@prestyj/cli 5.11.0 → 5.13.0

package/dist/app-sidecar.js

@@ -8,7 +8,7 @@
  *   POST /prompt   → { text } ; runs AgentSession.prompt(text)
  *   POST /cancel   → aborts the in-flight run
  *
- * The agent spine (gg-ai → gg-agent → gg-core) and every tool are reused
+ * The agent spine (@prestyj/ai → @prestyj/agent → @prestyj/core) and every tool are reused
  * unchanged via AgentSession — this file is only a network seam.
  */
 import http from "node:http";
@@ -39,14 +39,15 @@ import { sessionToMarkdown, defaultExportFilename, } from "./core/session-export
 import { AuthStorage } from "./core/auth-storage.js";
 import { cleanupToolOutputs } from "./tools/overflow.js";
 import { readCappedBody } from "./utils/http-body.js";
-import { fetchSubscriptionUsage, MOONSHOT_OAUTH_KEY, SubscriptionUsageError, XIAOMI_CREDITS_KEY, discoverLocalModels, findProbedModel, formatLocalModelId, parseLocalModelId, probeEndpoint, toModelInfo as localModelInfo, } from "@prestyj/core";
+import { fetchSubscriptionUsage, SubscriptionUsageError, XIAOMI_CREDITS_KEY, dualAuthProvider, oauthStorageKey, discoverLocalModels, findProbedModel, formatLocalModelId, parseLocalModelId, probeEndpoint, toModelInfo as localModelInfo, } from "@prestyj/core";
 import { LocalEndpointError, addCustomEndpoint, listAllEndpoints, removeCustomEndpoint, syncEndpointCredentials, } from "./core/local-endpoint-store.js";
 import { loginAnthropic } from "./core/oauth/anthropic.js";
 import { loginOpenAI } from "./core/oauth/openai.js";
 import { loginGemini } from "./core/oauth/gemini.js";
 import { loginKimi } from "./core/oauth/kimi.js";
-import { AUTH_PROVIDERS } from "./core/auth-providers.js";
-import { ensureAppDirs, loadSavedSettings } from "./config.js";
+import { loginXai } from "./core/oauth/xai.js";
+import { AUTH_PROVIDERS, authPriorityNote, describeAuthMethods, } from "./core/auth-providers.js";
+import { ensureAppDirs, loadSavedSettings, projectScopeAllowed } from "./config.js";
 import { SettingsManager } from "./core/settings-manager.js";
 import { installPlugin, listInstalledPlugins, removePlugin, } from "./core/extensions/plugin-bundles.js";
 import { getModel, getDefaultThinkingLevel, getContextWindow, getAllModels, clearRuntimeModels, registerRuntimeModels, } from "./core/model-registry.js";
@@ -61,6 +62,7 @@ import { discoverProjects } from "./core/project-discovery.js";
 import { listSidecarSessions } from "./app-sidecar-sessions.js";
 import { loadTasksSync, saveTasksSync, pruneDoneTasksSync, getNextPendingTask, markTaskInProgress, } from "./core/task-store.js";
 import { initLogger, log } from "./core/logger.js";
+import { installTerminationHandlers } from "./core/shutdown.js";
 import { RADIO_STATIONS, getCurrentStation, getRadioVolume, playRadio, setRadioVolume, stopRadio, } from "./core/radio.js";
 import { enrichProcessPath } from "./core/shell-path.js";
 import { downscaleForPreview, shrinkToFit, validateVisionImage } from "./utils/image.js";
@@ -386,27 +388,49 @@ function mcpRowSummary(config) {
 }
 /** Load + connect every server, returning one wire row per server. Mirrors the
  *  CLI dashboard's buildRows (connectAllDetailed, then dispose). Empty list
- *  short-circuits before spawning any stdio process / opening any HTTP conn. */
-async function buildMcpRows(cwd) {
+ *  short-circuits before spawning any stdio process / opening any HTTP conn.
+ *  Project-scope servers run repo-controlled commands, so unless the user
+ *  trusts them (trustProjectMcpServers) they are reported blocked WITHOUT
+ *  being connected — even a status probe would spawn the process. */
+async function buildMcpRows(cwd, settingsFile) {
     const scoped = await loadServers(cwd);
     if (scoped.length === 0)
         return [];
+    const settings = loadSavedSettings(settingsFile);
+    const allowProject = projectScopeAllowed(settings.trustProjectMcpServers, settings.trustedProjects, cwd);
+    const connectable = scoped.filter((s) => allowProject || s.scope !== "project");
+    const blocked = scoped.filter((s) => !allowProject && s.scope === "project");
     const manager = new MCPClientManager();
     try {
-        const results = await manager.connectAllDetailed(scoped.map((s) => s.config));
-        return scoped.map((s) => {
-            const result = results.find((r) => r.name === s.config.name);
-            return {
+        const results = connectable.length > 0
+            ? await manager.connectAllDetailed(connectable.map((s) => s.config))
+            : [];
+        return [
+            ...connectable.map((s) => {
+                const result = results.find((r) => r.name === s.config.name);
+                return {
+                    name: s.config.name,
+                    scope: s.scope,
+                    ok: result?.ok ?? false,
+                    toolCount: result?.toolCount ?? 0,
+                    error: result?.error,
+                    kind: s.config.url ? "http" : "stdio",
+                    summary: mcpRowSummary(s.config),
+                    requiresAuth: result?.requiresAuth,
+                };
+            }),
+            ...blocked.map((s) => ({
                 name: s.config.name,
                 scope: s.scope,
-                ok: result?.ok ?? false,
-                toolCount: result?.toolCount ?? 0,
-                error: result?.error,
-                kind: s.config.url ? "http" : "stdio",
+                ok: false,
+                toolCount: 0,
+                error: "Project-scope server not connected — this repo's .ezcoder/mcp.json runs " +
+                    "repo-controlled commands. Add or re-add a server in this project via " +
+                    "the MCP modal to trust it.",
+                kind: (s.config.url ? "http" : "stdio"),
                 summary: mcpRowSummary(s.config),
-                requiresAuth: result?.requiresAuth,
-            };
-        });
+            })),
+        ];
     }
     finally {
         await manager.dispose();
@@ -450,6 +474,8 @@ async function runJsonModeIfRequested() {
             model: { type: "string" },
             "max-turns": { type: "string" },
             "system-prompt": { type: "string" },
+            "agent-prompt": { type: "string" },
+            "agent-context": { type: "string" },
             tools: { type: "string" },
             "mcp-servers": { type: "string" },
             "prompt-cache-key": { type: "string" },
@@ -483,6 +509,8 @@ async function runJsonModeIfRequested() {
         model: values.model ?? "claude-opus-5",
         cwd: process.cwd(),
         systemPrompt: values["system-prompt"],
+        agentPrompt: values["agent-prompt"],
+        agentContext: values["agent-context"] === "none" ? "none" : undefined,
         maxTurns: maxTurnsRaw ? parseInt(maxTurnsRaw, 10) : undefined,
         allowedTools,
         allowedMcpServers,
@@ -504,9 +532,10 @@ function daemonReadBody(req, res) {
     return readCappedBody(req, res);
 }
 function daemonJson(res, status, body) {
+    // No CORS headers: only the Rust proxy (no Origin) should call this daemon.
+    // Granting origins would let any web page read responses from loopback.
     res.writeHead(status, {
         "content-type": "application/json",
-        "access-control-allow-origin": "*",
     });
     res.end(JSON.stringify(body));
 }
@@ -524,6 +553,13 @@ async function main() {
     // GG_APP_LISTENING handshake and consumed by the shell.
     const port = Number(process.env.GG_APP_PORT ?? 0);
     const host = "127.0.0.1";
+    // Per-launch bearer token. The Rust shell generates one and passes it via
+    // GG_APP_TOKEN; spawned any other way (dev, tests, smoke) we mint our own
+    // and report it on the GG_APP_LISTENING line. Every request must carry it
+    // as x-ez-token: this daemon creates sessions for arbitrary cwds, runs
+    // prompts, and installs plugins, so an unauthenticated loopback port lets
+    // any local process drive the agent as the user.
+    const authToken = process.env.GG_APP_TOKEN ?? randomUUID();
     const paths = await ensureAppDirs();
     // Own log file so the app sidecar never clobbers the interactive CLI's
     // ~/.ezcoder/debug.log (initLogger truncates on each start).
@@ -586,7 +622,7 @@ async function main() {
     await auth.load();
     // Every window's session lives here as an in-process object, keyed by the id
     // the daemon hands back from POST /session. The Rust shell routes each proxy
-    // request to its window's session via the `x-gg-session` header (and the
+    // request to its window's session via the `x-ez-session` header (and the
     // `?session=` query for the SSE /events stream).
     const sessions = new Map();
     /**
@@ -645,7 +681,7 @@ async function main() {
         const displayName = provider === "anthropic" ? "Anthropic" : provider === "openai" ? "Codex" : "Kimi";
         // Kimi plan usage is tracked on the OAuth credential specifically — the
         // Moonshot platform API key is metered per-token, not per plan window.
-        const authKey = provider === "moonshot" ? MOONSHOT_OAUTH_KEY : provider;
+        const authKey = oauthStorageKey(provider) ?? provider;
         if (!(await auth.hasProviderAuth(authKey))) {
             // Logged out: drop the replay cache so a later login on a DIFFERENT
             // account can never inherit the previous one's numbers.
@@ -666,7 +702,14 @@ async function main() {
                 // A provider can revoke an access token before its stored expiry. Refresh
                 // once on 401, matching inference auth recovery, then retry the usage call.
                 if (error instanceof SubscriptionUsageError && error.status === 401) {
-                    credentials = await auth.resolveCredentials(authKey, { forceRefresh: true });
+                    // Name the rejected token. This poller runs on a timer alongside live
+                    // agent runs, so an unconditional refresh here would invalidate the
+                    // token those runs are holding and fail them mid-turn — a background
+                    // status check must never be able to log out the foreground.
+                    credentials = await auth.resolveCredentials(authKey, {
+                        forceRefresh: true,
+                        rejectedToken: credentials.accessToken,
+                    });
                     const snapshot = {
                         ...(await fetchSubscriptionUsage(provider, credentials)),
                         connected: true,
@@ -751,10 +794,10 @@ async function main() {
                 usageRequests.delete(provider);
         }
     }
-    /** Resolve the target session id: the `x-gg-session` header, else a
+    /** Resolve the target session id: the `x-ez-session` header, else a
      *  `?session=` query param (used by the SSE /events connection). */
     function sessionIdFromReq(req, url) {
-        const header = req.headers["x-gg-session"];
+        const header = req.headers["x-ez-session"];
         if (typeof header === "string" && header.length > 0)
             return header;
         try {
@@ -767,16 +810,26 @@ async function main() {
     const server = http.createServer(wrapSidecarHandler((req, res) => {
         const url = req.url ?? "/";
         const method = req.method ?? "GET";
-        // CORS preflight — the webview origin differs from 127.0.0.1.
+        // Answer preflights with a bare 204 but grant NO origins — the webview
+        // reaches the daemon through the Rust proxy, never cross-origin, so any
+        // browser page's preflight must fail here.
         if (method === "OPTIONS") {
-            res.writeHead(204, {
-                "access-control-allow-origin": "*",
-                "access-control-allow-methods": "GET, POST, DELETE, OPTIONS",
-                "access-control-allow-headers": "content-type, x-gg-session",
-            });
+            res.writeHead(204);
             res.end();
             return;
         }
+        // Host allowlist. The daemon binds 127.0.0.1 only; rejecting any other
+        // Host blocks DNS rebinding, where a web page's request arrives with
+        // the attacker's hostname (browsers cannot spoof Host).
+        const reqHost = req.headers.host ?? "";
+        if (!/^(127\.0\.0\.1|localhost|\[::1\])(:\d+)?$/i.test(reqHost)) {
+            daemonJson(res, 403, { error: "forbidden host" });
+            return;
+        }
+        if (req.headers["x-ez-token"] !== authToken) {
+            daemonJson(res, 401, { error: "unauthorized" });
+            return;
+        }
         // ── Daemon-level routes (session lifecycle) ──────────────────────────
         // Create a session for a window: { mode?, cwd, sessionPath? } → { sessionId }.
         if (method === "POST" && url === "/session") {
@@ -874,28 +927,34 @@ async function main() {
     }, "app-sidecar.http"));
     server.listen(port, host, () => {
         const addr = server.address();
-        // The Rust shell reads this line to learn the daemon port.
-        process.stdout.write(`GG_APP_LISTENING ${addr.port}\n`);
+        // The Rust shell reads this line to learn the daemon port (it already
+        // knows the token — it set GG_APP_TOKEN; the field serves other spawners).
+        process.stdout.write(`GG_APP_LISTENING ${addr.port} ${authToken}\n`);
         log("INFO", "app-sidecar", "daemon listening", { port: String(addr.port), host });
     });
     const shellPid = process.ppid;
-    let shuttingDown = false;
-    async function shutdown() {
-        if (shuttingDown)
-            return;
-        shuttingDown = true;
-        clearInterval(parentWatch);
-        // Radio playback is app-wide (one stream across all windows), so it stops
-        // at the daemon level, not per session.
-        stopRadio();
-        // Close the ~/.ezcoder progress fs.watch handle (baseline #8 leak fix).
-        progress.dispose();
-        await Promise.all([...sessions.values()].map((c) => c.dispose().catch(() => { })));
-        server.close();
-        process.exit(0);
-    }
-    process.on("SIGINT", () => void shutdown());
-    process.on("SIGTERM", () => void shutdown());
+    // Session teardown awaits MCP servers, LSP servers and third-party extension
+    // `deactivate()` hooks. Any can hang, so a deadline guarantees process exit.
+    const shutdown = installTerminationHandlers({
+        scope: "app-sidecar",
+        teardown: async () => {
+            clearInterval(parentWatch);
+            // Radio playback is app-wide (one stream across all windows).
+            stopRadio();
+            // Close the ~/.ezcoder progress fs.watch handle.
+            progress.dispose();
+            await Promise.all([...sessions.values()].map((c) => c.dispose().catch(() => { })));
+            server.close();
+        },
+        onTimeout: (timeoutMs) => {
+            // Radio is audible, so it must stop even when the rest is wedged.
+            stopRadio();
+            log("WARN", "app-sidecar", "daemon teardown hung; exiting on deadline", {
+                timeoutMs: String(timeoutMs),
+                sessions: String(sessions.size),
+            });
+        },
+    });
     process.once("exit", stopRadio);
     // Tauri can disappear without delivering a signal (force-quit, dev runner
     // teardown, crash). Detect reparenting or a dead shell so the daemon and its
@@ -911,7 +970,7 @@ async function main() {
             }
         }
         if (!parentAlive)
-            void shutdown();
+            shutdown();
     }, 1_000);
     parentWatch.unref?.();
 }
@@ -1177,7 +1236,7 @@ async function createSession(deps, opts) {
             "Start it again and retry, or pick another model.");
     }
     // Turn any thrown value into the same clear headline/message/guidance shape
-    // the TUI shows (see gg-ai's formatError) instead of a bare `err.message`, log
+    // the TUI shows (see @prestyj/ai's formatError) instead of a bare `err.message`, log
     // the full detail, and broadcast it under `type` ("error" or "nolan_error").
     // Without this the webview only ever saw a raw provider string like
     // `400 {"code":"400",...}` with no "is this me or them / when does it reset"
@@ -1587,6 +1646,12 @@ async function createSession(deps, opts) {
             durationMs: String(d.durationMs),
             isError: String(d.isError),
             ...(d.isError ? { result: d.result.slice(0, 500) } : {}),
+            // Consecutive-failure count for schema rejections. Attempt 1 followed by
+            // a success means the model self-corrected; reaching 3 means it looped
+            // and the turn was ended. Grep this to tell the two apart.
+            ...(d.invalidArgAttempt === undefined
+                ? {}
+                : { invalidArgAttempt: String(d.invalidArgAttempt) }),
         });
         broadcast("tool_call_end", d);
         // The agent can add/done/remove project tasks via the `tasks` tool during a
@@ -1610,12 +1675,25 @@ async function createSession(deps, opts) {
     session.eventBus.on("agent_done", (d) => broadcast("agent_done", d));
     // Non-clean stop (max_tokens/refusal/provider error) — info-style frame so
     // the webview can warn instead of presenting truncated output as complete.
-    session.eventBus.on("truncated", (d) => broadcast("truncated", d));
+    // empty_response is a hard failure (no output at all): route it through
+    // broadcastError so the app renders an error row — the webview does not
+    // render bare "truncated" frames.
+    session.eventBus.on("truncated", (d) => {
+        if (d.reason === "empty_response") {
+            broadcastError("error", "empty response", new Error("The model returned an empty response after retries — try sending again."));
+            return;
+        }
+        broadcast("truncated", d);
+    });
     session.eventBus.on("error", (d) => {
         broadcastError("error", "agent error", d.error);
     });
     session.eventBus.on("model_change", (d) => broadcast("model_change", d));
     session.eventBus.on("hook", (d) => broadcast("hook", d));
+    // Fires BEFORE the candidate final answer streams. The webview holds assistant
+    // text back while armed, so an Ideal review supersedes a draft that was never
+    // painted instead of deleting one the user already started reading.
+    session.eventBus.on("hook_armed", (d) => broadcast("hook_armed", d));
     session.eventBus.on("subagent_state", (d) => broadcast("subagent_state", d));
     session.eventBus.on("compaction_start", (d) => broadcast("compaction_start", d));
     session.eventBus.on("compaction_end", (d) => broadcast("compaction_end", d));
@@ -2372,10 +2450,52 @@ async function createSession(deps, opts) {
         // Native (Rust) writes to auth.json bypass this daemon's cache; re-read so
         // the reported connection state matches what's actually on disk.
         await auth.reload();
-        const providers = await Promise.all(AUTH_PROVIDERS.map(async (p) => ({
-            ...p,
-            connected: await auth.hasProviderAuth(p.value),
-        })));
+        const providers = await Promise.all(AUTH_PROVIDERS.map(async (p) => {
+            const dual = dualAuthProvider(p.value);
+            // Which methods hold a credential right now. Dual-auth providers can hold
+            // both at once, and the app needs them separately: one "connected" bit
+            // cannot express "OAuth signed in, key also on file as backup", nor offer
+            // a per-method disconnect.
+            const oauthKey = dual?.oauthKey;
+            const hasOAuth = oauthKey ? await auth.hasCredentials(oauthKey) : false;
+            const apiKeyKeys = p.apiKeyVariants?.map((v) => v.key) ?? [p.value];
+            const hasApiKey = p.methods.includes("apikey")
+                ? (await Promise.all(apiKeyKeys.map((k) => auth.hasCredentials(k)))).some(Boolean)
+                : false;
+            const connectedMethods = [];
+            // OAuth-only providers (Anthropic/OpenAI/Gemini) store under the provider
+            // id itself, so `hasProviderAuth` is what proves their OAuth connection.
+            if (p.methods.includes("oauth") &&
+                (hasOAuth || (!dual && (await auth.hasCredentials(p.value)))))
+                connectedMethods.push("oauth");
+            if (hasApiKey)
+                connectedMethods.push("apikey");
+            // Which one a request would actually use, mirroring AuthStorage's
+            // resolution: OAuth wins unless its usage window is exhausted AND a key
+            // is configured to cover it.
+            const exhaustedUntil = oauthKey
+                ? ((await auth.getCredentials(oauthKey))?.usageExhaustedUntil ?? 0)
+                : 0;
+            const oauthSidelined = hasOAuth && Date.now() < exhaustedUntil && hasApiKey;
+            const activeMethod = connectedMethods.includes("oauth")
+                ? oauthSidelined
+                    ? "apikey"
+                    : "oauth"
+                : connectedMethods[0];
+            // `methodDetails` is the server-side lookup table behind
+            // `methodGuidance` — shipping both would duplicate every string on the
+            // wire for no consumer.
+            const { methodDetails: _table, ...wireMeta } = p;
+            return {
+                ...wireMeta,
+                connected: await auth.hasProviderAuth(p.value),
+                connectedMethods,
+                ...(activeMethod ? { activeMethod } : {}),
+                ...(oauthSidelined ? { oauthExhaustedUntil: exhaustedUntil } : {}),
+                ...(authPriorityNote(p.value) ? { priorityNote: authPriorityNote(p.value) } : {}),
+                methodGuidance: describeAuthMethods(p.value),
+            };
+        }));
         return { providers };
     }
     // Background tasks have no event source (the bash tool just spawns them), so
@@ -2448,7 +2568,6 @@ async function createSession(deps, opts) {
         const payload = JSON.stringify(redactValue(body, { secrets: environmentSecrets(process.env) }));
         res.writeHead(status, {
             "content-type": "application/json",
-            "access-control-allow-origin": "*",
         });
         res.end(payload);
     }
@@ -2533,7 +2652,6 @@ async function createSession(deps, opts) {
                 "content-type": "text/event-stream",
                 "cache-control": "no-cache",
                 connection: "keep-alive",
-                "access-control-allow-origin": "*",
             });
             res.write(`retry: 1000\n\n`);
             const client = { id: ++clientSeq, res };
@@ -3299,7 +3417,7 @@ async function createSession(deps, opts) {
                 });
                 // After the user's run settles, kick off Nolan's auto-review loop — but
                 // only when the turn is actually reviewable (shouldStartAutopilotCycle):
-                // workflow commands (/compare, /bullet-proof, …) end with reports or
+                // workflow commands (/compare, /expand, …) end with reports or
                 // A/B/C choices reserved for the USER; registry commands (/help) and
                 // failed runs add no assistant work to judge; a turn that ended in plan
                 // mode has a pending Accept/Reject modal Nolan must not preempt. This is
@@ -4163,9 +4281,11 @@ async function createSession(deps, opts) {
                             creds = await loginOpenAI(cb);
                         else if (provider === "gemini")
                             creds = await loginGemini(cb);
-                        else if (provider === "moonshot") {
-                            creds = await loginKimi(cb);
-                            storageKey = MOONSHOT_OAUTH_KEY;
+                        else if (provider === "moonshot" || provider === "xai") {
+                            // Subscription OAuth (Kimi plan / SuperGrok-X Premium) stores under
+                            // a distinct key so it can coexist with the provider's API key.
+                            creds = provider === "moonshot" ? await loginKimi(cb) : await loginXai(cb);
+                            storageKey = dualAuthProvider(provider).oauthKey;
                         }
                         else {
                             throw new Error(`OAuth not implemented for ${provider}`);
@@ -4258,22 +4378,34 @@ async function createSession(deps, opts) {
                 if (raw === null)
                     return;
                 let provider;
+                let logoutMethod;
                 try {
-                    provider = JSON.parse(raw).provider ?? "";
+                    const body = JSON.parse(raw);
+                    provider = body.provider ?? "";
+                    logoutMethod =
+                        body.method === "oauth" || body.method === "apikey" ? body.method : undefined;
                 }
                 catch {
                     json(res, 400, { error: "invalid JSON body" });
                     return;
                 }
-                await auth.clearCredentials(provider);
-                // Moonshot's OAuth credential lives under a distinct key — clear both so
-                // "disconnect" fully removes Kimi OAuth and the API key.
-                if (provider === "moonshot")
-                    await auth.clearCredentials(MOONSHOT_OAUTH_KEY);
-                // Xiaomi's API Credits credential lives under a distinct key — clear it
-                // too so "disconnect" fully removes both the Token Plan and Credits keys.
-                if (provider === "xiaomi")
-                    await auth.clearCredentials(XIAOMI_CREDITS_KEY);
+                const dual = dualAuthProvider(provider);
+                // A dual-auth provider can be disconnected one method at a time: dropping
+                // a spent API key should not sign the user out of their subscription, and
+                // vice versa. Omitting `method` still clears everything (the plain
+                // "Disconnect" action).
+                if (logoutMethod !== "apikey") {
+                    await auth.clearCredentials(dual ? dual.oauthKey : provider);
+                }
+                if (logoutMethod !== "oauth") {
+                    // Non-dual providers store their only credential under the provider id,
+                    // so this covers both them and a dual provider's API key.
+                    await auth.clearCredentials(provider);
+                    // Xiaomi's API Credits credential lives under a distinct key — clear it
+                    // too so "disconnect" fully removes both the Token Plan and Credits keys.
+                    if (provider === "xiaomi")
+                        await auth.clearCredentials(XIAOMI_CREDITS_KEY);
+                }
                 broadcast("auth_done", { provider });
                 json(res, 200, { ok: true });
             });
@@ -4467,7 +4599,7 @@ async function createSession(deps, opts) {
         // scope ignores it (always ~/.ezcoder/mcp.json).
         if (method === "GET" && (url === "/mcp" || url.startsWith("/mcp?"))) {
             const targetCwd = new URL(url, `http://${host}`).searchParams.get("cwd") ?? cwd;
-            void buildMcpRows(targetCwd)
+            void buildMcpRows(targetCwd, paths.settingsFile)
                 .then((servers) => json(res, 200, { servers }))
                 .catch((err) => {
                 captureSidecarError(err, "app-sidecar.mcp.list");
@@ -4519,6 +4651,12 @@ async function createSession(deps, opts) {
                         json(res, 400, { error: saved.error });
                         return;
                     }
+                    // Adding a project-scope server is an explicit trust signal — the
+                    // user chose to put a server in this repo's .ezcoder/mcp.json. Auto-trust
+                    // the project so all project-scope servers connect on next load.
+                    if (scope === "project") {
+                        await session.trustProject(targetCwd);
+                    }
                     json(res, 200, {
                         ok: true,
                         name: config.name,