@gajae-code/coding-agent 0.18.11 → 0.18.12

package/src/modes/controllers/plan-mode-controller.ts

@@ -5,7 +5,7 @@ import type { CompactionOutcome } from "@gajae-code/agent-core/compaction";
 import { type Model, modelsAreEqual } from "@gajae-code/ai/core";
 import { Container, type KeyId, Markdown, Spacer, Text } from "@gajae-code/tui";
 import { isEnoent, prompt } from "@gajae-code/utils";
-import { resolveLocalUrlToPath } from "../../internal-urls";
+import { resolveLocalRoot, resolveLocalUrlToPath } from "../../internal-urls";
 import { humanizePlanTitle, type PlanApprovalDetails, resolvePlanTitle } from "../../plan-mode/approved-plan";
 import planModeApprovedPrompt from "../../prompts/system/plan-mode-approved.md" with { type: "text" };
 import planModeCompactInstructionsPrompt from "../../prompts/system/plan-mode-compact-instructions.md" with {
@@ -13,6 +13,7 @@ import planModeCompactInstructionsPrompt from "../../prompts/system/plan-mode-co
 };
 import type { AgentSession, TemporaryProviderSessionScope } from "../../session/agent-session";
 import type { SessionContext, SessionManager } from "../../session/session-manager";
+import { writeFileAtomically } from "../../tools/atomic-file-write";
 import { normalizeLocalScheme } from "../../tools/path-utils";
 import { type ResolveToolDetails, runResolveInvocation } from "../../tools/resolve";
 import { ToolError } from "../../tools/tool-errors";
@@ -338,13 +339,16 @@ export class PlanModeController {
 			throw error;
 		}
 	}
+	#localProtocolOptions() {
+		return {
+			getArtifactsDir: () => this.ctx.sessionManager.getArtifactsDir(),
+			isManagedDestination: () => this.ctx.sessionManager.isManagedDestination(),
+			getSessionId: () => this.ctx.sessionManager.getSessionId(),
+		};
+	}
 	#resolvePath(planFilePath: string): string {
 		return planFilePath.startsWith("local:")
-			? resolveLocalUrlToPath(normalizeLocalScheme(planFilePath), {
-					getArtifactsDir: () => this.ctx.sessionManager.getArtifactsDir(),
-					isManagedDestination: () => this.ctx.sessionManager.isManagedDestination(),
-					getSessionId: () => this.ctx.sessionManager.getSessionId(),
-				})
+			? resolveLocalUrlToPath(normalizeLocalScheme(planFilePath), this.#localProtocolOptions())
 			: path.resolve(this.ctx.sessionManager.getCwd(), planFilePath);
 	}
 	async #finalizeApprovedPlan(planContent: string, planFilePath: string, finalPlanFilePath: string): Promise<void> {
@@ -420,7 +424,13 @@ export class PlanModeController {
 				trimTrailingNewline: false,
 			});
 			if (result !== null) {
-				await Bun.write(resolved, result);
+				// Lexical local:// checks do not see a symlink. Bind this save to the
+				// same local root so a link inside it cannot publish outside.
+				if (planFilePath.startsWith("local:")) {
+					await writeFileAtomically(resolved, result, {
+						trustBoundary: path.resolve(resolveLocalRoot(this.#localProtocolOptions())),
+					});
+				} else await Bun.write(resolved, result);
 				this.ctx.showStatus("Plan updated in external editor.");
 			}
 			return result;

package/src/modes/controllers/selector-controller.ts

@@ -107,7 +107,10 @@ import { ensureTelegramDaemonRunningDetailed, resolveTelegramSetupPreflight } fr
 import { TelegramDaemonController } from "../../sdk/bus/telegram-daemon-control";
 import { runTelegramSetup, type TelegramSetupPreflight } from "../../sdk/bus/telegram-setup";
 import { clearPersistentPinForRemovedRows } from "../../session/account-inventory";
-import type { DefaultFallbackRuntimeState } from "../../session/agent-session";
+import type {
+	AgentSessionProfileInstalledOverrideState,
+	DefaultFallbackRuntimeState,
+} from "../../session/agent-session";
 import { CREDENTIAL_STORE_UNREADABLE_MESSAGE } from "../../session/credential-store-errors";
 import { type SessionInfo, SessionManager } from "../../session/session-manager";
 import { getTreeForInternalRead } from "../../session/session-manager-internal";
@@ -1214,6 +1217,7 @@ interface DefaultAssignmentRollbackSnapshot {
 	profileOverride: SettingValue<"modelProfile.default"> | undefined;
 	chain: { entries: readonly string[]; origin: string; identity?: string; explicitHead?: boolean } | undefined;
 	activeProfile: string | undefined;
+	profileInstalledOverrideState: AgentSessionProfileInstalledOverrideState | undefined;
 	canonicalVariant: string | undefined;
 	resumeDefaultSelector: string | undefined;
 	fallbackRuntimeState: DefaultFallbackRuntimeState;
@@ -1248,6 +1252,10 @@ function rawAutoroutingState(current: RawSettings): {
 
 export class SelectorController {
 	#smartRoutingInFlight?: Promise<unknown>;
+	#modelSelector?: ModelSelectorComponent;
+	#settingsSelector?: SettingsSelectorComponent;
+	#statusLinePreview?: Partial<StatusLineSettings>;
+	#statusLinePreviewActive = false;
 	#transcriptViewerOpen = false;
 	#transcriptViewer?: TranscriptViewerOverlay;
 	#sessionsDashboardOpen = false;
@@ -1277,6 +1285,7 @@ export class SelectorController {
 			profileOverride: this.ctx.settings.getOverride("modelProfile.default"),
 			chain: this.ctx.session.getConfiguredModelChainState("default"),
 			activeProfile: this.ctx.session.getActiveModelProfile?.(),
+			profileInstalledOverrideState: this.ctx.session.getProfileInstalledOverrideState?.(),
 			canonicalVariant: this.ctx.session.modelRegistry.getSessionCanonicalVariant?.(this.ctx.session.sessionId),
 			resumeDefaultSelector: this.ctx.session.sessionManager.buildSessionContext().models.default,
 			fallbackRuntimeState: this.ctx.session.getDefaultFallbackRuntimeState(),
@@ -1354,6 +1363,11 @@ export class SelectorController {
 			restore(() => this.ctx.session.recordResumeDefaultModel(snapshot.resumeDefaultSelector));
 		}
 		restore(() => this.ctx.session.setActiveModelProfile?.(snapshot.activeProfile));
+		if (snapshot.profileInstalledOverrideState) {
+			restore(() =>
+				this.ctx.session.restoreProfileInstalledOverrideState?.(snapshot.profileInstalledOverrideState!),
+			);
+		}
 		try {
 			await this.ctx.settings.flushOrThrow();
 		} catch (rollbackError) {
@@ -1401,7 +1415,15 @@ export class SelectorController {
 	 */
 	showSelector(create: (done: () => void) => { component: Component; focus: Component }): void {
 		if (this.ctx.isStopped?.()) return;
+		this.#modelSelector = undefined;
+		this.#settingsSelector = undefined;
+		this.#statusLinePreview = undefined;
+		this.#statusLinePreviewActive = false;
 		const done = () => {
+			this.#modelSelector = undefined;
+			this.#settingsSelector = undefined;
+			this.#statusLinePreview = undefined;
+			this.#statusLinePreviewActive = false;
 			if (this.ctx.isStopped?.()) return;
 			// Prefer the pet-aware composer restore (InteractiveMode.restoreComposer); fall back
 			// to a plain editor swap for contexts that predate it (e.g. lightweight test doubles).
@@ -1424,6 +1446,28 @@ export class SelectorController {
 		this.ctx.ui.requestRender();
 	}
 
+	/** Refresh accepted disk configuration without discarding an open preview. */
+	refreshConfiguration(): void {
+		if (this.ctx.isStopped?.()) return;
+		this.#applyStatusLineSettings();
+		this.#modelSelector?.refreshRoleAssignments({
+			currentModel: this.ctx.session.model,
+			currentThinkingLevel: this.ctx.session.thinkingLevel,
+			activeModelProfile: this.ctx.session.getActiveModelProfile(),
+		});
+		this.#modelSelector?.refreshPresetProfiles();
+		this.#settingsSelector?.refreshFromConfiguration([...this.ctx.session.modelRegistry.getModelProfiles().keys()]);
+		this.ctx.updateEditorTopBorder();
+		this.ctx.ui.requestRender();
+	}
+
+	#applyStatusLineSettings(): void {
+		this.ctx.statusLine.updateSettings({
+			...buildStatusLineSettings(this.ctx.settings),
+			...(this.#statusLinePreviewActive ? this.#statusLinePreview : undefined),
+		});
+	}
+
 	showCommandPalette(
 		commands: SlashCommand[],
 		actions: CommandPaletteAction[],
@@ -1990,11 +2034,19 @@ export class SelectorController {
 						},
 						onPetCommit: mode => this.ctx.commitPetPreviewMode(mode as PetMode),
 						onStatusLinePreview: previewSettings => {
-							// Update status line with preview settings
-							this.ctx.statusLine.updateSettings({
-								...buildStatusLineSettings(settings),
-								...previewSettings,
-							});
+							if (this.#statusLinePreviewActive) this.#statusLinePreview = previewSettings;
+							this.#applyStatusLineSettings();
+							this.ctx.updateEditorTopBorder();
+							this.ctx.ui.requestRender();
+						},
+						onStatusLinePreviewStart: () => {
+							this.#statusLinePreviewActive = true;
+							this.#statusLinePreview = undefined;
+						},
+						onStatusLinePreviewEnd: () => {
+							this.#statusLinePreviewActive = false;
+							this.#statusLinePreview = undefined;
+							this.#applyStatusLineSettings();
 							this.ctx.updateEditorTopBorder();
 							this.ctx.ui.requestRender();
 						},
@@ -2068,6 +2120,7 @@ export class SelectorController {
 					},
 					notificationsOperations,
 				);
+				this.#settingsSelector = selector;
 				return { component: selector, focus: selector };
 			});
 		});
@@ -2849,6 +2902,7 @@ export class SelectorController {
 								if (!materializedProfile) {
 									for (const targetRole of targetRoles) {
 										const target = GJC_MODEL_ASSIGNMENT_TARGETS[targetRole];
+										this.ctx.session.markProfileRoleOverrideManual?.(target.settingsPath, targetRole);
 										if (target.settingsPath === "modelRoles") {
 											this.ctx.settings.setModelRole(targetRole, value);
 										} else {
@@ -2952,6 +3006,7 @@ export class SelectorController {
 							});
 							if (!materializedProfile) {
 								const target = GJC_MODEL_ASSIGNMENT_TARGETS[role];
+								this.ctx.session.markProfileRoleOverrideManual?.(target.settingsPath, role);
 								if (target.settingsPath === "modelRoles") {
 									this.ctx.settings.setModelRole(role, value);
 								} else {
@@ -2996,6 +3051,7 @@ export class SelectorController {
 					smartRoutingOnly: options?.smartRoutingOnly,
 				},
 			);
+			this.#modelSelector = modelSelector;
 			return { component: modelSelector, focus: modelSelector };
 		});
 	}

package/src/modes/interactive-mode.ts

@@ -16,6 +16,8 @@ import {
 import { APP_NAME, adjustHsv, getAgentDir, getProjectDir, logger, postmortem, sanitizeText } from "@gajae-code/utils";
 import chalk from "chalk";
 import { AsyncJobManager } from "../async";
+import { ConfigHotReloadWatcher } from "../config/config-hot-reload";
+import { isConfigHotReloadSupported, isConfigHotReloadTrusted } from "../config/config-hot-reload-trust";
 import {
 	type AppKeybinding,
 	defaultMessageQueueKeysForPlatform,
@@ -573,6 +575,7 @@ export class InteractiveMode implements InteractiveModeContext {
 	// paint, which renders the full session anyway.
 	#initialTranscriptPainted = false;
 	#stopListeners = new Set<() => void>();
+	#configHotReload?: ConfigHotReloadWatcher;
 	#eventBus?: EventBus;
 	#eventBusUnsubscribers: Array<() => void> = [];
 	#welcomeComponent?: WelcomeComponent;
@@ -999,6 +1002,8 @@ export class InteractiveMode implements InteractiveModeContext {
 		this.updateEditorChrome();
 		this.#syncEditorMaxHeight();
 		this.isInitialized = true;
+		await this.#startConfigHotReload();
+		if (this.#stopped) return;
 		this.syncActivityIndicator();
 		if (this.settings.get("tasksPane.defaultVisible")) this.showTasksPane();
 		this.#syncIrcSidebarAvailabilityFromSettings();
@@ -1691,6 +1696,65 @@ export class InteractiveMode implements InteractiveModeContext {
 		return this.#stopped;
 	}
 
+	async #startConfigHotReload(): Promise<void> {
+		const paths = this.session.getConfigurationPaths();
+		if (!paths) return;
+		if (!isConfigHotReloadSupported()) {
+			logger.debug("Configuration hot reload is unsupported on this platform", { platform: process.platform });
+			return;
+		}
+		const trusted = await isConfigHotReloadTrusted(paths);
+		if (this.#stopped || this.#isShuttingDown) return;
+		if (!trusted) {
+			this.showWarning(
+				"Configuration watching could not start because directory ownership and privacy could not be verified.",
+			);
+			return;
+		}
+		const assertTrustedPaths = async (): Promise<void> => {
+			if (await isConfigHotReloadTrusted(paths)) return;
+			const error = new Error("Configuration directory ownership and privacy could not be verified");
+			Object.assign(error, { code: "EACCES" });
+			throw error;
+		};
+		const watcher = new ConfigHotReloadWatcher({
+			onValidate: async candidate => {
+				await assertTrustedPaths();
+				await this.session.validateConfiguration(candidate);
+			},
+			onCandidate: async (candidate, signal) => {
+				if (signal.aborted || this.#stopped || this.#isShuttingDown) return;
+				await assertTrustedPaths();
+				if (signal.aborted || this.#stopped || this.#isShuttingDown) return;
+				const result = await this.session.reloadConfiguration(candidate, signal);
+				if (signal.aborted || this.#stopped || this.#isShuttingDown || !result.applied) return;
+				this.#selectorController.refreshConfiguration();
+				this.#syncEditorMaxHeight();
+				this.#syncIrcSidebarAvailabilityFromSettings();
+				this.updateEditorChrome();
+				this.showStatus(
+					result.settingsChanged
+						? "Configuration reloaded. Startup-only services require a restart."
+						: "Model configuration reloaded.",
+				);
+				this.ui.requestRender();
+			},
+			onError: error => {
+				if (!this.#stopped && !this.#isShuttingDown) {
+					this.showWarning(`${error.message}. Repair the configuration file and save again.`);
+				}
+			},
+		});
+		this.#configHotReload = watcher;
+		try {
+			await watcher.start(paths);
+		} catch {
+			watcher.dispose();
+			this.#configHotReload = undefined;
+			this.showWarning("Configuration watching could not start. Restart after repairing file access.");
+		}
+	}
+
 	onStop(callback: () => void): () => void {
 		if (this.#stopped) {
 			callback();
@@ -1703,6 +1767,8 @@ export class InteractiveMode implements InteractiveModeContext {
 	stop(): void {
 		const wasInitialized = this.isInitialized;
 		this.#stopped = true;
+		this.#configHotReload?.dispose();
+		this.#configHotReload = undefined;
 		this.ui.setRenderPreparationLifecycleCallbacks(undefined);
 		this.#inputController.discardDeferredSubmission();
 		for (const listener of this.#stopListeners) {
@@ -1776,6 +1842,8 @@ export class InteractiveMode implements InteractiveModeContext {
 			return;
 		}
 		this.#isShuttingDown = true;
+		this.#configHotReload?.dispose();
+		this.#configHotReload = undefined;
 
 		// `/btw` owns the shared composer while its panel is open. Never persist a
 		// side-chat draft or pending side-chat images into the main-session draft.

package/src/modes/theme/theme.ts

@@ -1260,9 +1260,11 @@ const langMap: Record<string, SymbolKey> = {
 };
 
 export class Theme {
+	#svgColorValues: Record<string, string | number>;
 	#fgColors: Record<ThemeColor, string>;
 	#bgColors: Record<ThemeBg, string>;
 	#symbols: SymbolMap;
+	#svgPalette: Readonly<Record<string, string>>;
 
 	constructor(
 		fgColors: Record<ThemeColor, string | number>,
@@ -1271,10 +1273,19 @@ export class Theme {
 		private readonly symbolPreset: SymbolPreset,
 		symbolOverrides: Partial<Record<SymbolKey, string>>,
 	) {
+		this.#svgColorValues = { ...fgColors, ...bgColors };
 		this.#fgColors = {} as Record<ThemeColor, string>;
 		for (const [key, value] of Object.entries(fgColors) as [ThemeColor, string | number][]) {
 			this.#fgColors[key] = fgAnsi(value, mode);
 		}
+		const textColor = this.#svgColorValues.text;
+		const foreground = typeof textColor === "number" ? ansi256ToHex(textColor) : textColor || "#e5e5e7";
+		const svgPalette: Record<string, string> = { fg: foreground };
+		for (const color of THEME_COLOR_KEYS) {
+			const value = this.#svgColorValues[color];
+			svgPalette[color] = typeof value === "number" ? ansi256ToHex(value) : value || foreground;
+		}
+		this.#svgPalette = Object.freeze(svgPalette);
 		this.#bgColors = {} as Record<ThemeBg, string>;
 		for (const [key, value] of Object.entries(bgColors) as [ThemeBg, string | number][]) {
 			this.#bgColors[key] = bgAnsi(value, mode);
@@ -1329,6 +1340,10 @@ export class Theme {
 		return ansi;
 	}
 
+	getSvgPalette(): Readonly<Record<string, string>> {
+		return this.#svgPalette;
+	}
+
 	getBgAnsi(color: ThemeBg): string {
 		const ansi = this.#bgColors[color];
 		if (!ansi) throw new Error(`Unknown theme background color: ${color}`);

package/src/prompts/tools/debug.md

@@ -15,7 +15,7 @@ Use for launching or attaching debuggers, setting breakpoints, stepping through
 <caution>
 - Only one active debug session is supported at a time.
 - Some adapters require a launched session to receive `configurationDone` before the target actually runs; if the tool says configuration is pending, set breakpoints and then call `continue`.
-- Adapter availability depends on local binaries. Common built-ins: `gdb`, `lldb-dap`, `python -m debugpy.adapter`, `dlv dap`.
+- Adapter availability depends on local binaries. Common built-ins: `gdb`, `lldb-dap`, `python -I -m debugpy.adapter`, `dlv dap`.
 - `program` must be an executable file or debug target, not a directory or interpreter name that resolves to a workspace directory.
 </caution>
 

package/src/prompts/tools/read.md

@@ -73,7 +73,7 @@ For `.sqlite`, `.sqlite3`, `.db`, `.db3`:
 
 `agent://<id>`, `artifact://<id>`, `rule://<name>`, and `local://<name>.md` resolve transparently and accept the same line selectors as filesystem paths. Use `artifact://<id>` to recover full output that a previous bash/eval/tool result spilled or truncated.
 
-Bundled skills have no filesystem home, so the skill tool and skill discovery report them as `embedded:gjc/skills/<name>/SKILL.md`; read that identifier verbatim. Bundled skill fragments, when surfaced, likewise use `embedded:gjc/skill-fragments/...` identifiers.
+Bundled skills have no filesystem home, so the skill tool and skill discovery report them as `embedded:gjc/skills/<name>/SKILL.md`; read that identifier verbatim. Bundled skill fragments, when surfaced, likewise use `embedded:gjc/skill-fragments/…` identifiers.
 
 <critical>
 - Always include `path`; never call `read` with `{}`.

package/src/prompts/tools/report-issue.md

@@ -0,0 +1,13 @@
+Records a tool that behaved inconsistently with its own description, for local quality tracking.
+
+<instruction>
+- Call this when a tool's output contradicts what its description or parameters promise: ignored or misapplied parameters, wrong or truncated results, misleading errors, silent no-ops.
+- `tool` is the misbehaving tool's name; `report` states what you called, what you expected, and what actually happened, in one or two sentences.
+- Do not report your own mistakes, user-caused failures, or expected errors (missing files, failing tests, network outages).
+- Do not paste secrets, tokens, credentials, or raw tool output into report; summarize it instead.
+- False positives are acceptable. Report once per distinct problem, then continue the task; this never fixes or retries anything.
+</instruction>
+
+<output>
+Confirms whether the report was recorded. Reports stay on this machine.
+</output>

package/src/prompts/tools/task.md

@@ -23,7 +23,7 @@ Use `irc` for live coordination when it is available.
 {{#if customSchemaEnabled}}- `schema`: JTD schema for expected structured output (do not put format rules in assignments){{/if}}
 - `spawnPlan` (optional): required before any batch with more than 4 tasks; include whyParallel, whyNotLocal, independence, expectedReceiptShape, and maxInlineTokens.
 {{#if isolationEnabled}}- `isolated`: run in an isolated environment; REQUIRED when the user explicitly requests a worktree (for example, "use worktree"), and use when tasks edit overlapping files{{/if}}
-- `repositoryBinding`: optional authoritative repository/worktree identity. It must match the active session and cannot authorize a foreign repository from this session. For another approved repository, start a fresh session rooted there (for example, `gjc --cwd <approved-worktree>`); do not use `/move` because materialized tasks retain their original binding.
+- `repositoryBinding`: optional authoritative repository/worktree identity. It must match the session's committed cwd and cannot itself authorize relocation. After an authorized session move, new work uses the committed target; already-admitted work retains its source execution inputs. Verified storage relocation of that same parent does not change child execution cwd; a logical session switch does not substitute successor storage. For another approved repository, start a fresh session rooted there (for example, `gjc --cwd <approved-worktree>`) or use the existing user-authorized relocation surface; `move_session` still only narrows to a descendant directory.
 </parameters>
 
 <rules>

package/src/runtime-credential-selector.ts

@@ -6,7 +6,7 @@ export interface CliCredentialSelector {
 	raw: string;
 }
 
-const SELECTOR_KINDS = new Set<AuthCredentialSelectorKind>(["id", "email", "account", "project"]);
+const SELECTOR_KINDS = new Set<AuthCredentialSelectorKind>(["id", "email", "account", "project", "org"]);
 
 function parseSelectorBody(body: string): AuthCredentialSelector | undefined {
 	const separator = body.indexOf(":");
@@ -28,7 +28,7 @@ export function parseCliCredentialSelector(raw: string): CliCredentialSelector {
 	const selector = parseSelectorBody(body);
 	if (!selector || provider === "") {
 		throw new Error(
-			`Invalid --credential selector "${raw}". Use email:name@example.com, id:123, account:<id>, project:<id>, or provider/email:name@example.com.`,
+			`Invalid --credential selector "${raw}". Use email:name@example.com, id:123, account:<id>, project:<id>, org:<organization id or name>, or provider/email:name@example.com.`,
 		);
 	}
 	return { ...(provider ? { provider } : {}), selector, raw };

package/src/runtime-mcp/content-limits.ts

@@ -1,4 +1,11 @@
 export const MCP_MAX_CONTENT_BYTES = 16 * 1024 * 1024;
+// Match the pasted-image count limit; bound decode attempts as well as output count.
+export const MCP_MAX_IMAGES = 16;
+// Bound decoded source complexity before native image decoding.
+export const MCP_MAX_IMAGE_SOURCE_DIMENSION = 8_192;
+export const MCP_MAX_IMAGE_SOURCE_PIXELS = 16_000_000;
+// Decoded image-file bytes after resizing, before base64 encoding (per result).
+export const MCP_MAX_IMAGE_OUTPUT_BYTES = 4 * 1024 * 1024;
 export const MCP_MAX_ERROR_BYTES = 16 * 1024;
 export const MCP_MAX_SSE_REQUEST_MESSAGES = 1024;
 export const MCP_MAX_SSE_BATCH_MESSAGES = 1024;

package/src/runtime-mcp/manager-pool.test.ts

@@ -2,6 +2,7 @@ import { expect, test, vi } from "bun:test";
 import { rm } from "node:fs/promises";
 import { legacyMcpMethodNotFound } from "../../test/mcp-test-utils";
 import * as configValue from "../config/resolve-config-value";
+import { wrapUntrustedContent } from "../tools/fetch";
 import { MCPManager } from "./manager";
 import { MCPConnectionPool } from "./pool";
 import { computeMCPPoolKey } from "./pool-key";
@@ -1386,8 +1387,8 @@ test("shared noReplay request failure coordinates one replacement without resend
 		expect(second.getTools()[0]?.mcpToolName).toBe("shared-2");
 		const firstResult = await first.getTools()[0]!.execute("first-later", {}, undefined, {} as never);
 		const secondResult = await second.getTools()[0]!.execute("second-later", {}, undefined, {} as never);
-		expect(firstResult.content).toEqual([{ type: "text", text: "ok-2" }]);
-		expect(secondResult.content).toEqual([{ type: "text", text: "ok-2" }]);
+		expect(firstResult.content).toEqual([{ type: "text", text: wrapUntrustedContent("ok-2") }]);
+		expect(secondResult.content).toEqual([{ type: "text", text: wrapUntrustedContent("ok-2") }]);
 	} finally {
 		await first.disconnectAll().catch(() => {});
 		await second.disconnectAll().catch(() => {});
@@ -1474,8 +1475,8 @@ test("shared restart rebinds every surviving manager lease before subsequent cal
 		expect(second.getTools()[0]?.mcpToolName).toBe("shared-2");
 		const firstResult = await first.getTools()[0]!.execute("first", {}, undefined, {} as never);
 		const secondResult = await second.getTools()[0]!.execute("second", {}, undefined, {} as never);
-		expect(firstResult.content).toEqual([{ type: "text", text: "ok-2" }]);
-		expect(secondResult.content).toEqual([{ type: "text", text: "ok-2" }]);
+		expect(firstResult.content).toEqual([{ type: "text", text: wrapUntrustedContent("ok-2") }]);
+		expect(secondResult.content).toEqual([{ type: "text", text: wrapUntrustedContent("ok-2") }]);
 	} finally {
 		await first.disconnectAll().catch(() => {});
 		await second.disconnectAll().catch(() => {});

package/src/runtime-mcp/manager.ts

@@ -303,6 +303,30 @@ export interface MCPToolCatalogSnapshot {
 	generation: number;
 }
 
+/** Drop project stdio servers unless the user/global opt-in is set. */
+export function omitUnapprovedProjectStdio(
+	configs: Record<string, MCPServerConfig>,
+	sources: Record<string, SourceMeta>,
+	allowProjectStdio: boolean,
+	toolsOnly = false,
+): void {
+	if (allowProjectStdio) return;
+	for (const name of Object.keys(configs)) {
+		const config = configs[name];
+		if (!config || config.type === "http" || config.type === "sse") continue;
+		if (!isUntrustedProjectMcpSource(sources[name], toolsOnly)) continue;
+		delete configs[name];
+		delete sources[name];
+		if (!toolsOnly) {
+			logger.warn("Skipping MCP autoload registration", {
+				path: `mcp:${name}`,
+				serverName: name,
+				reason: "project stdio server is not user-approved",
+			});
+		}
+	}
+}
+
 /** Options for discovering and connecting to MCP servers */
 export interface MCPDiscoverOptions {
 	/** Whether to load project-level config (default: true) */
@@ -330,6 +354,11 @@ export interface MCPDiscoverOptions {
 export interface MCPManagerOptions {
 	/** Restrict this instance to tools from an explicit MCP config. */
 	toolsOnly?: boolean;
+	/**
+	 * Spawn stdio servers loaded from a project MCP file. Default false.
+	 * User-scope servers and an explicit `--mcp-config` file are unaffected.
+	 */
+	allowUntrustedProjectStdio?: boolean;
 	/**
 	 * Ceiling for the startup wait, in milliseconds. ACP lifecycle launches and
 	 * plugin MCP startup use bounded caller-owned budgets; other consumers keep
@@ -460,6 +489,7 @@ export class MCPManager {
 	#scopedLifecycle: "open" | "disconnecting" | "reconnecting" = "open";
 	#scopedLifecycleEpoch = 0;
 	readonly #toolsOnly: boolean;
+	readonly #allowUntrustedProjectStdio: boolean;
 	#toolCacheServerNames: Set<string> | undefined;
 	#toolsOnlyConfigLoaded = false;
 	#connectionSetMutationBlocked = false;
@@ -995,6 +1025,7 @@ export class MCPManager {
 		options: MCPManagerOptions = {},
 	) {
 		this.#toolsOnly = options.toolsOnly === true;
+		this.#allowUntrustedProjectStdio = options.allowUntrustedProjectStdio === true;
 		this.#toolCacheServerNames = options.toolCacheServerNames ? new Set(options.toolCacheServerNames) : undefined;
 		this.#maxStartupTimeoutMs = options.maxStartupTimeoutMs;
 		this.#sleep = options.sleep ?? delay;
@@ -1185,6 +1216,7 @@ export class MCPManager {
 			nativeOnly: options?.nativeOnly,
 			configPath: options?.configPath,
 		});
+		omitUnapprovedProjectStdio(configs, sources, this.#allowUntrustedProjectStdio, this.#toolsOnly);
 		if (this.#toolCacheServerNames !== undefined) {
 			this.#toolCacheServerNames = new Set(
 				Object.keys(configs).filter(name => sources[name]?.provider !== "gjc-plugins"),

package/src/runtime-mcp/oauth-flow.ts

@@ -9,6 +9,7 @@ import type { OAuthCallbackFlowOptions } from "@gajae-code/ai/utils/oauth/callba
 import { OAuthCallbackFlow } from "@gajae-code/ai/utils/oauth/callback-server";
 import type { OAuthController, OAuthCredentials } from "@gajae-code/ai/utils/oauth/types";
 import { guardedPublicFetch } from "../web/insane/url-guard";
+import { cancelMCPStream } from "./content-limits";
 import { assertPublicOAuthUrl } from "./oauth-public-url";
 
 const DEFAULT_PORT = 3000;
@@ -104,6 +105,34 @@ function resolveCallbackOptions(config: MCPOAuthConfig): OAuthCallbackFlowOption
 	};
 }
 
+function isOAuthRedirect(response: Response): boolean {
+	return response.type === "opaqueredirect" || (response.status >= 300 && response.status < 400);
+}
+
+/**
+ * Dial the URL on an address `guardedPublicFetch` just accepted. That helper
+ * forces `redirect: "manual"`, so a 3xx is a refusal rather than a followed hop.
+ */
+async function fetchPinnedOAuthEndpoint(
+	url: string,
+	init: { method: string; headers: Record<string, string>; body?: string; signal?: AbortSignal },
+): Promise<Response> {
+	const dialed = await guardedPublicFetch(url, {
+		method: init.method,
+		headers: init.headers,
+		body: init.body,
+		signal: init.signal,
+	});
+	if (!dialed.ok) {
+		throw new Error(`Refusing non-public OAuth endpoint: ${dialed.reason}`);
+	}
+	if (isOAuthRedirect(dialed.response)) {
+		cancelMCPStream(dialed.response.body);
+		throw new Error("Refusing non-public OAuth endpoint: redirect");
+	}
+	return dialed.response;
+}
+
 /**
  * Canonical MCP server resource URI per RFC 8707 §2: absolute URI, lowercase
  * scheme/host, no fragment, no trailing slash on an empty path.
@@ -264,9 +293,8 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 		}
 
 		await assertPublicOAuthUrl(this.config.tokenUrl, { signal: this.ctrl.signal });
-		const response = await fetch(this.config.tokenUrl, {
+		const response = await fetchPinnedOAuthEndpoint(this.config.tokenUrl, {
 			method: "POST",
-			redirect: "error",
 			headers: {
 				"Content-Type": "application/x-www-form-urlencoded",
 			},
@@ -345,9 +373,8 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 
 		try {
 			await assertPublicOAuthUrl(registrationEndpoint, { signal });
-			const response = await fetch(registrationEndpoint, {
+			const response = await fetchPinnedOAuthEndpoint(registrationEndpoint, {
 				method: "POST",
-				redirect: "error",
 				headers: {
 					"Content-Type": "application/json",
 					Accept: "application/json",
@@ -387,9 +414,8 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 			const authorizationEndpoint = new URL(this.config.authorizationUrl);
 			const metadataUrl = new URL("/.well-known/oauth-authorization-server", authorizationEndpoint.origin);
 			await assertPublicOAuthUrl(metadataUrl.toString(), { signal });
-			const response = await fetch(metadataUrl.toString(), {
+			const response = await fetchPinnedOAuthEndpoint(metadataUrl.toString(), {
 				method: "GET",
-				redirect: "error",
 				headers: { Accept: "application/json" },
 				signal,
 			});