fix(mcp): pass tool name and args to permission ask - #32564

Issue for this PR

Fixes #19549

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

The MCP tool wrapper in packages/opencode/src/session/tools.ts was calling ctx.ask with hardcoded wildcards:

ctx.ask({ permission: key, metadata: {}, patterns: ["*"], always: ["*"] })

That caused three observable problems:

1. The permission dock rendered * instead of the actual MCP tool name (the original report on MCP tools show * instead of actual tool name in permission dialogs #19549).
2. Picking "Always allow" on any MCP tool saved a rule against pattern: "*" instead of the tool name, so approving one MCP tool silently approved every MCP tool in the session.
3. SDK / serve consumers received an empty metadata on the permission.asked event, so a host UI couldn't display the tool input or reason about it.

The fix aligns the MCP wrapper with the convention used by every other tool (bash, webfetch, task, read, edit, …): forward the action key as both permission and patterns/always, and pass the tool's input as metadata.

ctx.ask({ permission: key, metadata: args, patterns: [key], always: [key] })

The metadata field is already typed Schema.Record(Schema.String, Schema.Unknown), so MCP tool args (also Record<string, unknown>) fit the schema without any wire-format change.

How did you verify your code works?

• Added mcp tool ask publishes tool name and args (regression: #19549) in packages/opencode/test/session/prompt.test.ts. It registers a fake one-tool MCP layer, subscribes to Permission.Event.Asked via EventV2Bridge, drives the prompt loop to invoke the tool with { greeting: "hi" }, and asserts:
  • request.permission === "echo_say"
  • request.patterns === ["echo_say"]
  • request.always === ["echo_say"]
  • request.metadata === { greeting: "hi" }
  • The loop completes cleanly after a once reply.
• bun test test/session/prompt.test.ts from packages/opencode/ — 55 pre-existing tests pass + the new one, 0 failures.
• bun typecheck clean.
• Manually re-ran the wrapper through a local MCP server: dock now shows the actual tool name, "Always allow" scopes to that one tool, and the permission.asked event payload carries the tool arguments.

Screenshots / recordings

No UI changes — only the data the existing dock already renders.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR