@chatpanel/bridge 0.10.40 → 0.10.42

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/bridge",
-  "version": "0.10.40",
+  "version": "0.10.42",
   "type": "module",
   "description": "Local bridge that exposes the AI coding agents installed on your machine \u2014 Claude Code (CLI), Codex (CLI), and Antigravity CLI (formerly Gemini CLI, which remains available for business/enterprise) \u2014 to the ChatPanel Chrome extension over a localhost SSE endpoint. Bring your own agent.",
   "keywords": [

package/src/api-compat.js

@@ -6,6 +6,7 @@
 // are rejected when accepting them would produce misleading behavior.
 
 import { randomUUID } from 'node:crypto';
+import { normalizeNames } from './mcp-quarantine.js';
 
 const AGENT_IDS = new Set(['claude', 'codex', 'antigravity', 'pi', 'opencode', 'kiro', 'copilot', 'deepseek']);
 
@@ -76,6 +77,9 @@ function resolveTarget(model, chatpanel = {}) {
       workingDir: chatpanel.working_dir || chatpanel.workingDir || process.env.CHATPANEL_API_WORKING_DIR || '',
       permissionMode,
       useLocalConfig: chatpanel.use_local_config ?? chatpanel.useLocalConfig ?? true,
+      // Servers in the agent's OWN MCP config to leave out of this run — one that can't
+      // authenticate or can't be reached otherwise kills the whole turn (see mcp-quarantine.js).
+      mcpDisabled: normalizeNames(chatpanel.mcp_disabled ?? chatpanel.mcpDisabled),
       ...(engineModel ? { model: engineModel } : {}),
     },
   };

package/src/cli-errors.js

@@ -0,0 +1,128 @@
+// Turning a CLI agent's dying breath into something a person can act on.
+//
+// When an agent exits non-zero we used to surface its raw stderr. For a crash that is fine;
+// for the common real failure — one of the AGENT'S OWN MCP servers refusing to authenticate —
+// it is not: those servers answer with an HTML error page, so the user got kilobytes of
+// markup, inline CSS and an SVG logo in the chat, with the one useful sentence buried inside.
+//
+// The failure is also usually not ChatPanel's to fix. Saying whose it is, and naming the
+// server, is the difference between "something broke" and "re-auth that server".
+//
+// `mcpFailure` is the machine-readable half of the same knowledge: mcp-quarantine.js reads
+// it to DROP the offending server and run again, so the common cases never reach a human at
+// all. One set of patterns serves both — a second copy would drift.
+
+const NOISE = [
+  /^\s*$/,
+  /^\s*at\s+/,            // stack frames
+  /^\s*[.#]?[\w-]+\s*\{/, // CSS rules
+  /^\s*[\w-]+:\s*[^;]+;$/,// CSS declarations
+  /^\s*<\//,              // closing tags
+];
+
+// Strip HTML/CSS/SVG so an error page collapses to whatever prose it contained.
+export function stripMarkup(text) {
+  return String(text || '')
+    .replace(/<script[\s\S]*?<\/script>/gi, ' ')
+    .replace(/<style[\s\S]*?<\/style>/gi, ' ')
+    .replace(/<svg[\s\S]*?<\/svg>/gi, ' ')
+    .replace(/<[^>]+>/g, ' ')
+    .replace(/&nbsp;/g, ' ')
+    .replace(/[ \t]+/g, ' ');
+}
+
+// Which server the output blames, if it names one. Codex and Claude Code phrase this several
+// ways, so try each; a name we cannot read means there is nothing to disable, which is why
+// every caller must tolerate `null`.
+const SERVER_PATTERNS = [
+  /(?:refresh OAuth tokens|refresh tools) for (?:MCP )?server ['"`]?([\w.-]+)['"`]?/i,
+  /MCP server ['"`]([\w.-]+)['"`]/i,
+  /server ['"]?([\w.-]+)['"]? (?:requires|failed) auth/i,
+];
+export function mcpServerName(text) {
+  for (const re of SERVER_PATTERNS) {
+    const name = re.exec(String(text || ''))?.[1];
+    if (name) return name;
+  }
+  return null;
+}
+
+// The named MCP causes worth translating. `say` is the sentence for a human; `short` is the
+// clause used when we skip the server and carry on. Order matters — specific before generic.
+const MCP_CAUSES = [
+  {
+    kind: 'expired',
+    test: /refresh token (?:does not exist|was rejected)|invalid_grant/i,
+    short: 'its saved login has expired',
+    say: (who) => `${who} needs re-authentication — its saved OAuth token has expired or been revoked. Re-login to that server in the agent's own config; ChatPanel can't refresh it.`,
+  },
+  {
+    kind: 'unauthorized',
+    test: /invalid_token|AuthRequired|www-authenticate|\b401\b/i,
+    short: 'it rejected the agent\'s token',
+    say: (who) => `${who} rejected the agent's token (401/invalid_token). Re-authenticate that server in the agent, then retry.`,
+  },
+  {
+    kind: 'refused',
+    test: /HTTP 403|\b403\b/,
+    short: 'it is refusing requests',
+    say: (who) => `${who} returned 403 and an error page — that server is refusing requests or is temporarily down. This is outside ChatPanel; retry when it recovers.`,
+  },
+  {
+    // The off-network case: a VPN-only server seen from a cafe. Only counted when the text
+    // is talking about MCP at all, so an ordinary provider timeout is not misread as this.
+    kind: 'unreachable',
+    requiresMcpContext: true,
+    test: /handshaking with MCP server failed|ECONNREFUSED|ENOTFOUND|EAI_AGAIN|dns error|connection (?:refused|reset)|failed to start and is unavailable|network is unreachable/i,
+    short: 'it could not be reached',
+    say: (who) => `${who} could not be reached — it is offline, or needs a network (VPN) this machine is not on. ChatPanel can't reach it either; retry when it is available.`,
+  },
+];
+
+/**
+ * Classify an MCP-server failure in an agent's output.
+ * @returns {{server: string|null, kind: string, short: string, say: string}|null}
+ */
+export function mcpFailure(text) {
+  const raw = String(text || '');
+  const server = mcpServerName(raw);
+  const hasMcpContext = /\bmcp\b/i.test(raw) || !!server;
+  for (const cause of MCP_CAUSES) {
+    if (cause.requiresMcpContext && !hasMcpContext) continue;
+    if (!cause.test.test(raw)) continue;
+    return {
+      server,
+      kind: cause.kind,
+      short: cause.short,
+      say: cause.say(server ? `its MCP server "${server}"` : 'one of its MCP servers'),
+    };
+  }
+  return null;
+}
+
+// The named causes worth translating. Each returns a sentence that says what to DO.
+function knownCause(text) {
+  const mcp = mcpFailure(text);
+  if (mcp) return mcp.say;
+  if (/ENOENT|command not found/i.test(text)) return 'the command could not be found on PATH.';
+  return null;
+}
+
+/**
+ * A short, actionable summary of why a CLI agent exited. Never returns markup, and never more
+ * than a couple of lines — the full output stays in the bridge log for anyone debugging.
+ */
+export function summarizeCliError(label, code, stderr, stdout = '') {
+  const raw = `${stderr || ''}\n${stdout || ''}`;
+  const cause = knownCause(raw);
+  if (cause) return `${label} exited ${code}: ${cause}`;
+
+  const lines = stripMarkup(raw)
+    .split('\n')
+    .map((l) => l.trim())
+    .filter((l) => l && !NOISE.some((re) => re.test(l)));
+  // Prefer the last line that reads like an error, else the last line at all.
+  const errish = lines.filter((l) => /error|fail|fatal|panic|refused|denied|timeout/i.test(l));
+  const pick = (errish.length ? errish : lines).pop() || 'failed';
+  return `${label} exited ${code}: ${pick.length > 300 ? `${pick.slice(0, 300)}…` : pick}`;
+}

package/src/engines/antigravity.js

@@ -16,6 +16,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { findAgentBin } from '../env.js';
 import { buildCliPrompt } from './prompt.js';
+import { summarizeCliError } from '../cli-errors.js';
 import { killOnAbort, spawnGroupOpts } from '../proc.js';
 import { pushExtraArgs, FORBIDDEN } from './args.js';
 import { resolveWorkdir } from '../workdir.js';
@@ -153,7 +154,7 @@ export async function chat({ messages, system, options, images }, emit, { signal
         emit({ type: 'done', text: '' });
         resolve();
       } else {
-        reject(new Error(`Antigravity exited ${code}: ${err.trim() || out.trim() || 'failed'}`));
+        reject(new Error(summarizeCliError('Antigravity', code, err, out)));
       }
     });
   });

package/src/engines/claude.js

@@ -19,6 +19,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { resolveClaude, buildSpawnSpec, isCompiledBinary, selfMcpStdio } from '../env.js';
 import { buildCliPrompt } from './prompt.js';
+import { summarizeCliError } from '../cli-errors.js';
 import { killOnAbort } from '../proc.js';
 import { pushExtraArgs, FORBIDDEN } from './args.js';
 import { displayPath, resolveWorkdir } from '../workdir.js';
@@ -160,7 +161,7 @@ function runClaude({ prompt, args, cwd, emit, signal }) {
       detach();
       if (signal?.aborted) { resolve({ streamedAny, resultText }); return; } // Stop pressed — end quietly
       if (code === 0) resolve({ streamedAny, resultText });
-      else reject(new Error(`Claude Code exited ${code}: ${stderr.trim().split('\n').pop() || 'failed'}`));
+      else reject(new Error(summarizeCliError('Claude Code', code, stderr)));
     });
 
     child.stdin.write(prompt);

package/src/engines/codex.js

@@ -24,6 +24,8 @@ import { findAgentBin, selfMcpStdio } from '../env.js';
 import { buildCliPrompt } from './prompt.js';
 import { pushExtraArgs, FORBIDDEN } from './args.js';
 import { resolveWorkdir } from '../workdir.js';
+import { summarizeCliError } from '../cli-errors.js';
+import { disabledMcpServers, planMcpRetry, quarantine } from '../mcp-quarantine.js';
 
 // Idle timeout: re-armed on every stdout/stderr chunk, so a long run that keeps
 // streaming never trips it — only true silence does. Override with
@@ -116,6 +118,40 @@ export function codexMcpConfigArgs(mcp) {
   return args;
 }
 
+// Which MCP servers this Codex actually has configured.
+//
+// READ THIS BEFORE TOUCHING codexDisableArgs. `-c mcp_servers.X.enabled=false` for a name
+// that is NOT already in config.toml does not disable anything — it DEFINES a new server
+// that has no transport, and Codex then refuses to start at all:
+//     Error: failed to load bootstrap configuration
+//     Caused by: invalid transport in `mcp_servers.does_not_exist`
+// So a stale quarantine entry, or a typo in the user's deny list, would break EVERY run —
+// strictly worse than the failure this feature exists to fix. We therefore only ever disable
+// a server we can see, and a name we cannot see is left alone (a no-op, never a break).
+//
+// Read from config.toml — instant, and the same source listModels() already reads — rather
+// than shelling out to `codex mcp list --json`, which is authoritative but costs ~0.8s on
+// every single turn.
+export function configuredMcpServers(home) {
+  try {
+    const cfg = readFileSync(path.join(home, 'config.toml'), 'utf8');
+    const names = new Set();
+    for (const m of cfg.matchAll(/^\s*\[mcp_servers\.([A-Za-z0-9_-]+)\s*[.\]]/gm)) names.add(m[1]);
+    return names;
+  } catch {
+    return new Set(); // no config (or the isolated home) — there is nothing to disable
+  }
+}
+
+// Turn off servers from the user's own config.toml for THIS RUN only — never by editing
+// their file. Names are validated upstream (mcp-quarantine.js) and filtered against
+// configuredMcpServers by the caller, which is what makes it safe to interpolate one into a
+// `-c` override key; `-c` is otherwise blocked in extraArgs precisely because it reaches
+// config that matters.
+export function codexDisableArgs(names = []) {
+  return names.flatMap((name) => ['-c', `mcp_servers.${name}.enabled=false`]);
+}
+
 // Write base64 data-URL images to temp files so `codex exec -i <file>` can
 // attach them to the prompt as vision input. Returns the paths (caller cleans up).
 async function writeImages(images, tag) {
@@ -131,54 +167,15 @@ async function writeImages(images, tag) {
   return files;
 }
 
-export async function chat({ messages, system, options, images }, emit, { signal } = {}) {
-  const tag = `${Date.now()}-${Math.random().toString(36).slice(2)}`;
-  const outFile = path.join(os.tmpdir(), `chatpanel-codex-${tag}.txt`);
-  const imageFiles = await writeImages(images, tag);
-  const cleanupImages = () => imageFiles.forEach((f) => unlink(f).catch(() => {}));
-
-  const cwd = resolveWorkdir(options.workingDir);
-  const args = ['exec', '--json', '--skip-git-repo-check', '-o', outFile];
-  // Headless exec has no human to approve actions. With MCP/browser tools armed
-  // Codex would otherwise raise an approval prompt it can't show — and cancel the
-  // tool call. So in bypassPermissions (full autonomy, what "Act on page" needs)
-  // use the all-in bypass flag, which also clears MCP-tool approval. Lower modes
-  // keep the sandbox + never-ask, which auto-runs within bounds.
-  if (options.permissionMode === 'bypassPermissions') {
-    args.push('--dangerously-bypass-approvals-and-sandbox');
-  } else {
-    const sandbox = options.permissionMode === 'acceptEdits' ? 'workspace-write' : 'read-only';
-    args.push('-s', sandbox, '-c', 'approval_policy=never');
-  }
-  if (REASONING) args.push('-c', `model_reasoning_effort=${REASONING}`);
-  // Ask Codex to emit reasoning SUMMARIES so the panel can stream the model's thinking.
-  // Additive + safe: a no-op for models/providers that don't produce summaries (e.g. some
-  // hosted models expose none), and cheap at the default effort. forwardEvent renders them.
-  args.push('-c', 'model_reasoning_summary=auto');
-  // Browser tools: register the bridge's MCP server as a stdio MCP server (the
-  // bridge binary in --mcp-stdio mode), so Codex can call our page-action tools.
-  // `-c key=value` parses value as TOML; JSON.stringify yields valid TOML here.
-  args.push(...codexMcpConfigArgs(options.mcp));
-  if (options.model) args.push('-m', options.model);
-  // Drop caller extras that would re-open the sandbox/approval boundary (shared sanitizer).
-  pushExtraArgs(args, options.extraArgs, FORBIDDEN.codex, emit);
-  for (const f of imageFiles) args.push('-i', f); // attach images to the initial prompt
-  args.push('-');
-
-  // Default: use the user's skills/config. Opt-out → isolated home.
-  const useLocal = options.useLocalConfig !== false;
-  const env = { ...process.env };
-  if (!useLocal) {
-    const home = ensureIsolatedHome();
-    if (home) env.CODEX_HOME = home;
-  }
-
-  await new Promise((resolve, reject) => {
+// A single `codex exec` attempt. Resolves with how it ended rather than emitting the final
+// message itself, so the caller can decide whether the run is worth ATTEMPTING AGAIN — the
+// terminal delta/done belongs to whichever attempt actually answered.
+function runCodex({ args, cwd, env, prompt, outFile, emit, signal }) {
+  return new Promise((resolve, reject) => {
     let child;
     try {
       child = spawn('codex', args, { cwd, stdio: ['pipe', 'pipe', 'pipe'], env, ...spawnGroupOpts });
     } catch (e) {
-      cleanupImages();
       return reject(new Error(`Failed to start codex: ${e.message}`));
     }
 
@@ -186,6 +183,13 @@ export async function chat({ messages, system, options, images }, emit, { signal
 
     let stdout = '';
     let stderr = '';
+    // Retrying is only honest while nothing the user can see has been produced. Status lines
+    // are ours and are replaceable; a delta, a tool call or a reasoning summary is not.
+    let streamed = false;
+    const relay = (ev) => {
+      if (ev?.type !== 'status') streamed = true;
+      emit(ev);
+    };
     // Per-run event state: correlate a command's started/completed events and emit each
     // reasoning summary once (Codex sends the same item id across item.started/updated/completed).
     const evState = { started: new Set(), reasoned: new Set(), n: 0 };
@@ -208,7 +212,7 @@ export async function chat({ messages, system, options, images }, emit, { signal
         stdout = stdout.slice(nl + 1);
         if (!line.startsWith('{')) continue;
         try {
-          forwardEvent(JSON.parse(line), emit, evState);
+          forwardEvent(JSON.parse(line), relay, evState);
         } catch {
           /* not a JSON event line */
         }
@@ -218,7 +222,6 @@ export async function chat({ messages, system, options, images }, emit, { signal
     child.on('error', (e) => {
       clearTimeout(idleTimer);
       detach();
-      cleanupImages();
       reject(e);
     });
     child.on('close', async (code) => {
@@ -231,22 +234,98 @@ export async function chat({ messages, system, options, images }, emit, { signal
         /* no message file */
       }
       unlink(outFile).catch(() => {});
-      cleanupImages();
-      if (signal?.aborted) { resolve(); return; } // Stop pressed — end quietly, no error
-      if (code === 0) {
-        emit({ type: 'delta', text: text || '(no output)' });
-        emit({ type: 'done', text: '' });
-        resolve();
-      } else {
-        reject(new Error(`Codex exited ${code}: ${stderr.trim() || 'failed'}`));
-      }
+      resolve({ code, stderr, text, streamed });
     });
 
-    child.stdin.write(buildCliPrompt(messages, system));
+    child.stdin.write(prompt);
     child.stdin.end();
   });
 }
 
+export async function chat({ messages, system, options, images }, emit, { signal } = {}) {
+  const tag = `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+  const outFile = path.join(os.tmpdir(), `chatpanel-codex-${tag}.txt`);
+  const imageFiles = await writeImages(images, tag);
+  const cleanupImages = () => imageFiles.forEach((f) => unlink(f).catch(() => {}));
+
+  const cwd = resolveWorkdir(options.workingDir);
+  // Sanitized once, not per attempt — pushExtraArgs emits a status when it drops something,
+  // and a retry must not say it twice.
+  const extraArgs = [];
+  pushExtraArgs(extraArgs, options.extraArgs, FORBIDDEN.codex, emit);
+
+  const buildArgs = (disabled) => {
+    const args = ['exec', '--json', '--skip-git-repo-check', '-o', outFile];
+    // Headless exec has no human to approve actions. With MCP/browser tools armed
+    // Codex would otherwise raise an approval prompt it can't show — and cancel the
+    // tool call. So in bypassPermissions (full autonomy, what "Act on page" needs)
+    // use the all-in bypass flag, which also clears MCP-tool approval. Lower modes
+    // keep the sandbox + never-ask, which auto-runs within bounds.
+    if (options.permissionMode === 'bypassPermissions') {
+      args.push('--dangerously-bypass-approvals-and-sandbox');
+    } else {
+      const sandbox = options.permissionMode === 'acceptEdits' ? 'workspace-write' : 'read-only';
+      args.push('-s', sandbox, '-c', 'approval_policy=never');
+    }
+    if (REASONING) args.push('-c', `model_reasoning_effort=${REASONING}`);
+    // Ask Codex to emit reasoning SUMMARIES so the panel can stream the model's thinking.
+    // Additive + safe: a no-op for models/providers that don't produce summaries (e.g. some
+    // hosted models expose none), and cheap at the default effort. forwardEvent renders them.
+    args.push('-c', 'model_reasoning_summary=auto');
+    // Browser tools: register the bridge's MCP server as a stdio MCP server (the
+    // bridge binary in --mcp-stdio mode), so Codex can call our page-action tools.
+    // `-c key=value` parses value as TOML; JSON.stringify yields valid TOML here.
+    args.push(...codexMcpConfigArgs(options.mcp));
+    // ...and the other direction: the user's own servers we've been told to leave out.
+    args.push(...codexDisableArgs(disabled));
+    if (options.model) args.push('-m', options.model);
+    // Drop caller extras that would re-open the sandbox/approval boundary (shared sanitizer).
+    args.push(...extraArgs);
+    for (const f of imageFiles) args.push('-i', f); // attach images to the initial prompt
+    args.push('-');
+    return args;
+  };
+
+  // Default: use the user's skills/config. Opt-out → isolated home.
+  const useLocal = options.useLocalConfig !== false;
+  const env = { ...process.env };
+  if (!useLocal) {
+    const home = ensureIsolatedHome();
+    if (home) env.CODEX_HOME = home;
+  }
+
+  const ownServer = options.mcp?.serverName || 'chatpanel_browser';
+  // Only servers Codex already knows about can be switched off — see configuredMcpServers.
+  const known = configuredMcpServers(env.CODEX_HOME || process.env.CODEX_HOME || path.join(os.homedir(), '.codex'));
+  let disabled = disabledMcpServers('codex', options, [ownServer]).filter((n) => known.has(n));
+  const prompt = buildCliPrompt(messages, system);
+  const attempt = () => runCodex({ args: buildArgs(disabled), cwd, env, prompt, outFile, emit, signal });
+
+  try {
+    let result = await attempt();
+
+    // The failure this exists for: one of the user's OWN MCP servers could not authenticate
+    // or could not be reached, and took a turn with it that never needed that server. Drop it
+    // and run again — once, out loud, and only while nothing has been streamed.
+    if (!signal?.aborted && result.code !== 0 && !result.streamed) {
+      const drop = planMcpRetry({ agent: 'codex', text: result.stderr, protect: [ownServer], already: disabled });
+      if (drop && known.has(drop.server)) {
+        quarantine('codex', drop.server);
+        emit({ type: 'status', text: `MCP server "${drop.server}" failed to load — ${drop.short}. Skipping it and retrying.` });
+        disabled = [...disabled, drop.server];
+        result = await attempt();
+      }
+    }
+
+    if (signal?.aborted) return; // Stop pressed — end quietly, no error
+    if (result.code !== 0) throw new Error(summarizeCliError('Codex', result.code, result.stderr));
+    emit({ type: 'delta', text: result.text || '(no output)' });
+    emit({ type: 'done', text: '' });
+  } finally {
+    cleanupImages();
+  }
+}
+
 // Translate Codex `exec --json` events into the bridge's streaming vocabulary the panel
 // renders richly. Codex sends item.started (in_progress) then item.completed for each item,
 // reusing the item id — so we correlate a tool's start/done by that id and show its command,

package/src/engines/custom.js

@@ -621,7 +621,7 @@ export async function runSpec(spec, { messages, system, options = {}, images },
         emit({ type: 'done', text: parser.streamed ? '' : parser.finish() });
         resolve();
       } else {
-        reject(new Error(`${label} exited ${code}: ${stderr.trim().split('\n').pop() || 'failed'}`));
+        reject(new Error(summarizeCliError(label, code, stderr)));
       }
     });
 

package/src/events/scopes.js

@@ -17,4 +17,4 @@
 // zero runtime dependencies by design; pulling the capability machinery and the event
 // schema behind it to reach a five-element array would be the transitive-graph mistake
 // the extension's first-paint budget exists to prevent, one repo over.
-export const DATA_SCOPES = Object.freeze(['notes', 'meetings', 'chats', 'page', 'files', 'net']);
+export const DATA_SCOPES = Object.freeze(['notes', 'meetings', 'chats', 'memory', 'page', 'files', 'net']);

package/src/mcp-quarantine.js

@@ -0,0 +1,110 @@
+// Why a turn should not die because a server it never used could not log in.
+//
+// A CLI agent loads EVERY MCP server in the user's own config on every single run. One that
+// cannot authenticate — an expired OAuth token, a VPN-only host seen from a coffee shop —
+// takes the whole turn down with it, even when the question had nothing to do with that
+// server. The user is then told to go re-login to something they never asked for.
+//
+// So: read the failure, name the server, drop it, run again. Two ways in —
+//   1. the user's own deny list (`options.mcpDisabled`), for servers they know they don't
+//      want ChatPanel to load at all; and
+//   2. QUARANTINE — a server that just killed a run is dropped automatically and stays
+//      dropped for the rest of the bridge's session, since it will not have healed in the
+//      twenty seconds before the next message.
+//
+// Two rules keep this honest. It is never silent: dropping a tool without saying so is worse
+// than failing loudly, so the engine emits a status line naming what it skipped. And it never
+// drops ChatPanel's OWN injected server — that one failing is our bug to surface, not a
+// nuisance to route around (silently disabling it would take "Act on page" with it).
+//
+// Engine-agnostic on purpose: Codex renders this as `-c mcp_servers.X.enabled=false`, Claude
+// Code and Copilot as their own flags, but the POLICY — which servers may load this turn —
+// is one decision, made here, not re-derived per engine.
+
+import { mcpFailure } from './cli-errors.js';
+
+// A server that failed is dropped for this long. Long enough that a chat session never pays
+// the same failed startup twice; short enough that reconnecting the VPN and waiting a while
+// brings the server back without restarting the bridge.
+const TTL_MS = Number(process.env.CHATPANEL_MCP_QUARANTINE_MS) || 30 * 60_000;
+
+const dropped = new Map(); // `${agent} ${server}` -> expiry epoch ms
+
+const key = (agent, server) => `${agent} ${server}`;
+
+function prune(now = Date.now()) {
+  for (const [k, expiry] of dropped) if (expiry <= now) dropped.delete(k);
+}
+
+/**
+ * Server names are interpolated into a config override key (`mcp_servers.<name>.enabled`),
+ * so they are validated rather than escaped: anything that isn't a plain MCP server name is
+ * dropped. Dots are excluded too — Codex's `-c` parser reads them as further path segments
+ * and rejects the quoted form. Accepts an array or a comma/space-separated string (what the
+ * settings field holds).
+ */
+const NAME_RE = /^[A-Za-z0-9_-]{1,64}$/;
+
+/** One name, validated whole — no splitting, so junk is rejected rather than chopped valid. */
+export function validName(value) {
+  const name = String(value || '').trim();
+  return NAME_RE.test(name) ? name : null;
+}
+
+export function normalizeNames(value) {
+  const list = Array.isArray(value) ? value : String(value || '').split(/[,\s]+/);
+  const out = [];
+  for (const raw of list) {
+    const name = validName(raw);
+    if (name && !out.includes(name)) out.push(name);
+  }
+  return out;
+}
+
+/** The servers currently quarantined for an agent. */
+export function quarantined(agent) {
+  prune();
+  const prefix = key(agent, '');
+  return [...dropped.keys()].filter((k) => k.startsWith(prefix)).map((k) => k.slice(prefix.length));
+}
+
+/** Drop a server for this agent. Returns false when it was already dropped. */
+export function quarantine(agent, server) {
+  const name = validName(server);
+  if (!name) return false;
+  const k = key(agent, name);
+  const fresh = !dropped.has(k);
+  dropped.set(k, Date.now() + TTL_MS);
+  return fresh;
+}
+
+/** Test seam — the store is process-global by design. */
+export function resetQuarantine() {
+  dropped.clear();
+}
+
+/**
+ * Every server this run must not load: the user's deny list plus anything quarantined,
+ * minus the servers ChatPanel itself injected (never route around our own).
+ */
+export function disabledMcpServers(agent, options = {}, protect = []) {
+  const guard = new Set(normalizeNames(protect));
+  const names = [...normalizeNames(options.mcpDisabled), ...quarantined(agent)];
+  return [...new Set(names)].filter((n) => !guard.has(n));
+}
+
+/**
+ * Should this failed run be retried without one of the agent's own MCP servers?
+ * Returns the server to drop, or null — and null is the safe answer: a failure that names no
+ * server, or names one we already dropped, means retrying would only fail the same way.
+ * @returns {{server: string, kind: string, short: string}|null}
+ */
+export function planMcpRetry({ agent = '', text = '', protect = [], already = [] } = {}) {
+  const failure = mcpFailure(text);
+  if (!failure?.server) return null;
+  if (!validName(failure.server)) return null; // a name we could never write as an override
+  if (normalizeNames(protect).includes(failure.server)) return null;
+  if (normalizeNames(already).includes(failure.server)) return null;
+  if (quarantined(agent).includes(failure.server)) return null;
+  return { server: failure.server, kind: failure.kind, short: failure.short };
+}

package/src/server.js

@@ -67,7 +67,7 @@ import {
 // Hardcoded (not read from package.json) so it survives Bun's single-file
 // --compile, where package.json isn't on a readable FS. CI fails the publish if
 // this drifts from package.json, so the two can't silently diverge.
-const VERSION = '0.10.40';
+const VERSION = '0.10.42';
 const HOST = process.env.CHATPANEL_BRIDGE_HOST || '127.0.0.1';
 const PORT = Number(process.env.CHATPANEL_BRIDGE_PORT) || 4319;