monkeybot 3.13.0__tar.gz → 3.14.0__tar.gz

{monkeybot-3.13.0 → monkeybot-3.14.0}/CHANGELOG.md

@@ -6,6 +6,27 @@ the project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [core v3.14.0] - 2026-11-04
+
+### Added
+
+- An MCP server a chat does not use for ten model turns is hidden from that chat. The connection stays up for other chats and for subagents. `enable_mcp` shows that server's tools again. A call to a hidden server is rejected.
+
+### Fixed
+
+- A message sent while a background subagent is still running is answered. It is not treated as a request for the child's result. `await_task` runs when the user asks for that result, or when a harness note says the child has finished.
+
+## [cli v0.13.0] - 2026-11-01
+
+### Added
+
+- Chat renders a turn the gateway starts while the prompt is idle, including the follow-up when a background subagent finishes. A message sent during that turn reports the session as busy.
+
+### Fixed
+
+- `monkeybot doctor` points a config-only tree at the Pillow overrides file shipped with the CLI. A bare `uv tool install` still resolves core 3.10.0.
+- New coding scaffolds tell the image generator to use the `skills` path from `list_skills` instead of an absolute host directory.
+
 ## [core v3.13.0] - 2026-11-01
 
 ### Added

{monkeybot-3.13.0 → monkeybot-3.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: monkeybot
-Version: 3.13.0
+Version: 3.14.0
 Summary: monkeybot agent harness — FastAPI SSE gateway, owned loop, SQLite, and MCP.
 License: MIT
 License-File: LICENSE

{monkeybot-3.13.0 → monkeybot-3.14.0}/cli/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "monkeybot-cli"
-version = "0.12.0"
+version = "0.13.0"
 description = "CLI to create, configure, validate, and chat with monkeybot agents."
 requires-python = ">=3.11"
 dependencies = [

{monkeybot-3.13.0 → monkeybot-3.14.0}/docs/testing.md

@@ -545,6 +545,21 @@ Existing unit coverage: `tests/unit/core/context`, `tests/unit/core/mcp`.
 | T2-MCP-09 | Catalog diff reload | Edit `mcp.json`: changed server reconnects; bad JSON keeps existing connections. | T2 | P1 | `core/mcp/mcp_client.py`, `oauth_flow.py`, `_tool_enable_mcp` / `_tool_disable_mcp`, progressive meta-tools, `apply_catalog_diff`. | regression/t2/loop/scenarios/mcp/catalog_diff_reload.yaml |
 | T2-MCP-10 | Enable unknown server | Not in catalog: error string (pinned; not an envelope). | T2 | P1 | `core/mcp/mcp_client.py`, `oauth_flow.py`, `_tool_enable_mcp` / `_tool_disable_mcp`, progressive meta-tools, `apply_catalog_diff`. | regression/t2/loop/scenarios/mcp/enable_unknown_server.yaml |
 | T2-MCP-11 | Disabled server not catalogued | `enabled: false`: not offered. | T2 | P1 | `core/mcp/mcp_client.py`, `oauth_flow.py`, `_tool_enable_mcp` / `_tool_disable_mcp`, progressive meta-tools, `apply_catalog_diff`. | regression/t2/loop/scenarios/mcp/disabled_server_not_catalogued.yaml |
+| T2-MCP-12 | Idle hides after ten | Ten inner turns offering `fixture__echo` without calling it hide it. The next request excludes the tool and the tool result contains the idle note. | T2 | P1 | `core/mcp/session_visibility.py`, turn loop idle count, tool-batch hide. | regression/t2/loop/scenarios/mcp/idle_hides_after_ten.yaml |
+| T2-MCP-13 | Use resets idle count | Nine idle turns, one `fixture__echo`, nine more idle turns: the tool is still listed. | T2 | P1 | `core/mcp/session_visibility.py`, turn loop idle count, tool-batch hide. | regression/t2/loop/scenarios/mcp/use_resets_idle_count.yaml |
+| T2-MCP-14 | Enable restores hidden | After a hide, `enable_mcp fixture` puts `fixture__echo` back on the next request. | T2 | P1 | `core/mcp/session_visibility.py`, turn loop idle count, tool-batch hide. | regression/t2/loop/scenarios/mcp/enable_restores_hidden.yaml |
+| T2-MCP-15 | Hidden tool call rejected | A call to a hidden server returns an error naming `enable_mcp`. `list_mcp_resources` with no server skips it. | T2 | P1 | `core/mcp/session_visibility.py`, turn loop idle count, tool-batch hide. | regression/t2/loop/scenarios/mcp/hidden_tool_call_rejected.yaml |
+| T2-MCP-16 | Idle count spans user messages | Six idle inner turns in one user message plus four in the next hide the server during the second message. | T2 | P1 | `core/mcp/session_visibility.py`, turn loop idle count, tool-batch hide. | regression/t2/loop/scenarios/mcp/idle_count_spans_user_messages.yaml |
+| T2-MCP-17 | Only idle server hidden | Of `fix` and `fix__extra`, calling only `fix` hides `fix__extra__echo`. | T2 | P1 | `core/mcp/session_visibility.py`, turn loop idle count, tool-batch hide. | regression/t2/loop/scenarios/mcp/only_idle_server_hidden.yaml |
+| T2-MCP-18 | Enable other keeps hidden | After `fix__extra` is hidden, `enable_mcp fix` leaves `fix__extra__echo` excluded. | T2 | P1 | `core/mcp/session_visibility.py`, turn loop idle count, tool-batch hide. | regression/t2/loop/scenarios/mcp/enable_other_keeps_hidden.yaml |
+| T2-MCP-19 | Meta tools drop when all hidden | Once every connected server is hidden, `list_mcp_resources` is excluded. | T2 | P1 | `core/mcp/session_visibility.py`, turn loop idle count, tool-batch hide. | regression/t2/loop/scenarios/mcp/meta_tools_drop_when_all_hidden.yaml |
+| T2-MCP-20 | Session isolation | Hiding a server in one session leaves it connected and listed for another session. | T2 | P1 | `core/mcp/session_visibility.py`, turn loop idle count, tool-batch hide. | regression/t2/python/test_mcp_idle_hide.py |
+| T2-MCP-21 | Note stays in the tool result | The idle note is inside the tool result. It is not a new user message and does not replace the current request. | T2 | P1 | `core/mcp/session_visibility.py`, turn loop idle count, tool-batch hide. | regression/t2/python/test_mcp_idle_hide.py |
+| T2-MCP-22 | No-tool turn does not count | A doom-loop recovery turn sent with no tools does not advance the idle count. | T2 | P1 | `core/mcp/session_visibility.py`, turn loop idle count, tool-batch hide. | regression/t2/python/test_mcp_idle_hide.py |
+| T2-MCP-23 | Aborted batch does not hide | Cancelling the tool batch that reaches the idle limit does not hide the server or write the note. | T2 | P1 | `core/mcp/session_visibility.py`, turn loop idle count, tool-batch hide. | regression/t2/python/test_mcp_idle_hide.py |
+| T2-MCP-24 | Voice does not hide | A voice turn does not hide a server that has reached the idle limit. A voice call of that server resets the count. | T2 | P1 | `core/mcp/session_visibility.py`, turn loop idle count, tool-batch hide. | regression/t2/python/test_mcp_idle_hide.py |
+| T2-MCP-25 | Second chat still sees the server | After one chat hides a connected server, the next chat's request still includes its tools and a call returns. | T2 | P1 | `core/mcp/session_visibility.py`, per-session tool list, shared MCP client. | regression/t2/loop/scenarios/mcp/second_session_still_sees_server.yaml |
+| T2-MCP-26 | Subagent keeps calling | After the parent hides a server, a subagent's own connection still calls it and the result reaches the parent. | T2 | P1 | `core/mcp/session_visibility.py`, subagent worker MCP client. | regression/t2/loop/scenarios/mcp/child_keeps_calling_hidden_server.yaml |
 | T3-MCP-01 | Replay tools list call | Recorded `tools/list` + `tools/call` JSON: same prefixed names and normalized result text. | T3 | P1 | `core/mcp/mcp_client.py`, `oauth_flow.py`, `_tool_enable_mcp` / `_tool_disable_mcp`, progressive meta-tools, `apply_catalog_diff`. | regression/t3/test_replay_mcp.py |
 | T4-MCP-01..03 | Mcp/* | autoConnect path as today. | T4 | P1 | `core/mcp/mcp_client.py`, `oauth_flow.py`, `_tool_enable_mcp` / `_tool_disable_mcp`, progressive meta-tools, `apply_catalog_diff`. | regression/t4/scenarios/mcp/tool_invoke.yaml, regression/t4/scenarios/mcp/list_resources.yaml, regression/t4/scenarios/mcp/get_prompt.yaml |
 | T4-MCP-04 | Enable then echo live | Progressive config: `required_tools: [enable_mcp, fixture__echo]`, `max_tool_errors: 0`. | T4 | P1 | `core/mcp/mcp_client.py`, `oauth_flow.py`, `_tool_enable_mcp` / `_tool_disable_mcp`, progressive meta-tools, `apply_catalog_diff`. | regression/t4/scenarios/mcp/enable_then_echo_live.yaml |

{monkeybot-3.13.0 → monkeybot-3.14.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "monkeybot"
-version = "3.13.0"
+version = "3.14.0"
 description = "monkeybot agent harness — FastAPI SSE gateway, owned loop, SQLite, and MCP."
 requires-python = ">=3.11"
 readme = "README.md"

{monkeybot-3.13.0 → monkeybot-3.14.0}/regression/drivers/bundles/mcp.py

@@ -91,6 +91,9 @@ class _McpBundle(Bundle):
                 "MCP_CONFIG needs executor: real so the fixture server has a workspace"
             )
         ctx.mcp_client, ctx.mcp_path = await _open_mcp(ctx.env, ctx.cfg, ctx.workspace)
+        # Subagents read MCP_CONFIG, not the parent client. Point them at the
+        # expanded copy this process actually loaded.
+        ctx.env["MCP_CONFIG"] = str(ctx.mcp_path)
         ctx.advertised, ctx.catalog = _advertised_tools(ctx.mcp_client)
 
     async def close(self, ctx: RunCtx) -> None:

{monkeybot-3.13.0 → monkeybot-3.14.0}/regression/drivers/bundles/protocol.py

@@ -36,6 +36,7 @@ class RunCtx:
     pristine: Path | None = None
     hook_memory: Any = None
     read_ledger: Any = None
+    mcp_visibility: Any = None
     mcp_client: Any = None
     mcp_path: Path | None = None
     advertised: list[Any] | None = None

{monkeybot-3.13.0 → monkeybot-3.14.0}/regression/drivers/bundles/session.py

@@ -13,6 +13,7 @@ from monkeybot.core.context import TurnContext
 from monkeybot.core.context.slash_skills import apply_invoked_skill
 from monkeybot.core.hooks import HookManager
 from monkeybot.core.layout import resolve_agent_path
+from monkeybot.core.mcp.session_visibility import MCPSessionVisibility
 from monkeybot.core.memory.subsystem import MemorySubsystem
 from monkeybot.core.persistence.backends import ScheduledLoopStore
 from monkeybot.core.persistence.scheduled_loops import KIND_GOAL, KIND_LOOP
@@ -254,6 +255,7 @@ class _SessionBundle(Bundle):
         if "memory" in ctx.hook_names and not _scenario_memory_disabled(ctx.scenario):
             root = ctx.workdir / "memory"
             ctx.hook_memory = _memory_subsystem(root, drawers, db_url=_scenario_sqlite_url(ctx))
+        ctx.mcp_visibility = MCPSessionVisibility()
         if ctx.scenario.executor != "real":
             if _PATCH_FAIL_ENV in ctx.env:
                 raise LoopDriverError(f"{_PATCH_FAIL_ENV} needs executor: real")
@@ -297,9 +299,9 @@ class _SessionBundle(Bundle):
         if policy is not None and policy.allowed_commands is not None:
             policy_kwargs["run_command_allowed_commands"] = policy.allowed_commands
             policy_kwargs["run_command_allowed_path_prefixes"] = policy.allowed_path_prefixes
+        from monkeybot.core.config.settings import get_subagent_settings
         from monkeybot.core.subagents.supervisor import SubagentSupervisor
         from monkeybot.core.tools.core_tool_executor import _run_inline_subagent_with_progress
-        from monkeybot.core.config.settings import get_subagent_settings
 
         settings = get_subagent_settings(config=ctx.cfg)
         supervisor = SubagentSupervisor(

{monkeybot-3.13.0 → monkeybot-3.14.0}/regression/drivers/loop.py

@@ -21,9 +21,11 @@ from monkeybot.core.context import (
     PendingResponseBusPort,
     TurnContext,
     _core_tool_defs,
+    refresh_tools_after_mcp_change,
 )
 from monkeybot.core.hooks import HookManager
 from monkeybot.core.llm.provider import ToolCall
+from monkeybot.core.mcp.session_visibility import MCPSessionVisibility
 from monkeybot.core.runtime.events import Error, TurnComplete, event_from_json
 from monkeybot.core.runtime.input_admission import InputAdmission
 from monkeybot.core.runtime.loop import run
@@ -269,6 +271,7 @@ async def _run(scenario: Scenario, workdir: Path) -> LoopRun:
                 project_instructions=ctx.project_instructions,
                 repo_overview=ctx.repo_overview,
                 session_id=ctx.session_id,
+                mcp_visibility=ctx.mcp_visibility,
                 attachment_store=ctx.attachment_store,
                 computer_inspector=ctx.computer_inspector,
             )
@@ -328,6 +331,7 @@ async def _drive(
     project_instructions: str = "",
     repo_overview: str = "",
     session_id: str = _SESSION_ID,
+    mcp_visibility: MCPSessionVisibility | None = None,
     attachment_store: Any = None,
     computer_inspector: Any = None,
 ) -> tuple[list[object], list[_SessionSlice] | None]:
@@ -411,6 +415,7 @@ async def _drive(
         event_publisher=publisher,
         grants_persist=grants_persist,
         approvals_persist=approvals_persist,
+        mcp_visibility=mcp_visibility,
     )
     turn = apply_project_context(
         turn,
@@ -426,7 +431,18 @@ async def _drive(
         thread_id = session_id if not multi else f"{session_id}-{session_index}"
         bindings.history = active_history
         bindings.thread_id = thread_id
-        turn = replace(turn, thread_id=thread_id)
+        # One tracker per scenario session, kept across that session's user messages.
+        session_visibility = (
+            mcp_visibility
+            if session_index == 1 and mcp_visibility is not None
+            else MCPSessionVisibility()
+        )
+        turn = replace(turn, thread_id=thread_id, mcp_visibility=session_visibility)
+        # Production builds each chat's tool list from the shared client. The
+        # first session's hide mutates this list in place; the next session
+        # has to see the servers that are still connected.
+        if session_index > 1 and live.mcp is not None:
+            refresh_tools_after_mcp_change(turn, live.mcp)
         for nth, message in enumerate(session_messages, start=1):
             start = len(events)
             if multi:
@@ -503,6 +519,7 @@ def _turn_context(
     event_publisher: _SubagentPublisher | None = None,
     grants_persist: Callable[[str, str], bool] | None = None,
     approvals_persist: Callable[[str, str], bool] | None = None,
+    mcp_visibility: MCPSessionVisibility | None = None,
 ) -> TurnContext:
     advertised = list(tools) if tools is not None else _core_tool_defs(include_task_tool=True)
     names = {tool.name for tool in advertised}
@@ -536,6 +553,7 @@ def _turn_context(
         verdict_mailbox=verdict_mailbox,
         grants_persist=grants_persist,
         approvals_persist=approvals_persist,
+        mcp_visibility=mcp_visibility,
     )
 
 

monkeybot-3.14.0/regression/t2/loop/scenarios/mcp/child_calls_fixture.yml

@@ -0,0 +1,15 @@
+- - type: tool_call
+    call_id: c1
+    name: enable_mcp
+    args:
+      name: fixture
+  - type: done
+- - type: tool_call
+    call_id: c2
+    name: fixture__echo
+    args:
+      text: ping
+  - type: done
+- - type: text
+    text: Child echoed ping.
+  - type: done

monkeybot-3.14.0/regression/t2/loop/scenarios/mcp/child_keeps_calling_hidden_server.yaml

@@ -0,0 +1,114 @@
+id: regression/t2/loop/scenarios/mcp/child_keeps_calling_hidden_server
+case: T2-MCP-26
+description: A subagent keeps calling an MCP server after the parent chat has hidden it.
+mode: scripted
+driver: loop
+executor: real
+config:
+  model:
+    max_turns: 30
+  env:
+    MCP_CONFIG: regression/fixtures/configs/mcp.autoconnect.json
+    MONKEYBOT_SUBAGENT_SCRIPT: "{repo_root}/src/monkeybot/core/subagents/subagent_worker.py"
+    MONKEYBOT_CONFIG: "{repo_root}/regression/fixtures/configs/agent.base.yaml"
+    MONKEYBOT_FAKE_PROVIDER_SCRIPT: "{repo_root}/regression/t2/loop/scenarios/mcp/child_calls_fixture.yml"
+    AGENT_MD: "{repo_root}/regression/t4/agent/monkeybot_config/AGENT.md"
+    DB_URL: "sqlite:///{workspace}/child.db"
+messages:
+- Hide the fixture server, then ask a subagent to echo through it.
+script:
+- - type: tool_call
+    call_id: c0
+    name: list_dir
+    args:
+      path: .
+      nonce: 0
+  - type: done
+- - type: tool_call
+    call_id: c1
+    name: list_dir
+    args:
+      path: .
+      nonce: 1
+  - type: done
+- - type: tool_call
+    call_id: c2
+    name: list_dir
+    args:
+      path: .
+      nonce: 2
+  - type: done
+- - type: tool_call
+    call_id: c3
+    name: list_dir
+    args:
+      path: .
+      nonce: 3
+  - type: done
+- - type: tool_call
+    call_id: c4
+    name: list_dir
+    args:
+      path: .
+      nonce: 4
+  - type: done
+- - type: tool_call
+    call_id: c5
+    name: list_dir
+    args:
+      path: .
+      nonce: 5
+  - type: done
+- - type: tool_call
+    call_id: c6
+    name: list_dir
+    args:
+      path: .
+      nonce: 6
+  - type: done
+- - type: tool_call
+    call_id: c7
+    name: list_dir
+    args:
+      path: .
+      nonce: 7
+  - type: done
+- - type: tool_call
+    call_id: c8
+    name: list_dir
+    args:
+      path: .
+      nonce: 8
+  - type: done
+- - type: tool_call
+    call_id: c9
+    name: list_dir
+    args:
+      path: .
+      nonce: 9
+  - type: done
+- - type: tool_call
+    call_id: task1
+    name: task
+    args:
+      task: Echo ping through the fixture server.
+  - type: done
+- - type: text
+    text: Parent saw the child echo.
+  - type: done
+assertions:
+  provider_calls: 12
+  provider_request:
+  - n: 11
+    tools_exclude:
+    - fixture__echo
+  events_sequence:
+  - type: ToolCallResult
+    tool: task
+    result:
+      regex: "echo: ping"
+  subagent:
+    started: true
+    completed_ok: true
+  turn_completed: true
+  no_errors: true

monkeybot-3.14.0/regression/t2/loop/scenarios/mcp/enable_other_keeps_hidden.yaml

@@ -0,0 +1,93 @@
+id: regression/t2/loop/scenarios/mcp/enable_other_keeps_hidden
+case: T2-MCP-18
+description: Enabling one server does not bring back a different server this chat has hidden.
+mode: scripted
+driver: loop
+executor: real
+messages:
+- Hide the longer prefix, then enable the shorter one again.
+config:
+  model:
+    max_turns: 30
+  env:
+    MCP_CONFIG: regression/fixtures/configs/mcp.two_prefix.json
+script:
+- - type: tool_call
+    call_id: e0
+    name: fix__echo
+    args:
+      text: n0
+  - type: done
+- - type: tool_call
+    call_id: e1
+    name: fix__echo
+    args:
+      text: n1
+  - type: done
+- - type: tool_call
+    call_id: e2
+    name: fix__echo
+    args:
+      text: n2
+  - type: done
+- - type: tool_call
+    call_id: e3
+    name: fix__echo
+    args:
+      text: n3
+  - type: done
+- - type: tool_call
+    call_id: e4
+    name: fix__echo
+    args:
+      text: n4
+  - type: done
+- - type: tool_call
+    call_id: e5
+    name: fix__echo
+    args:
+      text: n5
+  - type: done
+- - type: tool_call
+    call_id: e6
+    name: fix__echo
+    args:
+      text: n6
+  - type: done
+- - type: tool_call
+    call_id: e7
+    name: fix__echo
+    args:
+      text: n7
+  - type: done
+- - type: tool_call
+    call_id: e8
+    name: fix__echo
+    args:
+      text: n8
+  - type: done
+- - type: tool_call
+    call_id: e9
+    name: fix__echo
+    args:
+      text: n9
+  - type: done
+- - type: tool_call
+    call_id: again
+    name: enable_mcp
+    args:
+      name: fix
+  - type: done
+- - type: text
+    text: "The other server stays hidden."
+  - type: done
+assertions:
+  provider_calls: 12
+  provider_request:
+  - n: 12
+    tools_include:
+    - fix__echo
+    tools_exclude:
+    - fix__extra__echo
+  turn_completed: true
+  no_errors: true

monkeybot-3.14.0/regression/t2/loop/scenarios/mcp/enable_restores_hidden.yaml

@@ -0,0 +1,110 @@
+id: regression/t2/loop/scenarios/mcp/enable_restores_hidden
+case: T2-MCP-14
+description: enable_mcp brings a hidden server's tools back on the next request.
+mode: scripted
+driver: loop
+executor: real
+messages:
+- Hide the fixture server, then enable it again.
+config:
+  model:
+    max_turns: 30
+  env:
+    MCP_CONFIG: regression/fixtures/configs/mcp.progressive.json
+script:
+- - type: tool_call
+    call_id: c0
+    name: enable_mcp
+    args:
+      name: fixture
+  - type: done
+- - type: tool_call
+    call_id: c1
+    name: list_dir
+    args:
+      path: .
+      nonce: 0
+  - type: done
+- - type: tool_call
+    call_id: c2
+    name: list_dir
+    args:
+      path: .
+      nonce: 1
+  - type: done
+- - type: tool_call
+    call_id: c3
+    name: list_dir
+    args:
+      path: .
+      nonce: 2
+  - type: done
+- - type: tool_call
+    call_id: c4
+    name: list_dir
+    args:
+      path: .
+      nonce: 3
+  - type: done
+- - type: tool_call
+    call_id: c5
+    name: list_dir
+    args:
+      path: .
+      nonce: 4
+  - type: done
+- - type: tool_call
+    call_id: c6
+    name: list_dir
+    args:
+      path: .
+      nonce: 5
+  - type: done
+- - type: tool_call
+    call_id: c7
+    name: list_dir
+    args:
+      path: .
+      nonce: 6
+  - type: done
+- - type: tool_call
+    call_id: c8
+    name: list_dir
+    args:
+      path: .
+      nonce: 7
+  - type: done
+- - type: tool_call
+    call_id: c9
+    name: list_dir
+    args:
+      path: .
+      nonce: 8
+  - type: done
+- - type: tool_call
+    call_id: c10
+    name: list_dir
+    args:
+      path: .
+      nonce: 9
+  - type: done
+- - type: tool_call
+    call_id: c-again
+    name: enable_mcp
+    args:
+      name: fixture
+  - type: done
+- - type: text
+    text: "Restored."
+  - type: done
+assertions:
+  provider_calls: 13
+  provider_request:
+  - n: 12
+    tools_exclude:
+    - fixture__echo
+  - n: 13
+    tools_include:
+    - fixture__echo
+  turn_completed: true
+  no_errors: true

monkeybot-3.14.0/regression/t2/loop/scenarios/mcp/hidden_tool_call_rejected.yaml

@@ -0,0 +1,124 @@
+id: regression/t2/loop/scenarios/mcp/hidden_tool_call_rejected
+case: T2-MCP-15
+description: A remembered call to a hidden server is rejected, and listing resources skips that server.
+mode: scripted
+driver: loop
+executor: real
+messages:
+- After the fixture server is hidden, call it anyway.
+config:
+  model:
+    max_turns: 30
+  env:
+    MCP_CONFIG: regression/fixtures/configs/mcp.progressive.json
+script:
+- - type: tool_call
+    call_id: c0
+    name: enable_mcp
+    args:
+      name: fixture
+  - type: done
+- - type: tool_call
+    call_id: c1
+    name: list_dir
+    args:
+      path: .
+      nonce: 0
+  - type: done
+- - type: tool_call
+    call_id: c2
+    name: list_dir
+    args:
+      path: .
+      nonce: 1
+  - type: done
+- - type: tool_call
+    call_id: c3
+    name: list_dir
+    args:
+      path: .
+      nonce: 2
+  - type: done
+- - type: tool_call
+    call_id: c4
+    name: list_dir
+    args:
+      path: .
+      nonce: 3
+  - type: done
+- - type: tool_call
+    call_id: c5
+    name: list_dir
+    args:
+      path: .
+      nonce: 4
+  - type: done
+- - type: tool_call
+    call_id: c6
+    name: list_dir
+    args:
+      path: .
+      nonce: 5
+  - type: done
+- - type: tool_call
+    call_id: c7
+    name: list_dir
+    args:
+      path: .
+      nonce: 6
+  - type: done
+- - type: tool_call
+    call_id: c8
+    name: list_dir
+    args:
+      path: .
+      nonce: 7
+  - type: done
+- - type: tool_call
+    call_id: c9
+    name: list_dir
+    args:
+      path: .
+      nonce: 8
+  - type: done
+- - type: tool_call
+    call_id: c10
+    name: list_dir
+    args:
+      path: .
+      nonce: 9
+  - type: done
+- - type: tool_call
+    call_id: hidden-echo
+    name: fixture__echo
+    args:
+      text: ping
+  - type: tool_call
+    call_id: hidden-list
+    name: list_mcp_resources
+    args: {}
+  - type: done
+- - type: text
+    text: "Rejected."
+  - type: done
+assertions:
+  provider_calls: 13
+  provider_request:
+  - n: 12
+    tools_exclude:
+    - fixture__echo
+    - list_mcp_resources
+  - n: 13
+    messages_contain: "enable_mcp"
+    messages_not_contain: "fixture://readme"
+  events_sequence:
+  - type: ToolCallResult
+    tool: fixture__echo
+    error:
+      regex: "enable_mcp"
+  - type: ToolCallResult
+    tool: list_mcp_resources
+    result:
+      regex: '"count": 0'
+  turn_completed: true
+  no_errors: true