@prestyj/cli 5.12.0 → 5.16.0

package/dist/core/agent-session.js

@@ -26,7 +26,8 @@ import { buildSubAgentCompletionFollowUp } from "./subagent-manager.js";
 import { applyAsyncSubagentPolicy } from "./subagent-policy.js";
 import { z } from "zod";
 import { MCPClientManager, getAllMcpServers } from "./mcp/index.js";
-import { DeferredToolCatalog } from "./mcp/deferred-catalog.js";
+import { clampMcpToolDescription, DeferredToolCatalog } from "./mcp/deferred-catalog.js";
+import { CONTEXT_LIMITS, resolveContextLimits } from "./context-limits.js";
 import { McpCatalogCache } from "./mcp/catalog-cache.js";
 import { describeDropped, importForeignSession, } from "./foreign-session-import.js";
 import { createToolSearchTool } from "../tools/tool-search.js";
@@ -41,8 +42,10 @@ import { detectProjectStack } from "./language-detector.js";
 import { evaluateIdealReview, buildIdealReviewMessage, buildReviewCoverageEscalationMessage, buildReviewCoverageMessage, MAX_REVIEW_COVERAGE_INJECTIONS, withReviewCoverageRequirements, detectTestDrift, ReviewCoverageTracker, } from "./ideal-review.js";
 import { evaluateLoopBreak, buildLoopBreakMessage, CycleDetector, ToolCallProgressTracker, detectTextRepetition, } from "./loop-breaker.js";
 import { buildRegroundingMessage } from "./regrounding.js";
+import { buildEnvDeltaMessage } from "./env-delta.js";
 import { wrapSteeringText, buildNotificationSteeringText, STEERING_PREFIX } from "./steering.js";
 import { AgentNotificationQueue } from "./agent-notifications.js";
+import { VerificationGate, extractAddedLines, isCheckOwnFile, isCodeFilePath, isVerificationCommand, } from "./verification-gate.js";
 import { findUserSessionPrompt, getUserSessionPrompt } from "./session-preview.js";
 import { normalizeMessageImages } from "./message-images.js";
 import crypto from "node:crypto";
@@ -140,16 +143,35 @@ export class AgentSession {
     idealReviewPhase = "idle";
     /** Runtime-only suppression while Nolan owns verification in autopilot mode. */
     idealReviewSuppressed = false;
+    /** Mirror of the last `hook_armed` value broadcast this run, so the event
+     *  fires only on a real edge. */
+    idealReviewArmed = false;
+    /** Cached test-drift probe, keyed by the size of the edited-file set. Drift
+     *  depends only on WHICH files were edited and that set only grows, so this
+     *  keeps the arming check off the filesystem on most tool results — the probe
+     *  is several sync existsSync calls per edited file. */
+    idealDriftProbe = null;
     reviewCoverage;
     /** Coverage follow-ups spent this run, capped by MAX_REVIEW_COVERAGE_INJECTIONS. */
     reviewCoverageInjected = 0;
     /** 0 = none; 1 = first nudge sent; 2 = final stop-and-report injected. */
     loopBreakInjected = 0;
     regroundingInjected = false;
+    /**
+     * The environment as the cached system prompt currently describes it.
+     * Re-recorded on every prompt build, so a rebuild (e.g. `/add-dir`) needs no
+     * delta; anything that changes WITHOUT one is caught by the hook below.
+     */
+    renderedEnvironment = {};
     /** Wall-clock start of the current run; scopes the background-process gate. */
     runStartedAt = 0;
     /** Gate injections spent this run, capped by MAX_PROCESS_GATE_INJECTIONS. */
     processGateInjected = 0;
+    /** Verification gate: code edited this run, nothing proved it since. */
+    verificationGate = new VerificationGate();
+    /** Mirror of the last verification `hook_armed` value, so the event fires
+     *  only on a real edge. */
+    verificationArmed = false;
     compactionOccurred = false;
     lastCompactionCompacted = false;
     compactionRetryAfter = 0;
@@ -184,6 +206,8 @@ export class AgentSession {
     mcpManager;
     /** Deferred MCP tools awaiting discovery via tool_search. */
     mcpCatalog;
+    /** Resolved prompt-injection byte budgets (contextLimits setting). */
+    contextLimits = CONTEXT_LIMITS;
     /**
      * Built-in tools held in the catalog instead of the live toolset. Their names
      * still render as one-line hints in the prompt's Tools section, so the model
@@ -294,6 +318,7 @@ export class AgentSession {
         // Load settings & auth
         this.settingsManager = new SettingsManager(paths.settingsFile);
         await this.settingsManager.load();
+        this.contextLimits = resolveContextLimits(this.settingsManager.get("contextLimits"));
         this.authStorage = new AuthStorage(paths.authFile);
         await this.authStorage.load();
         // Session manager. Agent-specific roots keep chat and coder histories isolated.
@@ -326,6 +351,7 @@ export class AgentSession {
         const { tools: builtInTools, processManager, rebuildReadTool, lspManager, subAgentManager, } = await createTools(this.cwd, {
             agents,
             skills: this.skills,
+            contextLimits: this.contextLimits,
             provider: this.provider,
             model: this.model,
             lspDiagnostics: this.settingsManager.get("lspDiagnostics"),
@@ -348,6 +374,7 @@ export class AgentSession {
                 // tool agree on which roots are writable.
                 additionalRoots: this.additionalRoots,
                 allowOutsideWorkspaceWrites: this.settingsManager.get("allowOutsideWorkspaceWrites"),
+                allowUnixSockets: this.settingsManager.get("sandboxAllowUnixSockets"),
             }),
             getUseExternalGrep: () => this.settingsManager.get("grepUseRipgrep"),
             authStorage: this.authStorage,
@@ -399,7 +426,7 @@ export class AgentSession {
                 // sits inside the cached prefix stays byte-stable across turns.
                 this.tools = core;
                 this.deferredBuiltinToolNames = deferred.map((t) => t.name);
-                this.mcpCatalog ??= new DeferredToolCatalog();
+                this.mcpCatalog ??= new DeferredToolCatalog(this.contextLimits);
                 this.mcpCatalog.add(deferred);
                 this.ensureToolSearchTool();
             }
@@ -522,7 +549,7 @@ export class AgentSession {
      * everything passes (default behavior). Otherwise a tool is allowed when its
      * name is in `allowedTools`, OR it's an MCP tool (`mcp__<server>__<tool>`)
      * whose `<server>` is in `allowedMcpServers`. The MCP-prefix rule lets a
-     * whitelisted research server (e.g. kencode-search) expose all its tools
+     * whitelisted research server expose all its tools
      * without hard-coding each one, while every other tool stays blocked.
      */
     isToolAllowed(name) {
@@ -552,8 +579,7 @@ export class AgentSession {
             return;
         // Allow-listed (read-only advisory) sessions enforce a fixed tool set by
         // name. An MCP server is only connected when its name is explicitly
-        // whitelisted via `allowedMcpServers` (the Nolan mentor agent does this for
-        // `kencode-search` so it can research real code). With no whitelist, skip
+        // whitelisted via `allowedMcpServers`. With no whitelist, skip
         // MCP entirely — dynamic `mcp__server__tool` names could never match a fixed
         // allow-list, and connecting would waste resources spawning stdio servers.
         const mcpWhitelist = this.opts.allowedMcpServers;
@@ -570,7 +596,9 @@ export class AgentSession {
                     // GLM not configured — skip Z.AI MCP servers
                 }
             }
-            let servers = await getAllMcpServers(this.provider, apiKey, this.cwd);
+            let servers = await getAllMcpServers(this.provider, apiKey, this.cwd, {
+                allowProjectScope: this.settingsManager.isProjectTrusted(this.cwd),
+            });
             // Whitelisted allow-listed session: connect ONLY the named servers, never
             // the user's full configured set (which could include mutating tools). The
             // whitelist only restricts in allow-list mode (the documented contract) so
@@ -601,11 +629,21 @@ export class AgentSession {
             if (this.opts.backgroundMcpConnect && mcpTools.length > 0) {
                 await this.rebuildSystemPromptInPlace();
             }
+            // Detect project-scope servers excluded because the repo isn't trusted,
+            // so the host can offer a per-repo "Trust" button. Computed after the
+            // connect so the blocked list reflects the same connect attempt.
         }
         catch (err) {
             log("WARN", "mcp", `MCP initialization failed: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
+    /** Persist `cwd` as a trusted project for project-scope MCP. Called by the
+     *  sidecar's `/mcp/add` handler when a user adds a project-scope server via
+     *  the MCP modal — the explicit add is itself the trust signal. The next
+     *  session load connects its `.ezcoder/mcp.json` servers. */
+    async trustProject(cwd) {
+        await this.settingsManager.trustProject(cwd);
+    }
     /**
      * Route freshly connected MCP tools: deferred into the tool_search catalog
      * (default — keeps ~8k tokens of schema out of every cache-miss turn) or
@@ -624,10 +662,11 @@ export class AgentSession {
         }
         const defer = !this.opts.allowedTools && this.settingsManager.get("deferredMcpTools");
         if (!defer) {
-            this.replaceOrPushTools(mcpTools);
+            // Eager path bypasses the catalog, so budget descriptions here too.
+            this.replaceOrPushTools(mcpTools.map((tool) => clampMcpToolDescription(tool, this.contextLimits)));
             return;
         }
-        this.mcpCatalog ??= new DeferredToolCatalog();
+        this.mcpCatalog ??= new DeferredToolCatalog(this.contextLimits);
         // `add` is name-keyed, so live definitions replace cached stubs in place.
         this.mcpCatalog.add(mcpTools);
         // A stub the model already promoted lives in `this.tools`; swap it for the
@@ -645,7 +684,7 @@ export class AgentSession {
      * registration on an existing catalog would leave those tools unreachable.
      */
     ensureToolSearchTool() {
-        this.mcpCatalog ??= new DeferredToolCatalog();
+        this.mcpCatalog ??= new DeferredToolCatalog(this.contextLimits);
         if (this.tools.some((t) => t.name === "tool_search"))
             return;
         this.tools.push(createToolSearchTool(this.mcpCatalog, (promoted) => {
@@ -663,7 +702,7 @@ export class AgentSession {
             return outcome.ok
                 ? { serverName, ok: true }
                 : { serverName, ok: false, error: outcome.error };
-        }));
+        }, this.contextLimits));
     }
     /** Append tools, replacing any same-named entry (cached stub → live tool). */
     replaceOrPushTools(tools) {
@@ -721,7 +760,7 @@ export class AgentSession {
     }
     /** Catalog-only registration for cached stubs — never marks them live. */
     addCachedMcpTools(stubs) {
-        this.mcpCatalog ??= new DeferredToolCatalog();
+        this.mcpCatalog ??= new DeferredToolCatalog(this.contextLimits);
         this.mcpCatalog.add(stubs);
         this.ensureToolSearchTool();
     }
@@ -859,12 +898,28 @@ export class AgentSession {
     buildAttachmentParts(text, attachments) {
         const parts = [];
         const fileNotes = [];
-        const modelSupportsVideo = getModel(this.model)?.supportsVideo ?? false;
+        const modelInfo = getModel(this.model);
+        const modelSupportsVideo = modelInfo?.supportsVideo ?? false;
+        // GLM only: GLM models have no native image input, but the GLM session is
+        // the only one with the zai_vision MCP server connected (core/mcp/defaults.ts).
+        // Point at the real tool instead of an inline image the provider layer would
+        // blank into a placeholder. Every other provider keeps inline images.
+        const glmImageHint = this.provider === "glm" && modelInfo?.supportsImages === false;
         for (const a of attachments) {
             if (a.kind === "image") {
-                parts.push({ type: "image", mediaType: a.mediaType, data: a.data });
-                if (a.path) {
-                    parts.push({ type: "text", text: `[Image saved at ${a.path}]` });
+                if (glmImageHint && a.path) {
+                    parts.push({
+                        type: "text",
+                        text: `[User attached an image saved at: ${a.path} — analyze it with the ` +
+                            `mcp__zai_vision__analyze_image tool (if that tool is not available yet, ` +
+                            `call tool_search with "analyze image" to unlock it first, then call it with image_source=${a.path})]`,
+                    });
+                }
+                else {
+                    parts.push({ type: "image", mediaType: a.mediaType, data: a.data });
+                    if (a.path) {
+                        parts.push({ type: "text", text: `[Image saved at ${a.path}]` });
+                    }
                 }
             }
             else if (a.kind === "video") {
@@ -936,10 +991,15 @@ export class AgentSession {
         this.reviewCoverage.reset();
         this.reviewCoverageInjected = 0;
         this.idealReviewPhase = "idle";
+        // No event here: clients reset their own hold on run_start.
+        this.idealReviewArmed = false;
+        this.verificationArmed = false;
+        this.idealDriftProbe = null;
         this.loopBreakInjected = 0;
         this.regroundingInjected = false;
         this.runStartedAt = Date.now();
         this.processGateInjected = 0;
+        this.verificationGate.reset();
         this.compactionOccurred = false;
         this.originalRequest = originalRequest;
     }
@@ -978,10 +1038,48 @@ export class AgentSession {
                     const removed = (diff.match(/^-[^-]/gm) ?? []).length;
                     this.hookStats.changedLines += added + removed;
                 }
+                // Verification-gate bookkeeping: successful code mutations and completed
+                // foreground verification commands, in occurrence order.
+                if (!event.isError && args) {
+                    if (name === "edit" || name === "write") {
+                        const filePath = String(args.file_path ?? "");
+                        // Check-owning files (tsconfig.json, pytest.ini, vitest.config.ts …)
+                        // are tracked even when they are not source code: editing one is how
+                        // a red suite is turned green without fixing anything.
+                        if (filePath && (isCodeFilePath(filePath) || isCheckOwnFile(filePath))) {
+                            const addedText = name === "write"
+                                ? String(args.content ?? "")
+                                : extractAddedLines(event.details?.diff ?? event.result);
+                            this.verificationGate.recordMutation(filePath, addedText);
+                        }
+                    }
+                    if (name === "bash" &&
+                        !args.run_in_background &&
+                        isVerificationCommand(String(args.command ?? ""))) {
+                        this.verificationGate.recordVerification();
+                    }
+                    // Reading the final output of an EXITED background verification run
+                    // counts: the process gate forces this read anyway, so without it the
+                    // gate would demand a redundant foreground re-run of tests the agent
+                    // already watched finish.
+                    if (name === "task_output") {
+                        const proc = this.processManager
+                            ?.list()
+                            .find((p) => p.id === args.id);
+                        if (proc && proc.exitCode !== null && isVerificationCommand(proc.command)) {
+                            this.verificationGate.recordVerification();
+                        }
+                    }
+                }
+                // Tool results are what push the run over the review gate, and they all
+                // land before the model writes its candidate final answer — so this is
+                // the point where arming still beats the draft's first token.
+                this.refreshHookArming();
                 break;
             }
             case "turn_end":
                 this.hookStats.turns = event.turn;
+                this.refreshHookArming();
                 for (let index = this.messages.length - 1; index >= 0; index--) {
                     const anchor = this.messages[index];
                     if (anchor?.role === "assistant") {
@@ -1036,6 +1134,24 @@ export class AgentSession {
      * Mirrors the TUI's getSteeringMessages ordering.
      */
     getHookSteeringMessages() {
+        // Environment drift: settings can move the network allowlist mid-session,
+        // and `/add-dir` can widen the workspace, with no prompt rebuild — leaving
+        // the cached Environment section describing facts that are no longer real.
+        // Correcting it by appending is ~30 tokens; re-rendering the prompt would
+        // invalidate every cached byte from that section onward. Unconditional and
+        // cheap: identical facts produce no message at all.
+        //
+        // This runs for a verbatim custom prompt TOO. Those sessions (Nolan's) never
+        // rebuild their prompt, so this note is the only channel that can tell them
+        // a root was added — skipping it meant Nolan could write into a folder it had
+        // never been told about. The note states the facts outright rather than
+        // referring to a section such a prompt does not have.
+        const environmentDelta = buildEnvDeltaMessage(this.renderedEnvironment, this.promptEnvironment());
+        if (environmentDelta) {
+            // The model has now been told; only a further change re-triggers this.
+            this.renderedEnvironment = this.promptEnvironment();
+            log("INFO", "session", "Injecting an environment update the prompt is too stale to show");
+        }
         // Push notifications: a child that finished or a background build that
         // exited is new *fact*, not a correction, and it is cheap (bounded to 1 KiB
         // per drain). Drained above the loop-break checks so the agent can act on
@@ -1087,10 +1203,18 @@ export class AgentSession {
                 ];
                 return { role: "user", content: parts, provenance };
             });
-            return notificationMessage ? [...steeringMessages, notificationMessage] : steeringMessages;
+            return [
+                ...(environmentDelta ? [environmentDelta] : []),
+                ...steeringMessages,
+                ...(notificationMessage ? [notificationMessage] : []),
+            ];
+        }
+        if (environmentDelta || notificationMessage) {
+            return [
+                ...(environmentDelta ? [environmentDelta] : []),
+                ...(notificationMessage ? [notificationMessage] : []),
+            ];
         }
-        if (notificationMessage)
-            return [notificationMessage];
         if (this.opts.selfCorrectionHooks === false)
             return null;
         if (!this.settingsManager.get("idealReviewEnabled"))
@@ -1165,6 +1289,86 @@ export class AgentSession {
         });
         return granted;
     }
+    /**
+     * Would the stop AFTER the current turn inject the Ideal review? Same inputs
+     * as the pre-stop gate below, evaluated early so clients know a candidate
+     * final answer is a review draft BEFORE it streams.
+     *
+     * The turn count is looked ahead by one on purpose. `hookStats.turns` only
+     * advances at `turn_end`, so while the model is writing the draft the counter
+     * still reads the PREVIOUS turn; the real gate sees one more. Without the
+     * lookahead a run sitting on score 3 crosses to 4 on the draft's own
+     * `turn_end` — after the text already streamed — which is precisely the
+     * appear-then-vanish flash. Over-arming by one turn point costs only live
+     * token streaming on a final answer that then shows whole; under-arming costs
+     * the flash, so this errs toward arming.
+     */
+    wouldInjectIdealReview() {
+        if (this.opts.selfCorrectionHooks === false || this.idealReviewSuppressed)
+            return false;
+        // Mid-review a stop still injects: the coverage follow-up while files are
+        // unread, or its escalation once the budget is spent. Both make the model
+        // answer again, so the candidate answer is a draft exactly as it is before
+        // the review starts — without arming here it paints and the reviewed answer
+        // lands under it as a duplicate.
+        if (this.idealReviewPhase === "reviewing") {
+            return this.reviewCoverage.evidence().missing.length > 0;
+        }
+        if (this.idealReviewPhase !== "idle")
+            return false;
+        if (!this.settingsManager.get("idealReviewEnabled"))
+            return false;
+        if (evaluateIdealReview({ ...this.hookStats, turns: this.hookStats.turns + 1 }).shouldReview) {
+            return true;
+        }
+        const files = this.hookFileEditCounts.size;
+        if (files === 0)
+            return false;
+        if (this.idealDriftProbe?.files !== files) {
+            this.idealDriftProbe = {
+                files,
+                drifted: detectTestDrift(this.hookFileEditCounts.keys(), this.cwd).length > 0,
+            };
+        }
+        return this.idealDriftProbe.drifted;
+    }
+    /** Would a stop right now inject the verification gate? Same conditions as
+     *  the pre-stop branch below, so arming and injection cannot disagree. */
+    wouldInjectVerification() {
+        if (this.opts.selfCorrectionHooks === false)
+            return false;
+        if (!this.settingsManager.get("verificationGateEnabled"))
+            return false;
+        if (this.opts.allowedTools && !this.opts.allowedTools.includes("bash"))
+            return false;
+        return this.verificationGate.willInject();
+    }
+    /** Broadcast pre-final hook arming on change. Both edges matter: armed=false
+     *  after the hook fires is what lets a client stream the REVIEWED final
+     *  answer live again.
+     *
+     *  Callable before `initialize()`: the sidecar sets Nolan's review suppression
+     *  on a freshly constructed session, and every arming predicate below reads
+     *  settings that `initialize()` has not loaded yet. Nothing can be armed
+     *  before the session can run a turn, and the first `tool_result`/`turn_end`
+     *  recomputes both edges — so skipping is the correct answer, not a patch. */
+    refreshHookArming() {
+        if (!this.settingsManager)
+            return;
+        this.refreshIdealReviewArmed();
+        const armed = this.wouldInjectVerification();
+        if (armed === this.verificationArmed)
+            return;
+        this.verificationArmed = armed;
+        this.eventBus.emit("hook_armed", { kind: "verification", armed });
+    }
+    refreshIdealReviewArmed() {
+        const armed = this.wouldInjectIdealReview();
+        if (armed === this.idealReviewArmed)
+            return;
+        this.idealReviewArmed = armed;
+        this.eventBus.emit("hook_armed", { kind: "ideal", armed });
+    }
     /**
      * Pre-stop Ideal review phase machine. Once review starts, completion is
      * blocked until harness-owned post-injection reads cover every changed file.
@@ -1184,6 +1388,23 @@ export class AgentSession {
             });
             return processFollowUp;
         }
+        // Verification gate: code was edited but nothing verified since the last
+        // edit. Above the Ideal review so checks RUN before the read-based review
+        // starts; off for allow-listed sessions that cannot run commands at all.
+        if (this.opts.selfCorrectionHooks !== false &&
+            this.settingsManager.get("verificationGateEnabled") &&
+            (!this.opts.allowedTools || this.opts.allowedTools.includes("bash"))) {
+            const verificationFollowUp = this.verificationGate.followUp();
+            if (verificationFollowUp) {
+                log("INFO", "verification-gate", "Injecting verification follow-up", {});
+                // Announce, THEN disarm: clients release held text on disarm, so the
+                // reverse order paints the draft and immediately deletes it — the exact
+                // flash arming exists to prevent.
+                this.eventBus.emit("hook", { kind: "verification" });
+                this.refreshHookArming();
+                return verificationFollowUp;
+            }
+        }
         if (this.opts.selfCorrectionHooks === false || this.idealReviewSuppressed)
             return null;
         if (this.idealReviewPhase === "reviewing") {
@@ -1196,8 +1417,20 @@ export class AgentSession {
                 lspMissing: lspEvidence.missing,
             });
             if (coverage.missing.length > 0) {
+                // Announce like any other pre-final injection: this follow-up makes the
+                // model answer again, so the answer it interrupts is a draft and the
+                // hook event is what tells clients to discard it. Injecting silently is
+                // what let the pre-coverage answer paint above the reviewed one.
+                this.eventBus.emit("hook", {
+                    kind: "ideal",
+                    coverageExpected: coverage.expected,
+                    coverageMissing: coverage.missing,
+                });
                 if (this.reviewCoverageInjected < MAX_REVIEW_COVERAGE_INJECTIONS) {
                     this.reviewCoverageInjected += 1;
+                    // Stays armed (coverage is still outstanding) — this call is here so a
+                    // client that missed the earlier edge is armed before the next draft.
+                    this.refreshIdealReviewArmed();
                     return [
                         this.withReviewLspEvidence(buildReviewCoverageMessage(coverage.missing), lspEvidence),
                     ];
@@ -1205,6 +1438,9 @@ export class AgentSession {
                 // Budget spent: close the gate so the run cannot spin on a file that
                 // never becomes readable, and require the gap be reported to the user.
                 this.idealReviewPhase = "complete";
+                // The gate is shut, so this is the real disarm: the answer to the
+                // escalation is final and streams live.
+                this.refreshIdealReviewArmed();
                 log("INFO", "ideal", "Ideal review coverage escalated after retry budget", {
                     injected: String(this.reviewCoverageInjected),
                     missing: coverage.missing,
@@ -1233,6 +1469,13 @@ export class AgentSession {
             coverageExpected: coverage.expected,
             coverageMissing: coverage.missing,
         });
+        // Recompute strictly AFTER the hook event: clients release held text on
+        // disarm, so the reverse order would paint the draft and then delete it —
+        // the exact flash arming exists to prevent. Arming normally PERSISTS here,
+        // because review starts with every changed file uncovered and a stop while
+        // coverage is outstanding injects again. Disarm lands later, on the read
+        // that closes the last gap (or when the retry budget escalates).
+        this.refreshIdealReviewArmed();
         log("INFO", "ideal", "Injecting ideal review before final response", {
             coverageExpected: coverage.expected,
             coverageMissing: coverage.missing,
@@ -1720,7 +1963,7 @@ export class AgentSession {
             // Reconnect MCP servers ONLY when GLM is involved on either side — GLM
             // is the only provider with a different server set (Z.AI tools), so a
             // non-GLM switch keeps the identical set. Skipping the dispose/reconnect
-            // there avoids tearing down a live stdio child (e.g. kencode-search) and
+            // there avoids tearing down a live stdio child and
             // gambling on a `npx` re-spawn that could fail and drop the tools.
             const glmInvolved = this.provider === "glm" || prevProvider === "glm";
             if (this.mcpManager && glmInvolved) {
@@ -1741,7 +1984,9 @@ export class AgentSession {
                         }
                     }
                     // Use getAllMcpServers so user-configured servers survive the reconnect.
-                    const servers = await getAllMcpServers(this.provider, apiKey, this.cwd);
+                    const servers = await getAllMcpServers(this.provider, apiKey, this.cwd, {
+                        allowProjectScope: this.settingsManager.isProjectTrusted(this.cwd),
+                    });
                     const mcpTools = await this.mcpManager.connectAll(servers);
                     // Drop stale MCP tools from both the live set and deferred catalog before
                     // re-adding. Some tools may already have been promoted out of the catalog.
@@ -2144,6 +2389,9 @@ export class AgentSession {
             this.idealReviewPhase = "idle";
             this.reviewCoverage.reset();
         }
+        // Suppression flips mid-run (autopilot takes over verification), so a client
+        // holding a draft under a stale arming must be released.
+        this.refreshHookArming();
     }
     /** Queue a user message (optionally with attachments) to be injected mid-run
      *  as steering. Returns the new queue length. No-op semantics are the caller's
@@ -2302,6 +2550,16 @@ export class AgentSession {
         const live = new Set(liveNames);
         return this.deferredBuiltinToolNames.filter((name) => !live.has(name));
     }
+    /**
+     * The environment about to be rendered into a prompt, remembered as the
+     * truth the model has been told. Pairs with the env-delta hook: whatever the
+     * prompt states, the model is only corrected when reality moves away from it.
+     */
+    recordRenderedEnvironment() {
+        const environment = this.promptEnvironment();
+        this.renderedEnvironment = environment;
+        return environment;
+    }
     /** Environment facts that vary per session rather than per host. */
     promptEnvironment() {
         const networkAllow = this.settingsManager.get("networkMode") === "allowlist"
@@ -2327,10 +2585,11 @@ export class AgentSession {
                 toolNames,
                 deferredToolNames,
                 context: this.opts.agentContext,
-                environment: this.promptEnvironment(),
+                environment: this.recordRenderedEnvironment(),
+                contextLimits: this.contextLimits,
             });
         }
-        return buildSystemPrompt(this.cwd, this.skills, planMode, approvedPlanPath, toolNames, undefined, this.provider, this.promptEnvironment(), deferredToolNames);
+        return buildSystemPrompt(this.cwd, this.skills, planMode, approvedPlanPath, toolNames, undefined, this.provider, this.recordRenderedEnvironment(), deferredToolNames, this.contextLimits);
     }
     /** Rebuild messages[0] from current plan-mode + approved-plan state. */
     async rebuildSystemPromptInPlace() {