@danieltmn/tamnora 0.6.2 → 0.7.0

package/CHANGELOG.md

@@ -5,6 +5,29 @@ Todos los cambios relevantes de este proyecto se documentan en este archivo.
 El formato sigue [Keep a Changelog](https://keepachangelog.com/es-ES/1.1.0/)
 y el proyecto usa [Versionado Semantico](https://semver.org/lang/es/).
 
+## [0.7.0] - 2026-10-05
+
+### Seguridad
+
+- **MCP sin filtracion de entorno**: los servidores stdio ya no heredan
+  `process.env`; reciben un baseline minimo mas el `env` declarado (`env:VAR`
+  soportado). `inheritEnv: true` es opt-in para servidores de confianza.
+- **Redaccion de secretos**: los resultados MCP pasan por `redactSecrets` y
+  `/api/mcp` devuelve el `env` enmascarado.
+
+### Cambiado
+
+- **Agente autonomo**: `runAgent` corre hasta `end_turn` (sin tope fijo de
+  rondas). Frena por **no-progreso** (llamadas repetidas) o por presupuestos
+  opcionales `maxTokens`/`maxDurationMs`, y cierra con un resumen
+  (`wrappedUp`). La consola agrega el boton **Continuar**.
+- **Ajustes de la consola**: Agente, Sesiones, MCP, Skills, Telegram y
+  **Límites** pasan a **pestañas** con ancho acotado (ya no ocupan todo el
+  ancho). El formulario MCP suma `inheritEnv` y `env` con `env:VAR`.
+- **Consola**: el footer (modo · proveedor · modelo · estado) ahora es
+  clickeable y abre el modal de ajustes; el input muestra un **menú de
+  comandos `/`** al escribir la barra.
+
 ## [0.6.2] - 2026-10-05
 
 ### Cambios

package/SECURITY.md

@@ -21,6 +21,12 @@ asi que se lo debe tratar como codigo con acceso a tu usuario.
 - **Credenciales**: las API keys de proveedores se guardan en la casa local del
   usuario (fuera del repo) y se cifran con una clave derivada de la passphrase.
   Nunca se commitean y se devuelven enmascaradas al cliente.
+- **Servidores MCP**: tratalos como codigo de terceros. Los MCP stdio **no heredan
+  `process.env`** por defecto: solo reciben un baseline minimo mas el `env` que
+  declares (`"env": { "TOKEN": "env:TOKEN" }`); `inheritEnv: true` es solo para
+  servidores de confianza. Un tool tipo `get-env` no puede leer tus secretos del
+  shell, y los resultados MCP se **redactan** (`redactSecrets`) por si devuelven un
+  token. No pases credenciales en los argumentos de las tools: van por `env`.
 
 ## Buenas practicas
 

package/harness/packages/cli/src/commands/repl.js

@@ -146,6 +146,8 @@ export async function replCommand(argv) {
         history,
         input: text,
         maxRounds,
+        maxTokens: config.maxTokens,
+        maxDurationMs: config.maxDurationMs,
         tools: toolDefs,
         execute,
         onEvent: printer.onEvent,

package/harness/packages/cli/src/commands/run.js

@@ -106,6 +106,8 @@ export async function runCommand(argv) {
       history,
       input: prompt,
       maxRounds: num(values['max-steps'], config.maxRounds),
+      maxTokens: config.maxTokens,
+      maxDurationMs: config.maxDurationMs,
       signal: controller.signal,
       tools: toolDefs,
       execute,

package/harness/packages/cli/src/commands/tui.js

@@ -85,6 +85,8 @@ export async function tuiCommand(argv) {
     onModeChange: (id) => store.setSetting('activeMode', id),
     systemPrompt: promptFor(mode),
     maxRounds: num(values['max-steps'], config.maxRounds),
+    maxTokens: config.maxTokens,
+    maxDurationMs: config.maxDurationMs,
     toolOptions: {
       root: cwd,
       enabled: enabledFor(mode),

package/harness/packages/cli/src/lib/runtime.js

@@ -52,6 +52,8 @@ export async function runTurn({
   history = [],
   input,
   maxRounds,
+  maxTokens,
+  maxDurationMs,
   stallWarnMs,
   signal,
   execute,
@@ -76,6 +78,8 @@ export async function runTurn({
     execute,
     toolContext,
     maxRounds,
+    maxTokens,
+    maxDurationMs,
     stallWarnMs,
     signal,
     onEvent,

package/harness/packages/cli/src/tui/app.js

@@ -18,6 +18,8 @@ export function runTui({
   onModeChange,
   systemPrompt,
   maxRounds,
+  maxTokens,
+  maxDurationMs,
   toolOptions,
   store,
   sessionId,
@@ -170,6 +172,8 @@ export function runTui({
         history: conv,
         input: text,
         maxRounds,
+        maxTokens,
+        maxDurationMs,
         signal: controller.signal,
         tools: toolset.definitions,
         execute: toolset.execute,

package/harness/packages/core/src/agent/runAgent.js

@@ -1,12 +1,24 @@
 import { withRetry, isRetryableError } from '../providers/resilience.js';
 import { trimContext, estimateTokens } from './context.js';
 
-export const MAX_TOOL_ROUNDS = 8;
+// 0 = sin limite de rondas: el loop sigue hasta que el modelo deja de pedir
+// herramientas. Los frenos reales son el guard de no-progreso y, opcionalmente,
+// los presupuestos `maxTokens` / `maxDurationMs`.
+export const MAX_TOOL_ROUNDS = 0;
+
+/** Rondas seguidas sin ninguna llamada nueva antes de cortar (guard de loop). */
+const NO_PROGRESS_LIMIT = 2;
+
+export const WRAP_UP_PROMPT =
+  'Se agotó el presupuesto de esta ejecución. No pidas más herramientas: resumí brevemente lo que hiciste, lo que quedó pendiente y respondé al usuario con lo que tengas.';
+
+const NO_PROGRESS_MESSAGE =
+  'No repitas la misma herramienta con los mismos argumentos: no produce cambios. Usá el resultado anterior o probá otra estrategia.';
 
 /**
  * Provider-agnostic agent loop. Runs the model, executes any tool calls it
  * requests, feeds the results back, and repeats until the model answers
- * without tools (or `maxRounds` is reached).
+ * without tools (or a limit/budget stops it).
  *
  * Free of React and browser APIs so it can run headless in Node.
  *
@@ -20,13 +32,17 @@ export const MAX_TOOL_ROUNDS = 8;
  * @param {object} [opts.toolContext] - passed through to `execute`
  * @param {AbortSignal} [opts.signal]
  * @param {Function} [opts.onEvent] - streaming/lifecycle callback
- * @param {number} [opts.maxRounds]
+ * @param {number} [opts.maxRounds] - techo de seguridad de rondas (0 = sin limite)
+ * @param {number} [opts.maxTokens] - presupuesto de tokens totales (0 = sin limite)
+ * @param {number} [opts.maxDurationMs] - presupuesto de tiempo (0 = sin limite)
+ * @param {number} [opts.repeatLimit] - veces que una misma llamada puede repetirse (0 = desactivado)
+ * @param {boolean} [opts.wrapUp] - ronda final sin tools para resumir si se cortó
  * @param {number} [opts.stallWarnMs] - warn once if the model emits nothing for
  *   this long (0 disables; default 90000)
  * @param {number} [opts.retries] - reintentos por ronda ante error transitorio
  *   (default 2; solo si la ronda no emitio contenido todavia)
  * @param {number} [opts.retryDelayMs] - base del backoff (default 500)
- * @returns {Promise<{content, reasoning, toolCalls, messages, rounds, stopReason, usage}>}
+ * @returns {Promise<{content, reasoning, toolCalls, messages, rounds, stopReason, usage, wrappedUp}>}
  */
 export async function runAgent({
   provider,
@@ -39,6 +55,10 @@ export async function runAgent({
   signal,
   onEvent,
   maxRounds = MAX_TOOL_ROUNDS,
+  maxTokens = 0,
+  maxDurationMs = 0,
+  repeatLimit = 3,
+  wrapUp = true,
   stallWarnMs = 90000,
   retries = 2,
   retryDelayMs = 500,
@@ -46,18 +66,38 @@ export async function runAgent({
 }) {
   const working = [...messages];
   let usageTotal = null;
+  const startedAt = Date.now();
+  const fingerprints = new Map();
+  const unlimited = !(maxRounds > 0);
+  let noProgressStreak = 0;
+  let roundsRun = 0;
+  let stopReason = 'max_rounds';
+  let content = '';
+
+  const accumulateUsage = (roundUsage) => {
+    if (!roundUsage) return {};
+    usageTotal = {
+      prompt_tokens: (usageTotal?.prompt_tokens ?? 0) + roundUsage.prompt_tokens,
+      completion_tokens: (usageTotal?.completion_tokens ?? 0) + roundUsage.completion_tokens,
+      total_tokens: (usageTotal?.total_tokens ?? 0) + roundUsage.total_tokens,
+      // last round = current context footprint (for context meters)
+      last_prompt_tokens: roundUsage.prompt_tokens,
+      last_completion_tokens: roundUsage.completion_tokens,
+    };
+    return { tokens_in: roundUsage.prompt_tokens, tokens_out: roundUsage.completion_tokens };
+  };
+
+  const budgetExceeded = () => {
+    if (maxDurationMs > 0 && Date.now() - startedAt >= maxDurationMs) return 'duration';
+    if (maxTokens > 0 && (usageTotal?.total_tokens ?? 0) >= maxTokens) return 'tokens';
+    return null;
+  };
 
-  for (let round = 1; round <= maxRounds; round++) {
+  while (unlimited || roundsRun < maxRounds) {
+    roundsRun++;
     if (signal?.aborted) {
-      return {
-        content: '',
-        reasoning: '',
-        toolCalls: [],
-        messages: working,
-        rounds: Math.max(0, round - 1),
-        stopReason: 'aborted',
-        usage: usageTotal,
-      };
+      stopReason = 'aborted';
+      break;
     }
 
     const stall = createStallGuard(onEvent, stallWarnMs);
@@ -109,38 +149,20 @@ export async function runAgent({
       stall.dispose();
     }
 
-    const roundUsage = result.usage ?? null;
-    if (roundUsage) {
-      usageTotal = {
-        prompt_tokens: (usageTotal?.prompt_tokens ?? 0) + roundUsage.prompt_tokens,
-        completion_tokens: (usageTotal?.completion_tokens ?? 0) + roundUsage.completion_tokens,
-        total_tokens: (usageTotal?.total_tokens ?? 0) + roundUsage.total_tokens,
-        // last round = current context footprint (for context meters)
-        last_prompt_tokens: roundUsage.prompt_tokens,
-        last_completion_tokens: roundUsage.completion_tokens,
-      };
-    }
-    const tokens = roundUsage
-      ? { tokens_in: roundUsage.prompt_tokens, tokens_out: roundUsage.completion_tokens }
-      : {};
+    const tokens = accumulateUsage(result.usage ?? null);
 
     const calls = result.toolCalls ?? [];
     if (calls.length === 0) {
-      working.push({ role: 'assistant', content: result.content ?? '', ...tokens });
-      return {
-        content: result.content,
-        reasoning: result.reasoning ?? '',
-        toolCalls: [],
-        messages: working,
-        rounds: round,
-        stopReason: 'end_turn',
-        usage: usageTotal,
-      };
+      content = result.content ?? '';
+      working.push({ role: 'assistant', content, ...tokens });
+      stopReason = 'end_turn';
+      break;
     }
 
     working.push({ role: 'assistant', content: result.content || null, tool_calls: calls, ...tokens });
-    onEvent?.({ type: 'tool_round', round, toolCalls: calls, content: result.content });
+    onEvent?.({ type: 'tool_round', round: roundsRun, toolCalls: calls, content: result.content });
 
+    let newCalls = 0;
     for (let index = 0; index < calls.length; index++) {
       const call = calls[index];
       const name = call.function?.name ?? call.name;
@@ -162,20 +184,32 @@ export async function runAgent({
           reasoning: result.reasoning ?? '',
           toolCalls: calls,
           messages: working,
-          rounds: round,
+          rounds: roundsRun,
           stopReason: 'aborted',
           usage: usageTotal,
+          wrappedUp: false,
         };
       }
 
       const args = parseToolArguments(call);
       onEvent?.({ type: 'tool_call', id: call.id, name, args });
 
+      const fingerprint = `${name}\u0000${stableStringify(args)}`;
+      const seen = (fingerprints.get(fingerprint) ?? 0) + 1;
+      fingerprints.set(fingerprint, seen);
+
       let output;
-      try {
-        output = await execute(name, args, toolContext);
-      } catch (err) {
-        output = `Error ejecutando ${name}: ${err?.message ?? err}`;
+      if (repeatLimit > 0 && seen > repeatLimit) {
+        // Llamada identica repetida: no re-ejecutar, avisar al modelo.
+        onEvent?.({ type: 'repeat', name, count: seen });
+        output = NO_PROGRESS_MESSAGE;
+      } else {
+        newCalls++;
+        try {
+          output = await execute(name, args, toolContext);
+        } catch (err) {
+          output = `Error ejecutando ${name}: ${err?.message ?? err}`;
+        }
       }
 
       onEvent?.({ type: 'tool_result', id: call.id, name, result: output });
@@ -186,19 +220,69 @@ export async function runAgent({
         content: typeof output === 'string' ? output : JSON.stringify(output),
       });
     }
+
+    noProgressStreak = newCalls === 0 ? noProgressStreak + 1 : 0;
+    if (noProgressStreak >= NO_PROGRESS_LIMIT) {
+      stopReason = 'no_progress';
+      break;
+    }
+    if (budgetExceeded()) {
+      stopReason = 'budget';
+      break;
+    }
+  }
+
+  let wrappedUp = false;
+  if (wrapUp && (stopReason === 'max_rounds' || stopReason === 'no_progress' || stopReason === 'budget')) {
+    const wrap = await runFinalAnswer({ provider, config, model, working, signal, onEvent, maxRetries: retries, retryDelayMs });
+    if (wrap.usage) accumulateUsage(wrap.usage);
+    if (wrap.content) {
+      working.push({ role: 'assistant', content: wrap.content, tokens_in: wrap.usage?.prompt_tokens, tokens_out: wrap.usage?.completion_tokens });
+      content = wrap.content;
+      wrappedUp = true;
+    }
   }
 
   return {
-    content: '',
+    content,
     reasoning: '',
     toolCalls: [],
     messages: working,
-    rounds: maxRounds,
-    stopReason: 'max_rounds',
+    rounds: roundsRun,
+    stopReason,
     usage: usageTotal,
+    wrappedUp,
   };
 }
 
+/** Ronda final con tools deshabilitadas para forzar un cierre con texto. */
+async function runFinalAnswer({ provider, config, model, working, signal, onEvent, maxRetries, retryDelayMs }) {
+  try {
+    const result = await withRetry(
+      () =>
+        provider.streamChat(config, {
+          model,
+          messages: [...working, { role: 'system', content: WRAP_UP_PROMPT }],
+          tools: [],
+          signal,
+          onEvent,
+        }),
+      { retries: maxRetries, baseDelayMs: retryDelayMs, signal }
+    );
+    return { content: result?.content ?? '', usage: result?.usage ?? null };
+  } catch {
+    return { content: '', usage: null };
+  }
+}
+
+/** JSON estable (claves ordenadas) para huellar argumentos. */
+function stableStringify(value) {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(',')}]`;
+  const keys = Object.keys(value).sort();
+  return `{${keys.map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(',')}}`;
+}
+
 /**
  * Emit a single warning event when the model emits nothing for `stallWarnMs`
  * during one stream (openbridge's stall watchdog port). Any provider event

package/harness/packages/core/src/config/index.js

@@ -7,7 +7,9 @@ export const DEFAULT_CONFIG = {
   provider: 'openrouter',
   model: '',
   instructions: ['AGENTS.md'],
-  maxRounds: 8,
+  maxRounds: 0,
+  maxTokens: 0,
+  maxDurationMs: 0,
   tools: [],
   permissions: {},
   mcp: [],

package/harness/packages/core/src/config/secrets.js

@@ -0,0 +1,36 @@
+// Secret indirection helpers. Values may reference environment variables as
+// `env:VAR` so credentials never live in `tamnora.json` or in tool arguments.
+
+import { getEnv } from '../env.js';
+
+/**
+ * Resolve a single value that may be an `env:VAR` reference.
+ * @param {string} value
+ * @param {Record<string,string>} [env]
+ */
+export function resolveApiKey(value, env = getEnv()) {
+  if (typeof value === 'string' && value.startsWith('env:')) {
+    return env[value.slice(4)] ?? '';
+  }
+  return value ?? '';
+}
+
+/**
+ * Resolve the values of an env map, expanding `env:VAR` references.
+ * String values only; anything else is stringified.
+ * @param {Record<string, unknown>} map
+ * @param {Record<string,string>} [env]
+ */
+export function resolveEnvMap(map = {}, env = getEnv()) {
+  const result = {};
+  for (const [key, value] of Object.entries(map ?? {})) {
+    if (value == null) continue;
+    result[key] = typeof value === 'string' ? resolveApiKey(value, env) : String(value);
+  }
+  return result;
+}
+
+/** True when at least one value in the map is an unresolved `env:VAR` reference. */
+export function hasEnvRefs(map = {}) {
+  return Object.values(map ?? {}).some((value) => typeof value === 'string' && value.startsWith('env:'));
+}

package/harness/packages/core/src/eval/runTask.js

@@ -1,18 +1,9 @@
 import { resolveProviderRuntime } from '../providers/index.js';
 import { runAgent } from '../agent/runAgent.js';
 import { buildMcpRegistry } from '../mcp/index.js';
+import { resolveApiKey } from '../config/secrets.js';
 
-/**
- * Resolve `env:VAR` references in a task's apiKey field.
- * @param {string} value
- * @param {Record<string,string>} env
- */
-export function resolveApiKey(value, env = {}) {
-  if (typeof value === 'string' && value.startsWith('env:')) {
-    return env[value.slice(4)] ?? '';
-  }
-  return value ?? '';
-}
+export { resolveApiKey } from '../config/secrets.js';
 
 /**
  * Run a single evaluation task headlessly.

package/harness/packages/core/src/index.js

@@ -1,4 +1,14 @@
 export { getEnv, envValue } from './env.js';
+export {
+  redactSecrets,
+  redactDeep,
+  secretValues,
+  isSecretName,
+  maskSecret,
+  maskEnv,
+  REDACTED,
+} from './redact.js';
+export { resolveApiKey, resolveEnvMap } from './config/secrets.js';
 export { ensureUtf8Console } from './console.js';
 export { MAX_TOOL_ROUNDS, runAgent, parseToolArguments } from './agent/runAgent.js';
 export { estimateTokens, trimContext } from './agent/context.js';
@@ -20,10 +30,12 @@ export {
   connectMcpServer,
   connectMcpHttpServer,
   connectMcpStdioServer,
+  childEnv,
   buildMcpRegistry,
   mcpTransport,
   qualifiedToolName,
   mcpToolToDefinition,
+  mcpResultToText,
 } from './mcp/index.js';
 export {
   loadConfig,
@@ -65,7 +77,7 @@ export {
   toRel,
 } from './tools/index.js';
 export { Store, openDatabase } from './storage/sqlite.js';
-export { runTask, resolveApiKey } from './eval/runTask.js';
+export { runTask } from './eval/runTask.js';
 export { loadDataset } from './eval/dataset.js';
 export { runDataset, extractToolCalls } from './eval/runner.js';
 export { summarize } from './eval/report.js';

package/harness/packages/core/src/mcp/common.js

@@ -1,5 +1,7 @@
 // Shared MCP helpers used by both transports (HTTP and stdio).
 
+import { redactSecrets } from '../redact.js';
+
 export const PROTOCOL_VERSION = '2025-06-18';
 export const CLIENT_INFO = { name: 'tamnora', version: '1.0.0' };
 
@@ -24,27 +26,29 @@ export function mcpToolToDefinition(tool, server, qualifiedName) {
 /** Flatten an MCP `tools/call` result into plain text for the model. */
 export function mcpResultToText(result) {
   if (!result) return '';
-  if (typeof result.content === 'string') return result.content;
+  if (typeof result.content === 'string') return redactSecrets(result.content);
   if (Array.isArray(result.content)) {
     const text = result.content
       .map((c) => (c.type === 'text' ? c.text : `[${c.type}]`))
       .join('\n');
-    return result.isError ? `Error: ${text}` : text;
+    return redactSecrets(result.isError ? `Error: ${text}` : text);
   }
-  return JSON.stringify(result);
+  return redactSecrets(JSON.stringify(result));
 }
 
 /** Flatten a `resources/read` result into plain text. */
 export function mcpResourceToText(result) {
   const contents = result?.contents ?? [];
   if (!contents.length) return '(recurso vacío)';
-  return contents
-    .map((c) => {
-      if (typeof c.text === 'string') return c.text;
-      if (c.blob) return `[binario ${c.mimeType ?? ''} ${c.blob.length}b64]`;
-      return JSON.stringify(c);
-    })
-    .join('\n');
+  return redactSecrets(
+    contents
+      .map((c) => {
+        if (typeof c.text === 'string') return c.text;
+        if (c.blob) return `[binario ${c.mimeType ?? ''} ${c.blob.length}b64]`;
+        return JSON.stringify(c);
+      })
+      .join('\n')
+  );
 }
 
 /** Flatten a `prompts/get` result into plain text. */
@@ -59,7 +63,7 @@ export function mcpPromptToText(result) {
         : (message.content?.text ?? JSON.stringify(message.content));
     parts.push(`[${message.role}] ${content}`);
   }
-  return parts.join('\n') || '(prompt vacío)';
+  return redactSecrets(parts.join('\n')) || '(prompt vacío)';
 }
 
 /** Text summary of a `resources/list` result. */

package/harness/packages/core/src/mcp/index.js

@@ -11,7 +11,7 @@ import {
 } from './common.js';
 
 export { connectMcpHttpServer } from './http.js';
-export { connectMcpStdioServer } from './stdio.js';
+export { connectMcpStdioServer, childEnv } from './stdio.js';
 export {
   PROTOCOL_VERSION,
   CLIENT_INFO,

package/harness/packages/core/src/mcp/registry.js

@@ -112,6 +112,7 @@ export function normalizeMcpConfig(input, fallbackId = 'mcp') {
     args: url ? [] : args,
     url: url ? String(url) : undefined,
     env: def.env && typeof def.env === 'object' ? def.env : undefined,
+    inheritEnv: def.inheritEnv === true,
     enabled: def.enabled !== false,
   };
 }

package/harness/packages/core/src/mcp/stdio.js

@@ -11,6 +11,7 @@ import {
   mcpResourceToText,
   mcpPromptToText,
 } from './common.js';
+import { resolveEnvMap } from '../config/secrets.js';
 
 /**
  * On Windows, bare commands like `npx`/`uvx` are `.cmd` shims that require a
@@ -25,10 +26,48 @@ function shouldUseShell(server, command) {
   return true;
 }
 
+// Variables minimas para que un proceso hijo comun (node, npx, uvx) arranque.
+const BASE_ENV_KEYS = [
+  'PATH',
+  'PATHEXT',
+  'SystemRoot',
+  'windir',
+  'ComSpec',
+  'TEMP',
+  'TMP',
+  'TMPDIR',
+  'USERPROFILE',
+  'HOME',
+  'APPDATA',
+  'LOCALAPPDATA',
+  'LANG',
+  'LC_ALL',
+  'TZ',
+  'NUMBER_OF_PROCESSORS',
+  'PROCESSOR_ARCHITECTURE',
+];
+
+/**
+ * Construye el entorno del hijo MCP. Por defecto **no** hereda `process.env`
+ * (asi un MCP de terceros no puede leer tokens del shell); solo pasa un
+ * baseline seguro mas el `env` declarado. `inheritEnv: true` restaura la
+ * herencia completa para servidores de confianza.
+ */
+export function childEnv(server = {}) {
+  const declared = resolveEnvMap(server.env ?? {});
+  if (server.inheritEnv === true) return { ...process.env, ...declared };
+
+  const base = {};
+  for (const key of BASE_ENV_KEYS) {
+    if (process.env[key] !== undefined) base[key] = process.env[key];
+  }
+  return { ...base, ...declared };
+}
+
 /**
  * Launch an MCP stdio server, initialize it and list its tools.
  *
- * @param {{id:string, name?:string, command:string, args?:string[], env?:object, cwd?:string, shell?:boolean}} server
+ * @param {{id:string, name?:string, command:string, args?:string[], env?:object, inheritEnv?:boolean, cwd?:string, shell?:boolean}} server
  * @param {{signal?:AbortSignal, timeout?:number}} [opts]
  */
 export async function connectMcpStdioServer(server, { signal, timeout = 30000 } = {}) {
@@ -37,7 +76,7 @@ export async function connectMcpStdioServer(server, { signal, timeout = 30000 }
 
   const child = spawn(command, server.args ?? [], {
     cwd: server.cwd,
-    env: { ...process.env, ...(server.env ?? {}) },
+    env: childEnv(server),
     stdio: ['pipe', 'pipe', 'pipe'],
     windowsHide: true,
     shell: shouldUseShell(server, command),