@prestyj/cli 5.11.0 → 5.13.0

package/dist/core/mcp/content.test.js

@@ -0,0 +1,135 @@
+import { describe, expect, it } from "vitest";
+import sharp from "sharp";
+import { toToolResult } from "./content.js";
+import { boundedSize } from "../../utils/image.js";
+/** Mirrors the private cap in utils/image.ts — kept local rather than widening that module's API. */
+const MAX_IMAGE_BYTES = 5 * 1024 * 1024;
+async function pngBase64(width, height) {
+    const buffer = await sharp({
+        create: { width, height, channels: 3, background: { r: 10, g: 120, b: 200 } },
+    })
+        .png()
+        .toBuffer();
+    return buffer.toString("base64");
+}
+describe("toToolResult", () => {
+    it("keeps a text-only response a plain string", async () => {
+        const result = await toToolResult([{ type: "text", text: "hello" }], "mcp__x__y");
+        expect(result).toBe("hello");
+    });
+    it("reports an empty response only when there is genuinely nothing", async () => {
+        expect(await toToolResult([], "mcp__x__y")).toBe("(empty response)");
+    });
+    // Every one of these used to return "(empty response)" — the same defect as the
+    // image case, one block type over.
+    describe("non-image blocks reach the model instead of vanishing", () => {
+        it("surfaces an embedded text resource in full", async () => {
+            const result = await toToolResult([
+                {
+                    type: "resource",
+                    resource: { uri: "file:///notes.md", mimeType: "text/markdown", text: "THE ANSWER" },
+                },
+            ], "mcp__s__t");
+            expect(result).toContain("THE ANSWER");
+            expect(result).toContain("file:///notes.md");
+        });
+        it("passes a resource link's address through", async () => {
+            const result = await toToolResult([{ type: "resource_link", uri: "https://example.com/a", name: "report" }], "mcp__s__t");
+            expect(result).toContain("https://example.com/a");
+            expect(result).toContain("report");
+        });
+        it("names audio rather than returning nothing", async () => {
+            const result = await toToolResult([{ type: "audio", data: "aGk=", mimeType: "audio/wav" }], "mcp__s__t");
+            expect(result).toContain("audio");
+            expect(result).not.toBe("(empty response)");
+        });
+        it("notes a non-image binary blob with its size", async () => {
+            const result = await toToolResult([
+                {
+                    type: "resource",
+                    resource: { uri: "file:///a.zip", mimeType: "application/zip", blob: "AAAA" },
+                },
+            ], "mcp__s__t");
+            expect(result).toContain("file:///a.zip");
+            expect(result).toContain("application/zip");
+            expect(result).toContain("3 bytes");
+        });
+        it("falls back to text on an unknown future block type", async () => {
+            const result = await toToolResult([{ type: "video", text: "a clip" }], "mcp__s__t");
+            expect(result).toBe("a clip");
+        });
+    });
+    // Servers use this shape when the image also has a URI; it is just as viewable.
+    it("forwards an image delivered as an embedded resource blob", async () => {
+        const data = await pngBase64(8, 8);
+        const result = await toToolResult([
+            {
+                type: "resource",
+                resource: { uri: "file:///shot.png", mimeType: "image/png", blob: data },
+            },
+        ], "mcp__s__t");
+        const parts = result.content;
+        expect(parts.some((p) => p.type === "image")).toBe(true);
+    });
+    it("forwards an image-only response instead of dropping it", async () => {
+        const data = await pngBase64(8, 8);
+        const result = await toToolResult([{ type: "image", data, mimeType: "image/png" }], "mcp__s__t");
+        expect(typeof result).not.toBe("string");
+        const parts = result.content;
+        expect(parts).toHaveLength(1);
+        expect(parts[0]).toMatchObject({ type: "image", mediaType: "image/png" });
+    });
+    it("puts text before images so it frames them", async () => {
+        const data = await pngBase64(8, 8);
+        const result = await toToolResult([
+            { type: "text", text: "here is the chart" },
+            { type: "image", data, mimeType: "image/png" },
+        ], "mcp__s__t");
+        const parts = result.content;
+        expect(parts.map((p) => p.type)).toEqual(["text", "image"]);
+        expect(parts[0]?.text).toBe("here is the chart");
+    });
+    // A third-party server can return a screenshot far larger than any provider
+    // accepts; forwarding it verbatim would fail the whole turn.
+    it("shrinks an oversized image to fit provider limits", async () => {
+        const huge = boundedSize(8000, 8000);
+        const data = await pngBase64(8000, 8000);
+        expect(Buffer.from(data, "base64").length).toBeGreaterThan(0);
+        const result = await toToolResult([{ type: "image", data, mimeType: "image/png" }], "mcp__s__t");
+        const parts = result.content;
+        const image = parts.find((p) => p.type === "image");
+        const bytes = Buffer.from(image?.data ?? "", "base64");
+        expect(bytes.length).toBeLessThanOrEqual(MAX_IMAGE_BYTES);
+        const meta = await sharp(bytes).metadata();
+        expect(meta.width).toBeLessThanOrEqual(huge.width);
+    });
+    // Providers reject a media type the bytes contradict.
+    it("corrects a media type the payload disagrees with", async () => {
+        const data = await pngBase64(8, 8);
+        const result = await toToolResult([{ type: "image", data, mimeType: "image/jpeg" }], "mcp__s__t");
+        const parts = result.content;
+        expect(parts.find((p) => p.type === "image")?.mediaType).toBe("image/png");
+    });
+    it("degrades an unreadable image to a note and keeps the text", async () => {
+        const result = await toToolResult([
+            { type: "text", text: "rendered" },
+            { type: "image", data: "bm90LWFuLWltYWdl", mimeType: "image/png" },
+        ], "mcp__s__t");
+        const parts = result.content;
+        expect(parts[0]?.text).toBe("rendered");
+        expect(parts[1]?.text).toContain("unreadable image");
+    });
+    it("caps how many images one call can forward", async () => {
+        const data = await pngBase64(8, 8);
+        const many = Array.from({ length: 7 }, () => ({
+            type: "image",
+            data,
+            mimeType: "image/png",
+        }));
+        const result = await toToolResult(many, "mcp__s__t");
+        const parts = result.content;
+        expect(parts.filter((p) => p.type === "image")).toHaveLength(4);
+        expect(parts[0]?.text).toContain("3 further images omitted");
+    });
+});
+//# sourceMappingURL=content.test.js.map

package/dist/core/mcp/content.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content.test.js","sourceRoot":"","sources":["../../../src/core/mcp/content.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,qGAAqG;AACrG,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAExC,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,MAAc;IACpD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;QACzB,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE;KAC9E,CAAC;SACC,GAAG,EAAE;SACL,QAAQ,EAAE,CAAC;IACd,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;QAClF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,CAAC,MAAM,YAAY,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,mCAAmC;IACnC,QAAQ,CAAC,uDAAuD,EAAE,GAAG,EAAE;QACrE,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B;gBACE;oBACE,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE;iBACrF;aACF,EACD,WAAW,CACZ,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YACvC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;YACxD,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EACzE,WAAW,CACZ,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;YAClD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,EACxD,WAAW,CACZ,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAClC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC3D,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B;gBACE;oBACE,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE;iBAC9E;aACF,EACD,WAAW,CACZ,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YAC1C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;YAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;YACpF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B;YACE;gBACE,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE;aACzE;SACF,EACD,WAAW,CACZ,CAAC;QAEF,MAAM,KAAK,GAAI,MAA0C,CAAC,OAAO,CAAC;QAClE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,EAChD,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,OAAO,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,KAAK,GAAI,MAA0C,CAAC,OAAO,CAAC;QAClE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B;YACE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE;YAC3C,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE;SAC/C,EACD,WAAW,CACZ,CAAC;QAEF,MAAM,KAAK,GAAI,MAAyD,CAAC,OAAO,CAAC;QACjF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6DAA6D;IAC7D,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAE9D,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,EAChD,WAAW,CACZ,CAAC;QACF,MAAM,KAAK,GAAI,MAAyD,CAAC,OAAO,CAAC;QACjF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QAEvD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,sDAAsD;IACtD,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,EACjD,WAAW,CACZ,CAAC;QACF,MAAM,KAAK,GAAI,MAA8D,CAAC,OAAO,CAAC;QACtF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B;YACE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE;YAClC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,WAAW,EAAE;SACnE,EACD,WAAW,CACZ,CAAC;QAEF,MAAM,KAAK,GAAI,MAAyD,CAAC,OAAO,CAAC;QACjF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5C,IAAI,EAAE,OAAO;YACb,IAAI;YACJ,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC,CAAC;QAEJ,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACrD,MAAM,KAAK,GAAI,MAAyD,CAAC,OAAO,CAAC;QAEjF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/core/mcp/defaults.d.ts

@@ -12,5 +12,7 @@ export declare function getMCPServers(provider: Provider, apiKey?: string): MCPS
  * a user server can only ADD a new name, never override a default like
  * `kencode-search`.
  */
-export declare function getAllMcpServers(provider: Provider, apiKey: string | undefined, cwd: string): Promise<MCPServerConfig[]>;
+export declare function getAllMcpServers(provider: Provider, apiKey: string | undefined, cwd: string, opts?: {
+    allowProjectScope?: boolean;
+}): Promise<MCPServerConfig[]>;
 //# sourceMappingURL=defaults.d.ts.map

package/dist/core/mcp/defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../../src/core/mcp/defaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlD,eAAO,MAAM,mBAAmB,EAAE,eAAe,EAOhD,CAAC;AAEF;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,eAAe,EAAE,CA4CpF;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,eAAe,EAAE,CAAC,CAM5B"}
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../../src/core/mcp/defaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlD,eAAO,MAAM,mBAAmB,EAAE,eAAe,EAOhD,CAAC;AAEF;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,eAAe,EAAE,CA4CpF;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IAAE,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAAE,GACrC,OAAO,CAAC,eAAe,EAAE,CAAC,CAa5B"}

package/dist/core/mcp/defaults.js

@@ -56,11 +56,18 @@ export function getMCPServers(provider, apiKey) {
  * a user server can only ADD a new name, never override a default like
  * `kencode-search`.
  */
-export async function getAllMcpServers(provider, apiKey, cwd) {
+export async function getAllMcpServers(provider, apiKey, cwd, opts) {
     const defaults = getMCPServers(provider, apiKey);
     const defaultNames = new Set(defaults.map((s) => s.name));
     const scoped = await loadServers(cwd);
-    const userServers = scoped.map((s) => s.config).filter((c) => !defaultNames.has(c.name));
+    // Project scope (<repo>/.ezcoder/mcp.json) is repo-controlled: a malicious repo
+    // can declare a stdio `command` that would execute the moment the project
+    // opens. Only include those when explicitly trusted (trustProjectMcpServers);
+    // global ~/.ezcoder/mcp.json is the user's own file and always connects.
+    const userServers = scoped
+        .filter((s) => opts?.allowProjectScope === true || s.scope !== "project")
+        .map((s) => s.config)
+        .filter((c) => !defaultNames.has(c.name));
     return [...defaults, ...userServers];
 }
 //# sourceMappingURL=defaults.js.map

package/dist/core/mcp/defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../../src/core/mcp/defaults.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,6DAA6D;IAC7D,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,2BAA2B,CAAC,EAAE;CACtF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,QAAkB,EAAE,MAAe;IAC/D,MAAM,OAAO,GAAG,CAAC,GAAG,mBAAmB,CAAC,CAAC;IAEzC,IAAI,QAAQ,KAAK,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC;QAEtD,8CAA8C;QAC9C,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,CAAC,IAAI,EAAE,kBAAkB,CAAC;YAChC,GAAG,EAAE;gBACH,YAAY,EAAE,MAAM;gBACpB,SAAS,EAAE,KAAK;aACjB;YACD,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QAEH,aAAa;QACb,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,gBAAgB;YACtB,GAAG,EAAE,+CAA+C;YACpD,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QAEH,4CAA4C;QAC5C,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,gBAAgB;YACtB,GAAG,EAAE,yCAAyC;YAC9C,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QAEH,gCAAgC;QAChC,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,WAAW;YACjB,GAAG,EAAE,oCAAoC;YACzC,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAkB,EAClB,MAA0B,EAC1B,GAAW;IAEX,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,WAAW,CAAC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../../src/core/mcp/defaults.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,6DAA6D;IAC7D,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,2BAA2B,CAAC,EAAE;CACtF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,QAAkB,EAAE,MAAe;IAC/D,MAAM,OAAO,GAAG,CAAC,GAAG,mBAAmB,CAAC,CAAC;IAEzC,IAAI,QAAQ,KAAK,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC;QAEtD,8CAA8C;QAC9C,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,CAAC,IAAI,EAAE,kBAAkB,CAAC;YAChC,GAAG,EAAE;gBACH,YAAY,EAAE,MAAM;gBACpB,SAAS,EAAE,KAAK;aACjB;YACD,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QAEH,aAAa;QACb,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,gBAAgB;YACtB,GAAG,EAAE,+CAA+C;YACpD,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QAEH,4CAA4C;QAC5C,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,gBAAgB;YACtB,GAAG,EAAE,yCAAyC;YAC9C,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QAEH,gCAAgC;QAChC,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,WAAW;YACjB,GAAG,EAAE,oCAAoC;YACzC,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAkB,EAClB,MAA0B,EAC1B,GAAW,EACX,IAAsC;IAEtC,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,gFAAgF;IAChF,0EAA0E;IAC1E,8EAA8E;IAC9E,yEAAyE;IACzE,MAAM,WAAW,GAAG,MAAM;SACvB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC;SACxE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,WAAW,CAAC,CAAC;AACvC,CAAC"}

package/dist/core/mcp/defaults.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=defaults.test.d.ts.map

package/dist/core/mcp/defaults.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.test.d.ts","sourceRoot":"","sources":["../../../src/core/mcp/defaults.test.ts"],"names":[],"mappings":""}

package/dist/core/mcp/defaults.test.js

@@ -0,0 +1,60 @@
+import { describe, expect, it, beforeEach, afterEach, vi } from "vitest";
+import path from "node:path";
+import os from "node:os";
+import fs from "node:fs/promises";
+// Point the global mcp file at a temp home so tests don't touch the real ~/.ezcoder.
+let tmpHome;
+let tmpProject;
+vi.mock("../../config.js", async () => {
+    const actual = await vi.importActual("../../config.js");
+    return {
+        ...actual,
+        getAppPaths: () => ({
+            ...actual.getAppPaths(),
+            mcpFile: path.join(process.env.EZ_TEST_HOME, ".ezcoder", "mcp.json"),
+        }),
+    };
+});
+import { getAllMcpServers, DEFAULT_MCP_SERVERS } from "./defaults.js";
+import { addServer } from "./store.js";
+beforeEach(async () => {
+    tmpHome = await fs.mkdtemp(path.join(os.tmpdir(), "ez-mcpdef-home-"));
+    tmpProject = await fs.mkdtemp(path.join(os.tmpdir(), "ez-mcpdef-proj-"));
+    process.env.EZ_TEST_HOME = tmpHome;
+    await fs.mkdir(path.join(tmpHome, ".ezcoder"), { recursive: true });
+});
+afterEach(async () => {
+    await fs.rm(tmpHome, { recursive: true, force: true });
+    await fs.rm(tmpProject, { recursive: true, force: true });
+    delete process.env.EZ_TEST_HOME;
+});
+describe("getAllMcpServers project-scope trust gate", () => {
+    it("excludes repo-declared (project-scope) servers by default", async () => {
+        // A malicious repo ships .ezcoder/mcp.json with a stdio command; opening the
+        // project must not connect it unless the user opted in.
+        await addServer({ name: "repo-server", command: "sh", args: ["-c", "echo pwned"] }, "project", tmpProject);
+        await addServer({ name: "user-server", url: "https://example.com/mcp" }, "global", tmpProject);
+        const servers = await getAllMcpServers("anthropic", undefined, tmpProject);
+        const names = servers.map((s) => s.name);
+        expect(names).not.toContain("repo-server");
+        expect(names).toContain("user-server");
+        expect(names).toContain(DEFAULT_MCP_SERVERS[0].name);
+    });
+    it("includes project-scope servers when allowProjectScope is set", async () => {
+        await addServer({ name: "repo-server", command: "sh", args: ["-c", "echo ok"] }, "project", tmpProject);
+        const servers = await getAllMcpServers("anthropic", undefined, tmpProject, {
+            allowProjectScope: true,
+        });
+        expect(servers.map((s) => s.name)).toContain("repo-server");
+    });
+    it("never lets a user server override a provider default", async () => {
+        await addServer({ name: DEFAULT_MCP_SERVERS[0].name, command: "evil" }, "global", tmpProject);
+        const servers = await getAllMcpServers("anthropic", undefined, tmpProject, {
+            allowProjectScope: true,
+        });
+        const kencode = servers.filter((s) => s.name === DEFAULT_MCP_SERVERS[0].name);
+        expect(kencode).toHaveLength(1);
+        expect(kencode[0].command).toBe(DEFAULT_MCP_SERVERS[0].command);
+    });
+});
+//# sourceMappingURL=defaults.test.js.map

package/dist/core/mcp/defaults.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.test.js","sourceRoot":"","sources":["../../../src/core/mcp/defaults.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGlC,qFAAqF;AACrF,IAAI,OAAe,CAAC;AACpB,IAAI,UAAkB,CAAC;AAEvB,EAAE,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,IAAI,EAAE;IACpC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,YAAY,CAAsB,iBAAiB,CAAC,CAAC;IAC7E,OAAO;QACL,GAAG,MAAM;QACT,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YAClB,GAAG,MAAM,CAAC,WAAW,EAAE;YACvB,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAa,EAAE,UAAU,EAAE,UAAU,CAAC;SACtE,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACtE,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC;IACnC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACtE,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IACzD,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,6EAA6E;QAC7E,wDAAwD;QACxD,MAAM,SAAS,CACb,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,EAClE,SAAS,EACT,UAAU,CACX,CAAC;QACF,MAAM,SAAS,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,yBAAyB,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAE/F,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,SAAS,CACb,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAC/D,SAAS,EACT,UAAU,CACX,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE;YACzE,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,SAAS,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAE/F,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE;YACzE,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC;QAC/E,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/core/mcp/deferred-catalog.d.ts

@@ -3,7 +3,7 @@ import type { AgentTool } from "@prestyj/agent";
  * Holds MCP tools OUT of the per-turn request payload until the model asks
  * for them via `tool_search`.
  *
- * Benchmarked (bench/RESULTS.md, bench A): injecting every MCP tool schema
+ * Measured: injecting every MCP tool schema
  * eagerly cost ~33KB (~8.3k tokens) per cache-miss turn with just two MCP
  * servers connected — 56% of all billed input tokens in a 6-turn session.
  * Deferring keeps the tool prefix small and byte-stable; promotion is a

package/dist/core/mcp/deferred-catalog.js

@@ -2,7 +2,7 @@
  * Holds MCP tools OUT of the per-turn request payload until the model asks
  * for them via `tool_search`.
  *
- * Benchmarked (bench/RESULTS.md, bench A): injecting every MCP tool schema
+ * Measured: injecting every MCP tool schema
  * eagerly cost ~33KB (~8.3k tokens) per cache-miss turn with just two MCP
  * servers connected — 56% of all billed input tokens in a 6-turn session.
  * Deferring keeps the tool prefix small and byte-stable; promotion is a

package/dist/core/mcp/elicitation.test.js

@@ -36,7 +36,7 @@ async function callTool(tools, suffix) {
     return typeof result === "string" ? result : JSON.stringify(result);
 }
 beforeEach(async () => {
-    dir = await fs.mkdtemp(path.join(os.tmpdir(), "gg-mcp-elicit-"));
+    dir = await fs.mkdtemp(path.join(os.tmpdir(), "ez-mcp-elicit-"));
 });
 afterEach(async () => {
     await Promise.all(managers.splice(0).map((instance) => instance.dispose()));

package/dist/core/mcp/legacy-negotiation.test.js

@@ -28,7 +28,7 @@ function legacyServer(overrides = {}) {
     };
 }
 beforeEach(async () => {
-    dir = await fs.mkdtemp(path.join(os.tmpdir(), "gg-mcp-legacy-"));
+    dir = await fs.mkdtemp(path.join(os.tmpdir(), "ez-mcp-legacy-"));
     cachePath = path.join(dir, "mcp-catalog.json");
 });
 afterEach(async () => {
@@ -55,7 +55,7 @@ describe("2025-only stdio server under version negotiation", () => {
     it("connects a server that stays silent on the discovery probe", async () => {
         const config = legacyServer({
             name: "silent-legacy-fixture",
-            env: { GG_FIXTURE_SILENT_ON_UNKNOWN: "1" },
+            env: { EZ_FIXTURE_SILENT_ON_UNKNOWN: "1" },
             // Generous connect budget: the point is that the PROBE does not consume
             // it. Without a stdio-specific probe timeout the probe inherits this
             // value, so a silent server would burn the full 30s before falling back.

package/dist/core/mcp/oauth-store.test.js

@@ -8,7 +8,7 @@ describe("McpOAuthStore", () => {
     let dir;
     let file;
     beforeEach(async () => {
-        dir = await fs.mkdtemp(path.join(os.tmpdir(), "gg-mcp-auth-"));
+        dir = await fs.mkdtemp(path.join(os.tmpdir(), "ez-mcp-auth-"));
         file = path.join(dir, "mcp-auth.json");
     });
     afterEach(async () => {
@@ -46,7 +46,7 @@ describe("McpOAuthProvider", () => {
     let dir;
     let store;
     beforeEach(async () => {
-        dir = await fs.mkdtemp(path.join(os.tmpdir(), "gg-mcp-prov-"));
+        dir = await fs.mkdtemp(path.join(os.tmpdir(), "ez-mcp-prov-"));
         store = new McpOAuthStore(path.join(dir, "mcp-auth.json"));
     });
     afterEach(async () => {

package/dist/core/mcp/resolve-stdio.test.js

@@ -92,7 +92,7 @@ describe("resolveStdioCommand npx-cache fallback (covers user-added MCPs)", () =
         tmp = undefined;
     });
     it("rewrites a non-bundled but npx-cached server to `node <binScript>`", () => {
-        tmp = fs.mkdtempSync(path.join(os.tmpdir(), "gg-npx-cache-"));
+        tmp = fs.mkdtempSync(path.join(os.tmpdir(), "ez-npx-cache-"));
         seedNpxCache(tmp, "hash1", "@vendor/cool-mcp", "1.0.0");
         process.env.npm_config_cache = tmp;
         const out = resolveStdioCommand("npx", ["-y", "@vendor/cool-mcp"]);
@@ -100,7 +100,7 @@ describe("resolveStdioCommand npx-cache fallback (covers user-added MCPs)", () =
         expect(out.args[0]).toMatch(/cool-mcp[/\\]build[/\\]index\.js$/);
     });
     it("honours a version pin: a mismatched cached version falls through to npx", () => {
-        tmp = fs.mkdtempSync(path.join(os.tmpdir(), "gg-npx-cache-"));
+        tmp = fs.mkdtempSync(path.join(os.tmpdir(), "ez-npx-cache-"));
         seedNpxCache(tmp, "hash1", "@vendor/cool-mcp", "1.0.0");
         process.env.npm_config_cache = tmp;
         // Requested @2.0.0, only 1.0.0 cached → do NOT rewrite to the wrong version.
@@ -111,7 +111,7 @@ describe("resolveStdioCommand npx-cache fallback (covers user-added MCPs)", () =
             expect(out.command).toBe("npx");
     });
     it("uses a cached copy whose version matches the pin exactly", () => {
-        tmp = fs.mkdtempSync(path.join(os.tmpdir(), "gg-npx-cache-"));
+        tmp = fs.mkdtempSync(path.join(os.tmpdir(), "ez-npx-cache-"));
         seedNpxCache(tmp, "hash1", "@vendor/cool-mcp", "2.0.0");
         process.env.npm_config_cache = tmp;
         const out = resolveStdioCommand("npx", ["-y", "@vendor/cool-mcp@2.0.0"]);
@@ -119,7 +119,7 @@ describe("resolveStdioCommand npx-cache fallback (covers user-added MCPs)", () =
         expect(out.args[0]).toMatch(/cool-mcp[/\\]build[/\\]index\.js$/);
     });
     it("picks the highest cached version when the spec is unpinned", () => {
-        tmp = fs.mkdtempSync(path.join(os.tmpdir(), "gg-npx-cache-"));
+        tmp = fs.mkdtempSync(path.join(os.tmpdir(), "ez-npx-cache-"));
         seedNpxCache(tmp, "old", "@vendor/cool-mcp", "1.2.0", "build/old.js");
         seedNpxCache(tmp, "new", "@vendor/cool-mcp", "1.10.0", "build/new.js");
         process.env.npm_config_cache = tmp;
@@ -131,7 +131,7 @@ describe("resolveStdioCommand npx-cache fallback (covers user-added MCPs)", () =
     it("resolves a sole bin whose key differs from the package name (e.g. zai)", () => {
         // @z_ai/mcp-server exposes bin `zai-mcp-server`, NOT `mcp-server`. A sole
         // bin must be used regardless of its key, or the rewrite silently misses.
-        tmp = fs.mkdtempSync(path.join(os.tmpdir(), "gg-npx-cache-"));
+        tmp = fs.mkdtempSync(path.join(os.tmpdir(), "ez-npx-cache-"));
         const pkgDir = path.join(tmp, "_npx", "h", "node_modules", "@z_ai", "mcp-server");
         fs.mkdirSync(path.join(pkgDir, "build"), { recursive: true });
         fs.writeFileSync(path.join(pkgDir, "build", "index.js"), "#!/usr/bin/env node\n");

package/dist/core/mcp/shared-pool.test.js

@@ -20,7 +20,7 @@ let cachePath;
 const managers = [];
 const pools = [];
 beforeEach(async () => {
-    dir = await fs.mkdtemp(path.join(os.tmpdir(), "gg-mcp-shared-"));
+    dir = await fs.mkdtemp(path.join(os.tmpdir(), "ez-mcp-shared-"));
     cachePath = path.join(dir, "mcp-catalog.json");
 });
 afterEach(async () => {
@@ -51,14 +51,14 @@ function sharedFixture(overrides = {}) {
     return {
         name: "shared-fixture",
         command: process.execPath,
-        args: [FIXTURE, `--gg-marker=${crypto.randomUUID()}`],
+        args: [FIXTURE, `--ez-marker=${crypto.randomUUID()}`],
         timeout: 10_000,
         ...overrides,
     };
 }
 /** Live child processes carrying this config's marker argument. */
 function processCount(config) {
-    const marker = config.args?.find((arg) => arg.startsWith("--gg-marker="));
+    const marker = config.args?.find((arg) => arg.startsWith("--ez-marker="));
     if (!marker)
         throw new Error("fixture config has no marker argument");
     const out = execFileSync("ps", ["-eo", "command"], { encoding: "utf8" });
@@ -351,7 +351,7 @@ describe.skipIf(process.platform === "win32")("shared servers across two session
         // Kill the child out from under the pool, exactly like a crash. Located
         // with `ps` rather than `pgrep`, whose BSD build reads this fixture's
         // leading `--` marker as an illegal option.
-        const marker = config.args.find((arg) => arg.startsWith("--gg-marker="));
+        const marker = config.args.find((arg) => arg.startsWith("--ez-marker="));
         const row = execFileSync("ps", ["-eo", "pid,command"], { encoding: "utf8" })
             .split("\n")
             .find((line) => line.includes(marker));
@@ -381,7 +381,7 @@ describe.skipIf(process.platform === "win32")("shared servers across two session
         const config = {
             name: "elicit-fixture",
             command: process.execPath,
-            args: [ELICIT_FIXTURE, `--gg-marker=${crypto.randomUUID()}`],
+            args: [ELICIT_FIXTURE, `--ez-marker=${crypto.randomUUID()}`],
             timeout: 10_000,
         };
         const pool = newPool();

package/dist/core/mcp/store.test.js

@@ -11,20 +11,20 @@ vi.mock("../../config.js", async () => {
         ...actual,
         getAppPaths: () => ({
             ...actual.getAppPaths(),
-            mcpFile: path.join(process.env.GG_TEST_HOME, ".ezcoder", "mcp.json"),
+            mcpFile: path.join(process.env.EZ_TEST_HOME, ".ezcoder", "mcp.json"),
         }),
     };
 });
 import { addServer, loadServers, removeServer, getServer, fromStoredEntry, globalMcpPath, projectMcpPath, } from "./store.js";
 beforeEach(async () => {
-    tmpHome = await fs.mkdtemp(path.join(os.tmpdir(), "gg-mcp-home-"));
-    tmpProject = await fs.mkdtemp(path.join(os.tmpdir(), "gg-mcp-proj-"));
-    process.env.GG_TEST_HOME = tmpHome;
+    tmpHome = await fs.mkdtemp(path.join(os.tmpdir(), "ez-mcp-home-"));
+    tmpProject = await fs.mkdtemp(path.join(os.tmpdir(), "ez-mcp-proj-"));
+    process.env.EZ_TEST_HOME = tmpHome;
 });
 afterEach(async () => {
     await fs.rm(tmpHome, { recursive: true, force: true });
     await fs.rm(tmpProject, { recursive: true, force: true });
-    delete process.env.GG_TEST_HOME;
+    delete process.env.EZ_TEST_HOME;
 });
 describe("mcp store", () => {
     it("round-trips an http server in global scope", async () => {

package/dist/core/mcp/when-connected.test.js

@@ -7,7 +7,7 @@ import { McpCatalogCache } from "./catalog-cache.js";
 let dir;
 let manager;
 beforeEach(async () => {
-    dir = await fs.mkdtemp(path.join(os.tmpdir(), "gg-mcp-when-connected-"));
+    dir = await fs.mkdtemp(path.join(os.tmpdir(), "ez-mcp-when-connected-"));
     manager = new MCPClientManager({
         catalogCache: new McpCatalogCache(path.join(dir, "mcp-catalog.json")),
     });
@@ -19,7 +19,7 @@ afterEach(async () => {
 /** A stdio command that cannot possibly start, so the connect fails fast. */
 const BROKEN = {
     name: "broken",
-    command: "gg-nonexistent-mcp-binary",
+    command: "ez-nonexistent-mcp-binary",
     args: [],
     timeout: 2_000,
 };

package/dist/core/nolan-model.test.js

@@ -40,7 +40,7 @@ describe("effectiveNolanModel", () => {
             nolanModelOverride: true,
         });
     });
-    it("pin identical to the build model still reports override=true (it survives GG switches)", () => {
+    it("pin identical to the build model still reports override=true (it survives EZ switches)", () => {
         expect(effectiveNolanModel({ provider: "anthropic", model: "claude-opus-5" }, build)).toEqual({
             nolanProvider: "anthropic",
             nolanModel: "claude-opus-5",

package/dist/core/nolan-prompt.js

@@ -44,7 +44,7 @@ export async function buildNolanSystemPrompt(cwd) {
     return [
         renderIdentity(),
         renderEdge(),
-        renderGGCoderCapabilities(),
+        renderEZCoderCapabilities(),
         renderSkeptical(),
         renderTaste(),
         renderMethod(),
@@ -73,7 +73,7 @@ export async function buildNolanSystemPrompt(cwd) {
 export async function buildNolanAutopilotSystemPrompt(cwd) {
     return [
         renderIdentity(),
-        renderGGCoderCapabilities(),
+        renderEZCoderCapabilities(),
         renderSkeptical(),
         renderTaste(),
         renderMethod(),
@@ -123,7 +123,7 @@ function renderEdge() {
         `directly for the same result, you added nothing. Be the strategy, the ` +
         `skeptic, or the better-shaped ask.`);
 }
-function renderGGCoderCapabilities() {
+function renderEZCoderCapabilities() {
     return (`## What EZ Coder can do\n\n` +
         `You direct EZ Coder, so you have to know its reach. It is a full coding agent ` +
         `with these tools, and your prompts should assume them instead of making the ` +
@@ -195,7 +195,7 @@ function renderTaste() {
 }
 function renderMethod() {
     return (`## Method\n\n` +
-        `Modular and sequential. One thing at a time, each step small enough that GG ` +
+        `Modular and sequential. One thing at a time, each step small enough that EZ ` +
         `Coder can nail it and you can both confirm it works before the next.\n\n` +
         `Kill the "one prompt that does everything" mega-request on sight. For a whole ` +
         `feature, break it into a sequence and hand over the first step only, then the ` +
@@ -324,7 +324,7 @@ function renderContextNote() {
     return (`## Your context\n\n` +
         `Each turn you get a digest: what they're building, the story so far, and the ` +
         `recent EZ Coder and user activity. Read it, then answer the actual question. If ` +
-        `the digest misses something, use your read-only tools to go look. You see GG ` +
+        `the digest misses something, use your read-only tools to go look. You see EZ ` +
         `Coder's conversation; it never sees yours. You steer, it builds.`);
 }
 //# sourceMappingURL=nolan-prompt.js.map

package/dist/core/oauth/xai.d.ts

@@ -0,0 +1,2 @@
+export { loginXai, refreshXaiToken, grokCliBaseUrl, grokCliHeaders, isGrokCliEndpoint, } from "@prestyj/core";
+//# sourceMappingURL=xai.d.ts.map

package/dist/core/oauth/xai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xai.d.ts","sourceRoot":"","sources":["../../../src/core/oauth/xai.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,QAAQ,EACR,eAAe,EACf,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,eAAe,CAAC"}

package/dist/core/oauth/xai.js

@@ -0,0 +1,4 @@
+// Lives in @prestyj/core — re-exported here so ezcoder call sites import
+// Grok OAuth the same way they import the other providers.
+export { loginXai, refreshXaiToken, grokCliBaseUrl, grokCliHeaders, isGrokCliEndpoint, } from "@prestyj/core";
+//# sourceMappingURL=xai.js.map

package/dist/core/oauth/xai.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xai.js","sourceRoot":"","sources":["../../../src/core/oauth/xai.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,2DAA2D;AAC3D,OAAO,EACL,QAAQ,EACR,eAAe,EACf,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,eAAe,CAAC"}

package/dist/core/persistent-shell.js

@@ -76,7 +76,7 @@ export class PersistentShell {
         }
         this.busy = true;
         const child = this.ensureChild();
-        const sentinel = `__GG_PSH_${randomUUID()}__`;
+        const sentinel = `__EZ_PSH_${randomUUID()}__`;
         // `</dev/null` keeps stdin-reading commands (cat, read) from eating the
         // next sentinel line instead of hanging the session.
         const wrapped = `{ ${command}\n} </dev/null; echo "${sentinel}$?"\n`;

package/dist/core/persistent-shell.test.js

@@ -27,8 +27,8 @@ d("PersistentShell", () => {
     });
     it("persists cd and env vars across calls — the point of the feature", async () => {
         const sh = make();
-        await sh.run("cd / && export GG_PSH_TEST=alive", 10_000, signal());
-        const res = await sh.run('pwd; echo "$GG_PSH_TEST"', 10_000, signal());
+        await sh.run("cd / && export EZ_PSH_TEST=alive", 10_000, signal());
+        const res = await sh.run('pwd; echo "$EZ_PSH_TEST"', 10_000, signal());
         expect(res.output).toBe("/\nalive");
     });
     it("stdin-reading commands don't eat the sentinel or hang", async () => {
@@ -41,23 +41,23 @@ d("PersistentShell", () => {
     });
     it("timeout kills the session; the next call gets a fresh shell", async () => {
         const sh = make();
-        await sh.run("export GG_PSH_STATE=set", 10_000, signal());
+        await sh.run("export EZ_PSH_STATE=set", 10_000, signal());
         const timedOut = await sh.run("sleep 30", 300, signal());
         expect(timedOut.exitCode).toBe("TIMEOUT");
         // Fresh shell: the exported var from before the timeout is gone.
-        const res = await sh.run('echo "[$GG_PSH_STATE]"', 10_000, signal());
+        const res = await sh.run('echo "[$EZ_PSH_STATE]"', 10_000, signal());
         expect(res.output).toBe("[]");
     });
     it("over-cap output still finds the sentinel — no hang, session survives", async () => {
         shell = new PersistentShell(os.tmpdir(), { ...process.env, TERM: "dumb" }, 512);
         const sh = shell;
-        await sh.run("export GG_PSH_CAP=kept", 10_000, signal());
+        await sh.run("export EZ_PSH_CAP=kept", 10_000, signal());
         // ~40KB of output, way past the 512-byte cap.
         const res = await sh.run('yes x | head -n 20000; echo "end"', 10_000, signal());
         expect(res.exitCode).toBe(0);
         expect(res.output).toContain("[Output capped at 512 bytes]");
         // Session state survived — the command completed instead of timing out.
-        const after = await sh.run('echo "$GG_PSH_CAP"', 10_000, signal());
+        const after = await sh.run('echo "$EZ_PSH_CAP"', 10_000, signal());
         expect(after.output).toBe("kept");
     });
     it("does not leak error listeners across many runs", async () => {