ue-mcp 1.3.3 → 1.3.4

package/dist/flow/task-factory.js

@@ -3,6 +3,38 @@ import { stripEditorTarget } from "../types.js";
 import { prepareCall, finishCall } from "../call-pipeline.js";
 import { liftRollback } from "./rollback.js";
 import { applyHandlerOutcome } from "./handler-outcome.js";
+import { DialogGuard, ensureGuard } from "../dialog-guard.js";
+/**
+ * Refuse a flow step while a modal is up, through the one guard.
+ *
+ * The bridge-backed steps are covered at the bridge boundary. An in-process
+ * handler never goes near it, so without this the gate simply was not on that
+ * route: a modal raised mid-run was missed by every remaining step.
+ *
+ * Returns the refusal to report, or null to run the step.
+ */
+async function refuseStepIfBlocked(ctx, taskName, options) {
+    const session = ctx.session;
+    if (!session)
+        return null;
+    // The micro gateway arrives as one task carrying the real category and
+    // method in its options. Asking the allowlist about the wrapper refused
+    // respond_to_dialog, which is the single call that clears the dialog, so the
+    // gateway could never escape one.
+    const subject = taskName === "tools.call"
+        ? `${String(options.category ?? "")}.${String(options.method ?? "")}`
+        : taskName;
+    if (DialogGuard.actionAllowed(subject))
+        return null;
+    const guard = await ensureGuard(session);
+    const decision = await guard.check(subject, "action");
+    return decision.allow ? null : (decision.refusal ?? null);
+}
+/** The error a refused step reports, worded by the refusal itself. */
+function refusalError(taskName, refusal) {
+    const said = typeof refusal.error === "string" ? refusal.error : undefined;
+    return new Error(said ?? `'${taskName}' was refused: a modal dialog is blocking the editor.`);
+}
 /**
  * Create a TaskConstructor for a bridge-delegation action.
  * The bridge method (and optional param mapper) are closed over in the class,
@@ -84,6 +116,15 @@ export function handlerTaskClass(name, fn, prep) {
             const ctx = pipeline.timeoutMs === undefined
                 ? this.ctx
                 : { ...this.ctx, callTimeoutMs: pipeline.timeoutMs };
+            // A flow is a minutes-long run, and a modal can appear at any point in
+            // it. The tool route checks once, before flow.run starts; without this,
+            // a dialog raised at step 3 was missed by every later step, which
+            // includes the editor lifecycle handlers. Checking per step is what
+            // makes "any process, at any point" true of flows as well.
+            const refusal = await refuseStepIfBlocked(this.ctx, name, this.options);
+            if (refusal) {
+                return { success: false, data: refusal, error: refusalError(name, refusal) };
+            }
             const answered = await fn(ctx, pipeline.params);
             const data = finishCall(answered, pipeline);
             // Same defect as the bridge class had, from the same hardcoded `true`:

package/dist/flow/task-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"task-factory.js","sourceRoot":"","sources":["../../src/flow/task-factory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAwB,MAAM,qBAAqB,CAAC;AAEpF,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,MAAc,EACd,SAAmE,EACnE,SAAkB,EAClB,IAAsB;IAEtB,MAAM,iBAAkB,SAAQ,SAAS;QACvC,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC;QAC/B,KAAK,CAAC,OAAO;YACX,yEAAyE;YACzE,yEAAyE;YACzE,gCAAgC;YAChC,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAkC,CAAC,CAAC;YAC3E,yEAAyE;YACzE,uEAAuE;YACvE,mEAAmE;YACnE,iEAAiE;YACjE,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YACxE,qEAAqE;YACrE,oEAAoE;YACpE,wBAAwB;YACxB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;YACzF,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAC5C,OAAO,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,wEAAwE;YACxE,oEAAoE;YACpE,uDAAuD;YACvD,EAAE;YACF,uEAAuE;YACvE,mEAAmE;YACnE,yEAAyE;YACzE,yEAAyE;YACzE,8DAA8D;YAC9D,0DAA0D;YAC1D,MAAM,IAAI,GAAG,GAA8B,CAAC;YAC5C,MAAM,MAAM,GAAe,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACzD,uEAAuE;YACvE,yEAAyE;YACzE,4DAA4D;YAC5D,0EAA0E;YAC1E,wEAAwE;YACxE,gCAAgC;YAChC,MAAM,gBAAgB,GAAG,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ;gBACxE,CAAC,CAAE,QAAoC,CAAC,QAAQ;gBAChD,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/D,IAAI,MAAM;gBAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC;YACrC,qEAAqE;YACrE,uEAAuE;YACvE,sEAAsE;YACtE,yEAAyE;YACzE,wCAAwC;YACxC,OAAO,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzD,CAAC;KACF;IACD,MAAM,CAAC,cAAc,CAAC,iBAAiB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,cAAc,IAAI,EAAE,EAAE,CAAC,CAAC;IAClF,OAAO,iBAA+C,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,EAA2E,EAC3E,IAAsB;IAEtB,MAAM,kBAAmB,SAAQ,SAAS;QACxC,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC;QAC/B,KAAK,CAAC,OAAO;YACX,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,OAAkC,EAAE,IAAI,CAAC,CAAC;YAC5E,qEAAqE;YACrE,yEAAyE;YACzE,iEAAiE;YACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,KAAK,SAAS;gBAC1C,CAAC,CAAC,IAAI,CAAC,GAAG;gBACV,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;YACvD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC5C,uEAAuE;YACvE,qEAAqE;YACrE,wEAAwE;YACxE,qEAAqE;YACrE,yEAAyE;YACzE,wDAAwD;YACxD,OAAO,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE;gBAC7C,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;oBAC7C,CAAC,CAAE,IAAgC;oBACnC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;KACF;IACD,MAAM,CAAC,cAAc,CAAC,kBAAkB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,eAAe,IAAI,EAAE,EAAE,CAAC,CAAC;IACpF,OAAO,kBAAgD,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"task-factory.js","sourceRoot":"","sources":["../../src/flow/task-factory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAwB,MAAM,qBAAqB,CAAC;AAEpF,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAE9D;;;;;;;;GAQG;AACH,KAAK,UAAU,mBAAmB,CAChC,GAAgB,EAChB,QAAgB,EAChB,OAAgC;IAEhC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,uEAAuE;IACvE,wEAAwE;IACxE,6EAA6E;IAC7E,kCAAkC;IAClC,MAAM,OAAO,GAAG,QAAQ,KAAK,YAAY;QACvC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE;QACrE,CAAC,CAAC,QAAQ,CAAC;IACb,IAAI,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACtD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;AAC5D,CAAC;AAED,sEAAsE;AACtE,SAAS,YAAY,CAAC,QAAgB,EAAE,OAAgC;IACtE,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,OAAO,IAAI,KAAK,CAAC,IAAI,IAAI,IAAI,QAAQ,uDAAuD,CAAC,CAAC;AAChG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,MAAc,EACd,SAAmE,EACnE,SAAkB,EAClB,IAAsB;IAEtB,MAAM,iBAAkB,SAAQ,SAAS;QACvC,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC;QAC/B,KAAK,CAAC,OAAO;YACX,yEAAyE;YACzE,yEAAyE;YACzE,gCAAgC;YAChC,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAkC,CAAC,CAAC;YAC3E,yEAAyE;YACzE,uEAAuE;YACvE,mEAAmE;YACnE,iEAAiE;YACjE,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YACxE,qEAAqE;YACrE,oEAAoE;YACpE,wBAAwB;YACxB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;YACzF,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAC5C,OAAO,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,wEAAwE;YACxE,oEAAoE;YACpE,uDAAuD;YACvD,EAAE;YACF,uEAAuE;YACvE,mEAAmE;YACnE,yEAAyE;YACzE,yEAAyE;YACzE,8DAA8D;YAC9D,0DAA0D;YAC1D,MAAM,IAAI,GAAG,GAA8B,CAAC;YAC5C,MAAM,MAAM,GAAe,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACzD,uEAAuE;YACvE,yEAAyE;YACzE,4DAA4D;YAC5D,0EAA0E;YAC1E,wEAAwE;YACxE,gCAAgC;YAChC,MAAM,gBAAgB,GAAG,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ;gBACxE,CAAC,CAAE,QAAoC,CAAC,QAAQ;gBAChD,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/D,IAAI,MAAM;gBAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC;YACrC,qEAAqE;YACrE,uEAAuE;YACvE,sEAAsE;YACtE,yEAAyE;YACzE,wCAAwC;YACxC,OAAO,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzD,CAAC;KACF;IACD,MAAM,CAAC,cAAc,CAAC,iBAAiB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,cAAc,IAAI,EAAE,EAAE,CAAC,CAAC;IAClF,OAAO,iBAA+C,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,EAA2E,EAC3E,IAAsB;IAEtB,MAAM,kBAAmB,SAAQ,SAAS;QACxC,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC;QAC/B,KAAK,CAAC,OAAO;YACX,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,OAAkC,EAAE,IAAI,CAAC,CAAC;YAC5E,qEAAqE;YACrE,yEAAyE;YACzE,iEAAiE;YACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,KAAK,SAAS;gBAC1C,CAAC,CAAC,IAAI,CAAC,GAAG;gBACV,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;YACvD,uEAAuE;YACvE,wEAAwE;YACxE,kEAAkE;YAClE,oEAAoE;YACpE,2DAA2D;YAC3D,MAAM,OAAO,GAAG,MAAM,mBAAmB,CACvC,IAAI,CAAC,GAAG,EACR,IAAI,EACJ,IAAI,CAAC,OAAkC,CACxC,CAAC;YACF,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YAC/E,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC5C,uEAAuE;YACvE,qEAAqE;YACrE,wEAAwE;YACxE,qEAAqE;YACrE,yEAAyE;YACzE,wDAAwD;YACxD,OAAO,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE;gBAC7C,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;oBAC7C,CAAC,CAAE,IAAgC;oBACnC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;KACF;IACD,MAAM,CAAC,cAAc,CAAC,kBAAkB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,eAAe,IAAI,EAAE,EAAE,CAAC,CAAC;IACpF,OAAO,kBAAgD,CAAC;AAC1D,CAAC"}

package/dist/flow/task-guards.js

@@ -25,6 +25,8 @@ import { discoverTaskGuards as discoverFlowkitGuards } from "@db-lyon/flowkit/gu
 import { writeScope } from "./guard.js";
 import { McpError, ErrorCode } from "../errors.js";
 import { debug, info } from "../log.js";
+import { withoutDialogActuation } from "../dialog-guard.js";
+import { DialogGatedBridge } from "./guarded-bridge.js";
 /** Adapts flowkit's logger to this server's `guard`-component logging. */
 const GUARD_LOGGER = {
     debug: (...args) => debug("guard", args.map(String).join(" ")),
@@ -57,8 +59,22 @@ export function discoverTaskGuards(registry, ctx, rawBridge) {
         // bridge happened to be built first. cc.bridge is the RAW bridge of the
         // session serving this call, so a guard can neither recurse through the
         // pipeline nor act on another project's editor.
+        // The raw bridge, gated. Raw is deliberate and stays: a guard task must
+        // not re-enter the flow pipeline that is running it. That is a statement
+        // about the registry, not about dialogs, and taking it to mean both left
+        // guard tasks as the one route that reached a parked game thread
+        // unrefused, where every call hung until it timed out. DialogGatedBridge
+        // puts the gate back with no pipeline attached, and
+        // withoutDialogActuation stays on top because set_dialog_policy is
+        // modal-safe in the plugin, so a guard task could otherwise arm a policy
+        // that answers the modal already on screen.
         contextFor: (cc) => cc.session
-            ? { ...ctx, bridge: cc.bridge, project: cc.session.project, session: cc.session }
+            ? {
+                ...ctx,
+                bridge: withoutDialogActuation(cc.session, new DialogGatedBridge(cc.bridge, cc.session)),
+                project: cc.session.project,
+                session: cc.session,
+            }
             : { ...ctx, bridge: rawBridge },
         optionsFor: (cc, result) => ({
             method: cc.method,

package/dist/flow/task-guards.js.map

@@ -1 +1 @@
-{"version":3,"file":"task-guards.js","sourceRoot":"","sources":["../../src/flow/task-guards.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,kBAAkB,IAAI,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAMrF,OAAO,EAAE,UAAU,EAAgE,MAAM,YAAY,CAAC;AACtG,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAExC,0EAA0E;AAC1E,MAAM,YAAY,GAAW;IAC3B,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9D,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7D,KAAK,EAAE,GAAG,EAAE,CAAC,YAAY;CAC1B,CAAC;AAEF,mFAAmF;AACnF,MAAM,UAAU,uBAAuB,CAAC,OAAuB;IAC7D,OAAO,CAAC,WAAmB,EAAiB,EAAE;QAC5C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,OAAO,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;YACpD,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAsB,EACtB,GAAgB,EAChB,SAAkB;IAElB,OAAO,qBAAqB,CAAuB,QAAQ,EAAE;QAC3D,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE;QAE7B,2EAA2E;QAC3E,wEAAwE;QACxE,wEAAwE;QACxE,gDAAgD;QAChD,UAAU,EAAE,CAAC,EAAE,EAAe,EAAE,CAC9B,EAAE,CAAC,OAAO;YACR,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE;YACjF,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE;QAEnC,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3B,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,EAAE,CAAC,UAAU,EAAE;YACtB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC;QAEF,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,OAAO,IAAI,QAAQ,CACjB,SAAS,CAAC,aAAa,EACvB,YAAY,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,EAAE,CACvD,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAChB,IAAI,QAAQ,CACV,SAAS,CAAC,aAAa,EACvB,UAAU,IAAI,CAAC,KAAK,gBAAgB,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CACtE;QAEH,gFAAgF;QAChF,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE,CACvB,KAAK,CAAC,OAAO,EAAE,gBAAgB,IAAI,CAAC,KAAK,yBAAyB,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAEtG,MAAM,EAAE,YAAY;KACrB,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"task-guards.js","sourceRoot":"","sources":["../../src/flow/task-guards.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,kBAAkB,IAAI,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAMrF,OAAO,EAAE,UAAU,EAAgE,MAAM,YAAY,CAAC;AACtG,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,0EAA0E;AAC1E,MAAM,YAAY,GAAW;IAC3B,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9D,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7D,KAAK,EAAE,GAAG,EAAE,CAAC,YAAY;CAC1B,CAAC;AAEF,mFAAmF;AACnF,MAAM,UAAU,uBAAuB,CAAC,OAAuB;IAC7D,OAAO,CAAC,WAAmB,EAAiB,EAAE;QAC5C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,OAAO,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;YACpD,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAsB,EACtB,GAAgB,EAChB,SAAkB;IAElB,OAAO,qBAAqB,CAAuB,QAAQ,EAAE;QAC3D,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE;QAE7B,2EAA2E;QAC3E,wEAAwE;QACxE,wEAAwE;QACxE,gDAAgD;QAChD,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,iEAAiE;QACjE,yEAAyE;QACzE,oDAAoD;QACpD,mEAAmE;QACnE,yEAAyE;QACzE,4CAA4C;QAC5C,UAAU,EAAE,CAAC,EAAE,EAAe,EAAE,CAC9B,EAAE,CAAC,OAAO;YACR,CAAC,CAAC;gBACE,GAAG,GAAG;gBACN,MAAM,EAAE,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;gBACxF,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO;gBAC3B,OAAO,EAAE,EAAE,CAAC,OAAO;aACpB;YACH,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE;QAEnC,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3B,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,EAAE,CAAC,UAAU,EAAE;YACtB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC;QAEF,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,OAAO,IAAI,QAAQ,CACjB,SAAS,CAAC,aAAa,EACvB,YAAY,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,EAAE,CACvD,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAChB,IAAI,QAAQ,CACV,SAAS,CAAC,aAAa,EACvB,UAAU,IAAI,CAAC,KAAK,gBAAgB,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CACtE;QAEH,gFAAgF;QAChF,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE,CACvB,KAAK,CAAC,OAAO,EAAE,gBAAgB,IAAI,CAAC,KAAK,yBAAyB,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAEtG,MAAM,EAAE,YAAY;KACrB,CAAC,CAAC;AACL,CAAC"}

package/dist/index.js

@@ -9,7 +9,7 @@ import { resolveContextStrategy, applyLeanContext, buildMicroGateway } from "./l
 import { routeEditorCall, effectiveTaskName, refuseUntargetedInRegistry, editorAttribution, } from "./editor-gate.js";
 import { injectEditorTarget, removeEditorTarget, injectMigrateTarget, removeMigrateTarget, stripEditorTarget, sessionContext, EDITOR_TARGET_PARAM, } from "./types.js";
 import { McpError, ErrorCode } from "./errors.js";
-import { gateForDialog, reshapeDialogRefusal, noteDialogBlocking, isDialogRefusal, } from "./dialog-gate.js";
+import { DialogGuard, guardFor, existingGuard, isDialogRefusal, stampBlockedEditor, } from "./dialog-guard.js";
 import { resolveDialogMode, clientAdvertisesElicitation } from "./editor-control.js";
 import { info, warn, debug } from "./log.js";
 import { startVersionCheck, consumeUpgradeNotice } from "./version-check.js";
@@ -29,7 +29,8 @@ import { ALL_TOOLS, setLiveToolGraph } from "./tools.js";
 import { nearestActions } from "./action-schema.js";
 import { enrichToolsWithEpicCatalog } from "./epic-enrich.js";
 import { checkPluginFreshness } from "./plugin-freshness.js";
-import { saveCatalogCache, loadCatalogCache, loadBakedCatalog } from "./epic-cache.js";
+import { readEngineSnapshot } from "./engine-observer.js";
+import { saveCatalogCache, loadCatalogCache, loadBakedCatalog, catalogOrRefusal, } from "./epic-cache.js";
 import { baseGraphFor, unionSurface, unionKnowledge, explainMissingAction, } from "./session-surface.js";
 function withUpgradeNotice(content) {
     const notice = consumeUpgradeNotice();
@@ -162,6 +163,13 @@ async function main() {
     const surfaces = [];
     const perSession = new Map();
     for (const session of sessions.list()) {
+        // BEFORE the surface build, which calls epic_list_toolsets on the editor.
+        // Creating guards afterwards meant the first call this server ever makes
+        // was the one call with no guard behind it: a modal refused it, the
+        // refusal has no toolsets, and the surface silently fell back to a cached
+        // one with nothing latched. startWatching is idempotent, so the later
+        // pass over sessions.list() stays harmless.
+        dialogGuardFor(session);
         const load = await buildSessionLoad(session, pkg.version, sessions.size > 1);
         perSession.set(session, load);
         surfaces.push(load.surface);
@@ -311,6 +319,35 @@ async function main() {
     // registry starts empty (pass-through) and is populated once the task
     // registry exists, below.
     const guardedBridge = primary.guarded;
+    /**
+     * The dialog guard for one editor, created on first use and kept.
+     *
+     * Watching starts with the guard, so a modal raised while the session sits
+     * idle is known before anything is called: the plugin refreshes its status
+     * file from the modal-loop tick, which is the tick that keeps running while
+     * the game thread is parked.
+     */
+    function dialogGuardFor(forSession, canElicit = false) {
+        const guard = guardFor(forSession, {
+            mode: () => resolveDialogMode({ projectDir: forSession.projectDir, canElicit }).mode,
+            probe: () => forSession.guarded.call("list_dialogs", {}),
+            press: (buttonLabel) => forSession.guarded.call("respond_to_dialog", { buttonLabel }),
+            elicit: () => (canElicit ? ctx.elicit : undefined),
+            isConnected: () => forSession.bridge.isConnected,
+            // The instance-aware reader, not a second one: it prefers
+            // status.<pid>.json over the shared file two editors of one project take
+            // turns writing, and it reports how old the snapshot is so a leftover
+            // from a crashed editor is not mistaken for a live modal.
+            readSnapshot: () => {
+                const proj = forSession.project.projectPath
+                    ?? forSession.bridge.getTarget().projectPath
+                    ?? null;
+                return proj ? readEngineSnapshot(proj) : null;
+            },
+        });
+        guard.startWatching();
+        return guard;
+    }
     const getToolGraph = (forSession = primary) => {
         const load = perSession.get(forSession);
         // D1 again. A session whose surface failed to build has no graph of its
@@ -378,6 +415,11 @@ async function main() {
     };
     for (const load of loads)
         discoverGuardsFor(load);
+    // A guard per registered editor, so a modal in the DESTINATION of a
+    // cross-editor call is seen by that editor's own guard rather than by
+    // whichever session happened to originate the call.
+    for (const s of sessions.list())
+        dialogGuardFor(s);
     /**
      * The dispatch surface for one session, built on demand (D1).
      *
@@ -421,6 +463,10 @@ async function main() {
     // its own surface exists.
     sessions.prepareSession = async (session) => {
         await ensureSessionLoad(session);
+        // Its own guard and its own watcher, before it is addressable. Without
+        // this an editor added at runtime had nothing watching it, so a modal
+        // there was never detected at all until a call happened to be routed in.
+        dialogGuardFor(session);
     };
     for (const session of sessions.list()) {
         if (session.guards.size === 0)
@@ -549,24 +595,17 @@ async function main() {
                     isError: true,
                 };
             }
-            // THE DIALOG GATE, server half. The plugin refuses anything that needs
-            // the editor while a modal is up; this covers what never reaches it, so
-            // there is no action anywhere that quietly works around a stuck editor.
-            //
-            // The dialog handling mode is resolved HERE, per call, so it governs the
-            // whole surface rather than the two lifecycle actions that used to be
-            // the only things that consulted it.
+            // One guard per editor, shared by every route. The mode is read per
+            // call, so changing it takes effect without restarting anything.
             const canElicit = clientAdvertisesElicitation(ctx.elicit);
-            const gated = await gateForDialog(session, taskName, {
-                mode: resolveDialogMode({ projectDir: session.projectDir, canElicit }).mode,
-                probe: () => session.guarded.call("list_dialogs", {}),
-                press: (buttonLabel) => session.guarded.call("respond_to_dialog", { buttonLabel }),
-                elicit: canElicit ? ctx.elicit : undefined,
-            });
-            if (gated) {
+            const guard = dialogGuardFor(session, canElicit);
+            // Actions served in this process never reach the bridge, so the bridge
+            // boundary cannot refuse them. Same guard, same decision.
+            const preflight = await guard.check(effectiveTaskName(tool, params), "action");
+            if (!preflight.allow) {
                 return {
                     content: withUpgradeNotice([
-                        { type: "text", text: JSON.stringify(gated, null, 2) },
+                        { type: "text", text: JSON.stringify(preflight.refusal, null, 2) },
                     ]),
                     isError: true,
                 };
@@ -648,10 +687,27 @@ async function main() {
             }
             try {
                 const task = await sessionRegistry.create(taskName, flowCtx, taskParams);
-                // Locks are acquired in the editor the call runs in, so they must be
-                // taken on that session's bridge rather than the process default.
-                const result = await withAssetLocks(session.bridge, lockingCfg, taskName, taskParams, () => task.run(), session.lockOwnerId);
-                if (!result.success) {
+                // Locks are acquired in the editor the call runs in, and through the
+                // GUARDED bridge, so a lock request made while a modal is up is
+                // refused as a dialog rather than reported as somebody else holding
+                // the asset.
+                const result = await withAssetLocks(session.guarded, lockingCfg, taskName, taskParams, () => task.run(), session.lockOwnerId);
+                // A handler that makes several bridge calls can swallow a refusal and
+                // still report success, so ask the guard what it learned rather than
+                // trusting the shape. Nothing is re-run: the call already applied
+                // whatever it applied, and replaying it would double-apply.
+                // A task that failed for its own reasons reports that, not a dialog.
+                //
+                // But a failure DURING a modal is usually caused by it: the game thread
+                // is parked, so the call times out and the error says the editor was
+                // busy and suggests a bigger timeoutMs, which is the retry loop this
+                // gate exists to end. The task runner returns no data on a throw, so
+                // the refusal cannot be recognised from the result: ask the guard.
+                const failedUnderDialog = !result.success
+                    && !isDialogRefusal(result.data)
+                    && !DialogGuard.actionAllowed(effectiveTaskName(tool, params))
+                    && (await guard.check(effectiveTaskName(tool, params), "action")).allow === false;
+                if (!result.success && !isDialogRefusal(result.data) && !failedUnderDialog) {
                     const msg = result.error?.message ?? `Task ${taskName} failed`;
                     return {
                         content: withUpgradeNotice([
@@ -662,56 +718,71 @@ async function main() {
                         isError: true,
                     };
                 }
-                // The plugin's own gate refuses anything needing the editor, and it
-                // does not know this machine's dialog mode. Reshaping its refusal here
-                // is what stops the mode applying to some calls and not others: the
-                // first blocked call would otherwise get the plugin's wording and the
-                // next one, caught by the latch, would get the mode's.
-                if (isDialogRefusal(result.data)) {
-                    const info = {
-                        dialogTitle: String(result.data.dialogTitle ?? ""),
-                        dialogMessage: String(result.data.dialogMessage ?? ""),
-                        buttons: Array.isArray(result.data.buttons) ? result.data.buttons : [],
-                        choices: Array.isArray(result.data.choices)
-                            ? result.data.choices
-                            : [],
-                    };
-                    noteDialogBlocking(session, info);
-                    const reshaped = await reshapeDialogRefusal(session, taskName, info, {
-                        mode: resolveDialogMode({ projectDir: session.projectDir, canElicit }).mode,
-                        probe: () => session.guarded.call("list_dialogs", {}),
-                        press: (buttonLabel) => session.guarded.call("respond_to_dialog", { buttonLabel }),
-                        elicit: canElicit ? ctx.elicit : undefined,
-                    });
-                    if (reshaped) {
+                // An allow-listed read still SAYS a dialog is up. get_status is the
+                // first call every client makes, and reporting a healthy editor while
+                // the game thread is parked is the one answer it must never give.
+                if (DialogGuard.actionAllowed(effectiveTaskName(tool, params))) {
+                    // respond_to_dialog may have just cleared it. Nothing re-probes for
+                    // an allow-listed bridge method (guardCall returns before check, and
+                    // observe refuses to clear on a modal-safe reply), so this call came
+                    // back stamped as blocked and told the caller to make the call it had
+                    // just made.
+                    if (effectiveTaskName(tool, params) === "editor.respond_to_dialog" && result.success) {
+                        // refresh, NOT check. check applies the mode, so in interactive it
+                        // raised a form for whatever prompt this answer surfaced and
+                        // pressed a button on it, unasked, and then threw the decision
+                        // away. Only the state needs correcting here.
+                        await guard.refresh();
+                    }
+                    const seen = guard.current;
+                    if (result.success)
+                        stampBlockedEditor(result.data, seen);
+                }
+                // Whatever the route, the caller gets ONE refusal shape, built here.
+                //
+                // A modal appearing between the preflight and the inner call means the
+                // plugin refuses, and its payload lands in result.data. Passing that
+                // through handed the caller a second shape with no dialogMode and, in
+                // defer, the very press calls defer exists to withhold.
+                //
+                // Actions allowed through a modal are exempt: reading the dialog and
+                // answering it must not come back refused because of the dialog they
+                // are about.
+                if (!DialogGuard.actionAllowed(effectiveTaskName(tool, params))) {
+                    const fromPlugin = isDialogRefusal(result.data)
+                        ? result.data
+                        : null;
+                    if (fromPlugin)
+                        guard.observe("__refused__", fromPlugin);
+                    const blocking = guard.current;
+                    if (blocking) {
+                        // A refusal means nothing ran. Anything else means the call had
+                        // already started when the dialog appeared, so it may have applied
+                        // part of its work; say so rather than implying it did nothing.
+                        const started = fromPlugin === null;
                         return {
                             content: withUpgradeNotice([
-                                { type: "text", text: JSON.stringify(reshaped, null, 2) },
+                                {
+                                    type: "text",
+                                    text: JSON.stringify(started
+                                        ? {
+                                            ...guard.refusal(effectiveTaskName(tool, params), blocking),
+                                            partiallyApplied: true,
+                                            note: `'${taskName}' had already started when the dialog appeared, so it may `
+                                                + "have applied some of its changes. Answer the dialog, then read the "
+                                                + "state back before deciding whether to run it again.",
+                                            // Whatever it did manage to return, kept rather than
+                                            // dropped: a mutation that completed still has the
+                                            // path it created in here.
+                                            partialResult: result.data ?? null,
+                                        }
+                                        : guard.refusal(effectiveTaskName(tool, params), blocking), null, 2),
+                                },
                                 ...attribution(session),
                             ]),
                             isError: true,
                         };
                     }
-                    // Answered through the elicitation form, so the dialog is gone and
-                    // the caller is told to make the call again rather than being handed
-                    // a refusal that is no longer true.
-                    return {
-                        content: withUpgradeNotice([
-                            {
-                                type: "text",
-                                text: JSON.stringify({
-                                    success: false,
-                                    dialogAnswered: true,
-                                    dialogTitle: info.dialogTitle,
-                                    retry: taskName,
-                                    note: "The blocking dialog was answered by the user, so the editor is running "
-                                        + `again. '${taskName}' did not run; call it again.`,
-                                }, null, 2),
-                            },
-                            ...attribution(session),
-                        ]),
-                        isError: true,
-                    };
                 }
                 const stringify = (v) => typeof v === "string" ? v : JSON.stringify(v, null, 2);
                 // Preserve directive responses (execute_python workaround tracking).
@@ -740,6 +811,26 @@ async function main() {
                 };
             }
             catch (e) {
+                // A refusal can arrive as a throw: acquiring an asset lock is a bridge
+                // call, so it is refused like any other, and locking reports failure by
+                // throwing. Shaped through the guard so a caller gets the same payload
+                // whether the refusal came back as a result or as an exception.
+                const thrownRefusal = e instanceof McpError && isDialogRefusal(e.details)
+                    ? e.details
+                    : null;
+                if (thrownRefusal) {
+                    guard.observe("__refused__", thrownRefusal);
+                    const blocking = guard.current;
+                    if (blocking) {
+                        return {
+                            content: withUpgradeNotice([
+                                { type: "text", text: JSON.stringify(guard.refusal(effectiveTaskName(tool, params), blocking), null, 2) },
+                                ...attribution(session),
+                            ]),
+                            isError: true,
+                        };
+                    }
+                }
                 const msg = e instanceof Error ? e.message : String(e);
                 const code = e instanceof McpError ? e.code : "UNKNOWN";
                 return {
@@ -820,6 +911,21 @@ async function main() {
                     isError: true,
                 };
             }
+            // The flow tool reaches the editor through the same guarded bridge, so
+            // its steps are refused individually. This covers the run being STARTED
+            // while a modal is already up, and flow(list)/flow(plan), which are
+            // in-process and never touch the bridge at all.
+            const flowGuard = dialogGuardFor(session, clientAdvertisesElicitation(ctx.elicit));
+            const flowCheck = await flowGuard.check(`${flowTool.name}.${String(params.action ?? "")}`, "action");
+            if (!flowCheck.allow) {
+                return {
+                    content: withUpgradeNotice([
+                        { type: "text", text: JSON.stringify(flowCheck.refusal, null, 2) },
+                        ...attribution(session),
+                    ]),
+                    isError: true,
+                };
+            }
             const result = await flowTool.handler(sessionContext(ctx, session), params);
             const text = typeof result === "string" ? result : JSON.stringify(result, null, 2);
             return { content: withUpgradeNotice([{ type: "text", text }, ...attribution(session)]) };
@@ -913,12 +1019,29 @@ async function buildSessionLoad(session, packageVersion, multi) {
             // its own.
             let catalog = null;
             let source = "";
-            const bridge = session.bridge;
-            if (!bridge.isConnected) {
-                await bridge.connect(2000).catch(() => { });
+            // The guarded bridge, not the raw one. This is the first call the server
+            // makes against an editor, so sending it raw meant a modal was met by
+            // the one route with no gate on it: the refusal came back, the surface
+            // fell back to a cache, and nothing was latched for the calls that
+            // followed.
+            const bridge = session.guarded;
+            if (!session.bridge.isConnected) {
+                await session.bridge.connect(2000).catch(() => { });
             }
-            if (bridge.isConnected) {
+            if (session.bridge.isConnected) {
                 catalog = (await bridge.call("epic_list_toolsets", { includeSchemas: true }, 20000));
+                // A modal refuses this like anything else, and the refusal has no
+                // toolsets, so it read as "this editor advertises none" and the surface
+                // silently fell back to a cache. Say what actually happened, and let
+                // the guard learn from it rather than swallowing the evidence.
+                const read = catalogOrRefusal(catalog);
+                if (read.refusedByDialog) {
+                    existingGuard(session)?.observe("epic_list_toolsets", catalog);
+                    warn("epic", `${session.name}: the Epic toolset list was refused because a modal dialog is blocking `
+                        + "the editor, so its tools are being taken from the cache. Answer the dialog and "
+                        + "re-register the editor to pick up the live set.");
+                }
+                catalog = read.catalog;
                 if (catalog?.toolsets?.length) {
                     saveCatalogCache(configDir, catalog, project.engineAssociation);
                     source = "live editor";