@cydm/pie 2.5.0 → 2.5.2

package/dist/builtin/extensions/ask-user/index.js

@@ -1,9 +1,9 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 import {
   createAskUserCapability
-} from "../../../chunks/chunk-JXY3YLDS.js";
-import "../../../chunks/chunk-ZKHMNEXL.js";
-import "../../../chunks/chunk-YRXXRLMQ.js";
+} from "../../../chunks/chunk-LO2V5DZZ.js";
+import "../../../chunks/chunk-RTTGO2A6.js";
+import "../../../chunks/chunk-UD7KYQ6J.js";
 import "../../../chunks/chunk-XXGYUYXI.js";
 import "../../../chunks/chunk-LZQXQOPJ.js";
 

package/dist/builtin/extensions/computer-use/index.js

@@ -3787,8 +3787,23 @@ function wireableInputDescendants(node) {
   visit(node);
   return matches;
 }
+var FOCUS_CHANGING_KEYS = /* @__PURE__ */ new Set(["TAB", "SHIFT+TAB", "ENTER", "RETURN", "SPACE", "UP", "DOWN", "LEFT", "RIGHT", "UP_ARROW", "DOWN_ARROW", "LEFT_ARROW", "RIGHT_ARROW", "ESC", "ESCAPE", "HOME", "END", "PAGE_UP", "PAGE_DOWN", "PAGEDOWN", "PAGEUP"]);
+function isFocusChangingKey(keys2) {
+  const list = typeof keys2 === "string" ? [keys2] : Array.isArray(keys2) ? keys2 : [];
+  for (const raw of list) {
+    if (typeof raw !== "string") continue;
+    const token = raw.trim().toUpperCase().split("+").pop() ?? "";
+    if (FOCUS_CHANGING_KEYS.has(token) || FOCUS_CHANGING_KEYS.has(raw.trim().toUpperCase())) return true;
+  }
+  return false;
+}
 function recordActionFocus(action, state, node, coordinateFocus = false) {
-  if (!["click", "press", "keypress", "typeText"].includes(action.action) || !action.ref && action.action !== "click") return;
+  if (action.action === "keypress" && !action.ref && isFocusChangingKey(action.keys)) {
+    state.currentFocus = true;
+    state.focusRef = void 0;
+    return;
+  }
+  if (!["click", "press", "keypress", "typeText"].includes(action.action) || !action.ref && action.action !== "click" && action.action !== "press" && !coordinateFocus) return;
   state.currentFocus = Boolean(node?.isTextInput && !node.pictureOnly) || coordinateFocus;
   state.focusRef = node?.isTextInput && node.wireRef && !node.pictureOnly ? node.ref : void 0;
   if (!state.currentFocus && node && !node.pictureOnly && action.ref && (action.action === "click" || action.action === "press") && containsEditable(node)) {
@@ -8546,7 +8561,7 @@ async function dispatchUiAction(action, target, look, headless, state, signal) {
   }
   const trace = await helperAct(target, prepared, headless, signal);
   if (!headless) {
-    const coordinateFocus = prepared.action === "click" && "x" in prepared.target;
+    const coordinateFocus = (prepared.action === "click" || prepared.action === "press") && "x" in prepared.target;
     const node = action.ref ? outlineNodeByRef(action.ref.trim()) : coordinateFocus ? editorAtPoint(currentOutlineOrThrow().nodes, action.x, action.y) : void 0;
     recordActionFocus(action, state, node, coordinateFocus);
   }

package/dist/builtin/extensions/computer-use/scripts/setup-helper.mjs

@@ -313,19 +313,100 @@ async function installPrebuiltHelperApp(sourceAppPath) {
 	const existingInfo = await fs.readFile(path.join(helperAppPath, "Contents", "Info.plist"), "utf8").catch(() => undefined);
 	const sourceInfo = await fs.readFile(sourceInfoPath, "utf8");
 	if (existingExecutable?.equals(sourceExecutable) && existingInfo === sourceInfo) {
-		await registerHelperApp();
-		return false;
+		// Byte equality alone is NOT sufficient for the no-change shortcut: a
+		// damaged/missing _CodeSignature (CodeResources tampered or deleted
+		// around an otherwise-identical executable) would otherwise survive
+		// every repair invocation. The existing bundle must still verify.
+		let existingVerifies = false;
+		try {
+			await run("codesign", ["--verify", "--strict", helperAppPath]);
+			existingVerifies = true;
+		} catch {
+			// Fall through to the replacement path below, which re-installs (and
+			// re-verifies) a complete bundle.
+		}
+		if (existingVerifies) {
+			await registerHelperApp();
+			return false;
+		}
 	}
 	// The sealed bundle must arrive intact — a broken signature would burn
 	// the user's TCC grants on an identity that can never validate.
 	await run("codesign", ["--verify", "--strict", sourceAppPath]);
-	await fs.rm(helperAppPath, { force: true, recursive: true });
-	// ditto preserves the bundle byte-for-byte (signature + stapled
-	// notarization ticket). The sealed app is NEVER re-signed here: its
-	// Developer ID designated requirement (identifier + team) is exactly
-	// what gives release builds their best chance of retaining TCC grants.
-	await run("/usr/bin/ditto", [sourceAppPath, helperAppPath]);
-	await registerHelperApp();
+	// Sweep staging directories abandoned by crashed installers (the finally
+	// below only runs on ordinary unwinding). Reclaim is ownership-aware:
+	// the staging name embeds its creator's PID, and ONLY a demonstrably dead
+	// owner (ESRCH on signal-0) plus age beyond a generous slow-install window
+	// makes a stage garbage — mtime alone is not ownership evidence, so a
+	// live/slow installer's stage is never touched.
+	try {
+		const parent = path.dirname(helperAppPath);
+		const base = path.basename(helperAppPath);
+		const entries = await fs.readdir(parent);
+		const cutoff = Date.now() - 60 * 60 * 1000;
+		for (const entry of entries) {
+			// Exact staging format <app>.staged-<pid>-<ts36>: anything else that
+			// merely contains ".staged-" is not ours to touch.
+			const match = new RegExp(`^${base.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\.staged-(\\d+)-[0-9a-z]+$`).exec(entry);
+			if (!match) continue;
+			const staged = path.join(parent, entry);
+			try {
+				const stat = await fs.stat(staged);
+				if (stat.mtimeMs >= cutoff) continue;
+				const ownerPid = Number(match[1]);
+				let ownerAlive = false;
+				try {
+					process.kill(ownerPid, 0);
+					ownerAlive = true;
+				} catch (error) {
+					// ESRCH: dead. EPERM (exists, other user): treat as alive —
+					// conservative, never delete on unknown liveness.
+					ownerAlive = error && error.code === "EPERM";
+				}
+				if (!ownerAlive) await fs.rm(staged, { force: true, recursive: true });
+			} catch { /* raced away */ }
+		}
+	} catch { /* no parent dir yet */ }
+	// Stage-then-swap: the staged copy is verified before publication and the
+	// previous installation survives every failure up to the final swap.
+	// NOTE: the swap itself (rm + rename) is NOT atomic — directory bundles
+	// have no atomic exchange on stock Node — but the failure window no longer
+	// starts before verification, and a crash mid-swap self-heals on the next
+	// run (which re-stages from the verified source).
+	const stagingPath = `${helperAppPath}.staged-${process.pid}-${Date.now().toString(36)}`;
+	await fs.rm(stagingPath, { force: true, recursive: true });
+	try {
+		// ditto preserves the bundle byte-for-byte (signature + stapled
+		// notarization ticket). The sealed app is NEVER re-signed here: its
+		// Developer ID designated requirement (identifier + team) is exactly
+		// what gives release builds their best chance of retaining TCC grants.
+		await run("/usr/bin/ditto", [sourceAppPath, stagingPath]);
+		// Verify the STAGED bundle (not just the source): source mutation
+		// between the verify above and the copy, or a torn copy, stops here.
+		await run("codesign", ["--verify", "--strict", stagingPath]);
+		let published = false;
+		try {
+			await fs.rm(helperAppPath, { force: true, recursive: true });
+			await fs.rename(stagingPath, helperAppPath);
+			published = true;
+		} catch (renameError) {
+			// Cross-device or otherwise unrenamable staging: fall back to a
+			// second ditto onto the final path, then verify the destination. A
+			// VERIFIED fallback is a successful installation — continue to
+			// registration instead of failing after doing the work.
+			try {
+				await run("/usr/bin/ditto", [stagingPath, helperAppPath]);
+				await run("codesign", ["--verify", "--strict", helperAppPath]);
+				published = true;
+			} catch (fallbackError) {
+				fallbackError.cause = renameError;
+				throw fallbackError;
+			}
+		}
+		if (published) await registerHelperApp();
+	} finally {
+		await fs.rm(stagingPath, { force: true, recursive: true }).catch(() => {});
+	}
 	return true;
 }
 

package/dist/builtin/extensions/herdr-agent-state/index.js

@@ -136,7 +136,42 @@ function spawnHerdrReport(binPath, args, timeoutMs = REPORT_TIMEOUT_MS) {
   } catch {
   }
 }
-function attachHerdrReporter(host, herdr, transport = (args) => spawnHerdrReport(herdr.binPath, args), sequencer = createReportSequencer()) {
+var KILL_GRACE_MS = 1e3;
+async function runHerdrReportBounded(binPath, args, timeoutMs = REPORT_TIMEOUT_MS) {
+  let child;
+  try {
+    child = spawn(binPath, args, { detached: true, stdio: "ignore" });
+  } catch {
+    return { outcome: "spawn-error", exitCode: null };
+  }
+  return await new Promise((resolve) => {
+    let killTimer;
+    let settled = false;
+    const finish = (outcome, exitCode) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (killTimer) clearTimeout(killTimer);
+      resolve({ outcome, exitCode });
+    };
+    const timer = setTimeout(() => {
+      try {
+        child.kill("SIGTERM");
+      } catch {
+      }
+      killTimer = setTimeout(() => {
+        try {
+          if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL");
+        } catch {
+        }
+        killTimer = setTimeout(() => finish("escalated", child.exitCode), 250);
+      }, KILL_GRACE_MS);
+    }, timeoutMs);
+    child.on("error", () => finish("spawn-error", null));
+    child.on("exit", (code) => finish("exited", code));
+  });
+}
+function attachHerdrReporter(host, herdr, transport = (args) => spawnHerdrReport(herdr.binPath, args), sequencer = createReportSequencer(), shutdownTransport = (args) => runHerdrReportBounded(herdr.binPath, args)) {
   const nextSeq = sequencer;
   let agentActive = false;
   const blockingToolCalls = /* @__PURE__ */ new Map();
@@ -238,10 +273,10 @@ function attachHerdrReporter(host, herdr, transport = (args) => spawnHerdrReport
     }
     publishState();
   });
-  host.registerCleanup?.((reason) => {
+  host.registerCleanup?.(async (reason) => {
     if (reason !== "shutdown") return;
     if (!heldPane) return;
-    report(
+    await shutdownTransport(
       buildReleaseReportArgs({
         paneId: herdr.paneId,
         source: SOURCE_ID,
@@ -267,6 +302,7 @@ export {
   createReportSequencer,
   herdrAgentStateExtension as default,
   readHerdrEnvironment,
+  runHerdrReportBounded,
   spawnHerdrReport,
   summarizeAskUserQuestion
 };

package/dist/builtin/extensions/mcp-adapter/index.js

@@ -24434,6 +24434,7 @@ var StdioClientTransport = class {
 };
 
 // builtin/extensions/mcp-adapter/src/server-manager.ts
+import { createHash } from "node:crypto";
 import * as fs2 from "node:fs";
 import * as path2 from "node:path";
 var CONNECT_TIMEOUT_MS = 3e4;
@@ -24442,6 +24443,41 @@ var PACKAGE_MANAGER_COMMANDS = /* @__PURE__ */ new Set(["npx", "npm", "bunx", "u
 var METADATA_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 var CALL_TIMEOUT_MS = 12e4;
 var STDERR_TAIL_LIMIT = 4e3;
+var DIAGNOSTIC_TEXT_LIMIT = 1500;
+function definitionSecrets(definition) {
+  const secrets = [];
+  for (const value of Object.values(definition.env ?? {})) {
+    if (typeof value === "string" && value.length > 0) secrets.push(value);
+  }
+  for (const value of Object.values(definition.headers ?? {})) {
+    if (typeof value === "string" && value.length > 0) secrets.push(value);
+  }
+  return secrets.sort((a, b) => b.length - a.length);
+}
+function redactSecrets(text, secrets) {
+  let sanitized = text;
+  for (const secret of secrets) {
+    sanitized = sanitized.split(secret).join("[redacted]");
+  }
+  return sanitized;
+}
+function sanitizeDiagnostic(text, secrets) {
+  let sanitized = redactSecrets(text, secrets);
+  if (secrets.length > 0 && sanitized.length > 0) {
+    for (const secret of secrets) {
+      for (let keep = Math.min(secret.length - 1, sanitized.length); keep >= 4; keep--) {
+        if (sanitized.startsWith(secret.slice(secret.length - keep))) {
+          sanitized = `[redacted]${sanitized.slice(keep)}`;
+          break;
+        }
+      }
+    }
+  }
+  if (sanitized.length > DIAGNOSTIC_TEXT_LIMIT) {
+    sanitized = `${sanitized.slice(0, DIAGNOSTIC_TEXT_LIMIT)}\u2026[truncated ${sanitized.length - DIAGNOSTIC_TEXT_LIMIT} chars]`;
+  }
+  return sanitized;
+}
 function connectTimeoutFor(definition) {
   if (definition.connectTimeoutMs !== void 0) return definition.connectTimeoutMs;
   const base = path2.basename(definition.command ?? "");
@@ -24499,6 +24535,22 @@ function withTimeout(promise, timeoutMs, label, signal) {
     );
   });
 }
+function cacheFingerprint(definition) {
+  return createHash("sha256").update(JSON.stringify({
+    sourceScope: definition.sourceScope,
+    sourcePath: definition.sourcePath,
+    name: definition.name,
+    command: definition.command,
+    args: definition.args,
+    // Canonicalized (key-sorted) so reordering equivalent env/header keys
+    // does not invalidate cached metadata.
+    env: Object.fromEntries(Object.entries(definition.env ?? {}).sort(([a], [b]) => a.localeCompare(b))),
+    serverCwd: definition.cwd,
+    url: definition.url,
+    headers: Object.fromEntries(Object.entries(definition.headers ?? {}).sort(([a], [b]) => a.localeCompare(b))),
+    inheritEnv: definition.inheritEnv
+  })).digest("hex").slice(0, 24);
+}
 var McpServerManager = class {
   constructor(definitions, cacheDir, log, now = Date.now) {
     this.now = now;
@@ -24577,8 +24629,9 @@ var McpServerManager = class {
         stderr: "pipe"
       });
       if (transport2.stderr) {
+        const captureSecrets = definitionSecrets(definition);
         transport2.stderr.on("data", (chunk) => {
-          runtime.stderrTail = appendTail(runtime.stderrTail, chunk);
+          runtime.stderrTail = appendTail(runtime.stderrTail, redactSecrets(String(chunk), captureSecrets));
         });
       }
       return { client, transport: transport2 };
@@ -24669,7 +24722,7 @@ var McpServerManager = class {
         if (!runtime.tools) continue;
         const shardPath = path2.join(this.cacheDir, `${key}.json`);
         const tempPath = `${shardPath}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
-        fs2.writeFileSync(tempPath, JSON.stringify({ updatedAt: this.now(), tools: runtime.tools }, null, 2), "utf8");
+        fs2.writeFileSync(tempPath, JSON.stringify({ updatedAt: this.now(), fingerprint: cacheFingerprint(runtime.definition), tools: runtime.tools }, null, 2), "utf8");
         try {
           fs2.renameSync(tempPath, shardPath);
         } catch (error2) {
@@ -24704,6 +24757,7 @@ var McpServerManager = class {
     }
   }
   /** Cached descriptors for one server (from the metadata cache file). */
+  /** Cached descriptors for one server (from the metadata cache file). */
   cachedToolsFor(server) {
     return this.loadCatalog().filter((tool) => tool.server === sanitizeName(server));
   }
@@ -24722,13 +24776,16 @@ var McpServerManager = class {
       catalog.set(tool.prefixedName, tool);
       ownerOf.set(tool.prefixedName, tool.server);
     };
-    for (const tools of Object.values(this.readCacheFile())) {
-      for (const tool of tools) {
-        if (!this.definitions.has(tool.server)) continue;
+    for (const [key, shard] of Object.entries(this.readCacheFile())) {
+      const definition = this.definitions.get(key);
+      if (!definition || definition.disabled) continue;
+      if (shard.fingerprint !== cacheFingerprint(definition)) continue;
+      for (const tool of shard.tools) {
         claim2(tool, false);
       }
     }
     for (const runtime of this.runtimes.values()) {
+      if (runtime.definition.disabled) continue;
       for (const tool of runtime.tools ?? []) claim2(tool, true);
     }
     for (const name of conflicts) {
@@ -24784,7 +24841,10 @@ var McpServerManager = class {
         if (typeof parsed.updatedAt !== "number" || this.now() - parsed.updatedAt > METADATA_TTL_MS) continue;
         if (!Array.isArray(parsed.tools)) continue;
         const key = name.slice(0, -".json".length);
-        snapshot[key] = parsed.tools;
+        snapshot[key] = {
+          tools: parsed.tools,
+          ...typeof parsed.fingerprint === "string" ? { fingerprint: parsed.fingerprint } : {}
+        };
         updatedAt[key] = parsed.updatedAt;
       } catch {
       }
@@ -24828,12 +24888,16 @@ var McpServerManager = class {
     } catch (error2) {
       const runtimeState = this.runtimes.get(server);
       const tail = runtimeState?.stderrTail.trim();
+      const secrets = definitionSecrets(definition);
       return {
         delivery: "not_sent",
-        error: `MCP server "${server}" failed to start: ${error2 instanceof Error ? error2.message : String(error2)}` + (tail ? `
+        error: sanitizeDiagnostic(
+          `MCP server "${server}" failed to start: ${error2 instanceof Error ? error2.message : String(error2)}` + (tail ? `
 
 Server stderr tail:
-${tail}` : "")
+${tail}` : ""),
+          secrets
+        )
       };
     }
     const client = runtime.client;
@@ -24849,6 +24913,20 @@ ${tail}` : "")
         error: `MCP call "${prefixedName}" was cancelled before the request was sent; nothing was executed.`
       };
     }
+    const postConnectCatalog = this.loadCatalog();
+    if (this.conflictedNames.has(prefixedName)) {
+      return {
+        delivery: "not_sent",
+        error: `MCP tool name "${prefixedName}" became claimed by more than one server during connection. Rename one of the servers so every tool name is unambiguous; the call was NOT sent.`
+      };
+    }
+    const postDescriptor = postConnectCatalog.find((tool) => tool.prefixedName === prefixedName);
+    if (postDescriptor && (postDescriptor.server !== server || postDescriptor.tool !== toolName)) {
+      return {
+        delivery: "not_sent",
+        error: `MCP tool "${prefixedName}" resolved to ${postDescriptor.server}/${postDescriptor.tool} after connecting; refusing to send the stale target ${server}/${toolName}. Retry the call.`
+      };
+    }
     try {
       const result = await withTimeout(
         client.callTool({ name: toolName, arguments: args }, void 0, signal !== void 0 ? { signal } : void 0),
@@ -24863,7 +24941,7 @@ ${tail}` : "")
         isError: result.isError === true
       };
     } catch (error2) {
-      const message = error2 instanceof Error ? error2.message : String(error2);
+      const message = sanitizeDiagnostic(error2 instanceof Error ? error2.message : String(error2), definitionSecrets(definition));
       if (error2 instanceof ProtocolError && (error2.code === ProtocolErrorCode.InvalidRequest || error2.code === ProtocolErrorCode.InvalidParams) && /output schema|structured content/i.test(message)) {
         return {
           delivery: "invalid_result",
@@ -24898,7 +24976,7 @@ ${tail}` : "")
 };
 
 // builtin/extensions/mcp-adapter/src/trust.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 import * as fs3 from "node:fs";
 import * as path3 from "node:path";
 function serverFingerprint(cwd, definition) {
@@ -24917,7 +24995,7 @@ function serverFingerprint(cwd, definition) {
     inheritEnv: definition.inheritEnv,
     headers: definition.headers
   });
-  return createHash("sha256").update(spec).digest("hex").slice(0, 24);
+  return createHash2("sha256").update(spec).digest("hex").slice(0, 24);
 }
 var McpTrustStore = class {
   filePath;
@@ -25018,8 +25096,9 @@ function structuredContentIsMirroredInText(textBlocks, structured) {
 function mapMcpOutcome(outcome, maxBytes) {
   if (outcome.delivery !== "ok") {
     const prefix = outcome.delivery === "may_have_run" || outcome.delivery === "invalid_result" ? "[outcome unknown]" : "[not executed]";
+    const errorText = truncate(`${outcome.error ?? "MCP call failed"}`, maxBytes);
     return {
-      content: [{ type: "text", text: `${prefix} ${outcome.error ?? "MCP call failed"}` }],
+      content: [{ type: "text", text: `${prefix} ${errorText}` }],
       details: { mode: "mcp", delivery: outcome.delivery, ...outcome.protocolCode !== void 0 ? { protocolCode: outcome.protocolCode } : {} },
       isError: true
     };
@@ -25054,8 +25133,9 @@ ${JSON.stringify(outcome.structuredContent, null, 2)}` });
     isError: outcome.isError === true
   };
 }
-function createMcpProxyTool(getManager, ensureTrusted, options = {}) {
-  const maxBytes = options.outputMaxBytes ?? DEFAULT_OUTPUT_MAX_BYTES;
+function createMcpProxyTool(getManager, ensureTrusted, optionsOrVerify = {}, options = {}) {
+  const verifyTrusted = typeof optionsOrVerify === "function" ? optionsOrVerify : void 0;
+  const maxBytes = typeof optionsOrVerify === "object" && optionsOrVerify.outputMaxBytes || options.outputMaxBytes || DEFAULT_OUTPUT_MAX_BYTES;
   return {
     name: "mcp",
     label: "MCP",
@@ -25107,7 +25187,8 @@ ${truncate(JSON.stringify(schema ?? {}, null, 2), maxBytes)}` : `unknown MCP too
       const resolved = getManager().resolvePrefixedName(params.tool);
       const server = descriptor?.server ?? resolved?.server ?? "";
       if (server) {
-        const trust = await ensureTrusted(server);
+        const managerAtGate = getManager();
+        const trust = await ensureTrusted(server, managerAtGate);
         if (!trust.trusted) {
           return {
             content: [{ type: "text", text: `[not executed] ${trust.reason ?? "MCP server not trusted"}` }],
@@ -25115,6 +25196,14 @@ ${truncate(JSON.stringify(schema ?? {}, null, 2), maxBytes)}` : `unknown MCP too
             isError: true
           };
         }
+        const managerNow = getManager();
+        if (managerNow !== managerAtGate || verifyTrusted !== void 0 && !verifyTrusted(server, managerNow)) {
+          return {
+            content: [{ type: "text", text: `[not executed] MCP config changed during approval for server "${server}" \u2014 the approved definition and the current one differ. Retry the call to approve the new definition.` }],
+            details: { mode: "mcp", delivery: "not_sent" },
+            isError: true
+          };
+        }
       }
       let args = {};
       if (typeof params.args === "string") {
@@ -25188,7 +25277,7 @@ function jsonSchemaToTypebox(schema) {
 // builtin/extensions/mcp-adapter/src/direct-tools.ts
 var FALLBACK_PARAMS = Type.Object({}, { description: "MCP tool arguments (schema unknown until first connect)" });
 var DEFAULT_DIRECT_OUTPUT_MAX_BYTES = 8192;
-function registerDirectTools(ctx, getManager, ensureTrusted, outputMaxBytes) {
+function registerDirectTools(ctx, getManager, ensureTrusted, verifyTrusted, outputMaxBytes) {
   const registered = [];
   const seenNames = /* @__PURE__ */ new Set();
   for (const definition of getManager().listDefinitions()) {
@@ -25202,13 +25291,13 @@ function registerDirectTools(ctx, getManager, ensureTrusted, outputMaxBytes) {
         continue;
       }
       seenNames.add(descriptor.prefixedName);
-      registerDirectTool(ctx, getManager, ensureTrusted, definition, descriptor.prefixedName, descriptor.description, descriptor.inputSchema, outputMaxBytes);
+      registerDirectTool(ctx, getManager, ensureTrusted, verifyTrusted, definition, descriptor.prefixedName, descriptor.description, descriptor.inputSchema, outputMaxBytes);
       registered.push(descriptor.prefixedName);
     }
   }
   return registered;
 }
-function registerDirectTool(ctx, getManager, ensureTrusted, definition, prefixedName, description, inputSchema, outputMaxBytes) {
+function registerDirectTool(ctx, getManager, ensureTrusted, verifyTrusted, definition, prefixedName, description, inputSchema, outputMaxBytes) {
   const parameters = inputSchema ? jsonSchemaToTypebox(inputSchema) : FALLBACK_PARAMS;
   ctx.registerTool({
     name: prefixedName,
@@ -25216,7 +25305,8 @@ function registerDirectTool(ctx, getManager, ensureTrusted, definition, prefixed
     description: `${(description ?? prefixedName).trim()} (MCP server: ${definition.name})`,
     parameters,
     async execute(args, toolContext) {
-      const trust = await ensureTrusted(definition.name);
+      const managerAtGate = getManager();
+      const trust = await ensureTrusted(definition.name, managerAtGate);
       if (!trust.trusted) {
         return {
           content: [{ type: "text", text: `[not executed] ${trust.reason ?? "MCP server not trusted"}` }],
@@ -25224,7 +25314,15 @@ function registerDirectTool(ctx, getManager, ensureTrusted, definition, prefixed
           isError: true
         };
       }
-      const outcome = await getManager().callTool(
+      const managerNow = getManager();
+      if (managerNow !== managerAtGate || verifyTrusted !== void 0 && !verifyTrusted(definition.name, managerNow)) {
+        return {
+          content: [{ type: "text", text: `[not executed] MCP config changed during approval for server "${definition.name}" \u2014 retry the call to approve the new definition.` }],
+          details: { delivery: "not_sent" },
+          isError: true
+        };
+      }
+      const outcome = await managerNow.callTool(
         prefixedName,
         args && typeof args === "object" && !Array.isArray(args) ? args : {},
         toolContext.signal
@@ -25266,19 +25364,26 @@ function mcpAdapter(ctx) {
     ctx.log
   );
   async function reloadManager() {
-    await manager.dispose().catch(() => void 0);
+    let replacement;
     try {
-      manager = new McpServerManager(
-        resolveMcpAdapterConfig(ctx.cwd, configDir).servers,
-        metadataCacheDir,
-        ctx.log
-      );
+      const resolved = resolveMcpAdapterConfig(ctx.cwd, configDir);
+      if (resolved.problems.length > 0) {
+        const message = `config layers failed to parse: ${resolved.problems.join("; ")}`;
+        ctx.log(`mcp: config reload failed, keeping the previous manager: ${message}`);
+        if (ctx.hasUI) ctx.ui.notify(`MCP adapter config error (previous servers kept): ${message}`, "error");
+        return { ok: false, error: message };
+      }
+      replacement = new McpServerManager(resolved.servers, metadataCacheDir, ctx.log);
     } catch (error2) {
       const message = error2 instanceof Error ? error2.message : String(error2);
-      ctx.log(`mcp: config reload failed: ${message}`);
-      if (ctx.hasUI) ctx.ui.notify(`MCP adapter config error: ${message}`, "error");
-      manager = new McpServerManager([], metadataCacheDir, ctx.log);
+      ctx.log(`mcp: config reload failed, keeping the previous manager: ${message}`);
+      if (ctx.hasUI) ctx.ui.notify(`MCP adapter config error (previous servers kept): ${message}`, "error");
+      return { ok: false, error: message };
     }
+    const previous = manager;
+    manager = replacement;
+    await previous.dispose().catch(() => void 0);
+    return { ok: true };
   }
   ctx.registerCleanup?.(() => manager.dispose().catch(() => void 0));
   function readProjectOverride() {
@@ -25312,8 +25417,8 @@ function mcpAdapter(ctx) {
     fs4.writeFileSync(filePath, JSON.stringify(parsed, null, 2) + "\n", "utf8");
     return filePath;
   }
-  async function ensureTrusted(serverName) {
-    const definition = manager.getDefinition(serverName);
+  async function ensureTrusted(serverName, managerAtGate = manager) {
+    const definition = managerAtGate.getDefinition(serverName);
     if (!definition) return { trusted: false, reason: `unknown MCP server "${serverName}"` };
     if (trustStore.isTrusted(ctx.cwd, definition)) return { trusted: true };
     if (!ctx.interactions.isAvailable()) {
@@ -25337,8 +25442,12 @@ function mcpAdapter(ctx) {
       reason: `MCP server "${definition.name}" was not approved. It was NOT started. Ask the user to approve it, or remove it from ${definition.sourcePath}.`
     };
   }
-  ctx.registerTool(createMcpProxyTool(() => manager, ensureTrusted));
-  const eagerRegistered = registerDirectTools(ctx, () => manager, ensureTrusted);
+  function verifyTrusted(serverName, currentManager) {
+    const definition = currentManager.getDefinition(serverName);
+    return !!definition && trustStore.isTrusted(ctx.cwd, definition);
+  }
+  ctx.registerTool(createMcpProxyTool(() => manager, ensureTrusted, verifyTrusted));
+  const eagerRegistered = registerDirectTools(ctx, () => manager, ensureTrusted, verifyTrusted);
   if (eagerRegistered.length > 0) {
     ctx.log(`mcp: registered ${eagerRegistered.length} direct tool(s) from metadata cache: ${eagerRegistered.join(", ")}`);
   }
@@ -25359,6 +25468,7 @@ function mcpAdapter(ctx) {
         }
         const overrides = readProjectOverride().mcpServers;
         const forceEnabled = overrides?.[definition.name]?.disabled === false;
+        const previousOverride = overrides?.[definition.name]?.disabled;
         const filePath = writeProjectOverride(
           definition.name,
           // enable must lift a source-level disabled:true with an explicit
@@ -25367,8 +25477,24 @@ function mcpAdapter(ctx) {
           // existing force-enable on repeated enable commands too.
           sub === "disable" ? true : definition.disabled || forceEnabled ? false : null
         );
-        await reloadManager();
-        const effectiveDisabled = manager.getDefinition(definition.name)?.disabled ?? false;
+        const reload = await reloadManager();
+        if (!reload.ok) {
+          writeProjectOverride(definition.name, previousOverride === void 0 ? null : previousOverride);
+          commandCtx.ui.notify(
+            `MCP server "${definition.name}" NOT ${sub === "disable" ? "disabled" : "enabled"}: config reload failed (${reload.error}); previous servers kept and the override was rolled back.`,
+            "error"
+          );
+          return;
+        }
+        const reloaded = manager.getDefinition(definition.name);
+        if (!reloaded) {
+          commandCtx.ui.notify(
+            `MCP server "${definition.name}" disappeared from the reloaded config (wrote ${filePath}); check project/global config merges.`,
+            "error"
+          );
+          return;
+        }
+        const effectiveDisabled = reloaded.disabled;
         const stateLabel = effectiveDisabled ? "disabled" : sub === "disable" ? "still enabled" : "enabled";
         commandCtx.ui.notify(
           `MCP server "${definition.name}" ${stateLabel} (wrote ${filePath}). ` + (eagerRegistered.length > 0 ? "Restart or /reload to resync direct tools." : "Effective immediately."),

package/dist/builtin/extensions/plan-mode/index.js

@@ -7,9 +7,9 @@ import {
   isPlanModeSafeCommand,
   markCompletedPlanSteps,
   restoreExecutionState
-} from "../../../chunks/chunk-JXY3YLDS.js";
-import "../../../chunks/chunk-ZKHMNEXL.js";
-import "../../../chunks/chunk-YRXXRLMQ.js";
+} from "../../../chunks/chunk-LO2V5DZZ.js";
+import "../../../chunks/chunk-RTTGO2A6.js";
+import "../../../chunks/chunk-UD7KYQ6J.js";
 import {
   Type
 } from "../../../chunks/chunk-XXGYUYXI.js";

package/dist/builtin/extensions/subagent/index.js

@@ -1,13 +1,13 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
 import {
   createCliHostCapabilities
-} from "../../../chunks/chunk-PU7IIEKH.js";
+} from "../../../chunks/chunk-M4OJARWJ.js";
 import {
   createSharedFileSystemTools,
   createSubagentCapability
-} from "../../../chunks/chunk-JXY3YLDS.js";
-import "../../../chunks/chunk-ZKHMNEXL.js";
-import "../../../chunks/chunk-YRXXRLMQ.js";
+} from "../../../chunks/chunk-LO2V5DZZ.js";
+import "../../../chunks/chunk-RTTGO2A6.js";
+import "../../../chunks/chunk-UD7KYQ6J.js";
 import "../../../chunks/chunk-5353DEEC.js";
 import "../../../chunks/chunk-XXGYUYXI.js";
 import "../../../chunks/chunk-LZQXQOPJ.js";