privateer-agent 0.14.6 → 0.15.0

package/patches/{pi-background-tasks+2.5.0.patch → pi-background-tasks+2.6.10.patch}

@@ -1,5 +1,28 @@
+diff --git a/node_modules/pi-background-tasks/src/core/anthropic-attribution.ts b/node_modules/pi-background-tasks/src/core/anthropic-attribution.ts
+index 2a4d905..3a689f5 100644
+--- a/node_modules/pi-background-tasks/src/core/anthropic-attribution.ts
++++ b/node_modules/pi-background-tasks/src/core/anthropic-attribution.ts
+@@ -7,6 +7,7 @@ import type {
+   Context as HostContext,
+   Model as HostModel,
+   SimpleStreamOptions as HostSimpleStreamOptions,
++  TranscriptContext as HostTranscriptContext,
+ } from '@earendil-works/pi-ai';
+ 
+ export const CLAUDE_CODE_SESSION_HEADER = 'X-Claude-Code-Session-Id';
+@@ -3024,7 +3025,9 @@ async function fetchAnthropicResponse(
+ }
+ 
+ type HostForwardingModel = PiModelLike & HostModel<'anthropic-messages'>;
+-type HostForwardingContext = PiStreamContext & HostContext;
++// Privateer: pi-ai 1.x brands the host's context type (TranscriptContext). The value
++// passed through is the host's own context object, so only the type needs the brand.
++type HostForwardingContext = PiStreamContext & HostContext & HostTranscriptContext;
+ type HostForwardingOptions = PiSimpleStreamOptions & HostSimpleStreamOptions;
+ type HostForwardingStream = AssistantMessageEventStreamLike & HostAssistantMessageEventStream;
+ 
 diff --git a/node_modules/pi-background-tasks/src/core/registry.ts b/node_modules/pi-background-tasks/src/core/registry.ts
-index cfbf133..c632390 100644
+index df6e6f4..cbab9f2 100644
 --- a/node_modules/pi-background-tasks/src/core/registry.ts
 +++ b/node_modules/pi-background-tasks/src/core/registry.ts
 @@ -1,11 +1,11 @@
@@ -7,7 +30,7 @@ index cfbf133..c632390 100644
 -import { randomBytes } from 'node:crypto';
 +import { createHash, randomBytes } from 'node:crypto';
  import { createWriteStream, existsSync } from 'node:fs';
- import { mkdir, realpath, writeFile } from 'node:fs/promises';
+ import { mkdir, realpath, rm, writeFile } from 'node:fs/promises';
 -import { join } from 'node:path';
 +import { join, resolve } from 'node:path';
  import type { Api, Model } from '@earendil-works/pi-ai';
@@ -17,7 +40,7 @@ index cfbf133..c632390 100644
  import {
    boundedRead,
    deriveTaskNameFromCommand,
-@@ -781,9 +781,29 @@ export class BackgroundTaskRegistry {
+@@ -1263,9 +1263,29 @@ export class BackgroundTaskRegistry {
      if (this.runtimeDir) return this.runtimeDir;
      const sessionId = sanitizePathSegment(ctx.sessionId ?? `session-${String(process.pid)}`);
      const runId = `${sessionId}-${String(process.pid)}`;
@@ -51,29 +74,21 @@ index cfbf133..c632390 100644
      return this.runtimeDir;
    }
 diff --git a/node_modules/pi-background-tasks/src/extension.ts b/node_modules/pi-background-tasks/src/extension.ts
-index 3afbd8e..d003a57 100644
+index c966df5..b073a15 100644
 --- a/node_modules/pi-background-tasks/src/extension.ts
 +++ b/node_modules/pi-background-tasks/src/extension.ts
-@@ -473,14 +473,15 @@ export default function backgroundTasksExtension(pi: ExtensionAPI): void {
-   pi.on('session_start', async (_event, ctx) => {
-     registry.setShuttingDown(false);
+@@ -710,8 +710,8 @@ export default async function backgroundTasksExtension(pi: ExtensionAPI): Promis
      currentCtx = ctx;
--    await registry.ensureRuntimeDir(ctx);
+     const nextRegistryCtx = currentRegistryCtx ?? registryContext(ctx);
+     currentRegistryCtx = nextRegistryCtx;
+-    await registry.ensureRuntimeDir(nextRegistryCtx);
+-    if (disposed) return;
 +    // Privateer: no project writes just to open a session. Each task-start path
 +    // creates its runtime directory on demand, with a per-user fallback.
      updateUi(ctx);
-     if (statusInterval) clearInterval(statusInterval);
-     statusInterval = setInterval(() => {
-       updateUi();
-     }, STATUS_INTERVAL_MS);
--    // One-shot, non-blocking: never awaited on the session-start path or the status tick.
--    void scheduleUpdateCheck(ctx);
-+    // Privateer: update check disabled. Privateer manages updates at the distribution
-+    // level via `privateer update`; individual tool packs shouldn't check npm or prompt /bg-update.
-   });
- 
-   pi.on('session_shutdown', async (_event, ctx) => {
-@@ -565,22 +566,11 @@ export default function backgroundTasksExtension(pi: ExtensionAPI): void {
+     hostService.markReady();
+     if (disposed) return;
+@@ -830,22 +830,11 @@ export default async function backgroundTasksExtension(pi: ExtensionAPI): Promis
    });
  
    pi.registerCommand('bg-update', {
@@ -99,7 +114,7 @@ index 3afbd8e..d003a57 100644
        ];
        ctx.ui.notify(lines.join('\n'), 'info');
        return Promise.resolve();
-@@ -682,7 +672,7 @@ export default function backgroundTasksExtension(pi: ExtensionAPI): void {
+@@ -958,7 +947,7 @@ export default async function backgroundTasksExtension(pi: ExtensionAPI): Promis
    pi.registerTool<typeof BgRunParams, BgRunDetails>({
      name: 'bg_run',
      label: 'Background Run',

package/src/bridge/engineAdapter.ts

@@ -80,6 +80,12 @@ export function createEngineEventAdapter() {
   let inRun = false;
 
   function toEngineEvents(ev: PiSessionEvent): EngineEvent[] {
+    // A tool call a codemode script made (Pi sets parentToolCallId; the id is
+    // "<parent>/<n>"). Not surfaced: the EngineEvent vocabulary has no nesting, so it
+    // would land as a top-level tool card for a call that isn't in the transcript. The
+    // script's own result reports what it did, and each nested call still went through
+    // the permission gate — any approval it needed was asked for.
+    if (ev.type.startsWith("tool_execution_") && ev.parentToolCallId) return [];
     switch (ev.type) {
       case "agent_start":
         terminalSent = false;

package/src/config/moat.ts

@@ -39,8 +39,10 @@
  * loads everything Pi-touching after ../boot.ts, and this must not break that).
  */
 
+import { readFileSync } from "node:fs";
 import { basename } from "node:path";
 import { managedNames } from "./moatManifest.ts";
+import { migrateMcpProjection } from "../remote/mcpControl.ts";
 import type { GateController } from "../ext/permissionGate.ts";
 import type { SendFileBridge } from "../tools/sendFile.ts";
 import type { CargoSaveBridge } from "../tools/cargo.ts";
@@ -94,7 +96,7 @@ export interface MoatOptions {
    */
   webHint?: string;
   /**
-   * How to import a THIRD-PARTY dependency (today: pi-mcp-adapter). Defaults to a plain
+   * How to import a shared dependency (today: pi-coding-agent, for its MCP extensions). Defaults to a plain
    * dynamic import, which is right for every process that runs from a normal Node
    * resolution root.
    *
@@ -107,6 +109,13 @@ export interface MoatOptions {
    * teaching this module about Electron.
    */
   hostImport?: (spec: string) => Promise<any>;
+  /**
+   * A window-scoped mcp.json (the desktop: each window activates its own subset of the
+   * catalog, projected by its connector manager). Set → this session's MCP support
+   * reads ONLY that file, so concurrent windows run different connector sets in one
+   * process. Unset → the shared agent/mcp.json plus a trusted project's, as the CLI.
+   */
+  mcpConfigPath?: string;
 }
 
 /**
@@ -260,6 +269,25 @@ export async function moatResourceOptions(
   return { extensionFactories: await buildMoat(opts), extensionsOverride: excludeDiscoveredMoat() };
 }
 
+// A window's mcp.json, in the shape Pi's MCP extension takes from `loadConfig`. The
+// file is our own projection (mcpService / mcpControl.toPiServerEntry), already in
+// Pi's format; an unreadable one is an empty config with the reason, not a crash.
+// `/mcp` changes save back to this same file (the entries' `source`).
+export function loadWindowMcpConfig(path: string): { servers: unknown[]; errors: string[] } {
+  try {
+    const raw = JSON.parse(readFileSync(path, "utf8"));
+    const servers = Object.entries<Record<string, unknown>>(raw?.mcpServers ?? {}).map(([name, config]) => ({
+      name,
+      config,
+      source: path,
+      scope: "global",
+    }));
+    return { servers, errors: [] };
+  } catch (e) {
+    return { servers: [], errors: [`${path}: ${e instanceof Error ? e.message : String(e)}`] };
+  }
+}
+
 /** Build the ordered extension factory list for one session. */
 export async function buildMoat(opts: MoatOptions): Promise<ExtensionFactory[]> {
   const caps = CAPABILITIES[opts.kind];
@@ -282,7 +310,8 @@ export async function buildMoat(opts: MoatOptions): Promise<ExtensionFactory[]>
     const { privacyExtension } = await import("./privacyPolicy.ts");
     factories.push(privacyExtension());
   }
-  factories.push(makeAccountProvider()); // must follow pi-privacy — see header
+  // must follow pi-privacy — see header. The harbor holds its own account lease.
+  factories.push(makeAccountProvider({ armOnStart: opts.kind !== "harbor-session" }));
 
   // Every kind: a text-only model gets image descriptions from a vision model on the
   // same key instead of silently losing the image. See providers/visionDelegate.ts.
@@ -375,18 +404,28 @@ export async function buildMoat(opts: MoatOptions): Promise<ExtensionFactory[]>
   }
 
   if (caps.mcp) {
-    // Registers the tools from the shared agent/mcp.json — the same projection the app's
-    // MCP manager writes over the relay. No servers configured → a no-op. The specifier is
-    // a variable so tsc treats it as Promise<any> and doesn't pull the third-party
-    // adapter's own .ts into our typecheck.
+    // Pi's built-in MCP support: servers from the shared agent/mcp.json — the same
+    // projection the app's MCP manager writes over the relay — plus codemode, the
+    // default way MCP tools are reached, and tool_search for servers set to `deferred`.
+    // The CLI loads these as built-ins; SDK sessions don't, so they're added here. No
+    // servers configured → no tools. Imported through hostImport so the desktop gets the
+    // ONE Pi instance it already runs (see hostImport above).
+    //
+    // codemode is created with `models: false`. Its `models` global runs classifier and
+    // image models with the session's credentials, straight from a script — calls our
+    // permission gate never sees and that need not go to the provider this session was
+    // chosen for. Scripts keep tool calls, each of which is gated like a direct one.
     //
-    // The caller still owns MCP_DIRECT_TOOLS: the adapter reads it when the factory RUNS
-    // (inside createAgentSessionServices), not when it is imported here, so the env has to
-    // be set around session creation rather than around this call.
-    const mcpAdapterSpec = "pi-mcp-adapter";
+    // A file an older release wrote in pi-mcp-adapter's format is rewritten first, or
+    // every HTTP connector in it would be rejected as invalid.
+    migrateMcpProjection();
     const hostImport = opts.hostImport ?? ((spec: string) => import(spec));
-    const { default: mcpAdapter } = await hostImport(mcpAdapterSpec);
-    factories.push(mcpAdapter);
+    const pi = await hostImport("@earendil-works/pi-coding-agent");
+    factories.push(
+      pi.createMcpExtension(opts.mcpConfigPath ? { loadConfig: () => loadWindowMcpConfig(opts.mcpConfigPath!) } : {}),
+      pi.createCodemodeExtension({ models: false }),
+      pi.createToolSearchExtension(),
+    );
   }
 
   return factories;

package/src/config/moatManifest.json

@@ -5,7 +5,7 @@
     "@juicesharp/rpiv-ask-user-question",
     "background-tasks"
   ],
-  "retired": ["pi-privacy", "pi-web-access", "pi-hypa", "rpiv-web-tools"],
+  "retired": ["pi-privacy", "pi-web-access", "pi-hypa", "rpiv-web-tools", "pi-mcp-adapter"],
   "shims": [
     { "entry": "extensions/privateer-brand.ts", "name": "privateer-brand", "note": "banner, ⚓ badge, /signin /signout" },
     { "entry": "extensions/privateer-context.ts", "name": "privateer-context", "note": "PRIVATEER.md context + /init" },
@@ -16,6 +16,7 @@
     { "entry": "extensions/privateer-tools.ts", "name": "privateer-tools", "note": "Privateer tool pack" },
     { "entry": "extensions/privateer-privacy.ts", "name": "privateer-privacy", "note": "pi-privacy + account tier resolver" },
     { "entry": "extensions/privateer-connect.ts", "name": "privateer-connect", "note": "/connect — MCP connector manager" },
+    { "entry": "extensions/privateer-codemode.ts", "name": "privateer-codemode", "note": "codemode — scripts that call tools; how MCP tools are reached (no `models` global)" },
     { "entry": "extensions/privateer-vision.ts", "name": "privateer-vision", "note": "a vision model on the same key describes images for a text-only model" },
     { "entry": "extensions/privateer-media.ts", "name": "privateer-media", "note": "image/video/speech/music + ffmpeg compose" },
     { "entry": "extensions/privateer-computer.ts", "name": "privateer-computer", "note": "screen control — screenshots, mouse and keyboard (off unless armed with --allow-computer-control)" },
@@ -28,8 +29,7 @@
     { "entry": "extensions/privateer-speak.ts", "name": "privateer-speak", "note": "spoken responses (/speak) + voice input (/talk) — pi-speak + confidential account TTS/STT" },
     { "entry": "extensions/privateer-web.ts", "name": "privateer-web", "note": "web_search/web_fetch — account search when signed in, else the user's own provider (rpiv-web-tools); crypto_lookup — account market data, in both cases" },
     { "dep": ["@juicesharp/rpiv-ask-user-question", "index.ts"], "name": "rpiv-ask-user-question", "note": "ask_user_question" },
-    { "dep": ["pi-mcp-adapter", "index.ts"], "name": "pi-mcp-adapter", "note": "MCP servers as first-class tools" },
-    { "dep": ["pi-subagents", "src", "extension", "index.ts"], "name": "pi-subagents", "note": "bounded parallel sub-agents" },
+    { "dep": ["pi-subagents", "index.js"], "name": "pi-subagents", "note": "bounded parallel sub-agents" },
     { "dep": ["pi-background-tasks", "extensions", "anthropic-attribution.ts"], "name": "anthropic-attribution", "note": "Anthropic OAuth attribution and prompt sanitization" },
     { "dep": ["pi-background-tasks", "extensions", "background-tasks.ts"], "name": "pi-background-tasks", "note": "durable background tasks, delegated agents, and fusion" }
   ]

package/src/config/whatsNew.json

@@ -1,10 +1,10 @@
 {
   "$comment": "The banner's What's New list, newest first: the two to four things a returning user should notice, not a changelog. `reviewedFor` is the release this list was last looked at for. A release can't ship until it equals package.json's version (scripts/check-whats-new.mjs, run by `npm test` and by release.yml before anything builds), so every release, patches included, is a deliberate look at this list. If nothing new is worth a line, bumping `reviewedFor` alone is the answer. `since` is the release an entry arrived in. `cmd` is shown in the accent colour.",
-  "reviewedFor": "0.14.6",
+  "reviewedFor": "0.15.0",
   "items": [
+    { "text": "MCP on Pi's built-in support — sign OAuth connectors back in with", "cmd": "/mcp", "since": "0.15.0" },
+    { "text": "Sub-agents are back: hand work to bounded parallel agents", "since": "0.15.0" },
     { "text": "API keys can expire and carry their own credit limit — set them in the app", "since": "0.14.6" },
-    { "text": "Save to Cargo with no app attached — it lands on your next app open", "since": "0.14.4" },
-    { "text": "Several privateer -p runs at once no longer sign each other out", "since": "0.14.3" },
-    { "text": "A reply cut off at the output limit picks back up on its own", "since": "0.14.2" }
+    { "text": "Save to Cargo with no app attached — it lands on your next app open", "since": "0.14.4" }
   ]
 }

package/src/ext/permissionGate.ts

@@ -284,11 +284,12 @@ export function makePermissionGate(ctrl: GateController) {
           toolName: string;
           toolCallId: string;
           content: Array<{ type: string; text?: string; [k: string]: unknown }>;
+          structuredContent?: unknown;
           details?: unknown;
           isError?: boolean;
         },
         ctx: unknown,
-      ) => { content?: unknown[] } | undefined,
+      ) => { content?: unknown[]; structuredContent?: unknown } | undefined,
     ): void;
   }
 
@@ -304,6 +305,12 @@ export function makePermissionGate(ctrl: GateController) {
     // tool_result delivers content PARTS (per the Pi extension contract), not a
     // bare string — patch text parts and return a partial { content }; omitted
     // fields keep their current values.
+    //
+    // structuredContent too. A codemode script receives a nested call's
+    // structuredContent INSTEAD of its text (bash's full output, an MCP tool's JSON),
+    // and whatever the script prints goes to the model — so redacting only `content`
+    // would leave the script a clean path around it. Pi also drops structuredContent
+    // when a handler replaces `content` without it, so it is always returned alongside.
     pi.on("tool_result", (event) => {
       let touched = false;
       const content = event.content.map((part) => {
@@ -314,11 +321,41 @@ export function makePermissionGate(ctrl: GateController) {
         }
         return part;
       });
-      return touched ? { content } : undefined;
+      if (event.structuredContent === undefined) return touched ? { content } : undefined;
+      const structured = redactJson(event.structuredContent, redact);
+      if (structured !== event.structuredContent) touched = true;
+      return touched ? { content, structuredContent: structured } : undefined;
     });
   };
 }
 
+// Redact every string in a JSON value, keys included. Returns the SAME value when
+// nothing changed, so the caller can tell a no-op from a rewrite without a deep compare.
+export function redactJson(value: unknown, redact: (s: string) => string): unknown {
+  if (typeof value === "string") return redact(value);
+  if (Array.isArray(value)) {
+    let changed = false;
+    const out = value.map((v) => {
+      const r = redactJson(v, redact);
+      if (r !== v) changed = true;
+      return r;
+    });
+    return changed ? out : value;
+  }
+  if (value && typeof value === "object") {
+    let changed = false;
+    const out: Record<string, unknown> = {};
+    for (const [k, v] of Object.entries(value)) {
+      const rk = redact(k);
+      const rv = redactJson(v, redact);
+      if (rk !== k || rv !== v) changed = true;
+      out[rk] = rv;
+    }
+    return changed ? out : value;
+  }
+  return value;
+}
+
 function withTimeout<T>(p: Promise<T>, ms: number | undefined, signal?: AbortSignal): Promise<T> {
   if (!ms && !signal) return p;
   return new Promise<T>((resolve, reject) => {

package/src/harbor/closeSession.ts

@@ -1,6 +1,6 @@
 // Tear a headless session all the way down. dispose() alone stops the agent but never
 // emits session_shutdown — that is AgentSessionRuntime's job, and we build sessions
-// without one — so every extension that cleans up on it (pi-mcp-adapter's connections,
+// without one — so every extension that cleans up on it (Pi's MCP server connections,
 // OAuth runtime and lifecycle state among them) leaked once per run, for the life of a
 // resident process. Reason "new", not "quit": to our own extensions "quit" means the
 // PROCESS is exiting (privateer-brand revokes the machine's sessions on it), and the

package/src/harbor/index.ts

@@ -1,5 +1,5 @@
 import type { Server } from "node:net";
-import { readFileSync, rmSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
@@ -55,7 +55,7 @@ import {
 import type { Routine } from "../routines/schema.ts";
 import { triggerError, computeNextRun, advanceAfterRun } from "../routines/trigger.ts";
 import { splitRoutineTools } from "../routines/toolSelect.ts";
-import { resolveMcpSelection, readMcpInventory, type ResolvedMcpTools } from "../mcp/toolNames.ts";
+import { resolveMcpTools, isToolOfServer } from "../mcp/toolNames.ts";
 import { deliver, type RelayPusher, type CloudPusher } from "../routines/delivery.ts";
 import { ResultMedia, type StagedMedia } from "../routines/resultMedia.ts";
 import { withBrief } from "../routines/resultBrief.ts";
@@ -63,7 +63,6 @@ import { ATTACH_RESULT_TOOL } from "../tools/attachResult.ts";
 import { postOutbox as sealToOutbox, type OutboxSource } from "../outbox/cloudOutbox.ts";
 import { redactText, collectSecrets } from "../util/redact.ts";
 import { startIpcServer, sendToHarbor, describeRelay, formatDuration, HarborAlreadyRunningError, type IpcRequest, type IpcResponse, type RelayStatus } from "./ipc.ts";
-import { serializeBuild } from "./buildLock.ts";
 import { createAccountLease } from "./accountLease.ts";
 import { closeSession } from "./closeSession.ts";
 import { rotateLogIfLarge } from "./logRotate.ts";
@@ -133,11 +132,9 @@ const HOSTED_SUSPEND_MIN_LEAD_MS = Number(process.env.HARBOR_SUSPEND_MIN_LEAD_MS
 // answer before it fail-closes to "no response" (the runner then defers the run). Bounds
 // a stuck graph from pinning a `running` slot forever when the controller wanders off.
 const GATE_TIMEOUT_MS = 5 * 60_000;
-// How long a run waits for a newly-selected connector to hand over its tool list
-// before giving up and saying so in the result (see warmMcpCache). Bounds a dead
-// endpoint or an expired OAuth token from stalling a scheduled run.
-const WARM_TIMEOUT_MS = Number(process.env.PRIVATEER_MCP_WARM_MS) || 30_000;
-const WARM_POLL_MS = 250;
+// Every tool Pi's MCP support registers: server tools, and the resource tools that
+// reach every server at once.
+const MCP_TOOL_PATTERNS = ["mcp__*", "list_mcp_resources", "list_mcp_resource_templates", "read_mcp_resource"];
 // Hard ceiling on one unattended run (a routine, a submitted task, a workflow agent
 // step). Nothing else bounds a provider stream that stops sending without closing, and a
 // run stuck there holds its routine's `running` slot until the harbor restarts — the
@@ -208,9 +205,6 @@ function formatResult(routine: Routine, body: string, status: "ok" | "error", er
   return `${head}${body.trim() || "(no output)"}\n${formatNotes(notes)}`;
 }
 
-// Session construction is serialized process-wide — see harbor/buildLock.ts for why.
-// Imported rather than defined here so the channels runtime can share the same lock.
-
 // A short human title for an ad-hoc task: the app's explicit title, else the first
 // non-empty line of the prompt, clipped. Exported for the signed-args round-trip test.
 export function deriveTaskTitle(spec: TaskSpec): string {
@@ -281,8 +275,6 @@ export class Harbor {
   // + no live work rather than on controllerAttached, which never resets while the
   // socket stays open).
   private lastActivityAt = Date.now();
-  // In-flight MCP tool-inventory rebuild, shared by every run that needs one.
-  private warmInFlight?: Promise<void>;
   // Live, app-drivable sessions spawned on demand (task_spawn). Each has its OWN relay
   // terminal (task-<uuid>); the harbor just keeps handles so it can reap them on shutdown.
   private readonly liveTasks = new Map<string, LiveTaskHandle>();
@@ -878,22 +870,15 @@ export class Harbor {
   }
 
   // Build the Pi services for one unattended run: the auto-approve gate, the account
-  // provider, web tools when the agent has them, and the MCP adapter.
-  //
-  // `directTools` is the ONLY way to make per-tool MCP names exist at all. Without it
-  // pi-mcp-adapter exposes every connector through a single proxy tool named "mcp" —
-  // one grant, all servers, all tools — which is exactly what a per-routine allow-list
-  // is supposed to prevent. The adapter reads it from process.env at extension
-  // activation, so the build is serialized (serializeBuild) and the previous value is
-  // restored. "__none__" is its sentinel for "register none": an unattended run with
-  // no connector selectors gets no direct tools, whatever a shared mcp.json says.
-  private buildSessionServices(
+  // provider, web tools when the agent has them, and Pi's MCP support. Which MCP tools
+  // the run may reach is decided by the session's `tools` allow-list (resolveRunTools),
+  // not here, so concurrent builds share nothing.
+  private async buildSessionServices(
     cwd: string,
-    directTools: string[],
     media?: ResultMedia,
     spendGrant: readonly string[] = [],
   ): Promise<any> {
-    return serializeBuild(async () => {
+    {
       const granted = new Set(spendGrant);
       const gate: GateController = {
         getMode: () => "bypass",
@@ -919,122 +904,39 @@ export class Harbor {
         // grant cover a call that leaves cwd or reads a protected file.
         isSpendPreauthorized: (req) => granted.has(req.tool),
       };
-      // Every extension this session gets, in the one canonical order — including the MCP
-      // adapter (Phase 5), the web/media capability shaping, and the filter that ignores
+      // Every extension this session gets, in the one canonical order — including MCP
+      // and codemode, the web/media capability shaping, and the filter that ignores
       // any moat shim an older release left in the shared agent dir (releases up to 0.11
       // installed one per extension; the launcher sweeps them, but a daemon can outlive
       // the launch that would have). See config/moat.ts.
       const moat = await moatResourceOptions({ kind: "harbor-session", gate, resultMedia: media });
-      // MCP_DIRECT_TOOLS is read by the adapter when its factory RUNS, inside
-      // createAgentSessionServices — so it has to wrap the session creation, not the
-      // moatResourceOptions() call that imported it.
-      const prevDirect = process.env.MCP_DIRECT_TOOLS;
-      process.env.MCP_DIRECT_TOOLS = directTools.length > 0 ? directTools.join(",") : "__none__";
-      try {
-        return await createAgentSessionServices({
-          cwd,
-          agentDir: agentDir(),
-          resourceLoaderOptions: moat as any,
-        });
-      } finally {
-        if (prevDirect === undefined) delete process.env.MCP_DIRECT_TOOLS;
-        else process.env.MCP_DIRECT_TOOLS = prevDirect;
-      }
-    });
+      return await createAgentSessionServices({
+        cwd,
+        agentDir: agentDir(),
+        resourceLoaderOptions: moat as any,
+      });
+    }
   }
 
   // Turn a routine's stored tool list into what Pi will actually accept.
   //
   // Builtins pass through builtinToolsFor (explicit list, or the safe read/web set).
-  // MCP entries are SELECTORS — "<server>__<tool>" / "<server>__*" — and have to be
-  // translated into the adapter's registered names before Pi's exact-match `tools:`
-  // Set can grant anything at all. A "<server>__*" needs the adapter's metadata cache
-  // to enumerate; when that is cold we warm it (below) and re-resolve once.
-  private async resolveRunTools(
-    raw: string[],
-    cwd: string,
-    modelSpec: string,
-  ): Promise<{ tools: string[]; directToolsEnv: string[]; notes: string[] }> {
+  // MCP entries are SELECTORS — "<server>__<tool>" / "<server>__*" — translated into
+  // Pi's "mcp__<server>__<tool>" names and patterns. Once any `tools` entry starts with
+  // "mcp__", Pi registers ONLY the MCP tools that match, so the run can reach exactly
+  // the connectors it named. codemode rides along because it is how MCP tools are
+  // called by default; it can only call tools the session registered.
+  //
+  // With no selectors, `excludeTools` keeps every MCP tool unregistered. A builtin-only
+  // list would leave them registered (Pi only filters MCP tools once an entry names
+  // one) and merely unreachable — a run nobody watches gets the stronger guarantee.
+  private resolveRunTools(raw: string[]): { tools: string[]; excludeTools: string[]; servers: string[] } {
     const split = splitRoutineTools(raw);
     const builtin = builtinToolsFor(split.builtin);
-    if (split.mcp.length === 0) return { tools: builtin, directToolsEnv: [], notes: [] };
-
-    let resolved: ResolvedMcpTools = resolveMcpSelection(split.mcp);
-    if (resolved.coldServers.length > 0) {
-      await this.warmMcpCache(cwd, modelSpec, resolved.coldServers);
-      resolved = resolveMcpSelection(split.mcp);
-    }
-
-    const notes: string[] = [];
-    for (const server of resolved.coldServers) {
-      notes.push(
-        `Connector "${server}" didn't provide a tool list, so none of its tools were available to this run. ` +
-          `Check it is configured and, if it uses OAuth, that it is still authorized.`,
-      );
-    }
-    for (const selector of resolved.unknownTools) {
-      notes.push(`Connector tool "${selector}" doesn't exist on that connector, so it was not available to this run.`);
-    }
-    if (resolved.names.length > 0) {
-      log(`  connectors: ${resolved.servers.join(", ")} → ${resolved.names.length} tools`);
-    }
-    for (const note of notes) log(`  ${note}`);
-    return { tools: [...builtin, ...resolved.names], directToolsEnv: resolved.directToolsEnv, notes };
-  }
-
-  // Make pi-mcp-adapter build a fresh tool inventory for every configured connector.
-  //
-  // The adapter only connects to ALL of them when agent/mcp-cache.json is absent
-  // (init.ts → bootstrapAll); with the file present it connects lazily, so a connector
-  // added since the last session never gets an inventory and a "<server>__*" selector
-  // over it expands to nothing, for ever. Dropping the cache is safe — it is a cache —
-  // and makes this one throwaway session rebuild it. The session is never prompted
-  // (empty allow-list) and its MCP connections close on the adapter's idle timeout.
-  //
-  // The adapter does NOT await its own initialization from session_start — it stashes
-  // the promise and returns — so session creation resolving means nothing here. We
-  // watch the cache file instead, and give up after WARM_TIMEOUT_MS: a connector that
-  // never answers (dead endpoint, expired OAuth) must not hold a scheduled run open.
-  //
-  // A warm rebuilds the inventory for EVERY configured connector, so two runs that
-  // both hit a cold selector share one pass rather than racing to wipe the file out
-  // from under each other.
-  private warmMcpCache(cwd: string, modelSpec: string, servers: string[]): Promise<void> {
-    if (this.warmInFlight) return this.warmInFlight;
-    const p = this.doWarmMcpCache(cwd, modelSpec, servers).finally(() => {
-      if (this.warmInFlight === p) this.warmInFlight = undefined;
-    });
-    this.warmInFlight = p;
-    return p;
-  }
-
-  private async doWarmMcpCache(cwd: string, modelSpec: string, servers: string[]): Promise<void> {
-    log(`  warming connector tool lists: ${servers.join(", ")}`);
-    try {
-      rmSync(join(agentDir(), "mcp-cache.json"), { force: true });
-      const services = await this.buildSessionServices(cwd, []);
-      const { provider, modelId } = parseSpec(modelSpec);
-      const model = (modelRegistryOf(services) as any).find(provider, modelId);
-      if (!model) return;
-      const { session } = await createAgentSessionFromServices({
-        services,
-        sessionManager: SessionManager.inMemory(cwd),
-        model,
-        tools: [],
-      } as any);
-      try {
-        const deadline = Date.now() + WARM_TIMEOUT_MS;
-        while (Date.now() < deadline) {
-          const inventory = readMcpInventory(agentDir());
-          if (servers.every((s) => (inventory[s]?.length ?? 0) > 0)) break;
-          await new Promise((r) => setTimeout(r, WARM_POLL_MS));
-        }
-      } finally {
-        await closeSession(session);
-      }
-    } catch (e) {
-      log(`  connector warm-up failed: ${e instanceof Error ? e.message : String(e)}`);
-    }
+    if (split.mcp.length === 0) return { tools: builtin, excludeTools: [...MCP_TOOL_PATTERNS], servers: [] };
+    const { patterns, servers } = resolveMcpTools(split.mcp);
+    log(`  connectors: ${servers.join(", ")}`);
+    return { tools: [...builtin, "codemode", ...patterns], excludeTools: [], servers };
   }
 
   // Drive one headless Pi turn to completion and return its collected text + status.
@@ -1055,14 +957,14 @@ export class Harbor {
     let error: string | undefined;
     let leasedAccount = false;
     let session: any;
-    const resolved = await this.resolveRunTools(spec.tools, spec.cwd, spec.model);
+    const resolved = this.resolveRunTools(spec.tools);
     // attach_to_result rides with the staging area rather than the allow-list: it is
     // how the answer is DELIVERED, not a capability the run gains. A routine that
     // named an explicit tool list still gets it, because the alternative is a run
     // that can generate a still and then has no way to hand it over — and the file
     // is going to the user's own mailbox, which `delivery: cloud` already chose.
     const allowedTools = spec.media ? [...resolved.tools, ATTACH_RESULT_TOOL] : resolved.tools;
-    const { directToolsEnv, notes } = resolved;
+    const notes: string[] = [];
     // The billing tools this run may use: the ones its own allow-list names, and no
     // others. Authorizes the run's own calls (the gate, below) and its subagents' —
     // children are a separate process and read the grant from the environment, released
@@ -1070,7 +972,7 @@ export class Harbor {
     const spendGrant = allowedTools.filter((t) => BILLED_MEDIA_TOOLS.has(t));
     const releaseChildSpend = grantChildSpend(`run:${++runSeq}`, spendGrant);
     try {
-      const services = await this.buildSessionServices(spec.cwd, directToolsEnv, spec.media, spendGrant);
+      const services = await this.buildSessionServices(spec.cwd, spec.media, spendGrant);
 
       const { provider, modelId } = parseSpec(spec.model);
       if (provider === "privateer") {
@@ -1090,7 +992,16 @@ export class Harbor {
           sessionManager: SessionManager.inMemory(spec.cwd),
           model,
           tools: allowedTools,
+          excludeTools: resolved.excludeTools,
         } as any));
+        // session_start is what connects the MCP servers (Pi's MCP support). Bound with
+        // NO uiContext on purpose: Pi then keeps its own no-op UI and reports hasUI
+        // false, which is the truth for a run nobody watches. Any context object we
+        // passed — even an empty one — reads as a UI to extensions, and pi-privacy
+        // would then "ask" about personal data in a tool call, get no answer, and
+        // block it, where with no UI it allows the call with a notice. The gate's own
+        // localAsk (deny) answers anything that would have prompted.
+        await session.bindExtensions({});
         const adapter = createEngineEventAdapter();
         session.subscribe((ev: any) => {
           for (const ee of adapter.toEngineEvents(ev)) {
@@ -1115,6 +1026,17 @@ export class Harbor {
           status = "error";
           error = `run stopped after ${Math.round(RUN_TIMEOUT_MS / 60_000)} minutes (PRIVATEER_RUN_TIMEOUT_MS)`;
         }
+        // A connector that never connected registers no tools, and the run quietly comes
+        // back thinner than asked for. Say which, so the result explains itself.
+        const registered: string[] = (session.getAllTools?.() ?? []).map((t: { name: string }) => t.name);
+        for (const server of resolved.servers) {
+          if (registered.some((name) => isToolOfServer(name, server))) continue;
+          const note =
+            `Connector "${server}" didn't provide any tools, so none were available to this run. ` +
+            `Check it is configured and, if it uses OAuth, that it is still signed in (/mcp login ${server}).`;
+          notes.push(note);
+          log(`  ${note}`);
+        }
       }
     } catch (err) {
       status = "error";