@atlasharness/atlascode 0.1.80 → 0.1.81

package/dist/cli.js

@@ -19862,7 +19862,7 @@ var init_openai = __esm(() => {
 });
 
 // src/modelprovider/constants.ts
-var API_IMAGE_MAX_BASE64_SIZE, IMAGE_TARGET_RAW_SIZE, PDF_TARGET_RAW_SIZE, API_PDF_MAX_PAGES = 100, LLM_TIMEOUT_DEFAULT_MS = 900000, LLM_TIMEOUT_CAP_MS = 1800000, LLM_TIMEOUT_UNIT_WARN_THRESHOLD_MS = 60000, STREAM_IDLE_TIMEOUT_MS = 300000, SUMMARIZE_CONNECTOR_TEXT_BETA_HEADER, AFK_MODE_BETA_HEADER;
+var API_IMAGE_MAX_BASE64_SIZE, IMAGE_TARGET_RAW_SIZE, PDF_TARGET_RAW_SIZE, API_PDF_MAX_PAGES = 100, LLM_TIMEOUT_DEFAULT_MS = 900000, LLM_TIMEOUT_CAP_MS = 1800000, LLM_TIMEOUT_UNIT_WARN_THRESHOLD_MS = 60000, STREAM_IDLE_TIMEOUT_MS = 300000, STREAM_IDLE_RETURN_GRACE_MS = 1000, SUMMARIZE_CONNECTOR_TEXT_BETA_HEADER, AFK_MODE_BETA_HEADER;
 var init_constants2 = __esm(() => {
   init_shared();
   API_IMAGE_MAX_BASE64_SIZE = 5 * 1024 * 1024;
@@ -19901,7 +19901,7 @@ var init_clients = __esm(() => {
 });
 
 // src/modelprovider/streamIdleWatchdog.ts
-async function* withStreamIdleWatchdog(stream, timeoutMs = STREAM_IDLE_TIMEOUT_MS) {
+async function* withStreamIdleWatchdog(stream, timeoutMs = STREAM_IDLE_TIMEOUT_MS, returnGraceMs = STREAM_IDLE_RETURN_GRACE_MS) {
   if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
     yield* stream;
     return;
@@ -19933,7 +19933,19 @@ async function* withStreamIdleWatchdog(stream, timeoutMs = STREAM_IDLE_TIMEOUT_M
     }
   } finally {
     try {
-      await iterator.return?.();
+      const ret = iterator.return?.();
+      if (ret) {
+        let graceTimer;
+        const grace = new Promise((resolve) => {
+          graceTimer = setTimeout(resolve, returnGraceMs);
+          if (typeof graceTimer === "object" && graceTimer !== null && "unref" in graceTimer) {
+            graceTimer.unref();
+          }
+        });
+        await Promise.race([ret.then(() => {
+          return;
+        }, () => {}), grace]);
+      }
     } catch {}
   }
 }
@@ -27201,6 +27213,12 @@ function isQuotaExhaustedMessage(message) {
   }
   return false;
 }
+function parseToolSchemaRejectionError(err) {
+  if (!(err instanceof APIError2) || err.status !== 400)
+    return null;
+  const m = /invalid schema for (?:tool|function) [`'"]?([A-Za-z0-9_.\-]+)[`'"]?/i.exec(err.message);
+  return m ? m[1] : null;
+}
 function classifyAPIError(error) {
   if (error instanceof Error && error.message === "Request was aborted.") {
     return "aborted";
@@ -27341,6 +27359,8 @@ function shouldRetryModelError(err, signal) {
     return false;
   if (isClientRequestTimeout(err))
     return false;
+  if (parseToolSchemaRejectionError(err))
+    return false;
   return isRetryableError(err);
 }
 function llmTimeoutUnitHint(ms) {
@@ -29509,8 +29529,8 @@ var SettingsSchema = () => object({
   mcpServers: record(string2(), any()).optional(),
   allowedMcpServers: any().optional(),
   deniedMcpServers: any().optional(),
-  enabledMcpjsonServers: array(string2()).optional(),
-  disabledMcpjsonServers: array(string2()).optional(),
+  enabledMcpjsonServers: union([string2(), array(string2())]).transform((v) => Array.isArray(v) ? v : [v]).optional(),
+  disabledMcpjsonServers: union([string2(), array(string2())]).transform((v) => Array.isArray(v) ? v : [v]).optional(),
   sandbox: any().optional(),
   permissions: any().optional(),
   hooks: lazy(() => HooksSchema).optional(),
@@ -30144,7 +30164,7 @@ var init_filesystem = __esm(() => {
 
 // src/permissions/permissionRuleParser.ts
 function setLegacyToolNameAliases(map) {
-  legacyToolNameAliases = map;
+  legacyToolNameAliases = Object.assign(Object.create(null), map);
 }
 function normalizeLegacyToolName(name) {
   return legacyToolNameAliases[name] ?? name;
@@ -30219,7 +30239,7 @@ function findLastUnescapedChar(str, char) {
 }
 var legacyToolNameAliases;
 var init_permissionRuleParser = __esm(() => {
-  legacyToolNameAliases = {};
+  legacyToolNameAliases = Object.create(null);
 });
 
 // src/permissions/mcpRuleNames.ts
@@ -30228,6 +30248,9 @@ function normalizeNameForMCP(name) {
   const normalized = folded.replace(/_+/g, "_").replace(/^_|_$/g, "");
   return normalized === "" ? folded : normalized;
 }
+function foldMcpNameForCompare(name) {
+  return name.replace(/[^a-zA-Z0-9_-]/g, "_").replace(/_+/g, "_");
+}
 function mcpInfoFromString(toolString) {
   const parts = toolString.split("__");
   const [mcpPart, serverName, ...toolNameParts] = parts;
@@ -30297,9 +30320,17 @@ function toolMatchesRule(tool, rule) {
   if (rule.ruleValue.toolName === nameForRuleMatch) {
     return true;
   }
-  const ruleInfo = mcpInfoFromString(rule.ruleValue.toolName);
-  const toolInfo = mcpInfoFromString(nameForRuleMatch);
-  return ruleInfo !== null && toolInfo !== null && (ruleInfo.toolName === undefined || ruleInfo.toolName === "*") && ruleInfo.serverName === toolInfo.serverName;
+  const toolInfo = tool.mcpInfo ?? mcpInfoFromString(nameForRuleMatch);
+  const ruleName = rule.ruleValue.toolName;
+  if (!toolInfo || !ruleName.startsWith("mcp__")) {
+    return false;
+  }
+  if (foldMcpNameForCompare(ruleName) === foldMcpNameForCompare(nameForRuleMatch)) {
+    return true;
+  }
+  const rest = ruleName.slice("mcp__".length);
+  const ruleServerRaw = rest.endsWith("__*") ? rest.slice(0, -3) : rest;
+  return foldMcpNameForCompare(ruleServerRaw) === foldMcpNameForCompare(toolInfo.serverName);
 }
 function toolAlwaysAllowedRule(context, tool) {
   return getAllowRules(context).find((rule) => toolMatchesRule(tool, rule)) || null;
@@ -36851,6 +36882,15 @@ function filterToolsForAgent({
 function computeChildSpawnDepth(parentOptions) {
   return (parentOptions?.spawnDepth ?? 0) + 1;
 }
+function resolveMcpServerDomainTools(toolName, available) {
+  if (typeof toolName !== "string")
+    return null;
+  const info = mcpInfoFromString(toolName);
+  if (!info || info.toolName !== undefined)
+    return null;
+  const prefix = getMcpPrefix(info.serverName);
+  return available.filter((t) => t.name.startsWith(prefix));
+}
 function resolveAgentTools(agentDefinition, availableTools, allowFanOut = false) {
   const { tools: agentTools, disallowedTools, source } = agentDefinition;
   const filtered = filterToolsForAgent({
@@ -36881,7 +36921,18 @@ function resolveAgentTools(agentDefinition, availableTools, allowFanOut = false)
         seen.add(tool);
       }
     } else {
-      invalidTools.push(spec);
+      const domain = resolveMcpServerDomainTools(toolName, allowed);
+      if (domain && domain.length > 0) {
+        validTools.push(spec);
+        for (const t of domain) {
+          if (!seen.has(t)) {
+            resolved.push(t);
+            seen.add(t);
+          }
+        }
+      } else {
+        invalidTools.push(spec);
+      }
     }
   }
   return { hasWildcard: false, validTools, invalidTools, resolvedTools: resolved };
@@ -78400,7 +78451,7 @@ function getMcpDiscoveryInput() {
   return discoveryInput;
 }
 async function buildMcpServerConfigs(input) {
-  const servers = {};
+  const servers = Object.create(null);
   for (const [name, raw] of Object.entries(input.settingsServers ?? {})) {
     const parsed = parseMcpServerConfig(raw);
     if (parsed) {
@@ -78631,6 +78682,7 @@ async function terminateChild(name, child) {
 function createMcpConnectionManager() {
   const connections = new Map;
   const pending = new Set;
+  const pendingConnects = new Map;
   const connectFailures = new Map;
   function fail(name, config, error, authFailure = false) {
     const conn = {
@@ -78643,6 +78695,17 @@ function createMcpConnectionManager() {
     connections.set(name, conn);
     return conn;
   }
+  function markBlocked(name, config, reason) {
+    const conn = {
+      name,
+      type: "failed",
+      config,
+      error: `MCP server "${name}" blocked by enterprise policy: ${reason}`,
+      blockedByPolicy: true
+    };
+    connections.set(name, conn);
+    return conn;
+  }
   async function connectStdio(name, config, opts) {
     const finalCommand = process.env.ATLAS_SHELL_PREFIX || config.command;
     const finalArgs = process.env.ATLAS_SHELL_PREFIX ? [[config.command, ...config.args ?? []].join(" ")] : config.args ?? [];
@@ -78700,7 +78763,7 @@ function createMcpConnectionManager() {
     };
     client.onClose(closeOnDrop);
     const initPromise = client.request("initialize", {
-      protocolVersion: "2025-03-26",
+      protocolVersion: "2026-07-28",
       capabilities: {
         elicitation: {},
         roots: {}
@@ -78727,6 +78790,7 @@ function createMcpConnectionManager() {
             version: init.serverInfo.version
           }
         } : {},
+        ...init.protocolVersion ? { negotiatedProtocolVersion: init.protocolVersion } : {},
         ...init.instructions ? { instructions: init.instructions } : {},
         config,
         cleanup: async () => {
@@ -78753,6 +78817,21 @@ function createMcpConnectionManager() {
     }
   }
   async function connect(name, config, opts) {
+    const existing = connections.get(name);
+    if (existing?.type === "connected")
+      return existing;
+    const inflight = pendingConnects.get(name);
+    if (inflight)
+      return inflight;
+    const attempt = connectOnce(name, config, opts);
+    pendingConnects.set(name, attempt);
+    try {
+      return await attempt;
+    } finally {
+      pendingConnects.delete(name);
+    }
+  }
+  async function connectOnce(name, config, opts) {
     const existing = connections.get(name);
     if (existing?.type === "connected")
       return existing;
@@ -78794,7 +78873,8 @@ function createMcpConnectionManager() {
         await manager.close(name);
       }
     },
-    getPendingServerNames: () => [...pending]
+    getPendingServerNames: () => [...pending],
+    markBlocked
   };
   return manager;
 }
@@ -78809,6 +78889,143 @@ var init_mcpConnectionManager = __esm(() => {
   init_mcpFetch();
 });
 
+// src/mcp/mcpPolicy.ts
+function getMcpPolicyFromSettings(settings) {
+  if (typeof settings !== "object" || settings === null)
+    return {};
+  const rec = settings;
+  return {
+    ...rec.allowedMcpServers !== undefined ? { allowedMcpServers: rec.allowedMcpServers } : {},
+    ...rec.deniedMcpServers !== undefined ? { deniedMcpServers: rec.deniedMcpServers } : {}
+  };
+}
+function getMcpPolicyInput() {
+  return policyInput;
+}
+function normalizePolicyEntries(raw) {
+  if (!Array.isArray(raw))
+    return [];
+  const out = [];
+  for (const entry of raw) {
+    if (typeof entry === "string") {
+      out.push({ kind: "name", value: entry });
+      continue;
+    }
+    if (typeof entry !== "object" || entry === null)
+      continue;
+    const rec = entry;
+    if (typeof rec.serverName === "string") {
+      out.push({ kind: "name", value: rec.serverName });
+    } else if (Array.isArray(rec.serverCommand) && rec.serverCommand.every((c) => typeof c === "string")) {
+      out.push({ kind: "command", value: rec.serverCommand });
+    } else if (typeof rec.serverUrl === "string") {
+      out.push({ kind: "url", value: rec.serverUrl });
+    }
+  }
+  return out;
+}
+function getServerCommandArray(config) {
+  const t = config.type;
+  if (t !== undefined && t !== "stdio") {
+    return null;
+  }
+  const stdioConfig = config;
+  return [stdioConfig.command, ...stdioConfig.args ?? []];
+}
+function commandArraysMatch(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  return a.every((val, idx) => val === b[idx]);
+}
+function getServerUrl(config) {
+  return "url" in config ? config.url : null;
+}
+function urlPatternToRegex(pattern) {
+  const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+  const regexStr = escaped.replace(/\*/g, ".*");
+  return new RegExp(`^${regexStr}$`);
+}
+function urlMatchesPattern(url, pattern) {
+  return urlPatternToRegex(pattern).test(url);
+}
+function isDeniedByEntries(serverName, config, entries) {
+  for (const entry of entries) {
+    if (entry.kind === "name" && entry.value === serverName)
+      return true;
+  }
+  const serverCommand = getServerCommandArray(config);
+  if (serverCommand) {
+    for (const entry of entries) {
+      if (entry.kind === "command" && commandArraysMatch(entry.value, serverCommand)) {
+        return true;
+      }
+    }
+  }
+  const serverUrl = getServerUrl(config);
+  if (serverUrl) {
+    for (const entry of entries) {
+      if (entry.kind === "url" && urlMatchesPattern(serverUrl, entry.value)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function isAllowedByEntries(serverName, config, entries) {
+  const hasCommandEntries = entries.some((e) => e.kind === "command");
+  const hasUrlEntries = entries.some((e) => e.kind === "url");
+  const serverCommand = getServerCommandArray(config);
+  const serverUrl = getServerUrl(config);
+  if (serverCommand) {
+    if (hasCommandEntries) {
+      return entries.some((e) => e.kind === "command" && commandArraysMatch(e.value, serverCommand));
+    }
+    return entries.some((e) => e.kind === "name" && e.value === serverName);
+  }
+  if (serverUrl) {
+    if (hasUrlEntries) {
+      return entries.some((e) => e.kind === "url" && urlMatchesPattern(serverUrl, e.value));
+    }
+    return entries.some((e) => e.kind === "name" && e.value === serverName);
+  }
+  return entries.some((e) => e.kind === "name" && e.value === serverName);
+}
+function checkMcpServerPolicy(serverName, config, policy) {
+  const p = policy ?? getMcpPolicyInput() ?? {};
+  const denied = normalizePolicyEntries(p.deniedMcpServers);
+  if (isDeniedByEntries(serverName, config, denied)) {
+    return { blocked: true, reason: "denied by policy (deniedMcpServers)" };
+  }
+  if (!Array.isArray(p.allowedMcpServers))
+    return { blocked: false };
+  if (p.allowedMcpServers.length === 0) {
+    return {
+      blocked: true,
+      reason: "not in allowedMcpServers allowlist (empty allowlist blocks all servers)"
+    };
+  }
+  const allowed = normalizePolicyEntries(p.allowedMcpServers);
+  if (isAllowedByEntries(serverName, config, allowed)) {
+    return { blocked: false };
+  }
+  return { blocked: true, reason: "not in allowedMcpServers allowlist" };
+}
+function filterMcpServersByPolicy(configs, policy) {
+  const allowed = {};
+  const blocked = [];
+  for (const [name, config] of Object.entries(configs)) {
+    const verdict = checkMcpServerPolicy(name, config, policy);
+    if (verdict.blocked) {
+      blocked.push({ name, reason: verdict.reason ?? "blocked by policy" });
+    } else {
+      allowed[name] = config;
+    }
+  }
+  return { allowed, blocked };
+}
+var policyInput = null;
+
 // src/mcp/index.ts
 var init_mcp3 = __esm(() => {
   init_types6();
@@ -79909,12 +80126,12 @@ var LEGACY_TOOL_NAME_ALIASES;
 var init_legacyToolNameAliases = __esm(() => {
   init_permissions3();
   init_toolNames();
-  LEGACY_TOOL_NAME_ALIASES = {
+  LEGACY_TOOL_NAME_ALIASES = Object.assign(Object.create(null), {
     Task: AGENT_TOOL_NAME,
     KillShell: TASK_STOP_TOOL_NAME,
     AgentOutputTool: TASK_OUTPUT_TOOL_NAME,
     BashOutputTool: TASK_OUTPUT_TOOL_NAME
-  };
+  });
   setLegacyToolNameAliases(LEGACY_TOOL_NAME_ALIASES);
 });
 
@@ -82800,6 +83017,8 @@ async function queryAgentLoop(deps, args) {
   let turns = 0;
   let terminated = false;
   let lastRound;
+  let activeTools = tools;
+  const degradedTools = new Set;
   const maxGoalTurns = args.context?.maxGoalTurns ?? DEFAULT_MAX_GOAL_TURNS;
   let goalTurns = 0;
   let deferredToolUse;
@@ -82842,6 +83061,24 @@ async function queryAgentLoop(deps, args) {
         deps.emit?.({ type: "compacted", turn: turns, messages });
       }
     }
+    if (deps.refreshRoundContext) {
+      try {
+        const refresh = deps.refreshRoundContext(messages);
+        if (refresh) {
+          if (refresh.tools) {
+            activeTools = degradedTools.size > 0 ? refresh.tools.filter((t) => !degradedTools.has(t.name)) : refresh.tools;
+          }
+          if (refresh.appendedMessages && refresh.appendedMessages.length > 0) {
+            messages = [...messages, ...refresh.appendedMessages];
+            if (deps.transcript) {
+              await deps.transcript.record(messages);
+            }
+          }
+        }
+      } catch (refreshErr) {
+        logForDebugging(`[round-context-refresh] failed: ${errorMessage(refreshErr)}`);
+      }
+    }
     deps.emit?.({ type: "round_start", turn: turns });
     let reactiveRetried = false;
     let effectiveDeps = deps;
@@ -82849,7 +83086,7 @@ async function queryAgentLoop(deps, args) {
     for (;; ) {
       const roundInputLen = messages.length;
       try {
-        lastRound = await queryOneRound(effectiveDeps, tools, messages);
+        lastRound = await queryOneRound(effectiveDeps, activeTools, messages);
       } catch (err) {
         if (!reactiveRetried && deps.reactiveCompact !== undefined && isReactiveCompactEnabled() && isReactiveCompactRecoverableError(err)) {
           reactiveRetried = true;
@@ -82872,6 +83109,13 @@ async function queryAgentLoop(deps, args) {
             continue;
           }
         }
+        const rejectedTool = parseToolSchemaRejectionError(err);
+        if (rejectedTool && !degradedTools.has(rejectedTool) && activeTools.some((t) => t.name === rejectedTool)) {
+          degradedTools.add(rejectedTool);
+          activeTools = activeTools.filter((t) => t.name !== rejectedTool);
+          logForDebugging(`[tool-schema-strip] 网关拒绝工具 '${rejectedTool}' 的 input schema，本会话剥除其参数后续跑（tools ${activeTools.length} 个）`);
+          continue;
+        }
         const nextRef = nextFallbackRef(deps.fallbackModels, triedFallbackRefs);
         if (nextRef && shouldRetryModelError(err, deps.signal)) {
           triedFallbackRefs.add(nextRef);
@@ -86960,7 +87204,12 @@ async function connectMcpStartup(args) {
   }) : {};
   const dynamicNames = new Set(Object.keys(dynamicConfigs));
   const allConfigs = strictMcpConfig ? dynamicConfigs : { ...baseConfigs, ...dynamicConfigs };
-  const connectAll = () => Promise.allSettled(Object.entries(allConfigs).map(([name, config]) => manager.connect(name, config, dynamicNames.has(name) ? { connectionTimeoutMs: 5000 } : undefined)));
+  const policy = getMcpPolicyInput() ?? getMcpPolicyFromSettings(getSettingsWithErrors().settings);
+  const { allowed, blocked } = filterMcpServersByPolicy(allConfigs, policy);
+  for (const b of blocked) {
+    manager.markBlocked(b.name, allConfigs[b.name], b.reason);
+  }
+  const connectAll = () => Promise.allSettled(Object.entries(allowed).map(([name, config]) => manager.connect(name, config, dynamicNames.has(name) ? { connectionTimeoutMs: 5000 } : undefined)));
   const nonBlocking = isMcpConnectionNonBlocking();
   if (nonBlocking) {
     connectAll();
@@ -88219,6 +88468,10 @@ async function mapConcurrent(items, fn, concurrency) {
   return results;
 }
 async function checkMcpServerHealth(manager, name, server) {
+  const policy = getMcpPolicyInput() ?? getMcpPolicyFromSettings(getSettingsWithErrors().settings);
+  if (checkMcpServerPolicy(name, server, policy).blocked) {
+    return "✗ Blocked by enterprise policy";
+  }
   try {
     const result = await manager.connect(name, server);
     if (result.type === "connected") {
@@ -88514,6 +88767,7 @@ Warning: The command "${actualCommand}" looks like a URL, but is being interpret
 }
 var init_mcp4 = __esm(() => {
   init_mcp3();
+  init_engine();
   init_entryInit();
   init_mcpConfigWrite();
   init_setup();
@@ -124455,8 +124709,8 @@ var isMcpServerCommandEntry = () => ({}), isMcpServerNameEntry = () => ({}), isM
   mcpServers: record(string2(), any()).optional(),
   allowedMcpServers: any().optional(),
   deniedMcpServers: any().optional(),
-  enabledMcpjsonServers: array(string2()).optional(),
-  disabledMcpjsonServers: array(string2()).optional(),
+  enabledMcpjsonServers: union([string2(), array(string2())]).transform((v) => Array.isArray(v) ? v : [v]).optional(),
+  disabledMcpjsonServers: union([string2(), array(string2())]).transform((v) => Array.isArray(v) ? v : [v]).optional(),
   enabledPlugins: record(string2(), any()).optional(),
   pluginConfigs: any().optional(),
   extraKnownMarketplaces: any().optional(),
@@ -124797,12 +125051,12 @@ function findLastUnescapedChar2(str, char) {
 var LEGACY_TOOL_NAME_ALIASES2;
 var init_permissionRuleParser2 = __esm(() => {
   init_constants6();
-  LEGACY_TOOL_NAME_ALIASES2 = {
+  LEGACY_TOOL_NAME_ALIASES2 = Object.assign(Object.create(null), {
     Task: AGENT_TOOL_NAME2,
     KillShell: TASK_STOP_TOOL_NAME2,
     AgentOutputTool: TASK_OUTPUT_TOOL_NAME2,
     BashOutputTool: TASK_OUTPUT_TOOL_NAME2
-  };
+  });
 });
 
 // src/tui/utils/settings/toolValidationConfig.ts
@@ -188182,6 +188436,97 @@ var init_streamableHttp = __esm(() => {
   };
 });
 
+// src/tui/services/mcp/fetchTimeout.ts
+function getMcpConnectionTimeoutMs() {
+  return parseInt(process.env.MCP_TIMEOUT || "", 10) || 30000;
+}
+function bindBodyReadDeadline(response) {
+  const contentType = response.headers?.get("content-type") ?? "";
+  if (contentType.includes("text/event-stream")) {
+    return response;
+  }
+  const rawBody = response.body;
+  if (!rawBody) {
+    return response;
+  }
+  const reader = rawBody.getReader();
+  let deadlineTimer;
+  const deadline = new Promise((_, reject) => {
+    deadlineTimer = setTimeout(() => reject(new DOMException("The operation timed out.", "TimeoutError")), getMcpConnectionTimeoutMs());
+    deadlineTimer.unref?.();
+  });
+  deadline.catch(() => {});
+  const clearDeadline = () => {
+    if (deadlineTimer) {
+      clearTimeout(deadlineTimer);
+    }
+  };
+  const stream = new ReadableStream({
+    async pull(ctrl) {
+      try {
+        const { done, value } = await Promise.race([reader.read(), deadline]);
+        if (done) {
+          clearDeadline();
+          ctrl.close();
+        } else {
+          ctrl.enqueue(value);
+        }
+      } catch (error) {
+        clearDeadline();
+        reader.cancel().catch(() => {});
+        ctrl.error(error);
+      }
+    },
+    cancel(reason) {
+      clearDeadline();
+      return reader.cancel(reason);
+    }
+  });
+  return new Response(stream, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers
+  });
+}
+function wrapFetchWithTimeout(baseFetch) {
+  return async (url, init) => {
+    const method = (init?.method ?? "GET").toUpperCase();
+    if (method === "GET") {
+      return baseFetch(url, init);
+    }
+    const headers = new Headers(init?.headers);
+    if (!headers.has("accept")) {
+      headers.set("accept", MCP_STREAMABLE_HTTP_ACCEPT);
+    }
+    const controller = new AbortController;
+    const timer = setTimeout((c) => c.abort(new DOMException("The operation timed out.", "TimeoutError")), MCP_REQUEST_TIMEOUT_MS, controller);
+    timer.unref?.();
+    const parentSignal = init?.signal;
+    const abort = () => controller.abort(parentSignal?.reason);
+    parentSignal?.addEventListener("abort", abort);
+    if (parentSignal?.aborted) {
+      controller.abort(parentSignal.reason);
+    }
+    const cleanup = () => {
+      clearTimeout(timer);
+      parentSignal?.removeEventListener("abort", abort);
+    };
+    try {
+      const response = await baseFetch(url, {
+        ...init,
+        headers,
+        signal: controller.signal
+      });
+      cleanup();
+      return bindBodyReadDeadline(response);
+    } catch (error) {
+      cleanup();
+      throw error;
+    }
+  };
+}
+var MCP_REQUEST_TIMEOUT_MS = 60000, MCP_STREAMABLE_HTTP_ACCEPT = "application/json, text/event-stream";
+
 // node_modules/lodash-es/_baseZipObject.js
 function baseZipObject(props, values, assignFunc) {
   var index = -1, length = props.length, valsLength = values.length, result = {};
@@ -193521,6 +193866,73 @@ var init_browser = __esm(() => {
   init_execFileNoThrow2();
 });
 
+// src/tui/services/mcp/headersHelper.ts
+function isMcpServerFromProjectOrLocalSettings(config) {
+  return config.scope === "project" || config.scope === "local";
+}
+async function getMcpHeadersFromHelper(serverName, config) {
+  if (!config.headersHelper) {
+    return null;
+  }
+  if ("scope" in config && isMcpServerFromProjectOrLocalSettings(config)) {
+    const isNonInteractive = getIsNonInteractiveSession();
+    const explicitTrust = process.env.ATLAS_TRUST_WORKSPACE === "true";
+    const hasTrust = checkHasTrustDialogAccepted() || isNonInteractive && explicitTrust;
+    if (!hasTrust) {
+      const error = new Error(`Security: headersHelper for MCP server '${serverName}' executed before workspace trust is confirmed. If you see this message, post in ${MACRO.FEEDBACK_CHANNEL}.`);
+      logAntError("MCP headersHelper invoked before trust check", error);
+      return null;
+    }
+  }
+  try {
+    logMCPDebug(serverName, "Executing headersHelper to get dynamic headers");
+    const execResult = await execFileNoThrowWithCwd2("sh", ["-c", config.headersHelper], {
+      timeout: 1e4,
+      env: {
+        ...process.env,
+        ATLAS_MCP_SERVER_NAME: serverName,
+        ATLAS_MCP_SERVER_URL: config.url
+      }
+    });
+    if (execResult.code !== 0 || !execResult.stdout) {
+      throw new Error(`headersHelper for MCP server '${serverName}' did not return a valid value`);
+    }
+    const result = execResult.stdout.trim();
+    const headers = jsonParse2(result);
+    if (typeof headers !== "object" || headers === null || Array.isArray(headers)) {
+      throw new Error(`headersHelper for MCP server '${serverName}' must return a JSON object with string key-value pairs`);
+    }
+    for (const [key, value] of Object.entries(headers)) {
+      if (typeof value !== "string") {
+        throw new Error(`headersHelper for MCP server '${serverName}' returned non-string value for key "${key}": ${typeof value}`);
+      }
+    }
+    logMCPDebug(serverName, `Successfully retrieved ${Object.keys(headers).length} headers from headersHelper`);
+    return headers;
+  } catch (error) {
+    logMCPError(serverName, `Error getting headers from headersHelper: ${errorMessage2(error)}`);
+    logError3(new Error(`Error getting MCP headers from headersHelper for server '${serverName}': ${errorMessage2(error)}`));
+    return null;
+  }
+}
+async function getMcpServerHeaders(serverName, config) {
+  const staticHeaders = config.headers || {};
+  const dynamicHeaders = await getMcpHeadersFromHelper(serverName, config) || {};
+  return {
+    ...staticHeaders,
+    ...dynamicHeaders
+  };
+}
+var init_headersHelper = __esm(() => {
+  init_bootstrap();
+  init_config6();
+  init_debug();
+  init_errors4();
+  init_execFileNoThrow2();
+  init_log5();
+  init_slowOperations();
+});
+
 // src/tui/services/mcp/oauthPort.ts
 import { createServer } from "http";
 function buildRedirectUri(port = REDIRECT_PORT_FALLBACK) {
@@ -194028,20 +194440,20 @@ async function writeMcpjsonFile2(config) {
     throw e;
   }
 }
-function getServerCommandArray(config) {
+function getServerCommandArray2(config) {
   if (config.type !== undefined && config.type !== "stdio") {
     return null;
   }
   const stdioConfig = config;
   return [stdioConfig.command, ...stdioConfig.args ?? []];
 }
-function commandArraysMatch(a, b) {
+function commandArraysMatch2(a, b) {
   if (a.length !== b.length) {
     return false;
   }
   return a.every((val, idx) => val === b[idx]);
 }
-function getServerUrl(config) {
+function getServerUrl2(config) {
   return "url" in config ? config.url : null;
 }
 function unwrapCcrProxyUrl(url) {
@@ -194057,11 +194469,11 @@ function unwrapCcrProxyUrl(url) {
   }
 }
 function getMcpServerSignature(config) {
-  const cmd = getServerCommandArray(config);
+  const cmd = getServerCommandArray2(config);
   if (cmd) {
     return `stdio:${jsonStringify5(cmd)}`;
   }
-  const url = getServerUrl(config);
+  const url = getServerUrl2(config);
   if (url) {
     return `url:${unwrapCcrProxyUrl(url)}`;
   }
@@ -194123,13 +194535,13 @@ function dedupManagedMcpServers(claudeAiServers, manualServers) {
   }
   return { servers, suppressed };
 }
-function urlPatternToRegex(pattern) {
+function urlPatternToRegex2(pattern) {
   const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
   const regexStr = escaped.replace(/\*/g, ".*");
   return new RegExp(`^${regexStr}$`);
 }
-function urlMatchesPattern(url, pattern) {
-  const regex = urlPatternToRegex(pattern);
+function urlMatchesPattern2(url, pattern) {
+  const regex = urlPatternToRegex2(pattern);
   return regex.test(url);
 }
 function getMcpAllowlistSettings() {
@@ -194152,18 +194564,18 @@ function isMcpServerDenied(serverName, config) {
     }
   }
   if (config) {
-    const serverCommand = getServerCommandArray(config);
+    const serverCommand = getServerCommandArray2(config);
     if (serverCommand) {
       for (const entry of settings.deniedMcpServers) {
-        if (isMcpServerCommandEntry(entry) && commandArraysMatch(entry.serverCommand, serverCommand)) {
+        if (isMcpServerCommandEntry(entry) && commandArraysMatch2(entry.serverCommand, serverCommand)) {
           return true;
         }
       }
     }
-    const serverUrl = getServerUrl(config);
+    const serverUrl = getServerUrl2(config);
     if (serverUrl) {
       for (const entry of settings.deniedMcpServers) {
-        if (isMcpServerUrlEntry(entry) && urlMatchesPattern(serverUrl, entry.serverUrl)) {
+        if (isMcpServerUrlEntry(entry) && urlMatchesPattern2(serverUrl, entry.serverUrl)) {
           return true;
         }
       }
@@ -194185,12 +194597,12 @@ function isMcpServerAllowedByPolicy(serverName, config) {
   const hasCommandEntries = settings.allowedMcpServers.some(isMcpServerCommandEntry);
   const hasUrlEntries = settings.allowedMcpServers.some(isMcpServerUrlEntry);
   if (config) {
-    const serverCommand = getServerCommandArray(config);
-    const serverUrl = getServerUrl(config);
+    const serverCommand = getServerCommandArray2(config);
+    const serverUrl = getServerUrl2(config);
     if (serverCommand) {
       if (hasCommandEntries) {
         for (const entry of settings.allowedMcpServers) {
-          if (isMcpServerCommandEntry(entry) && commandArraysMatch(entry.serverCommand, serverCommand)) {
+          if (isMcpServerCommandEntry(entry) && commandArraysMatch2(entry.serverCommand, serverCommand)) {
             return true;
           }
         }
@@ -194206,7 +194618,7 @@ function isMcpServerAllowedByPolicy(serverName, config) {
     } else if (serverUrl) {
       if (hasUrlEntries) {
         for (const entry of settings.allowedMcpServers) {
-          if (isMcpServerUrlEntry(entry) && urlMatchesPattern(serverUrl, entry.serverUrl)) {
+          if (isMcpServerUrlEntry(entry) && urlMatchesPattern2(serverUrl, entry.serverUrl)) {
             return true;
           }
         }
@@ -194235,7 +194647,7 @@ function isMcpServerAllowedByPolicy(serverName, config) {
   }
   return false;
 }
-function filterMcpServersByPolicy(configs) {
+function filterMcpServersByPolicy2(configs) {
   const allowed = {};
   const blocked = [];
   for (const [name, config] of Object.entries(configs)) {
@@ -194687,7 +195099,7 @@ async function getAllMcpConfigs2() {
   }
   const claudeaiPromise = Promise.resolve({});
   const { servers: claudeCodeServers, errors } = await getMcpConfigs({}, claudeaiPromise);
-  const { allowed: claudeaiMcpServers } = filterMcpServersByPolicy(await claudeaiPromise);
+  const { allowed: claudeaiMcpServers } = filterMcpServersByPolicy2(await claudeaiPromise);
   const { servers: dedupedClaudeAi } = dedupManagedMcpServers(claudeaiMcpServers, claudeCodeServers);
   const servers = Object.assign({}, dedupedClaudeAi, claudeCodeServers);
   return { servers, errors };
@@ -194792,6 +195204,9 @@ function parseMcpConfigFromFilePath(params) {
       ]
     };
   }
+  if (!configContent.trim()) {
+    return { config: { mcpServers: {} }, errors: [] };
+  }
   const parsedJson = safeParseJSON3(configContent);
   if (!parsedJson) {
     logForDebugging3(`MCP config is not valid JSON: ${filePath} (scope=${scope}, length=${configContent.length}, first100=${jsonStringify5(configContent.slice(0, 100))})`, { level: "error" });
@@ -194811,6 +195226,9 @@ function parseMcpConfigFromFilePath(params) {
       ]
     };
   }
+  if (typeof parsedJson === "object" && parsedJson !== null && !Array.isArray(parsedJson) && Object.keys(parsedJson).length === 0) {
+    return { config: { mcpServers: {} }, errors: [] };
+  }
   return parseMcpConfig({
     configObject: parsedJson,
     expandVars,
@@ -194941,11 +195359,11 @@ function hashMcpConfig(config) {
   });
   return createHash4("sha256").update(stable).digest("hex").slice(0, 16);
 }
-function excludeStalePluginClients(mcp, configs) {
+function excludeStalePluginClients(mcp, configs, opts) {
   const stale = mcp.clients.filter((c) => {
     const fresh = configs[c.name];
     if (!fresh)
-      return c.config.scope === "dynamic";
+      return opts?.absentIsStale || c.config.scope === "dynamic";
     return hashMcpConfig(c.config) !== hashMcpConfig(fresh);
   });
   if (stale.length === 0) {
@@ -195741,6 +196159,53 @@ function createAuthFetch() {
     }
   };
 }
+async function resolveConfiguredMcpHeaders(serverName, serverConfig) {
+  try {
+    return await getMcpServerHeaders(serverName, serverConfig);
+  } catch (error) {
+    logMCPDebug(serverName, `Failed to resolve configured headers for OAuth: ${errorMessage2(error)}`);
+    return {};
+  }
+}
+function headersToRecord2(headers) {
+  const out = {};
+  if (!headers)
+    return out;
+  if (headers instanceof Headers) {
+    headers.forEach((v, k) => {
+      out[k] = v;
+    });
+    return out;
+  }
+  if (Array.isArray(headers)) {
+    for (const [k, v] of headers)
+      out[k] = v;
+    return out;
+  }
+  if (typeof headers === "object") {
+    for (const [k, v] of Object.entries(headers)) {
+      out[k] = String(v);
+    }
+  }
+  return out;
+}
+function mergeConfiguredHeaders(fetchLike, configured) {
+  if (Object.keys(configured).length === 0)
+    return fetchLike;
+  return (url, init) => {
+    const requestHeaders = headersToRecord2(init?.headers);
+    const requestKeys = new Set(Object.keys(requestHeaders).map((k) => k.toLowerCase()));
+    const configuredNotOverridden = Object.fromEntries(Object.entries(configured).filter(([k]) => !requestKeys.has(k.toLowerCase())));
+    return fetchLike(url, {
+      ...init,
+      headers: { ...configuredNotOverridden, ...requestHeaders }
+    });
+  };
+}
+async function withConfiguredHeaders(fetchLike, serverName, serverConfig) {
+  const configured = await resolveConfiguredMcpHeaders(serverName, serverConfig);
+  return mergeConfiguredHeaders(fetchLike, configured);
+}
 async function fetchAuthServerMetadata(serverName, serverUrl, configuredMetadataUrl, fetchFn, resourceMetadataUrl) {
   if (configuredMetadataUrl) {
     if (!configuredMetadataUrl.startsWith("https://")) {
@@ -195799,12 +196264,14 @@ async function revokeToken({
   clientId,
   clientSecret,
   accessToken,
-  authMethod = "client_secret_basic"
+  authMethod = "client_secret_basic",
+  extraHeaders
 }) {
   const params = new URLSearchParams;
   params.set("token", token);
   params.set("token_type_hint", tokenTypeHint);
   const headers = {
+    ...extraHeaders ?? {},
     "Content-Type": "application/x-www-form-urlencoded"
   };
   if (clientId && clientSecret) {
@@ -195847,7 +196314,8 @@ async function revokeServerTokens(serverName, serverConfig, { preserveStepUpStat
   if (tokenData?.accessToken || tokenData?.refreshToken) {
     try {
       const asUrl = tokenData.discoveryState?.authorizationServerUrl ?? serverConfig.url;
-      const metadata = await fetchAuthServerMetadata(serverName, asUrl, serverConfig.oauth?.authServerMetadataUrl);
+      const configuredHeaders = await resolveConfiguredMcpHeaders(serverName, serverConfig);
+      const metadata = await fetchAuthServerMetadata(serverName, asUrl, serverConfig.oauth?.authServerMetadataUrl, mergeConfiguredHeaders(createAuthFetch(), configuredHeaders));
       if (!metadata) {
         logMCPDebug(serverName, "No OAuth metadata found");
       } else {
@@ -195869,7 +196337,8 @@ async function revokeServerTokens(serverName, serverConfig, { preserveStepUpStat
                 clientId: tokenData.clientId,
                 clientSecret: tokenData.clientSecret,
                 accessToken: tokenData.accessToken,
-                authMethod
+                authMethod,
+                extraHeaders: configuredHeaders
               });
             } catch (error) {
               logMCPDebug(serverName, `Failed to revoke refresh token: ${errorMessage2(error)}`);
@@ -195885,7 +196354,8 @@ async function revokeServerTokens(serverName, serverConfig, { preserveStepUpStat
                 clientId: tokenData.clientId,
                 clientSecret: tokenData.clientSecret,
                 accessToken: tokenData.accessToken,
-                authMethod
+                authMethod,
+                extraHeaders: configuredHeaders
               });
             } catch (error) {
               logMCPDebug(serverName, `Failed to revoke access token: ${errorMessage2(error)}`);
@@ -196078,8 +196548,9 @@ async function performMCPOAuthFlow(serverName, serverConfig, onAuthorizationUrl,
     const redirectUri = buildRedirectUri(port);
     logMCPDebug(serverName, `Using redirect port: ${port}${configuredCallbackPort ? " (from config)" : ""}`);
     const provider = new ClaudeAuthProvider(serverName, serverConfig, redirectUri, true, onAuthorizationUrl, options?.skipBrowserOpen);
+    const oauthFetch = await withConfiguredHeaders(createAuthFetch(), serverName, serverConfig);
     try {
-      const metadata = await fetchAuthServerMetadata(serverName, serverConfig.url, serverConfig.oauth?.authServerMetadataUrl, undefined, wwwAuthParams.resourceMetadataUrl);
+      const metadata = await fetchAuthServerMetadata(serverName, serverConfig.url, serverConfig.oauth?.authServerMetadataUrl, oauthFetch, wwwAuthParams.resourceMetadataUrl);
       if (metadata) {
         provider.setMetadata(metadata);
         logMCPDebug(serverName, `Fetched OAuth metadata with scope: ${getScopeFromMetadata(metadata) || "NONE"}`);
@@ -196215,7 +196686,8 @@ async function performMCPOAuthFlow(serverName, serverConfig, onAuthorizationUrl,
           const result = await auth(provider, {
             serverUrl: serverConfig.url,
             scope: wwwAuthParams.scope,
-            resourceMetadataUrl: wwwAuthParams.resourceMetadataUrl
+            resourceMetadataUrl: wwwAuthParams.resourceMetadataUrl,
+            fetchFn: oauthFetch
           });
           logMCPDebug(serverName, `Initial auth result: ${result}`);
           if (result !== "REDIRECT") {
@@ -196239,7 +196711,8 @@ async function performMCPOAuthFlow(serverName, serverConfig, onAuthorizationUrl,
     const result = await auth(provider, {
       serverUrl: serverConfig.url,
       authorizationCode,
-      resourceMetadataUrl: wwwAuthParams.resourceMetadataUrl
+      resourceMetadataUrl: wwwAuthParams.resourceMetadataUrl,
+      fetchFn: oauthFetch
     });
     logMCPDebug(serverName, `Auth result: ${result}`);
     if (result === "AUTHORIZED") {
@@ -196746,7 +197219,7 @@ class ClaudeAuthProvider {
     if (metadataUrl) {
       logMCPDebug(this.serverName, `Fetching metadata from configured URL: ${metadataUrl}`);
       try {
-        const metadata = await fetchAuthServerMetadata(this.serverName, this.serverConfig.url, metadataUrl);
+        const metadata = await fetchAuthServerMetadata(this.serverName, this.serverConfig.url, metadataUrl, await withConfiguredHeaders(createAuthFetch(), this.serverName, this.serverConfig));
         if (metadata) {
           return {
             authorizationServerUrl: metadata.issuer,
@@ -196831,7 +197304,7 @@ class ClaudeAuthProvider {
     for (let attempt = 1;attempt <= MAX_ATTEMPTS; attempt++) {
       try {
         logMCPDebug(this.serverName, `Starting token refresh`);
-        const authFetch = createAuthFetch();
+        const authFetch = await withConfiguredHeaders(createAuthFetch(), this.serverName, this.serverConfig);
         let metadata = this._metadata;
         if (!metadata) {
           const cached = await this.discoveryState();
@@ -197007,6 +197480,7 @@ var init_auth3 = __esm(() => {
   init_secureStorage();
   init_macOsKeychainHelpers();
   init_slowOperations();
+  init_headersHelper();
   init_oauthPort();
   init_utils6();
   init_xaa();
@@ -201002,10 +201476,10 @@ function parseProxyResponse(socket) {
     read();
   });
 }
-var import_debug52, debug;
+var import_debug53, debug;
 var init_parse_proxy_response = __esm(() => {
-  import_debug52 = __toESM(require_src(), 1);
-  debug = import_debug52.default("https-proxy-agent:parse-proxy-response");
+  import_debug53 = __toESM(require_src(), 1);
+  debug = import_debug53.default("https-proxy-agent:parse-proxy-response");
 });
 
 // node_modules/proxy-agent-negotiate/dist/index.js
@@ -201058,7 +201532,7 @@ function omit2(obj, ...keys) {
   }
   return ret;
 }
-var import_debug53, debug2, setServernameFromNonIpHost = (options) => {
+var import_debug54, debug2, setServernameFromNonIpHost = (options) => {
   if (options.servername === undefined && options.host && !net2.isIP(options.host)) {
     return {
       ...options,
@@ -201070,8 +201544,8 @@ var import_debug53, debug2, setServernameFromNonIpHost = (options) => {
 var init_dist7 = __esm(() => {
   init_dist6();
   init_parse_proxy_response();
-  import_debug53 = __toESM(require_src(), 1);
-  debug2 = import_debug53.default("https-proxy-agent");
+  import_debug54 = __toESM(require_src(), 1);
+  debug2 = import_debug54.default("https-proxy-agent");
   HttpsProxyAgent2 = class HttpsProxyAgent2 extends Agent2 {
     constructor(proxy, opts) {
       super(opts);
@@ -202132,73 +202606,6 @@ var init_classifyForCollapse = __esm(() => {
     "resources_list"
   ]);
 });
-
-// src/tui/services/mcp/headersHelper.ts
-function isMcpServerFromProjectOrLocalSettings(config) {
-  return config.scope === "project" || config.scope === "local";
-}
-async function getMcpHeadersFromHelper(serverName, config) {
-  if (!config.headersHelper) {
-    return null;
-  }
-  if ("scope" in config && isMcpServerFromProjectOrLocalSettings(config)) {
-    const isNonInteractive = getIsNonInteractiveSession();
-    const explicitTrust = process.env.ATLAS_TRUST_WORKSPACE === "true";
-    const hasTrust = checkHasTrustDialogAccepted() || isNonInteractive && explicitTrust;
-    if (!hasTrust) {
-      const error = new Error(`Security: headersHelper for MCP server '${serverName}' executed before workspace trust is confirmed. If you see this message, post in ${MACRO.FEEDBACK_CHANNEL}.`);
-      logAntError("MCP headersHelper invoked before trust check", error);
-      return null;
-    }
-  }
-  try {
-    logMCPDebug(serverName, "Executing headersHelper to get dynamic headers");
-    const execResult = await execFileNoThrowWithCwd2("sh", ["-c", config.headersHelper], {
-      timeout: 1e4,
-      env: {
-        ...process.env,
-        ATLAS_MCP_SERVER_NAME: serverName,
-        ATLAS_MCP_SERVER_URL: config.url
-      }
-    });
-    if (execResult.code !== 0 || !execResult.stdout) {
-      throw new Error(`headersHelper for MCP server '${serverName}' did not return a valid value`);
-    }
-    const result = execResult.stdout.trim();
-    const headers = jsonParse2(result);
-    if (typeof headers !== "object" || headers === null || Array.isArray(headers)) {
-      throw new Error(`headersHelper for MCP server '${serverName}' must return a JSON object with string key-value pairs`);
-    }
-    for (const [key, value] of Object.entries(headers)) {
-      if (typeof value !== "string") {
-        throw new Error(`headersHelper for MCP server '${serverName}' returned non-string value for key "${key}": ${typeof value}`);
-      }
-    }
-    logMCPDebug(serverName, `Successfully retrieved ${Object.keys(headers).length} headers from headersHelper`);
-    return headers;
-  } catch (error) {
-    logMCPError(serverName, `Error getting headers from headersHelper: ${errorMessage2(error)}`);
-    logError3(new Error(`Error getting MCP headers from headersHelper for server '${serverName}': ${errorMessage2(error)}`));
-    return null;
-  }
-}
-async function getMcpServerHeaders(serverName, config) {
-  const staticHeaders = config.headers || {};
-  const dynamicHeaders = await getMcpHeadersFromHelper(serverName, config) || {};
-  return {
-    ...staticHeaders,
-    ...dynamicHeaders
-  };
-}
-var init_headersHelper = __esm(() => {
-  init_bootstrap();
-  init_config6();
-  init_debug();
-  init_errors4();
-  init_execFileNoThrow2();
-  init_log5();
-  init_slowOperations();
-});
 // src/tui/skills/mcpSkills.ts
 var exports_mcpSkills = {};
 __export(exports_mcpSkills, {
@@ -209645,6 +210052,11 @@ function isMcpSessionExpiredError(error) {
   }
   return error.message.includes('"code":-32001') || error.message.includes('"code": -32001');
 }
+function truncateMcpDescriptionText(text) {
+  if (!text)
+    return text;
+  return text.length > MAX_MCP_DESCRIPTION_LENGTH ? text.slice(0, MAX_MCP_DESCRIPTION_LENGTH) + "… [truncated]" : text;
+}
 function getMcpToolTimeoutMs() {
   return parseInt(process.env.MCP_TOOL_TIMEOUT || "", 10) || DEFAULT_MCP_TOOL_TIMEOUT_MS;
 }
@@ -209693,46 +210105,6 @@ async function createNodeWsClient(url, options) {
   const WS = wrapper_default;
   return new WS(url, ["mcp"], options);
 }
-function getConnectionTimeoutMs2() {
-  return parseInt(process.env.MCP_TIMEOUT || "", 10) || 30000;
-}
-function wrapFetchWithTimeout(baseFetch) {
-  return async (url, init) => {
-    const method = (init?.method ?? "GET").toUpperCase();
-    if (method === "GET") {
-      return baseFetch(url, init);
-    }
-    const headers = new Headers(init?.headers);
-    if (!headers.has("accept")) {
-      headers.set("accept", MCP_STREAMABLE_HTTP_ACCEPT);
-    }
-    const controller = new AbortController;
-    const timer = setTimeout((c) => c.abort(new DOMException("The operation timed out.", "TimeoutError")), MCP_REQUEST_TIMEOUT_MS, controller);
-    timer.unref?.();
-    const parentSignal = init?.signal;
-    const abort = () => controller.abort(parentSignal?.reason);
-    parentSignal?.addEventListener("abort", abort);
-    if (parentSignal?.aborted) {
-      controller.abort(parentSignal.reason);
-    }
-    const cleanup = () => {
-      clearTimeout(timer);
-      parentSignal?.removeEventListener("abort", abort);
-    };
-    try {
-      const response = await baseFetch(url, {
-        ...init,
-        headers,
-        signal: controller.signal
-      });
-      cleanup();
-      return response;
-    } catch (error) {
-      cleanup();
-      throw error;
-    }
-  };
-}
 function getMcpServerConnectionBatchSize() {
   return parseInt(process.env.MCP_SERVER_CONNECTION_BATCH_SIZE || "", 10) || 3;
 }
@@ -210382,7 +210754,7 @@ function extractToolUseId(message) {
   }
   return message.message.content[0].id;
 }
-var fetchMcpSkillsForClient2, McpAuthError, McpSessionExpiredError, McpToolCallError_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS, DEFAULT_MCP_TOOL_TIMEOUT_MS = 1e8, MAX_MCP_DESCRIPTION_LENGTH = 2048, computerUseWrapper, isComputerUseMCPServer2, MCP_AUTH_CACHE_TTL_MS, authCachePromise = null, writeChain, IMAGE_MIME_TYPES, MCP_REQUEST_TIMEOUT_MS = 60000, MCP_STREAMABLE_HTTP_ACCEPT = "application/json, text/event-stream", ALLOWED_IDE_TOOLS, connectToServer, MCP_FETCH_CACHE_SIZE2 = 20, fetchToolsForClient2, fetchResourcesForClient2, fetchCommandsForClient2;
+var fetchMcpSkillsForClient2, McpAuthError, McpSessionExpiredError, McpToolCallError_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS, DEFAULT_MCP_TOOL_TIMEOUT_MS = 1e8, MAX_MCP_DESCRIPTION_LENGTH = 4096, computerUseWrapper, isComputerUseMCPServer2, MCP_AUTH_CACHE_TTL_MS, authCachePromise = null, writeChain, IMAGE_MIME_TYPES, ALLOWED_IDE_TOOLS, connectToServer, MCP_FETCH_CACHE_SIZE2 = 20, fetchToolsForClient2, fetchResourcesForClient2, fetchCommandsForClient2;
 var init_client4 = __esm(() => {
   init_shared();
   init_client3();
@@ -210674,7 +211046,7 @@ var init_client4 = __esm(() => {
           ]
         };
       });
-      logMCPDebug(name, `Starting connection with timeout of ${getConnectionTimeoutMs2()}ms`);
+      logMCPDebug(name, `Starting connection with timeout of ${getMcpConnectionTimeoutMs()}ms`);
       if (serverRef.type === "http") {
         logMCPDebug(name, `Testing basic HTTP connectivity to ${serverRef.url}`);
         try {
@@ -210691,13 +211063,13 @@ var init_client4 = __esm(() => {
       const timeoutPromise = new Promise((_, reject) => {
         const timeoutId = setTimeout(() => {
           const elapsed = Date.now() - connectStartTime;
-          logMCPDebug(name, `Connection timeout triggered after ${elapsed}ms (limit: ${getConnectionTimeoutMs2()}ms)`);
+          logMCPDebug(name, `Connection timeout triggered after ${elapsed}ms (limit: ${getMcpConnectionTimeoutMs()}ms)`);
           if (inProcessServer) {
             inProcessServer.close().catch(() => {});
           }
           transport.close().catch(() => {});
-          reject(new TelemetrySafeError_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS(`MCP server "${name}" connection timed out after ${getConnectionTimeoutMs2()}ms`, "MCP connection timeout"));
-        }, getConnectionTimeoutMs2());
+          reject(new TelemetrySafeError_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS(`MCP server "${name}" connection timed out after ${getMcpConnectionTimeoutMs()}ms`, "MCP connection timeout"));
+        }, getMcpConnectionTimeoutMs());
         connectPromise.then(() => {
           clearTimeout(timeoutId);
         }, (_error) => {
@@ -210745,9 +211117,8 @@ var init_client4 = __esm(() => {
       const capabilities = client.getServerCapabilities();
       const serverVersion = client.getServerVersion();
       const rawInstructions = client.getInstructions();
-      let instructions = rawInstructions;
-      if (rawInstructions && rawInstructions.length > MAX_MCP_DESCRIPTION_LENGTH) {
-        instructions = rawInstructions.slice(0, MAX_MCP_DESCRIPTION_LENGTH) + "… [truncated]";
+      const instructions = truncateMcpDescriptionText(rawInstructions);
+      if (instructions !== rawInstructions) {
         logMCPDebug(name, `Server instructions truncated from ${rawInstructions.length} to ${MAX_MCP_DESCRIPTION_LENGTH} chars`);
       }
       logMCPDebug(name, `Connection established with capabilities: ${jsonStringify5({
@@ -211035,8 +211406,7 @@ var init_client4 = __esm(() => {
             return tool.description ?? "";
           },
           async prompt() {
-            const desc = tool.description ?? "";
-            return desc.length > MAX_MCP_DESCRIPTION_LENGTH ? desc.slice(0, MAX_MCP_DESCRIPTION_LENGTH) + "… [truncated]" : desc;
+            return truncateMcpDescriptionText(tool.description ?? "");
           },
           isConcurrencySafe() {
             return tool.annotations?.readOnlyHint ?? false;
@@ -276339,6 +276709,15 @@ function filterToolsForAgent2({
 function computeChildSpawnDepth2(parentOptions) {
   return (parentOptions?.spawnDepth ?? 0) + 1;
 }
+function resolveMcpServerDomainTools2(toolName, available) {
+  if (typeof toolName !== "string")
+    return null;
+  const info = mcpInfoFromString3(toolName);
+  if (!info || info.toolName !== undefined)
+    return null;
+  const prefix = getMcpPrefix3(info.serverName);
+  return available.filter((t) => t.name.startsWith(prefix));
+}
 function resolveAgentTools2(agentDefinition, availableTools, isAsync = false, isMainThread = false, allowFanOut = false) {
   const {
     tools: agentTools,
@@ -276395,7 +276774,18 @@ function resolveAgentTools2(agentDefinition, availableTools, isAsync = false, is
         resolvedToolsSet.add(tool);
       }
     } else {
-      invalidTools.push(toolSpec);
+      const domain = resolveMcpServerDomainTools2(toolName, allowedAvailableTools);
+      if (domain && domain.length > 0) {
+        validTools.push(toolSpec);
+        for (const t of domain) {
+          if (!resolvedToolsSet.has(t)) {
+            resolved.push(t);
+            resolvedToolsSet.add(t);
+          }
+        }
+      } else {
+        invalidTools.push(toolSpec);
+      }
     }
   }
   return {
@@ -276652,6 +277042,7 @@ var init_agentToolUtils2 = __esm(() => {
   init_errors4();
   init_messages3();
   init_permissionRuleParser2();
+  init_mcpStringUtils();
   init_yoloClassifier();
   init_sdkProgress();
   init_teammateContext3();
@@ -321769,7 +322160,8 @@ function buildAgentLoopParams(m) {
       }
     },
     systemPrompt: asSystemPrompt(appendSystemContext(m.systemPrompt, systemContext)),
-    effortValue: m.effort !== undefined ? String(m.effort) : undefined
+    effortValue: m.effort !== undefined ? String(m.effort) : undefined,
+    refreshRoundContext: m.refreshRoundContext
   };
   const unboundedTurns = m.unboundedTurns ?? m.maxTurns === undefined;
   const args = {
@@ -322338,7 +322730,8 @@ function getDefaultAppState() {
       tools: [],
       commands: [],
       resources: {},
-      pluginReconnectKey: 0
+      pluginReconnectKey: 0,
+      cwdReconnectKey: 0
     },
     plugins: {
       enabled: [],
@@ -348079,7 +348472,8 @@ async function clearConversation({
           tools: [],
           commands: [],
           resources: {},
-          pluginReconnectKey: prev.mcp.pluginReconnectKey
+          pluginReconnectKey: prev.mcp.pluginReconnectKey,
+          cwdReconnectKey: prev.mcp.cwdReconnectKey
         }
       };
     });
@@ -369468,7 +369862,9 @@ function useManageMCPConnections(dynamicMcpConfig, isStrictMcpConfig = false) {
   const store = useAppStateStore();
   const _authVersion = useAppState((s) => s.authVersion);
   const _pluginReconnectKey = useAppState((s) => s.mcp.pluginReconnectKey);
+  const _cwdReconnectKey = useAppState((s) => s.mcp.cwdReconnectKey);
   const setAppState = useSetAppState();
+  const lastCwdRef = import_react110.useRef(null);
   const reconnectTimersRef = import_react110.useRef(new Map);
   const mcpFailureTrackerRef = import_react110.useRef(null);
   const notifyMcpConnectionFailure = import_react110.useCallback((serverName, error) => {
@@ -369695,9 +370091,12 @@ function useManageMCPConnections(dynamicMcpConfig, isStrictMcpConfig = false) {
     async function initializeServersAsPending() {
       const { servers: existingConfigs, errors: mcpErrors } = isStrictMcpConfig ? { servers: {}, errors: [] } : await getMcpConfigs(dynamicMcpConfig);
       const configs = { ...existingConfigs, ...dynamicMcpConfig };
+      const currentCwd = getCwd();
+      const cwdChanged = lastCwdRef.current !== null && lastCwdRef.current !== currentCwd;
+      lastCwdRef.current = currentCwd;
       addErrorsToAppState(setAppState, mcpErrors);
       setAppState((prevState) => {
-        const { stale, ...mcpWithoutStale } = excludeStalePluginClients(prevState.mcp, configs);
+        const { stale, ...mcpWithoutStale } = excludeStalePluginClients(prevState.mcp, configs, { absentIsStale: cwdChanged });
         for (const s of stale) {
           const timer = reconnectTimersRef.current.get(s.name);
           if (timer) {
@@ -369736,7 +370135,8 @@ function useManageMCPConnections(dynamicMcpConfig, isStrictMcpConfig = false) {
     dynamicMcpConfig,
     setAppState,
     sessionId,
-    _pluginReconnectKey
+    _pluginReconnectKey,
+    _cwdReconnectKey
   ]);
   import_react110.useEffect(() => {
     let cancelled = false;
@@ -369753,7 +370153,7 @@ function useManageMCPConnections(dynamicMcpConfig, isStrictMcpConfig = false) {
       });
       let claudeaiConfigs = {};
       if (!isStrictMcpConfig) {
-        claudeaiConfigs = filterMcpServersByPolicy(await claudeaiPromise).allowed;
+        claudeaiConfigs = filterMcpServersByPolicy2(await claudeaiPromise).allowed;
         if (cancelled)
           return;
         if (Object.keys(claudeaiConfigs).length > 0) {
@@ -369819,7 +370219,8 @@ function useManageMCPConnections(dynamicMcpConfig, isStrictMcpConfig = false) {
     setAppState,
     _authVersion,
     sessionId,
-    _pluginReconnectKey
+    _pluginReconnectKey,
+    _cwdReconnectKey
   ]);
   import_react110.useEffect(() => {
     const timers = reconnectTimersRef.current;
@@ -412095,7 +412496,7 @@ var exports_cd = {};
 __export(exports_cd, {
   call: () => call46
 });
-var USAGE2 = "Usage: /cd [path] (no argument = show current session cwd)", call46 = async (_args, _context) => {
+var USAGE2 = "Usage: /cd [path] (no argument = show current session cwd)", call46 = async (_args, context) => {
   const arg = (_args ?? "").trim();
   if (arg === "") {
     return {
@@ -412106,6 +412507,10 @@ ${USAGE2}`
   }
   try {
     setCwd2(arg, pwd());
+    context.setAppState((prev) => ({
+      ...prev,
+      mcp: { ...prev.mcp, cwdReconnectKey: prev.mcp.cwdReconnectKey + 1 }
+    }));
     return {
       type: "text",
       value: `Session working directory changed to: ${pwd()}`
@@ -428686,7 +429091,7 @@ function getHttpHookPolicy() {
     allowedEnvVars: settings.httpHookAllowedEnvVars
   };
 }
-function urlMatchesPattern2(url, pattern) {
+function urlMatchesPattern3(url, pattern) {
   const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
   const regexStr = escaped.replace(/\*/g, ".*");
   return new RegExp(`^${regexStr}$`).test(url);
@@ -428708,7 +429113,7 @@ function interpolateEnvVars(value, allowedEnvVars) {
 async function execHttpHook(hook, _hookEvent, jsonInput, signal) {
   const policy = getHttpHookPolicy();
   if (policy.allowedUrls !== undefined) {
-    const matched = policy.allowedUrls.some((p) => urlMatchesPattern2(hook.url, p));
+    const matched = policy.allowedUrls.some((p) => urlMatchesPattern3(hook.url, p));
     if (!matched) {
       const msg = `HTTP hook blocked: ${hook.url} does not match any pattern in allowedHttpHookUrls`;
       logForDebugging3(msg, { level: "warn" });
@@ -470300,6 +470705,32 @@ var init_useMailboxBridge = __esm(() => {
 
 // src/tui/replLoopDeps.ts
 function buildReplLoopParams(m) {
+  let prevPoolSig = (m.tools ?? []).map((t) => t.name).join(",");
+  const refreshRoundContext = (messages) => {
+    const appState = m.toolUseContext?.getAppState?.();
+    const liveMcpTools = appState?.mcp?.tools;
+    if (!liveMcpTools)
+      return null;
+    const pool = assembleToolPool(m.toolPermissionContext, liveMcpTools);
+    const sig = pool.map((t) => t.name).join(",");
+    const tuiMessages = messages;
+    const atts = [
+      ...getDeferredToolsDeltaAttachment(pool, m.mainLoopModel, tuiMessages, {
+        callSite: "round_refresh",
+        querySource: m.querySource
+      }),
+      ...getMcpInstructionsDeltaAttachment(m.toolUseContext.options.mcpClients ?? [], pool, m.mainLoopModel, tuiMessages)
+    ];
+    if (sig === prevPoolSig && atts.length === 0)
+      return null;
+    prevPoolSig = sig;
+    return {
+      tools: pool,
+      ...atts.length > 0 ? {
+        appendedMessages: atts.map((att) => createAttachmentMessage(att))
+      } : {}
+    };
+  };
   return buildAgentLoopParams({
     messages: m.messages,
     userContext: m.userContext,
@@ -470315,11 +470746,14 @@ function buildReplLoopParams(m) {
     toolUseContext: m.toolUseContext,
     querySource: m.querySource,
     unboundedTurns: true,
-    maxGoalTurns: m.maxGoalTurns
+    maxGoalTurns: m.maxGoalTurns,
+    refreshRoundContext
   });
 }
 var init_replLoopDeps = __esm(() => {
   init_agentLoopDeps();
+  init_tools3();
+  init_attachments();
 });
 
 // src/tui/hooks/useMergedClients.ts
@@ -493526,7 +493960,7 @@ ${formattedErrors}
         const {
           allowed,
           blocked
-        } = filterMcpServersByPolicy(scopedConfigs);
+        } = filterMcpServersByPolicy2(scopedConfigs);
         if (blocked.length > 0) {
           process.stderr.write(`Warning: MCP ${plural2(blocked.length, "server")} blocked by enterprise policy: ${blocked.join(", ")}
 `);
@@ -494207,7 +494641,8 @@ ${inputPrompt}` : mergePrompt;
         tools: [],
         commands: [],
         resources: {},
-        pluginReconnectKey: 0
+        pluginReconnectKey: 0,
+        cwdReconnectKey: 0
       },
       plugins: {
         enabled: [],