@bubblebrain-ai/bubble 0.0.58 → 0.0.60

package/dist/lsp/service.js

@@ -2,11 +2,38 @@ import { execFile as execFileCallback, spawn } from "node:child_process";
 import { EventEmitter } from "node:events";
 import { access, readFile } from "node:fs/promises";
 import { createRequire } from "node:module";
-import { basename, dirname, extname, isAbsolute, join, normalize, relative, resolve } from "node:path";
+import { basename, dirname, extname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
 import { pathToFileURL, fileURLToPath } from "node:url";
 import { createMessageConnection, StreamMessageReader, StreamMessageWriter, } from "vscode-jsonrpc/node.js";
 import { customLspServerEntries, isLspEnabled, isLspServerEnabled } from "./config.js";
+// vscode-jsonrpc 8.x rethrows write failures inside an async Promise executor.
+// Dispose through the lifecycle handler instead: pending requests still reject,
+// without an additional unhandled rejection that can crash the desktop host.
+class LspMessageWriter extends StreamMessageWriter {
+    onWriteFailure;
+    constructor(stream, onWriteFailure) {
+        super(stream);
+        this.onWriteFailure = onWriteFailure;
+    }
+    async write(message) {
+        try {
+            await super.write(message);
+        }
+        catch (error) {
+            this.onWriteFailure(error);
+        }
+    }
+}
+// Electron's executable is also a Node runtime, but only with this child-local
+// flag. Preserve it for descendants (e.g. typescript-language-server's tsserver).
+function spawnNodeServer(args, cwd) {
+    return spawn(process.execPath, args, {
+        cwd,
+        env: process.versions.electron ? { ...process.env, ELECTRON_RUN_AS_NODE: "1" } : process.env,
+        stdio: "pipe",
+    });
+}
 const execFile = promisify(execFileCallback);
 const services = new Map();
 const TS_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".mts", ".cts"];
@@ -14,9 +41,12 @@ const NODE_ROOT_MARKERS = ["package-lock.json", "bun.lockb", "bun.lock", "pnpm-l
 const DENO_ROOT_MARKERS = ["deno.json", "deno.jsonc"];
 export class ProjectLspService {
     cwd;
+    timeouts;
     emitter = new EventEmitter();
     clients = new Map();
     spawning = new Map();
+    initializing = new Map();
+    generation = 0;
     starting = new Map();
     broken = new Map();
     unavailable = new Set();
@@ -24,8 +54,9 @@ export class ProjectLspService {
     waiters = new Set();
     disposed = false;
     config;
-    constructor(cwd, config) {
+    constructor(cwd, config, timeouts = {}) {
         this.cwd = cwd;
+        this.timeouts = timeouts;
         this.config = config;
     }
     updateConfig(config) {
@@ -122,13 +153,12 @@ export class ProjectLspService {
             return [];
         const clients = await this.getClients(file);
         await Promise.all(clients.map((client) => this.openOrChange(client, file)));
-        const results = await Promise.all(clients.map((client) => client.connection
-            .sendRequest("textDocument/documentSymbol", { textDocument: { uri: pathToFileURL(file).href } })
+        const results = await Promise.all(clients.map((client) => this.request(client, "textDocument/documentSymbol", { textDocument: { uri: pathToFileURL(file).href } })
             .catch(() => [])));
         return results.flatMap(normalizeLspResult);
     }
     async workspaceSymbol(query) {
-        const results = await Promise.all([...this.clients.values()].map((client) => client.connection.sendRequest("workspace/symbol", { query }).catch(() => [])));
+        const results = await Promise.all([...this.clients.values()].map((client) => this.request(client, "workspace/symbol", { query }).catch(() => [])));
         return results.flatMap(normalizeLspResult).slice(0, 50);
     }
     async prepareCallHierarchy(input) {
@@ -157,12 +187,11 @@ export class ProjectLspService {
         for (const waiter of this.waiters)
             waiter.resolve();
         this.waiters.clear();
-        for (const client of this.clients.values()) {
-            client.stopping = true;
-            client.connection.dispose();
-            client.process.kill();
-        }
-        this.clients.clear();
+        this.disposed = true;
+        this.generation += 1;
+        for (const client of [...this.initializing.values(), ...this.clients.values()])
+            this.stopClient(client);
+        this.starting.clear();
     }
     async runRequest(input, method, params) {
         const file = this.resolveInsideCwd(input.file);
@@ -170,7 +199,7 @@ export class ProjectLspService {
             return [];
         const clients = await this.getClients(file);
         await Promise.all(clients.map((client) => this.openOrChange(client, file)));
-        const results = await Promise.all(clients.map((client) => client.connection.sendRequest(method, params).catch(() => [])));
+        const results = await Promise.all(clients.map((client) => this.request(client, method, params).catch(() => [])));
         return results.flatMap(normalizeLspResult);
     }
     async callHierarchyRequest(input, method) {
@@ -180,8 +209,7 @@ export class ProjectLspService {
         const clients = await this.getClients(file);
         const results = await Promise.all(clients.map(async (client) => {
             await this.openOrChange(client, file);
-            const items = await client.connection
-                .sendRequest("textDocument/prepareCallHierarchy", {
+            const items = await this.request(client, "textDocument/prepareCallHierarchy", {
                 textDocument: { uri: pathToFileURL(file).href },
                 position: { line: input.line, character: input.character },
             })
@@ -189,16 +217,20 @@ export class ProjectLspService {
             const first = normalizeLspResult(items)[0];
             if (!first)
                 return [];
-            return client.connection.sendRequest(method, { item: first }).catch(() => []);
+            return this.request(client, method, { item: first }).catch(() => []);
         }));
         return results.flatMap(normalizeLspResult);
     }
     async getClients(file) {
+        if (this.disposed)
+            return [];
         const matches = await this.matchingServers(file);
         const clients = await Promise.all(matches.map(({ server, root }) => this.getClient(server, root)));
         return clients.filter((client) => !!client);
     }
     async getClient(server, root) {
+        if (this.disposed)
+            return undefined;
         const key = `${root}:${server.id}`;
         const existing = this.clients.get(key);
         if (existing)
@@ -221,27 +253,36 @@ export class ProjectLspService {
         const task = this.spawnClient(server, root, key);
         this.spawning.set(key, task);
         task.finally(() => {
-            if (this.spawning.get(key) === task)
+            if (this.spawning.get(key) === task) {
                 this.spawning.delete(key);
-            if (this.starting.delete(key))
-                this.emitStatus();
+                if (this.starting.delete(key))
+                    this.emitStatus();
+            }
         });
         return task;
     }
     async spawnClient(server, root, key) {
+        const generation = this.generation;
+        let client;
         try {
             const handle = await server.spawn(root, { cwd: this.cwd });
             if (!handle) {
                 this.unavailable.add(key);
                 return undefined;
             }
-            const connection = createMessageConnection(new StreamMessageReader(handle.process.stdout), new StreamMessageWriter(handle.process.stdin), {
+            if (this.disposed || generation !== this.generation || !isLspServerEnabled(this.config, server.id)) {
+                // Install an error handler even when shutdown won the spawn race.
+                handle.process.on("error", () => { });
+                handle.process.kill();
+                return undefined;
+            }
+            const connection = createMessageConnection(new StreamMessageReader(handle.process.stdout), new LspMessageWriter(handle.process.stdin, (error) => client?.fail(`server write failed: ${String(error)}`)), {
                 error: () => { },
                 warn: () => { },
                 info: () => { },
                 log: () => { },
             });
-            const client = {
+            client = {
                 key,
                 id: server.id,
                 name: server.name,
@@ -251,7 +292,22 @@ export class ProjectLspService {
                 connection,
                 documents: new Map(),
                 stopping: false,
+                fail: (message) => {
+                    if (client.stopping)
+                        return;
+                    this.stopClient(client);
+                    if (!this.disposed && generation === this.generation)
+                        this.markBroken(key, server, root, message);
+                },
             };
+            const activeClient = client;
+            this.initializing.set(key, client);
+            // Drain stderr: an unread pipe can block an otherwise healthy server.
+            handle.process.stderr.resume();
+            handle.process.once("error", (error) => activeClient.fail(`server error: ${error.message}`));
+            handle.process.once("exit", (code, signal) => activeClient.fail(`server exited${code === null ? "" : ` with code ${code}`}${signal ? ` (${signal})` : ""}`));
+            connection.onClose(() => activeClient.fail("server connection closed"));
+            connection.onError(([error]) => activeClient.fail(`server connection error: ${error.message}`));
             connection.onNotification("textDocument/publishDiagnostics", (params) => {
                 if (!params?.uri)
                     return;
@@ -265,14 +321,8 @@ export class ProjectLspService {
             connection.onRequest("workspace/workspaceFolders", () => [{ uri: pathToFileURL(root).href, name: basename(root) }]);
             connection.onRequest("client/registerCapability", () => null);
             connection.onRequest("client/unregisterCapability", () => null);
-            handle.process.once("exit", (code, signal) => {
-                this.clients.delete(key);
-                if (!this.disposed && !client.stopping) {
-                    this.markBroken(key, server, root, `server exited${code === null ? "" : ` with code ${code}`}${signal ? ` (${signal})` : ""}`);
-                }
-            });
             connection.listen();
-            await connection.sendRequest("initialize", {
+            await this.request(client, "initialize", {
                 processId: process.pid,
                 rootPath: root,
                 rootUri: pathToFileURL(root).href,
@@ -296,16 +346,74 @@ export class ProjectLspService {
                     },
                     window: { workDoneProgress: false },
                 },
-            });
-            connection.sendNotification("initialized", {});
+            }, this.timeouts.initializeMs ?? 10_000);
+            if (client.stopping || this.disposed || generation !== this.generation)
+                return undefined;
+            await this.notify(client, "initialized", {});
+            if (client.stopping || this.disposed || generation !== this.generation)
+                return undefined;
             this.clients.set(key, client);
             this.emitStatus();
             return client;
         }
         catch (error) {
-            this.markBroken(key, server, root, error instanceof Error ? error.message : String(error));
+            if (client)
+                client.fail(error instanceof Error ? error.message : String(error));
+            else if (!this.disposed && generation === this.generation) {
+                this.markBroken(key, server, root, error instanceof Error ? error.message : String(error));
+            }
             return undefined;
         }
+        finally {
+            if (this.initializing.get(key) === client)
+                this.initializing.delete(key);
+        }
+    }
+    async request(client, method, params, timeoutMs = this.timeouts.requestMs ?? 10_000) {
+        return this.withDeadline(client, method, () => client.connection.sendRequest(method, params), timeoutMs);
+    }
+    async notify(client, method, params) {
+        await this.withDeadline(client, method, () => client.connection.sendNotification(method, params));
+    }
+    async withDeadline(client, method, operation, timeoutMs = this.timeouts.requestMs ?? 10_000) {
+        let timer;
+        try {
+            return await Promise.race([
+                operation(),
+                new Promise((_, reject) => {
+                    timer = setTimeout(() => {
+                        const message = `${method} timed out after ${timeoutMs}ms`;
+                        reject(new Error(message));
+                        client.fail(message);
+                    }, timeoutMs);
+                }),
+            ]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    stopClient(client) {
+        client.stopping = true;
+        if (this.clients.get(client.key) === client)
+            this.clients.delete(client.key);
+        if (this.initializing.get(client.key) === client)
+            this.initializing.delete(client.key);
+        // JSON-RPC close alone does not reject pending requests; dispose does.
+        client.connection.dispose();
+        if (client.process.exitCode === null && client.process.signalCode === null) {
+            client.process.kill();
+            const forceKill = setTimeout(() => {
+                if (client.process.exitCode === null && client.process.signalCode === null)
+                    client.process.kill("SIGKILL");
+            }, 1_000);
+            forceKill.unref();
+            client.process.once("exit", () => clearTimeout(forceKill));
+        }
+        for (const file of client.documents.keys()) {
+            this.diagnosticsByFile.get(file)?.delete(client.id);
+            this.resolveDiagnosticWaiters(file);
+        }
     }
     async openOrChange(client, file) {
         const text = await readFile(file, "utf-8");
@@ -314,13 +422,13 @@ export class ProjectLspService {
         const existing = client.documents.get(file);
         if (!existing) {
             client.documents.set(file, { languageId, version: 1 });
-            client.connection.sendNotification("textDocument/didOpen", {
+            await this.notify(client, "textDocument/didOpen", {
                 textDocument: { uri, languageId, version: 1, text },
             });
             return;
         }
         existing.version += 1;
-        client.connection.sendNotification("textDocument/didChange", {
+        await this.notify(client, "textDocument/didChange", {
             textDocument: { uri, version: existing.version },
             contentChanges: [{ text }],
         });
@@ -392,29 +500,41 @@ export class ProjectLspService {
     resolveInsideCwd(filePath) {
         const file = normalize(isAbsolute(filePath) ? filePath : resolve(this.cwd, filePath));
         const rel = relative(this.cwd, file);
-        if (rel.startsWith("..") || isAbsolute(rel))
+        // Only a whole `..` segment climbs out; `..notes.md` is a file in the project.
+        if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel))
             return undefined;
         return file;
     }
     async shutdownClient(client) {
         client.stopping = true;
-        await client.connection.sendRequest("shutdown").catch(() => undefined);
-        client.connection.sendNotification("exit");
-        client.connection.dispose();
-        client.process.kill();
+        try {
+            await this.request(client, "shutdown", undefined, this.timeouts.shutdownMs ?? 1_000);
+            await this.withDeadline(client, "exit", () => client.connection.sendNotification("exit"), this.timeouts.shutdownMs ?? 1_000);
+        }
+        catch {
+            // Shutdown must finish even if the server no longer answers.
+        }
+        finally {
+            this.stopClient(client);
+        }
     }
     async shutdownClients() {
+        this.generation += 1;
+        for (const client of [...this.initializing.values()])
+            this.stopClient(client);
+        this.spawning.clear();
         await Promise.all([...this.clients.values()].map((client) => this.shutdownClient(client)));
         this.clients.clear();
         this.starting.clear();
         this.diagnosticsByFile.clear();
     }
     async shutdownDisabledClients() {
+        for (const client of [...this.initializing.values()]) {
+            if (!isLspServerEnabled(this.config, client.id))
+                this.stopClient(client);
+        }
         const disabled = [...this.clients.values()].filter((client) => !isLspServerEnabled(this.config, client.id));
         await Promise.all(disabled.map((client) => this.shutdownClient(client)));
-        for (const client of disabled) {
-            this.clients.delete(client.key);
-        }
     }
 }
 export const TypeScriptLspService = ProjectLspService;
@@ -446,7 +566,7 @@ const TypeScriptServer = {
         if (!tsserverPath || !serverPath)
             return undefined;
         return {
-            process: spawn(process.execPath, [serverPath, "--stdio"], { cwd: root, env: process.env, stdio: "pipe" }),
+            process: spawnNodeServer([serverPath, "--stdio"], root),
             initializationOptions: { tsserver: { path: tsserverPath } },
         };
     },
@@ -485,7 +605,7 @@ const VueServer = {
             return undefined;
         const args = tsdk ? [serverPath, "--stdio", "--tsdk", tsdk] : [serverPath, "--stdio"];
         return {
-            process: spawn(process.execPath, args, { cwd: root, env: process.env, stdio: "pipe" }),
+            process: spawnNodeServer(args, root),
         };
     },
 };
@@ -506,7 +626,7 @@ const ESLintServer = {
         if (!serverPath)
             return undefined;
         return {
-            process: spawn(process.execPath, [serverPath, "--stdio"], { cwd: root, env: process.env, stdio: "pipe" }),
+            process: spawnNodeServer([serverPath, "--stdio"], root),
         };
     },
     configuration: (root, items) => items.map(() => eslintConfiguration(root)),

package/dist/main.js

@@ -5,17 +5,20 @@
 import chalk from "chalk";
 import { Agent } from "./agent.js";
 import { BudgetLedger } from "./agent/budget-ledger.js";
-import { parseArgs, printHelp } from "./cli.js";
+import { enterWorkingDirectory, parseArgs, printHelp } from "./cli.js";
 import { effectiveThemeModeForTerminal, shouldProbeTerminalTheme, UserConfig } from "./config.js";
 import { createProviderInstance, createUnavailableProvider } from "./provider.js";
 import { resolveConfiguredModel } from "./model-selection.js";
 import { getAvailableThinkingLevels, getDefaultThinkingLevel, normalizeThinkingLevel } from "./provider-transform.js";
 import { ProviderRegistry, displayModel, encodeModel, decodeModel } from "./provider-registry.js";
 import { SessionManager } from "./session.js";
+import { SessionContextFence } from "./session-context-fence.js";
 import { createSessionTitleUpdater } from "./session-title.js";
 import { buildSystemPrompt } from "./system-prompt.js";
 import { createRoutableModelIndex, createRoutingSnapshotAccessor } from "./agent/routing-catalog.js";
 import { buildModelRoutingPrompt } from "./prompt/routing.js";
+/** Upper bound on blocking startup for OAuth catalog discovery (one HTTP round trip normally). */
+const MODEL_DISCOVERY_STARTUP_WAIT_MS = 3_000;
 import { SkillRegistry } from "./skills/registry.js";
 import { buildToolPromptOptions, createAllTools } from "./tools/index.js";
 import { getProcessManager } from "./tasks/manager.js";
@@ -30,7 +33,8 @@ import { SettingsManager } from "./permissions/settings.js";
 import { ExternalHookController } from "./hooks/index.js";
 import { getLspService } from "./lsp/index.js";
 import { loadMcpConfig } from "./mcp/config.js";
-import { McpManager } from "./mcp/manager.js";
+import { promptRepoTrust } from "./permissions/trust-prompt.js";
+import { McpManager, gateMcpTools } from "./mcp/manager.js";
 import { normalizeInheritedThinkingLevel } from "./variant/variant-resolver.js";
 import { QuestionController } from "./question/index.js";
 import { buildMemoryPrompt, formatMemoryStartupResult, purgeUnsafeMemorySources, recordMemoryCitations, runMemoryPhase2, runMemoryStartupPipeline, startMemoryStartupTask, } from "./memory/index.js";
@@ -52,6 +56,13 @@ async function main() {
         console.log(`v${getCurrentVersion()}`);
         process.exit(0);
     }
+    // --cwd means "run as if launched there" (like git -C): every layer, including
+    // the TUI, shell children and relative paths, then sees the same directory.
+    const cwdError = enterWorkingDirectory(args.cwd);
+    if (cwdError) {
+        console.error(`bubble: ${cwdError}`);
+        process.exit(1);
+    }
     if (args.command === "update") {
         const { runUpdateCommand } = await import("./update/index.js");
         const code = await runUpdateCommand({ checkOnly: args.checkOnly });
@@ -86,10 +97,10 @@ async function main() {
             console.error(chalk.red("Error: No provider configured. Start interactive mode and use /login or /provider --add <id>."));
             process.exit(1);
         }
-        console.log(chalk.dim("No provider configured yet. Start with /login for ChatGPT or /provider --add <id> for an API key."));
+        console.log(chalk.dim("No provider configured yet. Start with /login for ChatGPT or Grok, or /provider --add <id> for an API key."));
     }
     const defaultProvider = registry.getDefault();
-    const unavailableProviderMessage = "No provider configured. Use /login for ChatGPT or /provider --add <id> before sending a prompt.";
+    const unavailableProviderMessage = "No provider configured. Use /login for ChatGPT or Grok, or /provider --add <id> before sending a prompt.";
     let sessionPromptCacheKey;
     const provider = defaultProvider
         ? createProviderInstance({
@@ -149,6 +160,11 @@ async function main() {
     const approvalHandlerRef = {};
     const questionController = new QuestionController();
     const bashAllowlist = new BashAllowlist();
+    // Folder trust (Kimi Code style): the repository's .bubble settings may
+    // enable allow rules, MCP servers and LSP servers; ask before loading them.
+    if (!printMode && process.stdin.isTTY && process.stdout.isTTY) {
+        await promptRepoTrust(args.cwd);
+    }
     const settingsManager = new SettingsManager(args.cwd);
     for (const d of settingsManager.getMerged().diagnostics) {
         console.error(chalk.yellow(`[settings:${d.scope}] ${d.path}: ${d.message}`));
@@ -161,6 +177,7 @@ async function main() {
         getMode: () => agentRef?.mode ?? "default",
         handlerRef: approvalHandlerRef,
         bashAllowlist,
+        sessionGrants: new Set(),
         cwd: args.cwd,
         getRuleSet: () => settingsManager.getMerged().ruleSet,
         externalHooks: hookController,
@@ -209,7 +226,7 @@ async function main() {
     let externalRuntime;
     if (mcpLoaded.servers.length > 0) {
         await mcpManager.start();
-        tools.push(...mcpManager.getToolEntries());
+        tools.push(...gateMcpTools(mcpManager.getToolEntries(), approvalController));
     }
     // Expose MCP prompts as slash commands. Queried live at each lookup so
     // /mcp reconnect picks up new prompts without restarting the process.
@@ -320,8 +337,21 @@ async function main() {
         ? decodeModel(normalizedConfiguredModel)
         : { providerId: undefined, modelId: "" };
     let activeProviderId = effectiveProviderId || fallbackProviderId;
-    if (registry.supportsOAuth(activeProviderId) && registry.getAuthStorage().has(activeProviderId)) {
-        await registry.prepareProvider(activeProviderId);
+    // getConfigured() resolves the legacy openai-codex auth alias; the raw
+    // auth key would skip token refresh and discovery for such logins.
+    if (registry.getConfigured().find((item) => item.id === activeProviderId)?.authType === "oauth") {
+        try {
+            await registry.prepareProvider(activeProviderId);
+        }
+        catch (error) {
+            // A dead login must not lock the user out: /login only exists inside the
+            // session, so start anyway and let the first request surface the error.
+            console.error(chalk.yellow(`[auth] ${error instanceof Error ? error.message : String(error)}`));
+        }
+        // The routing prompt below is composed once; give the account catalog a
+        // bounded chance to land first so the menu the model reads matches what a
+        // spawn will actually get (design §1.5).
+        await registry.waitForModelDiscovery(activeProviderId, MODEL_DISCOVERY_STARTUP_WAIT_MS);
     }
     const activeProvider = registry.getConfigured().find((p) => p.id === activeProviderId) || defaultProvider;
     const activeModel = activeProvider && effectiveModelId
@@ -356,6 +386,8 @@ async function main() {
         : undefined;
     const systemPrompt = buildSystemPrompt({
         agentName: "Bubble",
+        skills: skillSummaries,
+        skillCatalogChars: userConfig.getSkillCatalogChars(),
         configuredProvider: activeProviderId || "none",
         configuredModel: activeModel ? displayModel(activeModel) : "none",
         configuredModelId: activeModel || "none",
@@ -389,6 +421,30 @@ async function main() {
     }
     const budgetLedger = new BudgetLedger();
     let sessionTitleUpdater;
+    let contextFence = new SessionContextFence(sessionManager);
+    // A fence rejection means the durable log diverged from this host's resident
+    // history (a foreign append/clear/rewind landed while a turn was in flight).
+    // The write is refused — and the resident transcript must roll back to the
+    // file's truth, or the rejected message lingers in the TUI while every later
+    // fenced write keeps failing on the stale revision until a manual reload.
+    const persistFenced = (write) => {
+        try {
+            write();
+        }
+        catch (error) {
+            // Any refused write (fence rejection, busy lock, I/O) leaves the agent's
+            // already-pushed message unpersisted, so always restore the file's truth.
+            try {
+                const history = contextFence.reloadHistory();
+                const head = splitLeadingContext(agent.messages).leading;
+                agent.messages = [...head, ...history];
+            }
+            catch {
+                // Surface the original write failure; the next write retries the reload.
+            }
+            throw error;
+        }
+    };
     const agent = new Agent({
         provider: activeProvider
             ? createProvider(activeProviderId, activeProvider.apiKey, activeProvider.baseURL)
@@ -410,7 +466,8 @@ async function main() {
             // they will be re-injected as needed on resume based on the current mode.
             if (message.role === "meta")
                 return;
-            sessionManager.appendMessage(message);
+            const manager = sessionManager;
+            persistFenced(() => manager.appendMessage(message, contextFence.getRevision()));
             traceEvent("session_message_persisted", {
                 message: summarizeTraceMessage(message),
             });
@@ -420,12 +477,14 @@ async function main() {
             }
         },
         onProviderError: (error) => {
-            sessionManager?.appendProviderError(error);
+            persistFenced(() => sessionManager?.appendProviderError(error, contextFence.getRevision()));
         },
-        // Auto-compaction summaries are meta messages (dropped above); persist the
-        // compacted state as a session summary entry so it survives resume.
-        onCompactionApplied: (summary) => {
-            sessionManager?.applyLLMCompaction(summary);
+        getContextRevision: () => contextFence.getRevision(),
+        onContextCheckpoint: (checkpoint) => {
+            if (!sessionManager)
+                throw new Error("No session available for context commit");
+            const manager = sessionManager;
+            persistFenced(() => manager.commitContextCheckpoint(checkpoint, contextFence.getRevision()));
         },
         onToolResult: (toolName, result) => {
             if (!sessionManager)
@@ -434,14 +493,16 @@ async function main() {
                 return;
             const match = result.content.match(/^Skill:\s+([^\n]+)$/m);
             if (match?.[1]) {
-                sessionManager.appendMarker("skill_activated", match[1].trim());
+                const manager = sessionManager;
+                persistFenced(() => manager.appendMarker("skill_activated", match[1].trim(), contextFence.getRevision()));
             }
         },
         onModeUpdate: (mode) => {
-            sessionManager?.appendMarker("mode_switch", mode);
+            persistFenced(() => sessionManager?.appendMarker("mode_switch", mode, contextFence.getRevision()));
         },
         budgetLedger,
         skills: skillSummaries,
+        skillCatalogChars: userConfig.getSkillCatalogChars(),
         memoryPrompt,
         fileStateTracker,
         agentCategories: userConfig.getAgentCategories(),
@@ -550,7 +611,7 @@ async function main() {
     }
     // Restore session if requested
     if (resumedExistingSession && sessionManager) {
-        const history = sessionManager.getMessages();
+        const history = contextFence.reloadHistory();
         if (history.length > 0) {
             agent.messages = [{ role: "system", content: systemPrompt }, ...history];
             // Reassigning agent.messages drops any runtime meta reminder injected during
@@ -699,6 +760,7 @@ async function main() {
         const activateSession = (next) => {
             try {
                 const history = next.getMessages();
+                const historyRevision = next.getRevision();
                 const nextPromptCacheKey = next.getOrCreatePromptCacheKey();
                 const nextTitleUpdater = createSessionTitleUpdater({
                     sessionManager: next,
@@ -717,6 +779,10 @@ async function main() {
                 // Commit only after every file read/write and reconstruction step has
                 // succeeded. Callers can safely prepare candidate sessions without a
                 // failed switch rebinding persistence or replacing the live history.
+                if (next.getRevision() !== historyRevision)
+                    throw new Error("Session changed while switching; retry");
+                contextFence.dispose();
+                contextFence = new SessionContextFence(next);
                 sessionManager = next;
                 sessionPromptCacheKey = nextPromptCacheKey;
                 sessionTitleUpdater = nextTitleUpdater;

package/dist/mcp/config.d.ts

@@ -5,6 +5,10 @@
  * identified by its key in mcpServers; if the same name appears in multiple
  * scopes, the higher-precedence scope overwrites, and we record a diagnostic.
  *
+ * Servers from the project and local files arrive with the repository and
+ * Bubble would spawn their commands at startup, so they are skipped until the
+ * user trusts the folder (asked at startup, trust.ts).
+ *
  * Env expansion: ${VAR} in command, args, env values, url, or header values
  * is replaced with the matching process.env entry. Missing vars become empty
  * strings and yield a diagnostic (non-fatal).

package/dist/mcp/config.js

@@ -5,6 +5,10 @@
  * identified by its key in mcpServers; if the same name appears in multiple
  * scopes, the higher-precedence scope overwrites, and we record a diagnostic.
  *
+ * Servers from the project and local files arrive with the repository and
+ * Bubble would spawn their commands at startup, so they are skipped until the
+ * user trusts the folder (asked at startup, trust.ts).
+ *
  * Env expansion: ${VAR} in command, args, env values, url, or header values
  * is replaced with the matching process.env entry. Missing vars become empty
  * strings and yield a diagnostic (non-fatal).
@@ -12,6 +16,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { getBubbleHome } from "../bubble-home.js";
+import { isRepoConfigTrusted, readRepoSettings } from "../permissions/trust.js";
 export function loadMcpConfig(options) {
     const bubbleHome = options.bubbleHome ?? getBubbleHome();
     const paths = {
@@ -21,6 +26,7 @@ export function loadMcpConfig(options) {
     };
     const diagnostics = [];
     const merged = new Map();
+    const repoTrusted = isRepoConfigTrusted(options.cwd, readRepoSettings(options.cwd), { bubbleHome });
     for (const scope of ["user", "project", "local"]) {
         const path = paths[scope];
         if (!existsSync(path))
@@ -38,6 +44,17 @@ export function loadMcpConfig(options) {
         const mcpServers = raw.mcpServers;
         if (!mcpServers || typeof mcpServers !== "object" || Array.isArray(mcpServers))
             continue;
+        if (scope !== "user" && !repoTrusted) {
+            const names = Object.keys(mcpServers);
+            if (names.length > 0) {
+                diagnostics.push({
+                    scope,
+                    path,
+                    message: `Skipped MCP server${names.length === 1 ? "" : "s"} ${names.join(", ")} from this repository: the folder is not trusted (Bubble asks at startup).`,
+                });
+            }
+            continue;
+        }
         for (const [name, value] of Object.entries(mcpServers)) {
             const validated = validateServerConfig(value, (msg) => {
                 diagnostics.push({ scope, path, message: `mcpServers.${name}: ${msg}` });