@oh-my-pi/pi-coding-agent 16.2.8 → 16.2.11

package/src/lsp/config.ts

@@ -209,13 +209,27 @@ export function hasRootMarkers(cwd: string, markers: string[]): boolean {
  * Local bin directories to check before $PATH, ordered by priority.
  * Each entry maps a root marker to the bin directory to check.
  */
+const PYTHON_ROOT_MARKERS = [
+	"pyproject.toml",
+	"requirements.txt",
+	"setup.py",
+	"setup.cfg",
+	"Pipfile",
+	"pyrightconfig.json",
+	"ruff.toml",
+	".ruff.toml",
+];
+
 const LOCAL_BIN_PATHS: Array<{ markers: string[]; binDir: string }> = [
 	// Node.js - check node_modules/.bin/
 	{ markers: ["package.json", "package-lock.json", "yarn.lock", "pnpm-lock.yaml"], binDir: "node_modules/.bin" },
 	// Python - check virtual environment bin directories
-	{ markers: ["pyproject.toml", "requirements.txt", "setup.py", "Pipfile"], binDir: ".venv/bin" },
-	{ markers: ["pyproject.toml", "requirements.txt", "setup.py", "Pipfile"], binDir: "venv/bin" },
-	{ markers: ["pyproject.toml", "requirements.txt", "setup.py", "Pipfile"], binDir: ".env/bin" },
+	{ markers: PYTHON_ROOT_MARKERS, binDir: ".venv/bin" },
+	{ markers: PYTHON_ROOT_MARKERS, binDir: ".venv/Scripts" },
+	{ markers: PYTHON_ROOT_MARKERS, binDir: "venv/bin" },
+	{ markers: PYTHON_ROOT_MARKERS, binDir: "venv/Scripts" },
+	{ markers: PYTHON_ROOT_MARKERS, binDir: ".env/bin" },
+	{ markers: PYTHON_ROOT_MARKERS, binDir: ".env/Scripts" },
 	// Ruby - check vendor bundle and binstubs
 	{ markers: ["Gemfile", "Gemfile.lock"], binDir: "vendor/bundle/bin" },
 	{ markers: ["Gemfile", "Gemfile.lock"], binDir: "bin" },

package/src/mcp/oauth-flow.ts

@@ -153,14 +153,44 @@ function resolveCallbackHostname(redirectUri: string | undefined): string | unde
 	return parsed.hostname;
 }
 
+/**
+ * Resolve the client_id MCPOAuthFlow would use without doing any I/O —
+ * either the explicitly configured value or one embedded as a query parameter
+ * in the authorization URL. Returns `undefined` when no client_id is known
+ * statically, which is the trigger for dynamic client registration in
+ * {@link MCPOAuthFlow.#tryRegisterClient}.
+ */
+function staticClientIdFromConfig(config: MCPOAuthConfig): string | undefined {
+	const fromConfig = config.clientId?.trim();
+	if (fromConfig) return fromConfig;
+	try {
+		return new URL(config.authorizationUrl).searchParams.get("client_id") ?? undefined;
+	} catch {
+		return undefined;
+	}
+}
+
 function resolveCallbackOptions(config: MCPOAuthConfig): OAuthCallbackFlowOptions {
 	const redirectUri = resolveRedirectUri(config.redirectUri);
 	validateRedirectConfig(config, redirectUri);
+	// When a client_id is already pinned (config-supplied or embedded in the
+	// authorization URL), it was registered against a specific redirect URI.
+	// Silently advertising a different port at the authorize endpoint would
+	// be rejected by providers like Atlassian (HTTP 500 in the browser, local
+	// flow hangs until the 5-minute timeout), so fail fast instead.
+	//
+	// When no client_id is pinned, MCPOAuthFlow will attempt dynamic client
+	// registration on demand with whichever loopback URI we actually bound —
+	// the provider issues a client_id tied to *that* URI, so the random-port
+	// fallback remains safe for first-install DCR flows whose preferred port
+	// happens to be occupied.
+	const allowPortFallback = staticClientIdFromConfig(config) === undefined;
 	return {
 		preferredPort: resolveCallbackPort(config.callbackPort, redirectUri),
 		callbackPath: resolveCallbackPath(config.callbackPath, redirectUri),
 		callbackHostname: resolveCallbackHostname(redirectUri),
 		redirectUri,
+		allowPortFallback,
 	};
 }
 
@@ -400,6 +430,7 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 				"Content-Type": "application/x-www-form-urlencoded",
 			},
 			body: params.toString(),
+			signal: this.ctrl.signal,
 		});
 
 		if (!response.ok) {
@@ -453,14 +484,7 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 	}
 
 	#resolveClientId(config: MCPOAuthConfig): string | undefined {
-		const fromConfig = config.clientId?.trim();
-		if (fromConfig) return fromConfig;
-
-		try {
-			return new URL(config.authorizationUrl).searchParams.get("client_id") ?? undefined;
-		} catch {
-			return undefined;
-		}
+		return staticClientIdFromConfig(config);
 	}
 	#resourceFromAuthorizationUrl(authorizationUrl: string): string | undefined {
 		try {
@@ -495,6 +519,7 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 					"Content-Type": "application/json",
 					Accept: "application/json",
 				},
+				signal: this.ctrl.signal,
 				body: JSON.stringify({
 					client_name: "oh-my-pi",
 					redirect_uris: [redirectUri],
@@ -560,6 +585,7 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 			const response = await this.#fetch(wellKnownUrl, {
 				method: "GET",
 				headers: { Accept: "application/json" },
+				signal: this.ctrl.signal,
 			});
 			if (!response.ok) return null;
 			const metadata = (await response.json()) as { registration_endpoint?: string };
@@ -578,6 +604,7 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 				method: "GET",
 				redirect: "manual",
 				headers: { Accept: "text/plain,text/html,application/json" },
+				signal: this.ctrl.signal,
 			});
 			if (response.status < 400) return;
 			const body = await response.text();

package/src/modes/acp/acp-agent.ts

@@ -53,7 +53,7 @@ import {
 } from "../../extensibility/extensions";
 import { runExtensionCompact } from "../../extensibility/extensions/compact-handler";
 import { getSessionSlashCommands } from "../../extensibility/extensions/get-commands-handler";
-import { buildSkillPromptMessage } from "../../extensibility/skills";
+import { buildSkillPromptMessage, parseSkillInvocation } from "../../extensibility/skills";
 import { loadSlashCommands } from "../../extensibility/slash-commands";
 import { resolveLocalUrlToPath } from "../../internal-urls";
 import { MCPManager } from "../../mcp/manager";
@@ -831,21 +831,18 @@ export class AcpAgent implements Agent {
 	}
 
 	async #tryRunSkillCommand(record: ManagedSessionRecord, text: string): Promise<boolean> {
-		if (!text.startsWith("/skill:")) {
+		if (!record.session.skillsSettings?.enableSkillCommands) {
 			return false;
 		}
-		if (!record.session.skillsSettings?.enableSkillCommands) {
+		const parsed = parseSkillInvocation(text);
+		if (!parsed) {
 			return false;
 		}
-		const spaceIndex = text.indexOf(" ");
-		const commandName = spaceIndex === -1 ? text.slice(1) : text.slice(1, spaceIndex);
-		const args = spaceIndex === -1 ? "" : text.slice(spaceIndex + 1).trim();
-		const skillName = commandName.slice("skill:".length);
-		const skill = record.session.skills.find(candidate => candidate.name === skillName);
+		const skill = record.session.skills.find(candidate => candidate.name === parsed.name);
 		if (!skill) {
 			return false;
 		}
-		const built = await buildSkillPromptMessage(skill, args);
+		const built = await buildSkillPromptMessage(skill, parsed.args);
 		await record.session.promptCustomMessage({
 			customType: SKILL_PROMPT_MESSAGE_TYPE,
 			content: built.message,

package/src/modes/components/mcp-add-wizard.ts

@@ -63,6 +63,14 @@ export interface MCPAddWizardOAuthResult {
 interface MCPAddWizardOAuthOptions {
 	serverUrl?: string;
 	resource?: string;
+	/**
+	 * External cancellation source. Aborting it tears down the in-flight OAuth
+	 * flow and surfaces a neutral cancellation error. The wizard wires its own
+	 * controller here so Esc cancels the OAuth wait instead of stepping back
+	 * through the form (the wizard is focused, so the editor's Esc hook does
+	 * not fire).
+	 */
+	abortSignal?: AbortSignal;
 }
 
 interface WizardState {
@@ -135,6 +143,12 @@ export class MCPAddWizard extends Container {
 		| null = null;
 	#onTestConnectionCallback: ((config: MCPServerConfig) => Promise<void>) | null = null;
 	#onRenderCallback: (() => void) | null = null;
+	/**
+	 * Set while the OAuth callback is in flight; populated by
+	 * {@link #launchOAuthFlow} and consumed by {@link handleInput} so Esc
+	 * cancels the OAuth wait instead of stepping back through the form.
+	 */
+	#oauthAbort: AbortController | null = null;
 
 	constructor(
 		onComplete: (name: string, config: MCPServerConfig, scope: Scope) => void,
@@ -473,6 +487,15 @@ export class MCPAddWizard extends Container {
 	}
 
 	handleInput(keyData: string): void {
+		// While an OAuth callback is being awaited, Esc/Ctrl+C aborts the flow
+		// rather than stepping back through the form: the wizard advertises
+		// "(Press Esc to cancel)" during the wait, and stepping back would
+		// leave the OAuth login orphaned.
+		if (this.#oauthAbort && (keyData === "\x03" || matchesAppInterrupt(keyData))) {
+			this.#oauthAbort.abort("MCP OAuth flow cancelled by user");
+			return;
+		}
+
 		// Handle Ctrl+C to cancel wizard immediately
 		if (keyData === "\x03") {
 			// Ctrl+C pressed - cancel wizard
@@ -1153,6 +1176,7 @@ export class MCPAddWizard extends Container {
 		this.#contentContainer.addChild(new Text(theme.fg("muted", "(Press Esc to cancel)"), 0, 0));
 		this.#requestRender();
 
+		this.#oauthAbort = new AbortController();
 		try {
 			// Call OAuth handler
 			const oauthResource = this.#state.oauthResource || (this.#state.transport === "stdio" ? "" : this.#state.url);
@@ -1165,6 +1189,7 @@ export class MCPAddWizard extends Container {
 				{
 					serverUrl: this.#state.url || undefined,
 					resource: oauthResource || undefined,
+					abortSignal: this.#oauthAbort.signal,
 				},
 			);
 
@@ -1237,16 +1262,29 @@ export class MCPAddWizard extends Container {
 				healthPassed ? 1000 : 2000,
 			);
 		} catch (error) {
-			// Show error with options to retry or go back
+			// User cancellation has its own neutral heading + tip; everything else
+			// keeps the "OAuth authentication failed" framing so the existing tips
+			// stay meaningful. Name-matching avoids importing controller types.
+			const cancelled = error instanceof Error && error.name === "MCPOAuthCancelledError";
 			const errorMsg = sanitize(error instanceof Error ? error.message : String(error));
 			this.#contentContainer.clear();
-			this.#contentContainer.addChild(new Text(theme.fg("error", "✗ OAuth authentication failed"), 0, 0));
+			this.#contentContainer.addChild(
+				new Text(
+					cancelled ? theme.fg("muted", "○ OAuth cancelled") : theme.fg("error", "✗ OAuth authentication failed"),
+					0,
+					0,
+				),
+			);
 			this.#contentContainer.addChild(new Spacer(1));
 			this.#contentContainer.addChild(new Text(errorMsg, 0, 0));
 			this.#contentContainer.addChild(new Spacer(1));
 
 			// Provide helpful tips based on error type
-			if (errorMsg.includes("timeout") || errorMsg.includes("timed out")) {
+			if (cancelled) {
+				this.#contentContainer.addChild(
+					new Text(theme.fg("muted", "Tip: Choose Retry to launch the browser again."), 0, 0),
+				);
+			} else if (errorMsg.includes("timeout") || errorMsg.includes("timed out")) {
 				this.#contentContainer.addChild(
 					new Text(theme.fg("muted", "Tip: Complete authorization faster next time"), 0, 0),
 				);
@@ -1272,6 +1310,8 @@ export class MCPAddWizard extends Container {
 			// Set up as a selector step
 			this.#selectedIndex = 0;
 			this.#currentStep = "oauth-error";
+		} finally {
+			this.#oauthAbort = null;
 		}
 	}
 

package/src/modes/components/model-selector.ts

@@ -24,7 +24,12 @@ import { getKnownRoleIds, getRoleInfo, MODEL_ROLE_IDS, MODEL_ROLES } from "../..
 import type { Settings } from "../../config/settings";
 import { type ThemeColor, theme } from "../../modes/theme/theme";
 import { matchesSelectDown, matchesSelectUp } from "../../modes/utils/keybinding-matchers";
-import { AUTO_THINKING, type ConfiguredThinkingLevel, getConfiguredThinkingLevelMetadata } from "../../thinking";
+import {
+	AUTO_THINKING,
+	type ConfiguredThinkingLevel,
+	getConfiguredThinkingLevelMetadata,
+	parseConfiguredThinkingLevel,
+} from "../../thinking";
 import { getTabBarTheme } from "../shared";
 import { DynamicBorder } from "./dynamic-border";
 
@@ -342,10 +347,7 @@ export class ModelSelectorComponent extends Container {
 			if (resolved.model) {
 				nextRoles[role] = {
 					model: resolved.model,
-					thinkingLevel:
-						resolved.explicitThinkingLevel && resolved.thinkingLevel !== undefined
-							? resolved.thinkingLevel
-							: ThinkingLevel.Inherit,
+					thinkingLevel: this.#getResolvedRoleThinkingLevel(role, resolved),
 					autoSelected: false,
 				};
 			}
@@ -363,10 +365,7 @@ export class ModelSelectorComponent extends Container {
 				if (!resolved.model) continue;
 				nextRoles[role] = {
 					model: resolved.model,
-					thinkingLevel:
-						resolved.explicitThinkingLevel && resolved.thinkingLevel !== undefined
-							? resolved.thinkingLevel
-							: ThinkingLevel.Inherit,
+					thinkingLevel: this.#getResolvedRoleThinkingLevel(role, resolved),
 					autoSelected: true,
 				};
 			}
@@ -1059,6 +1058,19 @@ export class ModelSelectorComponent extends Container {
 			);
 		}
 	}
+	#getResolvedRoleThinkingLevel(
+		role: string,
+		resolved: { explicitThinkingLevel: boolean; thinkingLevel?: ThinkingLevel },
+	): ConfiguredThinkingLevel {
+		if (resolved.explicitThinkingLevel && resolved.thinkingLevel !== undefined) {
+			return resolved.thinkingLevel;
+		}
+		if (role === "default") {
+			return parseConfiguredThinkingLevel(this.#settings.get("defaultThinkingLevel")) ?? ThinkingLevel.Inherit;
+		}
+		return ThinkingLevel.Inherit;
+	}
+
 	#getThinkingLevelsForModel(model: Model): ReadonlyArray<ConfiguredThinkingLevel> {
 		return [ThinkingLevel.Inherit, ThinkingLevel.Off, AUTO_THINKING, ...getSupportedEfforts(model)];
 	}

package/src/modes/components/todo-reminder.ts

@@ -3,7 +3,9 @@ import { theme } from "../../modes/theme/theme";
 import type { TodoItem } from "../../tools/todo";
 
 /**
- * Component that renders a todo completion reminder notification.
+ * Component that renders a todo completion reminder notification, committed into
+ * the transcript like a TTSR notification so it stays anchored in history rather
+ * than floating above the editor.
  * Shows when the agent stops with incomplete todos.
  */
 export class TodoReminderComponent extends Container {
@@ -16,6 +18,8 @@ export class TodoReminderComponent extends Container {
 	) {
 		super();
 
+		this.addChild(new Spacer(1));
+
 		this.#box = new Box(1, 1, t => theme.inverse(theme.fg("warning", t)));
 		this.#box.setIgnoreTight(true);
 		this.addChild(this.#box);

package/src/modes/controllers/event-controller.ts

@@ -72,6 +72,11 @@ export class EventController {
 	// emits one read per completion — does not break it, so a run of consecutive
 	// reads collapses into one group even across completion boundaries.
 	#lastVisibleBlockCount = 0;
+	// Bumped on each assistant message_start. Scopes the placeholder key for a
+	// not-yet-id'd streamed tool block (see the toolCall loop) so a sealed,
+	// undeleted pending entry from an aborted message can never be reused by the
+	// next message's same content index.
+	#streamTurnNonce = 0;
 	#renderedCustomMessages = new Set<string>();
 	#lastIntent: string | undefined = undefined;
 	#backgroundToolCallIds = new Set<string>();
@@ -401,6 +406,7 @@ export class EventController {
 			this.ctx.ui.requestRender();
 		} else if (event.message.role === "assistant") {
 			this.#lastVisibleBlockCount = 0;
+			this.#streamTurnNonce++;
 			this.ctx.streamingComponent = createAssistantMessageComponent(this.ctx);
 			this.ctx.streamingMessage = event.message;
 			this.ctx.chatContainer.addChild(this.ctx.streamingComponent);
@@ -607,9 +613,14 @@ export class EventController {
 			if (this.ctx.streamingMessage.content.some(content => content.type === "toolCall")) {
 				this.ctx.streamingComponent.markTranscriptBlockFinalized();
 			}
-			for (const content of this.ctx.streamingMessage.content) {
+			for (const [contentIndex, content] of this.ctx.streamingMessage.content.entries()) {
 				if (content.type !== "toolCall") continue;
 				if (content.name === "read") {
+					// Read groups key by the real id (one group spans several reads),
+					// and the owned-dialect parser delivers id + args together when
+					// the call closes, so a parseable target without an id never
+					// occurs here. Defer if it somehow does.
+					if (!content.id) continue;
 					if (!readArgsHaveTarget(content.arguments)) {
 						// Args still streaming — defer until path is parseable so we can route to the
 						// read group (regular files) vs ToolExecutionComponent (internal URLs).
@@ -632,6 +643,26 @@ export class EventController {
 					// Internal URL read falls through to ToolExecutionComponent below.
 				}
 
+				// The owned-dialect tool parser (text-based tool calls for OAuth
+				// Anthropic / OpenAI) appends a tool block when it detects the call
+				// opening and only fills `id` + arguments once the call's text
+				// closes — so the live preview must stream while `content.id` is "".
+				// Key the preview by stable content position until the id lands,
+				// then migrate the pending entry + reveal state onto the real id
+				// (so `tool_execution_*`, which always carries the real id, matches
+				// the same component instead of orphaning a blank card). Native
+				// structured tool calls — every Gemini call, and Anthropic/OpenAI
+				// function calls — carry the id from the first frame, so
+				// `pendingKey === content.id` throughout and the migration no-ops.
+				const streamKey = `\u0000stream:${this.#streamTurnNonce}:${contentIndex}`;
+				const pendingKey = content.id || streamKey;
+				if (content.id && this.ctx.pendingTools.has(streamKey)) {
+					const migrated = this.ctx.pendingTools.get(streamKey);
+					this.ctx.pendingTools.delete(streamKey);
+					if (migrated) this.ctx.pendingTools.set(pendingKey, migrated);
+					this.#toolArgsReveal.rekey(streamKey, pendingKey);
+				}
+
 				// Preserve the raw partial JSON only for renderers that need to surface fields before the JSON object closes.
 				// Bash uses this to show inline env assignments during streaming instead of popping them in at completion.
 				// While the JSON is still open, ToolArgsRevealController paces the
@@ -643,16 +674,16 @@ export class EventController {
 				const rawInput = content.customWireName !== undefined;
 				const tool = this.ctx.viewSession.getToolByName(content.name);
 				if (partialJson) {
-					renderArgs = this.#toolArgsReveal.setTarget(content.id, partialJson, {
+					renderArgs = this.#toolArgsReveal.setTarget(pendingKey, partialJson, {
 						rawInput,
 						exposeRawPartialJson: exposesRawPartialJson(content.name, rawInput, tool),
 						fullArgs: content.arguments,
 					});
 				} else {
-					this.#toolArgsReveal.finish(content.id);
+					this.#toolArgsReveal.finish(pendingKey);
 					renderArgs = content.arguments;
 				}
-				if (!this.ctx.pendingTools.has(content.id)) {
+				if (!this.ctx.pendingTools.has(pendingKey)) {
 					this.#resolveDisplaceablePoll(content.name);
 					this.#resetReadGroup();
 					const component = new ToolExecutionComponent(
@@ -671,13 +702,13 @@ export class EventController {
 					);
 					component.setExpanded(this.ctx.toolOutputExpanded);
 					this.ctx.chatContainer.addChild(component);
-					this.ctx.pendingTools.set(content.id, component);
-					this.#toolArgsReveal.bind(content.id, component);
+					this.ctx.pendingTools.set(pendingKey, component);
+					this.#toolArgsReveal.bind(pendingKey, component);
 				} else {
-					const component = this.ctx.pendingTools.get(content.id);
+					const component = this.ctx.pendingTools.get(pendingKey);
 					if (component) {
 						component.updateArgs(renderArgs, content.id);
-						this.#toolArgsReveal.bind(content.id, component);
+						this.#toolArgsReveal.bind(pendingKey, component);
 					}
 				}
 			}
@@ -969,13 +1000,9 @@ export class EventController {
 		}
 		// Update todo display when todo tool completes
 		if (event.toolName === "todo" && !event.isError) {
-			const hadTodoReminder = (this.ctx.todoReminderContainer?.children.length ?? 0) > 0;
-			this.ctx.todoReminderContainer?.clear();
 			const details = event.result.details as { phases?: TodoPhase[] } | undefined;
 			if (details?.phases) {
 				this.ctx.setTodos(details.phases);
-			} else if (hadTodoReminder) {
-				this.ctx.ui.requestRender();
 			}
 		} else if (event.toolName === "todo" && event.isError) {
 			const textContent = event.result.content.find(
@@ -1272,9 +1299,7 @@ export class EventController {
 
 	async #handleTodoReminder(event: Extract<AgentSessionEvent, { type: "todo_reminder" }>): Promise<void> {
 		const component = new TodoReminderComponent(event.todos, event.attempt, event.maxAttempts);
-		this.ctx.todoReminderContainer.clear();
-		this.ctx.todoReminderContainer.addChild(component);
-		this.ctx.ui.requestRender();
+		this.ctx.present(component);
 	}
 
 	async #handleTodoAutoClear(_event: Extract<AgentSessionEvent, { type: "todo_auto_clear" }>): Promise<void> {

package/src/modes/controllers/mcp-command-controller.ts

@@ -62,6 +62,16 @@ function withTimeout<T>(promise: Promise<T>, timeoutMs: number, message: string,
 	}, timeoutMs);
 	return Promise.race([promise, timeoutPromise]).finally(() => clearTimeout(timer));
 }
+function raceAbortSignal<T>(promise: Promise<T>, signal: AbortSignal, createError: () => Error): Promise<T> {
+	if (signal.aborted) return Promise.reject(createError());
+
+	const aborted = Promise.withResolvers<never>();
+	const onAbort = (): void => aborted.reject(createError());
+	signal.addEventListener("abort", onAbort, { once: true });
+	return Promise.race([promise, aborted.promise]).finally(() => {
+		signal.removeEventListener("abort", onAbort);
+	});
+}
 
 /** Renders the MCP OAuth fallback URL without hard-wrapping the copy target. */
 export class MCPAuthorizationLinkPrompt implements Component {
@@ -135,6 +145,22 @@ interface OAuthFlowResult {
 	resource?: string;
 }
 
+/**
+ * Thrown by {@link MCPCommandController}'s OAuth handler when the user (or a
+ * caller-supplied {@link AbortSignal}) cancels the in-flight flow. Distinct
+ * from network/timeout failures so callers can surface a neutral
+ * "cancelled" status instead of an error banner.
+ */
+export class MCPOAuthCancelledError extends Error {
+	constructor(message = "OAuth flow cancelled") {
+		super(message);
+		this.name = "MCPOAuthCancelledError";
+	}
+}
+
+/** Reason recorded on the OAuth flow's AbortController when the user hits Esc. */
+const MCP_OAUTH_USER_CANCEL_REASON = "MCP OAuth flow cancelled by user";
+
 type MCPAddScope = "user" | "project";
 type MCPAddTransport = "http" | "sse";
 
@@ -521,6 +547,10 @@ export class MCPCommandController {
 								userClientSecret: finalConfig.oauth?.clientSecret,
 							});
 						} catch (oauthError) {
+							if (oauthError instanceof MCPOAuthCancelledError) {
+								this.ctx.showStatus(`Add cancelled for "${parsed.initialName}"`);
+								return;
+							}
 							this.ctx.showError(
 								`OAuth flow failed for "${parsed.initialName}": ${oauthError instanceof Error ? oauthError.message : String(oauthError)}`,
 							);
@@ -587,6 +617,14 @@ export class MCPCommandController {
 			serverUrl?: string;
 			resource?: string;
 			stripSameOriginResource?: boolean;
+			/**
+			 * External cancellation source: when this signal aborts, the in-flight
+			 * OAuth flow is torn down and {@link MCPOAuthCancelledError} is thrown.
+			 * Wizards (which own focus and absorb Esc themselves) pass their own
+			 * controller here; editor-focused callers rely on the Esc hook
+			 * installed below instead.
+			 */
+			abortSignal?: AbortSignal;
 		},
 	): Promise<OAuthFlowResult> {
 		const authStorage = this.ctx.session.modelRegistry.authStorage;
@@ -614,6 +652,26 @@ export class MCPCommandController {
 		}
 		let manualInputClaim: { promise: Promise<string>; clear: (reason?: string) => void } | undefined;
 		const oauthTimeout = new AbortController();
+		// User Esc and external aborts route through here; the timeout path sets
+		// its own reason and leaves this flag false so the catch can distinguish
+		// "user cancelled" (status) from "deadline elapsed" (error).
+		let userCancelled = false;
+		const requestUserCancel = (reason: string): void => {
+			userCancelled = true;
+			if (!oauthTimeout.signal.aborted) oauthTimeout.abort(reason);
+		};
+		const originalOnEscape = this.ctx.editor.onEscape;
+		this.ctx.editor.onEscape = () => requestUserCancel(MCP_OAUTH_USER_CANCEL_REASON);
+		const externalSignal = opts?.abortSignal;
+		const onExternalAbort = (): void => {
+			const reason = externalSignal?.reason;
+			requestUserCancel(typeof reason === "string" ? reason : MCP_OAUTH_USER_CANCEL_REASON);
+		};
+		if (externalSignal?.aborted) {
+			onExternalAbort();
+		} else {
+			externalSignal?.addEventListener("abort", onExternalAbort, { once: true });
+		}
 		try {
 			// Create OAuth flow
 			const flow = new MCPOAuthFlow(
@@ -641,7 +699,7 @@ export class MCPCommandController {
 						block.addChild(new Spacer(1));
 						block.addChild(
 							new Text(
-								theme.fg("muted", "Waiting for authorization... (Press Ctrl+C to cancel, 5 minute timeout)"),
+								theme.fg("muted", "Waiting for authorization... (Press Esc to cancel, 5 minute timeout)"),
 								1,
 								0,
 							),
@@ -687,9 +745,18 @@ export class MCPCommandController {
 				},
 			);
 
-			// Execute OAuth flow with 5 minute timeout
+			const createAbortError = (): Error => {
+				const reason = String(oauthTimeout.signal.reason ?? "MCP OAuth flow aborted");
+				return userCancelled ? new MCPOAuthCancelledError() : new Error(reason);
+			};
+			if (oauthTimeout.signal.aborted) throw createAbortError();
+
+			// Execute OAuth flow with 5 minute timeout. Race the login itself
+			// against the abort signal because Esc/external abort may fire before
+			// MCPOAuthFlow reaches OAuthCallbackFlow.#waitForCallback, where the
+			// underlying callback server normally observes the signal.
 			const credentials = await withTimeout(
-				flow.login(),
+				raceAbortSignal(flow.login(), oauthTimeout.signal, createAbortError),
 				5 * 60 * 1000,
 				"OAuth flow timed out after 5 minutes",
 				() => oauthTimeout.abort("MCP OAuth flow timed out"),
@@ -727,6 +794,14 @@ export class MCPCommandController {
 				resource: flow.resource,
 			};
 		} catch (error) {
+			// User-initiated cancel (Esc or external signal) → neutral status, not
+			// a failure. Check the flag we set in `requestUserCancel`, not the
+			// abort reason: the timeout path also aborts but with a different
+			// reason, and we want it to surface as a timeout error below.
+			if (userCancelled) {
+				throw new MCPOAuthCancelledError();
+			}
+
 			const errorMsg = error instanceof Error ? error.message : String(error);
 
 			// Provide helpful error messages based on failure type
@@ -742,6 +817,8 @@ export class MCPCommandController {
 				throw new Error(`OAuth authentication failed: ${errorMsg}`);
 			}
 		} finally {
+			this.ctx.editor.onEscape = originalOnEscape;
+			externalSignal?.removeEventListener("abort", onExternalAbort);
 			manualInputClaim?.clear("Manual MCP OAuth input cleared");
 		}
 	}
@@ -1629,6 +1706,10 @@ export class MCPCommandController {
 			];
 			this.#showMessage(lines.join("\n"));
 		} catch (error) {
+			if (error instanceof MCPOAuthCancelledError) {
+				this.ctx.showStatus(`Reauthorization cancelled for "${name}"`);
+				return;
+			}
 			this.ctx.showError(`Failed to reauthorize server: ${error instanceof Error ? error.message : String(error)}`);
 		}
 	}