@sayknow-cli/coding-agent 0.3.10 → 0.3.12

package/src/cli/mcp-cli.ts

@@ -37,14 +37,27 @@ interface ScopedPath {
 	path: string;
 }
 
+interface RuntimeDisclosure {
+	runtimeStatus: "storage-only";
+	runtimeLoadedByStandalone: false;
+	runtimeNote: string;
+}
+
 interface RedactedServerEntry {
 	name: string;
 	config: MCPServerConfig;
 }
 
+interface RuntimeRedactedServerEntry extends RedactedServerEntry, RuntimeDisclosure {}
+
 const REDACTED = "<redacted>";
 const SENSITIVE_KEY_PATTERN =
 	/(?:token|secret|key|credential|password|passwd|pwd|authorization|auth|bearer|cookie|session)/i;
+const STORAGE_ONLY_RUNTIME_DISCLOSURE: RuntimeDisclosure = {
+	runtimeStatus: "storage-only",
+	runtimeLoadedByStandalone: false,
+	runtimeNote: "Stored MCP registrations are not loaded by normal standalone skc sessions today.",
+};
 
 function resolvePath(args: MCPCommandArgs): ScopedPath {
 	const scope = args.flags.project ? "project" : "user";
@@ -128,6 +141,50 @@ function redactRecord(
 	);
 }
 
+function redactUrl(value: string | undefined): string | undefined {
+	if (!value) return value;
+	try {
+		const url = new URL(value);
+		if (url.username) url.username = REDACTED;
+		if (url.password) url.password = REDACTED;
+		if (url.search) {
+			for (const key of Array.from(url.searchParams.keys())) {
+				url.searchParams.set(key, REDACTED);
+			}
+		}
+		url.hash = "";
+		return url.toString();
+	} catch {
+		return SENSITIVE_KEY_PATTERN.test(value) ? REDACTED : value;
+	}
+}
+
+function redactArgs(args: string[] | undefined): string[] | undefined {
+	if (!args) return undefined;
+	const redacted: string[] = [];
+	let redactNext = false;
+	for (const arg of args) {
+		if (redactNext) {
+			redacted.push(REDACTED);
+			redactNext = false;
+			continue;
+		}
+		const equalsIndex = arg.indexOf("=");
+		if (equalsIndex > 0) {
+			const key = arg.slice(0, equalsIndex);
+			redacted.push(SENSITIVE_KEY_PATTERN.test(key) ? `${key}=${REDACTED}` : arg);
+			continue;
+		}
+		if (arg.startsWith("-") && SENSITIVE_KEY_PATTERN.test(arg)) {
+			redacted.push(arg);
+			redactNext = true;
+			continue;
+		}
+		redacted.push(SENSITIVE_KEY_PATTERN.test(arg) ? REDACTED : arg);
+	}
+	return redacted;
+}
+
 export function redactMCPServerConfig(config: MCPServerConfig): MCPServerConfig {
 	const redacted = { ...config } as MCPServerConfig;
 	if ("env" in redacted) {
@@ -138,11 +195,19 @@ export function redactMCPServerConfig(config: MCPServerConfig): MCPServerConfig
 		const headers = redactRecord(redacted.headers, true);
 		if (headers) redacted.headers = headers;
 	}
+	if ("url" in redacted) {
+		const url = redactUrl(redacted.url);
+		if (url) redacted.url = url;
+	}
+	if ("args" in redacted) {
+		const args = redactArgs(redacted.args);
+		if (args) redacted.args = args;
+	}
 	if (redacted.auth) {
 		redacted.auth = {
 			type: redacted.auth.type,
 			credentialId: redacted.auth.credentialId ? REDACTED : undefined,
-			tokenUrl: redacted.auth.tokenUrl,
+			tokenUrl: redactUrl(redacted.auth.tokenUrl),
 			clientId: redacted.auth.clientId ? REDACTED : undefined,
 			clientSecret: redacted.auth.clientSecret ? REDACTED : undefined,
 		};
@@ -151,7 +216,7 @@ export function redactMCPServerConfig(config: MCPServerConfig): MCPServerConfig
 		redacted.oauth = {
 			clientId: redacted.oauth.clientId ? REDACTED : undefined,
 			clientSecret: redacted.oauth.clientSecret ? REDACTED : undefined,
-			redirectUri: redacted.oauth.redirectUri,
+			redirectUri: redactUrl(redacted.oauth.redirectUri),
 			callbackPort: redacted.oauth.callbackPort,
 			callbackPath: redacted.oauth.callbackPath,
 		};
@@ -159,10 +224,14 @@ export function redactMCPServerConfig(config: MCPServerConfig): MCPServerConfig
 	return redacted;
 }
 
-function collectEntries(config: MCPConfigFile): RedactedServerEntry[] {
+function withRuntimeDisclosure<T extends object>(value: T): T & RuntimeDisclosure {
+	return { ...value, ...STORAGE_ONLY_RUNTIME_DISCLOSURE };
+}
+
+function collectEntries(config: MCPConfigFile): RuntimeRedactedServerEntry[] {
 	return Object.entries(config.mcpServers ?? {})
 		.sort(([a], [b]) => a.localeCompare(b))
-		.map(([name, serverConfig]) => ({ name, config: redactMCPServerConfig(serverConfig) }));
+		.map(([name, serverConfig]) => withRuntimeDisclosure({ name, config: redactMCPServerConfig(serverConfig) }));
 }
 
 function writeJson(value: unknown): void {
@@ -188,37 +257,46 @@ async function runAdd(args: MCPCommandArgs, scoped: ScopedPath): Promise<void> {
 	const result = await upsertMCPServer(scoped.path, args.name, config, { force: args.flags.force });
 	const redacted = redactMCPServerConfig(config);
 	if (args.flags.json) {
-		writeJson({
-			action: "add",
-			status: result.status,
-			name: args.name,
-			scope: scoped.scope,
-			path: scoped.path,
-			config: redacted,
-		});
+		writeJson(
+			withRuntimeDisclosure({
+				action: "add",
+				status: result.status,
+				name: args.name,
+				scope: scoped.scope,
+				path: scoped.path,
+				config: redacted,
+			}),
+		);
 		return;
 	}
 	if (result.status === "skipped") {
 		process.stdout.write(
-			`MCP server "${args.name}" already exists in ${scoped.scope} config. Pass --force to overwrite.\n`,
+			`MCP server "${args.name}" already exists in ${scoped.scope} config. Pass --force to overwrite. ` +
+				"Status: storage-only; normal standalone skc sessions do not load stored MCP registrations today.\n",
 		);
 		return;
 	}
-	process.stdout.write(`MCP server "${args.name}" ${result.status} in ${scoped.scope} config: ${scoped.path}\n`);
+	process.stdout.write(
+		`MCP server "${args.name}" ${result.status} in ${scoped.scope} config: ${scoped.path}\nStatus: storage-only; normal standalone skc sessions do not load stored MCP registrations today.\n`,
+	);
 }
 
 async function runList(args: MCPCommandArgs, scoped: ScopedPath): Promise<void> {
 	const config = await readMCPConfigFile(scoped.path);
 	const entries = collectEntries(config);
 	if (args.flags.json) {
-		writeJson({ action: "list", scope: scoped.scope, path: scoped.path, servers: entries });
+		writeJson(withRuntimeDisclosure({ action: "list", scope: scoped.scope, path: scoped.path, servers: entries }));
 		return;
 	}
 	if (entries.length === 0) {
-		process.stdout.write(`No MCP servers registered in ${scoped.scope} config: ${scoped.path}\n`);
+		process.stdout.write(
+			`No MCP servers registered in ${scoped.scope} config: ${scoped.path}\nStatus: storage-only; normal standalone skc sessions do not load stored MCP registrations today.\n`,
+		);
 		return;
 	}
-	process.stdout.write(`MCP servers in ${scoped.scope} config: ${scoped.path}\n`);
+	process.stdout.write(
+		`MCP servers in ${scoped.scope} config: ${scoped.path}\nStatus: storage-only; normal standalone skc sessions do not load stored MCP registrations today.\n`,
+	);
 	for (const entry of entries) {
 		process.stdout.write(`${renderDetails(entry)}\n`);
 	}
@@ -233,17 +311,21 @@ async function runRemove(args: MCPCommandArgs, scoped: ScopedPath): Promise<void
 	await removeMCPServer(scoped.path, args.name);
 	const entry = { name: args.name, config: redactMCPServerConfig(existing) };
 	if (args.flags.json) {
-		writeJson({
-			action: "remove",
-			status: "removed",
-			name: args.name,
-			scope: scoped.scope,
-			path: scoped.path,
-			removed: entry,
-		});
+		writeJson(
+			withRuntimeDisclosure({
+				action: "remove",
+				status: "removed",
+				name: args.name,
+				scope: scoped.scope,
+				path: scoped.path,
+				removed: entry,
+			}),
+		);
 		return;
 	}
-	process.stdout.write(`Removed MCP server "${args.name}" from ${scoped.scope} config: ${scoped.path}\n`);
+	process.stdout.write(
+		`Removed MCP server "${args.name}" from ${scoped.scope} config: ${scoped.path}\nStatus: storage-only; normal standalone skc sessions do not load stored MCP registrations today.\n`,
+	);
 	process.stdout.write(`${renderDetails(entry)}\n`);
 }
 

package/src/cli.ts

@@ -87,6 +87,23 @@ async function installRuntimeGlobals(): Promise<void> {
 	delete process.env.MallocStackLoggingNoCompact;
 }
 
+function isStatsHelpFastPath(argv: string[]): boolean {
+	return argv[0] === "stats" && (argv.includes("--help") || argv.includes("-h"));
+}
+
+function showStatsFastHelp(): void {
+	process.stdout.write(`Usage: ${APP_NAME} stats [options]
+
+View usage statistics
+
+Options:
+  -p, --port <number>   Port for the dashboard server (default: 3847)
+  -j, --json            Output stats as JSON
+  -s, --summary         Print summary to console
+  -h, --help            Show this help
+`);
+}
+
 function isNotifyDaemonInternalFastPath(argv: string[]): boolean {
 	return argv[0] === "notify" && argv[1] === "daemon-internal";
 }
@@ -264,6 +281,10 @@ export async function runCli(argv: string[]): Promise<void> {
 		process.exitCode = await runFixtureReport(id);
 		return;
 	}
+	if (isStatsHelpFastPath(argv)) {
+		showStatsFastHelp();
+		return;
+	}
 	if (hasRootHelpFlag(argv)) {
 		const { renderRootHelp } = await import("@sayknow-cli/utils/cli");
 		const { getExtraHelpText } = await import("./cli/fast-help");

package/src/commands/mcp.ts

@@ -1,5 +1,5 @@
 /**
- * Direct MCP server registration for standalone SKC.
+ * Explicit MCP server config storage for standalone SKC.
  */
 import { Args, Command, Flags } from "@sayknow-cli/utils/cli";
 import { type MCPAction, type MCPCommandArgs, runMCPCommand } from "../cli/mcp-cli";
@@ -7,7 +7,7 @@ import { type MCPAction, type MCPCommandArgs, runMCPCommand } from "../cli/mcp-c
 const ACTIONS: MCPAction[] = ["add", "list", "remove"];
 
 export default class MCP extends Command {
-	static description = "Register standalone MCP servers explicitly in SKC config";
+	static description = "Store standalone MCP server definitions without loading them at runtime";
 	static delegateHelp = true;
 
 	static examples = [
@@ -81,15 +81,15 @@ export default class MCP extends Command {
 	}
 
 	private printHelp(): void {
-		process.stdout.write(`Register standalone MCP servers explicitly in SKC config
+		process.stdout.write(`Store standalone MCP server definitions in SKC config without loading them at runtime
 
 USAGE
   $ skc mcp [add|list|remove] [NAME] [COMMAND_OR_URL] [ARGS...] [FLAGS]
 
 COMMANDS
-  add     Add an explicit user-provided MCP server definition
-  list    List registered servers with env/header/auth values redacted
-  remove  Remove a registered server and print the removed definition redacted
+  add     Store an explicit user-provided MCP server definition
+  list    List stored servers with env/header/auth values redacted
+  remove  Remove a stored server and print the removed definition redacted
 
 FLAGS
       --project          Use project scope (./.skc/mcp.json) instead of user scope
@@ -110,8 +110,8 @@ EXAMPLES
   $ skc mcp list --json
   $ skc mcp remove context7
 
-SECURITY
-  This command writes only the server definition supplied on this invocation. It does not import or inherit Claude Code, Codex, OpenCode, or other live MCP configs. Public output redacts env, header, auth, and OAuth credential values.
+STORAGE/RUNTIME
+  This command stores only the server definition supplied on this invocation. It does not import or inherit Claude Code, Codex, OpenCode, or other live MCP configs. Normal standalone skc sessions do not load stored MCP registrations today. Public output redacts env, header, auth, and OAuth credential values.
 `);
 	}
 }

package/src/commands/stats.ts

@@ -2,8 +2,7 @@
  * View usage statistics dashboard.
  */
 import { Command, Flags } from "@sayknow-cli/utils/cli";
-import { runStatsCommand, type StatsCommandArgs } from "../cli/stats-cli";
-import { initTheme } from "../modes/theme/theme";
+import type { StatsCommandArgs } from "../cli/stats-cli";
 
 export default class Stats extends Command {
 	static description = "View usage statistics";
@@ -23,6 +22,11 @@ export default class Stats extends Command {
 			summary: flags.summary,
 		};
 
+		const [{ initTheme }, { runStatsCommand }] = await Promise.all([
+			import("../modes/theme/theme"),
+			import("../cli/stats-cli"),
+		]);
+
 		await initTheme();
 		await runStatsCommand(cmd);
 	}

package/src/config/keybindings.ts

@@ -188,11 +188,11 @@ export const KEYBINDINGS = {
 	},
 	"app.session.delete": {
 		defaultKeys: "ctrl+d",
-		description: "Delete session",
+		description: "Delete current session transcript/artifacts",
 	},
 	"app.session.deleteNoninvasive": {
 		defaultKeys: "ctrl+backspace",
-		description: "Delete session (non-invasive)",
+		description: "Delete selected session transcript/artifacts (non-invasive)",
 	},
 	"app.tree.foldOrUp": {
 		defaultKeys: ["ctrl+left", "alt+left"],

package/src/config/mcp-schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://raw.githubusercontent.com/jaybeyond/Sayknow_CLI/main/packages/coding-agent/src/config/mcp-schema.json",
   "title": "SKC MCP configuration",
-  "description": "Schema for mcp.json, .mcp.json, .skc/mcp.json, and ~/.skc/agent/mcp.json used by the SKC coding agent.",
+  "description": "Schema for stored MCP server definitions in mcp.json, .mcp.json, .skc/mcp.json, and ~/.skc/agent/mcp.json. Normal standalone skc sessions do not consume skc mcp registrations as runtime tools today.",
   "type": "object",
   "additionalProperties": false,
   "properties": {
@@ -12,7 +12,7 @@
     },
     "mcpServers": {
       "type": "object",
-      "description": "Map of MCP server name to server configuration.",
+      "description": "Map of MCP server name to stored server configuration.",
       "propertyNames": {
         "pattern": "^[a-zA-Z0-9_.-]{1,100}$"
       },
@@ -22,7 +22,7 @@
     },
     "disabledServers": {
       "type": "array",
-      "description": "User-level denylist for disabling discovered servers by name.",
+      "description": "Denylist for explicit runtime MCP consumers that load discovered or stored servers by name.",
       "items": {
         "type": "string",
         "minLength": 1
@@ -94,11 +94,11 @@
       "properties": {
         "enabled": {
           "type": "boolean",
-          "description": "Whether SKC should try to connect this server."
+          "description": "Whether explicit runtime MCP consumers should try to connect this server."
         },
         "autoload": {
           "type": "boolean",
-          "description": "Whether to connect this server automatically at session startup (default: true). When false the server stays configured until connected explicitly (e.g. /mcp connect <name>)."
+          "description": "Whether an explicit runtime MCP consumer should connect this server automatically when that consumer starts (default: true). Normal standalone skc, skc --tmux, and print-mode sessions do not consume skc mcp registrations today; false keeps the server configured for consumers that support explicit connection."
         },
         "timeout": {
           "type": "number",
@@ -114,13 +114,13 @@
       }
     },
     "stdioServer": {
+      "type": "object",
+      "unevaluatedProperties": false,
       "allOf": [
         {
           "$ref": "#/$defs/serverBase"
         },
         {
-          "type": "object",
-          "additionalProperties": false,
           "required": ["command"],
           "properties": {
             "type": {
@@ -138,11 +138,15 @@
               "items": {
                 "type": "string"
               },
-              "description": "Arguments passed to the stdio server process."
+              "description": "Arguments passed to the stdio server process. Public CLI output redacts sensitive-looking argument values."
             },
             "env": {
               "$ref": "#/$defs/stringMap",
-              "description": "Environment variables passed to the stdio process."
+              "description": "Environment variables passed to the stdio process. Public CLI output redacts values."
+            },
+            "noInheritEnv": {
+              "type": "boolean",
+              "description": "When true, explicit runtime consumers should avoid inheriting the host environment and pass only a minimal allowlist plus explicit env keys."
             },
             "cwd": {
               "type": "string",
@@ -156,13 +160,13 @@
       ]
     },
     "httpServer": {
+      "type": "object",
+      "unevaluatedProperties": false,
       "allOf": [
         {
           "$ref": "#/$defs/serverBase"
         },
         {
-          "type": "object",
-          "additionalProperties": false,
           "required": ["type", "url"],
           "properties": {
             "type": {
@@ -173,11 +177,11 @@
             "url": {
               "type": "string",
               "minLength": 1,
-              "description": "MCP endpoint URL."
+              "description": "MCP endpoint URL. Public CLI output redacts userinfo, query values, and fragments."
             },
             "headers": {
               "$ref": "#/$defs/stringMap",
-              "description": "HTTP headers sent with MCP requests."
+              "description": "HTTP headers sent with MCP requests. Public CLI output redacts values."
             }
           },
           "not": {
@@ -187,13 +191,13 @@
       ]
     },
     "sseServer": {
+      "type": "object",
+      "unevaluatedProperties": false,
       "allOf": [
         {
           "$ref": "#/$defs/serverBase"
         },
         {
-          "type": "object",
-          "additionalProperties": false,
           "required": ["type", "url"],
           "properties": {
             "type": {
@@ -204,11 +208,11 @@
             "url": {
               "type": "string",
               "minLength": 1,
-              "description": "Legacy SSE endpoint URL."
+              "description": "Legacy SSE endpoint URL. Public CLI output redacts userinfo, query values, and fragments."
             },
             "headers": {
               "$ref": "#/$defs/stringMap",
-              "description": "HTTP headers sent with the SSE transport."
+              "description": "HTTP headers sent with the SSE transport. Public CLI output redacts values."
             }
           },
           "not": {

package/src/config/model-profiles.ts

@@ -70,25 +70,25 @@ const profile = (
 
 export const BUILTIN_MODEL_PROFILES: readonly ModelProfileDefinition[] = [
 	profile("codex-eco", ["openai-codex"], {
-		default: "openai-codex/gpt-5.5:low",
-		executor: "openai-codex/gpt-5.5:minimal",
-		planner: "openai-codex/gpt-5.5:low",
-		critic: "openai-codex/gpt-5.5:medium",
-		architect: "openai-codex/gpt-5.5:high",
+		default: "openai-codex/gpt-5.6-sol:medium",
+		executor: "openai-codex/gpt-5.6-luna:low",
+		planner: "openai-codex/gpt-5.6-luna:medium",
+		critic: "openai-codex/gpt-5.6-luna:medium",
+		architect: "openai-codex/gpt-5.6-sol:medium",
 	}),
 	profile("codex-medium", ["openai-codex"], {
-		default: "openai-codex/gpt-5.5:medium",
-		executor: "openai-codex/gpt-5.5:low",
-		planner: "openai-codex/gpt-5.5:medium",
-		critic: "openai-codex/gpt-5.5:high",
-		architect: "openai-codex/gpt-5.5:xhigh",
+		default: "openai-codex/gpt-5.6-sol:high",
+		executor: "openai-codex/gpt-5.6-luna:medium",
+		planner: "openai-codex/gpt-5.6-terra:medium",
+		critic: "openai-codex/gpt-5.6-terra:high",
+		architect: "openai-codex/gpt-5.6-sol:high",
 	}),
 	profile("codex-pro", ["openai-codex"], {
-		default: "openai-codex/gpt-5.5:xhigh",
-		executor: "openai-codex/gpt-5.5:medium",
-		planner: "openai-codex/gpt-5.5:high",
-		critic: "openai-codex/gpt-5.5:xhigh",
-		architect: "openai-codex/gpt-5.5:xhigh",
+		default: "openai-codex/gpt-5.6-sol:xhigh",
+		executor: "openai-codex/gpt-5.6-terra:medium",
+		planner: "openai-codex/gpt-5.6-sol:high",
+		critic: "openai-codex/gpt-5.6-sol:xhigh",
+		architect: "openai-codex/gpt-5.6-sol:max",
 	}),
 	profile("opencodego", ["opencode-go"], {
 		default: "opencode-go/kimi-k2.6",
@@ -256,24 +256,24 @@ export const BUILTIN_MODEL_PROFILES: readonly ModelProfileDefinition[] = [
 	}),
 	profile("opus-codex", ["anthropic", "openai-codex"], {
 		default: "anthropic/claude-opus-4-8:xhigh",
-		executor: "openai-codex/gpt-5.5:low",
-		planner: "openai-codex/gpt-5.5:medium",
-		critic: "openai-codex/gpt-5.5:high",
-		architect: "openai-codex/gpt-5.5:xhigh",
+		executor: "openai-codex/gpt-5.6-terra:low",
+		planner: "openai-codex/gpt-5.6-terra:medium",
+		critic: "openai-codex/gpt-5.6-terra:high",
+		architect: "openai-codex/gpt-5.6-sol:xhigh",
 	}),
 	profile("codex-opencodego", ["openai-codex", "opencode-go"], {
-		default: "openai-codex/gpt-5.5:medium",
+		default: "openai-codex/gpt-5.6-sol:medium",
 		executor: "opencode-go/deepseek-v4-pro",
 		planner: "opencode-go/kimi-k2.6",
 		critic: "opencode-go/mimo-v2.5-pro",
-		architect: "openai-codex/gpt-5.5:xhigh",
+		architect: "openai-codex/gpt-5.6-sol:xhigh",
 	}),
 	profile("fable-opus-codex", ["anthropic", "openai-codex"], {
 		default: "anthropic/claude-fable-5:high",
-		executor: "openai-codex/gpt-5.5:high",
+		executor: "openai-codex/gpt-5.6-terra:high",
 		planner: "anthropic/claude-opus-4-8:medium",
 		critic: "anthropic/claude-opus-4-8:high",
-		architect: "openai-codex/gpt-5.5:xhigh",
+		architect: "openai-codex/gpt-5.6-sol:xhigh",
 	}),
 ];
 

package/src/discovery/builtin.ts

@@ -176,6 +176,19 @@ async function loadMCPServers(ctx: LoadContext): Promise<LoadResult<MCPServer>>
 				autoload = undefined;
 			}
 
+			// Validate noInheritEnv: boolean only, warn on other types
+			let noInheritEnv: boolean | undefined;
+			if (serverConfig.noInheritEnv === undefined || serverConfig.noInheritEnv === null) {
+				noInheritEnv = undefined;
+			} else if (typeof serverConfig.noInheritEnv === "boolean") {
+				noInheritEnv = serverConfig.noInheritEnv;
+			} else {
+				logger.warn(
+					`MCP server "${serverName}": invalid noInheritEnv type ${typeof serverConfig.noInheritEnv}, ignoring`,
+				);
+				noInheritEnv = undefined;
+			}
+
 			result.push({
 				name: serverName,
 				enabled,
@@ -184,6 +197,7 @@ async function loadMCPServers(ctx: LoadContext): Promise<LoadResult<MCPServer>>
 				command: serverConfig.command as string | undefined,
 				args: serverConfig.args as string[] | undefined,
 				env: serverConfig.env as Record<string, string> | undefined,
+				noInheritEnv,
 				cwd: serverConfig.cwd as string | undefined,
 				url: serverConfig.url as string | undefined,
 				headers: serverConfig.headers as Record<string, string> | undefined,

package/src/discovery/mcp-json.ts

@@ -30,6 +30,7 @@ interface MCPConfigFile {
 			command?: string;
 			args?: string[];
 			env?: Record<string, string>;
+			noInheritEnv?: boolean;
 			cwd?: string;
 			url?: string;
 			headers?: Record<string, string>;
@@ -92,6 +93,18 @@ function transformMCPConfig(config: MCPConfigFile, source: SourceMeta): MCPServe
 				}
 			}
 
+			let noInheritEnv: boolean | undefined;
+			if (serverConfig.noInheritEnv !== undefined) {
+				if (typeof serverConfig.noInheritEnv === "boolean") {
+					noInheritEnv = serverConfig.noInheritEnv;
+				} else {
+					logger.warn("MCP server has invalid 'noInheritEnv' value, ignoring", {
+						name,
+						value: serverConfig.noInheritEnv,
+					});
+				}
+			}
+
 			const server: MCPServer = {
 				name,
 				enabled,
@@ -100,6 +113,7 @@ function transformMCPConfig(config: MCPConfigFile, source: SourceMeta): MCPServe
 				command: serverConfig.command,
 				args: serverConfig.args,
 				env: serverConfig.env,
+				noInheritEnv,
 				cwd: serverConfig.cwd,
 				url: serverConfig.url,
 				headers: serverConfig.headers,

package/src/eval/js/executor.ts

@@ -1,6 +1,7 @@
 import { DEFAULT_MAX_BYTES, OutputSink } from "../../session/streaming-output";
 import type { ToolSession } from "../../tools";
 import { resolveOutputMaxColumns, resolveOutputSinkHeadBytes } from "../../tools/output-meta";
+import { ToolError } from "../../tools/tool-errors";
 import { executeInVmContext, type JsDisplayOutput } from "./context-manager";
 
 export interface JsExecutorOptions {
@@ -117,7 +118,12 @@ export async function executeJs(code: string, options: JsExecutorOptions): Promi
 				displayOutputs,
 			};
 		}
-		const message = error instanceof Error ? (error.stack ?? error.message) : String(error);
+		const message =
+			error instanceof ToolError || (error instanceof Error && error.name === "ToolError")
+				? error.message
+				: error instanceof Error
+					? (error.stack ?? error.message)
+					: String(error);
 		outputSink.push(message);
 		const summary = await outputSink.dump();
 		return {