@atlasharness/atlascode 0.1.80 → 0.1.82

package/dist/cli.js

@@ -19862,7 +19862,7 @@ var init_openai = __esm(() => {
 });
 
 // src/modelprovider/constants.ts
-var API_IMAGE_MAX_BASE64_SIZE, IMAGE_TARGET_RAW_SIZE, PDF_TARGET_RAW_SIZE, API_PDF_MAX_PAGES = 100, LLM_TIMEOUT_DEFAULT_MS = 900000, LLM_TIMEOUT_CAP_MS = 1800000, LLM_TIMEOUT_UNIT_WARN_THRESHOLD_MS = 60000, STREAM_IDLE_TIMEOUT_MS = 300000, SUMMARIZE_CONNECTOR_TEXT_BETA_HEADER, AFK_MODE_BETA_HEADER;
+var API_IMAGE_MAX_BASE64_SIZE, IMAGE_TARGET_RAW_SIZE, PDF_TARGET_RAW_SIZE, API_PDF_MAX_PAGES = 100, LLM_TIMEOUT_DEFAULT_MS = 900000, LLM_TIMEOUT_CAP_MS = 1800000, LLM_TIMEOUT_UNIT_WARN_THRESHOLD_MS = 60000, STREAM_IDLE_TIMEOUT_MS = 300000, STREAM_IDLE_RETURN_GRACE_MS = 1000, SUMMARIZE_CONNECTOR_TEXT_BETA_HEADER, AFK_MODE_BETA_HEADER;
 var init_constants2 = __esm(() => {
   init_shared();
   API_IMAGE_MAX_BASE64_SIZE = 5 * 1024 * 1024;
@@ -19901,7 +19901,7 @@ var init_clients = __esm(() => {
 });
 
 // src/modelprovider/streamIdleWatchdog.ts
-async function* withStreamIdleWatchdog(stream, timeoutMs = STREAM_IDLE_TIMEOUT_MS) {
+async function* withStreamIdleWatchdog(stream, timeoutMs = STREAM_IDLE_TIMEOUT_MS, returnGraceMs = STREAM_IDLE_RETURN_GRACE_MS) {
   if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
     yield* stream;
     return;
@@ -19933,7 +19933,19 @@ async function* withStreamIdleWatchdog(stream, timeoutMs = STREAM_IDLE_TIMEOUT_M
     }
   } finally {
     try {
-      await iterator.return?.();
+      const ret = iterator.return?.();
+      if (ret) {
+        let graceTimer;
+        const grace = new Promise((resolve) => {
+          graceTimer = setTimeout(resolve, returnGraceMs);
+          if (typeof graceTimer === "object" && graceTimer !== null && "unref" in graceTimer) {
+            graceTimer.unref();
+          }
+        });
+        await Promise.race([ret.then(() => {
+          return;
+        }, () => {}), grace]);
+      }
     } catch {}
   }
 }
@@ -27201,6 +27213,12 @@ function isQuotaExhaustedMessage(message) {
   }
   return false;
 }
+function parseToolSchemaRejectionError(err) {
+  if (!(err instanceof APIError2) || err.status !== 400)
+    return null;
+  const m = /invalid schema for (?:tool|function) [`'"]?([A-Za-z0-9_.\-]+)[`'"]?/i.exec(err.message);
+  return m ? m[1] : null;
+}
 function classifyAPIError(error) {
   if (error instanceof Error && error.message === "Request was aborted.") {
     return "aborted";
@@ -27341,6 +27359,8 @@ function shouldRetryModelError(err, signal) {
     return false;
   if (isClientRequestTimeout(err))
     return false;
+  if (parseToolSchemaRejectionError(err))
+    return false;
   return isRetryableError(err);
 }
 function llmTimeoutUnitHint(ms) {
@@ -29134,6 +29154,11 @@ var DEFAULT_HOOK_SHELL = "bash";
 var init_getMatchingHooks = () => {};
 
 // src/hooks/runHooks.ts
+function sessionEndHookTimeoutMs() {
+  const raw = process.env.ATLAS_SESSIONEND_HOOKS_TIMEOUT_MS;
+  const parsed = raw ? Number(raw) : NaN;
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : SESSION_END_HOOK_TIMEOUT_MS_DEFAULT;
+}
 function isSimpleModeHooksSkipped() {
   const raw = process.env.ATLAS_SIMPLE;
   if (raw === undefined)
@@ -29253,6 +29278,7 @@ ${r.additionalContext}` : r.additionalContext;
     if (!acc.permissionBehavior || PERMISSION_RANK[r.permissionBehavior] > PERMISSION_RANK[acc.permissionBehavior]) {
       acc.permissionBehavior = r.permissionBehavior;
       acc.permissionDecisionReason = r.permissionDecisionReason;
+      acc.permissionDecisionSource = r.source;
     }
   }
 }
@@ -29270,12 +29296,14 @@ function runOneHook(m, port, env, signal, options) {
     if (result.blockingError && cmd.continueOnBlock === true) {
       result.continueOnBlock = true;
     }
+    result.source = m.source;
     return result;
   }, (e) => ({
     command: cmd.command,
     status: -1,
     succeeded: false,
-    stderr: e instanceof Error ? e.message : String(e)
+    stderr: e instanceof Error ? e.message : String(e),
+    source: m.source
   }));
 }
 async function runHooks(hookEvent, hookInput, options = {}) {
@@ -29330,7 +29358,15 @@ async function runStopHooks(options = {}) {
   const hookInput = { ...base, hook_event_name: "Stop" };
   return runHooks("Stop", hookInput, options);
 }
-var HOOK_EXECUTION_TIMEOUT_MS, PERMISSION_RANK;
+async function runSessionEndHooks(reason, options = {}) {
+  const base = createBaseHookInput(options.permissionMode, options.sessionId, options.agentInfo);
+  const hookInput = { ...base, hook_event_name: "SessionEnd", reason };
+  return runHooks("SessionEnd", hookInput, {
+    ...options,
+    timeoutMs: options.timeoutMs ?? sessionEndHookTimeoutMs()
+  });
+}
+var MAX_HOOK_CONCURRENCY = 12, HOOK_EXECUTION_TIMEOUT_MS, SESSION_END_HOOK_TIMEOUT_MS_DEFAULT = 1500, PERMISSION_RANK;
 var init_runHooks = __esm(() => {
   init_createBaseHookInput();
   init_getMatchingHooks();
@@ -29366,9 +29402,20 @@ async function* runHooksStream(hookEvent, hookInput, options = {}) {
       toolUseID: options.toolUseID
     };
   }
-  const started = matched.map((m) => runOneHook(m, port, env, signal, options));
-  for (const pending of started) {
-    const result = await pending;
+  const slots = [];
+  let nextStart = 0;
+  const startNext = () => {
+    if (nextStart < matched.length) {
+      slots[nextStart] = runOneHook(matched[nextStart], port, env, signal, options);
+      nextStart++;
+    }
+  };
+  for (let i = 0;i < Math.min(MAX_HOOK_CONCURRENCY, matched.length); i++) {
+    startNext();
+  }
+  for (let i = 0;i < matched.length; i++) {
+    const result = await slots[i];
+    startNext();
     results.push(result);
     yield { kind: "hook_result", result };
     mergeAggregated(aggregated, result);
@@ -29509,8 +29556,8 @@ var SettingsSchema = () => object({
   mcpServers: record(string2(), any()).optional(),
   allowedMcpServers: any().optional(),
   deniedMcpServers: any().optional(),
-  enabledMcpjsonServers: array(string2()).optional(),
-  disabledMcpjsonServers: array(string2()).optional(),
+  enabledMcpjsonServers: union([string2(), array(string2())]).transform((v) => Array.isArray(v) ? v : [v]).optional(),
+  disabledMcpjsonServers: union([string2(), array(string2())]).transform((v) => Array.isArray(v) ? v : [v]).optional(),
   sandbox: any().optional(),
   permissions: any().optional(),
   hooks: lazy(() => HooksSchema).optional(),
@@ -30144,7 +30191,7 @@ var init_filesystem = __esm(() => {
 
 // src/permissions/permissionRuleParser.ts
 function setLegacyToolNameAliases(map) {
-  legacyToolNameAliases = map;
+  legacyToolNameAliases = Object.assign(Object.create(null), map);
 }
 function normalizeLegacyToolName(name) {
   return legacyToolNameAliases[name] ?? name;
@@ -30219,7 +30266,7 @@ function findLastUnescapedChar(str, char) {
 }
 var legacyToolNameAliases;
 var init_permissionRuleParser = __esm(() => {
-  legacyToolNameAliases = {};
+  legacyToolNameAliases = Object.create(null);
 });
 
 // src/permissions/mcpRuleNames.ts
@@ -30228,6 +30275,9 @@ function normalizeNameForMCP(name) {
   const normalized = folded.replace(/_+/g, "_").replace(/^_|_$/g, "");
   return normalized === "" ? folded : normalized;
 }
+function foldMcpNameForCompare(name) {
+  return name.replace(/[^a-zA-Z0-9_-]/g, "_").replace(/_+/g, "_");
+}
 function mcpInfoFromString(toolString) {
   const parts = toolString.split("__");
   const [mcpPart, serverName, ...toolNameParts] = parts;
@@ -30297,9 +30347,17 @@ function toolMatchesRule(tool, rule) {
   if (rule.ruleValue.toolName === nameForRuleMatch) {
     return true;
   }
-  const ruleInfo = mcpInfoFromString(rule.ruleValue.toolName);
-  const toolInfo = mcpInfoFromString(nameForRuleMatch);
-  return ruleInfo !== null && toolInfo !== null && (ruleInfo.toolName === undefined || ruleInfo.toolName === "*") && ruleInfo.serverName === toolInfo.serverName;
+  const toolInfo = tool.mcpInfo ?? mcpInfoFromString(nameForRuleMatch);
+  const ruleName = rule.ruleValue.toolName;
+  if (!toolInfo || !ruleName.startsWith("mcp__")) {
+    return false;
+  }
+  if (foldMcpNameForCompare(ruleName) === foldMcpNameForCompare(nameForRuleMatch)) {
+    return true;
+  }
+  const rest = ruleName.slice("mcp__".length);
+  const ruleServerRaw = rest.endsWith("__*") ? rest.slice(0, -3) : rest;
+  return foldMcpNameForCompare(ruleServerRaw) === foldMcpNameForCompare(toolInfo.serverName);
 }
 function toolAlwaysAllowedRule(context, tool) {
   return getAllowRules(context).find((rule) => toolMatchesRule(tool, rule)) || null;
@@ -30512,12 +30570,22 @@ function applyDontAskMode(decision, permissionContext, toolName) {
   }
   return decision;
 }
-var BASH_TOOL_NAME = "Bash", hasPermissionsToUseTool = async (tool, input, context, _assistantMessage, _toolUseID, forceDecision) => {
+var BASH_TOOL_NAME = "Bash", PLAN_MODE_WRITE_EXEMPT_TOOL_NAMES, PLAN_MODE_WRITE_DENIED_MESSAGE = (toolName) => `Plan mode is active — ${toolName} is not allowed to make changes. ` + `Present your plan and use ExitPlanMode, or ask the user to change the permission mode.`, hasPermissionsToUseTool = async (tool, input, context, _assistantMessage, _toolUseID, forceDecision) => {
   const permissionContext = context.getToolPermissionContext?.();
   if (forceDecision !== undefined) {
     return applyDontAskMode(forceDecision, permissionContext, tool.name);
   }
   const sandbox = getSandboxAccess();
+  if (permissionContext?.mode === "plan" && !permissionContext.isBypassPermissionsModeAvailable && !PLAN_MODE_WRITE_EXEMPT_TOOL_NAMES.has(tool.name) && !(tool.isReadOnly?.(input) ?? false)) {
+    return {
+      behavior: "deny",
+      message: PLAN_MODE_WRITE_DENIED_MESSAGE(tool.name),
+      decisionReason: {
+        type: "mode",
+        mode: "plan"
+      }
+    };
+  }
   const denyRule = permissionContext ? getDenyRuleForTool(permissionContext, tool) : null;
   if (denyRule) {
     return {
@@ -30636,6 +30704,10 @@ var init_permissions2 = __esm(() => {
   init_ruleMatching();
   init_sandboxAccess();
   init_denialMessages();
+  PLAN_MODE_WRITE_EXEMPT_TOOL_NAMES = new Set([
+    "EnterPlanMode",
+    "ExitPlanMode"
+  ]);
 });
 
 // src/permissions/permissionMode.ts
@@ -36851,6 +36923,15 @@ function filterToolsForAgent({
 function computeChildSpawnDepth(parentOptions) {
   return (parentOptions?.spawnDepth ?? 0) + 1;
 }
+function resolveMcpServerDomainTools(toolName, available) {
+  if (typeof toolName !== "string")
+    return null;
+  const info = mcpInfoFromString(toolName);
+  if (!info || info.toolName !== undefined)
+    return null;
+  const prefix = getMcpPrefix(info.serverName);
+  return available.filter((t) => t.name.startsWith(prefix));
+}
 function resolveAgentTools(agentDefinition, availableTools, allowFanOut = false) {
   const { tools: agentTools, disallowedTools, source } = agentDefinition;
   const filtered = filterToolsForAgent({
@@ -36881,7 +36962,18 @@ function resolveAgentTools(agentDefinition, availableTools, allowFanOut = false)
         seen.add(tool);
       }
     } else {
-      invalidTools.push(spec);
+      const domain = resolveMcpServerDomainTools(toolName, allowed);
+      if (domain && domain.length > 0) {
+        validTools.push(spec);
+        for (const t of domain) {
+          if (!seen.has(t)) {
+            resolved.push(t);
+            seen.add(t);
+          }
+        }
+      } else {
+        invalidTools.push(spec);
+      }
     }
   }
   return { hasWildcard: false, validTools, invalidTools, resolvedTools: resolved };
@@ -46561,9 +46653,67 @@ var init_bashCommandHelpers = __esm(() => {
 });
 
 // src/engine/tools/bash/bashReadOnly.ts
+function globPatternCouldMatchWriteAction(pattern) {
+  let regex = "^";
+  let i = 0;
+  while (i < pattern.length) {
+    const c = pattern[i];
+    if (c === "*") {
+      regex += ".*";
+      i++;
+      continue;
+    }
+    if (c === "?") {
+      regex += ".";
+      i++;
+      continue;
+    }
+    if (c === "[") {
+      const close = pattern.indexOf("]", i + 1);
+      if (close > i) {
+        let cls = pattern.slice(i + 1, close);
+        if (cls.startsWith("!"))
+          cls = `^${cls.slice(1)}`;
+        regex += `[${cls}]`;
+        i = close + 1;
+        continue;
+      }
+    }
+    regex += c.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    i++;
+  }
+  regex += "$";
+  let re;
+  try {
+    re = new RegExp(regex);
+  } catch {
+    return true;
+  }
+  for (const action of FIND_WRITE_ACTION_TOKENS) {
+    if (re.test(action))
+      return true;
+  }
+  return false;
+}
+function isAllowedNonStringToken(token) {
+  if (typeof token !== "object" || token === null)
+    return false;
+  const t = token;
+  if (t.comment !== undefined)
+    return true;
+  if (t.op === "<")
+    return true;
+  if (t.op === "glob") {
+    if (typeof t.pattern !== "string")
+      return false;
+    return !globPatternCouldMatchWriteAction(t.pattern);
+  }
+  return false;
+}
 function matchReadOnlyPrefix(command) {
   const trimmed = command.trim();
-  if (trimmed.includes("&&") || trimmed.includes("||") || trimmed.includes(";") || trimmed.includes("|") || trimmed.includes("`") || trimmed.includes("$(") || trimmed.includes(">")) {
+  if (trimmed.includes("&&") || trimmed.includes("||") || trimmed.includes(";") || trimmed.includes("|") || trimmed.includes("`") || trimmed.includes("$(") || trimmed.includes(">") || trimmed.includes(`
+`) || trimmed.includes("\r") || trimmed.includes("-delete") || trimmed.includes("-exec") || trimmed.includes("-ok") || trimmed.includes("-fprint") || trimmed.includes("-fls")) {
     return null;
   }
   let best = null;
@@ -46573,13 +46723,31 @@ function matchReadOnlyPrefix(command) {
         best = p;
     }
   }
+  if (best === null)
+    return null;
+  const parsed = tryParseShellCommand(trimmed, (key) => `$${key}`);
+  if (!parsed.success) {
+    return null;
+  }
+  for (const token of parsed.tokens) {
+    if (typeof token === "string") {
+      if (FIND_WRITE_ACTION_TOKENS.has(token))
+        return null;
+      if (token.includes("[") && globPatternCouldMatchWriteAction(token)) {
+        return null;
+      }
+    } else if (!isAllowedNonStringToken(token)) {
+      return null;
+    }
+  }
   return best;
 }
 function isReadOnlyCommand(command) {
   return matchReadOnlyPrefix(command) !== null;
 }
-var READ_ONLY_PREFIXES;
+var READ_ONLY_PREFIXES, FIND_WRITE_ACTION_TOKENS;
 var init_bashReadOnly = __esm(() => {
+  init_shellQuote();
   READ_ONLY_PREFIXES = [
     "ls",
     "cat",
@@ -46606,6 +46774,17 @@ var init_bashReadOnly = __esm(() => {
     "printenv",
     "type"
   ];
+  FIND_WRITE_ACTION_TOKENS = new Set([
+    "-delete",
+    "-exec",
+    "-execdir",
+    "-ok",
+    "-okdir",
+    "-fprint",
+    "-fprint0",
+    "-fprintf",
+    "-fls"
+  ]);
 });
 
 // src/engine/tools/bash/abortError.ts
@@ -75284,6 +75463,27 @@ var init_tasks3 = __esm(() => {
   init_taskOutputTool();
 });
 
+// src/engine/skill/commandNameSafety.ts
+function isUnsafeCommandName(name) {
+  if (name === "")
+    return true;
+  if (name.includes("<") || name.includes(">"))
+    return true;
+  return UNSAFE_NAME_CHARS_RE.test(name);
+}
+function sanitizeDisplayName(displayName, canonicalName) {
+  if (displayName === undefined || !isUnsafeCommandName(displayName)) {
+    return displayName;
+  }
+  logForDebugging(`Discarding unsafe frontmatter display name ${JSON.stringify(displayName)} for ${canonicalName}; falling back to canonical name`);
+  return;
+}
+var UNSAFE_NAME_CHARS_RE;
+var init_commandNameSafety = __esm(() => {
+  init_shared();
+  UNSAFE_NAME_CHARS_RE = /[\u0000-\u001F\u007F-\u00A0\u00AD\u034F\u061C\u070F\u1680\u180E\u2000-\u200F\u2028\u2029\u202A-\u202E\u202F\u205F\u2060-\u2069\u3000\uFE00-\uFE0F\uFEFF\u{E0100}-\u{E01EF}]/u;
+});
+
 // src/engine/skill/types.ts
 function getCommandName(cmd) {
   return cmd.userFacingName?.() ?? cmd.name;
@@ -75406,44 +75606,129 @@ function parseArgumentNames(argumentNames) {
     return [];
   }
   const isValidName = (name) => typeof name === "string" && name.trim() !== "" && !/^\d+$/.test(name);
+  const cap = (names) => names.map((name) => name.slice(0, MAX_ARGUMENT_NAME_CHARS)).slice(0, MAX_ARGUMENT_NAMES);
   if (Array.isArray(argumentNames)) {
-    return argumentNames.filter(isValidName);
+    return cap(argumentNames.filter(isValidName));
   }
   if (typeof argumentNames === "string") {
-    return argumentNames.split(/\s+/).filter(isValidName);
+    return cap(argumentNames.split(/\s+/).filter(isValidName));
   }
   return [];
 }
-function substituteArguments(content, args, appendIfNoPlaceholder = true, argumentNames = []) {
+function isWordChar2(c) {
+  return c !== undefined && /[A-Za-z0-9_]/.test(c);
+}
+function matchPlaceholderAt(content, i, argumentNames) {
+  if (content[i] !== "$")
+    return null;
+  for (let n = 0;n < argumentNames.length; n++) {
+    const name = argumentNames[n];
+    if (!name)
+      continue;
+    if (content.startsWith(`$${name}`, i)) {
+      const after = content[i + 1 + name.length];
+      if (after !== "[" && !isWordChar2(after)) {
+        return { length: 1 + name.length, kind: "named", nameIndex: n };
+      }
+    }
+  }
+  INDEXED_PLACEHOLDER_RE.lastIndex = i;
+  const indexed = INDEXED_PLACEHOLDER_RE.exec(content);
+  if (indexed) {
+    return {
+      length: indexed[0].length,
+      kind: "indexed",
+      argIndex: parseInt(indexed[1], 10)
+    };
+  }
+  if (content.startsWith("$ARGUMENTS", i)) {
+    return { length: "$ARGUMENTS".length, kind: "bare" };
+  }
+  SHORTHAND_PLACEHOLDER_RE.lastIndex = i;
+  const shorthand = SHORTHAND_PLACEHOLDER_RE.exec(content);
+  if (shorthand && !isWordChar2(content[i + shorthand[0].length])) {
+    return {
+      length: shorthand[0].length,
+      kind: "shorthand",
+      argIndex: parseInt(shorthand[1], 10)
+    };
+  }
+  return null;
+}
+function countPlaceholderOccurrences(content, argumentNames) {
+  let count = 0;
+  let i = 0;
+  while (i < content.length) {
+    const m = matchPlaceholderAt(content, i, argumentNames);
+    if (m) {
+      count++;
+      i += m.length;
+    } else {
+      i++;
+    }
+  }
+  return count;
+}
+function substituteArgumentsImpl(content, args, appendIfNoPlaceholder, argumentNames, strict) {
   if (args === undefined || args === null) {
     return content;
   }
-  const parsedArgs = parseArguments(args);
-  const originalContent = content;
-  for (let i = 0;i < argumentNames.length; i++) {
-    const name = argumentNames[i];
-    if (!name)
-      continue;
-    content = content.replace(new RegExp(`\\$${name}(?![\\[\\w])`, "g"), parsedArgs[i] ?? "");
+  const placeholderCount = countPlaceholderOccurrences(content, argumentNames);
+  let effectiveArgs = args;
+  if (placeholderCount > 0 && content.length + placeholderCount * args.length > MAX_SUBSTITUTION_OUTPUT_CHARS) {
+    if (strict)
+      return null;
+    const budgetPerReplacement = Math.max(0, Math.floor((MAX_SUBSTITUTION_OUTPUT_CHARS - content.length) / placeholderCount));
+    effectiveArgs = args.slice(0, budgetPerReplacement);
+  } else if (strict) {
+    const appendLen = appendIfNoPlaceholder && args ? `
+
+ARGUMENTS: `.length + args.length : 0;
+    if (content.length + appendLen > MAX_SUBSTITUTION_OUTPUT_CHARS) {
+      return null;
+    }
   }
-  content = content.replace(/\$ARGUMENTS\[(\d+)\]/g, (_, indexStr) => {
-    const index = parseInt(indexStr, 10);
-    return parsedArgs[index] ?? "";
-  });
-  content = content.replace(/\$(\d+)(?!\w)/g, (_, indexStr) => {
-    const index = parseInt(indexStr, 10);
-    return parsedArgs[index] ?? "";
-  });
-  content = content.replaceAll("$ARGUMENTS", args);
-  if (content === originalContent && appendIfNoPlaceholder && args) {
-    content = content + `
+  const parsedArgs = parseArguments(effectiveArgs);
+  let out = "";
+  const appendValue = (value) => {
+    if (out.length + value.length > MAX_SUBSTITUTION_OUTPUT_CHARS) {
+      value = value.slice(0, Math.max(0, MAX_SUBSTITUTION_OUTPUT_CHARS - out.length));
+    }
+    out += value;
+  };
+  let matched = false;
+  let i = 0;
+  while (i < content.length) {
+    const m = matchPlaceholderAt(content, i, argumentNames);
+    if (m) {
+      matched = true;
+      if (m.kind === "bare")
+        appendValue(effectiveArgs);
+      else if (m.kind === "named")
+        appendValue(parsedArgs[m.nameIndex] ?? "");
+      else
+        appendValue(parsedArgs[m.argIndex] ?? "");
+      i += m.length;
+    } else {
+      out += content[i];
+      i++;
+    }
+  }
+  if (!matched && appendIfNoPlaceholder && args) {
+    out = out + `
 
 ARGUMENTS: ${args}`;
   }
-  return content;
+  return out;
+}
+function substituteArguments(content, args, appendIfNoPlaceholder = true, argumentNames = []) {
+  return substituteArgumentsImpl(content, args, appendIfNoPlaceholder, argumentNames, false) ?? content;
 }
+var MAX_ARGUMENT_NAMES = 64, MAX_ARGUMENT_NAME_CHARS = 64, MAX_SUBSTITUTION_OUTPUT_CHARS = 1e6, INDEXED_PLACEHOLDER_RE, SHORTHAND_PLACEHOLDER_RE;
 var init_argumentSubstitution = __esm(() => {
   init_bash();
+  INDEXED_PLACEHOLDER_RE = /\$ARGUMENTS\[(\d+)\]/y;
+  SHORTHAND_PLACEHOLDER_RE = /\$(\d+)/y;
 });
 
 // src/engine/skill/skillModel.ts
@@ -76880,7 +77165,7 @@ function parseSkillFrontmatterFields(frontmatter, markdownContent, resolvedName,
     logForDebugging(`Skill ${resolvedName} has invalid effort '${effortRaw}'. Valid options: ${EFFORT_LEVELS.join(", ")} or an integer`);
   }
   return {
-    displayName: frontmatter.name != null ? String(frontmatter.name) : undefined,
+    displayName: sanitizeDisplayName(frontmatter.name != null ? String(frontmatter.name) : undefined, resolvedName),
     description,
     hasUserSpecifiedDescription: validatedDescription !== null,
     allowedTools: parseSlashCommandToolsFromFrontmatter(frontmatter["allowed-tools"]),
@@ -76991,6 +77276,7 @@ var init_skillCommand = __esm(() => {
   init_frontmatterFields();
   init_markdownLoader();
   init_skillModel();
+  init_commandNameSafety();
   init_promptShellExecution();
 });
 
@@ -77030,6 +77316,10 @@ async function loadSkillsFromSkillsDir(basePath, source) {
       if (!entry.isDirectory() && !entry.isSymbolicLink()) {
         return null;
       }
+      if (isUnsafeCommandName(entry.name)) {
+        logForDebugging(`[skills] skipping unsafe skill directory name: ${JSON.stringify(entry.name)}`);
+        return null;
+      }
       const skillDirPath = join32(basePath, entry.name);
       const skillFilePath = join32(skillDirPath, "SKILL.md");
       let content;
@@ -77138,6 +77428,10 @@ async function loadSkillsFromCommandsDir(cwd) {
           content,
           source
         });
+        if (isUnsafeCommandName(cmdName)) {
+          logForDebugging(`[skills] skipping unsafe command name: ${JSON.stringify(cmdName)}`);
+          continue;
+        }
         const parsed = parseSkillFrontmatterFields(frontmatter, content, cmdName, "Custom command");
         skills.push({
           skill: createSkillCommand({
@@ -77177,6 +77471,7 @@ var init_loadSkillsDir = __esm(() => {
   init_memory();
   init_config();
   init_messaging();
+  init_commandNameSafety();
   init_gitignore();
   init_markdownLoader();
   init_skillCommand();
@@ -77592,6 +77887,7 @@ var init_pluginIdentifier = __esm(() => {
 
 // src/engine/skill/index.ts
 var init_skill = __esm(() => {
+  init_commandNameSafety();
   init_frontmatterFields();
   init_argumentSubstitution();
   init_skillModel();
@@ -77645,6 +77941,14 @@ import { randomUUID as randomUUID14 } from "crypto";
 async function getAllCommands() {
   return getCommands(process.cwd());
 }
+function buildUnknownSkillMessage(skillName, commands) {
+  const available = commands.filter((c) => !c.isHidden && !c.disableModelInvocation).map((c) => c.userFacingName?.() ?? c.name);
+  if (available.length === 0)
+    return `Unknown skill: ${skillName}`;
+  const listed = available.slice(0, MAX_UNKNOWN_SKILL_SUGGESTIONS);
+  const more = available.length - listed.length;
+  return `Unknown skill: ${skillName}. Available skills: ${listed.join(", ")}${more > 0 ? ` (and ${more} more)` : ""}`;
+}
 function getToolUseIDFromParentMessage(parentMessage, toolName) {
   if (!parentMessage)
     return;
@@ -77712,7 +78016,7 @@ function skillHasOnlySafeProperties(command) {
   }
   return true;
 }
-var SKILL_TOOL_INPUT_SCHEMA, SAFE_SKILL_PROPERTIES, SkillTool;
+var SKILL_TOOL_INPUT_SCHEMA, MAX_UNKNOWN_SKILL_SUGGESTIONS = 10, SAFE_SKILL_PROPERTIES, SkillTool;
 var init_skillTool = __esm(() => {
   init_shared();
   init_permissions3();
@@ -77884,7 +78188,7 @@ var init_skillTool = __esm(() => {
       if (!foundCommand) {
         return {
           result: false,
-          message: `Unknown skill: ${normalizedCommandName}`,
+          message: buildUnknownSkillMessage(normalizedCommandName, commands),
           errorCode: 2
         };
       }
@@ -78400,7 +78704,7 @@ function getMcpDiscoveryInput() {
   return discoveryInput;
 }
 async function buildMcpServerConfigs(input) {
-  const servers = {};
+  const servers = Object.create(null);
   for (const [name, raw] of Object.entries(input.settingsServers ?? {})) {
     const parsed = parseMcpServerConfig(raw);
     if (parsed) {
@@ -78631,6 +78935,7 @@ async function terminateChild(name, child) {
 function createMcpConnectionManager() {
   const connections = new Map;
   const pending = new Set;
+  const pendingConnects = new Map;
   const connectFailures = new Map;
   function fail(name, config, error, authFailure = false) {
     const conn = {
@@ -78643,6 +78948,17 @@ function createMcpConnectionManager() {
     connections.set(name, conn);
     return conn;
   }
+  function markBlocked(name, config, reason) {
+    const conn = {
+      name,
+      type: "failed",
+      config,
+      error: `MCP server "${name}" blocked by enterprise policy: ${reason}`,
+      blockedByPolicy: true
+    };
+    connections.set(name, conn);
+    return conn;
+  }
   async function connectStdio(name, config, opts) {
     const finalCommand = process.env.ATLAS_SHELL_PREFIX || config.command;
     const finalArgs = process.env.ATLAS_SHELL_PREFIX ? [[config.command, ...config.args ?? []].join(" ")] : config.args ?? [];
@@ -78700,7 +79016,7 @@ function createMcpConnectionManager() {
     };
     client.onClose(closeOnDrop);
     const initPromise = client.request("initialize", {
-      protocolVersion: "2025-03-26",
+      protocolVersion: "2026-07-28",
       capabilities: {
         elicitation: {},
         roots: {}
@@ -78727,6 +79043,7 @@ function createMcpConnectionManager() {
             version: init.serverInfo.version
           }
         } : {},
+        ...init.protocolVersion ? { negotiatedProtocolVersion: init.protocolVersion } : {},
         ...init.instructions ? { instructions: init.instructions } : {},
         config,
         cleanup: async () => {
@@ -78753,6 +79070,21 @@ function createMcpConnectionManager() {
     }
   }
   async function connect(name, config, opts) {
+    const existing = connections.get(name);
+    if (existing?.type === "connected")
+      return existing;
+    const inflight = pendingConnects.get(name);
+    if (inflight)
+      return inflight;
+    const attempt = connectOnce(name, config, opts);
+    pendingConnects.set(name, attempt);
+    try {
+      return await attempt;
+    } finally {
+      pendingConnects.delete(name);
+    }
+  }
+  async function connectOnce(name, config, opts) {
     const existing = connections.get(name);
     if (existing?.type === "connected")
       return existing;
@@ -78794,7 +79126,8 @@ function createMcpConnectionManager() {
         await manager.close(name);
       }
     },
-    getPendingServerNames: () => [...pending]
+    getPendingServerNames: () => [...pending],
+    markBlocked
   };
   return manager;
 }
@@ -78809,6 +79142,143 @@ var init_mcpConnectionManager = __esm(() => {
   init_mcpFetch();
 });
 
+// src/mcp/mcpPolicy.ts
+function getMcpPolicyFromSettings(settings) {
+  if (typeof settings !== "object" || settings === null)
+    return {};
+  const rec = settings;
+  return {
+    ...rec.allowedMcpServers !== undefined ? { allowedMcpServers: rec.allowedMcpServers } : {},
+    ...rec.deniedMcpServers !== undefined ? { deniedMcpServers: rec.deniedMcpServers } : {}
+  };
+}
+function getMcpPolicyInput() {
+  return policyInput;
+}
+function normalizePolicyEntries(raw) {
+  if (!Array.isArray(raw))
+    return [];
+  const out = [];
+  for (const entry of raw) {
+    if (typeof entry === "string") {
+      out.push({ kind: "name", value: entry });
+      continue;
+    }
+    if (typeof entry !== "object" || entry === null)
+      continue;
+    const rec = entry;
+    if (typeof rec.serverName === "string") {
+      out.push({ kind: "name", value: rec.serverName });
+    } else if (Array.isArray(rec.serverCommand) && rec.serverCommand.every((c) => typeof c === "string")) {
+      out.push({ kind: "command", value: rec.serverCommand });
+    } else if (typeof rec.serverUrl === "string") {
+      out.push({ kind: "url", value: rec.serverUrl });
+    }
+  }
+  return out;
+}
+function getServerCommandArray(config) {
+  const t = config.type;
+  if (t !== undefined && t !== "stdio") {
+    return null;
+  }
+  const stdioConfig = config;
+  return [stdioConfig.command, ...stdioConfig.args ?? []];
+}
+function commandArraysMatch(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  return a.every((val, idx) => val === b[idx]);
+}
+function getServerUrl(config) {
+  return "url" in config ? config.url : null;
+}
+function urlPatternToRegex(pattern) {
+  const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+  const regexStr = escaped.replace(/\*/g, ".*");
+  return new RegExp(`^${regexStr}$`);
+}
+function urlMatchesPattern(url, pattern) {
+  return urlPatternToRegex(pattern).test(url);
+}
+function isDeniedByEntries(serverName, config, entries) {
+  for (const entry of entries) {
+    if (entry.kind === "name" && entry.value === serverName)
+      return true;
+  }
+  const serverCommand = getServerCommandArray(config);
+  if (serverCommand) {
+    for (const entry of entries) {
+      if (entry.kind === "command" && commandArraysMatch(entry.value, serverCommand)) {
+        return true;
+      }
+    }
+  }
+  const serverUrl = getServerUrl(config);
+  if (serverUrl) {
+    for (const entry of entries) {
+      if (entry.kind === "url" && urlMatchesPattern(serverUrl, entry.value)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function isAllowedByEntries(serverName, config, entries) {
+  const hasCommandEntries = entries.some((e) => e.kind === "command");
+  const hasUrlEntries = entries.some((e) => e.kind === "url");
+  const serverCommand = getServerCommandArray(config);
+  const serverUrl = getServerUrl(config);
+  if (serverCommand) {
+    if (hasCommandEntries) {
+      return entries.some((e) => e.kind === "command" && commandArraysMatch(e.value, serverCommand));
+    }
+    return entries.some((e) => e.kind === "name" && e.value === serverName);
+  }
+  if (serverUrl) {
+    if (hasUrlEntries) {
+      return entries.some((e) => e.kind === "url" && urlMatchesPattern(serverUrl, e.value));
+    }
+    return entries.some((e) => e.kind === "name" && e.value === serverName);
+  }
+  return entries.some((e) => e.kind === "name" && e.value === serverName);
+}
+function checkMcpServerPolicy(serverName, config, policy) {
+  const p = policy ?? getMcpPolicyInput() ?? {};
+  const denied = normalizePolicyEntries(p.deniedMcpServers);
+  if (isDeniedByEntries(serverName, config, denied)) {
+    return { blocked: true, reason: "denied by policy (deniedMcpServers)" };
+  }
+  if (!Array.isArray(p.allowedMcpServers))
+    return { blocked: false };
+  if (p.allowedMcpServers.length === 0) {
+    return {
+      blocked: true,
+      reason: "not in allowedMcpServers allowlist (empty allowlist blocks all servers)"
+    };
+  }
+  const allowed = normalizePolicyEntries(p.allowedMcpServers);
+  if (isAllowedByEntries(serverName, config, allowed)) {
+    return { blocked: false };
+  }
+  return { blocked: true, reason: "not in allowedMcpServers allowlist" };
+}
+function filterMcpServersByPolicy(configs, policy) {
+  const allowed = {};
+  const blocked = [];
+  for (const [name, config] of Object.entries(configs)) {
+    const verdict = checkMcpServerPolicy(name, config, policy);
+    if (verdict.blocked) {
+      blocked.push({ name, reason: verdict.reason ?? "blocked by policy" });
+    } else {
+      allowed[name] = config;
+    }
+  }
+  return { allowed, blocked };
+}
+var policyInput = null;
+
 // src/mcp/index.ts
 var init_mcp3 = __esm(() => {
   init_types6();
@@ -78833,6 +79303,24 @@ function classifyToolError(error) {
   return "UnknownError";
 }
 
+// src/engine/pipeline/sanitizeUpdatedInput.ts
+function isPlainObject3(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function sanitizeUpdatedInput(originalInput, updatedInput) {
+  if (!isPlainObject3(originalInput) || !isPlainObject3(updatedInput)) {
+    return originalInput;
+  }
+  const result = {};
+  for (const key of Object.keys(originalInput)) {
+    result[key] = key in updatedInput ? updatedInput[key] : originalInput[key];
+  }
+  return result;
+}
+
 // src/engine/pipeline/schemaValidation.ts
 function typeName(v) {
   if (v === null)
@@ -78993,7 +79481,7 @@ async function runWithToolHeartbeat(opts, fn) {
 var DEFAULT_TOOL_HEARTBEAT_INTERVAL_MS = 30000, MIN_TOOL_HEARTBEAT_INTERVAL_MS = 100;
 
 // src/engine/pipeline/toolExecution.ts
-function mergeHookPermission(hookBehavior, gate, hookReason) {
+function mergeHookPermission(hookBehavior, gate, hookReason, hookSource) {
   if (hookBehavior === "defer") {
     return {
       allowed: false,
@@ -79007,7 +79495,8 @@ function mergeHookPermission(hookBehavior, gate, hookReason) {
   if (!gate.allowed)
     return gate;
   if (hookBehavior === "ask") {
-    return { allowed: false, ask: true, reason: "hook requested confirmation" };
+    const reason = hookSource && hookSource !== "settings" ? `hook requested confirmation (from ${hookSource})` : "hook requested confirmation";
+    return { allowed: false, ask: true, reason };
   }
   return gate;
 }
@@ -79078,12 +79567,12 @@ async function executeToolUse(tu, assistantMsg, deps) {
       isError: true
     };
   }
-  const effectiveInput = preOutcome?.updatedInput ?? tu.input;
+  const effectiveInput = preOutcome?.updatedInput !== undefined ? sanitizeUpdatedInput(tu.input, preOutcome.updatedInput) : tu.input;
   const gateVerdict = deps.checkPermission ? await deps.checkPermission(tool, effectiveInput, {
     toolUseId: tu.id,
     assistantMessage: assistantMsg
   }) : { allowed: true };
-  const verdict = mergeHookPermission(preOutcome?.hookBehavior, gateVerdict, preOutcome?.hookPermissionDecisionReason);
+  const verdict = mergeHookPermission(preOutcome?.hookBehavior, gateVerdict, preOutcome?.hookPermissionDecisionReason, preOutcome?.hookSource);
   if (verdict.deferred) {
     return { deferred: true, deferReason: verdict.reason, isError: false };
   }
@@ -79909,12 +80398,12 @@ var LEGACY_TOOL_NAME_ALIASES;
 var init_legacyToolNameAliases = __esm(() => {
   init_permissions3();
   init_toolNames();
-  LEGACY_TOOL_NAME_ALIASES = {
+  LEGACY_TOOL_NAME_ALIASES = Object.assign(Object.create(null), {
     Task: AGENT_TOOL_NAME,
     KillShell: TASK_STOP_TOOL_NAME,
     AgentOutputTool: TASK_OUTPUT_TOOL_NAME,
     BashOutputTool: TASK_OUTPUT_TOOL_NAME
-  };
+  });
   setLegacyToolNameAliases(LEGACY_TOOL_NAME_ALIASES);
 });
 
@@ -82800,6 +83289,8 @@ async function queryAgentLoop(deps, args) {
   let turns = 0;
   let terminated = false;
   let lastRound;
+  let activeTools = tools;
+  const degradedTools = new Set;
   const maxGoalTurns = args.context?.maxGoalTurns ?? DEFAULT_MAX_GOAL_TURNS;
   let goalTurns = 0;
   let deferredToolUse;
@@ -82842,6 +83333,24 @@ async function queryAgentLoop(deps, args) {
         deps.emit?.({ type: "compacted", turn: turns, messages });
       }
     }
+    if (deps.refreshRoundContext) {
+      try {
+        const refresh = deps.refreshRoundContext(messages);
+        if (refresh) {
+          if (refresh.tools) {
+            activeTools = degradedTools.size > 0 ? refresh.tools.filter((t) => !degradedTools.has(t.name)) : refresh.tools;
+          }
+          if (refresh.appendedMessages && refresh.appendedMessages.length > 0) {
+            messages = [...messages, ...refresh.appendedMessages];
+            if (deps.transcript) {
+              await deps.transcript.record(messages);
+            }
+          }
+        }
+      } catch (refreshErr) {
+        logForDebugging(`[round-context-refresh] failed: ${errorMessage(refreshErr)}`);
+      }
+    }
     deps.emit?.({ type: "round_start", turn: turns });
     let reactiveRetried = false;
     let effectiveDeps = deps;
@@ -82849,7 +83358,7 @@ async function queryAgentLoop(deps, args) {
     for (;; ) {
       const roundInputLen = messages.length;
       try {
-        lastRound = await queryOneRound(effectiveDeps, tools, messages);
+        lastRound = await queryOneRound(effectiveDeps, activeTools, messages);
       } catch (err) {
         if (!reactiveRetried && deps.reactiveCompact !== undefined && isReactiveCompactEnabled() && isReactiveCompactRecoverableError(err)) {
           reactiveRetried = true;
@@ -82872,6 +83381,13 @@ async function queryAgentLoop(deps, args) {
             continue;
           }
         }
+        const rejectedTool = parseToolSchemaRejectionError(err);
+        if (rejectedTool && !degradedTools.has(rejectedTool) && activeTools.some((t) => t.name === rejectedTool)) {
+          degradedTools.add(rejectedTool);
+          activeTools = activeTools.filter((t) => t.name !== rejectedTool);
+          logForDebugging(`[tool-schema-strip] 网关拒绝工具 '${rejectedTool}' 的 input schema，本会话剥除其参数后续跑（tools ${activeTools.length} 个）`);
+          continue;
+        }
         const nextRef = nextFallbackRef(deps.fallbackModels, triedFallbackRefs);
         if (nextRef && shouldRetryModelError(err, deps.signal)) {
           triedFallbackRefs.add(nextRef);
@@ -83058,6 +83574,7 @@ function createToolHooks(opts = {}) {
         updatedInput: r.updatedInput,
         hookBehavior: r.permissionBehavior,
         hookPermissionDecisionReason: r.permissionDecisionReason,
+        hookSource: r.permissionDecisionSource,
         preventContinuation: r.preventContinuation,
         stopReason: r.stopReason
       };
@@ -83346,6 +83863,7 @@ var init_state2 = () => {};
 var init_hooks2 = __esm(() => {
   init_toolHooks();
   init_hooks();
+  init_hooks();
 });
 
 // src/engine/goal/goalCheckIn.ts
@@ -83434,6 +83952,7 @@ var init_engine = __esm(() => {
   init_permissions4();
   init_hooks2();
   init_hooks2();
+  init_hooks2();
   init_config();
   init_messaging();
   init_messaging();
@@ -86861,6 +87380,19 @@ var init_hooksWiring = __esm(() => {
   init_hooks();
 });
 
+// src/cli/headlessSessionEnd.ts
+async function runHeadlessSessionEndHooks(reason) {
+  try {
+    await runSessionEndHooks(reason);
+  } catch (error) {
+    logForDebugging2(`SessionEnd hooks (headless exit, reason=${reason}) failed: ${String(error)}`, { level: "error" });
+  }
+}
+var init_headlessSessionEnd = __esm(() => {
+  init_hooks();
+  init_debugSink();
+});
+
 // src/cli/print.ts
 import { randomUUID as randomUUID21 } from "crypto";
 import { readFile as readFile12 } from "node:fs/promises";
@@ -86960,7 +87492,12 @@ async function connectMcpStartup(args) {
   }) : {};
   const dynamicNames = new Set(Object.keys(dynamicConfigs));
   const allConfigs = strictMcpConfig ? dynamicConfigs : { ...baseConfigs, ...dynamicConfigs };
-  const connectAll = () => Promise.allSettled(Object.entries(allConfigs).map(([name, config]) => manager.connect(name, config, dynamicNames.has(name) ? { connectionTimeoutMs: 5000 } : undefined)));
+  const policy = getMcpPolicyInput() ?? getMcpPolicyFromSettings(getSettingsWithErrors().settings);
+  const { allowed, blocked } = filterMcpServersByPolicy(allConfigs, policy);
+  for (const b of blocked) {
+    manager.markBlocked(b.name, allConfigs[b.name], b.reason);
+  }
+  const connectAll = () => Promise.allSettled(Object.entries(allowed).map(([name, config]) => manager.connect(name, config, dynamicNames.has(name) ? { connectionTimeoutMs: 5000 } : undefined)));
   const nonBlocking = isMcpConnectionNonBlocking();
   if (nonBlocking) {
     connectAll();
@@ -87615,6 +88152,7 @@ async function runHeadless(inputPrompt, options) {
     cronScheduler.stop();
     await drainToOutput();
     await drainPendingBackgroundAgents(abortController.signal);
+    await runHeadlessSessionEndHooks("prompt_input_exit");
   } catch (error) {
     cronScheduler.stop();
     logForDebugging2(headlessErrorLine(error), { level: "error" });
@@ -87633,6 +88171,7 @@ async function runHeadless(inputPrompt, options) {
       });
     } catch {}
     abortController.abort();
+    await runHeadlessSessionEndHooks("other");
     process.exitCode = 1;
   }
   await flushDebugSink();
@@ -87683,6 +88222,7 @@ var init_print = __esm(() => {
   init_headlessPrompt();
   init_debugSink();
   init_hooksWiring();
+  init_headlessSessionEnd();
 });
 
 // src/cli/handlers/update.ts
@@ -88219,6 +88759,10 @@ async function mapConcurrent(items, fn, concurrency) {
   return results;
 }
 async function checkMcpServerHealth(manager, name, server) {
+  const policy = getMcpPolicyInput() ?? getMcpPolicyFromSettings(getSettingsWithErrors().settings);
+  if (checkMcpServerPolicy(name, server, policy).blocked) {
+    return "✗ Blocked by enterprise policy";
+  }
   try {
     const result = await manager.connect(name, server);
     if (result.type === "connected") {
@@ -88514,6 +89058,7 @@ Warning: The command "${actualCommand}" looks like a URL, but is being interpret
 }
 var init_mcp4 = __esm(() => {
   init_mcp3();
+  init_engine();
   init_entryInit();
   init_mcpConfigWrite();
   init_setup();
@@ -89066,7 +89611,7 @@ var init_cli = __esm(() => {
 });
 
 // node_modules/is-plain-obj/index.js
-function isPlainObject3(value) {
+function isPlainObject4(value) {
   if (typeof value !== "object" || value === null) {
     return false;
   }
@@ -89088,7 +89633,7 @@ var init_file_url = () => {};
 // node_modules/execa/lib/methods/parameters.js
 var normalizeParameters = (rawFile, rawArguments = [], rawOptions = {}) => {
   const filePath = safeNormalizeFileUrl(rawFile, "First argument");
-  const [commandArguments, options] = isPlainObject3(rawArguments) ? [[], rawArguments] : [rawArguments, rawOptions];
+  const [commandArguments, options] = isPlainObject4(rawArguments) ? [[], rawArguments] : [rawArguments, rawOptions];
   if (!Array.isArray(commandArguments)) {
     throw new TypeError(`Second argument must be either an array of arguments or an options object: ${commandArguments}`);
   }
@@ -89100,7 +89645,7 @@ var normalizeParameters = (rawFile, rawArguments = [], rawOptions = {}) => {
   if (nullByteArgument !== undefined) {
     throw new TypeError(`Arguments cannot contain null bytes ("\\0"): ${nullByteArgument}`);
   }
-  if (!isPlainObject3(options)) {
+  if (!isPlainObject4(options)) {
     throw new TypeError(`Last argument must be an options object: ${options}`);
   }
   return [filePath, normalizedArguments, { __proto__: null, ...options }];
@@ -89222,7 +89767,7 @@ var isTemplateString = (templates) => Array.isArray(templates) && Array.isArray(
   if (typeOfExpression === "number") {
     return String(expression);
   }
-  if (isPlainObject3(expression) && (("stdout" in expression) || ("isMaxBuffer" in expression))) {
+  if (isPlainObject4(expression) && (("stdout" in expression) || ("isMaxBuffer" in expression))) {
     return getSubprocessResult(expression);
   }
   if (expression instanceof ChildProcess || Object.prototype.toString.call(expression) === "[object Promise]") {
@@ -89269,7 +89814,7 @@ var normalizeFdSpecificOptions = (options) => {
   const optionBaseArray = Array.from({ length: stdioLength + 1 });
   const optionArray = normalizeFdSpecificValue(options[optionName], optionBaseArray, optionName, stdioLength);
   return addDefaultValue(optionArray, optionName);
-}, getStdioLength = ({ stdio }) => Array.isArray(stdio) ? Math.max(stdio.length, STANDARD_STREAMS_ALIASES.length) : STANDARD_STREAMS_ALIASES.length, normalizeFdSpecificValue = (optionValue, optionArray, optionName, stdioLength) => isPlainObject3(optionValue) ? normalizeOptionObject(optionValue, optionArray, optionName, stdioLength) : optionArray.fill(optionValue), normalizeOptionObject = (optionValue, optionArray, optionName, stdioLength) => {
+}, getStdioLength = ({ stdio }) => Array.isArray(stdio) ? Math.max(stdio.length, STANDARD_STREAMS_ALIASES.length) : STANDARD_STREAMS_ALIASES.length, normalizeFdSpecificValue = (optionValue, optionArray, optionName, stdioLength) => isPlainObject4(optionValue) ? normalizeOptionObject(optionValue, optionArray, optionName, stdioLength) : optionArray.fill(optionValue), normalizeOptionObject = (optionValue, optionArray, optionName, stdioLength) => {
   for (const fdName of Object.keys(optionValue).sort(compareFdName)) {
     for (const fdNumber of parseFdName(fdName, optionName, stdioLength)) {
       optionArray[fdNumber] = optionValue[fdName];
@@ -92516,7 +93061,7 @@ var getStdioItemType = (value, optionName) => {
   if (value !== undefined && typeof value !== "boolean") {
     throw new TypeError(`The \`${optionName}\` option must use a boolean.`);
   }
-}, isGenerator = (value) => isAsyncGenerator(value) || isSyncGenerator(value), isAsyncGenerator = (value) => Object.prototype.toString.call(value) === "[object AsyncGeneratorFunction]", isSyncGenerator = (value) => Object.prototype.toString.call(value) === "[object GeneratorFunction]", isTransformOptions = (value) => isPlainObject3(value) && (value.transform !== undefined || value.final !== undefined), isUrl = (value) => Object.prototype.toString.call(value) === "[object URL]", isRegularUrl = (value) => isUrl(value) && value.protocol !== "file:", isFilePathObject = (value) => isPlainObject3(value) && Object.keys(value).length > 0 && Object.keys(value).every((key) => FILE_PATH_KEYS.has(key)) && isFilePathString(value.file), FILE_PATH_KEYS, isFilePathString = (file) => typeof file === "string", isStdioValueObject = (value) => isPlainObject3(value) && Object.keys(value).length > 0 && Object.keys(value).every((key) => STDIO_VALUE_KEYS.has(key)) && ("value" in value), STDIO_VALUE_KEYS, isUnknownStdioString = (type, value) => type === "native" && typeof value === "string" && !KNOWN_STDIO_STRINGS.has(value), KNOWN_STDIO_STRINGS, isReadableStream3 = (value) => Object.prototype.toString.call(value) === "[object ReadableStream]", isWritableStream2 = (value) => Object.prototype.toString.call(value) === "[object WritableStream]", isWebStream = (value) => isReadableStream3(value) || isWritableStream2(value), isTransformStream = (value) => isReadableStream3(value?.readable) && isWritableStream2(value?.writable), isAsyncIterableObject = (value) => isObject2(value) && typeof value[Symbol.asyncIterator] === "function", isIterableObject = (value) => isObject2(value) && typeof value[Symbol.iterator] === "function", isObject2 = (value) => typeof value === "object" && value !== null, TRANSFORM_TYPES, FILE_TYPES, SPECIAL_DUPLICATE_TYPES_SYNC, SPECIAL_DUPLICATE_TYPES, FORBID_DUPLICATE_TYPES, TYPE_TO_MESSAGE;
+}, isGenerator = (value) => isAsyncGenerator(value) || isSyncGenerator(value), isAsyncGenerator = (value) => Object.prototype.toString.call(value) === "[object AsyncGeneratorFunction]", isSyncGenerator = (value) => Object.prototype.toString.call(value) === "[object GeneratorFunction]", isTransformOptions = (value) => isPlainObject4(value) && (value.transform !== undefined || value.final !== undefined), isUrl = (value) => Object.prototype.toString.call(value) === "[object URL]", isRegularUrl = (value) => isUrl(value) && value.protocol !== "file:", isFilePathObject = (value) => isPlainObject4(value) && Object.keys(value).length > 0 && Object.keys(value).every((key) => FILE_PATH_KEYS.has(key)) && isFilePathString(value.file), FILE_PATH_KEYS, isFilePathString = (file) => typeof file === "string", isStdioValueObject = (value) => isPlainObject4(value) && Object.keys(value).length > 0 && Object.keys(value).every((key) => STDIO_VALUE_KEYS.has(key)) && ("value" in value), STDIO_VALUE_KEYS, isUnknownStdioString = (type, value) => type === "native" && typeof value === "string" && !KNOWN_STDIO_STRINGS.has(value), KNOWN_STDIO_STRINGS, isReadableStream3 = (value) => Object.prototype.toString.call(value) === "[object ReadableStream]", isWritableStream2 = (value) => Object.prototype.toString.call(value) === "[object WritableStream]", isWebStream = (value) => isReadableStream3(value) || isWritableStream2(value), isTransformStream = (value) => isReadableStream3(value?.readable) && isWritableStream2(value?.writable), isAsyncIterableObject = (value) => isObject2(value) && typeof value[Symbol.asyncIterator] === "function", isIterableObject = (value) => isObject2(value) && typeof value[Symbol.iterator] === "function", isObject2 = (value) => typeof value === "object" && value !== null, TRANSFORM_TYPES, FILE_TYPES, SPECIAL_DUPLICATE_TYPES_SYNC, SPECIAL_DUPLICATE_TYPES, FORBID_DUPLICATE_TYPES, TYPE_TO_MESSAGE;
 var init_type = __esm(() => {
   init_uint_array();
   FILE_PATH_KEYS = new Set(["file", "append"]);
@@ -92618,7 +93163,7 @@ var normalizeTransforms = (stdioItems, optionName, direction, options) => [
     value: { transform, writableObjectMode, readableObjectMode }
   };
 }, normalizeTransformStream = ({ stdioItem, stdioItem: { value }, index, newTransforms, direction }) => {
-  const { transform, objectMode } = isPlainObject3(value) ? value : { transform: value };
+  const { transform, objectMode } = isPlainObject4(value) ? value : { transform: value };
   const { writableObjectMode, readableObjectMode } = getTransformObjectModes(objectMode, index, newTransforms, direction);
   return {
     ...stdioItem,
@@ -92631,7 +93176,7 @@ var normalizeTransforms = (stdioItems, optionName, direction, options) => [
     binary: binaryOption = false,
     preserveNewlines = false,
     objectMode
-  } = isPlainObject3(value) ? value : { transform: value };
+  } = isPlainObject4(value) ? value : { transform: value };
   const binary = binaryOption || BINARY_ENCODINGS.has(encoding);
   const { writableObjectMode, readableObjectMode } = getTransformObjectModes(objectMode, index, newTransforms, direction);
   return {
@@ -95326,7 +95871,7 @@ var init_abort2 = __esm(() => {
 
 // node_modules/execa/lib/pipe/setup.js
 var pipeToSubprocess = (sourceInfo, ...pipeArguments) => {
-  if (isPlainObject3(pipeArguments[0])) {
+  if (isPlainObject4(pipeArguments[0])) {
     return pipeToSubprocess.bind(undefined, {
       ...sourceInfo,
       boundOptions: { ...sourceInfo.boundOptions, ...pipeArguments[0] }
@@ -96235,7 +96780,7 @@ var mergeOptions = (boundOptions, options) => {
   ]));
   return { ...safeBoundOptions, ...mergedOptions };
 }, mergeOption = (optionName, boundOptionValue, optionValue) => {
-  if (DEEP_OPTIONS.has(optionName) && isPlainObject3(boundOptionValue) && isPlainObject3(optionValue)) {
+  if (DEEP_OPTIONS.has(optionName) && isPlainObject4(boundOptionValue) && isPlainObject4(optionValue)) {
     return { ...boundOptionValue, ...optionValue };
   }
   return optionValue;
@@ -96260,7 +96805,7 @@ var createExeca = (mapArguments, boundOptions, deepOptions, setBoundExeca) => {
   }
   return boundExeca;
 }, callBoundExeca = ({ mapArguments, deepOptions = {}, boundOptions = {}, setBoundExeca, createNested }, firstArgument, ...nextArguments) => {
-  if (isPlainObject3(firstArgument)) {
+  if (isPlainObject4(firstArgument)) {
     return createNested(mapArguments, mergeOptions(boundOptions, firstArgument), setBoundExeca);
   }
   const { file, commandArguments, options, isSync } = parseArguments2({
@@ -98324,7 +98869,7 @@ var init_isArrayLikeObject = __esm(() => {
 });
 
 // node_modules/lodash-es/isPlainObject.js
-function isPlainObject4(value) {
+function isPlainObject5(value) {
   if (!isObjectLike_default(value) || _baseGetTag_default(value) != objectTag4) {
     return false;
   }
@@ -98345,7 +98890,7 @@ var init_isPlainObject = __esm(() => {
   funcToString3 = funcProto3.toString;
   hasOwnProperty11 = objectProto14.hasOwnProperty;
   objectCtorString = funcToString3.call(Object);
-  isPlainObject_default = isPlainObject4;
+  isPlainObject_default = isPlainObject5;
 });
 
 // node_modules/lodash-es/_safeGet.js
@@ -102476,9 +103021,9 @@ function merge2(...objs) {
     }
     const targetKey = caseless && typeof key === "string" && findKey(result, key) || key;
     const existing = hasOwnProperty14(result, targetKey) ? result[targetKey] : undefined;
-    if (isPlainObject5(existing) && isPlainObject5(val)) {
+    if (isPlainObject6(existing) && isPlainObject6(val)) {
       result[targetKey] = merge2(existing, val);
-    } else if (isPlainObject5(val)) {
+    } else if (isPlainObject6(val)) {
       result[targetKey] = merge2({}, val);
     } else if (isArray3(val)) {
       result[targetKey] = val.slice();
@@ -102581,7 +103126,7 @@ var toString3, getPrototypeOf, iterator, toStringTag, hasOwnProperty14, isUnsafe
 }, kindOf, kindOfTest = (type) => {
   type = type.toLowerCase();
   return (thing) => kindOf(thing) === type;
-}, typeOfTest = (type) => (thing) => typeof thing === type, isArray3, isUndefined, isArrayBuffer3, isString, isFunction2, isNumber, isObject4 = (thing) => thing !== null && typeof thing === "object", isBoolean = (thing) => thing === true || thing === false, isPlainObject5 = (val) => {
+}, typeOfTest = (type) => (thing) => typeof thing === type, isArray3, isUndefined, isArrayBuffer3, isString, isFunction2, isNumber, isObject4 = (thing) => thing !== null && typeof thing === "object", isBoolean = (thing) => thing === true || thing === false, isPlainObject6 = (val) => {
   if (!isObject4(val)) {
     return false;
   }
@@ -102857,7 +103402,7 @@ var init_utils3 = __esm(() => {
     isNumber,
     isBoolean,
     isObject: isObject4,
-    isPlainObject: isPlainObject5,
+    isPlainObject: isPlainObject6,
     isEmptyObject,
     isReadableStream: isReadableStream4,
     isRequest,
@@ -124455,8 +125000,8 @@ var isMcpServerCommandEntry = () => ({}), isMcpServerNameEntry = () => ({}), isM
   mcpServers: record(string2(), any()).optional(),
   allowedMcpServers: any().optional(),
   deniedMcpServers: any().optional(),
-  enabledMcpjsonServers: array(string2()).optional(),
-  disabledMcpjsonServers: array(string2()).optional(),
+  enabledMcpjsonServers: union([string2(), array(string2())]).transform((v) => Array.isArray(v) ? v : [v]).optional(),
+  disabledMcpjsonServers: union([string2(), array(string2())]).transform((v) => Array.isArray(v) ? v : [v]).optional(),
   enabledPlugins: record(string2(), any()).optional(),
   pluginConfigs: any().optional(),
   extraKnownMarketplaces: any().optional(),
@@ -124797,12 +125342,12 @@ function findLastUnescapedChar2(str, char) {
 var LEGACY_TOOL_NAME_ALIASES2;
 var init_permissionRuleParser2 = __esm(() => {
   init_constants6();
-  LEGACY_TOOL_NAME_ALIASES2 = {
+  LEGACY_TOOL_NAME_ALIASES2 = Object.assign(Object.create(null), {
     Task: AGENT_TOOL_NAME2,
     KillShell: TASK_STOP_TOOL_NAME2,
     AgentOutputTool: TASK_OUTPUT_TOOL_NAME2,
     BashOutputTool: TASK_OUTPUT_TOOL_NAME2
-  };
+  });
 });
 
 // src/tui/utils/settings/toolValidationConfig.ts
@@ -180895,6 +181440,7 @@ __export(exports_engineCompat, {
   MAX_CONSECUTIVE_AUTOCOMPACT_FAILURES: () => MAX_CONSECUTIVE_AUTOCOMPACT_FAILURES,
   MAX_GOAL_CHECKINS: () => MAX_GOAL_CHECKINS,
   MAX_GOAL_CONDITION_CHARS: () => MAX_GOAL_CONDITION_CHARS,
+  MAX_HOOK_CONCURRENCY: () => MAX_HOOK_CONCURRENCY,
   MAX_PTL_RETRIES: () => MAX_PTL_RETRIES,
   MAX_TRANSCRIPT_READ_BYTES: () => MAX_TRANSCRIPT_READ_BYTES,
   MAX_WORKER_SPAWN_DEPTH: () => MAX_WORKER_SPAWN_DEPTH,
@@ -182181,11 +182727,12 @@ function parseArgumentNames2(argumentNames) {
     return [];
   }
   const isValidName = (name) => typeof name === "string" && name.trim() !== "" && !/^\d+$/.test(name);
+  const cap = (names) => names.map((name) => name.slice(0, MAX_ARGUMENT_NAME_CHARS2)).slice(0, MAX_ARGUMENT_NAMES2);
   if (Array.isArray(argumentNames)) {
-    return argumentNames.filter(isValidName);
+    return cap(argumentNames.filter(isValidName));
   }
   if (typeof argumentNames === "string") {
-    return argumentNames.split(/\s+/).filter(isValidName);
+    return cap(argumentNames.split(/\s+/).filter(isValidName));
   }
   return [];
 }
@@ -182195,36 +182742,144 @@ function generateProgressiveArgumentHint2(argNames, typedArgs) {
     return;
   return remaining.map((name) => `[${name}]`).join(" ");
 }
-function substituteArguments2(content, args, appendIfNoPlaceholder = true, argumentNames = []) {
+function isWordChar3(c) {
+  return c !== undefined && /[A-Za-z0-9_]/.test(c);
+}
+function matchPlaceholderAt2(content, i, argumentNames) {
+  if (content[i] !== "$")
+    return null;
+  for (let n = 0;n < argumentNames.length; n++) {
+    const name = argumentNames[n];
+    if (!name)
+      continue;
+    if (content.startsWith(`$${name}`, i)) {
+      const after = content[i + 1 + name.length];
+      if (after !== "[" && !isWordChar3(after)) {
+        return { length: 1 + name.length, kind: "named", nameIndex: n };
+      }
+    }
+  }
+  INDEXED_PLACEHOLDER_RE2.lastIndex = i;
+  const indexed = INDEXED_PLACEHOLDER_RE2.exec(content);
+  if (indexed) {
+    return {
+      length: indexed[0].length,
+      kind: "indexed",
+      argIndex: parseInt(indexed[1], 10)
+    };
+  }
+  if (content.startsWith("$ARGUMENTS", i)) {
+    return { length: "$ARGUMENTS".length, kind: "bare" };
+  }
+  SHORTHAND_PLACEHOLDER_RE2.lastIndex = i;
+  const shorthand = SHORTHAND_PLACEHOLDER_RE2.exec(content);
+  if (shorthand && !isWordChar3(content[i + shorthand[0].length])) {
+    return {
+      length: shorthand[0].length,
+      kind: "shorthand",
+      argIndex: parseInt(shorthand[1], 10)
+    };
+  }
+  return null;
+}
+function countPlaceholderOccurrences2(content, argumentNames) {
+  let count = 0;
+  let i = 0;
+  while (i < content.length) {
+    const m = matchPlaceholderAt2(content, i, argumentNames);
+    if (m) {
+      count++;
+      i += m.length;
+    } else {
+      i++;
+    }
+  }
+  return count;
+}
+function substituteArgumentsImpl2(content, args, appendIfNoPlaceholder, argumentNames, strict) {
   if (args === undefined || args === null) {
     return content;
   }
-  const parsedArgs = parseArguments3(args);
-  const originalContent = content;
-  for (let i = 0;i < argumentNames.length; i++) {
-    const name = argumentNames[i];
-    if (!name)
-      continue;
-    content = content.replace(new RegExp(`\\$${name}(?![\\[\\w])`, "g"), parsedArgs[i] ?? "");
+  const placeholderCount = countPlaceholderOccurrences2(content, argumentNames);
+  let effectiveArgs = args;
+  if (placeholderCount > 0 && content.length + placeholderCount * args.length > MAX_SUBSTITUTION_OUTPUT_CHARS2) {
+    if (strict)
+      return null;
+    const budgetPerReplacement = Math.max(0, Math.floor((MAX_SUBSTITUTION_OUTPUT_CHARS2 - content.length) / placeholderCount));
+    effectiveArgs = args.slice(0, budgetPerReplacement);
+  } else if (strict) {
+    const appendLen = appendIfNoPlaceholder && args ? `
+
+ARGUMENTS: `.length + args.length : 0;
+    if (content.length + appendLen > MAX_SUBSTITUTION_OUTPUT_CHARS2) {
+      return null;
+    }
   }
-  content = content.replace(/\$ARGUMENTS\[(\d+)\]/g, (_, indexStr) => {
-    const index = parseInt(indexStr, 10);
-    return parsedArgs[index] ?? "";
-  });
-  content = content.replace(/\$(\d+)(?!\w)/g, (_, indexStr) => {
-    const index = parseInt(indexStr, 10);
-    return parsedArgs[index] ?? "";
-  });
-  content = content.replaceAll("$ARGUMENTS", args);
-  if (content === originalContent && appendIfNoPlaceholder && args) {
-    content = content + `
+  const parsedArgs = parseArguments3(effectiveArgs);
+  let out = "";
+  const appendValue = (value) => {
+    if (out.length + value.length > MAX_SUBSTITUTION_OUTPUT_CHARS2) {
+      value = value.slice(0, Math.max(0, MAX_SUBSTITUTION_OUTPUT_CHARS2 - out.length));
+    }
+    out += value;
+  };
+  let matched = false;
+  let i = 0;
+  while (i < content.length) {
+    const m = matchPlaceholderAt2(content, i, argumentNames);
+    if (m) {
+      matched = true;
+      if (m.kind === "bare")
+        appendValue(effectiveArgs);
+      else if (m.kind === "named")
+        appendValue(parsedArgs[m.nameIndex] ?? "");
+      else
+        appendValue(parsedArgs[m.argIndex] ?? "");
+      i += m.length;
+    } else {
+      out += content[i];
+      i++;
+    }
+  }
+  if (!matched && appendIfNoPlaceholder && args) {
+    out = out + `
 
 ARGUMENTS: ${args}`;
   }
-  return content;
+  return out;
 }
+function substituteArguments2(content, args, appendIfNoPlaceholder = true, argumentNames = []) {
+  return substituteArgumentsImpl2(content, args, appendIfNoPlaceholder, argumentNames, false) ?? content;
+}
+function substituteArgumentsStrict2(content, args, appendIfNoPlaceholder = true, argumentNames = []) {
+  return substituteArgumentsImpl2(content, args, appendIfNoPlaceholder, argumentNames, true);
+}
+var MAX_ARGUMENT_NAMES2 = 64, MAX_ARGUMENT_NAME_CHARS2 = 64, MAX_SUBSTITUTION_OUTPUT_CHARS2 = 1e6, INDEXED_PLACEHOLDER_RE2, SHORTHAND_PLACEHOLDER_RE2;
 var init_argumentSubstitution2 = __esm(() => {
   init_shellQuote2();
+  INDEXED_PLACEHOLDER_RE2 = /\$ARGUMENTS\[(\d+)\]/y;
+  SHORTHAND_PLACEHOLDER_RE2 = /\$(\d+)/y;
+});
+
+// src/tui/utils/commandNameSafety.ts
+function isUnsafeCommandName2(name) {
+  if (name === "")
+    return true;
+  if (name.includes("<") || name.includes(">"))
+    return true;
+  return UNSAFE_NAME_CHARS_RE2.test(name);
+}
+function sanitizeDisplayName2(displayName, canonicalName) {
+  if (displayName === undefined || !isUnsafeCommandName2(displayName)) {
+    return displayName;
+  }
+  logForDebugging3(`Discarding unsafe frontmatter display name ${JSON.stringify(displayName)} for ${canonicalName}; falling back to canonical name`);
+  return;
+}
+var UNSAFE_NAME_CHARS_RE2;
+var init_commandNameSafety2 = __esm(() => {
+  init_debug();
+  UNSAFE_NAME_CHARS_RE2 = /[\u0000-\u001F\u007F-\u00A0\u00AD\u034F\u061C\u070F\u1680\u180E\u2000-\u200F\u2028\u2029\u202A-\u202E\u202F\u205F\u2060-\u2069\u3000\uFE00-\uFE0F\uFEFF\u{E0100}-\u{E01EF}]/u;
 });
 
 // src/tui/utils/generatedFiles.ts
@@ -184657,7 +185312,7 @@ class Protocol {
     };
   }
 }
-function isPlainObject6(value) {
+function isPlainObject7(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function mergeCapabilities(base, additional) {
@@ -184668,7 +185323,7 @@ function mergeCapabilities(base, additional) {
     if (addValue === undefined)
       continue;
     const baseValue = result[k];
-    if (isPlainObject6(baseValue) && isPlainObject6(addValue)) {
+    if (isPlainObject7(baseValue) && isPlainObject7(addValue)) {
       result[k] = { ...baseValue, ...addValue };
     } else {
       result[k] = addValue;
@@ -188182,6 +188837,97 @@ var init_streamableHttp = __esm(() => {
   };
 });
 
+// src/tui/services/mcp/fetchTimeout.ts
+function getMcpConnectionTimeoutMs() {
+  return parseInt(process.env.MCP_TIMEOUT || "", 10) || 30000;
+}
+function bindBodyReadDeadline(response) {
+  const contentType = response.headers?.get("content-type") ?? "";
+  if (contentType.includes("text/event-stream")) {
+    return response;
+  }
+  const rawBody = response.body;
+  if (!rawBody) {
+    return response;
+  }
+  const reader = rawBody.getReader();
+  let deadlineTimer;
+  const deadline = new Promise((_, reject) => {
+    deadlineTimer = setTimeout(() => reject(new DOMException("The operation timed out.", "TimeoutError")), getMcpConnectionTimeoutMs());
+    deadlineTimer.unref?.();
+  });
+  deadline.catch(() => {});
+  const clearDeadline = () => {
+    if (deadlineTimer) {
+      clearTimeout(deadlineTimer);
+    }
+  };
+  const stream = new ReadableStream({
+    async pull(ctrl) {
+      try {
+        const { done, value } = await Promise.race([reader.read(), deadline]);
+        if (done) {
+          clearDeadline();
+          ctrl.close();
+        } else {
+          ctrl.enqueue(value);
+        }
+      } catch (error) {
+        clearDeadline();
+        reader.cancel().catch(() => {});
+        ctrl.error(error);
+      }
+    },
+    cancel(reason) {
+      clearDeadline();
+      return reader.cancel(reason);
+    }
+  });
+  return new Response(stream, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers
+  });
+}
+function wrapFetchWithTimeout(baseFetch) {
+  return async (url, init) => {
+    const method = (init?.method ?? "GET").toUpperCase();
+    if (method === "GET") {
+      return baseFetch(url, init);
+    }
+    const headers = new Headers(init?.headers);
+    if (!headers.has("accept")) {
+      headers.set("accept", MCP_STREAMABLE_HTTP_ACCEPT);
+    }
+    const controller = new AbortController;
+    const timer = setTimeout((c) => c.abort(new DOMException("The operation timed out.", "TimeoutError")), MCP_REQUEST_TIMEOUT_MS, controller);
+    timer.unref?.();
+    const parentSignal = init?.signal;
+    const abort = () => controller.abort(parentSignal?.reason);
+    parentSignal?.addEventListener("abort", abort);
+    if (parentSignal?.aborted) {
+      controller.abort(parentSignal.reason);
+    }
+    const cleanup = () => {
+      clearTimeout(timer);
+      parentSignal?.removeEventListener("abort", abort);
+    };
+    try {
+      const response = await baseFetch(url, {
+        ...init,
+        headers,
+        signal: controller.signal
+      });
+      cleanup();
+      return bindBodyReadDeadline(response);
+    } catch (error) {
+      cleanup();
+      throw error;
+    }
+  };
+}
+var MCP_REQUEST_TIMEOUT_MS = 60000, MCP_STREAMABLE_HTTP_ACCEPT = "application/json, text/event-stream";
+
 // node_modules/lodash-es/_baseZipObject.js
 function baseZipObject(props, values, assignFunc) {
   var index = -1, length = props.length, valsLength = values.length, result = {};
@@ -193521,6 +194267,73 @@ var init_browser = __esm(() => {
   init_execFileNoThrow2();
 });
 
+// src/tui/services/mcp/headersHelper.ts
+function isMcpServerFromProjectOrLocalSettings(config) {
+  return config.scope === "project" || config.scope === "local";
+}
+async function getMcpHeadersFromHelper(serverName, config) {
+  if (!config.headersHelper) {
+    return null;
+  }
+  if ("scope" in config && isMcpServerFromProjectOrLocalSettings(config)) {
+    const isNonInteractive = getIsNonInteractiveSession();
+    const explicitTrust = process.env.ATLAS_TRUST_WORKSPACE === "true";
+    const hasTrust = checkHasTrustDialogAccepted() || isNonInteractive && explicitTrust;
+    if (!hasTrust) {
+      const error = new Error(`Security: headersHelper for MCP server '${serverName}' executed before workspace trust is confirmed. If you see this message, post in ${MACRO.FEEDBACK_CHANNEL}.`);
+      logAntError("MCP headersHelper invoked before trust check", error);
+      return null;
+    }
+  }
+  try {
+    logMCPDebug(serverName, "Executing headersHelper to get dynamic headers");
+    const execResult = await execFileNoThrowWithCwd2("sh", ["-c", config.headersHelper], {
+      timeout: 1e4,
+      env: {
+        ...process.env,
+        ATLAS_MCP_SERVER_NAME: serverName,
+        ATLAS_MCP_SERVER_URL: config.url
+      }
+    });
+    if (execResult.code !== 0 || !execResult.stdout) {
+      throw new Error(`headersHelper for MCP server '${serverName}' did not return a valid value`);
+    }
+    const result = execResult.stdout.trim();
+    const headers = jsonParse2(result);
+    if (typeof headers !== "object" || headers === null || Array.isArray(headers)) {
+      throw new Error(`headersHelper for MCP server '${serverName}' must return a JSON object with string key-value pairs`);
+    }
+    for (const [key, value] of Object.entries(headers)) {
+      if (typeof value !== "string") {
+        throw new Error(`headersHelper for MCP server '${serverName}' returned non-string value for key "${key}": ${typeof value}`);
+      }
+    }
+    logMCPDebug(serverName, `Successfully retrieved ${Object.keys(headers).length} headers from headersHelper`);
+    return headers;
+  } catch (error) {
+    logMCPError(serverName, `Error getting headers from headersHelper: ${errorMessage2(error)}`);
+    logError3(new Error(`Error getting MCP headers from headersHelper for server '${serverName}': ${errorMessage2(error)}`));
+    return null;
+  }
+}
+async function getMcpServerHeaders(serverName, config) {
+  const staticHeaders = config.headers || {};
+  const dynamicHeaders = await getMcpHeadersFromHelper(serverName, config) || {};
+  return {
+    ...staticHeaders,
+    ...dynamicHeaders
+  };
+}
+var init_headersHelper = __esm(() => {
+  init_bootstrap();
+  init_config6();
+  init_debug();
+  init_errors4();
+  init_execFileNoThrow2();
+  init_log5();
+  init_slowOperations();
+});
+
 // src/tui/services/mcp/oauthPort.ts
 import { createServer } from "http";
 function buildRedirectUri(port = REDIRECT_PORT_FALLBACK) {
@@ -194028,20 +194841,20 @@ async function writeMcpjsonFile2(config) {
     throw e;
   }
 }
-function getServerCommandArray(config) {
+function getServerCommandArray2(config) {
   if (config.type !== undefined && config.type !== "stdio") {
     return null;
   }
   const stdioConfig = config;
   return [stdioConfig.command, ...stdioConfig.args ?? []];
 }
-function commandArraysMatch(a, b) {
+function commandArraysMatch2(a, b) {
   if (a.length !== b.length) {
     return false;
   }
   return a.every((val, idx) => val === b[idx]);
 }
-function getServerUrl(config) {
+function getServerUrl2(config) {
   return "url" in config ? config.url : null;
 }
 function unwrapCcrProxyUrl(url) {
@@ -194057,11 +194870,11 @@ function unwrapCcrProxyUrl(url) {
   }
 }
 function getMcpServerSignature(config) {
-  const cmd = getServerCommandArray(config);
+  const cmd = getServerCommandArray2(config);
   if (cmd) {
     return `stdio:${jsonStringify5(cmd)}`;
   }
-  const url = getServerUrl(config);
+  const url = getServerUrl2(config);
   if (url) {
     return `url:${unwrapCcrProxyUrl(url)}`;
   }
@@ -194123,13 +194936,13 @@ function dedupManagedMcpServers(claudeAiServers, manualServers) {
   }
   return { servers, suppressed };
 }
-function urlPatternToRegex(pattern) {
+function urlPatternToRegex2(pattern) {
   const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
   const regexStr = escaped.replace(/\*/g, ".*");
   return new RegExp(`^${regexStr}$`);
 }
-function urlMatchesPattern(url, pattern) {
-  const regex = urlPatternToRegex(pattern);
+function urlMatchesPattern2(url, pattern) {
+  const regex = urlPatternToRegex2(pattern);
   return regex.test(url);
 }
 function getMcpAllowlistSettings() {
@@ -194152,18 +194965,18 @@ function isMcpServerDenied(serverName, config) {
     }
   }
   if (config) {
-    const serverCommand = getServerCommandArray(config);
+    const serverCommand = getServerCommandArray2(config);
     if (serverCommand) {
       for (const entry of settings.deniedMcpServers) {
-        if (isMcpServerCommandEntry(entry) && commandArraysMatch(entry.serverCommand, serverCommand)) {
+        if (isMcpServerCommandEntry(entry) && commandArraysMatch2(entry.serverCommand, serverCommand)) {
           return true;
         }
       }
     }
-    const serverUrl = getServerUrl(config);
+    const serverUrl = getServerUrl2(config);
     if (serverUrl) {
       for (const entry of settings.deniedMcpServers) {
-        if (isMcpServerUrlEntry(entry) && urlMatchesPattern(serverUrl, entry.serverUrl)) {
+        if (isMcpServerUrlEntry(entry) && urlMatchesPattern2(serverUrl, entry.serverUrl)) {
           return true;
         }
       }
@@ -194185,12 +194998,12 @@ function isMcpServerAllowedByPolicy(serverName, config) {
   const hasCommandEntries = settings.allowedMcpServers.some(isMcpServerCommandEntry);
   const hasUrlEntries = settings.allowedMcpServers.some(isMcpServerUrlEntry);
   if (config) {
-    const serverCommand = getServerCommandArray(config);
-    const serverUrl = getServerUrl(config);
+    const serverCommand = getServerCommandArray2(config);
+    const serverUrl = getServerUrl2(config);
     if (serverCommand) {
       if (hasCommandEntries) {
         for (const entry of settings.allowedMcpServers) {
-          if (isMcpServerCommandEntry(entry) && commandArraysMatch(entry.serverCommand, serverCommand)) {
+          if (isMcpServerCommandEntry(entry) && commandArraysMatch2(entry.serverCommand, serverCommand)) {
             return true;
           }
         }
@@ -194206,7 +195019,7 @@ function isMcpServerAllowedByPolicy(serverName, config) {
     } else if (serverUrl) {
       if (hasUrlEntries) {
         for (const entry of settings.allowedMcpServers) {
-          if (isMcpServerUrlEntry(entry) && urlMatchesPattern(serverUrl, entry.serverUrl)) {
+          if (isMcpServerUrlEntry(entry) && urlMatchesPattern2(serverUrl, entry.serverUrl)) {
             return true;
           }
         }
@@ -194235,7 +195048,7 @@ function isMcpServerAllowedByPolicy(serverName, config) {
   }
   return false;
 }
-function filterMcpServersByPolicy(configs) {
+function filterMcpServersByPolicy2(configs) {
   const allowed = {};
   const blocked = [];
   for (const [name, config] of Object.entries(configs)) {
@@ -194687,7 +195500,7 @@ async function getAllMcpConfigs2() {
   }
   const claudeaiPromise = Promise.resolve({});
   const { servers: claudeCodeServers, errors } = await getMcpConfigs({}, claudeaiPromise);
-  const { allowed: claudeaiMcpServers } = filterMcpServersByPolicy(await claudeaiPromise);
+  const { allowed: claudeaiMcpServers } = filterMcpServersByPolicy2(await claudeaiPromise);
   const { servers: dedupedClaudeAi } = dedupManagedMcpServers(claudeaiMcpServers, claudeCodeServers);
   const servers = Object.assign({}, dedupedClaudeAi, claudeCodeServers);
   return { servers, errors };
@@ -194792,6 +195605,9 @@ function parseMcpConfigFromFilePath(params) {
       ]
     };
   }
+  if (!configContent.trim()) {
+    return { config: { mcpServers: {} }, errors: [] };
+  }
   const parsedJson = safeParseJSON3(configContent);
   if (!parsedJson) {
     logForDebugging3(`MCP config is not valid JSON: ${filePath} (scope=${scope}, length=${configContent.length}, first100=${jsonStringify5(configContent.slice(0, 100))})`, { level: "error" });
@@ -194811,6 +195627,9 @@ function parseMcpConfigFromFilePath(params) {
       ]
     };
   }
+  if (typeof parsedJson === "object" && parsedJson !== null && !Array.isArray(parsedJson) && Object.keys(parsedJson).length === 0) {
+    return { config: { mcpServers: {} }, errors: [] };
+  }
   return parseMcpConfig({
     configObject: parsedJson,
     expandVars,
@@ -194941,11 +195760,11 @@ function hashMcpConfig(config) {
   });
   return createHash4("sha256").update(stable).digest("hex").slice(0, 16);
 }
-function excludeStalePluginClients(mcp, configs) {
+function excludeStalePluginClients(mcp, configs, opts) {
   const stale = mcp.clients.filter((c) => {
     const fresh = configs[c.name];
     if (!fresh)
-      return c.config.scope === "dynamic";
+      return opts?.absentIsStale || c.config.scope === "dynamic";
     return hashMcpConfig(c.config) !== hashMcpConfig(fresh);
   });
   if (stale.length === 0) {
@@ -195741,6 +196560,53 @@ function createAuthFetch() {
     }
   };
 }
+async function resolveConfiguredMcpHeaders(serverName, serverConfig) {
+  try {
+    return await getMcpServerHeaders(serverName, serverConfig);
+  } catch (error) {
+    logMCPDebug(serverName, `Failed to resolve configured headers for OAuth: ${errorMessage2(error)}`);
+    return {};
+  }
+}
+function headersToRecord2(headers) {
+  const out = {};
+  if (!headers)
+    return out;
+  if (headers instanceof Headers) {
+    headers.forEach((v, k) => {
+      out[k] = v;
+    });
+    return out;
+  }
+  if (Array.isArray(headers)) {
+    for (const [k, v] of headers)
+      out[k] = v;
+    return out;
+  }
+  if (typeof headers === "object") {
+    for (const [k, v] of Object.entries(headers)) {
+      out[k] = String(v);
+    }
+  }
+  return out;
+}
+function mergeConfiguredHeaders(fetchLike, configured) {
+  if (Object.keys(configured).length === 0)
+    return fetchLike;
+  return (url, init) => {
+    const requestHeaders = headersToRecord2(init?.headers);
+    const requestKeys = new Set(Object.keys(requestHeaders).map((k) => k.toLowerCase()));
+    const configuredNotOverridden = Object.fromEntries(Object.entries(configured).filter(([k]) => !requestKeys.has(k.toLowerCase())));
+    return fetchLike(url, {
+      ...init,
+      headers: { ...configuredNotOverridden, ...requestHeaders }
+    });
+  };
+}
+async function withConfiguredHeaders(fetchLike, serverName, serverConfig) {
+  const configured = await resolveConfiguredMcpHeaders(serverName, serverConfig);
+  return mergeConfiguredHeaders(fetchLike, configured);
+}
 async function fetchAuthServerMetadata(serverName, serverUrl, configuredMetadataUrl, fetchFn, resourceMetadataUrl) {
   if (configuredMetadataUrl) {
     if (!configuredMetadataUrl.startsWith("https://")) {
@@ -195799,12 +196665,14 @@ async function revokeToken({
   clientId,
   clientSecret,
   accessToken,
-  authMethod = "client_secret_basic"
+  authMethod = "client_secret_basic",
+  extraHeaders
 }) {
   const params = new URLSearchParams;
   params.set("token", token);
   params.set("token_type_hint", tokenTypeHint);
   const headers = {
+    ...extraHeaders ?? {},
     "Content-Type": "application/x-www-form-urlencoded"
   };
   if (clientId && clientSecret) {
@@ -195847,7 +196715,8 @@ async function revokeServerTokens(serverName, serverConfig, { preserveStepUpStat
   if (tokenData?.accessToken || tokenData?.refreshToken) {
     try {
       const asUrl = tokenData.discoveryState?.authorizationServerUrl ?? serverConfig.url;
-      const metadata = await fetchAuthServerMetadata(serverName, asUrl, serverConfig.oauth?.authServerMetadataUrl);
+      const configuredHeaders = await resolveConfiguredMcpHeaders(serverName, serverConfig);
+      const metadata = await fetchAuthServerMetadata(serverName, asUrl, serverConfig.oauth?.authServerMetadataUrl, mergeConfiguredHeaders(createAuthFetch(), configuredHeaders));
       if (!metadata) {
         logMCPDebug(serverName, "No OAuth metadata found");
       } else {
@@ -195869,7 +196738,8 @@ async function revokeServerTokens(serverName, serverConfig, { preserveStepUpStat
                 clientId: tokenData.clientId,
                 clientSecret: tokenData.clientSecret,
                 accessToken: tokenData.accessToken,
-                authMethod
+                authMethod,
+                extraHeaders: configuredHeaders
               });
             } catch (error) {
               logMCPDebug(serverName, `Failed to revoke refresh token: ${errorMessage2(error)}`);
@@ -195885,7 +196755,8 @@ async function revokeServerTokens(serverName, serverConfig, { preserveStepUpStat
                 clientId: tokenData.clientId,
                 clientSecret: tokenData.clientSecret,
                 accessToken: tokenData.accessToken,
-                authMethod
+                authMethod,
+                extraHeaders: configuredHeaders
               });
             } catch (error) {
               logMCPDebug(serverName, `Failed to revoke access token: ${errorMessage2(error)}`);
@@ -196078,8 +196949,9 @@ async function performMCPOAuthFlow(serverName, serverConfig, onAuthorizationUrl,
     const redirectUri = buildRedirectUri(port);
     logMCPDebug(serverName, `Using redirect port: ${port}${configuredCallbackPort ? " (from config)" : ""}`);
     const provider = new ClaudeAuthProvider(serverName, serverConfig, redirectUri, true, onAuthorizationUrl, options?.skipBrowserOpen);
+    const oauthFetch = await withConfiguredHeaders(createAuthFetch(), serverName, serverConfig);
     try {
-      const metadata = await fetchAuthServerMetadata(serverName, serverConfig.url, serverConfig.oauth?.authServerMetadataUrl, undefined, wwwAuthParams.resourceMetadataUrl);
+      const metadata = await fetchAuthServerMetadata(serverName, serverConfig.url, serverConfig.oauth?.authServerMetadataUrl, oauthFetch, wwwAuthParams.resourceMetadataUrl);
       if (metadata) {
         provider.setMetadata(metadata);
         logMCPDebug(serverName, `Fetched OAuth metadata with scope: ${getScopeFromMetadata(metadata) || "NONE"}`);
@@ -196215,7 +197087,8 @@ async function performMCPOAuthFlow(serverName, serverConfig, onAuthorizationUrl,
           const result = await auth(provider, {
             serverUrl: serverConfig.url,
             scope: wwwAuthParams.scope,
-            resourceMetadataUrl: wwwAuthParams.resourceMetadataUrl
+            resourceMetadataUrl: wwwAuthParams.resourceMetadataUrl,
+            fetchFn: oauthFetch
           });
           logMCPDebug(serverName, `Initial auth result: ${result}`);
           if (result !== "REDIRECT") {
@@ -196239,7 +197112,8 @@ async function performMCPOAuthFlow(serverName, serverConfig, onAuthorizationUrl,
     const result = await auth(provider, {
       serverUrl: serverConfig.url,
       authorizationCode,
-      resourceMetadataUrl: wwwAuthParams.resourceMetadataUrl
+      resourceMetadataUrl: wwwAuthParams.resourceMetadataUrl,
+      fetchFn: oauthFetch
     });
     logMCPDebug(serverName, `Auth result: ${result}`);
     if (result === "AUTHORIZED") {
@@ -196746,7 +197620,7 @@ class ClaudeAuthProvider {
     if (metadataUrl) {
       logMCPDebug(this.serverName, `Fetching metadata from configured URL: ${metadataUrl}`);
       try {
-        const metadata = await fetchAuthServerMetadata(this.serverName, this.serverConfig.url, metadataUrl);
+        const metadata = await fetchAuthServerMetadata(this.serverName, this.serverConfig.url, metadataUrl, await withConfiguredHeaders(createAuthFetch(), this.serverName, this.serverConfig));
         if (metadata) {
           return {
             authorizationServerUrl: metadata.issuer,
@@ -196831,7 +197705,7 @@ class ClaudeAuthProvider {
     for (let attempt = 1;attempt <= MAX_ATTEMPTS; attempt++) {
       try {
         logMCPDebug(this.serverName, `Starting token refresh`);
-        const authFetch = createAuthFetch();
+        const authFetch = await withConfiguredHeaders(createAuthFetch(), this.serverName, this.serverConfig);
         let metadata = this._metadata;
         if (!metadata) {
           const cached = await this.discoveryState();
@@ -197007,6 +197881,7 @@ var init_auth3 = __esm(() => {
   init_secureStorage();
   init_macOsKeychainHelpers();
   init_slowOperations();
+  init_headersHelper();
   init_oauthPort();
   init_utils6();
   init_xaa();
@@ -201002,10 +201877,10 @@ function parseProxyResponse(socket) {
     read();
   });
 }
-var import_debug52, debug;
+var import_debug54, debug;
 var init_parse_proxy_response = __esm(() => {
-  import_debug52 = __toESM(require_src(), 1);
-  debug = import_debug52.default("https-proxy-agent:parse-proxy-response");
+  import_debug54 = __toESM(require_src(), 1);
+  debug = import_debug54.default("https-proxy-agent:parse-proxy-response");
 });
 
 // node_modules/proxy-agent-negotiate/dist/index.js
@@ -201058,7 +201933,7 @@ function omit2(obj, ...keys) {
   }
   return ret;
 }
-var import_debug53, debug2, setServernameFromNonIpHost = (options) => {
+var import_debug55, debug2, setServernameFromNonIpHost = (options) => {
   if (options.servername === undefined && options.host && !net2.isIP(options.host)) {
     return {
       ...options,
@@ -201070,8 +201945,8 @@ var import_debug53, debug2, setServernameFromNonIpHost = (options) => {
 var init_dist7 = __esm(() => {
   init_dist6();
   init_parse_proxy_response();
-  import_debug53 = __toESM(require_src(), 1);
-  debug2 = import_debug53.default("https-proxy-agent");
+  import_debug55 = __toESM(require_src(), 1);
+  debug2 = import_debug55.default("https-proxy-agent");
   HttpsProxyAgent2 = class HttpsProxyAgent2 extends Agent2 {
     constructor(proxy, opts) {
       super(opts);
@@ -202132,73 +203007,6 @@ var init_classifyForCollapse = __esm(() => {
     "resources_list"
   ]);
 });
-
-// src/tui/services/mcp/headersHelper.ts
-function isMcpServerFromProjectOrLocalSettings(config) {
-  return config.scope === "project" || config.scope === "local";
-}
-async function getMcpHeadersFromHelper(serverName, config) {
-  if (!config.headersHelper) {
-    return null;
-  }
-  if ("scope" in config && isMcpServerFromProjectOrLocalSettings(config)) {
-    const isNonInteractive = getIsNonInteractiveSession();
-    const explicitTrust = process.env.ATLAS_TRUST_WORKSPACE === "true";
-    const hasTrust = checkHasTrustDialogAccepted() || isNonInteractive && explicitTrust;
-    if (!hasTrust) {
-      const error = new Error(`Security: headersHelper for MCP server '${serverName}' executed before workspace trust is confirmed. If you see this message, post in ${MACRO.FEEDBACK_CHANNEL}.`);
-      logAntError("MCP headersHelper invoked before trust check", error);
-      return null;
-    }
-  }
-  try {
-    logMCPDebug(serverName, "Executing headersHelper to get dynamic headers");
-    const execResult = await execFileNoThrowWithCwd2("sh", ["-c", config.headersHelper], {
-      timeout: 1e4,
-      env: {
-        ...process.env,
-        ATLAS_MCP_SERVER_NAME: serverName,
-        ATLAS_MCP_SERVER_URL: config.url
-      }
-    });
-    if (execResult.code !== 0 || !execResult.stdout) {
-      throw new Error(`headersHelper for MCP server '${serverName}' did not return a valid value`);
-    }
-    const result = execResult.stdout.trim();
-    const headers = jsonParse2(result);
-    if (typeof headers !== "object" || headers === null || Array.isArray(headers)) {
-      throw new Error(`headersHelper for MCP server '${serverName}' must return a JSON object with string key-value pairs`);
-    }
-    for (const [key, value] of Object.entries(headers)) {
-      if (typeof value !== "string") {
-        throw new Error(`headersHelper for MCP server '${serverName}' returned non-string value for key "${key}": ${typeof value}`);
-      }
-    }
-    logMCPDebug(serverName, `Successfully retrieved ${Object.keys(headers).length} headers from headersHelper`);
-    return headers;
-  } catch (error) {
-    logMCPError(serverName, `Error getting headers from headersHelper: ${errorMessage2(error)}`);
-    logError3(new Error(`Error getting MCP headers from headersHelper for server '${serverName}': ${errorMessage2(error)}`));
-    return null;
-  }
-}
-async function getMcpServerHeaders(serverName, config) {
-  const staticHeaders = config.headers || {};
-  const dynamicHeaders = await getMcpHeadersFromHelper(serverName, config) || {};
-  return {
-    ...staticHeaders,
-    ...dynamicHeaders
-  };
-}
-var init_headersHelper = __esm(() => {
-  init_bootstrap();
-  init_config6();
-  init_debug();
-  init_errors4();
-  init_execFileNoThrow2();
-  init_log5();
-  init_slowOperations();
-});
 // src/tui/skills/mcpSkills.ts
 var exports_mcpSkills = {};
 __export(exports_mcpSkills, {
@@ -209645,6 +210453,11 @@ function isMcpSessionExpiredError(error) {
   }
   return error.message.includes('"code":-32001') || error.message.includes('"code": -32001');
 }
+function truncateMcpDescriptionText(text) {
+  if (!text)
+    return text;
+  return text.length > MAX_MCP_DESCRIPTION_LENGTH ? text.slice(0, MAX_MCP_DESCRIPTION_LENGTH) + "… [truncated]" : text;
+}
 function getMcpToolTimeoutMs() {
   return parseInt(process.env.MCP_TOOL_TIMEOUT || "", 10) || DEFAULT_MCP_TOOL_TIMEOUT_MS;
 }
@@ -209693,46 +210506,6 @@ async function createNodeWsClient(url, options) {
   const WS = wrapper_default;
   return new WS(url, ["mcp"], options);
 }
-function getConnectionTimeoutMs2() {
-  return parseInt(process.env.MCP_TIMEOUT || "", 10) || 30000;
-}
-function wrapFetchWithTimeout(baseFetch) {
-  return async (url, init) => {
-    const method = (init?.method ?? "GET").toUpperCase();
-    if (method === "GET") {
-      return baseFetch(url, init);
-    }
-    const headers = new Headers(init?.headers);
-    if (!headers.has("accept")) {
-      headers.set("accept", MCP_STREAMABLE_HTTP_ACCEPT);
-    }
-    const controller = new AbortController;
-    const timer = setTimeout((c) => c.abort(new DOMException("The operation timed out.", "TimeoutError")), MCP_REQUEST_TIMEOUT_MS, controller);
-    timer.unref?.();
-    const parentSignal = init?.signal;
-    const abort = () => controller.abort(parentSignal?.reason);
-    parentSignal?.addEventListener("abort", abort);
-    if (parentSignal?.aborted) {
-      controller.abort(parentSignal.reason);
-    }
-    const cleanup = () => {
-      clearTimeout(timer);
-      parentSignal?.removeEventListener("abort", abort);
-    };
-    try {
-      const response = await baseFetch(url, {
-        ...init,
-        headers,
-        signal: controller.signal
-      });
-      cleanup();
-      return response;
-    } catch (error) {
-      cleanup();
-      throw error;
-    }
-  };
-}
 function getMcpServerConnectionBatchSize() {
   return parseInt(process.env.MCP_SERVER_CONNECTION_BATCH_SIZE || "", 10) || 3;
 }
@@ -210382,7 +211155,7 @@ function extractToolUseId(message) {
   }
   return message.message.content[0].id;
 }
-var fetchMcpSkillsForClient2, McpAuthError, McpSessionExpiredError, McpToolCallError_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS, DEFAULT_MCP_TOOL_TIMEOUT_MS = 1e8, MAX_MCP_DESCRIPTION_LENGTH = 2048, computerUseWrapper, isComputerUseMCPServer2, MCP_AUTH_CACHE_TTL_MS, authCachePromise = null, writeChain, IMAGE_MIME_TYPES, MCP_REQUEST_TIMEOUT_MS = 60000, MCP_STREAMABLE_HTTP_ACCEPT = "application/json, text/event-stream", ALLOWED_IDE_TOOLS, connectToServer, MCP_FETCH_CACHE_SIZE2 = 20, fetchToolsForClient2, fetchResourcesForClient2, fetchCommandsForClient2;
+var fetchMcpSkillsForClient2, McpAuthError, McpSessionExpiredError, McpToolCallError_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS, DEFAULT_MCP_TOOL_TIMEOUT_MS = 1e8, MAX_MCP_DESCRIPTION_LENGTH = 4096, computerUseWrapper, isComputerUseMCPServer2, MCP_AUTH_CACHE_TTL_MS, authCachePromise = null, writeChain, IMAGE_MIME_TYPES, ALLOWED_IDE_TOOLS, connectToServer, MCP_FETCH_CACHE_SIZE2 = 20, fetchToolsForClient2, fetchResourcesForClient2, fetchCommandsForClient2;
 var init_client4 = __esm(() => {
   init_shared();
   init_client3();
@@ -210674,7 +211447,7 @@ var init_client4 = __esm(() => {
           ]
         };
       });
-      logMCPDebug(name, `Starting connection with timeout of ${getConnectionTimeoutMs2()}ms`);
+      logMCPDebug(name, `Starting connection with timeout of ${getMcpConnectionTimeoutMs()}ms`);
       if (serverRef.type === "http") {
         logMCPDebug(name, `Testing basic HTTP connectivity to ${serverRef.url}`);
         try {
@@ -210691,13 +211464,13 @@ var init_client4 = __esm(() => {
       const timeoutPromise = new Promise((_, reject) => {
         const timeoutId = setTimeout(() => {
           const elapsed = Date.now() - connectStartTime;
-          logMCPDebug(name, `Connection timeout triggered after ${elapsed}ms (limit: ${getConnectionTimeoutMs2()}ms)`);
+          logMCPDebug(name, `Connection timeout triggered after ${elapsed}ms (limit: ${getMcpConnectionTimeoutMs()}ms)`);
           if (inProcessServer) {
             inProcessServer.close().catch(() => {});
           }
           transport.close().catch(() => {});
-          reject(new TelemetrySafeError_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS(`MCP server "${name}" connection timed out after ${getConnectionTimeoutMs2()}ms`, "MCP connection timeout"));
-        }, getConnectionTimeoutMs2());
+          reject(new TelemetrySafeError_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS(`MCP server "${name}" connection timed out after ${getMcpConnectionTimeoutMs()}ms`, "MCP connection timeout"));
+        }, getMcpConnectionTimeoutMs());
         connectPromise.then(() => {
           clearTimeout(timeoutId);
         }, (_error) => {
@@ -210745,9 +211518,8 @@ var init_client4 = __esm(() => {
       const capabilities = client.getServerCapabilities();
       const serverVersion = client.getServerVersion();
       const rawInstructions = client.getInstructions();
-      let instructions = rawInstructions;
-      if (rawInstructions && rawInstructions.length > MAX_MCP_DESCRIPTION_LENGTH) {
-        instructions = rawInstructions.slice(0, MAX_MCP_DESCRIPTION_LENGTH) + "… [truncated]";
+      const instructions = truncateMcpDescriptionText(rawInstructions);
+      if (instructions !== rawInstructions) {
         logMCPDebug(name, `Server instructions truncated from ${rawInstructions.length} to ${MAX_MCP_DESCRIPTION_LENGTH} chars`);
       }
       logMCPDebug(name, `Connection established with capabilities: ${jsonStringify5({
@@ -211035,8 +211807,7 @@ var init_client4 = __esm(() => {
             return tool.description ?? "";
           },
           async prompt() {
-            const desc = tool.description ?? "";
-            return desc.length > MAX_MCP_DESCRIPTION_LENGTH ? desc.slice(0, MAX_MCP_DESCRIPTION_LENGTH) + "… [truncated]" : desc;
+            return truncateMcpDescriptionText(tool.description ?? "");
           },
           isConcurrencySafe() {
             return tool.annotations?.readOnlyHint ?? false;
@@ -262650,6 +263421,9 @@ function convertToHookMatchers(sessionMatchers) {
   return sessionMatchers.map((sm) => ({
     matcher: sm.matcher,
     skillRoot: sm.skillRoot,
+    pluginRoot: sm.pluginRoot,
+    pluginName: sm.pluginName,
+    pluginId: sm.pluginId,
     hooks: sm.hooks.map((h) => h.hook).filter((h) => h.type !== "function")
   }));
 }
@@ -273429,6 +274203,19 @@ async function toArray2(generator) {
   }
   return result;
 }
+async function runWithConcurrencyLimit(tasks, limit) {
+  const results = new Array(tasks.length);
+  let next = 0;
+  const worker = async () => {
+    while (next < tasks.length) {
+      const index = next++;
+      results[index] = await tasks[index]();
+    }
+  };
+  const workers = Math.max(1, Math.min(limit, tasks.length));
+  await Promise.all(Array.from({ length: workers }, worker));
+  return results;
+}
 var NO_VALUE;
 var init_generators = __esm(() => {
   NO_VALUE = Symbol("NO_VALUE");
@@ -276339,6 +277126,15 @@ function filterToolsForAgent2({
 function computeChildSpawnDepth2(parentOptions) {
   return (parentOptions?.spawnDepth ?? 0) + 1;
 }
+function resolveMcpServerDomainTools2(toolName, available) {
+  if (typeof toolName !== "string")
+    return null;
+  const info = mcpInfoFromString3(toolName);
+  if (!info || info.toolName !== undefined)
+    return null;
+  const prefix = getMcpPrefix3(info.serverName);
+  return available.filter((t) => t.name.startsWith(prefix));
+}
 function resolveAgentTools2(agentDefinition, availableTools, isAsync = false, isMainThread = false, allowFanOut = false) {
   const {
     tools: agentTools,
@@ -276395,7 +277191,18 @@ function resolveAgentTools2(agentDefinition, availableTools, isAsync = false, is
         resolvedToolsSet.add(tool);
       }
     } else {
-      invalidTools.push(toolSpec);
+      const domain = resolveMcpServerDomainTools2(toolName, allowedAvailableTools);
+      if (domain && domain.length > 0) {
+        validTools.push(toolSpec);
+        for (const t of domain) {
+          if (!resolvedToolsSet.has(t)) {
+            resolved.push(t);
+            resolvedToolsSet.add(t);
+          }
+        }
+      } else {
+        invalidTools.push(toolSpec);
+      }
     }
   }
   return {
@@ -276652,6 +277459,7 @@ var init_agentToolUtils2 = __esm(() => {
   init_errors4();
   init_messages3();
   init_permissionRuleParser2();
+  init_mcpStringUtils();
   init_yoloClassifier();
   init_sdkProgress();
   init_teammateContext3();
@@ -303311,11 +304119,11 @@ function byteAt2(L, charIdx) {
   L.byteTable = t;
   return t[charIdx];
 }
-function isWordChar2(c) {
+function isWordChar4(c) {
   return c >= "a" && c <= "z" || c >= "A" && c <= "Z" || c >= "0" && c <= "9" || c === "_" || c === "/" || c === "." || c === "-" || c === "+" || c === ":" || c === "@" || c === "%" || c === "," || c === "~" || c === "^" || c === "?" || c === "*" || c === "!" || c === "=" || c === "[" || c === "]";
 }
 function isWordStart2(c) {
-  return isWordChar2(c) || c === "\\";
+  return isWordChar4(c) || c === "\\";
 }
 function isIdentStart2(c) {
   return c >= "a" && c <= "z" || c >= "A" && c <= "Z" || c === "_";
@@ -303625,7 +304433,7 @@ function nextToken2(L, ctx = "arg") {
         advance2(L);
         continue;
       }
-      if (!isWordChar2(ch) && ch !== "{" && ch !== "}") {
+      if (!isWordChar4(ch) && ch !== "{" && ch !== "}") {
         break;
       }
       advance2(L);
@@ -321769,7 +322577,8 @@ function buildAgentLoopParams(m) {
       }
     },
     systemPrompt: asSystemPrompt(appendSystemContext(m.systemPrompt, systemContext)),
-    effortValue: m.effort !== undefined ? String(m.effort) : undefined
+    effortValue: m.effort !== undefined ? String(m.effort) : undefined,
+    refreshRoundContext: m.refreshRoundContext
   };
   const unboundedTurns = m.unboundedTurns ?? m.maxTurns === undefined;
   const args = {
@@ -322338,7 +323147,8 @@ function getDefaultAppState() {
       tools: [],
       commands: [],
       resources: {},
-      pluginReconnectKey: 0
+      pluginReconnectKey: 0,
+      cwdReconnectKey: 0
     },
     plugins: {
       enabled: [],
@@ -325228,7 +326038,7 @@ function parseSkillFrontmatterFields2(frontmatter, markdownContent, resolvedName
     logForDebugging3(`Skill ${resolvedName} has invalid effort '${effortRaw}'. Valid options: ${EFFORT_LEVELS2.join(", ")} or an integer`);
   }
   return {
-    displayName: frontmatter.name != null ? String(frontmatter.name) : undefined,
+    displayName: sanitizeDisplayName2(frontmatter.name != null ? String(frontmatter.name) : undefined, resolvedName),
     description,
     hasUserSpecifiedDescription: validatedDescription !== null,
     allowedTools: parseSlashCommandToolsFromFrontmatter2(frontmatter["allowed-tools"]),
@@ -325344,6 +326154,10 @@ async function loadSkillsFromSkillsDir2(basePath, source) {
       if (!entry.isDirectory() && !entry.isSymbolicLink()) {
         return null;
       }
+      if (isUnsafeCommandName2(entry.name)) {
+        logForDebugging3(`[skills] skipping unsafe skill directory name: ${JSON.stringify(entry.name)}`);
+        return null;
+      }
       const skillDirPath = join108(basePath, entry.name);
       const skillFilePath = join108(skillDirPath, "SKILL.md");
       let content;
@@ -325454,6 +326268,10 @@ async function loadSkillsFromCommandsDir2(cwd) {
           content,
           source
         });
+        if (isUnsafeCommandName2(cmdName)) {
+          logForDebugging3(`[skills] skipping unsafe command name: ${JSON.stringify(cmdName)}`);
+          continue;
+        }
         const parsed = parseSkillFrontmatterFields2(frontmatter, content, cmdName, "Custom command");
         skills.push({
           skill: createSkillCommand2({
@@ -325592,6 +326410,7 @@ var init_loadSkillsDir2 = __esm(() => {
   init_bootstrapState();
   init_tokenEstimation();
   init_argumentSubstitution2();
+  init_commandNameSafety2();
   init_debug();
   init_effort2();
   init_envUtils2();
@@ -330013,7 +330832,7 @@ function createPluginCommand(commandName, file, sourceName, pluginManifest, plug
     const argumentNames = parseArgumentNames2(frontmatter.arguments);
     const whenToUse = frontmatter["when-to-use"] ?? frontmatter.when_to_use;
     const version = frontmatter.version;
-    const displayName = frontmatter.name;
+    const displayName = sanitizeDisplayName2(frontmatter.name, commandName);
     const model = frontmatter.model === "inherit" ? undefined : frontmatter.model ? parseUserSpecifiedModel2(frontmatter.model) : undefined;
     const effortRaw = frontmatter["effort"];
     const effort = effortRaw !== undefined ? parseEffortValue2(effortRaw) : undefined;
@@ -330198,6 +331017,7 @@ var init_loadPluginCommands = __esm(() => {
   init_bootstrapState();
   init_argumentSubstitution2();
   init_debug();
+  init_commandNameSafety2();
   init_effort2();
   init_envUtils2();
   init_errors4();
@@ -330349,8 +331169,15 @@ var init_loadPluginCommands = __esm(() => {
       return pluginCommands;
     }));
     const allCommands = perPluginCommands.flat();
-    logForDebugging3(`Total plugin commands loaded: ${allCommands.length}`);
-    return allCommands;
+    const safeCommands = allCommands.filter((cmd) => {
+      if (isUnsafeCommandName2(cmd.name)) {
+        logForDebugging3(`Skipping unsafe plugin command name: ${JSON.stringify(cmd.name)}`);
+        return false;
+      }
+      return true;
+    });
+    logForDebugging3(`Total plugin commands loaded: ${safeCommands.length}`);
+    return safeCommands;
   });
   getPluginSkills = memoize_default(async () => {
     if (isBareMode() && getInlinePlugins().length === 0) {
@@ -330395,8 +331222,15 @@ var init_loadPluginCommands = __esm(() => {
       return pluginSkills;
     }));
     const allSkills = perPluginSkills.flat();
-    logForDebugging3(`Total plugin skills loaded: ${allSkills.length}`);
-    return allSkills;
+    const safeSkills = allSkills.filter((cmd) => {
+      if (isUnsafeCommandName2(cmd.name)) {
+        logForDebugging3(`Skipping unsafe plugin skill name: ${JSON.stringify(cmd.name)}`);
+        return false;
+      }
+      return true;
+    });
+    logForDebugging3(`Total plugin skills loaded: ${safeSkills.length}`);
+    return safeSkills;
   });
 });
 
@@ -335419,6 +336253,12 @@ function mergePluginSources(sources) {
   const marketplacePlugins = sources.marketplace.filter((p) => {
     if (sessionNames.has(p.name)) {
       logForDebugging3(`Plugin "${p.name}" from --plugin-dir overrides installed version`);
+      errors.push({
+        type: "generic-error",
+        source: p.source,
+        plugin: p.name,
+        error: `Installed plugin "${p.name}" excluded (hooks and commands inactive) — overridden by --plugin-dir copy of the same name`
+      });
       return false;
     }
     return true;
@@ -337425,8 +338265,9 @@ function handleMessageFromStream(message, onMessage, onUpdateLength, onSetStream
   }
 }
 function wrapInSystemReminder(content) {
+  const neutralized = content.replaceAll("</system-reminder>", "&lt;/system-reminder&gt;").replaceAll("<system-reminder>", "&lt;system-reminder&gt;");
   return `<system-reminder>
-${content}
+${neutralized}
 </system-reminder>`;
 }
 function wrapMessagesInSystemReminder(messages) {
@@ -340035,6 +340876,16 @@ async function hasPermissionsToUseToolInner(tool, input, context) {
     throw new AbortError2;
   }
   let appState = context.getAppState();
+  if (appState.toolPermissionContext.mode === "plan" && !appState.toolPermissionContext.isBypassPermissionsModeAvailable && !PLAN_MODE_WRITE_EXEMPT_TOOL_NAMES2.has(tool.name) && !(tool.isReadOnly?.(input) ?? false)) {
+    return {
+      behavior: "deny",
+      message: PLAN_MODE_WRITE_DENIED_MESSAGE2(tool.name),
+      decisionReason: {
+        type: "mode",
+        mode: "plan"
+      }
+    };
+  }
   const denyRule = getDenyRuleForTool2(appState.toolPermissionContext, tool);
   if (denyRule) {
     return {
@@ -340215,7 +341066,7 @@ function syncPermissionRulesFromDisk2(toolPermissionContext, rules) {
 function getUpdatedInputOrFallback2(permissionResult, fallback) {
   return ("updatedInput" in permissionResult ? permissionResult.updatedInput : undefined) ?? fallback;
 }
-var classifierDecisionModule, autoModeStateModule3, CLASSIFIER_FAIL_CLOSED_REFRESH_MS, PERMISSION_RULE_SOURCES2, hasPermissionsToUseTool2 = async (tool, input, context, assistantMessage, toolUseID) => {
+var PLAN_MODE_WRITE_EXEMPT_TOOL_NAMES2, PLAN_MODE_WRITE_DENIED_MESSAGE2 = (toolName) => `Plan mode is active — ${toolName} is not allowed to make changes. ` + `Present your plan and use ExitPlanMode, or ask the user to change the permission mode.`, classifierDecisionModule, autoModeStateModule3, CLASSIFIER_FAIL_CLOSED_REFRESH_MS, PERMISSION_RULE_SOURCES2, hasPermissionsToUseTool2 = async (tool, input, context, assistantMessage, toolUseID) => {
   const result = await hasPermissionsToUseToolInner(tool, input, context);
   if (result.behavior === "allow") {
     const appState = context.getAppState();
@@ -340448,6 +341299,10 @@ var init_permissions6 = __esm(() => {
   init_slowOperations();
   init_denialTracking();
   init_yoloClassifier();
+  PLAN_MODE_WRITE_EXEMPT_TOOL_NAMES2 = new Set([
+    "EnterPlanMode",
+    "ExitPlanMode"
+  ]);
   classifierDecisionModule = feature("TRANSCRIPT_CLASSIFIER") ? (init_classifierDecision(), __toCommonJS(exports_classifierDecision)) : null;
   autoModeStateModule3 = feature("TRANSCRIPT_CLASSIFIER") ? __toCommonJS(exports_autoModeState) : null;
   CLASSIFIER_FAIL_CLOSED_REFRESH_MS = 30 * 60 * 1000;
@@ -348079,7 +348934,8 @@ async function clearConversation({
           tools: [],
           commands: [],
           resources: {},
-          pluginReconnectKey: prev.mcp.pluginReconnectKey
+          pluginReconnectKey: prev.mcp.pluginReconnectKey,
+          cwdReconnectKey: prev.mcp.cwdReconnectKey
         }
       };
     });
@@ -369468,7 +370324,9 @@ function useManageMCPConnections(dynamicMcpConfig, isStrictMcpConfig = false) {
   const store = useAppStateStore();
   const _authVersion = useAppState((s) => s.authVersion);
   const _pluginReconnectKey = useAppState((s) => s.mcp.pluginReconnectKey);
+  const _cwdReconnectKey = useAppState((s) => s.mcp.cwdReconnectKey);
   const setAppState = useSetAppState();
+  const lastCwdRef = import_react110.useRef(null);
   const reconnectTimersRef = import_react110.useRef(new Map);
   const mcpFailureTrackerRef = import_react110.useRef(null);
   const notifyMcpConnectionFailure = import_react110.useCallback((serverName, error) => {
@@ -369695,9 +370553,12 @@ function useManageMCPConnections(dynamicMcpConfig, isStrictMcpConfig = false) {
     async function initializeServersAsPending() {
       const { servers: existingConfigs, errors: mcpErrors } = isStrictMcpConfig ? { servers: {}, errors: [] } : await getMcpConfigs(dynamicMcpConfig);
       const configs = { ...existingConfigs, ...dynamicMcpConfig };
+      const currentCwd = getCwd();
+      const cwdChanged = lastCwdRef.current !== null && lastCwdRef.current !== currentCwd;
+      lastCwdRef.current = currentCwd;
       addErrorsToAppState(setAppState, mcpErrors);
       setAppState((prevState) => {
-        const { stale, ...mcpWithoutStale } = excludeStalePluginClients(prevState.mcp, configs);
+        const { stale, ...mcpWithoutStale } = excludeStalePluginClients(prevState.mcp, configs, { absentIsStale: cwdChanged });
         for (const s of stale) {
           const timer = reconnectTimersRef.current.get(s.name);
           if (timer) {
@@ -369736,7 +370597,8 @@ function useManageMCPConnections(dynamicMcpConfig, isStrictMcpConfig = false) {
     dynamicMcpConfig,
     setAppState,
     sessionId,
-    _pluginReconnectKey
+    _pluginReconnectKey,
+    _cwdReconnectKey
   ]);
   import_react110.useEffect(() => {
     let cancelled = false;
@@ -369753,7 +370615,7 @@ function useManageMCPConnections(dynamicMcpConfig, isStrictMcpConfig = false) {
       });
       let claudeaiConfigs = {};
       if (!isStrictMcpConfig) {
-        claudeaiConfigs = filterMcpServersByPolicy(await claudeaiPromise).allowed;
+        claudeaiConfigs = filterMcpServersByPolicy2(await claudeaiPromise).allowed;
         if (cancelled)
           return;
         if (Object.keys(claudeaiConfigs).length > 0) {
@@ -369819,7 +370681,8 @@ function useManageMCPConnections(dynamicMcpConfig, isStrictMcpConfig = false) {
     setAppState,
     _authVersion,
     sessionId,
-    _pluginReconnectKey
+    _pluginReconnectKey,
+    _cwdReconnectKey
   ]);
   import_react110.useEffect(() => {
     const timers = reconnectTimersRef.current;
@@ -404670,6 +405533,8 @@ async function searchSkillsAcrossMarketplaces(query) {
         for (const d of dirEntries) {
           if (!d.isDirectory())
             continue;
+          if (isUnsafeCommandName2(d.name))
+            continue;
           const skillFile = join146(skillDir, d.name, "SKILL.md");
           if (seen.has(skillFile))
             continue;
@@ -404681,7 +405546,7 @@ async function searchSkillsAcrossMarketplaces(query) {
             continue;
           }
           const { frontmatter, content: markdown } = parseFrontmatter2(content);
-          const resolvedName = typeof frontmatter.name === "string" ? frontmatter.name : d.name;
+          const resolvedName = d.name;
           const parsed = parseSkillFrontmatterFields2(frontmatter, markdown, resolvedName);
           const installId = createPluginId(entry.name, marketplaceName);
           const skill = {
@@ -404706,6 +405571,7 @@ async function searchSkillsAcrossMarketplaces(query) {
   return results;
 }
 var init_skillSearch = __esm(() => {
+  init_commandNameSafety2();
   init_frontmatterParser2();
   init_loadSkillsDir2();
   init_marketplaceHelpers();
@@ -412070,7 +412936,7 @@ var call45 = async (_args, _context) => {
   reloadSkillsNow();
   return {
     type: "text",
-    value: "Re-scanned skill directories; in-session skill registry refreshed (new/removed/changed skills now active without restart)."
+    value: "Re-scanned skill directories; in-session skill registry refreshed (new/removed/changed skills now active without restart). The complete skill list will be re-sent to the model with your next message."
   };
 };
 var init_reload_skills = __esm(() => {
@@ -412095,7 +412961,7 @@ var exports_cd = {};
 __export(exports_cd, {
   call: () => call46
 });
-var USAGE2 = "Usage: /cd [path] (no argument = show current session cwd)", call46 = async (_args, _context) => {
+var USAGE2 = "Usage: /cd [path] (no argument = show current session cwd)", call46 = async (_args, context) => {
   const arg = (_args ?? "").trim();
   if (arg === "") {
     return {
@@ -412106,6 +412972,10 @@ ${USAGE2}`
   }
   try {
     setCwd2(arg, pwd());
+    context.setAppState((prev) => ({
+      ...prev,
+      mcp: { ...prev.mcp, cwdReconnectKey: prev.mcp.cwdReconnectKey + 1 }
+    }));
     return {
       type: "text",
       value: `Session working directory changed to: ${pwd()}`
@@ -428100,9 +428970,144 @@ var init_combinedAbortSignal = __esm(() => {
   init_abortController2();
 });
 
+// src/tui/utils/hooks/hookInputDepth.ts
+function exceedsMaxNestingDepth(value) {
+  const stack = [[value, 0]];
+  const visited = new WeakSet;
+  while (stack.length > 0) {
+    const [v, depth] = stack.pop();
+    if (depth > MAX_HOOK_INPUT_NESTING_DEPTH)
+      return true;
+    if (v === null || typeof v !== "object")
+      continue;
+    if (visited.has(v))
+      continue;
+    visited.add(v);
+    let children;
+    try {
+      children = Array.isArray(v) ? v : Object.values(v);
+    } catch {
+      continue;
+    }
+    for (const child of children) {
+      stack.push([child, depth + 1]);
+    }
+  }
+  return false;
+}
+var MAX_HOOK_INPUT_NESTING_DEPTH = 28000;
+
+// src/tui/utils/hooks/hookInputMaterialize.ts
+function materializeHookInput(value) {
+  if (value === null || typeof value !== "object") {
+    return { ok: true, value, droppedKeys: [] };
+  }
+  const droppedKeys = [];
+  const visited = new WeakMap;
+  const root = Array.isArray(value) ? [] : {};
+  visited.set(value, root);
+  const stack = [{ src: value, target: root }];
+  while (stack.length > 0) {
+    const { src, target } = stack.pop();
+    let keys;
+    try {
+      keys = Object.keys(src);
+    } catch {
+      droppedKeys.push("<enumeration-failed>");
+      continue;
+    }
+    for (const key of keys) {
+      let child;
+      try {
+        child = src[key];
+      } catch {
+        droppedKeys.push(key);
+        continue;
+      }
+      if (child === null || typeof child !== "object") {
+        target[key] = child;
+      } else if (visited.has(child)) {
+        target[key] = "[Circular]";
+      } else {
+        const childClone = Array.isArray(child) ? [] : {};
+        visited.set(child, childClone);
+        target[key] = childClone;
+        stack.push({ src: child, target: childClone });
+      }
+    }
+  }
+  return { ok: true, value: root, droppedKeys };
+}
+function stringifyWithGetterFallback(value) {
+  try {
+    return { ok: true, value: jsonStringify5(value), droppedKeys: [] };
+  } catch (error) {
+    const materialized = materializeHookInput(value);
+    if (materialized.ok === false)
+      return { ok: false, error };
+    try {
+      return {
+        ok: true,
+        value: jsonStringify5(materialized.value),
+        droppedKeys: materialized.droppedKeys
+      };
+    } catch {
+      return { ok: false, error };
+    }
+  }
+}
+var init_hookInputMaterialize = __esm(() => {
+  init_slowOperations();
+});
+
+// src/tui/utils/hooks/hookReentrancy.ts
+import { AsyncLocalStorage as AsyncLocalStorage8 } from "async_hooks";
+function getCallbackId(fn) {
+  let id = callbackIds.get(fn);
+  if (id === undefined) {
+    id = nextCallbackId++;
+    callbackIds.set(fn, id);
+  }
+  return id;
+}
+function getHookReentrancyKey(hookEvent, hook, pluginRoot) {
+  const h = hook;
+  const body = typeof h.callback === "function" ? `fn:${getCallbackId(h.callback)}` : String(h.command ?? h.prompt ?? h.url ?? "");
+  return `${hookEvent}:${String(h.type)}:${pluginRoot ?? ""}:${body}`;
+}
+function isReentrantHook(hookEvent, hook, pluginRoot) {
+  const inFlight = hookReentrancyStorage.getStore();
+  if (inFlight === undefined)
+    return false;
+  return inFlight.has(getHookReentrancyKey(hookEvent, hook, pluginRoot));
+}
+function runWithHookReentrancy(hookEvent, hook, pluginRoot, fn) {
+  const store = new Set(hookReentrancyStorage.getStore() ?? []);
+  store.add(getHookReentrancyKey(hookEvent, hook, pluginRoot));
+  return hookReentrancyStorage.run(store, fn);
+}
+var hookReentrancyStorage, callbackIds, nextCallbackId = 1;
+var init_hookReentrancy = __esm(() => {
+  hookReentrancyStorage = new AsyncLocalStorage8;
+  callbackIds = new WeakMap;
+});
+
+// src/tui/utils/hooks/hookFailClosed.ts
+function shouldFailClosePluginHook(hookEvent, pluginRoot) {
+  return pluginRoot !== undefined && GATE_EVENTS.has(hookEvent);
+}
+var GATE_EVENTS;
+var init_hookFailClosed = __esm(() => {
+  GATE_EVENTS = new Set([
+    "PreToolUse",
+    "UserPromptSubmit",
+    "PermissionRequest"
+  ]);
+});
+
 // src/tui/utils/hooks/hookHelpers.ts
 function addArgumentsToPrompt(prompt, jsonInput) {
-  return substituteArguments2(prompt, jsonInput);
+  return substituteArgumentsStrict2(prompt, jsonInput);
 }
 function createStructuredOutputTool() {
   return {
@@ -428150,6 +429155,19 @@ async function execPromptHook(hook, hookName, hookEvent, jsonInput, signal, tool
   const effectiveToolUseID = toolUseID || `hook-${randomUUID41()}`;
   try {
     const processedPrompt = addArgumentsToPrompt(hook.prompt, jsonInput);
+    if (processedPrompt === null) {
+      logForDebugging3(`Hooks: hook input exceeds substitution budget — blocking (fail-closed)`);
+      return {
+        hook,
+        outcome: "blocking",
+        blockingError: {
+          blockingError: "Hook input exceeds substitution budget; refusing to evaluate on truncated input",
+          command: hook.prompt
+        },
+        preventContinuation: true,
+        stopReason: "hook input exceeds substitution budget"
+      };
+    }
     logForDebugging3(`Hooks: Processing prompt hook with prompt: ${processedPrompt}`);
     const userMessage = createUserMessage2({ content: processedPrompt });
     const messagesToQuery = messages && messages.length > 0 ? [...messages, userMessage] : [userMessage];
@@ -428296,6 +429314,17 @@ async function execAgentHook(hook, hookName, hookEvent, jsonInput, signal, toolU
   const hookStartTime = Date.now();
   try {
     const processedPrompt = addArgumentsToPrompt(hook.prompt, jsonInput);
+    if (processedPrompt === null) {
+      logForDebugging3(`Hooks: hook input exceeds substitution budget — blocking (fail-closed)`);
+      return {
+        hook,
+        outcome: "blocking",
+        blockingError: {
+          blockingError: "Hook input exceeds substitution budget; refusing to verify on truncated input",
+          command: hook.prompt
+        }
+      };
+    }
     logForDebugging3(`Hooks: Processing agent hook with prompt: ${processedPrompt}`);
     const userMessage = createUserMessage2({ content: processedPrompt });
     const agentMessages = [userMessage];
@@ -428686,7 +429715,7 @@ function getHttpHookPolicy() {
     allowedEnvVars: settings.httpHookAllowedEnvVars
   };
 }
-function urlMatchesPattern2(url, pattern) {
+function urlMatchesPattern3(url, pattern) {
   const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
   const regexStr = escaped.replace(/\*/g, ".*");
   return new RegExp(`^${regexStr}$`).test(url);
@@ -428708,7 +429737,7 @@ function interpolateEnvVars(value, allowedEnvVars) {
 async function execHttpHook(hook, _hookEvent, jsonInput, signal) {
   const policy = getHttpHookPolicy();
   if (policy.allowedUrls !== undefined) {
-    const matched = policy.allowedUrls.some((p) => urlMatchesPattern2(hook.url, p));
+    const matched = policy.allowedUrls.some((p) => urlMatchesPattern3(hook.url, p));
     if (!matched) {
       const msg = `HTTP hook blocked: ${hook.url} does not match any pattern in allowedHttpHookUrls`;
       logForDebugging3(msg, { level: "warn" });
@@ -428784,7 +429813,7 @@ import { randomUUID as randomUUID43 } from "crypto";
 function getSessionEndHookTimeoutMs() {
   const raw = process.env.ATLAS_SESSIONEND_HOOKS_TIMEOUT_MS;
   const parsed = raw ? parseInt(raw, 10) : NaN;
-  return Number.isFinite(parsed) && parsed > 0 ? parsed : SESSION_END_HOOK_TIMEOUT_MS_DEFAULT;
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : SESSION_END_HOOK_TIMEOUT_MS_DEFAULT2;
 }
 function executeInBackground({
   processId,
@@ -429820,18 +430849,33 @@ async function* executeHooks({
     if (jsonInputResult !== undefined) {
       return jsonInputResult;
     }
-    try {
-      return jsonInputResult = { ok: true, value: jsonStringify5(hookInput) };
-    } catch (error) {
+    if (exceedsMaxNestingDepth(hookInput)) {
+      const error = Error(`Hook input nesting depth exceeds MAX_HOOK_INPUT_NESTING_DEPTH (${MAX_HOOK_INPUT_NESTING_DEPTH}); refusing to serialize`);
       logError3(Error(`Failed to stringify hook ${hookName} input`, { cause: error }));
       return jsonInputResult = { ok: false, error };
     }
+    const serialized = stringifyWithGetterFallback(hookInput);
+    if (serialized.ok !== true) {
+      logError3(Error(`Failed to stringify hook ${hookName} input`, {
+        cause: serialized.error
+      }));
+      return jsonInputResult = { ok: false, error: serialized.error };
+    }
+    if (serialized.droppedKeys.length > 0) {
+      logForDebugging3(`Hooks: ${hookName}: dropped input keys with throwing getters: ${serialized.droppedKeys.join(", ")}`);
+    }
+    return jsonInputResult = { ok: true, value: serialized.value };
   }
   const hookPromises = matchingHooks.map(async function* ({ hook, pluginRoot, pluginId, skillRoot }, hookIndex) {
+    if (isReentrantHook(hookEvent, hook, pluginRoot)) {
+      logForDebugging3(`Hooks: ${hookName}: skipping re-entrant execution of ${getHookDisplayText(hook)}`);
+      yield { outcome: "success", hook };
+      return;
+    }
     if (hook.type === "callback") {
       const callbackTimeoutMs = hook.timeout ? hook.timeout * 1000 : timeoutMs;
       const { signal: abortSignal, cleanup } = createCombinedAbortSignal(signal, { timeoutMs: callbackTimeoutMs });
-      yield executeHookCallback({
+      yield runWithHookReentrancy(hookEvent, hook, pluginRoot, () => executeHookCallback({
         toolUseID,
         hook,
         hookEvent,
@@ -429839,7 +430883,23 @@ async function* executeHooks({
         signal: abortSignal,
         hookIndex,
         toolUseContext
-      }).finally(cleanup);
+      }).catch((error) => {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        return {
+          message: createAttachmentMessage({
+            type: "hook_non_blocking_error",
+            hookName: `${hookEvent}:Callback`,
+            toolUseID,
+            hookEvent,
+            stderr: `Failed to run: ${errorMessage}`,
+            stdout: "",
+            exitCode: 1,
+            command: "callback"
+          }),
+          outcome: "non_blocking_error",
+          hook
+        };
+      }).finally(cleanup));
       return;
     }
     if (hook.type === "function") {
@@ -429857,7 +430917,7 @@ async function* executeHooks({
         };
         return;
       }
-      yield executeFunctionHook({
+      yield runWithHookReentrancy(hookEvent, hook, pluginRoot, () => executeFunctionHook({
         hook,
         messages,
         hookName,
@@ -429865,7 +430925,7 @@ async function* executeHooks({
         hookEvent,
         timeoutMs,
         signal
-      });
+      }));
       return;
     }
     const commandTimeoutMs = hook.timeout ? hook.timeout * 1000 : timeoutMs;
@@ -429878,6 +430938,7 @@ async function* executeHooks({
     try {
       const jsonInputRes = getJsonInput();
       if (!jsonInputRes.ok) {
+        const failClosed = shouldFailClosePluginHook(hookEvent, pluginRoot);
         yield {
           message: createAttachmentMessage({
             type: "hook_error_during_execution",
@@ -429888,7 +430949,13 @@ async function* executeHooks({
             command: hookCommand,
             durationMs: Date.now() - hookStartMs
           }),
-          outcome: "non_blocking_error",
+          ...failClosed ? {
+            blockingError: {
+              blockingError: `Plugin hook input could not be prepared; blocking gated action (fail-closed): ${errorMessage2(jsonInputRes.error)}`,
+              command: hookCommand
+            }
+          } : {},
+          outcome: failClosed ? "blocking" : "non_blocking_error",
           hook
         };
         cleanup();
@@ -429899,7 +430966,7 @@ async function* executeHooks({
         if (!toolUseContext) {
           throw new Error("ToolUseContext is required for prompt hooks. This is a bug.");
         }
-        const promptResult = await execPromptHook(hook, hookName, hookEvent, jsonInput, abortSignal, toolUseContext, messages, toolUseID);
+        const promptResult = await runWithHookReentrancy(hookEvent, hook, pluginRoot, () => execPromptHook(hook, hookName, hookEvent, jsonInput, abortSignal, toolUseContext, messages, toolUseID));
         if (promptResult.message?.type === "attachment") {
           const att = promptResult.message.attachment;
           if (att.type === "hook_success" || att.type === "hook_non_blocking_error") {
@@ -429918,7 +430985,7 @@ async function* executeHooks({
         if (!messages) {
           throw new Error("Messages are required for agent hooks. This is a bug.");
         }
-        const agentResult = await execAgentHook(hook, hookName, hookEvent, jsonInput, abortSignal, toolUseContext, toolUseID, messages, "agent_type" in hookInput ? hookInput.agent_type : undefined);
+        const agentResult = await runWithHookReentrancy(hookEvent, hook, pluginRoot, () => execAgentHook(hook, hookName, hookEvent, jsonInput, abortSignal, toolUseContext, toolUseID, messages, "agent_type" in hookInput ? hookInput.agent_type : undefined));
         if (agentResult.message?.type === "attachment") {
           const att = agentResult.message.attachment;
           if (att.type === "hook_success" || att.type === "hook_non_blocking_error") {
@@ -429932,7 +430999,7 @@ async function* executeHooks({
       }
       if (hook.type === "http") {
         emitHookStarted(hookId, hookName, hookEvent);
-        const httpResult = await execHttpHook(hook, hookEvent, jsonInput, signal);
+        const httpResult = await runWithHookReentrancy(hookEvent, hook, pluginRoot, () => execHttpHook(hook, hookEvent, jsonInput, signal));
         cleanup?.();
         if (httpResult.aborted) {
           emitHookResponse({
@@ -430060,7 +431127,7 @@ async function* executeHooks({
         return;
       }
       emitHookStarted(hookId, hookName, hookEvent);
-      const result = await execCommandHook(hook, hookEvent, hookName, jsonInput, abortSignal, hookId, hookIndex, pluginRoot, pluginId, skillRoot, forceSyncExecution, boundRequestPrompt);
+      const result = await runWithHookReentrancy(hookEvent, hook, pluginRoot, () => execCommandHook(hook, hookEvent, hookName, jsonInput, abortSignal, hookId, hookIndex, pluginRoot, pluginId, skillRoot, forceSyncExecution, boundRequestPrompt));
       cleanup?.();
       const durationMs = Date.now() - hookStartMs;
       if (result.backgrounded) {
@@ -430306,7 +431373,7 @@ async function* executeHooks({
     cancelled: 0
   };
   let permissionBehavior;
-  for await (const result of all2(hookPromises)) {
+  for await (const result of all2(hookPromises, MAX_HOOK_CONCURRENCY)) {
     outcomes[result.outcome]++;
     if (result.terminalSequence) {
       try {
@@ -430496,20 +431563,46 @@ async function executeHooksOutsideREPL({
     const pluginHookCounts = getPluginHookCounts(userHooks);
     const hookTypeCounts = getHookTypeCounts(userHooks);
   }
-  let jsonInput;
-  try {
-    jsonInput = jsonStringify5(hookInput);
-  } catch (error) {
-    logError3(error);
-    return [];
+  if (exceedsMaxNestingDepth(hookInput)) {
+    const message = `Hook input nesting depth exceeds MAX_HOOK_INPUT_NESTING_DEPTH (${MAX_HOOK_INPUT_NESTING_DEPTH}); refusing to run hooks`;
+    logForDebugging3(`Hooks: ${hookName}: ${message}`);
+    return matchingHooks.map(({ hook, pluginRoot }) => ({
+      command: getHookDisplayText(hook),
+      succeeded: false,
+      output: message,
+      blocked: shouldFailClosePluginHook(hookEvent, pluginRoot)
+    }));
+  }
+  const serialized = stringifyWithGetterFallback(hookInput);
+  if (serialized.ok !== true) {
+    logError3(serialized.error);
+    return matchingHooks.map(({ hook, pluginRoot }) => ({
+      command: getHookDisplayText(hook),
+      succeeded: false,
+      output: `Failed to serialize hook input: ${errorMessage2(serialized.error)}`,
+      blocked: shouldFailClosePluginHook(hookEvent, pluginRoot)
+    }));
+  }
+  if (serialized.droppedKeys.length > 0) {
+    logForDebugging3(`Hooks: ${hookName}: dropped input keys with throwing getters: ${serialized.droppedKeys.join(", ")}`);
   }
-  const hookPromises = matchingHooks.map(async ({ hook, pluginRoot, pluginId }, hookIndex) => {
+  const jsonInput = serialized.value;
+  const hookTasks = matchingHooks.map(({ hook, pluginRoot, pluginId }, hookIndex) => async () => {
+    if (isReentrantHook(hookEvent, hook, pluginRoot)) {
+      logForDebugging3(`Hooks: ${hookName}: skipping re-entrant execution of ${getHookDisplayText(hook)}`);
+      return {
+        command: getHookDisplayText(hook),
+        succeeded: true,
+        output: "Skipped: re-entrant hook execution (already running in this call chain)",
+        blocked: false
+      };
+    }
     if (hook.type === "callback") {
       const callbackTimeoutMs = hook.timeout ? hook.timeout * 1000 : timeoutMs;
       const { signal: abortSignal, cleanup } = createCombinedAbortSignal(signal, { timeoutMs: callbackTimeoutMs });
       try {
         const toolUseID = randomUUID43();
-        const json = await hook.callback(hookInput, toolUseID, abortSignal, hookIndex);
+        const json = await runWithHookReentrancy(hookEvent, hook, pluginRoot, () => hook.callback(hookInput, toolUseID, abortSignal, hookIndex));
         cleanup?.();
         if (isAsyncHookJSONOutput(json)) {
           logForDebugging3(`${hookName} [callback] returned async response, returning empty output`);
@@ -430568,7 +431661,7 @@ async function executeHooksOutsideREPL({
     }
     if (hook.type === "http") {
       try {
-        const httpResult = await execHttpHook(hook, hookEvent, jsonInput, signal);
+        const httpResult = await runWithHookReentrancy(hookEvent, hook, pluginRoot, () => execHttpHook(hook, hookEvent, jsonInput, signal));
         if (httpResult.aborted) {
           logForDebugging3(`${hookName} [${hook.url}] cancelled`);
           return {
@@ -430619,7 +431712,7 @@ async function executeHooksOutsideREPL({
     const commandTimeoutMs = hook.timeout ? hook.timeout * 1000 : timeoutMs;
     const { signal: abortSignal, cleanup } = createCombinedAbortSignal(signal, { timeoutMs: commandTimeoutMs });
     try {
-      const result = await execCommandHook(hook, hookEvent, hookName, jsonInput, abortSignal, randomUUID43(), hookIndex, pluginRoot, pluginId);
+      const result = await runWithHookReentrancy(hookEvent, hook, pluginRoot, () => execCommandHook(hook, hookEvent, hookName, jsonInput, abortSignal, randomUUID43(), hookIndex, pluginRoot, pluginId));
       cleanup?.();
       if (result.aborted) {
         logForDebugging3(`${hookName} [${hook.command}] cancelled`);
@@ -430663,7 +431756,7 @@ async function executeHooksOutsideREPL({
       };
     }
   });
-  return await Promise.all(hookPromises);
+  return await runWithConcurrencyLimit(hookTasks, MAX_HOOK_CONCURRENCY);
 }
 async function* executePermissionDeniedHooks(toolName, toolUseID, toolInput, reason, toolUseContext, permissionMode, signal, timeoutMs = TOOL_HOOK_EXECUTION_TIMEOUT_MS) {
   const appState = toolUseContext.getAppState();
@@ -431463,7 +432556,7 @@ function getHookDefinitionsForTelemetry(matchedHooks) {
     return { type: "unknown" };
   });
 }
-var TOOL_HOOK_EXECUTION_TIMEOUT_MS, SESSION_END_HOOK_TIMEOUT_MS_DEFAULT = 1500;
+var TOOL_HOOK_EXECUTION_TIMEOUT_MS, SESSION_END_HOOK_TIMEOUT_MS_DEFAULT2 = 1500;
 var init_hooks7 = __esm(() => {
   init_file();
   init_ShellCommand2();
@@ -431496,12 +432589,16 @@ var init_hooks7 = __esm(() => {
   init_permissionRuleParser2();
   init_log5();
   init_combinedAbortSignal();
+  init_hookInputMaterialize();
+  init_hookReentrancy();
+  init_hookFailClosed();
   init_AsyncHookRegistry();
   init_messageQueueManager();
   init_messages3();
   init_hookEvents2();
   init_attachments();
   init_generators();
+  init_engine();
   init_Tool();
   init_execPromptHook();
   init_execAgentHook();
@@ -440582,7 +441679,21 @@ function getDestructiveCommandWarning2(command) {
   }
   return null;
 }
-var DESTRUCTIVE_PATTERNS;
+function isStrictInlineShellRmPromptEnabled(env = process.env) {
+  return env[STRICT_INLINE_SHELL_RM_PROMPT_ENV] === "1";
+}
+function getStrictInlineShellRmWarning(command) {
+  if (STRICT_CONCAT_RM_RE.test(command)) {
+    return STRICT_CONCAT_RM_WARNING;
+  }
+  for (const re of STRICT_SCRIPT_INVOCATION_RES) {
+    if (re.test(command)) {
+      return STRICT_SCRIPT_WARNING;
+    }
+  }
+  return null;
+}
+var DESTRUCTIVE_PATTERNS, STRICT_INLINE_SHELL_RM_PROMPT_ENV = "ATLAS_STRICT_INLINE_SHELL_RM_PROMPT", STRICT_CONCAT_RM_RE, STRICT_SCRIPT_INVOCATION_RES, STRICT_CONCAT_RM_WARNING = "Note: may remove files via a non-literal rm invocation", STRICT_SCRIPT_WARNING = "Note: runs a shell script whose contents are not inspected";
 var init_destructiveCommandWarning2 = __esm(() => {
   DESTRUCTIVE_PATTERNS = [
     {
@@ -440650,6 +441761,13 @@ var init_destructiveCommandWarning2 = __esm(() => {
       warning: "Note: may destroy Terraform infrastructure"
     }
   ];
+  STRICT_CONCAT_RM_RE = /\brm\s+(?:-[a-zA-Z]*[rRf]|--recursive|--force)/;
+  STRICT_SCRIPT_INVOCATION_RES = [
+    /(^|[;&|\n]\s*)(?:[^\s;&|]*\/)?(?:bash|zsh|dash|ksh|sh)\b/,
+    /(^|[;&|\n]\s*)source\s+\S/,
+    /(^|[;&|\n]\s*)\.[ \t]*\S/,
+    /(^|[;&|\n]\s*)\S+\.sh\b/
+  ];
 });
 
 // src/tui/utils/shell/specPrefix.ts
@@ -444710,7 +445828,7 @@ function BashPermissionRequestInner({
     sandboxingEnabled: sandboxingEnabled_0,
     isSandboxed: isSandboxed_0
   } = import_react193.useMemo(() => {
-    const destructiveWarning = getFeatureValue_CACHED_MAY_BE_STALE("atlas_destructive_command_warning", false) ? getDestructiveCommandWarning2(command) : null;
+    const destructiveWarning = getFeatureValue_CACHED_MAY_BE_STALE("atlas_destructive_command_warning", false) ? getDestructiveCommandWarning2(command) ?? (isStrictInlineShellRmPromptEnabled() ? getStrictInlineShellRmWarning(command) : null) : null;
     const sandboxingEnabled = getSandboxManager().isSandboxingEnabled();
     const isSandboxed = sandboxingEnabled && shouldUseSandbox2(toolUseConfirm.input);
     return {
@@ -469670,41 +470788,28 @@ async function processUserInput({
   if (mode === "prompt" && inputString !== null && !isMeta) {
     setUserInputOnProcessing?.(inputString);
   }
-  queryCheckpoint("query_process_user_input_base_start");
   const appState = context.getAppState();
-  const result = await processUserInputBase(input, mode, setToolJSX, context, pastedContents, ideSelection, messages, uuid, isAlreadyProcessing, querySource, canUseTool, appState.toolPermissionContext.mode, skipSlashCommands, bridgeOrigin, isMeta, skipAttachments, preExpansionInput);
-  queryCheckpoint("query_process_user_input_base_end");
-  if (!result.shouldQuery) {
-    return result;
-  }
   queryCheckpoint("query_hooks_start");
   const inputMessage = getContentText(input) || "";
+  let hookBlockingMessage = null;
+  let hookStopped = false;
+  let hookStopReason;
+  const hookMessages = [];
   for await (const hookResult of executeUserPromptSubmitHooks(inputMessage, appState.toolPermissionContext.mode, context, context.requestPrompt)) {
     if (hookResult.message?.type === "progress") {
       continue;
     }
     if (hookResult.blockingError) {
-      const blockingMessage = getUserPromptSubmitHookBlockingMessage(hookResult.blockingError);
-      return {
-        messages: [
-          createSystemMessage(`${blockingMessage}
-
-Original prompt: ${input}`, "warning")
-        ],
-        shouldQuery: false,
-        allowedTools: result.allowedTools
-      };
+      hookBlockingMessage = getUserPromptSubmitHookBlockingMessage(hookResult.blockingError);
+      break;
     }
     if (hookResult.preventContinuation) {
-      const message = hookResult.stopReason ? `Operation stopped by hook: ${hookResult.stopReason}` : "Operation stopped by hook";
-      result.messages.push(createUserMessage2({
-        content: message
-      }));
-      result.shouldQuery = false;
-      return result;
+      hookStopped = true;
+      hookStopReason = hookResult.stopReason;
+      continue;
     }
     if (hookResult.additionalContexts && hookResult.additionalContexts.length > 0) {
-      result.messages.push(createAttachmentMessage({
+      hookMessages.push(createAttachmentMessage({
         type: "hook_additional_context",
         content: hookResult.additionalContexts.map(applyTruncation),
         hookName: "UserPromptSubmit",
@@ -469718,7 +470823,7 @@ Original prompt: ${input}`, "warning")
           if (!hookResult.message.attachment.content) {
             break;
           }
-          result.messages.push({
+          hookMessages.push({
             ...hookResult.message,
             attachment: {
               ...hookResult.message.attachment,
@@ -469727,12 +470832,38 @@ Original prompt: ${input}`, "warning")
           });
           break;
         default:
-          result.messages.push(hookResult.message);
+          hookMessages.push(hookResult.message);
           break;
       }
     }
   }
   queryCheckpoint("query_hooks_end");
+  if (hookBlockingMessage !== null) {
+    return {
+      messages: [
+        createSystemMessage(`${hookBlockingMessage}
+
+Original prompt: ${input}`, "warning")
+      ],
+      shouldQuery: false,
+      allowedTools: []
+    };
+  }
+  queryCheckpoint("query_process_user_input_base_start");
+  const result = await processUserInputBase(input, mode, setToolJSX, context, pastedContents, ideSelection, messages, uuid, isAlreadyProcessing, querySource, canUseTool, appState.toolPermissionContext.mode, skipSlashCommands, bridgeOrigin, isMeta, skipAttachments, preExpansionInput);
+  queryCheckpoint("query_process_user_input_base_end");
+  if (hookStopped && result.shouldQuery) {
+    const message = hookStopReason ? `Operation stopped by hook: ${hookStopReason}` : "Operation stopped by hook";
+    result.messages.push(createUserMessage2({
+      content: message
+    }));
+    result.shouldQuery = false;
+    return result;
+  }
+  if (!result.shouldQuery) {
+    return result;
+  }
+  result.messages.push(...hookMessages);
   return result;
 }
 function applyTruncation(content) {
@@ -470300,6 +471431,32 @@ var init_useMailboxBridge = __esm(() => {
 
 // src/tui/replLoopDeps.ts
 function buildReplLoopParams(m) {
+  let prevPoolSig = (m.tools ?? []).map((t) => t.name).join(",");
+  const refreshRoundContext = (messages) => {
+    const appState = m.toolUseContext?.getAppState?.();
+    const liveMcpTools = appState?.mcp?.tools;
+    if (!liveMcpTools)
+      return null;
+    const pool = assembleToolPool(m.toolPermissionContext, liveMcpTools);
+    const sig = pool.map((t) => t.name).join(",");
+    const tuiMessages = messages;
+    const atts = [
+      ...getDeferredToolsDeltaAttachment(pool, m.mainLoopModel, tuiMessages, {
+        callSite: "round_refresh",
+        querySource: m.querySource
+      }),
+      ...getMcpInstructionsDeltaAttachment(m.toolUseContext.options.mcpClients ?? [], pool, m.mainLoopModel, tuiMessages)
+    ];
+    if (sig === prevPoolSig && atts.length === 0)
+      return null;
+    prevPoolSig = sig;
+    return {
+      tools: pool,
+      ...atts.length > 0 ? {
+        appendedMessages: atts.map((att) => createAttachmentMessage(att))
+      } : {}
+    };
+  };
   return buildAgentLoopParams({
     messages: m.messages,
     userContext: m.userContext,
@@ -470315,11 +471472,14 @@ function buildReplLoopParams(m) {
     toolUseContext: m.toolUseContext,
     querySource: m.querySource,
     unboundedTurns: true,
-    maxGoalTurns: m.maxGoalTurns
+    maxGoalTurns: m.maxGoalTurns,
+    refreshRoundContext
   });
 }
 var init_replLoopDeps = __esm(() => {
   init_agentLoopDeps();
+  init_tools3();
+  init_attachments();
 });
 
 // src/tui/hooks/useMergedClients.ts
@@ -493526,7 +494686,7 @@ ${formattedErrors}
         const {
           allowed,
           blocked
-        } = filterMcpServersByPolicy(scopedConfigs);
+        } = filterMcpServersByPolicy2(scopedConfigs);
         if (blocked.length > 0) {
           process.stderr.write(`Warning: MCP ${plural2(blocked.length, "server")} blocked by enterprise policy: ${blocked.join(", ")}
 `);
@@ -494207,7 +495367,8 @@ ${inputPrompt}` : mergePrompt;
         tools: [],
         commands: [],
         resources: {},
-        pluginReconnectKey: 0
+        pluginReconnectKey: 0,
+        cwdReconnectKey: 0
       },
       plugins: {
         enabled: [],