fix(core): stop MCP server rules from authorizing a colliding server - #12531

Both stage-2 findings are now dispositioned — details in the updated Risk & Scope section of the PR body (bilingual), cross-posted to #10199 for tracking.

Finding 1 — alias-less blocklist paths narrow fail-open. Call sites confirmed first-hand at this head: five deny-semantics callers reach matchesMcpPattern() without rawToolName (agent-core.ts ×3 over toolConfig.disallowedTools, workflow-agent-tools.ts over input.denies, and matchesAgentToolBlocklist() in subagent-plan-tool-policy.ts). User permissions.deny is unaffected — aliases are threaded through permissionFlow.ts → permission-helpers.ts. Recorded as a disclosed residual; the narrowing only triggers when both the server and tool segments are provider-unsafe. Threading aliases into these call sites needs registry context they do not currently hold, so it belongs to the variant-2 work tracked in #10199 rather than this PR.

Finding 2 — hash verification is a consistency check, not an authenticity check. Agreed; the forgeability is documented in Risk & Scope. Exposure is still strictly smaller than on main (from "every tool of the colliding server" to "tools whose name embeds a computed hash"). Real closure needs the registry-backed ambiguity filtering attempted in #10202, so the matcher can ask "does this rule denote more than one registered server?" instead of reasoning about one name in isolation.

Both findings were statically derived (the review environment could not execute code) and were re-verified by a first-hand read of the call sites and the rawToolName === undefined branch at 67d07f2; no behavior in this PR is changed by these disclosures. The merge decision on this permission-path change is handed to @zjunothing.

Scope ledger — delivered 7e489a5b331287dab9cf6015d94d2bb076f5a633, substantive round 27.

Goal and scope. Preserve #10199 and original baseline 67d07f238b (one production file/102 lines, one test file/114 lines). Four independently reproduced findings are addressed by the bounded R24 repair. Existing Suggestions and other naming/centralization work stay deferred. No new production file, API, alias channel, dependency, cache or option; suspiciousFiles stays empty. Earlier scope-fuse deferrals are superseded by this verified fix-forward result under the user's explicit continuation request.

Result. Producer identity handles nested bare servers and real underscore tool prefixes; actual registry competition handles grant refusal. Unique registered/raw exact names retain priority. Lossy heads cannot ignore a longer competing server key. Partial-separator restrictions regain ordinary-tool coverage, with underscore-leading registered boundary refusals retained. Historical deny/status assertions use the actual producer context; alias-only checks remain labelled compatibility predicates. EN/CN contracts match.

Metrics. Five existing files +114/-109, net+5: production -9, tests+14, docs0. Whole PR 28 files,+2877/-106: production18/+595/-84; tests8/+2214/-21; docs2/+68/-1. The preceding reductions and full history remain below; the PR still exceeds the original minimal baseline. No global-minimality claim.

Evidence. 805 focused tests, dependency/CLI build, core typecheck, bundle and changed-source lint pass. Independent reuse/correctness, quality/correctness and efficiency checks are clean. Same21-row source before/after +27-row real module flow pass; four actual packaged CLI/tmux/stdio paths verify cited nested deny0, single nested allow1, longer-key confirmation0→Allow once1, ordinary partial-separator deny0. Four original-frame PNGs are visually checked, full-text equal and publicly byte verified at immutable img-host URLs. Tested candidate e46e5ae0ed088e68ab5180ff311b80ea0b55d622dae96e53cbd91c641b87404b maps exactly to all five committed blobs; executed binary/module and TS emit bindings are recorded. Initial harness failures and controlled-provider/unrun boundaries remain explicit in the report with screenshots.

Delivery snapshot. Normal additive push confirmed exact remote head, OPEN/MERGEABLE. One snapshot: ten checks running, six queued, two skipped; review CHANGES_REQUESTED. Fresh CI and maintainer review remain merge gates. No merge/approval or informational-job wait. Scope verdict: corrected.

R2 round delivered — 59ba562c68

All four Criticals and all eleven Suggestions from the 2026-09-23T21:16Z review are addressed in 59ba562c68, by taking the route R2-3 named: the producer now publishes the tool's exact raw mcp__<server>__<tool> identity, the matcher compares it literally, and the entire reconstruction machinery is deleted. Nothing is hashed or reconstructed anywhere in the permission path, so no gate built on "does this name look like a normalization" remains to have a next corner.

What changed

• DiscoveredMCPTool.permissionAliases now publishes [raw, legacy?] — the exact raw spelling first, the legacy reduction second, deduped. Verbatim provider-safe registrations still publish [] (the legacyName === this.name rule is unchanged), so the pinned no-alias posture and the isToolDisabled / matchesLegacyExactName consumers of the legacy spelling are unaffected.
• rule-parser.ts: deleted isNormalizedFromRawPrefix, PROVIDER_NAME_HASH_SUFFIX, PROVIDER_NAME_HASH_LENGTH, the aliasAdvertised gate, and the relaxed server-segment alias arm. The exact arm is now pattern === rawToolName (literal, provenance-anchored). resolveRawMcpIdentity keeps only the strict arm. Net effect in this file: 66 insertions / 149 deletions — the round is a simplification, not another layer.
• matchesToolPattern gains the advertised-exact-name arm, so an exact 3-part entry now blocks identically via permissions.deny and disallowedTools (R2-6).
• ACP L1 isToolEnabled gate threads the same alias channel as the scheduler (R2-5); workflow narrowing skips session-registry aliases for agent types with their own MCP servers (R2-12); the stale docblock sentence and dangling {@link} are corrected (R2-13); docs/design/mcp-tool-name-provider-compatibility.md now describes the shipped algorithm and gained its zh-CN counterpart (R2-11).

Red-first evidence

Every witness from the findings was pinned as a failing test against b6ae20e9a3 before the fix (13 red / 15 green in mcp-server-rule-collision.test.ts, every failure a designated witness, every positive control green), and all pass after:

• R2-1: evil_1oxrpi0 byte-identical forgery and the zybio_db/literature_search_0qeuuzz witness — exact arm matched true pre-fix, now false / default.
• R1-3: both entrances red — the foo:bar server naming evil[a b#c#d"e~f|x (hash-rebuild verifies) and the 64-char provider-safe raw registering byte-identical (_0lt68rp). Both now false / default; the fallback they entered no longer exists.
• R2-2: weather-forecast-server-premium's middle-truncated alias matched rule mcp__weather-forecast-server pre-fix (true/allow); now false/default. The own-server controls (foo:bar, com.example.enterprise-search, zybio.db) still match.
• R1-2: row H (foo:bar + a.b deny), the 24+-char truncation entrances (both mcp__com.example.enterprise-search forms), and the dotted-server tool-prefixed wildcard (mcp__zybio.db__literature.search_*) were all default-fail-open pre-fix; now deny/disabled. The length sweep is pinned: foo:bar denies at rawLen 55, 56, 59, 63, 64, 69, 74, 80 (pre-fix red at 56/59/63/64/69/74/80 — the cliff was indeed 56); foo.bar matches at every length.

Verification

• packages/core focused suites on the final commit: rule-parser 7/7, mcp-server-rule-collision 28/28, permission-manager 514/514, tool-registry 75/75, workflow-orchestrator 262/262, plus the memory/skill shim suites, mcp-tool, permissionFlow — 1120/1120 pass (independently re-run by the orchestrator on the pushed SHA: 886/886 across the five core files).
• pnpm typecheck: core ✓, cli ✓. eslint clean on all touched files.
• The keeps a deny rule effective past the 63-char truncation and keeps a legacy dotted server rule on its own tool when both segments are unsafe rows stay green — the relaxed capability is redirected through the raw identity, not deleted.

Disclosed expectation changes

Two permission-manager.test.ts rows pinned the unprovenanced exact-normalize arm by supplying no alias where production always advertises one for an unsafe raw; they now supply [legacyName] / [dottedName] respectively. The slashed-mismatch assertion in the second row is unchanged (still no-alias false). No expectation was weakened to pass.

Claim corrections

The PR body's "forgery … is closed in b6ae20e9a3" certification was true only for the server-level/wildcard shapes — the exact 3-part shape still evaluated 'allow' until this commit — and the two "crafted name never reaches the check" docblock sentences were false (provider-safe raws over 63 chars also carry hash suffixes). Both are corrected in the body and the code comments now describe the literal-raw-identity mechanism.

Residuals (unchanged, accepted)

• Provider-safe-spelled rules (mcp__foo_bar) still literally match any server sanitizing under that prefix — the pre-existing accepted residual.
• Legacy-spelled rules now rely on the alias channel at every evaluation site; all known sites are threaded and the no-alias posture is pinned, but a future call site that forgets it fails open on deny. The design doc's new "Rule matching" section records this.
• Full Session.test.ts could not run on the worker box (pre-existing OOM, reproduced unmodified); the L1 subset passed 2/2 and CI should run the full file.

@qwen-code /triage

@pomelo-nwu R4-1 is fixed at a9009261b8, per your ruling:

Please preserve the legacy spelling for restrictive prefix matches with server provenance, and add a regression for deny/ask as well as allow.

matchesMcpPattern's wildcard arm now also reads generateLegacyMcpToolName's reduction of the tool's own vouched raw identity — the spelling a persisted prefix was copied from. Server provenance is established twice: the input is the raw identity resolveRawMcpIdentity already vouched for (an alias whose own normalization IS the registered name), and the reduction must have left the server segment byte-identical, which rejects the middle-truncated reduction of a 24+ character server key (slice(0, 28) + '___' shortens the key and injects the __ a prefix match needs). One production file, packages/core/src/permissions/rule-parser.ts; no exported signature change, no new cross-package channel, nothing admitted from the alias array.

Regression coverage in mcp-server-rule-collision.test.ts (new describe, 9 rows) covers deny, ask and allow end to end plus getToolRegistrationStatus, and pins both directions: a differently-registered foo_bar server still does not match a foo.bar prefix at any of the three matchers and still evaluates default under both a deny and an allow list, so #10199 is intact and no allow rule matches more against a different server; and a middle-truncated reduction still does not reach a shorter server's wildcard, so R2-2 is intact.

Measured in packages/core: npx vitest run src/permissions/ → 14 files, 1109 passed; tsc --noEmit clean; prettier and eslint clean on both changed files. Three mutation checks, each reverted afterwards — reverting the production change reddens exactly the 5 new positive rows (5 failed / 1104 passed); deleting the server-provenance check reddens the truncated-reduction row (1 failed / 1108); replacing the fix with the "reduce both sides through the sanitization" remedy reddens 5 rows including the four pre-existing #10199 pins and the new cross-server row (5 failed / 1104).

Deliberately not fixed in this commit:

1. The mixed-spelling sub-population — a rule whose tool segment is the sanitized one while the reduction preserves the dot, e.g. prodTool('zendesk.default', 'literature.search') against mcp__zendesk.default__literature_search* and its mirror. No spelling of that tool starts with that pattern, so it needs the segment-wise {server, toolGlob} comparison R4-2 names plus a ruling on the two decomposed matchers at agent-core.ts:1765-1802 and tools/agent/agent.ts:1814-1839. R4-2 stays unresolved with what I established on it — notably that the server-identity half no longer needs a new channel, because rawToolName.split('__')[1] is already authoritative whenever the raw identity vouches.
2. docs/design/mcp-tool-name-provider-compatibility.md:32 and :36, plus the zh-CN copy, which still describe matching as literal against two spellings. The matching matchesMcpPattern docblock is corrected in this commit; the doc is not, because that is two more files in two languages on top of this round's three-file ceiling, and per the note already on R4-3 the section should be edited once against the final matcher design rather than twice.
3. The other four open Suggestions (R2-6, R2-12, R3-3, R4-3) — unchanged from the rounds already recorded on each of them.

Also in this push: 3c8afa34c3 merges main (c3a4058a0c), which the gate-freshness check required — main moved eslint.config.js, .prettierignore and .github/workflows/ci.yml at 73aa65a4b4 after this branch last synced. The merge was clean, no conflicts.

Further Ponytail pass in 7d5192bad16e29e0bcaff92175a6f9bb0d6b301a: 284 net lines removed (76 production, 208 tests), with five existing files changed. The whole PR is 28 files, +2811/-107. Duplicate MCP name matching now shares its existing path, tests reuse existing producer/registry fixtures and equivalent cases, and the ACP gate retains its meaningful no-build assertion.

Also fixed R19 reverse underscore ownership. With both foo/_deploy and foo_/release registered, mcp__foo___* grants the foo_ tool. The foreign foo tool returns to normal approval. The guard stays tied to an actual competing registration: removing foo_ restores the single-claimant grant, while the existing mcp__foo____i* own-tool control remains allowed. A broader ownership/parser redesign stays deferred; the later author comment asks to keep the discussion open for tracking, so this report distinguishes the verified fix from that design proposal.

Verification on the unchanged candidate and delivered source:

• Core build/typecheck and CLI bundle passed; 776/776 core cases in five files plus 1/1 selected ACP L1 case passed (1113 other ACP cases skipped). The final commit hook passed formatting and lint for the five changed files; all five committed blobs match the tested candidate.
• 10 actual producer/registry/shared-permission observations passed, including model-visible/App-only ownership, owner removal and the existing lettered-prefix control. Changed-source emit matches the built permission module; the executed CLI entry and permission chunk are bound to the frozen candidate.
• Two real packaged CLI/tmux/stdio MCP runs passed in default approval with trust:false. Foreign _deploy: Ask, 0 calls before approval, 1 after Allow once. Own release: direct Allow, 1 call. The model is a controlled loopback fixture; this does not verify an external model/provider or App RPC/UI.

These are PNG replays of the original tmux ANSI captures; paired plain-text captures match the rendered text. Images are hosted in yiliang114/img-host and their public bytes were verified.

Foreign tool awaiting confirmation (zero MCP calls):

Own-server tool executes directly under its whole-server rule:

Earlier 272d3efc report retains the previous 1011-case and four-run before/after evidence at that head. Current fresh CI/review status: post-push snapshot: CI pending/queued, no conflicting files (MERGEABLE); maintainer review remains required. The reverse entrance is fixed, and the broader structural discussion remains open as requested. No merge performed.

R23 follow-up verified at 6abd1eb (candidate diff SHA-256 94db481861bf790f7f2dac3d3c5f6e04873f9e30743d57e839895d6c764bde2e). Both Criticals reproduced at 7d5192bad16e; the current repair replaces the grant entrance enumeration with live producer-boundary ownership and reuses the existing matcher for restrictive-only legacy coverage. No new product API, alias publication, dependency or cache.

The second row intentionally uses both → default. The rule has two different real server/tool boundaries; assigning only one claimant would retain the ambiguity. Complete raw whole-server boundaries, explicit raw exact/unique registered exact rules and intentional raw coarse prefixes keep their existing authority. The old no-registry “never grants” fixture was replaced with the real registry-backed shared-cut witness; it could not prove its advertised invariant.

Validation: 798 cases across six focused core files, core build/typecheck, CLI bundle and changed-source ESLint passed. Independent correctness, reuse and efficiency/test-value reviews found no remaining actionable issue in the unchanged final delta. The single 21-row real producer/registry/permission/shared-flow probe passes, including App-only and actual agent declaration/invocation guards (minimal agent fixture, not nested-agent E2E). Source/runtime hashes and executed matcher chunk/imports are bound to this candidate; committed blobs match after hooks.

Native acceptance uses packaged CLI 0.24.7, Node 22, real tmux and stdio MCP transports with default approval and trust:false. Four flows pass: foreign confirmation with0 calls before and1 after Allow once; own direct1 call; legacy deny with exact rule citation and0 calls (still advertised to the model); legacy ask with Always Allow hidden,0 before and1 after Allow once. These are controlled loopback model runs, not external-provider/model acceptance. App-only coverage is real registry/shared-flow coverage; App RPC/UI, Web Shell, Windows and this repair's Linux UI are unrun.

Foreign foo__bar: confirmation before action, transport calls0

Own foo: direct successful MCP execution, transport calls1

Legacy deny: cited scheduler decline, transport calls0 (fixture final text is not execution proof)

Images replay original captured ANSI frames using the repository terminal renderer, with complete plain-text frame parity and visual inspection; they are not native Terminal.app screenshots. Uploaded only to yiliang114/img-host, at immutable image commits; public PNG bytes and GitHub rendered image URLs were checked.

Scope: this round touches five existing files, +181/-119 (net +62): production +9, tests +53, bilingual docs net zero. Whole PR: 28 files, +2872/-106, versus +2811/-107 at the previous head. The previous two rounds' 853-line reduction remains; this round adds only the reproduced Critical repair and its smallest distinct regressions. The overall PR is still larger than the initial fix, and this is not a global-minimality claim.

Initial validation attempts are retained: the new two-/three-column test callback needed an optional parameter type; the first build rejected it, and a concurrent test start stopped at the build-prerequisite guard before executing cases. The type was fixed and the build completed before the successful focused test run. The overstrict bundle lexical observer and the initial wrong expectation that native deny removes model declarations are also retained; the corrected denial verifier passed with unchanged source. No external provider credentials were used. One post-push snapshot confirms this exact PR head; current aggregate CI is PENDING, mergeability is MERGEABLE, and review remains CHANGES_REQUESTED. Fresh checks and maintainer approval remain separate merge gates; this repair does not wait for informational review jobs.

Post-delivery local state: the verification worktree and its ignored evidence directory became unavailable during publication closeout. The remote commit and immutable screenshots remain available, but the original local runtime/logs can no longer be read. Publication receipts are preserved outside that worktree; the validated branch content was not changed or rerun.

Delivered 7e489a5b331287dab9cf6015d94d2bb076f5a633: the four R24 findings are addressed with five existing files, +114/-109 (net +5). Production code is net -9, tests +14, bilingual docs net zero. Whole PR: 28 files, +2877/-106 (production18/+595/-84, tests8/+2214/-21, docs2/+68/-1). Existing Suggestions remain deferred; this repair adds no production file, dependency, cache, option or alias channel. The PR remains larger than its original fix; this is not a claim of global minimality.

Nested server keys now use producer identity for bare whole-server rules and underscore tool prefixes. Real registry competition owns grant refusal rather than a re-split local predicate. Unique registered/raw exact priority remains: mcp__foo__bar grants exact foo/bar, but does not grant the competing broad foo__bar server. A lossy prefix also checks a competing key extending beyond its head. Restrictive partial-separator prefixes again cover ordinary registered tool segments, while underscore-leading boundary controls and the narrower allow posture remain. Shared historical-spelling tests now evaluate production identity for deny/status and keep alias-only checks explicitly as compatibility characterizations.

Verification: 805 focused core tests (798 across five files + seven direct matcher cases), dependency/CLI build, core typecheck, bundle and changed-source ESLint pass. Independent reuse/correctness, quality/correctness and efficiency passes are clean. The same 21 bounded exact-source before/after rows reproduce six pre-fix mismatches and none after; this baseline is source-function fallback, not an old packaged CLI or old real PermissionManager. A separate 27-row real built Config/producer/ToolRegistry/PermissionManager/shared-flow probe passes, including App-only competition, registration/removal, citation/status, and actual agent declaration/invocation predicates in a minimal fixture.

Four actual packaged CLI/tmux/stdio MCP paths pass in one consolidated run, under default approval and server trust false:

Denied tools can remain advertised to the model. The evidence is the cited scheduler decline and actual zero MCP transport calls; the controlled model's final text is not execution proof.

Screenshots: original tmux ANSI frames replayed through TerminalCapture/xterm, not OS screenshots. All four have complete text parity, visual inspection and public PNG SHA-256 equality. Images are hosted only in public yiliang114/img-host, with immutable commit URLs.

Bare nested-server restriction:

Single nested-server allow:

Longer-key competition, before confirmation:

Partial-separator restriction:

Identity: tested base 6abd1eb228d7ed6efd4fdfd08aa184a5e8fc5f02 + candidate diff SHA-256 e46e5ae0ed088e68ab5180ff311b80ea0b55d622dae96e53cbd91c641b87404b; all five committed blobs at 7e489a5b331287dab9cf6015d94d2bb076f5a633 equal the tested source. Packaged CLI SHA-256 ad57ff1c3a9a21ad60c32466a4e8d827330b6075b87781a3d26ab0b0eb93b2b8, actual matcher chunk d88793e4b370e839e89a9dbb1a04dced5fc4b0f98c79240e5d44d5693a3675cb, matcher source 796521169fbaf8ac34a71d41ee0cf859c4b7b7ea503f84ad92cc57d586f15f22. The binary was built before the additive commit; source-to-commit equality and in-memory TypeScript emit-to-rebuilt-core equality were verified. Esbuild lexical equality is not claimed.

Failures and limits: the first test launcher referenced a nonexistent package-local bin and ran no tests; correcting its path passed. A concurrent seven-case matcher run hit a shared coverage-directory ENOENT after its cases passed; only that check was rerun with coverage disabled and exited0. The first unbundled Node module observer stopped before any case on existing mime/lite resolution; the prepared tsx loader passed the unchanged built runtime. The four native cases passed on their first run. Native inference uses a controlled localhost OpenAI-compatible fixture; external real models/providers, App RPC/UI and full nested-agent E2E are unrun. Fixture homes and raw captures remain; owned processes/ports are stopped. Prior R23 evidence remains evidence at its named head.

One post-push snapshot at 2026-10-05T10:24:39+00:00 confirms this head, OPEN/MERGEABLE, review CHANGES_REQUESTED, with ten checks running, six queued and two skipped. Fresh CI and maintainer review are separate merge gates; informational review jobs are not awaited.

@qwen-code /triage

Maintainer verification, round 4 (real local environment) — PR #12531 @ 7e489a5b33

Verdict: not mergeable as-is. One fail-open family against main is still open, and a small restrictive-only patch (candidate E) closes all of it without changing any grant. I measured it exhaustively this round rather than case by case.

The other two open bot Criticals, R23-1 and R26-1, are real. Neither is a regression against main: in both, the new grant guard misses a case, so main's behaviour stays in place. Tracking them in #13412 is reasonable.

Correction to round 3

In round 3 I wrote that after candidate D "I have no blockers". That was wrong.

My round-3 sweep only took literal prefixes of the registered name at the key's own boundary. It never generated prefixes that stop inside the separator, or coarse legacy prefixes. Measured with this round's differential, candidate D (which landed as d62f5b79d2) still lost 569 restrictions against main. The author's R23/R24 rounds fixed 417 of them, and the remaining 152 are item 1.

The three test rows that candidate E flips also come from me: my round-2 candidate C added them ("uncut registrations must not enter the fallback") to keep the R17-2 decision. Once R24 made the same fallback restrict ordinary tools, those rows only pin the asymmetry.

Environment

• Arms. Each was built from git with pnpm install --frozen-lockfile, npm run build and npm run bundle, all exit 0:

  • base b3dda468f2, the merge-base;
  • prev d62f5b79d2, my round-3 candidate D as landed;
  • head 7e489a5b33;
  • merge: head merged into current main 43a6e1e5e4, no conflicts;
  • cand E: head + the patch in §1.

• Harness. Same as rounds 2–3:

  • real stdio MCP servers, whose own call log is the execution oracle;
  • a scripted OpenAI-compatible model that calls exactly the target tool;
  • a fresh HOME per run.

• New scenario groups:

  • N: partial separator;
  • E: R23-1;
  • P: R26-1, with agent-frontmatter mcpServers;
  • Q: the PR's own nested-key test plan.

• Runs:

  • headless qwen -p: 83 scenarios × 5 arms = 415 runs;
  • qwen --acp: 9 scenarios × 3 arms;
  • real interactive TUI: N8 and N2 × 3 arms.

• Module differential, new this round. For 18 server keys × 14 tool names, I took every rule that is literally an exact name or a <prefix>* of the tool's own raw, registered or legacy spelling, plus bare-server forms. That is 16,502 rule×tool rows. Each arm's built modules were called the way production calls them:

  • L4 PermissionManager.evaluate for deny and for ask, with the invocation's aliases and mcpIdentity;
  • L1 scheduler isToolEnabled;
  • the subagent disallowedTools predicate that arm actually uses.

  A loss is a row that main restricts and the arm does not. No registry competitor is involved, because restrictive matching never reads the registry.

• Linux x86_64, Node 22.22.2. Round 3 ran on macOS arm64.

1. Open: partial-separator restrictions fail open (bot R26-2 + a new raw-key family)

All 152 remaining losses have the same shape: a restrictive wildcard mcp__<key spelling>_* that stops one underscore into the key's own separator. This is the coarse "everything from this server" spelling that R24 restored for mcp__github_* (row N1). matchesRestrictiveMcpName (rule-parser.ts:1912) accepts it only in two cases:

• the rule is a literal prefix of the registered name;
• and the tool segment does not start with _ (:1936-1937).

That leaves two holes.

• Same on ACP. N2, N3, N7, N8, N9, N10 and N14 run on head. Base and cand E report Tool "…" is disabled. or send session/request_permission.
• The contract is inconsistent at head. The registered spelling mcp__zybio_db_* blocks (N12), and so do mcp__zybio.db__* (N13) and mcp__zybio.db (D4); only the one-underscore raw form misses. Likewise deny mcp__foo__* blocks foo_/deploy (N15) but not foo_/_internal (N14).
• Family A is documented (design doc :38: "underscore-leading registered tool segments retain the boundary refusal"). In the restrictive direction, though, that refusal has only one effect: the deny does not fire. The doc's own Asymmetry bullet names exactly that failure. The grant-side R17-2 refusal is separate, and candidate E keeps it.
• Exposure. It needs a restrictive entry written as mcp__<key>_*. For A, the tool name must also start with _. For B, the key must contain ., : or /, which is common for zybio.db-style and URL keys. On a trusted server, or in YOLO, the tool then runs with no prompt, while main blocks it.

Candidate E. This is restrictive-only. matchesRestrictiveMcpName is reached only from deny, ask and disallowedTools, and from matchesToolPattern, whose production callers are all restrictive. The rule it applies: a prefix that stops at or inside the key's own separator, in any of the key's three spellings, names that key.

@@ -1930,11 +1930,14 @@ function matchesRestrictiveMcpName(
   const prefix = pattern.slice(0, -1);
   const registeredServerPrefix = `mcp__${identity.serverName.replace(/[^A-Za-z0-9_-]/g, '_')}__`;
   return (
-    toolName.startsWith(prefix) &&
-    (!toolName.startsWith(registeredServerPrefix) ||
-      prefix.startsWith(registeredServerPrefix) ||
-      (registeredServerPrefix.startsWith(prefix) &&
-        !toolName.slice(registeredServerPrefix.length).startsWith('_')))
+    (toolName.startsWith(prefix) &&
+      (!toolName.startsWith(registeredServerPrefix) ||
+        prefix.startsWith(registeredServerPrefix))) ||
+    // A prefix that stops at or inside this key's own separator names the
+    // key in that spelling, whatever the tool segment starts with.
+    mcpSegmentSpellings(identity.serverName).some((server) =>
+      `mcp__${server}__`.startsWith(prefix),
+    )
   );
 }

2. R23-1: a legacy exact allow still grants with a same-spelling server registered (not a regression)

E1 is what main does, so this is not a regression. But design doc :36 says "a legacy exact entry cannot grant to foo:bar while foo_bar is also registered", and the code does not do that. Either narrow that sentence now or keep the case in #13412. I would not block on it.

3. R26-1: the ambiguity pool is the session registry (reproduced in both directions)

isMcpAllowAmbiguous reads this.config.getToolRegistry() (permission-manager.ts:452). A subagent with frontmatter mcpServers runs on its own rebuilt registry but keeps the session's PermissionManager.

P3 matches main. P4 is a fail-closed UX regression, limited to agent-local MCP servers whose spelling collides with a session-level server. Neither should block; both belong to the #13412 decision about which registry owns the ambiguity check.

4. What still holds at head

• Earlier rows. All 48 rows of round 3's candidate-D run give the same verdict at head, and prev on Linux reproduces that macOS run cell for cell (groups R, T, U, F, K, A in Fig 3). One grant row changed on purpose: K5 went from ask at prev to ran at head, because R24 now grants the sole __-key claimant. Since prev, R24 also fixed N1, N5, N12 and N15.
• The PR's nested-key test plan (Q1–Q5) behaves as described: the foreign foo__bar asks under mcp__foo__*; two boundary claimants both ask; bare mcp__foo__bar restricts both.
• Pomelo-nwu's R4-1 (legacy spelling for restrictive prefixes):
  • satisfied at head for every legacy prefix shape, including the 252 coarse legacy prefixes on long URL keys that were still lost at prev;
  • the only legacy rows still lost are 4 family-B partial-separator rows, which candidate E closes.
• Head + current main. Identical to head on all 83 real-CLI rows and all 16,502 differential rows.

5. Gates and coverage

Not covered:

• Windows and macOS (Linux x86_64 only this round).
• App-only RPC/UI.
• External providers; the model is a loopback fixture.
• The tool_search bridge.
• The interactive TUI for rows other than N2 and N8.

Recommendation

1. Fold in candidate E, or an equivalent restrictive-only fix for both families. After that I have no blockers.
2. R23-1 (doc vs code) and R26-1 (P3/P4) do not block. Narrow the doc sentence or track both in Deferred review finding from PR #12531: attribute an MCP permission rule to its server from producer identity #13412.
3. Pomelo-nwu's re-review is still required to clear the standing CR.

Evidence is in wenshao/qwen-code asserts/pr-12531-r4: harness, per-run rows (headless, ACP, cand E), the differential JSON, unit logs and the candidate E patch.

_{🤖 Generated with Claude Code — Claude Opus 5.5}

Maintainer verification, round 5 (delta) — PR #12531 @ 0a5e943bf1

Verdict: mergeable from my side. The round-4 blocker is closed and I have no blockers left. I re-ran everything on the real PR head (fresh pnpm install --frozen-lockfile, npm run build, npm run bundle, no local patches). What remains is the human review gate below.

This is a delta over round 4. Anything round 4 measured that is not listed here is unchanged.

What changed since round 4

• cdb3cb189e is byte-identical to candidate E. I diffed each of the four files against my round-4 cand E worktree.
• 0a5e943bf1 merges main 43a6e1e5e4, which is the same main my round-4 merge arm was built on. Its tree equals that arm (7e489a5b33 + 43a6e1e5e4) plus candidate E and nothing else: git diff --stat between the two lists only the four files, +55/−13.

Results at 0a5e943bf1

Still open, not blocking (unchanged from round 4)

• R23-1. E1 (a legacy exact allow while a same-spelling server is registered) still grants, which is what main does. The design doc's :36 sentence still promises a refusal.
• R26-1. P3 (agent-local competitor) behaves like main. P4 (an agent-local owner now gets a prompt) is a fail-closed UX regression.
• As the bot points out on both threads, Deferred review finding from PR #12531: attribute an MCP permission rule to its server from producer identity #13412 does not list these rows yet. E1 and P3/P4 should be added there when this merges, so the follow-up is actually tracked.

Merge gates

• pomelo-nwu's CHANGES_REQUESTED from 952e3ef668 (2026-09-25) still stands, so reviewDecision is CHANGES_REQUESTED.
• chiga0's approval on 7e489a5b33 was dismissed by the new push, so it needs a fresh approval at 0a5e943bf1.

Not covered: Windows and macOS (Linux x86_64 only), App-only RPC/UI, external model providers, the tool_search bridge. Same limits as round 4.

Evidence: wenshao/qwen-code asserts/pr-12531-r5 — harness, raw per-run data (headless, ACP, TUI), the differential JSON, unit logs, and tree-equality.txt (the byte-identity and tree checks above).

_{🤖 Generated with Claude Code — Claude Opus 5.5}

@qwen-code /triage