },
+  devDependencies: {
+    "@earendil-works/pi-ai": "^0.85.1",
+    "@earendil-works/pi-coding-agent": "^0.85.1",
+    "@earendil-works/pi-tui": "^0.85.1",
+    "@modelcontextprotocol/server": "2.0.0",
+    "@types/bun": "^1.3.0",
+    "@types/node": "^24.0.0",
+    esbuild: "^0.25.0",
+    typebox: "^1.1.0",
+    typescript: "^5.9.0",
+    zod: "^4.0.0"
+  },
+  peerDependencies: {
+    "@earendil-works/pi-ai": ">=0.85.1",
+    "@earendil-works/pi-coding-agent": ">=0.85.1",
+    "@earendil-works/pi-tui": ">=0.85.1",
+    typebox: "^1.1.0"
+  }
+};
+
+// src/runtime.ts
 import {
   StdioClientTransport,
   getDefaultEnvironment
@@ -4804,9 +4891,335 @@ var ResourceSubscriptions = class {
   }
 };
 
+// src/elicitation.ts
+import {
+  ProtocolError as ProtocolError2,
+  ProtocolErrorCode as ProtocolErrorCode2
+} from "@modelcontextprotocol/client";
+var MAX_FIELDS = 50;
+var MAX_CHOICES = 100;
+var MAX_TEXT = 8192;
+var MAX_CONTENT = 64 * 1024;
+var MAX_REQUIRED = 3;
+var invalid2 = (message2) => new ProtocolError2(ProtocolErrorCode2.InvalidParams, message2);
+var short = (value, limit) => typeof value === "string" ? line(value).slice(0, limit) : "";
+var number = (value) => typeof value === "number" && Number.isFinite(value) ? value : void 0;
+function message(value) {
+  const text = plain(value).split("\n").map((row) => row.trimEnd()).slice(0, 20).join("\n").trim();
+  return text.slice(0, 2e3) || "(No message supplied.)";
+}
+function choices(values) {
+  if (!values.length || values.length > MAX_CHOICES || new Set(values.map((choice) => choice.value)).size !== values.length)
+    throw invalid2("Elicitation choices are empty, duplicated, or too many.");
+  return values.map(({ value, label: label2 }) => ({ value, label: short(label2, 120) || short(value, 120) || JSON.stringify(value) }));
+}
+function formFields(schema) {
+  const entries = Object.entries(schema.properties ?? {});
+  if (entries.length > MAX_FIELDS) throw invalid2("Elicitation forms are limited to 50 fields.");
+  const required = new Set(Array.isArray(schema.required) ? schema.required : []);
+  return entries.map(([name, value]) => {
+    const property = value;
+    const base = {
+      name,
+      label: short(property.title, 120) || short(name, 120) || "(unnamed)",
+      description: short(property.description, 400),
+      required: required.has(name)
+    };
+    if (property.type === "boolean")
+      return { ...base, type: "boolean", default: typeof property.default === "boolean" ? property.default : void 0 };
+    if (property.type === "number" || property.type === "integer")
+      return { ...base, type: property.type, minimum: number(property.minimum), maximum: number(property.maximum), default: number(property.default) };
+    if (property.type === "array") {
+      const items = property.items ?? {};
+      const options = Array.isArray(items.enum) ? items.enum.map((value2) => ({ value: value2, label: value2 })) : (items.anyOf ?? []).map((option) => ({ value: option.const, label: option.title }));
+      return {
+        ...base,
+        type: "multi",
+        options: choices(options),
+        minItems: number(property.minItems),
+        maxItems: number(property.maxItems),
+        default: Array.isArray(property.default) ? property.default : void 0
+      };
+    }
+    if (Array.isArray(property.enum) || Array.isArray(property.oneOf)) {
+      const options = Array.isArray(property.enum) ? property.enum.map((value2, index) => ({ value: value2, label: property.enumNames?.[index] ?? value2 })) : property.oneOf.map((option) => ({ value: option.const, label: option.title }));
+      return { ...base, type: "choice", options: choices(options), default: typeof property.default === "string" ? property.default : void 0 };
+    }
+    return {
+      ...base,
+      type: "string",
+      minLength: number(property.minLength),
+      maxLength: number(property.maxLength),
+      format: typeof property.format === "string" ? property.format : void 0,
+      default: typeof property.default === "string" ? property.default : void 0
+    };
+  });
+}
+var validDate = (value) => /^\d{4}-\d{2}-\d{2}$/.test(value) && !Number.isNaN(Date.parse(`${value}T00:00:00Z`)) && (/* @__PURE__ */ new Date(`${value}T00:00:00Z`)).toISOString().startsWith(value);
+var formats = {
+  email: { name: "email address", valid: (value) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/u.test(value) },
+  uri: { name: "absolute URI", valid: (value) => URL.canParse(value) },
+  date: {
+    name: "date (YYYY-MM-DD)",
+    valid: validDate
+  },
+  "date-time": {
+    name: "date and time (RFC 3339)",
+    valid: (value) => /^\d{4}-\d{2}-\d{2}T([01]\d|2[0-3]):[0-5]\d:[0-5]\d(\.\d+)?(Z|[+-]([01]\d|2[0-3]):[0-5]\d)$/i.test(value) && validDate(value.slice(0, 10)) && !Number.isNaN(Date.parse(value))
+  }
+};
+var textLimit = (field) => Math.min(field.maxLength ?? MAX_TEXT, MAX_TEXT);
+function problem(field, value) {
+  switch (field.type) {
+    case "string": {
+      if (typeof value !== "string") return "Enter text.";
+      const length = [...value].length;
+      if (length > textLimit(field)) return `Use at most ${textLimit(field)} characters.`;
+      if (field.minLength !== void 0 && length < field.minLength) return `Use at least ${field.minLength} characters.`;
+      const format = field.format ? formats[field.format] : void 0;
+      if (format && !format.valid(value)) return `Enter a valid ${format.name}.`;
+      return;
+    }
+    case "number":
+    case "integer":
+      if (typeof value !== "number" || !Number.isFinite(value)) return "Enter a number.";
+      if (field.type === "integer" && !Number.isInteger(value)) return "Enter a whole number.";
+      if (field.minimum !== void 0 && value < field.minimum) return `Enter at least ${field.minimum}.`;
+      if (field.maximum !== void 0 && value > field.maximum) return `Enter at most ${field.maximum}.`;
+      return;
+    case "boolean":
+      return typeof value === "boolean" ? void 0 : "Choose yes or no.";
+    case "choice":
+      return typeof value === "string" && field.options.some((option) => option.value === value) ? void 0 : "Choose one of the listed options.";
+    case "multi":
+      if (!Array.isArray(value) || new Set(value).size !== value.length || value.some((item) => !field.options.some((option) => option.value === item))) return "Choose from the listed options.";
+      if (field.minItems !== void 0 && value.length < field.minItems) return `Choose at least ${field.minItems}.`;
+      if (field.maxItems !== void 0 && value.length > field.maxItems) return `Choose at most ${field.maxItems}.`;
+  }
+}
+var range = (min, max, unit = "") => min !== void 0 && max !== void 0 ? `${min}\u2013${max}${unit}` : min !== void 0 ? `at least ${min}${unit}` : max !== void 0 ? `at most ${max}${unit}` : "";
+function constraints(field) {
+  const parts = [];
+  if (field.type === "string") {
+    parts.push(field.format && formats[field.format] ? formats[field.format].name : "text");
+    const length = range(field.minLength, field.maxLength, " characters");
+    if (length) parts.push(length);
+  } else if (field.type === "number" || field.type === "integer") {
+    parts.push(field.type === "integer" ? "whole number" : "number");
+    const bounds = range(field.minimum, field.maximum);
+    if (bounds) parts.push(bounds);
+  } else if (field.type === "boolean") parts.push("yes or no");
+  else if (field.type === "choice") parts.push("choose one");
+  else if (field.type === "multi") parts.push(`choose ${range(field.minItems, field.maxItems) || "any"}`);
+  parts.push(field.required ? "required" : "optional");
+  return parts.join(", ");
+}
+var label = (field, value) => field.type === "choice" || field.type === "multi" ? field.options.find((option) => option.value === value)?.label ?? value : value;
+function shown(field, value) {
+  if (value === void 0) return "not set";
+  if (typeof value === "boolean") return value ? "yes" : "no";
+  if (Array.isArray(value)) return value.map((item) => label(field, item)).join(", ") || "none";
+  if (typeof value === "number") return String(value);
+  if (field.type === "choice") return label(field, value);
+  const text = line(value);
+  return JSON.stringify(text.length > 60 ? `${text.slice(0, 59)}\u2026` : text);
+}
+async function edit(ui, field, values, signal) {
+  const current = values.get(field.name);
+  const title = `${field.label}
+${[constraints(field), field.description].filter(Boolean).join("\n")}`;
+  const clear = field.required ? [] : ["Clear value"];
+  if (field.type === "boolean" || field.type === "choice") {
+    const options = field.type === "boolean" ? [{ value: true, label: "Yes" }, { value: false, label: "No" }] : field.options.map((option) => ({ value: option.value, label: option.label }));
+    const labels = options.map((option, index) => `${option.value === current ? "\u25CF" : "\u25CB"} ${index + 1}. ${option.label}`);
+    const choice = await ui.select(title, [...labels, ...clear, "Back"], signal);
+    if (choice === "Clear value") values.delete(field.name);
+    else if (choice !== void 0 && labels.includes(choice)) values.set(field.name, options[labels.indexOf(choice)].value);
+    return;
+  }
+  if (field.type === "multi") {
+    const selected = new Set(Array.isArray(current) ? current : []);
+    while (!signal.aborted) {
+      const labels = field.options.map((option2, index) => `${selected.has(option2.value) ? "\u2611" : "\u2610"} ${index + 1}. ${option2.label}`);
+      const choice = await ui.select(`${title}
+Select options to toggle them, then choose Done.`, [...labels, "Done", ...clear, "Back"], signal);
+      if (choice === void 0 || choice === "Back") return;
+      if (choice === "Clear value") return void values.delete(field.name);
+      if (choice === "Done") {
+        const value2 = field.options.map((option2) => option2.value).filter((value3) => selected.has(value3));
+        const issue2 = problem(field, value2);
+        if (issue2) ui.notify(`${field.label}: ${issue2}`, "error");
+        else return void values.set(field.name, value2);
+        continue;
+      }
+      const option = field.options[labels.indexOf(choice)];
+      if (option && !selected.delete(option.value)) selected.add(option.value);
+    }
+    return;
+  }
+  const text = await ui.editor(`${title}${field.required ? "" : "\nLeave empty to clear the value."}`, current === void 0 ? "" : String(current));
+  if (text === void 0 || signal.aborted) return;
+  if (!text.trim() && !field.required && (field.type !== "string" || !text)) return void values.delete(field.name);
+  const value = field.type === "string" ? text : text.trim() ? Number(text.trim()) : Number.NaN;
+  const issue = problem(field, value);
+  if (issue) ui.notify(`${field.label}: ${issue} The previous value was kept.`, "error");
+  else values.set(field.name, value);
+}
+async function elicitForm(ui, server, params, signal) {
+  const fields = formFields(params.requestedSchema);
+  const values = /* @__PURE__ */ new Map();
+  for (const field of fields)
+    if (field.default !== void 0 && !problem(field, field.default)) values.set(field.name, field.default);
+  const title = `${server} requests information
+${message(params.message)}
+
+Review the values below. Only what you submit is sent to ${server}. Never enter passwords, API keys, or payment details here.`;
+  while (!signal.aborted) {
+    const labels = fields.map((field2, index) => `${index + 1}. ${field2.label} (${field2.required ? "required" : "optional"}) \xB7 ${shown(field2, values.get(field2.name))}`);
+    const choice = await ui.select(title, [...labels, "Submit", "Decline", "Cancel"], signal);
+    if (signal.aborted || choice === void 0 || choice === "Cancel") break;
+    if (choice === "Decline") return { action: "decline" };
+    if (choice === "Submit") {
+      const issue = fields.map((field2) => {
+        const value = values.get(field2.name);
+        if (value === void 0) return field2.required ? `${field2.label}: A value is required.` : void 0;
+        const found = problem(field2, value);
+        return found && `${field2.label}: ${found}`;
+      }).find(Boolean);
+      const content = Object.fromEntries(values);
+      if (issue) ui.notify(issue, "error");
+      else if (Buffer.byteLength(JSON.stringify(content)) > MAX_CONTENT) ui.notify("The submitted values exceed 64 KiB.", "error");
+      else return { action: "accept", content };
+      continue;
+    }
+    const field = fields[labels.indexOf(choice)];
+    if (field) await edit(ui, field, values, signal);
+  }
+  return { action: "cancel" };
+}
+function safeUrl(value) {
+  if (typeof value !== "string" || value.length > 4096 || !URL.canParse(value)) return;
+  const url = new URL(value);
+  const loopback = url.hostname === "localhost" || url.hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(url.hostname);
+  if (url.username || url.password || !(url.protocol === "https:" || url.protocol === "http:" && loopback)) return;
+  const notes = [];
+  if (url.hostname.split(".").some((part) => part.startsWith("xn--")))
+    notes.push("\u26A0 The site name contains internationalized characters. Check that it's the site you expect.");
+  if (url.protocol === "http:") notes.push("\u26A0 This page uses an unencrypted connection to this computer.");
+  return { href: url.href, host: url.host, notes };
+}
+async function elicitUrl(ui, server, params, signal) {
+  const target = safeUrl(params.url);
+  if (!target) {
+    ui.notify(`${server} asked to open an unsupported URL, so the request was refused. Only HTTPS pages, or HTTP pages on this computer, without embedded credentials can be opened.`, "warning");
+    throw invalid2("Unsupported elicitation URL.");
+  }
+  let failed = false;
+  while (!signal.aborted) {
+    const choice = await ui.select(
+      `${server} asks you to open a web page
+${message(params.message)}
+
+Site: ${target.host}
+URL: ${target.href}
+${target.notes.map((note) => `${note}
+`).join("")}` + (failed ? `Couldn't open a browser. Copy the URL, then choose "I'll open it myself".
+` : "") + "Anything you enter on the page goes to that site, not to Pi. Copy the URL before choosing to open it elsewhere.",
+      ["Open in browser", "I'll open it myself", "Decline"],
+      signal
+    );
+    if (signal.aborted || choice === void 0) break;
+    if (choice === "Decline") return { action: "decline" };
+    if (choice === "I'll open it myself") return { action: "accept" };
+    if (await ui.open(target.href)) return { action: "accept" };
+    failed = true;
+  }
+  return { action: "cancel" };
+}
+function elicit(ui, server, params, signal) {
+  const name = line(server);
+  return params.mode === "url" ? elicitUrl(ui, name, params, signal) : elicitForm(ui, name, params, signal);
+}
+async function awaitCompletion(ui, server, completed, signal) {
+  const name = line(server);
+  const choice = await ui.select(
+    `${name} \xB7 Finish in your browser
+Complete the step on the page you opened, then choose Done. This closes automatically if ${name} confirms completion. The tool runs again only if the assistant calls it.`,
+    ["Done", "Cancel"],
+    AbortSignal.any([completed, signal])
+  );
+  return completed.aborted || choice === "Done" && !signal.aborted;
+}
+function requiredElicitations(error) {
+  if (!(error instanceof ProtocolError2) || error.code !== ProtocolErrorCode2.UrlElicitationRequired) return;
+  const list = error.data?.elicitations;
+  if (!Array.isArray(list) || !list.length || list.length > MAX_REQUIRED) return;
+  const valid = list.every((item) => typeof item === "object" && item !== null && item.mode === "url" && typeof item.message === "string" && typeof item.url === "string" && typeof item.elicitationId === "string" && item.elicitationId.length > 0 && item.elicitationId.length <= 256);
+  if (!valid || new Set(list.map((item) => item.elicitationId)).size !== list.length) return;
+  return list.map(({ mode, message: message2, url, elicitationId }) => ({ mode, message: message2, url, elicitationId }));
+}
+
 // src/runtime.ts
 var ToolContractError = class extends Error {
 };
+var UNBOUNDED_TIMEOUT = 2147483647;
+var MAX_PENDING_ELICITATIONS = 4;
+var Deadline = class {
+  constructor(remaining) {
+    this.remaining = remaining;
+    this.start();
+  }
+  controller = new AbortController();
+  signal = this.controller.signal;
+  timer;
+  started = 0;
+  holds = 0;
+  done = false;
+  start() {
+    this.started = Date.now();
+    this.timer = setTimeout(
+      () => this.controller.abort(new SdkError2(SdkErrorCode.RequestTimeout, "Request timed out")),
+      Math.max(0, this.remaining)
+    );
+  }
+  pause() {
+    if (this.holds++ || !this.timer) return;
+    clearTimeout(this.timer);
+    this.timer = void 0;
+    this.remaining -= Date.now() - this.started;
+  }
+  resume() {
+    if (--this.holds || this.done || this.signal.aborted) return;
+    this.start();
+  }
+  dispose() {
+    this.done = true;
+    clearTimeout(this.timer);
+  }
+};
+function createClient(config, handlers = {}) {
+  const { elicit: elicit2, elicitationComplete } = handlers;
+  const client = new Client(
+    { name: "pi-mcp-client", version: package_default.version },
+    {
+      ...elicit2 ? { capabilities: { elicitation: { form: {}, url: {} } } } : {},
+      listChanged: {
+        tools: { autoRefresh: false, debounceMs: 0, onChanged: () => handlers.toolsChanged?.() },
+        prompts: { autoRefresh: false, debounceMs: 0, onChanged: () => handlers.promptsChanged?.() },
+        resources: { autoRefresh: false, debounceMs: 0, onChanged: () => handlers.resourcesChanged?.() }
+      },
+      versionNegotiation: {
+        mode: config.protocol ?? "auto",
+        probe: { timeoutMs: config.startupTimeoutMs ?? config.timeoutMs ?? 15e3 }
+      }
+    }
+  );
+  if (elicit2) {
+    client.setRequestHandler("elicitation/create", (request, ctx) => elicit2(request.params, ctx.mcpReq.signal));
+    client.setNotificationHandler("notifications/elicitation/complete", (notification) => elicitationComplete?.(notification.params.elicitationId));
+  }
+  return client;
+}
 function waitFor2(promise, signal) {
   if (!signal) return promise;
   return new Promise((resolve3, reject) => {
@@ -4825,36 +5238,11 @@ function waitFor2(promise, signal) {
     if (signal.aborted) abort();
   });
 }
-var createSdkConnector = (storeFactory = credentialStore) => async (name, config, signal, onToolsChanged, onResourcesChanged, onPromptsChanged) => {
+var createSdkConnector = (storeFactory = credentialStore) => async (name, config, signal, handlers) => {
   const timeout = config.timeoutMs ?? 15e3;
   const startupTimeout = config.startupTimeoutMs ?? timeout;
   let connecting = true;
-  const client = new Client(
-    { name: "pi-mcp-client", version: "0.1.0" },
-    {
-      listChanged: {
-        tools: {
-          autoRefresh: false,
-          debounceMs: 0,
-          onChanged: () => onToolsChanged?.()
-        },
-        prompts: {
-          autoRefresh: false,
-          debounceMs: 0,
-          onChanged: () => onPromptsChanged?.()
-        },
-        resources: {
-          autoRefresh: false,
-          debounceMs: 0,
-          onChanged: () => onResourcesChanged?.()
-        }
-      },
-      versionNegotiation: {
-        mode: config.protocol ?? "auto",
-        probe: { timeoutMs: startupTimeout }
-      }
-    }
-  );
+  const client = createClient(config, handlers);
   const transport = config.command ? new StdioClientTransport({
     command: config.command,
     args: config.args,
@@ -4912,11 +5300,12 @@ var createSdkConnector = (storeFactory = credentialStore) => async (name, config
 };
 var connectSdk = createSdkConnector();
 var McpRuntime = class {
-  constructor(config, cwd, cacheDir, connect = connectSdk) {
+  constructor(config, cwd, cacheDir, connect = connectSdk, options = {}) {
     this.config = config;
     this.cwd = cwd;
     this.cacheDir = cacheDir;
     this.connect = connect;
+    this.options = options;
   }
   states = /* @__PURE__ */ new Map();
   lifetime = new AbortController();
@@ -4984,33 +5373,42 @@ var McpRuntime = class {
           this.lifetime.signal
         ),
         this.lifetime.signal,
-        () => {
-          if (this.closing || this.lifetime.signal.aborted || state.connectionToken !== token)
-            return;
-          state.catalogGeneration++;
-          state.catalogDirty = true;
-          state.tools = void 0;
-          state.warnings = void 0;
-          const path = join2(this.cacheDir, `${identity}.json`);
-          state.invalidating = withFileMutationQueue2(
-            path,
-            () => rm2(path, { force: true })
-          ).catch(() => {
-            state.warnings = [
-              `${name}: stale catalog cache could not be removed.`
-            ];
-          });
-        },
-        () => {
-          if (this.closing || this.lifetime.signal.aborted || state.connectionToken !== token) return;
-          state.resourceGeneration++;
-          state.resources = void 0;
-          state.resourceWarnings = void 0;
-        },
-        () => {
-          if (this.closing || this.lifetime.signal.aborted || state.connectionToken !== token) return;
-          state.promptGeneration++;
-          state.prompts = void 0;
+        {
+          toolsChanged: () => {
+            if (this.closing || this.lifetime.signal.aborted || state.connectionToken !== token)
+              return;
+            state.catalogGeneration++;
+            state.catalogDirty = true;
+            state.tools = void 0;
+            state.warnings = void 0;
+            const path = join2(this.cacheDir, `${identity}.json`);
+            state.invalidating = withFileMutationQueue2(
+              path,
+              () => rm2(path, { force: true })
+            ).catch(() => {
+              state.warnings = [
+                `${name}: stale catalog cache could not be removed.`
+              ];
+            });
+          },
+          resourcesChanged: () => {
+            if (this.closing || this.lifetime.signal.aborted || state.connectionToken !== token) return;
+            state.resourceGeneration++;
+            state.resources = void 0;
+            state.resourceWarnings = void 0;
+          },
+          promptsChanged: () => {
+            if (this.closing || this.lifetime.signal.aborted || state.connectionToken !== token) return;
+            state.promptGeneration++;
+            state.prompts = void 0;
+          },
+          ...this.options.interactive ? {
+            elicit: (params, signal) => this.elicit(name, state, token, params, signal),
+            elicitationComplete: (id) => {
+              if (state.connectionToken === token)
+                for (const complete of state.awaitingCompletion?.get(id) ?? []) complete();
+            }
+          } : {}
         }
       );
       if (this.closing || this.lifetime.signal.aborted) {
@@ -5410,7 +5808,7 @@ var McpRuntime = class {
     );
     return result;
   }
-  async call(tool, args, signal, progress) {
+  async call(tool, args, signal, progress, ui) {
     const config = this.definition(tool.server);
     if (!allowed(tool.name, config) || this.identity(tool.server) !== tool.identity)
       throw new ToolContractError(
@@ -5423,29 +5821,125 @@ var McpRuntime = class {
         "MCP tool was removed or its schema changed. Use mcp_tools with activate and its exact identifier to activate its current definition."
       );
     const client = await waitFor2(this.client(tool.server), signal);
+    const state = this.state(tool.server);
+    const deadline = new Deadline(config.toolTimeoutMs ?? config.timeoutMs ?? 3e4);
+    const scope = ui && this.options.interactive ? { ui, deadline, progress } : void 0;
+    if (scope) {
+      if (!state.scopes?.size) {
+        state.scopes = /* @__PURE__ */ new Set();
+        state.scopesEnded = new AbortController();
+      }
+      state.scopes.add(scope);
+    }
     try {
       return await client.callTool(
         { name: tool.name, arguments: args },
         {
           signal: AbortSignal.any([
             this.lifetime.signal,
+            deadline.signal,
             ...signal ? [signal] : []
           ]),
-          timeout: config.toolTimeoutMs ?? config.timeoutMs ?? 3e4,
+          timeout: UNBOUNDED_TIMEOUT,
           onprogress: (event) => progress?.(
             event.message ?? `${event.progress}${event.total === void 0 ? "" : `/${event.total}`}`
           )
         }
       );
     } catch (error) {
-      const value = diagnose(error, {
+      const context = {
         server: tool.server,
         operation: "call",
         oauth: usesOAuth(config),
         signal
-      });
-      this.state(tool.server).error = value;
+      };
+      if (scope && error instanceof ProtocolError3 && error.code === ProtocolErrorCode3.UrlElicitationRequired) {
+        const required = requiredElicitations(error);
+        throw failure(
+          required ? await this.completeRequired(tool.server, state, scope, required, signal) : "protocol_error",
+          context
+        );
+      }
+      const value = diagnose(error, context);
+      if (value.code !== "elicitation_required") state.error = value;
       throw new DiagnosticError(value);
+    } finally {
+      deadline.dispose();
+      if (scope) {
+        state.scopes?.delete(scope);
+        if (!state.scopes?.size) state.scopesEnded?.abort();
+      }
+    }
+  }
+  /** Server dialogs appear one at a time, in arrival order. */
+  dialogs = Promise.resolve();
+  dialog(work, signal) {
+    const run = this.dialogs.then(() => {
+      signal.throwIfAborted();
+      return work();
+    });
+    this.dialogs = run.catch(() => {
+    });
+    return waitFor2(run, signal);
+  }
+  /** Accept requests only while a tool call to this server can show them. */
+  async elicit(name, state, token, params, signal) {
+    const scopes = [...state.scopes ?? []];
+    const scope = scopes.at(-1);
+    if (!scope || !state.scopesEnded || state.connectionToken !== token || this.closing)
+      throw new ProtocolError3(ProtocolErrorCode3.InvalidRequest, "Elicitation is only accepted during an interactive tool call.");
+    if ((state.pendingElicitations ?? 0) >= MAX_PENDING_ELICITATIONS)
+      throw new ProtocolError3(ProtocolErrorCode3.InvalidRequest, "Too many pending elicitation requests.");
+    state.pendingElicitations = (state.pendingElicitations ?? 0) + 1;
+    for (const each of scopes) each.deadline.pause();
+    const combined = AbortSignal.any([signal, this.lifetime.signal, state.scopesEnded.signal]);
+    try {
+      return await this.dialog(() => {
+        scope.progress?.("Waiting for your input\u2026");
+        return elicit(scope.ui, name, params, combined);
+      }, combined);
+    } catch (error) {
+      if (combined.aborted) return { action: "cancel" };
+      throw error;
+    } finally {
+      state.pendingElicitations = (state.pendingElicitations ?? 1) - 1;
+      for (const each of scopes) each.deadline.resume();
+      if (!combined.aborted) scope.progress?.("Calling\u2026");
+    }
+  }
+  /** Present a required browser step; never replay the refused call. */
+  async completeRequired(name, state, scope, required, signal) {
+    const combined = AbortSignal.any([this.lifetime.signal, ...signal ? [signal] : []]);
+    const pending = new Set(required.map((item) => item.elicitationId));
+    const completed = new AbortController();
+    const awaiting = state.awaitingCompletion ??= /* @__PURE__ */ new Map();
+    const listeners = /* @__PURE__ */ new Map();
+    for (const id of pending) {
+      const complete = () => {
+        pending.delete(id);
+        if (!pending.size) completed.abort();
+      };
+      listeners.set(id, complete);
+      const subscribers = awaiting.get(id) ?? /* @__PURE__ */ new Set();
+      subscribers.add(complete);
+      awaiting.set(id, subscribers);
+    }
+    try {
+      for (const params of required) {
+        scope.progress?.("Waiting for your input\u2026");
+        const result = await this.dialog(() => elicit(scope.ui, name, params, combined), combined);
+        if (result.action !== "accept") return combined.aborted ? "cancelled" : "elicitation_declined";
+      }
+      const done = completed.signal.aborted || await this.dialog(() => awaitCompletion(scope.ui, name, completed.signal, combined), combined);
+      return done ? "elicitation_completed" : combined.aborted ? "cancelled" : "elicitation_declined";
+    } catch {
+      return combined.aborted ? "cancelled" : "elicitation_declined";
+    } finally {
+      for (const [id, complete] of listeners) {
+        const subscribers = awaiting.get(id);
+        subscribers?.delete(complete);
+        if (!subscribers?.size) awaiting.delete(id);
+      }
     }
   }
   /** Close related OAuth connections without reconnecting, including disabled servers. */
@@ -5682,7 +6176,7 @@ Content type: ${line(resource.mimeType ?? "unspecified")}` });
   converted.details.resource = target;
   return converted;
 }
-async function convertResult(result, label) {
+async function convertResult(result, label2) {
   const texts = [];
   const blocks = [];
   let offset = 0;
@@ -5704,7 +6198,7 @@ async function convertResult(result, label) {
       append(part.resource.text, { mimeType: part.resource.mimeType });
     else if (part.type === "resource_link")
       append(`${part.name}: ${part.uri}${validResourceUri(part.uri) ? `
-Read with mcp_tools(${JSON.stringify({ read: { server: label.split(".")[0], uri: part.uri } })})` : ""}`, {
+Read with mcp_tools(${JSON.stringify({ read: { server: label2.split(".")[0], uri: part.uri } })})` : ""}`, {
         mimeType: part.mimeType,
         resourceLink: true
       });
@@ -5730,12 +6224,12 @@ Read with mcp_tools(${JSON.stringify({ read: { server: label.split(".")[0], uri:
     ...result.isError ? {
       diagnostics: [
         diagnostic("tool_error", {
-          server: label.split(".")[0],
+          server: label2.split(".")[0],
           operation: "call"
         })
       ]
     } : {},
-    rows: [{ label, state: result.isError ? "failed" : "done" }]
+    rows: [{ label: label2, state: result.isError ? "failed" : "done" }]
   };
   if (truncated.truncated || needsSpill) {
     const path = join3(await mkdtemp(join3(tmpdir(), "pi-mcp-client-")), "result.json");
@@ -5958,19 +6452,54 @@ function statusPanel(snapshot, theme) {
   };
 }
 
+// src/trust.ts
+import {
+  hasTrustRequiringProjectResources,
+  ProjectTrustStore,
+  SettingsManager
+} from "@earendil-works/pi-coding-agent";
+var CHOICES = /* @__PURE__ */ new Map([
+  ["Trust", { trusted: true, save: true }],
+  ["Trust (this session only)", { trusted: true, save: false }],
+  ["Do not trust", { trusted: false, save: true }],
+  ["Do not trust (this session only)", { trusted: false, save: false }]
+]);
+function projectTrustDecision(agentDir, cwd, piTrusted) {
+  if (!piTrusted) return false;
+  if (hasTrustRequiringProjectResources(cwd)) return true;
+  const saved = new ProjectTrustStore(agentDir).get(cwd);
+  if (saved !== null) return saved;
+  const policy = SettingsManager.create(cwd, agentDir, { projectTrusted: false }).getDefaultProjectTrust();
+  return policy === "ask" ? void 0 : policy === "always";
+}
+async function askProjectTrust(agentDir, cwd, select, signal) {
+  const answer = await select(
+    `Trust project folder?
+${cwd}
+
+Its .mcp.json defines MCP servers, which can run local commands with your permissions. Saved decisions use Pi's project trust and also apply to Pi project resources.`,
+    [...CHOICES.keys()],
+    { signal }
+  );
+  const choice = answer === void 0 ? void 0 : CHOICES.get(answer);
+  if (!choice || signal.aborted) return void 0;
+  if (choice.save) new ProjectTrustStore(agentDir).set(cwd, choice.trusted);
+  return choice.trusted;
+}
+
 // src/index.ts
 var CommandUsageError = class extends Error {
 };
 function errorResult(error, context) {
   const value = error instanceof ToolContractError ? diagnostic("tool_changed", context) : diagnose(error, context);
-  const message = formatDiagnostic(value) + (context.operation === "call" ? " The call was not replayed. The server may already have performed the operation; verify before retrying." : "");
-  return textResult(message, {
+  const message2 = formatDiagnostic(value) + (context.operation === "call" && !value.code.startsWith("elicitation_") ? " The call was not replayed. The server may already have performed the operation; verify before retrying." : "");
+  return textResult(message2, {
     mcpClient: 1,
     failed: true,
     diagnostics: [value],
     rows: [
       {
-        label: value.code === "cancelled" ? "Cancelled" : message,
+        label: value.code === "cancelled" ? "Cancelled" : message2,
         state: value.code === "cancelled" ? "cancelled" : "failed"
       }
     ]
@@ -5986,18 +6515,31 @@ function mcpClient(pi, options = {}) {
   let loginController;
   let promptController;
   let importController;
+  let trustController;
+  let sessionTrust;
   pi.registerEntryRenderer(
     STATUS_ENTRY,
     (entry, _options, theme) => statusPanel(entry.data ?? { servers: [], loaded: [] }, theme)
   );
-  pi.registerMessageRenderer("mcp-prompt", (message, { expanded, outputPad }, theme) => {
-    const details = object(message.details) ? message.details : {};
+  pi.registerMessageRenderer("mcp-prompt", (message2, { expanded, outputPad }, theme) => {
+    const details = object(message2.details) ? message2.details : {};
     const count = Number(details.count ?? 0);
-    const label = `${line(String(details.server ?? "MCP"))} \xB7 ${line(String(details.name ?? "prompt"))} \xB7 ${count} ${count === 1 ? "message" : "messages"}`;
-    return new Text4(theme.fg("toolTitle", "mcp prompt") + "\n" + theme.fg("success", "\u2714\uFE0E ") + theme.fg("accent", label) + (expanded && typeof message.content === "string" ? `
-${message.content}` : ""), outputPad, 0);
+    const label2 = `${line(String(details.server ?? "MCP"))} \xB7 ${line(String(details.name ?? "prompt"))} \xB7 ${count} ${count === 1 ? "message" : "messages"}`;
+    return new Text4(theme.fg("toolTitle", "mcp prompt") + "\n" + theme.fg("success", "\u2714\uFE0E ") + theme.fg("accent", label2) + (expanded && typeof message2.content === "string" ? `
+${message2.content}` : ""), outputPad, 0);
   });
   const exposure = new Exposure(pi, registerNative);
+  const launchBrowser = async (target) => {
+    const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer.exe" : "xdg-open";
+    const result = await pi.exec(command, [target], { timeout: 5e3 }).catch(() => void 0);
+    return !!result && result.code === 0;
+  };
+  const elicitationUi = (ctx) => ({
+    select: (title, choices2, signal) => chooseOption(ctx, title, choices2, signal),
+    editor: (title, value) => ctx.ui.editor(title, value),
+    notify: (message2, type) => ctx.ui.notify(message2, type),
+    open: launchBrowser
+  });
   const current = () => {
     if (!runtime)
       throw configError ?? failure("configuration_invalid", { operation: "configuration" });
@@ -6021,13 +6563,13 @@ Text output is limited to 2000 lines or 50 KiB; larger results are saved to a pr
       renderCall: (args, theme, context) => renderCall(`${tool.server} ${tool.name}`, args, theme, context.expanded),
       renderResult: (result, options2, theme, context) => renderResult(result, options2, theme, context.isError),
       async execute(_id, args, signal, onUpdate, ctx) {
-        const label = `${tool.server}.${tool.name}`;
-        const emit = (message) => onUpdate?.(
-          textResult(message, {
+        const label2 = `${tool.server}.${tool.name}`;
+        const emit = (message2) => onUpdate?.(
+          textResult(message2, {
             mcpClient: 1,
             rows: [
               {
-                label: `${label} \xB7 ${line(message).slice(0, 160)}`,
+                label: `${label2} \xB7 ${line(message2).slice(0, 160)}`,
                 state: "running"
               }
             ]
@@ -6039,9 +6581,10 @@ Text output is limited to 2000 lines or 50 KiB; larger results are saved to a pr
             tool,
             args,
             signal ?? ctx.signal,
-            emit
+            emit,
+            ctx.hasUI ? elicitationUi(ctx) : void 0
           );
-          return await convertResult(result, label);
+          return await convertResult(result, label2);
         } catch (error) {
           return errorResult(error, {
             server: tool.server,
@@ -6053,6 +6596,35 @@ Text output is limited to 2000 lines or 50 KiB; larger results are saved to a pr
       }
     });
   }
+  const trustDecision = (ctx) => projectTrustDecision(agentDir, ctx.cwd, ctx.isProjectTrusted()) ?? (sessionTrust?.cwd === ctx.cwd ? sessionTrust.trusted : void 0);
+  const projectTrusted = (ctx) => trustDecision(ctx) ?? false;
+  async function resolveProjectTrust(ctx) {
+    let trusted = trustDecision(ctx);
+    if (!existsSync(join4(ctx.cwd, ".mcp.json"))) return trusted ?? false;
+    let answered = false;
+    if (trusted === void 0 && ctx.hasUI) {
+      const controller = new AbortController();
+      trustController = controller;
+      try {
+        trusted = await askProjectTrust(
+          agentDir,
+          ctx.cwd,
+          ctx.ui.select.bind(ctx.ui),
+          AbortSignal.any([controller.signal, ...ctx.signal ? [ctx.signal] : []])
+        );
+      } finally {
+        if (trustController === controller) trustController = void 0;
+      }
+      if (controller.signal.aborted) return false;
+      if (trusted !== void 0) {
+        sessionTrust = { cwd: ctx.cwd, trusted };
+        answered = true;
+      }
+    }
+    if (!trusted && !answered && ctx.hasUI && ctx.isProjectTrusted())
+      ctx.ui.notify("Project .mcp.json ignored: this folder isn't trusted for MCP servers. Run /trust to save a decision, then /mcp reload.", "warning");
+    return trusted ?? false;
+  }
   const restore = (ctx) => {
     const tools = restoredTools(ctx.sessionManager.getBranch()).filter((tool) => {
       try {
@@ -6087,20 +6659,22 @@ Text output is limited to 2000 lines or 50 KiB; larger results are saved to a pr
       }
     };
     ctx.signal?.throwIfAborted();
+    const trusted = mutation ? projectTrusted(ctx) : await resolveProjectTrust(ctx);
     const update = mutation && await updateServerConfig(
       agentDir,
       ctx.cwd,
-      ctx.isProjectTrusted(),
+      trusted,
       mutation,
       validate
     );
-    const nextConfig = update ? update.config : await loadConfig(agentDir, ctx.cwd, ctx.isProjectTrusted());
+    const nextConfig = update ? update.config : await loadConfig(agentDir, ctx.cwd, trusted);
     validate(nextConfig);
     const next = new McpRuntime(
       nextConfig,
       ctx.cwd,
       join4(agentDir, "cache", "pi-mcp-client"),
-      createSdkConnector(storeFactory)
+      createSdkConnector(storeFactory),
+      { interactive: ctx.hasUI }
     );
     const active = new Set(pi.getActiveTools());
     const retained = [...exposure.definitions.values()].filter((tool) => {
@@ -6122,16 +6696,19 @@ Text output is limited to 2000 lines or 50 KiB; larger results are saved to a pr
     return update?.scope;
   }
   pi.on("session_start", async (_event, ctx) => {
-    sessionGeneration++;
+    const generation = ++sessionGeneration;
     promptController?.abort();
     importController?.abort();
+    trustController?.abort();
     await runtime?.close();
     runtime = void 0;
     config = {};
     configError = void 0;
     try {
-      config = await loadConfig(agentDir, ctx.cwd, ctx.isProjectTrusted());
-      runtime = new McpRuntime(config, ctx.cwd, join4(agentDir, "cache", "pi-mcp-client"), createSdkConnector(storeFactory));
+      const trusted = await resolveProjectTrust(ctx);
+      if (generation !== sessionGeneration) return;
+      config = await loadConfig(agentDir, ctx.cwd, trusted);
+      runtime = new McpRuntime(config, ctx.cwd, join4(agentDir, "cache", "pi-mcp-client"), createSdkConnector(storeFactory), { interactive: ctx.hasUI });
       resourceNotifications(runtime, ctx);
     } catch (error) {
       configError = new DiagnosticError(diagnose(error, { operation: "configuration" }));
@@ -6150,6 +6727,7 @@ Text output is limited to 2000 lines or 50 KiB; larger results are saved to a pr
     loginController?.abort();
     promptController?.abort();
     importController?.abort();
+    trustController?.abort();
     const old = runtime;
     runtime = void 0;
     await old?.close();
@@ -6336,7 +6914,7 @@ Variables: ${(candidate.variables ?? []).join(", ") || "none"}. Supply known val
               state: "failed"
             };
           }));
-          messages2.push(...discovery.unavailable.map((message) => `Not searched: ${message}`), ...discovery.warnings);
+          messages2.push(...discovery.unavailable.map((message2) => `Not searched: ${message2}`), ...discovery.warnings);
           messages2.push("No tools activated or resource or prompt content read. Activate selected tools or read selected resources using their exact next-call arguments. Prompt commands are for the user to run, not the assistant.");
         } else {
           const resolved = resolveTools(discovery.tools, identifiers);
@@ -6349,8 +6927,8 @@ Variables: ${(candidate.variables ?? []).join(", ") || "none"}. Supply known val
             const ok = tool && loaded.includes(tool);
             const unavailable = discovery.diagnostics.find((value) => value.server && serversFor(identifier2).includes(value.server));
             const reason = unavailable ? `server unavailable: ${formatDiagnostic(unavailable)}` : tool ? collisions.has(tool.nativeName) ? "name collision" : "restricted by Pi" : `unknown identifier${suggestions.length ? `; nearest catalog names: ${suggestions.join(", ")}` : "; no catalog names available for this server. Check the server identifier or discover candidates with query."}`;
-            const label = `${line(identifier2)} \u2014 ${ok ? added.includes(tool.nativeName) ? "loaded" : "already loaded" : `not loaded \u2014 ${reason}`}`;
-            messages2.push(label);
+            const label2 = `${line(identifier2)} \u2014 ${ok ? added.includes(tool.nativeName) ? "loaded" : "already loaded" : `not loaded \u2014 ${reason}`}`;
+            messages2.push(label2);
             details.rows.push({
               label: activationLabel(identifier2, tool),
               ...ok ? {} : { inlineDescription: reason },
@@ -6419,6 +6997,7 @@ Variables: ${(candidate.variables ?? []).join(", ") || "none"}. Supply known val
               args,
               ctx,
               agentDir,
+              () => projectTrusted(ctx),
               AbortSignal.any([controller.signal, ...ctx.signal ? [ctx.signal] : []]),
               () => {
                 if (sessionGeneration !== generation || runtime !== activeRuntime)
@@ -6458,8 +7037,8 @@ ${snapshot.body}`,
         if (action === "subscriptions") {
           if (server) throw new CommandUsageError("Use /mcp subscriptions without arguments.");
           const watches = current().resourceSubscriptions();
-          const message = watches.length ? watches.map((watch) => `${watch.changed ? "\u21BB" : "\u2714\uFE0E"} ${watch.server} \xB7 ${line(watch.uri).slice(0, 160)}${watch.changed ? " \xB7 changed" : ""}`).join("\n") : "No active resource subscriptions.";
-          if (ctx.hasUI) ctx.ui.notify(message, "info");
+          const message2 = watches.length ? watches.map((watch) => `${watch.changed ? "\u21BB" : "\u2714\uFE0E"} ${watch.server} \xB7 ${line(watch.uri).slice(0, 160)}${watch.changed ? " \xB7 changed" : ""}`).join("\n") : "No active resource subscriptions.";
+          if (ctx.hasUI) ctx.ui.notify(message2, "info");
           return;
         }
         if (action === "subscribe" || action === "unsubscribe") {
@@ -6478,8 +7057,8 @@ ${snapshot.body}`,
           server = mutation.server;
           await reloadConfiguration(ctx, mutation);
           const remaining = Object.hasOwn(config, server);
-          const message = mutation.action === "add" ? `\u2714\uFE0E ${server}: saved in ${mutation.scope} configuration. Connections, authentication, and tool discovery remain on demand.` + (mutation.scope === "global" && ctx.isProjectTrusted() ? " Trusted project definitions take precedence over global definitions." : "") : `\u2714\uFE0E ${server}: removed from ${mutation.scope} configuration. Credentials were retained.` + (remaining ? " A definition from the other scope remains effective; connections reopen on demand." : " Its connection is closed and its tools are no longer active.");
-          if (ctx.hasUI) ctx.ui.notify(message, "info");
+          const message2 = mutation.action === "add" ? `\u2714\uFE0E ${server}: saved in ${mutation.scope} configuration. Connections, authentication, and tool discovery remain on demand.` + (mutation.scope === "global" && projectTrusted(ctx) ? " Trusted project definitions take precedence over global definitions." : "") : `\u2714\uFE0E ${server}: removed from ${mutation.scope} configuration. Credentials were retained.` + (remaining ? " A definition from the other scope remains effective; connections reopen on demand." : " Its connection is closed and its tools are no longer active.");
+          if (ctx.hasUI) ctx.ui.notify(message2, "info");
           return;
         }
         if (action === "reload" && !server) {
@@ -6573,14 +7152,14 @@ ${snapshot.body}`,
             );
             return;
           }
-          const choices = [...tools].sort((a, b) => a.name.localeCompare(b.name));
+          const choices2 = [...tools].sort((a, b) => a.name.localeCompare(b.name));
           const columns = ctx.mode === "tui" ? process.stdout.columns || 80 : 80;
-          const labels = choices.map((tool2, index) => toolPickerLabel(tool2, index, columns));
+          const labels = choices2.map((tool2, index) => toolPickerLabel(tool2, index, columns));
           const selected = await ctx.ui.select(
             `${server}: ${tools.length} tools (select to inspect; none are activated)`,
             labels
           );
-          const tool = selected === void 0 ? void 0 : choices[labels.indexOf(selected)];
+          const tool = selected === void 0 ? void 0 : choices2[labels.indexOf(selected)];
           if (tool)
             ctx.ui.notify(
               inspectTool(tool),
@@ -6601,9 +7180,7 @@ ${snapshot.body}`,
           const options2 = config[server];
           const loginRuntime = current();
           const open2 = async (target) => {
-            const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer.exe" : "xdg-open";
-            const result = await pi.exec(command, [target], { timeout: 5e3 }).catch(() => void 0);
-            if (!result || result.code !== 0)
+            if (!await launchBrowser(target))
               throw failure("oauth_failed", { server, operation: "auth" });
           };
           if (loginController) throw failure("busy", { server, operation: "auth" });
@@ -6679,7 +7256,7 @@ Opening browser. Esc to cancel.`
             "info"
           );
       } catch (error) {
-        const message = error instanceof CommandUsageError || error instanceof ConfigMutationError || error instanceof PromptCommandError ? error.message : formatDiagnostic(
+        const message2 = error instanceof CommandUsageError || error instanceof ConfigMutationError || error instanceof PromptCommandError ? error.message : formatDiagnostic(
           diagnose(error, {
             server,
             operation: ["reload", "get", "enable", "disable", "add", "remove", "import"].includes(action) ? "configuration" : action === "tools" ? "search" : action === "prompt" ? "prompt" : ["login", "logout"].includes(action) ? "auth" : ["subscribe", "unsubscribe"].includes(action) ? "subscribe" : action === "refresh" ? "refresh" : "reconnect",
@@ -6687,8 +7264,8 @@ Opening browser. Esc to cancel.`
             signal: ctx.signal
           })
         );
-        if (ctx.hasUI) ctx.ui.notify(message, "error");
-        else throw new Error(message);
+        if (ctx.hasUI) ctx.ui.notify(message2, "error");
+        else throw new Error(message2);
       }
     }
   });