@cnwenf/occ 2.1.328 → 2.1.330

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-globalThis.MACRO={"VERSION":"2.1.328","BINARY_NAME":"occ","BUILD_TIME":"2026-09-10T19:48:17.557Z","FEEDBACK_CHANNEL":"","ISSUES_EXPLAINER":"","NATIVE_PACKAGE_URL":"","PACKAGE_URL":"@cnwenf/occ","VERSION_CHANGELOG":""};
+globalThis.MACRO={"VERSION":"2.1.330","BINARY_NAME":"occ","BUILD_TIME":"2026-09-12T00:55:03.697Z","FEEDBACK_CHANNEL":"","ISSUES_EXPLAINER":"","NATIVE_PACKAGE_URL":"","PACKAGE_URL":"@cnwenf/occ","VERSION_CHANGELOG":""};
 // @bun
 var __create = Object.create;
 var __getProtoOf = Object.getPrototypeOf;
@@ -59707,6 +59707,22 @@ var init_types2 = __esm(() => {
     prUrlTemplate: exports_external.string().optional().describe('URL template for the footer PR badge (e.g. "https://internal-review.example.com/pr/{number}"). Uses {number} as the PR number placeholder. Defaults to github.com.'),
     alwaysThinkingEnabled: exports_external.boolean().optional().describe("When false, thinking is disabled. When absent or true, thinking is " + "enabled automatically for supported models."),
     effortLevel: exports_external.enum(["low", "medium", "high", "xhigh"]).optional().catch(undefined).describe("Persisted effort level for supported models."),
+    maxEffortLevel: exports_external.enum(["low", "medium", "high", "xhigh", "max"]).optional().catch(undefined).describe("Maximum effort level. Anything above it (an /effort or /model pick, --effort, CLAUDE_CODE_EFFORT_LEVEL, a model default) is clamped to it, on every provider including Bedrock, Vertex and Foundry. Combines with an organization's per-model effort cap by taking the lower of the two; across settings files the lowest value wins, and modelSettings.<model>.maxEffortLevel replaces it per model. Enforced client-side: an effort supplied through CLAUDE_CODE_EXTRA_BODY is not clamped."),
+    modelSettings: exports_external.preprocess((value) => {
+      if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return value;
+      }
+      const stripped = {};
+      for (const [key, entry] of Object.entries(value)) {
+        if (!Object.hasOwn(Object.prototype, key)) {
+          stripped[key] = entry;
+        }
+      }
+      return stripped;
+    }, exports_external.record(exports_external.string(), exports_external.object({
+      effortLevel: exports_external.enum(["low", "medium", "high", "xhigh"]).optional().catch(undefined).describe("Persisted effort level for this model."),
+      maxEffortLevel: exports_external.enum(["low", "medium", "high", "xhigh", "max"]).optional().catch(undefined).describe('Maximum effort level for this model. Within one settings file it replaces the top-level maxEffortLevel for the model ("max" exempts it); across settings files the lowest applicable value wins. Keyed like effortLevel: the canonical model name also matches its dated, [1m], Bedrock and Vertex spellings.')
+    }).passthrough().optional().catch(undefined))).optional().catch(undefined).describe("Per-model settings keyed by canonical model name."),
     dynamicWorkflowSize: exports_external.enum(["small", "medium", "large"]).optional().catch(undefined).describe("Advisory guideline for how large Claude makes dynamic workflows (small/medium/large agent counts). Not an enforced cap."),
     advisorModel: exports_external.string().optional().describe("Advisor model for the server-side advisor tool."),
     fastMode: exports_external.boolean().optional().describe("When true, fast mode is enabled. When absent or false, fast mode is off."),
@@ -203580,12 +203596,15 @@ function isPathInSandboxWriteAllowlist(resolvedPath) {
 }
 function isPathAllowed(resolvedPath, context4, operationType, precomputedPathsToCheck) {
   const permissionType = operationType === "read" ? "read" : "edit";
-  const denyRule = matchingRuleForInput(resolvedPath, context4, permissionType, "deny");
-  if (denyRule !== null) {
-    return {
-      allowed: false,
-      decisionReason: { type: "rule", rule: denyRule }
-    };
+  const pathsToCheck = precomputedPathsToCheck ?? getPathsForPermissionCheck(resolvedPath);
+  for (const pathToCheck of pathsToCheck) {
+    const denyRule = matchingRuleForInput(pathToCheck, context4, permissionType, "deny");
+    if (denyRule !== null) {
+      return {
+        allowed: false,
+        decisionReason: { type: "rule", rule: denyRule }
+      };
+    }
   }
   if (operationType !== "read") {
     const internalEditResult = checkEditableInternalPath(resolvedPath, {});
@@ -203938,6 +203957,122 @@ var init_thinking = __esm(() => {
   ];
 });
 
+// src/utils/effort/cap.ts
+function effortLevelIndex(level) {
+  return EFFORT_LEVELS.indexOf(level);
+}
+function isKnownEffortLevel(value) {
+  return typeof value === "string" && EFFORT_LEVELS.includes(value);
+}
+function getSettingsEffortCap(model) {
+  const sources = getEnabledSettingSources().map((source) => getSettingsForSource(source));
+  const canonicalTarget = sources.some((settings) => Object.values(settings?.modelSettings ?? {}).some((entry) => entry?.maxEffortLevel !== undefined)) ? getCanonicalName(model) : undefined;
+  let lowest = null;
+  for (const settings of sources) {
+    if (!settings)
+      continue;
+    let perFile;
+    if (canonicalTarget !== undefined) {
+      for (const [key, entry] of Object.entries(settings.modelSettings ?? {})) {
+        if (Object.hasOwn(Object.prototype, key))
+          continue;
+        const candidate = entry?.maxEffortLevel;
+        if (candidate !== undefined && (perFile === undefined || effortLevelIndex(candidate) < effortLevelIndex(perFile)) && getCanonicalName(key) === canonicalTarget) {
+          perFile = candidate;
+        }
+      }
+    }
+    perFile ??= settings.maxEffortLevel;
+    if (perFile !== undefined && perFile !== "max" && (lowest === null || effortLevelIndex(perFile) < effortLevelIndex(lowest))) {
+      lowest = perFile;
+    }
+  }
+  return lowest;
+}
+function getEffectiveEffortCap(model) {
+  const cap = getSettingsEffortCap(model);
+  return cap === "max" ? null : cap;
+}
+function isEffortLevelAllowed(level, model) {
+  const cap = getEffectiveEffortCap(model);
+  return cap === null || effortLevelIndex(level) <= effortLevelIndex(cap);
+}
+function getAllowedEffortLevels(model) {
+  return EFFORT_LEVELS.filter((level) => isEffortLevelAllowed(level, model));
+}
+function modelSupportsEffortLevel(model, level) {
+  if (level === "xhigh")
+    return modelSupportsXhighEffort(model);
+  if (level === "max")
+    return modelSupportsMaxEffort(model);
+  return true;
+}
+function clampEffortToCap(value, model) {
+  const cap = getEffectiveEffortCap(model);
+  if (cap !== null && isKnownEffortLevel(value)) {
+    return effortLevelIndex(value) > effortLevelIndex(cap) ? cap : value;
+  }
+  return value;
+}
+function applyEffortCapabilityDowngrade(value, model) {
+  let result = value;
+  if (result === "max" && !modelSupportsMaxEffort(model))
+    result = "high";
+  if (result === "xhigh" && !modelSupportsXhighEffort(model))
+    result = "high";
+  return result;
+}
+function clampEffortValue(value, model) {
+  return applyEffortCapabilityDowngrade(clampEffortToCap(value, model), model);
+}
+function hasEffortLevelsAboveCap(model) {
+  const cap = getEffectiveEffortCap(model);
+  if (cap === null)
+    return false;
+  return EFFORT_LEVELS.some((level) => effortLevelIndex(level) > effortLevelIndex(cap) && modelSupportsEffortLevel(model, level));
+}
+function getEffortCapWarning(requested, model) {
+  if (!isKnownEffortLevel(requested))
+    return null;
+  const cap = getEffectiveEffortCap(model);
+  if (cap === null || effortLevelIndex(requested) <= effortLevelIndex(cap)) {
+    return null;
+  }
+  const using = clampEffortValue(requested, model);
+  return `Effort '${requested}' exceeds the cap for ${model} set by your settings or organization; using '${using}'.`;
+}
+function emitStartupEffortCapWarning(requestedEffort, model, outputFormat) {
+  const warning = getEffortCapWarning(requestedEffort, model);
+  if (warning === null)
+    return;
+  if (outputFormat !== "json" && outputFormat !== "stream-json" && process.env.CLAUDE_CODE_SESSION_KIND !== "bg") {
+    console.warn(source_default.yellow(warning));
+    return;
+  }
+  logForDebugging(`[effort] ${warning}`);
+}
+function isUltracodeAvailableForModel(model) {
+  return model === undefined || modelSupportsXhighEffort(model) && isEffortLevelAllowed("xhigh", model);
+}
+function formatEffortValidOptions(model) {
+  const levels = getAllowedEffortLevels(model);
+  const ultracode = isUltracodeAvailableForModel(model) ? ", ultracode" : "";
+  return `${levels.join(", ")}${ultracode}, auto`;
+}
+function buildEffortArgumentHint(open6, close, model) {
+  const levels = getAllowedEffortLevels(model);
+  const ultracode = isUltracodeAvailableForModel(model) ? "|ultracode" : "";
+  return `${open6}${levels.join("|")}${ultracode}|auto${close}`;
+}
+var init_cap = __esm(() => {
+  init_source();
+  init_debug();
+  init_model();
+  init_constants2();
+  init_settings2();
+  init_effort();
+});
+
 // src/utils/effort.ts
 function modelSupportsEffort(model) {
   const m5 = model.toLowerCase();
@@ -204026,24 +204161,30 @@ function getEffortEnvOverride() {
 }
 function resolveAppliedEffort(model, appStateEffortValue) {
   const envOverride = getEffortEnvOverride();
-  if (envOverride === null) {
+  const hasSettingsCap = getSettingsEffortCap(model) !== null;
+  if (envOverride === null && !hasSettingsCap) {
     return;
   }
-  const resolved = envOverride ?? appStateEffortValue ?? getDefaultEffortForModel(model);
-  if (resolved === "max" && !modelSupportsMaxEffort(model)) {
-    return "high";
+  const modelDefault = getDefaultEffortForModel(model);
+  let resolved = envOverride ?? (envOverride === null ? modelDefault : undefined) ?? appStateEffortValue ?? modelDefault;
+  if (typeof resolved === "number" && hasSettingsCap) {
+    resolved = "high";
   }
-  if (resolved === "xhigh" && !modelSupportsXhighEffort(model)) {
-    return "high";
+  if (resolved === undefined) {
+    return;
   }
-  return resolved;
+  return clampEffortValue(resolved, model);
 }
 function resolveConfiguredEffort(model, appStateEffortValue) {
   const envOverride = getEffortEnvOverride();
   if (envOverride === null) {
     return;
   }
-  return envOverride ?? appStateEffortValue ?? getDefaultEffortForModel(model);
+  const resolved = envOverride ?? appStateEffortValue ?? getDefaultEffortForModel(model);
+  if (resolved === undefined) {
+    return;
+  }
+  return clampEffortToCap(resolved, model);
 }
 function getDisplayedEffortLevel(model, appStateEffort) {
   const configured = resolveConfiguredEffort(model, appStateEffort) ?? "high";
@@ -204148,6 +204289,7 @@ var init_effort = __esm(() => {
   init_providers();
   init_modelSupportOverrides();
   init_envUtils();
+  init_cap();
   EFFORT_LEVELS = [
     "low",
     "medium",
@@ -377344,43 +377486,40 @@ function getMaxBashTimeoutMs(env6 = process.env) {
 var DEFAULT_TIMEOUT_MS = 120000, MAX_TIMEOUT_MS = 600000;
 
 // src/utils/todoToolsAvailability.ts
-function isModelAtOrAboveRestrictedThreshold(modelId, restricted) {
-  const match = /^claude-([a-z]+)-(\d+(?:-\d+)*)$/.exec(modelId);
-  const family = match?.[1];
-  const version5 = match?.[2];
-  if (!family || !version5) {
-    return false;
-  }
-  const threshold = restricted.find(([f4]) => f4 === family)?.[1];
-  if (!threshold) {
-    return false;
-  }
-  const segments = version5.split("-").map(Number);
-  for (let i6 = 0;i6 < Math.max(segments.length, threshold.length); i6++) {
-    const diff2 = (segments[i6] ?? 0) - (threshold[i6] ?? 0);
-    if (diff2 !== 0) {
-      return diff2 > 0;
-    }
-  }
-  return true;
-}
 function areTodoToolsAvailable() {
   const model = getMainLoopModel();
-  if (!isModelAtOrAboveRestrictedThreshold(model, TODO_TOOL_RESTRICTED_MODELS)) {
+  if (model === undefined) {
+    return true;
+  }
+  if (model.includes("application-inference-profile")) {
+    return true;
+  }
+  if (TODO_TOOL_ALLOWED_MODELS.has(model)) {
     return true;
   }
   return isEnvTruthy(process.env.CLAUDE_CODE_ENABLE_TODO_TOOLS);
 }
-var TODO_TOOL_RESTRICTED_MODELS;
+var TODO_TOOL_ALLOWED_MODELS;
 var init_todoToolsAvailability = __esm(() => {
   init_envUtils();
   init_model();
-  TODO_TOOL_RESTRICTED_MODELS = [
-    ["opus", [4, 8]],
-    ["sonnet", [5]],
-    ["fable", [5]],
-    ["mythos", [5]]
-  ];
+  TODO_TOOL_ALLOWED_MODELS = new Set([
+    "claude-3-opus",
+    "claude-3-sonnet",
+    "claude-3-haiku",
+    "claude-3-5-sonnet",
+    "claude-3-5-haiku",
+    "claude-3-7-sonnet",
+    "claude-opus-4-0",
+    "claude-opus-4-1",
+    "claude-opus-4-5",
+    "claude-opus-4-6",
+    "claude-opus-4-7",
+    "claude-sonnet-4-0",
+    "claude-sonnet-4-5",
+    "claude-sonnet-4-6",
+    "claude-haiku-4-5"
+  ]);
 });
 
 // src/utils/todo/types.ts
@@ -387587,6 +387726,518 @@ var init_common4 = __esm(() => {
   trackedTabIds = new Set;
 });
 
+// src/services/mcp/redaction.ts
+function splitEnvVarSegments(template) {
+  const segments = [];
+  let cursor = 0;
+  for (const match of template.matchAll(new RegExp(ENV_VAR_PATTERN, "g"))) {
+    segments.push(template.slice(cursor, match.index));
+    cursor = match.index + match[0].length;
+  }
+  segments.push(template.slice(cursor));
+  return segments;
+}
+function redactEnvVarPlaceholders(value) {
+  return value.replace(new RegExp(ENV_VAR_PATTERN, "g"), (match) => "x".repeat(match.length));
+}
+function normalizeEnvVarRefs(value) {
+  return value.replace(new RegExp(ENV_VAR_PATTERN, "g"), (_match, name3) => `\${${name3}}`);
+}
+function escapeRegExp2(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function recoverExpandedSecrets(template, expanded) {
+  if (!template || !expanded || !template.includes("${"))
+    return [];
+  const segments = splitEnvVarSegments(template);
+  if (segments.length < 2)
+    return [];
+  if (expanded.length > MAX_RECOVER_EXPANDED_LENGTH || segments.length > MAX_RECOVER_SEGMENTS)
+    return [];
+  const escapedSegments = segments.map(escapeRegExp2);
+  const secrets = [];
+  if (segments.length === 2) {
+    const [prefix = "", suffix = ""] = segments;
+    if (expanded.length >= prefix.length + suffix.length && expanded.startsWith(prefix) && expanded.endsWith(suffix))
+      secrets.push(expanded.slice(prefix.length, expanded.length - suffix.length));
+  } else if (segments.length === 3) {
+    const [prefix = "", middle = "", suffix = ""] = segments;
+    if (expanded.startsWith(prefix) && expanded.endsWith(suffix)) {
+      const inner = expanded.slice(prefix.length, expanded.length - suffix.length);
+      if (middle === "")
+        secrets.push(inner);
+      else {
+        const positions = [];
+        for (let idx = inner.indexOf(middle);idx !== -1 && positions.length <= MAX_MIDDLE_OCCURRENCES; idx = inner.indexOf(middle, idx + 1))
+          positions.push(idx);
+        const chosen = positions.length > MAX_MIDDLE_OCCURRENCES ? [positions[0] ?? 0, inner.lastIndexOf(middle)] : positions;
+        for (const position2 of chosen)
+          secrets.push(inner.slice(0, position2), inner.slice(position2 + middle.length));
+      }
+    }
+  } else {
+    for (let i6 = 1;i6 < segments.length - 1; i6++)
+      if (segments[i6] === "")
+        return [];
+    let pattern = "^";
+    for (let i6 = 0;i6 < escapedSegments.length; i6++) {
+      pattern += escapedSegments[i6];
+      if (i6 < escapedSegments.length - 1) {
+        const next = segments[i6 + 1] ?? "";
+        if (next === "")
+          pattern += "([\\s\\S]*)";
+        else {
+          const firstChar = next.charAt(0).replace(/[.*+?^${}()|[\]-]/g, "\\$&");
+          pattern += `([^${firstChar}]*)`;
+        }
+      }
+    }
+    const match = expanded.match(new RegExp(`${pattern}$`));
+    if (match)
+      secrets.push(...match.slice(1).filter((secret) => secret !== ""));
+  }
+  return [...new Set(secrets)];
+}
+function collectConfigSecrets(authored, resolved) {
+  if (!authored)
+    return [];
+  const secrets = [];
+  const collect = (template, expanded) => {
+    if (typeof template === "string" && typeof expanded === "string")
+      secrets.push(...recoverExpandedSecrets(template, expanded));
+  };
+  if ("url" in authored && "url" in resolved)
+    collect(authored.url, resolved.url);
+  if ("command" in authored && "command" in resolved) {
+    collect(authored.command, resolved.command);
+    const authoredArgs = Array.isArray(authored.args) ? authored.args : [];
+    const resolvedArgs = Array.isArray(resolved.args) ? resolved.args : [];
+    for (let i6 = 0;i6 < Math.min(authoredArgs.length, resolvedArgs.length); i6++)
+      collect(authoredArgs[i6], resolvedArgs[i6]);
+  }
+  for (const field of ["headers", "env"]) {
+    const authoredRecord = field in authored ? authored[field] : undefined;
+    const resolvedRecord = field in resolved ? resolved[field] : undefined;
+    if (authoredRecord && resolvedRecord && typeof authoredRecord === "object" && typeof resolvedRecord === "object")
+      for (const [key2, value] of Object.entries(authoredRecord))
+        collect(value, resolvedRecord[key2]);
+  }
+  return secrets;
+}
+function matchesEnvVarTemplate(template, expanded) {
+  const segments = splitEnvVarSegments(template);
+  if (segments.length === 1)
+    return template === expanded;
+  const prefix = segments[0] ?? "";
+  const suffix = segments.at(-1) ?? "";
+  if (!expanded.startsWith(prefix) || !expanded.endsWith(suffix))
+    return false;
+  let cursor = prefix.length;
+  const limit = expanded.length - suffix.length;
+  for (let i6 = 1;i6 < segments.length - 1; i6++) {
+    const segment2 = segments[i6] ?? "";
+    const idx = expanded.indexOf(segment2, cursor);
+    if (idx === -1 || idx + segment2.length > limit)
+      return false;
+    cursor = idx + segment2.length;
+  }
+  return cursor <= limit;
+}
+function recordField(config6, field) {
+  const value = config6[field];
+  return value && typeof value === "object" ? value : undefined;
+}
+function recordFieldsMatch(authored, expanded) {
+  const authoredEntries = Object.entries(authored ?? {});
+  const expandedRecord = expanded ?? {};
+  if (authoredEntries.length !== Object.keys(expandedRecord).length)
+    return false;
+  return authoredEntries.every(([key2, value]) => typeof expandedRecord[key2] === "string" && matchesEnvVarTemplate(value, expandedRecord[key2]));
+}
+function isWebUrl(url3) {
+  if (!URL.canParse(url3))
+    return false;
+  const { protocol } = new URL(url3);
+  return protocol === "http:" || protocol === "https:" || protocol === "ws:" || protocol === "wss:";
+}
+function getServerUrl(config6) {
+  return "url" in config6 ? config6.url : null;
+}
+function getStdioCommandParts(config6) {
+  if (config6.type !== undefined && config6.type !== "stdio")
+    return null;
+  if (!("command" in config6))
+    return null;
+  return [config6.command, ...config6.args ?? []];
+}
+function getServerTypeLabel(config6) {
+  return config6.type ?? ("command" in config6 ? "stdio" : "unknown");
+}
+function splitUrlParts(url3, maskedUrl = url3) {
+  const findSplit = (from) => {
+    let end2 = url3.length;
+    for (const delimiter2 of ["/", "?", "#", "\\"]) {
+      const idx = maskedUrl.indexOf(delimiter2, from);
+      if (idx !== -1 && idx < end2)
+        end2 = idx;
+    }
+    return end2;
+  };
+  const schemeSeparator = maskedUrl.indexOf("://");
+  const start = schemeSeparator !== -1 && schemeSeparator < findSplit(0) && /^[A-Za-z][A-Za-z0-9+.-]*$/.test(maskedUrl.slice(0, schemeSeparator)) ? schemeSeparator + 3 : 0;
+  const end = findSplit(start);
+  return {
+    scheme: url3.slice(0, start),
+    authority: url3.slice(start, end),
+    rest: url3.slice(end)
+  };
+}
+function authorityHasEnvVarRef(url3) {
+  return splitUrlParts(url3, redactEnvVarPlaceholders(url3)).authority.includes("${");
+}
+function authoredMatchesExpanded(authored, expanded) {
+  if ((authored.type ?? "stdio") !== (expanded.type ?? "stdio"))
+    return false;
+  const authoredUrl = getServerUrl(authored);
+  const expandedUrl = getServerUrl(expanded);
+  if (authoredUrl !== null || expandedUrl !== null) {
+    const urlsMatchTemplate = (a5, r4) => {
+      const masked = redactEnvVarPlaceholders(a5);
+      const authoredParts = splitUrlParts(a5, masked);
+      const expandedParts = splitUrlParts(r4);
+      const isAllPlaceholder = (value) => splitEnvVarSegments(value).every((segment2) => segment2 === "");
+      if (isAllPlaceholder(a5))
+        return true;
+      if (authoredParts.scheme === "" && isAllPlaceholder(authoredParts.authority))
+        return matchesEnvVarTemplate(a5, r4);
+      const maskedAt = splitUrlParts(masked).authority.lastIndexOf("@");
+      const expandedAt = expandedParts.authority.lastIndexOf("@");
+      if (maskedAt === -1 !== (expandedAt === -1))
+        return false;
+      if (authoredParts.scheme === "")
+        return expandedParts.scheme === "" && !isWebUrl(r4) && matchesEnvVarTemplate(a5, r4);
+      if (expandedParts.scheme === "")
+        return false;
+      return matchesEnvVarTemplate(authoredParts.scheme.toLowerCase(), expandedParts.scheme.toLowerCase()) && (maskedAt === -1 || matchesEnvVarTemplate(authoredParts.authority.slice(0, maskedAt), expandedParts.authority.slice(0, expandedAt))) && matchesEnvVarTemplate(authoredParts.authority.slice(maskedAt + 1), expandedParts.authority.slice(expandedAt + 1)) && matchesEnvVarTemplate(authoredParts.rest, expandedParts.rest);
+    };
+    if (authoredUrl === null || expandedUrl === null)
+      return false;
+    if (!urlsMatchTemplate(authoredUrl, expandedUrl))
+      return false;
+  }
+  const authoredCommand = getStdioCommandParts(authored);
+  const expandedCommand = getStdioCommandParts(expanded);
+  if (authoredCommand !== null || expandedCommand !== null) {
+    if (authoredCommand === null || expandedCommand === null || authoredCommand.length !== expandedCommand.length || !authoredCommand.every((part, i6) => matchesEnvVarTemplate(part, expandedCommand[i6] ?? "")))
+      return false;
+  }
+  return recordFieldsMatch(recordField(authored, "headers"), recordField(expanded, "headers")) && recordFieldsMatch(recordField(authored, "env"), recordField(expanded, "env"));
+}
+function getUrlOrigin(url3) {
+  try {
+    const origin2 = new URL(url3).origin;
+    return origin2 === "null" ? undefined : origin2;
+  } catch {
+    return;
+  }
+}
+function maskUrlUserinfo(url3) {
+  const masked = redactEnvVarPlaceholders(url3);
+  const { scheme, authority } = splitUrlParts(masked);
+  const schemeLength = scheme.length;
+  const authorityEnd = schemeLength + authority.length;
+  if (masked.includes("@", authorityEnd))
+    return `${normalizeEnvVarRefs(url3.slice(0, schemeLength))}[unparseable-authority]`;
+  const at = authority.lastIndexOf("@");
+  const userinfo = url3.slice(at === -1 ? schemeLength : schemeLength + at + 1, authorityEnd);
+  if (userinfo === "")
+    return;
+  return normalizeEnvVarRefs(url3.slice(0, schemeLength) + userinfo);
+}
+function getEndpointForDisplay(params) {
+  const { authoredUnexpanded: authored, expanded } = params;
+  const detail = params.detail ?? "endpoint";
+  if (authored) {
+    const url3 = getServerUrl(authored);
+    if (url3) {
+      if (detail === "endpoint")
+        return normalizeEnvVarRefs(url3);
+      if (authorityHasEnvVarRef(url3))
+        return maskUrlUserinfo(url3);
+      return getUrlOrigin(url3) ?? maskUrlUserinfo(url3);
+    }
+    const commandParts = getStdioCommandParts(authored);
+    if (commandParts)
+      return detail === "endpoint" ? normalizeEnvVarRefs(commandParts.join(" ")) : undefined;
+    return detail === "endpoint" ? getServerTypeLabel(authored) : undefined;
+  }
+  const expandedUrl = getServerUrl(expanded);
+  if (expandedUrl) {
+    const origin2 = getUrlOrigin(expandedUrl);
+    if (origin2 !== undefined)
+      return origin2;
+  }
+  return detail === "endpoint" ? getServerTypeLabel(expanded) : undefined;
+}
+function deepNormalizeEnvVarRefs(value) {
+  const walk = (current) => typeof current === "string" ? normalizeEnvVarRefs(current) : Array.isArray(current) ? current.map(walk) : current && typeof current === "object" ? Object.fromEntries(Object.entries(current).map(([key2, child]) => [key2, walk(child)])) : current;
+  return walk(value);
+}
+function sanitizeConfigForDisplay(config6) {
+  const typeLabel = getServerTypeLabel(config6);
+  if ("url" in config6) {
+    return {
+      ...config6,
+      url: typeLabel,
+      ..."headers" in config6 && config6.headers && {
+        headers: Object.fromEntries(Object.keys(config6.headers).map((key2) => [key2, "[REDACTED]"]))
+      }
+    };
+  }
+  if ("command" in config6) {
+    return {
+      ...config6,
+      command: typeLabel,
+      ..."args" in config6 && config6.args && { args: [] },
+      ..."env" in config6 && config6.env && {
+        env: Object.fromEntries(Object.keys(config6.env).map((key2) => [key2, "[REDACTED]"]))
+      }
+    };
+  }
+  return config6;
+}
+function getKnownScope(config6) {
+  if (!("scope" in config6))
+    return;
+  const scope = config6.scope;
+  return ConfigScopeSchema().options.find((known) => known === scope);
+}
+function getDisplayServers(servers, resolveUnexpanded) {
+  const resolverCache = new Map;
+  const display = {};
+  for (const [name3, config6] of Object.entries(servers)) {
+    const scope = getKnownScope(config6);
+    if (scope === undefined) {
+      display[name3] = config6;
+      continue;
+    }
+    if (scope === "claudeai") {
+      display[name3] = deepNormalizeEnvVarRefs(config6);
+      continue;
+    }
+    if (!resolverCache.has(scope))
+      resolverCache.set(scope, resolveUnexpanded(scope));
+    const authored = resolverCache.get(scope)?.[name3];
+    display[name3] = authored && authoredMatchesExpanded(authored, config6) ? deepNormalizeEnvVarRefs(authored) : sanitizeConfigForDisplay(config6);
+  }
+  return display;
+}
+function getDisplayConfig(name3, config6, resolveUnexpanded) {
+  return getDisplayServers({ [name3]: config6 }, resolveUnexpanded)[name3] ?? sanitizeConfigForDisplay(config6);
+}
+function registerAuthoredUnexpandedConfig(name3, config6) {
+  authoredUnexpandedRegistry.set(name3, config6);
+}
+function getAuthoredUnexpandedRegistry() {
+  return authoredUnexpandedRegistry;
+}
+function getAuthoredUnexpanded(name3, config6, resolveUnexpanded) {
+  const scope = getKnownScope(config6);
+  if (scope === undefined)
+    return;
+  try {
+    const authored = resolveUnexpanded(scope)?.[name3];
+    return authored && authoredMatchesExpanded(authored, config6) ? authored : undefined;
+  } catch {
+    return;
+  }
+}
+function getMcpErrorEndpoint(name3, config6, options, resolveUnexpanded) {
+  const authored = getAuthoredUnexpanded(name3, config6, resolveUnexpanded);
+  if (authored === undefined && getKnownScope(config6) !== undefined)
+    return options?.detail === "origin" ? undefined : getServerTypeLabel(config6);
+  return getEndpointForDisplay({
+    authoredUnexpanded: authored,
+    expanded: config6,
+    cliOwned: false,
+    detail: options?.detail
+  });
+}
+function isLabelLikeSecret(candidate) {
+  const parts = candidate.split(/[:=\uFF1A\uFF1D]+/).map((part) => part.trim());
+  let matched = 0;
+  for (const [index2, part] of parts.entries()) {
+    if (part === "")
+      continue;
+    const isNonFinalOrFlag = index2 < parts.length - 1 || part.startsWith("-");
+    if (!LABEL_EXACT_PATTERN.test(part) && !(isNonFinalOrFlag && LABEL_SUFFIX_PATTERN.test(part)))
+      return false;
+    matched++;
+  }
+  return matched > 0;
+}
+function redactMcpErrorText(errorText, expanded, endpoint3, authored) {
+  const endpointDisplay = endpoint3 ?? MCP_ENDPOINT_PLACEHOLDER;
+  const registrations = [];
+  const registerSecret = (secret, replacement, options) => {
+    if (secret === undefined)
+      return;
+    if (secret.length < 4)
+      return;
+    if (replacement !== "[redacted]" && replacement.includes(secret))
+      return;
+    registrations.push([secret, replacement, options?.wordBoundary === true]);
+  };
+  const registerRedacted = (secret, replacement = endpointDisplay) => {
+    if (secret === undefined)
+      return;
+    if (replacement.includes(secret) || isLabelLikeSecret(secret.trim()))
+      return;
+    registerSecret(secret, "[redacted]");
+  };
+  const registerWithVariants = (secret, replacement = endpointDisplay) => {
+    if (!secret)
+      return;
+    registerRedacted(secret, replacement);
+    if (secret.includes("+"))
+      registerRedacted(secret.replaceAll("+", " "), replacement);
+    if (secret.includes(" "))
+      registerRedacted(secret.replaceAll(" ", "+"), replacement);
+    for (const variant of [secret, secret.replaceAll("+", " ")]) {
+      const words = variant.split(/\s+/);
+      if (words.length > 1)
+        for (const word of words)
+          registerRedacted(word, replacement);
+    }
+  };
+  const registerUrl = (url3, replacement) => {
+    if (url3 === undefined)
+      return;
+    registerSecret(url3, replacement);
+    try {
+      const parsed = new URL(url3);
+      registerSecret(parsed.href, replacement);
+      if (parsed.origin !== "null")
+        registerSecret(parsed.origin, replacement);
+      registerSecret(parsed.host, replacement);
+      registerSecret(parsed.hostname, replacement);
+      const bareHostname = parsed.hostname.replace(/^\[|\]$/g, "");
+      if (bareHostname !== parsed.hostname)
+        registerSecret(bareHostname, replacement);
+      registerWithVariants(parsed.username, replacement);
+      registerWithVariants(parsed.password, replacement);
+      registerRedacted(parsed.pathname !== "/" ? parsed.pathname : undefined, replacement);
+      for (const segment2 of parsed.pathname.split("/"))
+        registerWithVariants(segment2, replacement);
+      registerRedacted(parsed.search, replacement);
+      for (const [key2, value] of parsed.searchParams.entries()) {
+        registerWithVariants(key2, replacement);
+        registerWithVariants(value, replacement);
+      }
+      for (const pair of parsed.search.replace(/^\?/, "").split("&")) {
+        const eq2 = pair.indexOf("=");
+        if (eq2 === -1)
+          registerWithVariants(pair, replacement);
+        else {
+          registerWithVariants(pair.slice(0, eq2), replacement);
+          registerWithVariants(pair.slice(eq2 + 1), replacement);
+        }
+      }
+    } catch {}
+  };
+  for (const secret of collectConfigSecrets(authored, expanded))
+    registerWithVariants(secret);
+  if ("url" in expanded && typeof expanded.url === "string")
+    registerUrl(expanded.url, endpointDisplay);
+  if ("oauth" in expanded && typeof expanded.oauth?.authServerMetadataUrl === "string") {
+    const metadataUrl = expanded.oauth.authServerMetadataUrl;
+    let replacement = "[redacted]";
+    try {
+      const origin2 = new URL(metadataUrl).origin;
+      if (origin2 !== "null")
+        replacement = origin2;
+    } catch {}
+    registerUrl(metadataUrl, replacement);
+  }
+  if ("command" in expanded && typeof expanded.command === "string") {
+    const authoredCommand = authored && "command" in authored && typeof authored.command === "string" ? normalizeEnvVarRefs(authored.command) : undefined;
+    registerSecret(expanded.command, authoredCommand ?? endpointDisplay, {
+      wordBoundary: true
+    });
+    if (Array.isArray(expanded.args))
+      for (const arg of expanded.args)
+        registerWithVariants(arg);
+  }
+  if ("headers" in expanded && expanded.headers)
+    for (const value of Object.values(expanded.headers))
+      registerWithVariants(value);
+  if ("env" in expanded && expanded.env)
+    for (const value of Object.values(expanded.env))
+      registerWithVariants(value);
+  if ("authToken" in expanded && typeof expanded.authToken === "string")
+    registerWithVariants(expanded.authToken);
+  if (registrations.length === 0)
+    return errorText;
+  registrations.sort((a5, b5) => b5[0].length - a5[0].length);
+  const deduped = new Map;
+  for (const [secret, replacement, wordBoundary] of registrations) {
+    const existing = deduped.get(secret);
+    if (!existing)
+      deduped.set(secret, { replacement, wordBoundary });
+    else if (existing.replacement === "[redacted]" && replacement !== "[redacted]")
+      deduped.set(secret, {
+        replacement,
+        wordBoundary: existing.wordBoundary && wordBoundary
+      });
+  }
+  const spans = [];
+  for (const [secret, entry] of deduped) {
+    const escaped = escapeRegExp2(secret);
+    const pattern = entry.wordBoundary && /^[\w-]+$/.test(secret) ? `(?<![\\w:.-])${escaped}(?![\\w:.-])` : escaped;
+    const regex2 = new RegExp(pattern, "gi");
+    for (let match = regex2.exec(errorText);match !== null; match = regex2.exec(errorText)) {
+      spans.push({
+        start: match.index,
+        end: match.index + match[0].length,
+        replacement: entry.replacement
+      });
+      regex2.lastIndex = match.index + 1;
+    }
+  }
+  spans.sort((a5, b5) => a5.start - b5.start || b5.end - a5.end);
+  const merged = [];
+  for (const span of spans) {
+    const last2 = merged.at(-1);
+    if (last2 && span.start < last2.end)
+      last2.end = Math.max(last2.end, span.end);
+    else
+      merged.push({ ...span });
+  }
+  let result = "";
+  let cursor = 0;
+  for (const span of merged) {
+    result += errorText.slice(cursor, span.start) + span.replacement;
+    cursor = span.end;
+  }
+  result += errorText.slice(cursor);
+  return result;
+}
+function redactMcpErrorDetail(name3, config6, errorText, resolveUnexpanded) {
+  try {
+    return redactMcpErrorText(errorText, config6, getMcpErrorEndpoint(name3, config6, { detail: "origin" }, resolveUnexpanded) ?? getServerTypeLabel(config6), getAuthoredUnexpanded(name3, config6, resolveUnexpanded));
+  } catch {
+    return MCP_ERROR_REDACTION_FAILED;
+  }
+}
+var MCP_ENDPOINT_PLACEHOLDER = "[mcp-endpoint]", MCP_ERROR_REDACTION_FAILED = "[mcp error detail unavailable: redaction failed]", MAX_RECOVER_EXPANDED_LENGTH = 2000, MAX_RECOVER_SEGMENTS = 9, MAX_MIDDLE_OCCURRENCES = 64, ENV_VAR_PATTERN, authoredUnexpandedRegistry, LABEL_EXACT_PATTERN, LABEL_SUFFIX_PATTERN;
+var init_redaction = __esm(() => {
+  init_types();
+  ENV_VAR_PATTERN = String.raw`\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-[^}]*)?\}`;
+  authoredUnexpandedRegistry = new Map;
+  LABEL_EXACT_PATTERN = /^(?:bearer|basic|(?:access|refresh|id|client|api|x[-_]api|session|auth)?[-_ ]?(?:token|key|secret|password|authorization|credential)s?)$/i;
+  LABEL_SUFFIX_PATTERN = /(?:^|[^A-Za-z0-9_\s])(?:bearer|basic|token|key|secret|password|authorization|credential)s?$/i;
+});
+
 // src/utils/plugins/mcpPluginIntegration.ts
 import { join as join78 } from "path";
 async function loadMcpServersFromMcpb(plugin, mcpbPath, errors8) {
@@ -387770,6 +388421,20 @@ function buildMcpUserConfig(plugin, serverName) {
     return;
   return { ...topLevel, ...channelSpecific };
 }
+function buildAuthoredPluginConfig(config6, plugin) {
+  if (config6.type === undefined || config6.type === "stdio") {
+    return {
+      ...config6,
+      env: {
+        CLAUDE_PLUGIN_ROOT: plugin.path,
+        CLAUDE_PLUGIN_DATA: getPluginDataDir(plugin.source),
+        ...config6.env || {}
+      },
+      scope: "dynamic"
+    };
+  }
+  return { ...config6, scope: "dynamic" };
+}
 function resolvePluginMcpEnvironment(config6, plugin, userConfig, errors8, pluginName, serverName) {
   const allMissingVars = [];
   const resolveValue2 = (value) => {
@@ -387859,6 +388524,7 @@ async function getPluginMcpServers(plugin, errors8 = []) {
     const userConfig = buildMcpUserConfig(plugin, name3);
     try {
       resolvedServers[name3] = resolvePluginMcpEnvironment(config6, plugin, userConfig, errors8, plugin.name, name3);
+      registerAuthoredUnexpandedConfig(`plugin:${plugin.name}:${name3}`, buildAuthoredPluginConfig(config6, plugin));
     } catch (err2) {
       errors8?.push({
         type: "generic-error",
@@ -387871,6 +388537,7 @@ async function getPluginMcpServers(plugin, errors8 = []) {
   return addPluginScopeToServers(resolvedServers, plugin.name, plugin.source);
 }
 var init_mcpPluginIntegration = __esm(() => {
+  init_redaction();
   init_types();
   init_debug();
   init_errors();
@@ -387901,25 +388568,6 @@ function markClaudeAiMcpConnected(name3) {
 function isClaudeAiMcpCurrentlyConnected(name3) {
   return currentlyConnectedClaudeAiMcps.has(name3);
 }
-function shouldCountClaudeAiNeedsAuth(client8) {
-  if (client8.config.type !== "claudeai-proxy")
-    return false;
-  const eligible2 = client8.config.eligible;
-  if (eligible2 === false && !isClaudeAiMcpCurrentlyConnected(client8.name)) {
-    return false;
-  }
-  return hasClaudeAiMcpEverConnected(client8.name);
-}
-function getMcpNeedsAuthCount(clients) {
-  return clients.filter((client8) => {
-    if (client8.type !== "needs-auth")
-      return false;
-    if (client8.config.type === "claudeai-proxy") {
-      return shouldCountClaudeAiNeedsAuth(client8);
-    }
-    return client8.config.type !== "sse-ide" && client8.config.type !== "ws-ide";
-  }).length;
-}
 var FETCH_TIMEOUT_MS = 5000, MCP_SERVERS_BETA_HEADER = "mcp-servers-2025-12-04", fetchClaudeAIMcpConfigsIfEligible, currentlyConnectedClaudeAiMcps;
 var init_claudeai = __esm(() => {
   init_axios2();
@@ -388184,18 +388832,22 @@ function mcpServerHealthStatusLabel(result) {
 function isUnconfiguredMcpServer(result) {
   return result.type === "failed" && result.errorCode === "UNCONFIGURED";
 }
+function formatErrorCode(errorCode) {
+  const numeric = Number(errorCode);
+  return errorCode === "23" ? "request timed out" : Number.isInteger(numeric) && numeric >= 100 && numeric <= 599 ? `HTTP ${errorCode}` : errorCode;
+}
 function getMcpServerFailureMessage(result) {
+  const endpoint3 = getMcpErrorEndpoint(result.name, result.config, { detail: "origin" }, resolveUnexpandedMcpServers);
   const errorCode = result.errorCode;
-  if (errorCode && NAMED_FAILURE_ERROR_CODES.has(errorCode)) {
-    return result.error ?? errorCode;
+  const redact = (errorText) => redactMcpErrorDetail(result.name, result.config, errorText, resolveUnexpandedMcpServers);
+  if (errorCode !== undefined && NAMED_FAILURE_ERROR_CODES.has(errorCode)) {
+    return result.error !== undefined ? redact(result.error) : errorCode;
   }
   if (errorCode) {
-    const numeric = Number(errorCode);
-    const message = errorCode === "23" ? "request timed out" : Number.isInteger(numeric) && numeric >= 100 && numeric <= 599 ? `HTTP ${errorCode}` : errorCode;
-    const url3 = "url" in result.config && typeof result.config.url === "string" ? result.config.url : null;
-    return url3 ? `${message} at ${url3}` : message;
+    const message = formatErrorCode(errorCode);
+    return endpoint3 ? `${message} at ${endpoint3}` : message;
   }
-  return result.error ?? "";
+  return result.error !== undefined ? redact(result.error) : "";
 }
 function getMcpServerScopeFromToolName(toolName) {
   if (!isMcpTool({ name: toolName })) {
@@ -388298,7 +388950,15 @@ function getLoggingSafeMcpBaseUrl(config6) {
     return;
   }
 }
-var NAMED_FAILURE_ERROR_CODES;
+var NAMED_FAILURE_ERROR_CODES, resolveUnexpandedMcpServers = (scope) => {
+  if (scope === "dynamic") {
+    const registry2 = getAuthoredUnexpandedRegistry();
+    return registry2.size === 0 ? undefined : Object.fromEntries(registry2);
+  }
+  if (scope !== "local" && scope !== "user" && scope !== "project" && scope !== "enterprise")
+    return;
+  return getMcpConfigsByScope(scope, { expandVars: false }).servers;
+};
 var init_utils9 = __esm(() => {
   init_state();
   init_cwd2();
@@ -388308,6 +388968,7 @@ var init_utils9 = __esm(() => {
   init_slowOperations();
   init_config6();
   init_mcpStringUtils();
+  init_redaction();
   init_normalization();
   init_types();
   NAMED_FAILURE_ERROR_CODES = new Set([
@@ -388383,7 +389044,7 @@ function commandArraysMatch(a5, b5) {
   }
   return a5.every((val, idx) => val === b5[idx]);
 }
-function getServerUrl(config6) {
+function getServerUrl2(config6) {
   return "url" in config6 ? config6.url : null;
 }
 function unwrapCcrProxyUrl(url3) {
@@ -388403,7 +389064,7 @@ function getMcpServerSignature(config6) {
   if (cmd) {
     return `stdio:${jsonStringify(cmd)}`;
   }
-  const url3 = getServerUrl(config6);
+  const url3 = getServerUrl2(config6);
   if (url3) {
     return `url:${unwrapCcrProxyUrl(url3)}`;
   }
@@ -388502,7 +389163,7 @@ function isMcpServerDenied(serverName, config6) {
         }
       }
     }
-    const serverUrl = getServerUrl(config6);
+    const serverUrl = getServerUrl2(config6);
     if (serverUrl) {
       for (const entry of settings.deniedMcpServers) {
         if (isMcpServerUrlEntry(entry) && urlMatchesPattern(serverUrl, entry.serverUrl)) {
@@ -388528,7 +389189,7 @@ function isMcpServerAllowedByPolicy(serverName, config6) {
   const hasUrlEntries = settings.allowedMcpServers.some(isMcpServerUrlEntry);
   if (config6) {
     const serverCommand = getServerCommandArray(config6);
-    const serverUrl = getServerUrl(config6);
+    const serverUrl = getServerUrl2(config6);
     if (serverCommand) {
       if (hasCommandEntries) {
         for (const entry of settings.allowedMcpServers) {
@@ -388825,7 +389486,7 @@ function getProjectMcpConfigsFromCwd() {
     errors: errors8 || []
   };
 }
-function getMcpConfigsByScope(scope) {
+function getMcpConfigsByScope(scope, options) {
   const sourceMap = {
     project: "projectSettings",
     user: "userSettings",
@@ -388848,7 +389509,7 @@ function getMcpConfigsByScope(scope) {
         const mcpJsonPath = join80(dir, ".mcp.json");
         const { config: config6, errors: errors8 } = parseMcpConfigFromFilePath({
           filePath: mcpJsonPath,
-          expandVars: true,
+          expandVars: options?.expandVars ?? true,
           scope: "project"
         });
         if (!config6) {
@@ -388878,7 +389539,7 @@ function getMcpConfigsByScope(scope) {
       }
       const { config: config6, errors: errors8 } = parseMcpConfig({
         configObject: { mcpServers },
-        expandVars: true,
+        expandVars: options?.expandVars ?? true,
         scope: "user"
       });
       return {
@@ -388893,7 +389554,7 @@ function getMcpConfigsByScope(scope) {
       }
       const { config: config6, errors: errors8 } = parseMcpConfig({
         configObject: { mcpServers },
-        expandVars: true,
+        expandVars: options?.expandVars ?? true,
         scope: "local"
       });
       return {
@@ -388905,7 +389566,7 @@ function getMcpConfigsByScope(scope) {
       const enterpriseMcpPath = getEnterpriseMcpFilePath();
       const { config: config6, errors: errors8 } = parseMcpConfigFromFilePath({
         filePath: enterpriseMcpPath,
-        expandVars: true,
+        expandVars: options?.expandVars ?? true,
         scope: "enterprise"
       });
       if (!config6) {
@@ -389293,6 +389954,10 @@ function parseDynamicMcpConfig(params) {
     }
     let serverConfig = validated;
     if (expandVars) {
+      registerAuthoredUnexpandedConfig(name3, {
+        ...validated,
+        scope
+      });
       const { expanded, missingVars, urlExpandedToEmpty } = expandEnvVars(validated);
       if (missingVars.length > 0) {
         pushEntryError(name3, `Missing environment variables: ${missingVars.join(", ")}`, `Set the following environment variables: ${missingVars.join(", ")}`, undefined);
@@ -389398,6 +390063,7 @@ var init_config6 = __esm(() => {
   init_slowOperations();
   init_analytics();
   init_claudeai();
+  init_redaction();
   init_types();
   init_utils9();
   init_normalization();
@@ -438905,7 +439571,8 @@ async function authStatus(opts) {
     const output = {
       loggedIn,
       authMethod,
-      apiProvider
+      apiProvider,
+      configDirectory: getClaudeConfigHomeDir()
     };
     if (resolvedApiKeySource) {
       output.apiKeySource = resolvedApiKeySource;
@@ -452939,6 +453606,15 @@ function parseRGB(colorStr) {
   RGB_CACHE.set(colorStr, result);
   return result;
 }
+function collapseWhitespace(value) {
+  return value.replace(/\s+/g, " ").trim();
+}
+function computeTodoLabel(todo) {
+  return [todo.activeForm, todo.subject].map((value) => value === undefined ? undefined : collapseWhitespace(value)).find(Boolean);
+}
+function computeSpinnerVerbWidth(columns) {
+  return Math.max(40, columns - 8);
+}
 var THINKING_AMBER_DELAY_MS = 1e4, THINKING_AMBER_RAMP_MS = 1e4, RGB_CACHE;
 var init_utils10 = __esm(() => {
   RGB_CACHE = new Map;
@@ -459741,7 +460417,8 @@ function SpinnerWithVerbInner({
   const currentTodo = tasksV2?.find((task) => task.status !== "pending" && task.status !== "completed");
   const nextTask = findNextPendingTask(tasksV2);
   const [randomVerb] = import_react64.useState(() => sample_default(getSpinnerVerbs()));
-  const leaderVerb = overrideMessage ?? currentTodo?.activeForm ?? currentTodo?.subject ?? randomVerb;
+  const leaderTodoLabel = currentTodo ? computeTodoLabel(currentTodo) : undefined;
+  const leaderVerb = overrideMessage ?? (leaderTodoLabel === undefined ? undefined : truncateToWidthNoEllipsis(leaderTodoLabel, computeSpinnerVerbWidth(columns))) ?? randomVerb;
   const effectiveVerb = foregroundedTeammate && !foregroundedTeammate.isIdle ? foregroundedTeammate.spinnerVerb ?? randomVerb : leaderVerb;
   const message = effectiveVerb + "\u2026";
   import_react64.useEffect(() => {
@@ -459913,7 +460590,8 @@ function SpinnerWithVerbInner({
           (nextTask || effectiveTip) && /* @__PURE__ */ jsx_runtime82.jsx(MessageResponse, {
             children: /* @__PURE__ */ jsx_runtime82.jsx(ThemedText, {
               dimColor: true,
-              children: nextTask ? `Next: ${nextTask.subject}` : `Tip: ${effectiveTip}`
+              wrap: nextTask ? "truncate-end" : "wrap",
+              children: nextTask ? `Next: ${collapseWhitespace(nextTask.subject)}` : `Tip: ${effectiveTip}`
             })
           })
         ]
@@ -460263,6 +460941,7 @@ var init_Spinner2 = __esm(() => {
   init_useTerminalSize();
   init_stringWidth();
   init_Spinner();
+  init_utils10();
   init_SpinnerAnimationRow();
   init_useSettings();
   init_InProcessTeammateTask();
@@ -497153,7 +497832,7 @@ function filterValue(rule, node, options) {
     throw new TypeError("`filter` needs to be a string, array, or function");
   }
 }
-function collapseWhitespace(options) {
+function collapseWhitespace2(options) {
   var element = options.element;
   var isBlock2 = options.isBlock;
   var isVoid2 = options.isVoid;
@@ -497245,7 +497924,7 @@ function RootNode(input, options) {
   } else {
     root3 = input.cloneNode(true);
   }
-  collapseWhitespace({
+  collapseWhitespace2({
     element: root3,
     isBlock,
     isVoid,
@@ -497818,6 +498497,7 @@ __export(exports_utils2, {
   validateURL: () => validateURL,
   isPreapprovedUrl: () => isPreapprovedUrl,
   isPermittedRedirect: () => isPermittedRedirect,
+  invalidUrlErrorMessage: () => invalidUrlErrorMessage,
   getWithPermittedRedirects: () => getWithPermittedRedirects,
   getURLMarkdownContent: () => getURLMarkdownContent,
   getTurndownService: () => getTurndownService,
@@ -497871,6 +498551,18 @@ function validateURL(url3) {
   }
   return true;
 }
+function invalidUrlErrorMessage(url3) {
+  let hostname4;
+  try {
+    hostname4 = new URL(url3).hostname;
+  } catch {
+    hostname4 = undefined;
+  }
+  if (hostname4 && !hostname4.includes(".")) {
+    return "WebFetch cannot fetch localhost or other hostnames without a dot. To reach a local server, use Bash with curl instead.";
+  }
+  return "Invalid URL";
+}
 async function checkDomainBlocklist(domain2) {
   if (DOMAIN_CHECK_CACHE.has(domain2)) {
     return { status: "allowed" };
@@ -497960,7 +498652,7 @@ function isRedirectInfo(response3) {
 }
 async function getURLMarkdownContent(url3, abortController) {
   if (!validateURL(url3)) {
-    throw new Error("Invalid URL");
+    throw new Error(invalidUrlErrorMessage(url3));
   }
   const cachedEntry = URL_CACHE.get(url3);
   if (cachedEntry) {
@@ -560902,18 +561594,18 @@ function parseFolderPath(folderPath) {
   }
   return { platform: platform5, buildId };
 }
-var import_debug177, debugCache;
+var import_debug178, debugCache;
 var init_Cache = __esm(() => {
   init_browser_data();
   init_detectPlatform();
-  import_debug177 = __toESM(require_src(), 1);
-  debugCache = import_debug177.default("puppeteer:browsers:cache");
+  import_debug178 = __toESM(require_src(), 1);
+  debugCache = import_debug178.default("puppeteer:browsers:cache");
 });
 
 // node_modules/.bun/@puppeteer+browsers@2.13.2/node_modules/@puppeteer/browsers/lib/esm/debug.js
-var import_debug178;
+var import_debug179;
 var init_debug3 = __esm(() => {
-  import_debug178 = __toESM(require_src(), 1);
+  import_debug179 = __toESM(require_src(), 1);
 });
 
 // node_modules/.bun/@puppeteer+browsers@2.13.2/node_modules/@puppeteer/browsers/lib/esm/launch.js
@@ -561232,7 +561924,7 @@ var init_launch = __esm(() => {
   init_Cache();
   init_debug3();
   init_detectPlatform();
-  debugLaunch = import_debug178.default("puppeteer:browsers:launcher");
+  debugLaunch = import_debug179.default("puppeteer:browsers:launcher");
   CDP_WEBSOCKET_ENDPOINT_REGEX = /^DevTools listening on (ws:\/\/.*)$/;
   WEBDRIVER_BIDI_WEBSOCKET_ENDPOINT_REGEX = /^WebDriver BiDi listening on (ws:\/\/.*)$/;
   processListeners = new Map;
@@ -566316,10 +567008,10 @@ async function installDMG(dmgPath, folderPath) {
     spawnSync4("hdiutil", ["detach", mountPath, "-quiet"]);
   }
 }
-var import_debug180, debugFileUtil, internalConstantsForTesting;
+var import_debug181, debugFileUtil, internalConstantsForTesting;
 var init_fileUtil = __esm(() => {
-  import_debug180 = __toESM(require_src(), 1);
-  debugFileUtil = import_debug180.default("puppeteer:browsers:fileUtil");
+  import_debug181 = __toESM(require_src(), 1);
+  debugFileUtil = import_debug181.default("puppeteer:browsers:fileUtil");
   internalConstantsForTesting = {
     xz: "xz",
     bzip2: "bzip2"
@@ -566612,7 +567304,7 @@ var init_install = __esm(() => {
   init_fileUtil();
   init_httpUtil();
   import_progress = __toESM(require_node_progress(), 1);
-  debugInstall = import_debug178.default("puppeteer:browsers:install");
+  debugInstall = import_debug179.default("puppeteer:browsers:install");
   times = new Map;
 });
 
@@ -572887,7 +573579,7 @@ import fs23 from "fs";
 import os16 from "os";
 import { dirname as dirname45 } from "path";
 import { PassThrough as PassThrough4 } from "stream";
-var import_debug182, __runInitializers23 = function(thisArg, initializers, value) {
+var import_debug183, __runInitializers23 = function(thisArg, initializers, value) {
   var useValue = arguments.length > 2;
   for (var i6 = 0;i6 < initializers.length; i6++) {
     value = useValue ? initializers[i6].call(thisArg, value) : initializers[i6].call(thisArg);
@@ -572947,8 +573639,8 @@ var init_ScreenRecorder = __esm(() => {
   init_util6();
   init_decorators();
   init_disposable();
-  import_debug182 = __toESM(require_src(), 1);
-  debugFfmpeg = import_debug182.default("puppeteer:ffmpeg");
+  import_debug183 = __toESM(require_src(), 1);
+  debugFfmpeg = import_debug183.default("puppeteer:ffmpeg");
   ScreenRecorder = (() => {
     let _classSuper = PassThrough4;
     let _instanceExtraInitializers = [];
@@ -604992,12 +605684,8 @@ ${customInstructions}`;
 function formatCompactSummary(summary) {
   let formattedSummary = summary;
   formattedSummary = formattedSummary.replace(/<analysis>[\s\S]*?<\/analysis>/, "");
-  const summaryMatch = formattedSummary.match(/<summary>([\s\S]*?)<\/summary>/);
-  if (summaryMatch) {
-    const content = summaryMatch[1] || "";
-    formattedSummary = formattedSummary.replace(/<summary>[\s\S]*?<\/summary>/, `Summary:
-${content.trim()}`);
-  }
+  formattedSummary = formattedSummary.replace(/<summary>([\s\S]*?)<\/summary>/, (_m4, g5) => `Summary:
+${(g5 ?? "").trim()}`);
   formattedSummary = formattedSummary.replace(/\n\n+/g, `
 
 `);
@@ -614788,7 +615476,7 @@ function isClassifierDenial(content) {
 function buildYoloRejectionMessage(reason) {
   const prefix = AUTO_MODE_REJECTION_PREFIX;
   const ruleHint = feature("BASH_CLASSIFIER") ? `To allow this type of action in the future, the user can add a permission rule like ` + `Bash(prompt: <description of allowed action>) to their settings. ` + `At the end of your session, recommend what permission rules to add so you don't get blocked again.` : `To allow this type of action in the future, the user can add a Bash permission rule to their settings.`;
-  return `${prefix}${reason}. ` + `If you have other tasks that don't depend on this action, continue working on those. ` + `${DENIAL_WORKAROUND_GUIDANCE} ` + ruleHint;
+  return `${prefix}${reason}. ` + `If you have other tasks that don't depend on this action, continue working on those. ` + `${DENIAL_WORKAROUND_GUIDANCE_BASE}${AUTO_MODE_STOP_SUFFIX} ` + ruleHint;
 }
 function buildClassifierUnavailableMessage(toolName, classifierModel) {
   return `${classifierModel} is temporarily unavailable, so auto mode cannot determine the safety of ${toolName} right now. ` + `Wait briefly and then try this action again. ` + `If it keeps failing, continue with other tasks that don't require this action and come back to it later. ` + `Note: reading files, searching code, and other read-only operations do not require the classifier and can still be used.`;
@@ -618189,7 +618877,7 @@ Note: The user's next message may contain a correction or preference. Pay close
 `, PLAN_REJECTION_PREFIX = `The agent proposed a plan that was rejected by the user. The user chose to stay in plan mode rather than proceed with implementation.
 
 Rejected plan:
-`, DENIAL_WORKAROUND_GUIDANCE, NO_RESPONSE_REQUESTED = "No response requested.", SYNTHETIC_TOOL_RESULT_PLACEHOLDER = "[Tool result missing due to internal error]", AUTO_MODE_REJECTION_PREFIX = "Permission for this action was denied by the Claude Code auto mode classifier. Reason: ", CLASSIFIER_UNAVAILABLE_REASON = "Classifier unavailable", CLASSIFIER_PARSING_ERROR_REASON_PREFIX = "Auto mode could not evaluate this action and is blocking it for safety", CLASSIFIER_TRANSCRIPT_TOO_LONG_REASON = "Auto mode classifier transcript exceeded context window \u2014 falling back to manual approval (try /compact to reduce conversation size)", SYNTHETIC_MODEL = "<synthetic>", SYNTHETIC_MESSAGES, EMPTY_LOOKUPS, EMPTY_STRING_SET, _normalizationCache, STRIPPED_TAGS_RE, PLAN_PHASE4_CONTROL = `### Phase 4: Final Plan
+`, DENIAL_WORKAROUND_GUIDANCE_BASE, LEGACY_STOP_SUFFIX, AUTO_MODE_STOP_SUFFIX, DENIAL_WORKAROUND_GUIDANCE, NO_RESPONSE_REQUESTED = "No response requested.", SYNTHETIC_TOOL_RESULT_PLACEHOLDER = "[Tool result missing due to internal error]", AUTO_MODE_REJECTION_PREFIX = "Permission for this action was denied by the Claude Code auto mode classifier. Reason: ", CLASSIFIER_UNAVAILABLE_REASON = "Classifier unavailable", CLASSIFIER_PARSING_ERROR_REASON_PREFIX = "Auto mode could not evaluate this action and is blocking it for safety", CLASSIFIER_TRANSCRIPT_TOO_LONG_REASON = "Auto mode classifier transcript exceeded context window \u2014 falling back to manual approval (try /compact to reduce conversation size)", SYNTHETIC_MODEL = "<synthetic>", SYNTHETIC_MESSAGES, EMPTY_LOOKUPS, EMPTY_STRING_SET, _normalizationCache, STRIPPED_TAGS_RE, PLAN_PHASE4_CONTROL = `### Phase 4: Final Plan
 Goal: Write your final plan to the plan file (the only file you can edit).
 - Begin with a **Context** section: explain why this change is being made \u2014 the problem or need it addresses, what prompted it, and the intended outcome
 - Include only your recommended approach, not all alternatives
@@ -618264,7 +618952,10 @@ var init_messages3 = __esm(() => {
   init_stringUtils();
   init_tasks();
   init_toolSearch();
-  DENIAL_WORKAROUND_GUIDANCE = `IMPORTANT: You *may* attempt to accomplish this action using other tools that might naturally be used to accomplish this goal, ` + `e.g. using head instead of cat. But you *should not* attempt to work around this denial in malicious ways, ` + `e.g. do not use your ability to run tests to execute non-test actions. ` + `You should only try to work around this restriction in reasonable ways that do not attempt to bypass the intent behind this denial. ` + `If you believe this capability is essential to complete the user's request, STOP and explain to the user ` + `what you were trying to do and why you need this permission. Let the user decide how to proceed.`;
+  DENIAL_WORKAROUND_GUIDANCE_BASE = `IMPORTANT: You *may* attempt to accomplish this action using other tools that might naturally be used to accomplish this goal, ` + `e.g. using head instead of cat. But you *should not* attempt to work around this denial in malicious ways, ` + `e.g. do not use your ability to run tests to execute non-test actions. ` + `You should only try to work around this restriction in reasonable ways that do not attempt to bypass the intent behind this denial. `;
+  LEGACY_STOP_SUFFIX = `If you believe this capability is essential to complete the user's request, STOP and explain to the user ` + `what you were trying to do and why you need this permission. Let the user decide how to proceed.`;
+  AUTO_MODE_STOP_SUFFIX = `If you believe this capability is essential to complete the user's request, first try a safer method. ` + `Get as much of the rest of the task done as you can, then STOP and explain to the user ` + `what you were trying to do and why you need this permission. Let the user decide how to proceed.`;
+  DENIAL_WORKAROUND_GUIDANCE = `${DENIAL_WORKAROUND_GUIDANCE_BASE}${LEGACY_STOP_SUFFIX}`;
   SYNTHETIC_MESSAGES = new Set([
     INTERRUPT_MESSAGE,
     INTERRUPT_MESSAGE_FOR_TOOL_USE,
@@ -632683,7 +633374,11 @@ function should1hCacheTTL(querySource, agentCacheTtlOverride) {
   return resolvePromptCacheTtl(querySource, { agentCacheTtlOverride }).ttl === "1h";
 }
 function configureEffortParams(effortValue, outputConfig, extraBodyParams, betas, model) {
-  if (!modelSupportsEffort(model) || "effort" in outputConfig) {
+  if (!modelSupportsEffort(model)) {
+    delete outputConfig.effort;
+    return;
+  }
+  if ("effort" in outputConfig) {
     return;
   }
   if (effortValue === undefined) {
@@ -632691,12 +633386,6 @@ function configureEffortParams(effortValue, outputConfig, extraBodyParams, betas
   } else if (typeof effortValue === "string") {
     outputConfig.effort = effortValue;
     betas.push(EFFORT_BETA_HEADER);
-  } else if (process.env.USER_TYPE === "ant") {
-    const existingInternal = extraBodyParams.anthropic_internal || {};
-    extraBodyParams.anthropic_internal = {
-      ...existingInternal,
-      effort_override: effortValue
-    };
   }
 }
 function configureTaskBudgetParams(taskBudget, outputConfig, betas) {
@@ -637288,17 +637977,23 @@ function applySettingsChange(source2, setAppState) {
     const prevEffort = prev.settings.effortLevel;
     const newEffort = newSettings.effortLevel;
     const effortChanged = prevEffort !== newEffort;
+    const effortSyncModel = getMainLoopModel();
+    const effortSyncBlocked = !modelSupportsEffort(effortSyncModel) || getEffortEnvOverride() !== undefined;
+    const clampedEffort = effortSyncBlocked || newEffort === undefined ? undefined : clampEffortToCap(newEffort, effortSyncModel);
     return {
       ...prev,
       settings: newSettings,
       toolPermissionContext: newContext,
-      ...effortChanged && newEffort !== undefined ? { effortValue: newEffort } : {}
+      ...effortChanged && clampedEffort !== undefined ? { effortValue: clampedEffort } : {}
     };
   });
 }
 var init_applySettingsChange = __esm(() => {
   init_debug();
+  init_effort();
+  init_cap();
   init_hooksConfigSnapshot();
+  init_model();
   init_permissionSetup();
   init_permissions2();
   init_permissionsLoader();
@@ -646246,6 +646941,86 @@ var init_magicDocs = __esm(() => {
   });
 });
 
+// src/utils/mcpNeedsAuthNotice.ts
+function clearNeedsAuthNoticedThisSession() {
+  needsAuthNoticedThisSession.clear();
+}
+function isFailedUnconfigured(client8) {
+  return client8.type === "failed" && client8.errorCode === "UNCONFIGURED";
+}
+function isEligibleForNeedsAuthNotice(client8, { hasEverConnected, connectedThisSession }) {
+  if (isFailedUnconfigured(client8))
+    return false;
+  if (client8.config.type === "claudeai-proxy") {
+    const eligible2 = client8.config.eligible;
+    if (eligible2 === false && !connectedThisSession(client8.name))
+      return false;
+    return hasEverConnected(client8.name);
+  }
+  return client8.config.type !== "sse-ide" && client8.config.type !== "ws-ide";
+}
+function shouldAnnounceNeedsAuth(client8, deps) {
+  if (client8.type !== "needs-auth" || !isEligibleForNeedsAuthNotice(client8, deps)) {
+    return false;
+  }
+  return needsAuthNoticedThisSession.has(client8.name) || !(getGlobalConfig().mcpNeedsAuthNoticed ?? []).includes(client8.name);
+}
+function countNeedsAuthToAnnounce(clients, deps) {
+  let count4 = 0;
+  for (const client8 of clients) {
+    count4 += +!!shouldAnnounceNeedsAuth(client8, deps);
+  }
+  return count4;
+}
+function markNeedsAuthNoticed(clients, deps) {
+  const newlyNoticed = [];
+  for (const client8 of clients) {
+    if (shouldAnnounceNeedsAuth(client8, deps) && !needsAuthNoticedThisSession.has(client8.name)) {
+      needsAuthNoticedThisSession.add(client8.name);
+      newlyNoticed.push(client8.name);
+    }
+  }
+  if (newlyNoticed.length === 0)
+    return;
+  saveGlobalConfig((current) => {
+    const noticed = current.mcpNeedsAuthNoticed ?? [];
+    const fresh = newlyNoticed.filter((name3) => !noticed.includes(name3));
+    if (fresh.length === 0)
+      return current;
+    const merged = [...noticed, ...fresh];
+    return {
+      ...current,
+      mcpNeedsAuthNoticed: merged.slice(-MCP_NEEDS_AUTH_NOTICED_CAP)
+    };
+  });
+}
+function countNoticedServersNowConnected(clients) {
+  const noticed = getGlobalConfig().mcpNeedsAuthNoticed;
+  if (noticed === undefined || noticed.length === 0)
+    return 0;
+  let count4 = 0;
+  for (const client8 of clients) {
+    count4 += +!!(client8.type === "connected" && noticed.includes(client8.name));
+  }
+  return count4;
+}
+function pruneNoticedServersNowConnected(clients) {
+  saveGlobalConfig((current) => {
+    const noticed = current.mcpNeedsAuthNoticed;
+    if (noticed === undefined || noticed.length === 0)
+      return current;
+    const remaining = noticed.filter((name3) => !clients.some((client8) => client8.name === name3 && client8.type === "connected"));
+    if (remaining.length === noticed.length)
+      return current;
+    return { ...current, mcpNeedsAuthNoticed: remaining };
+  });
+}
+var MCP_NEEDS_AUTH_NOTICED_CAP = 128, needsAuthNoticedThisSession;
+var init_mcpNeedsAuthNotice = __esm(() => {
+  init_config4();
+  needsAuthNoticedThisSession = new Set;
+});
+
 // src/commands/clear/caches.ts
 var exports_caches = {};
 __export(exports_caches, {
@@ -646268,6 +647043,7 @@ function clearSessionCaches(preservedAgentIds = new Set) {
   resetGetMemoryFilesCache("session_start");
   clearStoredImagePaths();
   clearAllSessions();
+  clearNeedsAuthNoticedThisSession();
   if (!hasPreserved)
     clearAllPendingCallbacks();
   if (process.env.USER_TYPE === "ant") {
@@ -646315,6 +647091,7 @@ var init_caches = __esm(() => {
   init_detectRepository();
   init_gitFilesystem();
   init_imageStore();
+  init_mcpNeedsAuthNotice();
   init_sessionEnvVars();
 });
 
@@ -649457,7 +650234,7 @@ var init_EffortIndicator = __esm(() => {
 
 // src/components/ModelPicker.tsx
 function ModelPicker(t0) {
-  const $4 = import_compiler_runtime133.c(84);
+  const $4 = import_compiler_runtime133.c(86);
   const {
     initial,
     sessionModel,
@@ -649583,6 +650360,9 @@ function ModelPicker(t0) {
     t8 = $4[22];
   }
   const focusedSupportsMax = t8;
+  const focusedModelForCap = resolveOptionModel(focusedValue);
+  const focusedCap = focusedModelForCap ? getEffectiveEffortCap(focusedModelForCap) : null;
+  const focusedCapped = focusedModelForCap ? hasEffortLevelsAboveCap(focusedModelForCap) : false;
   let t9;
   if ($4[23] !== focusedValue) {
     t9 = getDefaultEffortLevelForOption(focusedValue);
@@ -649592,13 +650372,16 @@ function ModelPicker(t0) {
     t9 = $4[24];
   }
   const focusedDefaultEffort = t9;
-  const displayEffort = effort === "max" && !focusedSupportsMax || effort === "xhigh" && !focusedSupportsXhigh ? "high" : effort;
+  const t8b = effort === "max" && !focusedSupportsMax || effort === "xhigh" && !focusedSupportsXhigh ? "high" : effort;
+  const displayEffort = t8b !== undefined && focusedModelForCap ? clampEffortToCap(t8b, focusedModelForCap) : t8b;
   let t10;
   if ($4[25] !== effortValue || $4[26] !== hasToggledEffort) {
     t10 = (value) => {
       setFocusedValue(value);
       if (!hasToggledEffort && effortValue === undefined) {
-        setEffort(getDefaultEffortLevelForOption(value));
+        const focusModel = resolveOptionModel(value);
+        const defaultEffort = getDefaultEffortLevelForOption(value);
+        setEffort(focusModel ? clampEffortToCap(defaultEffort, focusModel) : defaultEffort);
       }
     };
     $4[25] = effortValue;
@@ -649609,12 +650392,12 @@ function ModelPicker(t0) {
   }
   const handleFocus = t10;
   let t11;
-  if ($4[28] !== focusedDefaultEffort || $4[29] !== focusedSupportsEffort || $4[30] !== focusedSupportsMax || $4[83] !== focusedSupportsXhigh) {
+  if ($4[28] !== focusedDefaultEffort || $4[29] !== focusedSupportsEffort || $4[30] !== focusedSupportsMax || $4[83] !== focusedSupportsXhigh || $4[84] !== focusedCap) {
     t11 = (direction) => {
       if (!focusedSupportsEffort) {
         return;
       }
-      setEffort((prev) => cycleEffortLevel(prev ?? focusedDefaultEffort, direction, focusedSupportsMax, focusedSupportsXhigh));
+      setEffort((prev) => cycleEffortLevel(prev ?? focusedDefaultEffort, direction, focusedSupportsMax, focusedSupportsXhigh, focusedCap));
       setHasToggledEffort(true);
     };
     $4[28] = focusedDefaultEffort;
@@ -649622,6 +650405,7 @@ function ModelPicker(t0) {
     $4[30] = focusedSupportsMax;
     $4[31] = t11;
     $4[83] = focusedSupportsXhigh;
+    $4[84] = focusedCap;
   } else {
     t11 = $4[31];
   }
@@ -649662,11 +650446,14 @@ function ModelPicker(t0) {
   let t14;
   if ($4[35] !== effort || $4[36] !== hasToggledEffort || $4[37] !== onSelect || $4[38] !== setAppState || $4[39] !== skipSettingsWrite) {
     t14 = function handleSelect2(value_0) {
+      const selectedModel = resolveOptionModel(value_0);
+      const clampedSelectEffort = selectedModel && effort !== undefined ? clampEffortToCap(effort, selectedModel) : effort;
       logEvent2("tengu_model_command_menu_effort", {
-        effort
+        effort: clampedSelectEffort
       });
       if (!skipSettingsWrite) {
-        const effortLevel = resolvePickerEffortPersistence(effort, getDefaultEffortLevelForOption(value_0), getSettingsForSource("userSettings")?.effortLevel, hasToggledEffort);
+        const persistModel = selectedModel ?? getDefaultMainLoopModel();
+        const effortLevel = clampEffortToCap(resolvePickerEffortPersistence(effort, getDefaultEffortLevelForOption(value_0), getSettingsForSource("userSettings")?.effortLevel, hasToggledEffort), persistModel);
         const persistable = toPersistableEffort(effortLevel);
         if (persistable !== undefined) {
           updateSettingsForSource("userSettings", {
@@ -649678,8 +650465,7 @@ function ModelPicker(t0) {
           effortValue: effortLevel
         }));
       }
-      const selectedModel = resolveOptionModel(value_0);
-      const selectedEffort = hasToggledEffort && selectedModel && modelSupportsEffort(selectedModel) ? effort : undefined;
+      const selectedEffort = hasToggledEffort && selectedModel && modelSupportsEffort(selectedModel) ? clampedSelectEffort : undefined;
       if (value_0 === NO_PREFERENCE) {
         onSelect(null, selectedEffort);
         return;
@@ -649812,42 +650598,49 @@ function ModelPicker(t0) {
     t23 = $4[61];
   }
   let t24;
-  if ($4[62] !== displayEffort || $4[63] !== focusedDefaultEffort || $4[64] !== focusedModelName || $4[65] !== focusedSupportsEffort) {
-    t24 = /* @__PURE__ */ jsx_runtime183.jsx(ThemedBox_default, {
+  if ($4[62] !== displayEffort || $4[63] !== focusedDefaultEffort || $4[64] !== focusedModelName || $4[65] !== focusedSupportsEffort || $4[85] !== focusedCapped) {
+    t24 = /* @__PURE__ */ jsx_runtime183.jsxs(ThemedBox_default, {
       marginBottom: 1,
       flexDirection: "column",
-      children: focusedSupportsEffort ? /* @__PURE__ */ jsx_runtime183.jsxs(ThemedText, {
-        dimColor: true,
-        children: [
-          /* @__PURE__ */ jsx_runtime183.jsx(EffortLevelIndicator, {
-            effort: displayEffort
-          }),
-          " ",
-          capitalize_default(displayEffort),
-          " effort",
-          displayEffort === focusedDefaultEffort ? " (default)" : "",
-          " ",
-          /* @__PURE__ */ jsx_runtime183.jsx(ThemedText, {
-            color: "subtle",
-            children: "\u2190 \u2192 to adjust"
-          })
-        ]
-      }) : /* @__PURE__ */ jsx_runtime183.jsxs(ThemedText, {
-        color: "subtle",
-        children: [
-          /* @__PURE__ */ jsx_runtime183.jsx(EffortLevelIndicator, {
-            effort: undefined
-          }),
-          " Effort not supported",
-          focusedModelName ? ` for ${focusedModelName}` : ""
-        ]
-      })
+      children: [
+        focusedSupportsEffort ? /* @__PURE__ */ jsx_runtime183.jsxs(ThemedText, {
+          dimColor: true,
+          children: [
+            /* @__PURE__ */ jsx_runtime183.jsx(EffortLevelIndicator, {
+              effort: displayEffort
+            }),
+            " ",
+            capitalize_default(displayEffort),
+            " effort",
+            displayEffort === focusedDefaultEffort ? " (default)" : "",
+            " ",
+            /* @__PURE__ */ jsx_runtime183.jsx(ThemedText, {
+              color: "subtle",
+              children: "\u2190 \u2192 to adjust"
+            })
+          ]
+        }) : /* @__PURE__ */ jsx_runtime183.jsxs(ThemedText, {
+          color: "subtle",
+          children: [
+            /* @__PURE__ */ jsx_runtime183.jsx(EffortLevelIndicator, {
+              effort: undefined
+            }),
+            " Effort not supported",
+            focusedModelName ? ` for ${focusedModelName}` : ""
+          ]
+        }),
+        focusedCapped ? /* @__PURE__ */ jsx_runtime183.jsx(ThemedText, {
+          color: "subtle",
+          children: "Higher effort levels are capped by your settings or organization."
+        }) : null
+      ]
     });
     $4[62] = displayEffort;
     $4[63] = focusedDefaultEffort;
     $4[64] = focusedModelName;
     $4[65] = focusedSupportsEffort;
     $4[66] = t24;
+    $4[85] = focusedCapped;
   } else {
     t24 = $4[66];
   }
@@ -650031,8 +650824,9 @@ function EffortLevelIndicator(t0) {
   }
   return t4;
 }
-function cycleEffortLevel(current, direction, includeMax, includeXhigh) {
-  const levels = ["low", "medium", "high", "xhigh", "max"].filter((level) => (level !== "max" || includeMax) && (level !== "xhigh" || includeXhigh));
+function cycleEffortLevel(current, direction, includeMax, includeXhigh, cap) {
+  const capIndex = cap !== undefined && cap !== null ? EFFORT_LEVEL_ORDER.indexOf(cap) : EFFORT_LEVEL_ORDER.length - 1;
+  const levels = EFFORT_LEVEL_ORDER.filter((level, index2) => index2 <= capIndex && (level !== "max" || includeMax) && (level !== "xhigh" || includeXhigh));
   const clamped = current === "max" && !includeMax || current === "xhigh" && !includeXhigh ? "high" : current;
   const idx = levels.indexOf(clamped);
   const currentIndex = idx !== -1 ? idx : levels.length - 1;
@@ -650047,7 +650841,7 @@ function getDefaultEffortLevelForOption(value) {
   const defaultValue = getDefaultEffortForModel(resolved);
   return defaultValue !== undefined ? convertEffortValueToLevel(defaultValue) : "high";
 }
-var import_compiler_runtime133, import_react103, jsx_runtime183, NO_PREFERENCE = "__NO_PREFERENCE__";
+var import_compiler_runtime133, import_react103, jsx_runtime183, NO_PREFERENCE = "__NO_PREFERENCE__", EFFORT_LEVEL_ORDER;
 var init_ModelPicker = __esm(() => {
   init_capitalize();
   init_useExitOnCtrlCDWithKeybindings();
@@ -650057,6 +650851,7 @@ var init_ModelPicker = __esm(() => {
   init_useKeybinding();
   init_AppState();
   init_effort();
+  init_cap();
   init_model();
   init_modelOptions();
   init_settings2();
@@ -650069,6 +650864,7 @@ var init_ModelPicker = __esm(() => {
   import_compiler_runtime133 = __toESM(require_compiler_runtime(), 1);
   import_react103 = __toESM(require_react(), 1);
   jsx_runtime183 = __toESM(require_jsx_runtime(), 1);
+  EFFORT_LEVEL_ORDER = ["low", "medium", "high", "xhigh", "max"];
 });
 
 // src/components/ClaudeMdExternalIncludesDialog.tsx
@@ -668610,6 +669406,12 @@ function MCPRemoteServerMenu({
   } = useTerminalSize();
   const [isAuthenticating, setIsAuthenticating] = import_react131.default.useState(false);
   const [error52, setError] = import_react131.default.useState(null);
+  const scopedConfig = import_react131.default.useMemo(() => ({
+    ...server.config,
+    scope: server.scope ?? server.config.scope
+  }), [server.config, server.scope]);
+  const displayConfig = import_react131.default.useMemo(() => getDisplayConfig(server.name, scopedConfig, resolveUnexpandedMcpServers), [server.name, scopedConfig]);
+  const displayUrl = "url" in displayConfig ? displayConfig.url : "";
   const mcp = useAppState((s4) => s4.mcp);
   const setAppState = useSetAppState();
   const [authorizationUrl, setAuthorizationUrl] = import_react131.default.useState(null);
@@ -668822,7 +669624,7 @@ function MCPRemoteServerMenu({
       }
     } catch (err_1) {
       if (err_1 instanceof Error && !(err_1 instanceof AuthenticationCancelledError)) {
-        setError(err_1.message);
+        setError(redactMcpErrorDetail(server.name, scopedConfig, err_1.message, resolveUnexpandedMcpServers));
       }
     } finally {
       setIsAuthenticating(false);
@@ -669340,7 +670142,7 @@ function MCPRemoteServerMenu({
                   }),
                   /* @__PURE__ */ jsx_runtime238.jsx(ThemedText, {
                     dimColor: true,
-                    children: server.config.url
+                    children: displayUrl
                   })
                 ]
               }),
@@ -669494,6 +670296,7 @@ var init_MCPRemoteServerMenu = __esm(() => {
   init_auth11();
   init_client12();
   init_MCPConnectionManager();
+  init_redaction();
   init_utils9();
   init_AppState();
   init_auth6();
@@ -669527,6 +670330,12 @@ function MCPStdioServerMenu({
   const reconnectMcpServer = useMcpReconnect();
   const toggleMcpServer = useMcpToggleEnabled();
   const [isReconnecting, setIsReconnecting] = import_react132.useState(false);
+  const displayConfig = import_react132.default.useMemo(() => getDisplayConfig(server.name, {
+    ...server.config,
+    scope: server.config.scope ?? "dynamic"
+  }, resolveUnexpandedMcpServers), [server.name, server.config]);
+  const displayCommand = "command" in displayConfig ? displayConfig.command : "";
+  const displayArgs = "command" in displayConfig && Array.isArray(displayConfig.args) ? displayConfig.args : [];
   const handleToggleEnabled = import_react132.default.useCallback(async () => {
     const wasEnabled = server.client.type !== "disabled";
     try {
@@ -669662,11 +670471,11 @@ function MCPStdioServerMenu({
                   }),
                   /* @__PURE__ */ jsx_runtime239.jsx(ThemedText, {
                     dimColor: true,
-                    children: server.config.command
+                    children: displayCommand
                   })
                 ]
               }),
-              server.config.args && server.config.args.length > 0 && /* @__PURE__ */ jsx_runtime239.jsxs(ThemedBox_default, {
+              displayArgs.length > 0 && /* @__PURE__ */ jsx_runtime239.jsxs(ThemedBox_default, {
                 children: [
                   /* @__PURE__ */ jsx_runtime239.jsx(ThemedText, {
                     bold: true,
@@ -669674,7 +670483,7 @@ function MCPStdioServerMenu({
                   }),
                   /* @__PURE__ */ jsx_runtime239.jsx(ThemedText, {
                     dimColor: true,
-                    children: server.config.args.join(" ")
+                    children: displayArgs.join(" ")
                   })
                 ]
               }),
@@ -669784,6 +670593,7 @@ var init_MCPStdioServerMenu = __esm(() => {
   init_ink2();
   init_config6();
   init_MCPConnectionManager();
+  init_redaction();
   init_utils9();
   init_AppState();
   init_errors();
@@ -678987,7 +679797,7 @@ function formatZodErrors(zodError) {
   }));
 }
 function checkPathTraversal(p4, field, errors8, hint) {
-  if (p4.includes("..")) {
+  if (p4.split(/[\\/]/).some((segment2) => segment2 === "..")) {
     errors8.push({
       path: field,
       message: hint ? `Path contains "..": ${p4}. ${hint}` : `Path contains ".." which could be a path traversal attempt: ${p4}`
@@ -716431,6 +717241,19 @@ __export(exports_effort, {
   call: () => call82
 });
 function setEffortValue(effortValue) {
+  const model = getMainLoopModel();
+  const clamped = typeof effortValue === "string" ? clampEffortToCap(effortValue, model) : effortValue;
+  if (clamped !== effortValue) {
+    logEvent2("tengu_effort_command", {
+      effort: effortValue
+    });
+    return {
+      message: `Effort '${effortValue}' exceeds the cap for ${model} set by your settings or organization; set to '${clamped}' instead (this session only): ${getEffortValueDescription(clamped)}`,
+      effortUpdate: {
+        value: clamped
+      }
+    };
+  }
   const persistable = toPersistableEffort(effortValue);
   if (persistable !== undefined) {
     const result = updateSettingsForSource("userSettings", {
@@ -716481,9 +717304,10 @@ function showCurrentEffort(appStateEffort, model) {
       message: `Effort level: auto (currently ${level})`
     };
   }
-  const description = getEffortValueDescription(effectiveValue);
+  const clamped = clampEffortToCap(effectiveValue, model);
+  const description = getEffortValueDescription(clamped);
   return {
-    message: `Current effort level: ${effectiveValue} (${description})`
+    message: `Current effort level: ${clamped} (${description})`
   };
 }
 function unsetEffortLevel() {
@@ -716515,7 +717339,17 @@ function unsetEffortLevel() {
     }
   };
 }
-function enableUltracode() {
+function enableUltracode(model) {
+  if (modelSupportsXhighEffort(model) && !isEffortLevelAllowed("xhigh", model)) {
+    return {
+      message: `Ultracode runs at xhigh effort, which is above the effort cap for ${model} set by your settings or organization. Valid options are: ${formatEffortValidOptions(model)}`
+    };
+  }
+  if (!isUltracodeAvailableForModel(model)) {
+    return {
+      message: `Ultracode runs at xhigh effort, which ${model} doesn't support \u2014 switch to an xhigh-capable model (${XHIGH_CAPABLE_MODELS_HINT}). Valid options are: ${formatEffortValidOptions(model)}`
+    };
+  }
   enableUltracodeForSession();
   logEvent2("tengu_effort_command", {
     effort: "ultracode"
@@ -716537,11 +717371,11 @@ function executeEffort(args) {
     return unsetEffortLevel();
   }
   if (normalized === "ultracode") {
-    return enableUltracode();
+    return enableUltracode(getMainLoopModel());
   }
   if (!isEffortLevel(normalized)) {
     return {
-      message: `Invalid argument: ${args}. Valid options are: low, medium, high, xhigh, max, ultracode, auto`
+      message: `Invalid argument: ${args}. Valid options are: ${formatEffortValidOptions(getMainLoopModel())}`
     };
   }
   if (isUltracodeEnabled()) {
@@ -716604,14 +717438,17 @@ function ApplyEffortAndClose(t0) {
 async function call82(onDone, _context, args) {
   args = args?.trim() || "";
   if (COMMON_HELP_ARGS2.includes(args)) {
-    onDone(`Usage: /effort [low|medium|high|xhigh|max|ultracode|auto]
-` + `- low: Quick, straightforward implementation
-` + `- medium: Balanced approach with standard testing
-` + `- high: Comprehensive implementation with extensive testing
-` + `- xhigh: Extended reasoning with thorough analysis (Fable 5, Opus 4.7+, Sonnet 5)
-` + `- max: Maximum capability with deepest reasoning (Fable 5, Opus 4.6+, Sonnet 4.6+)
-` + `- ultracode: xhigh + dynamic workflow orchestration (this session only)
-` + "- auto: Use the default effort level for your model");
+    const model = getMainLoopModel();
+    const lines2 = [buildEffortArgumentHint("Usage: /effort [", "]", model)];
+    for (const level of getAllowedEffortLevels(model)) {
+      lines2.push(`- ${level}: ${SHORT_EFFORT_HELP[level]}`);
+    }
+    if (isUltracodeAvailableForModel(model)) {
+      lines2.push("- ultracode: xhigh + dynamic workflow orchestration (this session only)");
+    }
+    lines2.push("- auto: Use the default effort level for your model");
+    onDone(lines2.join(`
+`));
     return;
   }
   if (!args || args === "current" || args === "status") {
@@ -716625,29 +717462,42 @@ async function call82(onDone, _context, args) {
     onDone
   });
 }
-var import_compiler_runtime248, React108, jsx_runtime350, COMMON_HELP_ARGS2;
+var import_compiler_runtime248, React108, jsx_runtime350, COMMON_HELP_ARGS2, XHIGH_CAPABLE_MODELS_HINT = "Fable 5, Opus 4.7+, Sonnet 5", SHORT_EFFORT_HELP;
 var init_effort2 = __esm(() => {
   init_useMainLoopModel();
   init_analytics();
   init_AppState();
   init_effort();
+  init_cap();
   init_ultracode();
+  init_model();
   init_settings2();
   import_compiler_runtime248 = __toESM(require_compiler_runtime(), 1);
   React108 = __toESM(require_react(), 1);
   jsx_runtime350 = __toESM(require_jsx_runtime(), 1);
   COMMON_HELP_ARGS2 = ["help", "-h", "--help"];
+  SHORT_EFFORT_HELP = {
+    low: "Quick, straightforward implementation",
+    medium: "Balanced approach with standard testing",
+    high: "Comprehensive implementation with extensive testing",
+    xhigh: "Extended reasoning with thorough analysis (Fable 5, Opus 4.7+, Sonnet 5)",
+    max: "Maximum capability with deepest reasoning (Fable 5, Opus 4.6+, Sonnet 4.6+)"
+  };
 });
 
 // src/commands/effort/index.ts
 var effort_default;
 var init_effort3 = __esm(() => {
+  init_cap();
   init_immediateCommand();
+  init_model();
   effort_default = {
     type: "local-jsx",
     name: "effort",
     description: "Set effort level for model usage",
-    argumentHint: "[low|medium|high|xhigh|max|ultracode|auto]",
+    get argumentHint() {
+      return buildEffortArgumentHint("[", "]", getMainLoopModel());
+    },
     get immediate() {
       return shouldInferenceConfigCommandBeImmediate();
     },
@@ -725952,7 +726802,15 @@ function stripNonLoadedContent(raw) {
   }
   return result;
 }
-function truncateEntrypointContent(raw) {
+function truncatePreviewAtWordBoundary(value, max2) {
+  if (value.length <= max2)
+    return value;
+  const head = sliceHead(value, max2 - 1);
+  const lastWordStart = head.search(/\s\S*$/);
+  const beforeLastWord = lastWordStart === -1 ? "" : head.slice(0, lastWordStart).trimEnd();
+  return `${beforeLastWord.length > max2 / 2 ? beforeLastWord : head.trimEnd()}\u2026`;
+}
+function truncateEntrypointContent(raw, kind = "index") {
   const trimmed = raw.trim();
   const contentLines = trimmed.split(`
 `);
@@ -725976,11 +726834,20 @@ function truncateEntrypointContent(raw) {
 `, MAX_ENTRYPOINT_BYTES);
     truncated = truncated.slice(0, cutAt > 0 ? cutAt : MAX_ENTRYPOINT_BYTES);
   }
-  const reason = wasByteTruncated && !wasLineTruncated ? `${formatFileSize(byteCount)} (limit: ${formatFileSize(MAX_ENTRYPOINT_BYTES)}) \u2014 index entries are too long` : wasLineTruncated && !wasByteTruncated ? `${lineCount} lines (limit: ${MAX_ENTRYPOINT_LINES})` : `${lineCount} lines and ${formatFileSize(byteCount)}`;
+  const fullLinesKept = trimmed[truncated.length] === `
+` ? countCharInString(truncated, `
+`) + 1 : 0;
+  const previewStart = truncated.length + 1;
+  const previewEnd = trimmed.indexOf(`
+`, previewStart);
+  const firstCutLine = trimmed.slice(previewStart, previewEnd < 0 ? undefined : previewEnd).trim();
+  const cutDetail = fullLinesKept === 0 ? `everything after the first ${truncated.length} characters of line 1 was cut off` : `${lineCount - fullLinesKept} of ${lineCount} lines were cut off, starting at line ${fullLinesKept + 1}${firstCutLine ? ` ("${truncatePreviewAtWordBoundary(firstCutLine, CUT_LINE_PREVIEW_MAX)}")` : ""}`;
+  const reason = wasByteTruncated && !wasLineTruncated ? `${formatFileSize(byteCount)} (limit: ${formatFileSize(MAX_ENTRYPOINT_BYTES)}) \u2014 ${kind === "index" ? "index entries are too long" : "its lines are too long"}` : wasLineTruncated && !wasByteTruncated ? `${lineCount} lines (limit: ${MAX_ENTRYPOINT_LINES})` : `${lineCount} lines and ${formatFileSize(byteCount)}`;
+  const warning = kind === "index" ? `${ENTRYPOINT_NAME} is ${reason}. Only part of it was loaded: ${cutDetail}. Keep index entries to one line under ~200 chars; move detail into topic files.` : `this memory file is ${reason}. Only part of it was loaded: ${cutDetail}. Keep each memory file focused on one topic.`;
   return {
     content: truncated + `
 
-> WARNING: ${ENTRYPOINT_NAME} is ${reason}. Only part of it was loaded. Keep index entries to one line under ~200 chars; move detail into topic files.`,
+> WARNING: ${warning}`,
     lineCount,
     byteCount,
     wasLineTruncated,
@@ -726297,7 +727164,7 @@ async function loadMemoryPrompt() {
   }
   return null;
 }
-var teamMemPaths7, ENTRYPOINT_NAME = "MEMORY.md", MAX_ENTRYPOINT_LINES = 200, MAX_ENTRYPOINT_BYTES = 25000, AUTO_MEM_DISPLAY_NAME = "auto memory", HTML_COMMENT_REGEX, MEMORY_INDEX_APPROACHING_THRESHOLD = 0.8, MEMORY_INDEX_TARGET_FRACTION = 0.7, WRITE_GUARD_READ_LIMIT, teamMemPrompts, DIR_EXISTS_GUIDANCE = "This directory already exists \u2014 write to it directly with the Write tool (do not run mkdir or check for its existence).", DIRS_EXIST_GUIDANCE = "Both directories already exist \u2014 write to them directly with the Write tool (do not run mkdir or check for their existence).";
+var teamMemPaths7, ENTRYPOINT_NAME = "MEMORY.md", MAX_ENTRYPOINT_LINES = 200, MAX_ENTRYPOINT_BYTES = 25000, AUTO_MEM_DISPLAY_NAME = "auto memory", HTML_COMMENT_REGEX, CUT_LINE_PREVIEW_MAX = 80, MEMORY_INDEX_APPROACHING_THRESHOLD = 0.8, MEMORY_INDEX_TARGET_FRACTION = 0.7, WRITE_GUARD_READ_LIMIT, teamMemPrompts, DIR_EXISTS_GUIDANCE = "This directory already exists \u2014 write to it directly with the Write tool (do not run mkdir or check for its existence).", DIRS_EXIST_GUIDANCE = "Both directories already exist \u2014 write to them directly with the Write tool (do not run mkdir or check for their existence).";
 var init_memdir = __esm(() => {
   init_featureFlags();
   init_marked_esm();
@@ -726315,6 +727182,8 @@ var init_memdir = __esm(() => {
   init_format();
   init_sessionStorage();
   init_settings2();
+  init_stringUtils();
+  init_truncateMiddle();
   init_memoryTypes();
   teamMemPaths7 = feature("TEAMMEM") ? (init_teamMemPaths(), __toCommonJS(exports_teamMemPaths)) : null;
   HTML_COMMENT_REGEX = /<!--[\s\S]*?-->/g;
@@ -726393,10 +727262,108 @@ var init_agentMemory = __esm(() => {
   init_path2();
 });
 
+// src/utils/permissions/symlinkEquivalences.ts
+import { posix as posix8 } from "path";
+function unescapePatternSegment(segment2) {
+  return segment2.replace(/\\([\s\S])/g, (match, char) => ESCAPABLE_PATTERN_CHAR.test(char) ? char : match);
+}
+function escapePatternPath(path39) {
+  let escaped = path39.replaceAll("\\", "\\\\").replace(/[[\]()|+^$]/g, (char) => `\\${char}`);
+  escaped = escaped.replaceAll("*", "\\*");
+  if (escaped.startsWith("!") || escaped.startsWith("#")) {
+    escaped = `\\${escaped}`;
+  }
+  return escaped.replace(/\s+$/, (whitespace) => Array.from(whitespace, (char) => `\\${char}`).join(""));
+}
+function collapsePatternSlashes(pattern) {
+  const collapsed = pattern.replace(/\/{2,}/g, "/");
+  if (/^\s*(?:\/\*\*)?$/.test(collapsed)) {
+    return collapsed;
+  }
+  return collapsed.replace(/^\uFEFF([!#]?)/, (_match, marker) => marker ? `\\${marker}` : "").replace(/^\uFEFF/, "[\uFEFF]");
+}
+function normalizeTrailingGlobstar(pattern, isAllow) {
+  if (pattern.endsWith("/**")) {
+    const withoutSuffix = pattern.slice(0, -3);
+    if (/[^/]/.test(withoutSuffix)) {
+      return withoutSuffix.includes("/") || !isAllow || /^[!#]/.test(withoutSuffix) ? withoutSuffix : `/${withoutSuffix}`;
+    }
+    return "/**";
+  }
+  return pattern;
+}
+function unusablePatternReason(pattern) {
+  if (UNUSABLE_IGNORE_PATTERN.test(pattern)) {
+    return "skipped by the ignore library (blank, comment, or trailing backslash)";
+  }
+  return validateIgnorePattern(pattern);
+}
+function makePhysicalTwinsKey(root3, pattern) {
+  return `${root3}\x00${pattern}`;
+}
+function getOrInitPhysicalTwins(key4) {
+  let twins = physicalTwinsByPattern.get(key4);
+  if (twins === undefined) {
+    twins = new Set;
+    physicalTwinsByPattern.set(key4, twins);
+  }
+  return twins;
+}
+function resolvePhysicalTwinPattern(root3, rawPattern) {
+  if (getPlatform() === "windows") {
+    return null;
+  }
+  const pattern = collapsePatternSlashes(rawPattern);
+  if (!pattern.startsWith("/")) {
+    return null;
+  }
+  const segments = pattern.slice(1).split("/");
+  let prefixEnd = 0;
+  while (prefixEnd < segments.length && segments[prefixEnd] !== "" && !UNESCAPED_GLOB_CHAR.test(segments[prefixEnd])) {
+    prefixEnd++;
+  }
+  if (prefixEnd === 0) {
+    return null;
+  }
+  const prefixPath = posix8.join(root3, ...segments.slice(0, prefixEnd).map(unescapePatternSegment));
+  let physicalPrefix;
+  try {
+    physicalPrefix = resolveDeepestExistingAncestorSync(getFsImplementation(), prefixPath);
+  } catch (error52) {
+    logForDebugging(`Could not resolve the physical twin of rule prefix ${prefixPath}: ${error52}`);
+    return null;
+  }
+  if (physicalPrefix === undefined || physicalPrefix === prefixPath || physicalPrefix === DIR_SEP) {
+    return null;
+  }
+  const rest = segments.slice(prefixEnd);
+  const twin = collapsePatternSlashes(escapePatternPath(physicalPrefix) + (rest.length > 0 ? `/${rest.join("/")}` : ""));
+  const normalized = normalizeTrailingGlobstar(twin, false);
+  if (unusablePatternReason(normalized) !== null) {
+    return null;
+  }
+  if (normalized !== twin && `${normalized}/**` !== twin) {
+    return null;
+  }
+  return twin;
+}
+var DIR_SEP, UNESCAPED_GLOB_CHAR, ESCAPABLE_PATTERN_CHAR, UNUSABLE_IGNORE_PATTERN, physicalTwinsByPattern;
+var init_symlinkEquivalences = __esm(() => {
+  init_debug();
+  init_fsOperations();
+  init_globPatternValidation();
+  init_platform2();
+  DIR_SEP = posix8.sep;
+  UNESCAPED_GLOB_CHAR = /(?:^|[^\\])(?:\\\\)*[*?[]/;
+  ESCAPABLE_PATTERN_CHAR = /^[\\[\]!#()|+^$*?\s]$/;
+  UNUSABLE_IGNORE_PATTERN = /^\s*$|^#|(?:^|[^\\])\\$/;
+  physicalTwinsByPattern = new Map;
+});
+
 // src/utils/permissions/filesystem.ts
 import { randomBytes as randomBytes19 } from "crypto";
 import { homedir as homedir44, tmpdir as tmpdir15 } from "os";
-import { join as join164, normalize as normalize18, posix as posix8, sep as sep47 } from "path";
+import { join as join164, normalize as normalize18, posix as posix9, sep as sep47 } from "path";
 function normalizeCaseForComparison2(path39) {
   return path39.toLowerCase();
 }
@@ -726439,9 +727406,9 @@ function relativePath(from2, to) {
   if (getPlatform() === "windows") {
     const posixFrom = windowsPathToPosixPath(from2);
     const posixTo = windowsPathToPosixPath(to);
-    return posix8.relative(posixFrom, posixTo);
+    return posix9.relative(posixFrom, posixTo);
   }
-  return posix8.relative(from2, to);
+  return posix9.relative(from2, to);
 }
 function toPosixPath(path39) {
   if (getPlatform() === "windows") {
@@ -726636,7 +727603,7 @@ function pathInWorkingPath(path39, workingPath) {
   if (containsPathTraversal(relative32)) {
     return false;
   }
-  return !posix8.isAbsolute(relative32);
+  return !posix9.isAbsolute(relative32);
 }
 function rootPathForSource(source2) {
   switch (source2) {
@@ -726653,25 +727620,25 @@ function rootPathForSource(source2) {
   }
 }
 function prependDirSep(path39) {
-  return posix8.join(DIR_SEP, path39);
+  return posix9.join(DIR_SEP2, path39);
 }
 function normalizePatternToPath({
   patternRoot,
   pattern,
   rootPath
 }) {
-  const fullPattern = posix8.join(patternRoot, pattern);
+  const fullPattern = posix9.join(patternRoot, pattern);
   if (patternRoot === rootPath) {
     return prependDirSep(pattern);
-  } else if (fullPattern.startsWith(`${rootPath}${DIR_SEP}`)) {
+  } else if (fullPattern.startsWith(`${rootPath}${DIR_SEP2}`)) {
     const relativePart = fullPattern.slice(rootPath.length);
     return prependDirSep(relativePart);
   } else {
-    const relativePath2 = posix8.relative(rootPath, patternRoot);
-    if (!relativePath2 || relativePath2.startsWith(`..${DIR_SEP}`) || relativePath2 === "..") {
+    const relativePath2 = posix9.relative(rootPath, patternRoot);
+    if (!relativePath2 || relativePath2.startsWith(`..${DIR_SEP2}`) || relativePath2 === "..") {
       return null;
     } else {
-      const relativePattern = posix8.join(relativePath2, pattern);
+      const relativePattern = posix9.join(relativePath2, pattern);
       return prependDirSep(relativePattern);
     }
   }
@@ -726704,7 +727671,7 @@ function getFileReadIgnorePatterns(toolPermissionContext) {
   return result;
 }
 function patternWithRoot(pattern, source2) {
-  if (pattern.startsWith(`${DIR_SEP}${DIR_SEP}`)) {
+  if (pattern.startsWith(`${DIR_SEP2}${DIR_SEP2}`)) {
     const patternWithoutDoubleSlash = pattern.slice(1);
     if (getPlatform() === "windows" && patternWithoutDoubleSlash.match(/^\/[a-z]\//i)) {
       const driveLetter = patternWithoutDoubleSlash[1]?.toUpperCase() ?? "C";
@@ -726718,21 +727685,21 @@ function patternWithRoot(pattern, source2) {
     }
     return {
       relativePattern: patternWithoutDoubleSlash,
-      root: DIR_SEP
+      root: DIR_SEP2
     };
-  } else if (pattern.startsWith(`~${DIR_SEP}`)) {
+  } else if (pattern.startsWith(`~${DIR_SEP2}`)) {
     return {
       relativePattern: pattern.slice(1),
       root: homedir44().normalize("NFC")
     };
-  } else if (pattern.startsWith(DIR_SEP)) {
+  } else if (pattern.startsWith(DIR_SEP2)) {
     return {
       relativePattern: pattern,
       root: rootPathForSource(source2)
     };
   }
   let normalizedPattern = pattern;
-  if (pattern.startsWith(`.${DIR_SEP}`)) {
+  if (pattern.startsWith(`.${DIR_SEP2}`)) {
     normalizedPattern = pattern.slice(2);
   }
   return {
@@ -726822,6 +727789,24 @@ function getPatternsByRoot(toolPermissionContext, toolType, behavior) {
       patternsByRoot.set(root3, patternsForRoot);
     }
     patternsForRoot.set(relativePattern, rule);
+    if (behavior === "allow" || root3 === null) {
+      continue;
+    }
+    const twins = getOrInitPhysicalTwins(makePhysicalTwinsKey(root3, relativePattern));
+    const twin = resolvePhysicalTwinPattern(root3, relativePattern);
+    if (twin !== null) {
+      twins.add(twin);
+    }
+    for (const twinPattern of twins) {
+      let rootSlashPatterns = patternsByRoot.get(DIR_SEP2);
+      if (rootSlashPatterns === undefined) {
+        rootSlashPatterns = new Map;
+        patternsByRoot.set(DIR_SEP2, rootSlashPatterns);
+      }
+      if (!rootSlashPatterns.has(twinPattern)) {
+        rootSlashPatterns.set(twinPattern, rule);
+      }
+    }
   }
   return patternsByRoot;
 }
@@ -726834,7 +727819,7 @@ function matchingRuleForInput(path39, toolPermissionContext, toolType, behavior)
   for (const [root3, { patternMap, getIg }] of matchersByRoot.entries()) {
     const ig = getIg();
     const relativePathStr = relativePath(root3 ?? getCwd(), fileAbsolutePath ?? getCwd());
-    if (relativePathStr.startsWith(`..${DIR_SEP}`)) {
+    if (relativePathStr.startsWith(`..${DIR_SEP2}`)) {
       continue;
     }
     if (!relativePathStr) {
@@ -727295,7 +728280,7 @@ function checkReadableInternalPath(absolutePath, input2) {
   }
   return { behavior: "passthrough", message: "" };
 }
-var import_ignore6, DANGEROUS_FILES2, DANGEROUS_DIRECTORIES2, DIR_SEP, getClaudeTempDir, getBundledSkillsRoot, getResolvedWorkingDirPaths, MATCHER_RECOMPILE_THRESHOLD = 1e4, MATCHER_CACHE_MAX_ENTRIES = 16, matcherCache;
+var import_ignore6, DANGEROUS_FILES2, DANGEROUS_DIRECTORIES2, DIR_SEP2, getClaudeTempDir, getBundledSkillsRoot, getResolvedWorkingDirPaths, MATCHER_RECOMPILE_THRESHOLD = 1e4, MATCHER_CACHE_MAX_ENTRIES = 16, matcherCache;
 var init_filesystem = __esm(() => {
   init_featureFlags();
   init_memoize();
@@ -727318,6 +728303,7 @@ var init_filesystem = __esm(() => {
   init_windowsPaths();
   init_PermissionUpdate();
   init_permissions2();
+  init_symlinkEquivalences();
   import_ignore6 = __toESM(require_ignore(), 1);
   DANGEROUS_FILES2 = [
     ".gitconfig",
@@ -727338,7 +728324,7 @@ var init_filesystem = __esm(() => {
     ".claude",
     ".husky"
   ];
-  DIR_SEP = posix8.sep;
+  DIR_SEP2 = posix9.sep;
   getClaudeTempDir = memoize_default(function getClaudeTempDir2() {
     const baseTmpDir = process.env.CLAUDE_CODE_TMPDIR || (getPlatform() === "windows" ? tmpdir15() : "/tmp");
     const fs26 = getFsImplementation();
@@ -762345,6 +763331,14 @@ var init_useBuddyNotification = __esm(() => {
   jsx_runtime402 = __toESM(require_jsx_runtime(), 1);
 });
 
+// src/hooks/historyEdited.ts
+function computeHistoryEdited(historyIndex, currentInput, recalledValue) {
+  return historyIndex > 0 && currentInput !== recalledValue;
+}
+function computeSuppressSuggestions(isSearchingHistory, historyIndex, historyEdited) {
+  return isSearchingHistory || historyIndex > 0 && !historyEdited;
+}
+
 // src/hooks/useIdeConnectionStatus.ts
 function useIdeConnectionStatus(mcpClients) {
   return import_react223.useMemo(() => {
@@ -764062,6 +765056,7 @@ function useArrowKeyHistory(onSetInput, currentInput, pastedContents, setCursorO
   const historyCache = import_react235.useRef([]);
   const historyCacheModeFilter = import_react235.useRef(undefined);
   const historyIndexRef = import_react235.useRef(0);
+  const recalledValueRef = import_react235.useRef(null);
   const initialModeFilterRef = import_react235.useRef(undefined);
   const currentInputRef = import_react235.useRef(currentInput);
   const pastedContentsRef = import_react235.useRef(pastedContents);
@@ -764070,6 +765065,7 @@ function useArrowKeyHistory(onSetInput, currentInput, pastedContents, setCursorO
   pastedContentsRef.current = pastedContents;
   currentModeRef.current = currentMode;
   const setInputWithCursor = import_react235.useCallback((value, mode, contents, cursorToStart = false) => {
+    recalledValueRef.current = value;
     onSetInput(value, mode, contents);
     setCursorOffset?.(cursorToStart ? 0 : value.length);
   }, [onSetInput, setCursorOffset]);
@@ -764165,6 +765161,7 @@ function useArrowKeyHistory(onSetInput, currentInput, pastedContents, setCursorO
     setHistoryIndex(0);
     historyIndexRef.current = 0;
     initialModeFilterRef.current = undefined;
+    recalledValueRef.current = null;
     removeNotification("search-history-hint");
     historyCache.current = [];
     historyCacheModeFilter.current = undefined;
@@ -764174,6 +765171,7 @@ function useArrowKeyHistory(onSetInput, currentInput, pastedContents, setCursorO
   }, [removeNotification]);
   return {
     historyIndex,
+    historyEdited: computeHistoryEdited(historyIndex, currentInput, recalledValueRef.current),
     setHistoryIndex,
     onHistoryUp,
     onHistoryDown,
@@ -764181,7 +765179,7 @@ function useArrowKeyHistory(onSetInput, currentInput, pastedContents, setCursorO
     dismissSearchHint
   };
 }
-var import_react235, jsx_runtime414, HISTORY_CHUNK_SIZE = 10, pendingLoad = null, pendingLoadTarget = 0, pendingLoadModeFilter = undefined;
+var import_react235, jsx_runtime414, HISTORY_CHUNK_SIZE = 10, pendingLoad = null, pendingLoadTarget = 0, pendingLoadModeFilter;
 var init_useArrowKeyHistory = __esm(() => {
   init_notifications();
   init_ConfigurableShortcutHint();
@@ -776184,7 +777182,8 @@ function PromptInput({
     onHistoryUp,
     onHistoryDown,
     dismissSearchHint,
-    historyIndex
+    historyIndex,
+    historyEdited
   } = useArrowKeyHistory((value, historyMode, pastedContents2) => {
     onChange(value);
     onModeChange(historyMode);
@@ -776335,7 +777334,7 @@ function PromptInput({
     agents: agents2,
     setSuggestionsState,
     suggestionsState,
-    suppressSuggestions: isSearchingHistory || historyIndex > 0,
+    suppressSuggestions: computeSuppressSuggestions(isSearchingHistory, historyIndex, historyEdited),
     markAccepted,
     onModeChange
   });
@@ -797752,7 +798751,10 @@ function useMcpConnectivityStatus(t0) {
       }
       const failedLocalClients = mcpClients.filter(_temp225);
       const failedClaudeAiClients = mcpClients.filter(_temp286);
-      const needsAuthCount = getMcpNeedsAuthCount(mcpClients);
+      if (countNoticedServersNowConnected(mcpClients) > 0) {
+        pruneNoticedServersNowConnected(mcpClients);
+      }
+      const needsAuthCount = countNeedsAuthToAnnounce(mcpClients, MCP_NEEDS_AUTH_NOTICE_DEPS);
       if (failedLocalClients.length === 0 && failedClaudeAiClients.length === 0 && needsAuthCount === 0) {
         return;
       }
@@ -797829,6 +798831,7 @@ function useMcpConnectivityStatus(t0) {
           }),
           priority: "medium"
         });
+        markNeedsAuthNoticed(mcpClients, MCP_NEEDS_AUTH_NOTICE_DEPS);
       }
     };
     t32 = [addNotification, mcpClients];
@@ -797848,16 +798851,21 @@ function _temp286(client_0) {
 function _temp225(client8) {
   return client8.type === "failed" && client8.config.type !== "sse-ide" && client8.config.type !== "ws-ide" && client8.config.type !== "claudeai-proxy";
 }
-var import_compiler_runtime326, import_react303, jsx_runtime455, EMPTY_MCP_CLIENTS;
+var import_compiler_runtime326, import_react303, jsx_runtime455, EMPTY_MCP_CLIENTS, MCP_NEEDS_AUTH_NOTICE_DEPS;
 var init_useMcpConnectivityStatus = __esm(() => {
   init_notifications();
   init_state();
   init_ink2();
   init_claudeai();
+  init_mcpNeedsAuthNotice();
   import_compiler_runtime326 = __toESM(require_compiler_runtime(), 1);
   import_react303 = __toESM(require_react(), 1);
   jsx_runtime455 = __toESM(require_jsx_runtime(), 1);
   EMPTY_MCP_CLIENTS = [];
+  MCP_NEEDS_AUTH_NOTICE_DEPS = {
+    hasEverConnected: hasClaudeAiMcpEverConnected,
+    connectedThisSession: isClaudeAiMcpCurrentlyConnected
+  };
 });
 
 // src/hooks/notifs/useAutoModeUnavailableNotification.ts
@@ -807091,13 +808099,13 @@ var init_bootstrap = __esm(() => {
 });
 
 // src/utils/warningHandler.ts
-import { posix as posix9, win32 as win324 } from "path";
+import { posix as posix10, win32 as win324 } from "path";
 function isRunningFromBuildDirectory() {
   let invokedPath = process.argv[1] || "";
   let execPath2 = process.execPath || process.argv[0] || "";
   if (getPlatform() === "windows") {
-    invokedPath = invokedPath.split(win324.sep).join(posix9.sep);
-    execPath2 = execPath2.split(win324.sep).join(posix9.sep);
+    invokedPath = invokedPath.split(win324.sep).join(posix10.sep);
+    execPath2 = execPath2.split(win324.sep).join(posix10.sep);
   }
   const pathsToCheck = [invokedPath, execPath2];
   const buildDirs = [
@@ -823803,11 +824811,14 @@ async function mcpListHandler() {
     }), {
       concurrency: getMcpServerConnectionBatchSize()
     });
+    const displayConfigs = getDisplayServers(configs, resolveUnexpandedMcpServers);
     for (const {
       name: name3,
-      server,
       status: status2
     } of results) {
+      const server = displayConfigs[name3];
+      if (!server)
+        continue;
       if (server.type === "sse") {
         console.log(`${name3}: ${server.url} (SSE) - ${status2}`);
       } else if (server.type === "http") {
@@ -823834,12 +824845,13 @@ async function mcpGetHandler(name3) {
   console.log(`  Scope: ${getScopeLabel(server.scope)}`);
   const status2 = await checkMcpServerHealth(name3, server);
   console.log(`  Status: ${status2}`);
-  if (server.type === "sse") {
+  const display = getDisplayConfig(name3, server, resolveUnexpandedMcpServers);
+  if (display.type === "sse") {
     console.log(`  Type: sse`);
-    console.log(`  URL: ${server.url}`);
-    if (server.headers) {
+    console.log(`  URL: ${display.url}`);
+    if (display.headers) {
       console.log("  Headers:");
-      for (const [key4, value] of Object.entries(server.headers)) {
+      for (const [key4, value] of Object.entries(display.headers)) {
         console.log(`    ${key4}: ${value}`);
       }
     }
@@ -823855,12 +824867,12 @@ async function mcpGetHandler(name3) {
         parts.push(`callback_port ${server.oauth.callbackPort}`);
       console.log(`  OAuth: ${parts.join(", ")}`);
     }
-  } else if (server.type === "http") {
+  } else if (display.type === "http") {
     console.log(`  Type: http`);
-    console.log(`  URL: ${server.url}`);
-    if (server.headers) {
+    console.log(`  URL: ${display.url}`);
+    if (display.headers) {
       console.log("  Headers:");
-      for (const [key4, value] of Object.entries(server.headers)) {
+      for (const [key4, value] of Object.entries(display.headers)) {
         console.log(`    ${key4}: ${value}`);
       }
     }
@@ -823876,14 +824888,14 @@ async function mcpGetHandler(name3) {
         parts.push(`callback_port ${server.oauth.callbackPort}`);
       console.log(`  OAuth: ${parts.join(", ")}`);
     }
-  } else if (server.type === "stdio") {
+  } else if (display.type === "stdio") {
     console.log(`  Type: stdio`);
-    console.log(`  Command: ${server.command}`);
-    const args = Array.isArray(server.args) ? server.args : [];
+    console.log(`  Command: ${display.command}`);
+    const args = Array.isArray(display.args) ? display.args : [];
     console.log(`  Args: ${args.join(" ")}`);
-    if (server.env) {
+    if (display.env) {
       console.log("  Environment:");
-      for (const [key4, value] of Object.entries(server.env)) {
+      for (const [key4, value] of Object.entries(display.env)) {
         console.log(`    ${key4}=${value}`);
       }
     }
@@ -824010,7 +825022,7 @@ After authorizing, paste the full redirect URL here and press Enter:`);
     });
     cliOk(`Successfully authenticated with MCP server "${name3}".`);
   } catch (error52) {
-    cliError(`Failed to authenticate with MCP server "${name3}": ${error52.message}`);
+    cliError(`Failed to authenticate with MCP server "${name3}": ${redactMcpErrorDetail(name3, server, error52.message, resolveUnexpandedMcpServers)}`);
   }
 }
 async function mcpLogoutHandler(name3) {
@@ -824043,6 +825055,7 @@ var init_mcp5 = __esm(() => {
   init_auth11();
   init_client12();
   init_config6();
+  init_redaction();
   init_utils9();
   init_normalization();
   init_AppState();
@@ -827596,6 +828609,7 @@ ${inputPrompt}` : mainThreadAgentDefinition.initialPrompt;
       effectiveMainLoopModel = ensureFableConsentSync(effectiveMainLoopModel);
       setInitialMainLoopModel(effectiveMainLoopModel);
     }
+    emitStartupEffortCapWarning(parseEffortValue(options.effort) ?? getInitialEffortSetting(), parseUserSpecifiedModel(effectiveMainLoopModel ?? getDefaultMainLoopModel()), outputFormat);
     let advisorModel;
     if (isAdvisorEnabled()) {
       const advisorOption = canUserConfigureAdvisor() ? options.advisor : undefined;
@@ -829569,6 +830583,7 @@ var init_main7 = __esm(() => {
   init_autoCompactWindow();
   init_earlyInput();
   init_effort();
+  init_cap();
   init_fastMode();
   init_managedEnv();
   init_messages3();