@gajae-code/coding-agent 0.18.8 → 0.18.9

package/src/lsp/config.ts

@@ -276,75 +276,19 @@ export function hasRootMarkers(cwd: string, markers: string[]): boolean {
 }
 
 // =============================================================================
-// Local Binary Resolution
+// Trusted executable resolution
 // =============================================================================
 
 /**
- * Local bin directories to check before $PATH, ordered by priority.
- * Each entry maps a root marker to the bin directory to check.
- */
-const LOCAL_BIN_PATHS: Array<{ markers: string[]; binDir: string }> = [
-	// Node.js - check node_modules/.bin/
-	{ markers: ["package.json", "package-lock.json", "yarn.lock", "pnpm-lock.yaml"], binDir: "node_modules/.bin" },
-	// Python - check virtual environment bin directories
-	{ markers: ["pyproject.toml", "requirements.txt", "setup.py", "Pipfile"], binDir: ".venv/bin" },
-	{ markers: ["pyproject.toml", "requirements.txt", "setup.py", "Pipfile"], binDir: "venv/bin" },
-	{ markers: ["pyproject.toml", "requirements.txt", "setup.py", "Pipfile"], binDir: ".env/bin" },
-	// Ruby - check vendor bundle and binstubs
-	{ markers: ["Gemfile", "Gemfile.lock"], binDir: "vendor/bundle/bin" },
-	{ markers: ["Gemfile", "Gemfile.lock"], binDir: "bin" },
-	// Go - check project-local bin
-	{ markers: ["go.mod", "go.sum"], binDir: "bin" },
-];
-
-const WINDOWS_LOCAL_EXECUTABLE_EXTENSIONS = [".exe", ".cmd", ".bat"] as const;
-
-function resolveLocalCommand(basePath: string): string | null {
-	if (fs.existsSync(basePath)) return basePath;
-	if (process.platform !== "win32") return null;
-
-	// Package managers write Windows launchers with executable suffixes in node_modules/.bin.
-	for (const extension of WINDOWS_LOCAL_EXECUTABLE_EXTENSIONS) {
-		const candidate = `${basePath}${extension}`;
-		if (fs.existsSync(candidate)) return candidate;
-	}
-
-	return null;
-}
-
-/**
- * Resolve a command to an executable path.
- * Checks project-local bin directories first, then falls back to $PATH.
- *
- * @param command - The command name (e.g., "typescript-language-server")
- * @param cwd - Working directory to search from
- * @returns Absolute path to the executable, or null if not found
- */
-export function resolveCommand(command: string, cwd: string): string | null {
-	// Check local bin directories based on project markers
-	for (const { markers, binDir } of LOCAL_BIN_PATHS) {
-		if (hasRootMarkers(cwd, markers)) {
-			const localPath = path.join(cwd, binDir, command);
-			const resolvedLocalPath = resolveLocalCommand(localPath);
-			if (resolvedLocalPath) {
-				return resolvedLocalPath;
-			}
-		}
-	}
-
-	// Fall back to $PATH
-	return piUtils.$which(command);
-}
-
-/**
- * Resolve an LSP executable without consulting project-controlled bin directories.
+ * Resolve a host-spawn executable from $PATH without consulting project-controlled bin directories.
+ * LSP auto-detection and DAP adapter launch both use this rule.
  *
  * Trust is evaluated on both the discovered and canonical paths, but the returned
  * path is the discovered one: multiplexed launchers such as rustup pick the proxied
  * tool from argv[0], so `~/.cargo/bin/rust-analyzer -> rustup` must be spawned as
  * `rust-analyzer`, not as the resolved `rustup` binary.
  */
-function resolveTrustedLspCommand(command: string, cwd: string): string | null {
+export function resolveTrustedCommand(command: string, cwd: string): string | null {
 	if (!path.isAbsolute(command) && (command.includes("/") || command.includes("\\"))) return null;
 	const discovered = path.isAbsolute(command) ? command : piUtils.$which(command);
 	if (!discovered) return null;
@@ -353,6 +297,11 @@ function resolveTrustedLspCommand(command: string, cwd: string): string | null {
 	return discovered;
 }
 
+/** Same rule as `resolveTrustedCommand`: project-local bin directories are never searched. */
+export function resolveCommand(command: string, cwd: string): string | null {
+	return resolveTrustedCommand(command, cwd);
+}
+
 interface ConfigSource {
 	allowProcessOverrides: boolean;
 	read(): LoadedConfigSource | null;
@@ -556,8 +505,8 @@ export function loadConfig(cwd: string): LspConfig {
 			// Check if project has root markers for this language
 			if (!hasRootMarkers(cwd, config.rootMarkers)) continue;
 
-			// Check if the language server binary is available (local or $PATH)
-			const resolved = resolveTrustedLspCommand(config.command, cwd);
+			// Check if a trusted language server binary is available on $PATH.
+			const resolved = resolveTrustedCommand(config.command, cwd);
 			if (!resolved) continue;
 
 			detected[name] = { ...config, resolvedCommand: resolved };
@@ -572,7 +521,7 @@ export function loadConfig(cwd: string): LspConfig {
 	for (const [name, config] of Object.entries(mergedWithRuntime)) {
 		if (config.disabled) continue;
 		if (!hasRootMarkers(cwd, config.rootMarkers)) continue;
-		const resolved = resolveTrustedLspCommand(config.command, cwd);
+		const resolved = resolveTrustedCommand(config.command, cwd);
 		if (!resolved) continue;
 		available[name] = { ...config, resolvedCommand: resolved };
 	}

package/src/memories/index.ts

@@ -3,7 +3,14 @@ import type * as fsNode from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import type { AgentMessage } from "@gajae-code/agent-core";
-import { completeSimple, Effort, type Model } from "@gajae-code/ai/core";
+import { estimateTextTokensHeuristic } from "@gajae-code/agent-core/compaction";
+import {
+	ANTHROPIC_THINKING,
+	completeSimple,
+	Effort,
+	type Model,
+	resolveDefaultRequestMaxTokens,
+} from "@gajae-code/ai/core";
 import { clampThinkingLevelForModel } from "@gajae-code/ai/model-thinking";
 import { getAgentDbPath, getMemoriesDir, logger, parseJsonlLenient, prompt } from "@gajae-code/utils";
 import type { ModelRegistry } from "../config/model-registry";
@@ -74,6 +81,20 @@ const DEFAULTS: MemoryRuntimeConfig = {
 	summaryInjectionTokenLimit: 5_000,
 };
 
+const PHASE2_RAW_MEMORIES_TOKEN_LIMIT = 20_000;
+const PHASE2_ROLLOUT_SUMMARIES_TOKEN_LIMIT = 12_000;
+// Ceiling for the phase 2 response. Phase 2 rewrites MEMORY.md, the summary and every
+// skill in one JSON response, and on adaptive-thinking / reasoning-effort models the
+// reasoning shares this budget. Twice the (approximate) input caps is a generous
+// practical ceiling, not a guarantee that every response fits; a response that still
+// overruns it is reported as truncation.
+const PHASE2_MAX_OUTPUT_TOKENS = 2 * (PHASE2_RAW_MEMORIES_TOKEN_LIMIT + PHASE2_ROLLOUT_SUMMARIES_TOKEN_LIMIT);
+// On a small context window phase 2 shrinks its inputs rather than let the response
+// budget drop below the previous fixed budget.
+const PHASE2_MIN_OUTPUT_TOKENS = 8_192;
+// Request framing plus estimator error when fitting input + output into the context window.
+const PHASE2_CONTEXT_SAFETY_TOKENS = 2_048;
+
 interface Stage1Stats {
 	claimed: number;
 	succeeded: number;
@@ -738,10 +759,8 @@ async function runConsolidationModel(options: {
 	const { memoryRoot, model, apiKey } = options;
 	const rawMemories = await Bun.file(path.join(memoryRoot, "raw_memories.md")).text();
 	const rolloutSummaries = await readRolloutSummaries(memoryRoot);
-	const input = prompt.render(consolidationTemplate, {
-		raw_memories: truncateByApproxTokens(rawMemories, 20_000),
-		rollout_summaries: truncateByApproxTokens(rolloutSummaries, 12_000),
-	});
+	const reasoning = clampThinkingLevelForModel(model, Effort.Low);
+	const { input, maxTokens } = buildPhase2Request(model, rawMemories, rolloutSummaries, reasoning);
 
 	const response = await completeSimple(
 		model,
@@ -751,18 +770,27 @@ async function runConsolidationModel(options: {
 		{
 			apiKey,
 			metadata: options.metadata,
-			maxTokens: 8192,
-			reasoning: clampThinkingLevelForModel(model, Effort.Medium),
+			maxTokens,
+			reasoning,
 		},
 	);
 	if (response.stopReason === "error") {
 		throw new Error(response.errorMessage || "phase2 model error");
 	}
+	if (response.stopReason === "length") {
+		throw new Error(`phase2 output truncated at the max output token limit (${response.usage.output} output tokens)`);
+	}
 	const text = response.content
 		.filter((c): c is { type: "text"; text: string } => c.type === "text")
 		.map(c => c.text)
 		.join("\n")
 		.trim();
+	if (!text) {
+		const thinkingBlocks = response.content.filter(c => c.type === "thinking").length;
+		throw new Error(
+			`phase2 returned no text (stopReason=${response.stopReason}, ${response.usage.output} output tokens, ${thinkingBlocks} thinking blocks)`,
+		);
+	}
 	const parsed = parseJsonObject(text);
 	if (!parsed) throw new Error("phase2 JSON parse failure");
 	const schemaOutput = parseConsolidationOutputSchema(parsed);
@@ -1101,6 +1129,59 @@ function truncateByApproxTokens(text: string, tokenLimit: number): string {
 	return `${text.slice(0, head)}\n\n...[truncated]...\n\n${text.slice(-tail)}`;
 }
 
+/**
+ * Render the phase 2 prompt and choose its response budget.
+ *
+ * The budget is the model's output limit capped at PHASE2_MAX_OUTPUT_TOKENS (or the
+ * provider layer's request default when the limit is unknown). When the context window
+ * is known, input + response + any thinking budget the provider adds on top must fit
+ * in it: the response budget is clamped to the remaining room, and the inputs are
+ * shrunk when that room would fall below PHASE2_MIN_OUTPUT_TOKENS.
+ */
+function buildPhase2Request(
+	model: Model,
+	rawMemories: string,
+	rolloutSummaries: string,
+	reasoning: Effort | undefined,
+): { input: string; maxTokens: number | undefined } {
+	const outputLimit =
+		Number.isSafeInteger(model.maxTokens) && model.maxTokens > 0
+			? Math.min(model.maxTokens, PHASE2_MAX_OUTPUT_TOKENS)
+			: undefined;
+	let rawTokens = Math.min(PHASE2_RAW_MEMORIES_TOKEN_LIMIT, Math.ceil(rawMemories.length / 4));
+	let rolloutTokens = Math.min(PHASE2_ROLLOUT_SUMMARIES_TOKEN_LIMIT, Math.ceil(rolloutSummaries.length / 4));
+	const render = () =>
+		prompt.render(consolidationTemplate, {
+			raw_memories: truncateByApproxTokens(rawMemories, rawTokens),
+			rollout_summaries: truncateByApproxTokens(rolloutSummaries, rolloutTokens),
+		});
+
+	const contextWindow =
+		Number.isSafeInteger(model.contextWindow) && model.contextWindow > 0 ? model.contextWindow : undefined;
+	if (contextWindow === undefined) return { input: render(), maxTokens: outputLimit };
+
+	const responseCeiling = resolveDefaultRequestMaxTokens(model, outputLimit);
+	const minResponse = Math.min(PHASE2_MIN_OUTPUT_TOKENS, responseCeiling);
+	// Budget-mode providers may add the thinking budget on top of maxTokens.
+	const addsThinkingBudget = model.thinking?.mode === "budget" || model.thinking?.mode === "anthropic-budget-effort";
+	const thinkingReserve = reasoning && addsThinkingBudget ? ANTHROPIC_THINKING[reasoning] : 0;
+	const inputRoom = contextWindow - PHASE2_CONTEXT_SAFETY_TOKENS - thinkingReserve - minResponse;
+
+	for (let attempt = 0; attempt < 4; attempt++) {
+		const input = render();
+		const inputTokens = estimateTextTokensHeuristic(input);
+		if (inputTokens <= inputRoom) {
+			const room = contextWindow - PHASE2_CONTEXT_SAFETY_TOKENS - thinkingReserve - inputTokens;
+			return { input, maxTokens: Math.min(responseCeiling, room) };
+		}
+		if (inputRoom <= 0 || rawTokens + rolloutTokens === 0) break;
+		const scale = (inputRoom / inputTokens) * 0.9;
+		rawTokens = Math.floor(rawTokens * scale);
+		rolloutTokens = Math.floor(rolloutTokens * scale);
+	}
+	throw new Error(`phase2 input does not fit the model context window (${contextWindow} tokens)`);
+}
+
 function computeModelTokenBudget(model: Model, config: MemoryRuntimeConfig): number {
 	const maxTokens =
 		Number.isFinite(model.contextWindow) && model.contextWindow > 0 ? model.contextWindow : config.fallbackTokenLimit;

package/src/modes/components/hook-editor.ts

@@ -146,7 +146,7 @@ export class HookEditorComponent extends Container {
 
 		const currentText = this.#editor.getExpandedText();
 		try {
-			this.#tui.stop();
+			this.#tui.suspend();
 			const result = await openInEditor(editorCmd, currentText);
 			if (result !== null) {
 				this.#editor.setText(result);

package/src/modes/components/hook-selector.ts

@@ -734,7 +734,7 @@ export class HookSelectorComponent extends Container {
 
 		const currentText = editor.getExpandedText();
 		try {
-			this.#tui.stop();
+			this.#tui.suspend();
 			const result = await openInEditor(editorCmd, currentText);
 			if (result !== null) {
 				editor.setText(result);

package/src/modes/controllers/input-controller.ts

@@ -1300,7 +1300,7 @@ export class InputController {
 		});
 
 		// Stop the TUI (restore terminal to normal mode)
-		this.ctx.ui.stop();
+		this.ctx.ui.suspend();
 
 		// Send SIGTSTP to process group (pid=0 means all processes in group)
 		process.kill(0, "SIGTSTP");
@@ -2562,7 +2562,7 @@ export class InputController {
 		let ttyHandle: fs.FileHandle | null = null;
 		try {
 			ttyHandle = await this.#openEditorTerminalHandle();
-			this.ctx.ui.stop();
+			this.ctx.ui.suspend();
 
 			const stdio: [number | "inherit", number | "inherit", number | "inherit"] = ttyHandle
 				? [ttyHandle.fd, ttyHandle.fd, ttyHandle.fd]

package/src/modes/controllers/runtime-mcp-command-controller.ts

@@ -19,6 +19,7 @@ import {
 	updateMCPServer,
 } from "../../runtime-mcp/config-writer";
 import { canonicalMCPResourceUri, type MCPOAuthConfig, MCPOAuthFlow } from "../../runtime-mcp/oauth-flow";
+import { nativeMcpSource } from "../../runtime-mcp/project-host-values";
 import {
 	clearSmitheryApiKey,
 	createSmitheryCliAuthSession,
@@ -815,7 +816,7 @@ export class MCPCommandController {
 	 * Test connection to an MCP server.
 	 * Throws an error if connection fails (used for auto-detection).
 	 */
-	async #handleTestConnection(config: MCPServerConfig): Promise<void> {
+	async #handleTestConnection(config: MCPServerConfig, source?: SourceMeta): Promise<void> {
 		const testName = `test_${Date.now()}`;
 		const manager =
 			this.ctx.mcpManager ??
@@ -823,7 +824,7 @@ export class MCPCommandController {
 				sharedPoolIdleMs: this.ctx.settings.get("mcp.sharedPoolIdleMs"),
 			});
 		if (!this.ctx.mcpManager) manager.setAuthStorage(this.ctx.session.modelRegistry.authStorage);
-		await manager.withPreparedLease(testName, config, async () => {});
+		await manager.withPreparedLease(testName, config, async () => {}, { source });
 	}
 
 	async #findConfiguredServer(
@@ -880,7 +881,10 @@ export class MCPCommandController {
 		return next;
 	}
 
-	async #resolveOAuthEndpointsFromServer(config: MCPServerConfig): Promise<{
+	async #resolveOAuthEndpointsFromServer(
+		config: MCPServerConfig,
+		source?: SourceMeta,
+	): Promise<{
 		authorizationUrl: string;
 		tokenUrl: string;
 		clientId?: string;
@@ -888,11 +892,12 @@ export class MCPCommandController {
 		issuer?: string;
 		authorizationResponseIssSupported?: boolean;
 	}> {
-		// First test if server actually needs auth by connecting without OAuth
+		// First test if server actually needs auth by connecting without OAuth.
+		// A stored file keeps its source so project `!` and secret names stay gated.
 		let connectionSucceeded = false;
 		let connectionError: Error | undefined;
 		try {
-			await this.#handleTestConnection(this.#stripOAuthAuth(config));
+			await this.#handleTestConnection(this.#stripOAuthAuth(config), source);
 			connectionSucceeded = true;
 		} catch (error) {
 			connectionError = error as Error;
@@ -967,10 +972,10 @@ export class MCPCommandController {
 		}
 	}
 
-	async #syncManagerConnection(name: string, config: MCPServerConfig): Promise<void> {
+	async #syncManagerConnection(name: string, config: MCPServerConfig, source?: SourceMeta): Promise<void> {
 		if (!this.ctx.mcpManager) return;
 		if (this.ctx.mcpManager.getConnectionStatus(name) !== "disconnected") return;
-		await this.ctx.mcpManager.connectServers({ [name]: config }, {});
+		await this.ctx.mcpManager.connectServers({ [name]: config }, source ? { [name]: source } : {});
 		if (this.ctx.mcpManager.getConnectionStatus(name) === "connected") {
 			await this.ctx.session.refreshMCPTools(this.ctx.mcpManager.getTools());
 		}
@@ -998,9 +1003,10 @@ export class MCPCommandController {
 			// report as connected to avoid false-negative messaging.
 			if (!isConnected && !isConnecting && config.enabled !== false) {
 				try {
-					await this.#handleTestConnection(config);
+					const source = nativeMcpSource(scope, filePath);
+					await this.#handleTestConnection(config, source);
 					isConnected = true;
-					await this.#syncManagerConnection(name, config);
+					await this.#syncManagerConnection(name, config, source);
 				} catch {
 					// Keep disconnected status
 				}
@@ -1276,7 +1282,8 @@ export class MCPCommandController {
 				return;
 			}
 
-			const { config } = found;
+			const { config, scope, filePath } = found;
+			const source = nativeMcpSource(scope, filePath);
 			if (config.enabled === false) {
 				this.ctx.showError(`Server "${name}" is disabled. Run /mcp enable ${name} first.`);
 				return;
@@ -1313,10 +1320,10 @@ export class MCPCommandController {
 					}
 
 					lines.push("");
-					await this.#syncManagerConnection(name, config);
+					await this.#syncManagerConnection(name, config, source);
 					this.#showMessage(lines.join("\n"));
 				},
-				{ signal: abortController.signal },
+				{ signal: abortController.signal, source },
 			);
 		} catch (error) {
 			if (abortController.signal.aborted || (error instanceof Error && error.name === "AbortError")) {
@@ -1492,7 +1499,8 @@ export class MCPCommandController {
 			}
 
 			const baseConfig = this.#stripOAuthAuth(found.config);
-			const oauth = await this.#resolveOAuthEndpointsFromServer(baseConfig);
+			const source = nativeMcpSource(found.scope, found.filePath);
+			const oauth = await this.#resolveOAuthEndpointsFromServer(baseConfig, source);
 			const oauthClientSecret = found.config.oauth?.clientSecret ?? currentAuth?.clientSecret ?? "";
 
 			this.#showMessage(["", theme.fg("muted", `Reauthorizing "${name}"...`), ""].join("\n"));

package/src/modes/controllers/selector-controller.ts

@@ -2777,18 +2777,12 @@ export class SelectorController {
 							return;
 						}
 						const { model, role, thinkingLevel, selector: selectedSelector } = selection;
-						if (
-							(role !== null && role !== "default") ||
-							selection.roles?.some(targetRole => targetRole !== "default")
-						) {
-							this.ctx.session.markUserModelSelection();
-						}
 						if (role === null) {
 							// Temporary: update agent state but don't persist to settings
-							this.ctx.session.markUserModelSelection();
 							await this.ctx.session.setModelTemporary(model, thinkingLevel, {
 								cause: "temporary-operation",
 								reason: "other",
+								onMutationStarted: () => this.ctx.session.markUserModelSelection(),
 							});
 							this.ctx.session.setDefaultFallbackRuntimeModel(
 								selectedSelector ?? formatModelSelectorValue(`${model.provider}/${model.id}`, thinkingLevel),
@@ -2826,6 +2820,7 @@ export class SelectorController {
 								selectedSelector && thinkingLevel && selectedSelector.endsWith(`:${thinkingLevel}`)
 									? selectedSelector.slice(0, -thinkingLevel.length - 1)
 									: selectedSelector;
+							if (includesRoleAgent && !includesDefault) this.ctx.session.markUserModelSelection();
 
 							const rollbackSnapshot = this.#captureDefaultAssignmentRollback();
 							let defaultMutationStarted = false;
@@ -2948,6 +2943,7 @@ export class SelectorController {
 							}
 							const value =
 								selectedSelector ?? formatModelSelectorValue(`${model.provider}/${model.id}`, thinkingLevel);
+							this.ctx.session.markUserModelSelection();
 							const assignments = new Map<GjcModelAssignmentTargetId, string>([[role, value]]);
 							const materializedProfile = materializeActiveModelProfileAssignments({
 								session: this.ctx.session,

package/src/modes/controllers/todo-command-controller.ts

@@ -409,7 +409,7 @@ export class TodoCommandController {
 			current.length > 0 ? phasesToMarkdown(current) : "# Todos\n- [ ] (replace this with your tasks)\n";
 
 		const fileHandle = await this.#openTtyHandle();
-		this.ctx.ui.stop();
+		this.ctx.ui.suspend();
 		try {
 			const stdio: [number | "inherit", number | "inherit", number | "inherit"] = fileHandle
 				? [fileHandle.fd, fileHandle.fd, fileHandle.fd]

package/src/modes/interactive-mode.ts

@@ -679,7 +679,7 @@ export class InteractiveMode implements InteractiveModeContext {
 			startPendingSubmission: input => thisMode.startPendingSubmission(input),
 			addChatChild: child => addChatChild(thisMode, child),
 			requestRender: full => thisMode.ui.requestRender(full),
-			stopUi: () => thisMode.ui.stop(),
+			stopUi: () => thisMode.ui.suspend(),
 			startUi: () => thisMode.ui.start(),
 			showStatus: message => thisMode.showStatus(message),
 			showWarning: message => thisMode.showWarning(message),

package/src/runtime-mcp/client.ts

@@ -496,8 +496,10 @@ async function requestWithInputHandling<T>(
 				throw options.signal.reason instanceof Error ? options.signal.reason : new Error("Aborted");
 			}
 			if (request.method === "roots/list") {
-				// roots are answered from local state without user interaction.
-				inputResponses[key] = await defaultRequestHandler("roots/list", undefined);
+				// Use the connection's request handler. Tools-only callers reject
+				// roots/list there; the default handler answers from local state.
+				const onRequest = connection.transport.onRequest ?? defaultRequestHandler;
+				inputResponses[key] = await onRequest("roots/list", undefined);
 				continue;
 			}
 			// Everything else (elicitation, sampling, ...) needs a real interactive

package/src/runtime-mcp/json-rpc.ts

@@ -6,6 +6,7 @@
  */
 import { logger } from "@gajae-code/utils";
 import { cancelMCPStream, MCP_HTTP_TIMEOUT_MS, MCP_MAX_CONTENT_BYTES, readMCPResponseText } from "./content-limits";
+import { fetchMcpRespectingOrigin } from "./mcp-redirect";
 import { redactMCPDiagnosticValue, redactMCPEndpoint } from "./redaction";
 
 /** Parse SSE response format (lines starting with "data: ") */
@@ -70,7 +71,7 @@ export async function callMCP<T = unknown>(
 
 	const signal = AbortSignal.timeout(MCP_HTTP_TIMEOUT_MS);
 	const response = await translateMCPTimeout(
-		fetch(url, {
+		fetchMcpRespectingOrigin(url, {
 			method: "POST",
 			headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream" },
 			body: JSON.stringify(body),

package/src/runtime-mcp/manager.ts

@@ -34,6 +34,7 @@ import {
 	MCPPoolLeaseObsoleteError,
 	MCPPoolLeaseReleaseError,
 } from "./pool";
+import { decideUntrustedProjectConfigValue, isUntrustedProjectMcpSource } from "./project-host-values";
 import type { MCPProtocolObservation } from "./protocol";
 import { DEFAULT_MCP_STARTUP_WAIT_MS, MAX_MCP_STARTUP_WAIT_MS, MCP_STARTUP_WAIT_GRACE_MS } from "./startup-policy";
 import type { MCPToolDetails } from "./tool-bridge";
@@ -1313,8 +1314,9 @@ export class MCPManager {
 			const connectionAbort = new AbortController();
 			this.#pendingConnectionControllers.set(name, connectionAbort);
 			// Resolve auth config before connecting, but do so per-server in parallel.
+			const configSource = sources[name] ?? this.#sources.get(name);
 			const acquireInitialLease = async (): Promise<MCPPoolLease> => {
-				const resolvedConfig = await this.#resolveAuthConfig(config);
+				const resolvedConfig = await this.#resolveAuthConfig(config, false, configSource);
 				let lease: MCPPoolLease | undefined;
 				try {
 					lease = await this.#acquireLease(name, resolvedConfig, config, connectionAbort);
@@ -1371,7 +1373,7 @@ export class MCPManager {
 						// Wire auth refresh for HTTP transports, and reconnect for any transport.
 						if (connection.transport instanceof HttpTransport && config.auth?.type === "oauth") {
 							connection.transport.onAuthError = async () => {
-								const refreshed = await this.#resolveAuthConfig(config, true);
+								const refreshed = await this.#resolveAuthConfig(config, true, configSource);
 								if (refreshed.type === "http" || refreshed.type === "sse") {
 									return refreshed.headers ?? null;
 								}
@@ -2152,7 +2154,11 @@ export class MCPManager {
 		const config = this.#serverConfigs.get(name);
 		if (!config) throw new Error(`MCP server unavailable: ${name}`);
 		await this.#closePendingConnectionCleanup(name);
-		const resolved = await this.#resolveAuthConfig(config);
+		const resolved = await this.#resolveAuthConfig(
+			config,
+			false,
+			this.#sources.get(name) ?? this.#connections.get(name)?._source,
+		);
 		const abort = new AbortController();
 		this.#pendingConnectionControllers.set(name, abort);
 		let prepared:
@@ -2308,9 +2314,9 @@ export class MCPManager {
 	/**
 	 * Resolve auth and shell-command substitutions in config before connecting.
 	 */
-	async prepareConfig(config: MCPServerConfig): Promise<MCPServerConfig> {
+	async prepareConfig(config: MCPServerConfig, source?: SourceMeta): Promise<MCPServerConfig> {
 		this.#assertRawMCPAccessAllowed();
-		return this.#resolveAuthConfig(config);
+		return this.#resolveAuthConfig(config, false, source);
 	}
 
 	/** Acquire a prepared, pool-owned lease for a scoped transient operation. */
@@ -2318,7 +2324,7 @@ export class MCPManager {
 		name: string,
 		config: MCPServerConfig,
 		fn: (lease: MCPPoolLease) => Promise<T> | T,
-		options: { signal?: AbortSignal } = {},
+		options: { signal?: AbortSignal; source?: SourceMeta } = {},
 	): Promise<T> {
 		this.#assertRawMCPAccessAllowed();
 		const lifecycleEpoch = this.#assertScopedAdmission();
@@ -2347,7 +2353,7 @@ export class MCPManager {
 		operation: ScopedOperation,
 		config: MCPServerConfig,
 		fn: (lease: MCPPoolLease) => Promise<T> | T,
-		options: { signal?: AbortSignal },
+		options: { signal?: AbortSignal; source?: SourceMeta },
 	): Promise<T> {
 		const callerSignal = options.signal;
 		const onAbort = () =>
@@ -2376,7 +2382,11 @@ export class MCPManager {
 		let failed = false;
 		let primaryError: unknown;
 		try {
-			const resolvedConfigPromise = this.#resolveAuthConfig(config);
+			const resolvedConfigPromise = this.#resolveAuthConfig(
+				config,
+				false,
+				options.source ?? this.#sources.get(operation.name),
+			);
 			void resolvedConfigPromise.catch(() => {});
 			const resolvedConfig = await Promise.race([resolvedConfigPromise, abortPromise]);
 			if (operation.lifecycleEpoch !== this.#scopedLifecycleEpoch || this.#scopedLifecycle !== "open") {
@@ -2857,7 +2867,7 @@ export class MCPManager {
 			throw new MCPManagerLifecycleError(this.#scopedLifecycle === "disconnecting" ? "disconnect" : "reconnect");
 		};
 		assertLifecycle();
-		const resolvedConfig = await this.#resolveAuthConfig(config);
+		const resolvedConfig = await this.#resolveAuthConfig(config, false, source);
 		assertLifecycle();
 		const connectionAbort = new AbortController();
 		this.#pendingConnectionControllers.set(name, connectionAbort);
@@ -2909,7 +2919,7 @@ export class MCPManager {
 		// Wire auth refresh for HTTP transports, and reconnect for any transport.
 		if (connection.transport instanceof HttpTransport && config.auth?.type === "oauth") {
 			connection.transport.onAuthError = async () => {
-				const refreshed = await this.#resolveAuthConfig(config, true);
+				const refreshed = await this.#resolveAuthConfig(config, true, source);
 				if (refreshed.type === "http" || refreshed.type === "sse") {
 					return refreshed.headers ?? null;
 				}
@@ -3174,7 +3184,11 @@ export class MCPManager {
 	/**
 	 * Resolve OAuth credentials and shell commands in config.
 	 */
-	async #resolveAuthConfig(config: MCPServerConfig, forceRefresh = false): Promise<MCPServerConfig> {
+	async #resolveAuthConfig(
+		config: MCPServerConfig,
+		forceRefresh = false,
+		source?: SourceMeta,
+	): Promise<MCPServerConfig> {
 		let resolved: MCPServerConfig = { ...config };
 
 		const auth = config.auth;
@@ -3240,7 +3254,11 @@ export class MCPManager {
 			resolved = { ...resolved, noInheritEnv: true };
 		}
 
+		const untrustedProject = isUntrustedProjectMcpSource(source, this.#toolsOnly);
 		const resolveValue = async (value: string): Promise<string | undefined> => {
+			const decision = decideUntrustedProjectConfigValue(value, untrustedProject);
+			if (decision.action === "drop") return undefined;
+			if (decision.action === "literal") return decision.value;
 			try {
 				const resolvedValue = await configValue.resolveConfigValue(value);
 				if (this.#toolsOnly && !resolvedValue) throw new MCPExpectedFailure();