@sayknow-cli/coding-agent 0.3.16 → 0.4.0

package/src/daemon/builtin.ts

@@ -1,19 +1,20 @@
 /**
  * Static built-in daemon controller map.
  *
- * Intentionally a static map keyed by daemon kind rather than a mutable plugin
- * registry: there is exactly one kind today (`telegram`). Promote to a richer
- * registry only when a second daemon kind exists.
+ * Controllers are deliberately static rather than a mutable plugin registry.
  */
 
 import type { Settings } from "../config/settings";
-import { type TelegramDaemonControlDeps, TelegramDaemonController } from "../notifications/telegram-daemon-control";
+import { type ChatDaemonControlDeps, ChatDaemonController } from "../sdk/bus/chat-daemon-control";
+import { type TelegramDaemonControlDeps, TelegramDaemonController } from "../sdk/bus/telegram-daemon-control";
 import type { BuiltInDaemonController, DaemonKind } from "./control-types";
 
-export const BUILT_IN_DAEMON_KINDS = ["telegram"] as const satisfies readonly DaemonKind[];
+export const BUILT_IN_DAEMON_KINDS = ["telegram", "discord", "slack"] as const satisfies readonly DaemonKind[];
 
 export interface BuiltInDaemonControllerDeps {
 	telegram?: TelegramDaemonControlDeps;
+	discord?: ChatDaemonControlDeps;
+	slack?: ChatDaemonControlDeps;
 }
 
 export function createBuiltInDaemonControllers(
@@ -22,6 +23,8 @@ export function createBuiltInDaemonControllers(
 ): Record<DaemonKind, BuiltInDaemonController> {
 	return {
 		telegram: new TelegramDaemonController(settings, deps.telegram),
+		discord: new ChatDaemonController(settings, "discord", deps.discord),
+		slack: new ChatDaemonController(settings, "slack", deps.slack),
 	};
 }
 

package/src/daemon/control-types.ts

@@ -6,7 +6,7 @@
  * a richer registry is intentionally deferred until a second kind exists.
  */
 
-export type DaemonKind = "telegram";
+export type DaemonKind = "telegram" | "discord" | "slack";
 
 export type DaemonAction = "list" | "status" | "stop" | "reload";
 

package/src/daemon/runtime.ts

@@ -32,12 +32,12 @@ const COMPILED_RELOAD_WARNING =
 export function resolveSkcRuntimeSpawnInfo(execPath: string = process.execPath): SkcRuntimeSpawnInfo {
 	const base = path.basename(execPath).toLowerCase();
 	const fromSource = base === "bun" || base === "node" || base.startsWith("bun") || base.startsWith("node");
-	const mainScript = fromSource && typeof Bun !== "undefined" ? (Bun as unknown as { main?: string }).main : undefined;
+	const sourceEntry = fromSource ? path.resolve(import.meta.dir, "../../bin/skc.js") : undefined;
 	if (fromSource) {
 		return {
 			execPath,
 			mode: "source",
-			argsPrefix: mainScript ? [mainScript] : [],
+			argsPrefix: sourceEntry ? [sourceEntry] : [],
 			reloadPicksUpSourceEdits: true,
 		};
 	}

package/src/debug/index.ts

@@ -443,7 +443,7 @@ export class DebugSelectorComponent extends Container {
 		return {
 			model: this.ctx.session.model?.id,
 			thinkingLevel: this.ctx.session.thinkingLevel,
-			planModeEnabled: this.ctx.planModeEnabled,
+			planModeEnabled: this.ctx.planModeController.enabled,
 			toolOutputExpanded: this.ctx.toolOutputExpanded,
 			hideThinkingBlock: this.ctx.hideThinkingBlock,
 		};

package/src/defaults/skc/skills/team/SKILL.md

@@ -7,25 +7,23 @@ source: "forked from upstream team skill and rebranded for SKC"
 
 # Team Skill
 
+## Purpose & Principles
+
 `$team` is the tmux-based multi-worker execution mode for SKC. It starts real SKC worker CLI sessions by splitting the current tmux leader window and coordinates them through `.skc/_session-{sessionid}/state/team/...` files plus CLI team interop (`skc team api ...`) and state files.
 
 This skill is operationally sensitive. Treat it as an operator workflow, not a generic prompt pattern. In SKC App or plain outside-tmux sessions, do not present `$team` / `skc team` as directly available; launch SKC CLI from shell first, or stay on the nearest app-safe surface until the user explicitly wants the tmux runtime.
 
-## Corrupt current-session state recovery
-
-When team detects its own current-session state is corrupt, tampered, unreadable, or stale on resume, run `skc state clear --force --mode team` before reseeding or restarting. Scope the clear to the current session via `--session-id`, the command payload, or `SKC_SESSION_ID`; it clears only team state for that session and never clears other skills or sessions.
-
-## Team vs Native Subagents
-
 - Use **SKC native subagents** for bounded, in-session parallelism where one leader thread can fan out a few independent subtasks and wait for them directly.
 - Use **`skc team`** when you need durable visible tmux workers, shared task state, worker mailbox files, worktrees, explicit lifecycle control, or long-running execution that must survive beyond one local reasoning burst.
 - Native subagents can complement team execution, but they do **not** replace the tmux team runtime's stateful coordination contract.
 
-## What This Skill Must Do
+Use the shared workflow guidance pattern: outcome-first framing, concise visible updates for multi-step work, local overrides for the active workflow branch, validation proportional to risk, explicit stop rules, and automatic continuation for safe reversible steps. Ask only for material, destructive, credentialed, external-production, or preference-dependent branches.
 
-## GPT-5.5 Guidance Alignment
+## Corrupt current-session state recovery
 
-Use the shared workflow guidance pattern: outcome-first framing, concise visible updates for multi-step work, local overrides for the active workflow branch, validation proportional to risk, explicit stop rules, and automatic continuation for safe reversible steps. Ask only for material, destructive, credentialed, external-production, or preference-dependent branches.
+When team detects its own current-session state is corrupt, tampered, unreadable, or stale on resume, run `skc state clear --force --mode team` before reseeding or restarting. Scope the clear to the current session via `--session-id`, the command payload, or `SKC_SESSION_ID`; it clears only team state for that session and never clears other skills or sessions.
+
+## What This Skill Must Do
 
 When user triggers `$team`, the agent must:
 
@@ -203,6 +201,22 @@ sleep 30 && skc team monitor <team-name>
 ```
 The mutating monitor path also performs bounded liveness recovery: expired task claims, stale heartbeat claims, and missing recorded worker panes are requeued instead of leaving work permanently `in_progress`.
 
+### Opt-in stalled-worker continuation
+
+`SKC_TEAM_AUTO_CONTINUE_STALLED_WORKERS=1` enables a separate, default-off monitor-only nudge for a stalled live worker. It is considered only when the team is running (not dry-run), the worker heartbeat is stale (using `SKC_TEAM_HEARTBEAT_STALE_MS`, default `120000` ms), and all of these checks pass:
+
+- The recorded pane id is a non-leader `%<number>` pane that tmux currently reports in the recorded `tmux_target` as that same pane id; no other pane is targeted.
+- Shutdown authority is proven absent; valid-present and invalid/unreadable records veto continuation without suppressing normal stale-claim recovery.
+- Lifecycle is `ready` or `working`, and worker status is a structurally valid non-terminal state (not `draining`, `failed`, or `unknown`).
+- One current non-terminal task is `in_progress`, assigned to and claimed by that worker; the stored claim record exactly matches its owner, token, and lease.
+- The lease remains valid through the entire next hold interval.
+
+The policy has at most two attempts per immutable incident: attempt 1 reserves a 30-second hold, then attempt 2 reserves a 120-second hold only after attempt 1 was recorded as sent and its hold elapsed. A retry still requires the heartbeat to be stale and every fence above to pass. Reservations and outcomes are create-without-clobber journal records keyed to the incident identity; a pre-existing reservation, an unknown/missing/non-sent outcome after restart, or a second-attempt record fails closed rather than sending again.
+
+Each eligible attempt sends only the fixed continuation prompt to that verified recorded worker pane, followed by Enter. It does not replay provider output or a prior prompt, inspect or inject dynamic pane content, cross pane boundaries, kill or relaunch workers, create/split panes, or extend/rewrite claims. This bounded nudge is not automatic recovery for a dead, shutdown, reassigned, terminal, or lease-expired worker. When it cannot act, use `skc team status <team-name>` / `skc team monitor <team-name>` and the documented state evidence; manual pane intervention remains the last-resort fallback.
+
+Continuation input is unsupported on psmux and native Windows send-keys fallback transports: the fixed prompt is not dispatched there because equivalent literal-input semantics are not proven. Startup's existing empty-pane worker command fallback is separate and unchanged.
+
 ## Operational Commands
 
 ```bash
@@ -311,10 +325,10 @@ Worker protocol:
 Useful runtime env vars:
 
 - `SKC_TMUX_COMMAND` / `SKC_TEAM_TMUX_COMMAND`
-  - tmux binary/name override (default `tmux` on POSIX, `psmux` / `pmux` / `tmux` on native Windows when one of those resolves on PATH). `SKC_TMUX_COMMAND` applies to every SKC tmux flow; `SKC_TEAM_TMUX_COMMAND` is honored as an alias by the team path. Both resolve through the same resolver, so the team leader and `skc session ...` always target the same multiplexer. These values are executable path/name overrides, not shell command lines; do not include flags such as `psmux -L <namespace>` in the env var.
-  - Native Windows psmux support: psmux is the supported tmux-compatible multiplexer for native Windows `skc --tmux`, `skc session`, and `skc team`. Psmux can be exposed as `psmux.exe` or as its `tmux.exe`/`pmux.exe` aliases. SKC probes `psmux` / `pmux` / `tmux` on Windows PATH, picks the first that resolves, and treats that binary as the multiplexer. Worker commands on Windows are emitted with PowerShell-safe `$env:VAR = 'value';` assignments so psmux's ConPTY panes inherit `SKC_TEAM_*` correctly.
-  - Multiplexer detection knobs (Windows): `SKC_PSMUX_COMMAND` forces a wrapper to be treated as psmux, `SKC_PSMUX_DETECTION=off` skips detection, `SKC_PSMUX_FORCE_DETECT=1` re-probes every call. The mouse / set-clipboard / mode-style UX profile is filtered out for psmux; the `@skc-profile` ownership tag and branch / project / session identity markers still round-trip and are required for `skc session` and `skc team`.
-  - Windows psmux namespace boundary: psmux `-c <path>` cwd/start-directory flags do not isolate the server namespace; psmux uses the tmux-compatible global `-L <namespace>` flag for isolated server instances. SKC does not currently expose structured runtime `-L` support, because launch, `skc session`, and `skc team` must all carry the same namespace prefix together. If you need isolated psmux servers, start `psmux -L <namespace>` yourself before `skc --tmux` and let SKC attach to it; do not pass `-L` through `SKC_TMUX_COMMAND`.
+  - tmux executable override (default `tmux` on POSIX; `psmux` / `pmux` / `tmux` resolution on native Windows). `SKC_TMUX_COMMAND` applies to every SKC tmux flow; `SKC_TEAM_TMUX_COMMAND` is honored as a team-path alias. Values are executable paths/names, not shell command lines.
+  - Native Windows psmux boundary: a generic-banner `tmux.exe` alias is classified by matching its executable identity with resolved `psmux.exe` / `pmux.exe` companions. Unresolved or conflicting identity evidence fails closed with `skc_tmux_provider_ambiguous`; `SKC_PSMUX_COMMAND` must resolve to the same executable identity as the selected alias.
+  - Managed psmux session creation, attachment, lifecycle mutation, and team startup remain unsupported because psmux cannot provide the immutable native session identity required by the owner-isolation contract. Use WSL or verified native tmux for live team workers.
+  - Windows psmux namespace boundary: psmux uses the tmux-compatible global `-L <namespace>` flag for server isolation, but SKC does not accept flags in `SKC_TMUX_COMMAND` or expose structured runtime `-L` support.
 - `SKC_TEAM_WORKER_COMMAND`
   - worker command override (default resolves to active SKC entrypoint or `skc`)
 - `SKC_TEAM_STATE_ROOT`

package/src/defaults/skc/skills/ultragoal/SKILL.md

@@ -50,8 +50,6 @@ goal({"op":"resume"})
 ```
 `drop` clears the active goal without exiting goal mode; `resume` reactivates a paused goal.
 
-Durable completion is single-source: `goals.json` defines which goals exist and their required state, while `ledger.jsonl` provides the receipt proof used to verify completion. Inline goal state is UX-only and is reconciled by the agent after durable completion, not by CLI checkpoints or hooks.
-
 ## Create goals
 
 1. Decide on the brief. To produce **multiple** stories, separate them with a reserved `@goal:` delimiter line; the title follows on the same line and the objective is everything beneath it until the next delimiter:

package/src/discovery/helpers.ts

@@ -20,8 +20,6 @@ import type { LoadContext, LoadResult, SourceMeta } from "../capability/types";
 import type { ForkContextPolicy } from "../task/types";
 import { parseThinkingLevel } from "../thinking";
 
-import { buildPluginDirRoot } from "./plugin-dir-roots";
-
 /**
  * Standard paths for each config source.
  */
@@ -900,14 +898,6 @@ export async function listClaudePluginRoots(
 		roots.push(...projectRoots, ...deduped);
 	}
 
-	// Merge --plugin-dir roots (highest precedence) on every fresh load
-	if (injectedPluginDirRoots.length > 0) {
-		const injectedIds = new Set(injectedPluginDirRoots.map(r => r.id));
-		const filtered = roots.filter(r => !injectedIds.has(r.id));
-		roots.length = 0;
-		roots.push(...injectedPluginDirRoots, ...filtered);
-	}
-
 	const result = { roots, warnings };
 	pluginRootsCache.set(cacheKey, result);
 	return result;
@@ -918,7 +908,7 @@ export async function listClaudePluginRoots(
  */
 export function clearClaudePluginRootsCache(): void {
 	pluginRootsCache.clear();
-	preloadedPluginRoots = [...injectedPluginDirRoots];
+	preloadedPluginRoots = [];
 	// Re-warm preloaded roots asynchronously so sync LSP config reads stay valid
 	if (lastPreloadHome) {
 		void preloadPluginRoots(lastPreloadHome, getProjectDir());
@@ -941,7 +931,6 @@ export function clearPluginRootsAndCaches(extraPaths?: readonly string[]): void
 // getPreloadedPluginRoots(). Safe degradation: empty array if not warmed.
 
 let preloadedPluginRoots: ClaudePluginRoot[] = [];
-let injectedPluginDirRoots: ClaudePluginRoot[] = [];
 let lastPreloadHome: string | undefined;
 
 /**
@@ -962,41 +951,3 @@ export async function preloadPluginRoots(home: string, cwd?: string): Promise<vo
 export function getPreloadedPluginRoots(): readonly ClaudePluginRoot[] {
 	return preloadedPluginRoots;
 }
-
-// ── --plugin-dir injection ──────────────────────────────────────────────────
-
-/**
- * Inject synthetic plugin roots from --plugin-dir paths.
- * These are prepended to the cache with highest precedence (before SKC/Anthropic model entries).
- * Must be called before any listAnthropic modelPluginRoots() access.
- */
-export async function injectPluginDirRoots(home: string, dirs: string[], cwd?: string): Promise<void> {
-	const injected: ClaudePluginRoot[] = [];
-	for (const dir of dirs) {
-		const resolved = path.resolve(dir);
-		// Read plugin name from manifest
-		let pluginName = path.basename(resolved);
-		try {
-			const manifestPath = path.join(resolved, ".claude-plugin", "plugin.json");
-			const content = await Bun.file(manifestPath).text();
-			const manifest = JSON.parse(content);
-			if (typeof manifest.name === "string" && manifest.name) {
-				pluginName = manifest.name;
-			}
-		} catch {
-			// No manifest or invalid — use directory name
-		}
-
-		injected.push(buildPluginDirRoot(resolved, pluginName));
-	}
-
-	// Set injected roots BEFORE populating cache so listAnthropic modelPluginRoots merges them.
-	injectedPluginDirRoots = injected;
-	lastPreloadHome = home; // ensure cache-clear re-warm fires even when injectPluginDirRoots was the startup path
-	// Clear any stale cache entries (populated before injected roots were set).
-	pluginRootsCache.clear();
-	// Rebuild — cache miss triggers fresh load that includes both user+project registries
-	// and prepends injectedPluginDirRoots at highest precedence.
-	const { roots } = await listClaudePluginRoots(home, cwd);
-	preloadedPluginRoots = roots;
-}

package/src/discovery/mcp-json.ts

@@ -6,6 +6,8 @@
  *
  * Priority: 5 (low, as this is a fallback after tool-specific providers)
  */
+import * as fs from "node:fs";
+import * as fsPromises from "node:fs/promises";
 import * as path from "node:path";
 import { logger, tryParseJson } from "@sayknow-cli/utils";
 import { registerProvider } from "../capability";
@@ -16,6 +18,7 @@ import { createSourceMeta, expandEnvVarsDeep } from "./helpers";
 
 const PROVIDER_ID = "mcp-json";
 const DISPLAY_NAME = "MCP Config";
+const PROTOTYPE_SENSITIVE_SERVER_NAMES = new Set(["__proto__", "prototype", "constructor"]);
 
 /**
  * Raw MCP JSON format (matches Anthropic model Desktop's format).
@@ -51,12 +54,100 @@ interface MCPConfigFile {
 			};
 		}
 	>;
+	disabledServers?: string[];
+}
+export interface MCPJsonLoadResult extends LoadResult<MCPServer> {
+	disabledServers: string[];
+}
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isStringArray(value: unknown): value is string[] {
+	return Array.isArray(value) && value.every(item => typeof item === "string");
+}
+function isStringRecord(value: unknown): value is Record<string, string> {
+	return isRecord(value) && Object.values(value).every(item => typeof item === "string");
+}
+function isOptionalBoolean(value: unknown): boolean {
+	return value === undefined || typeof value === "boolean";
+}
+function isOptionalString(value: unknown): boolean {
+	return value === undefined || typeof value === "string";
+}
+function isValidAuthConfig(value: unknown): boolean {
+	return (
+		isRecord(value) &&
+		(value.type === "oauth" || value.type === "apikey") &&
+		isOptionalString(value.credentialId) &&
+		isOptionalString(value.tokenUrl) &&
+		isOptionalString(value.clientId) &&
+		isOptionalString(value.clientSecret)
+	);
+}
+function isValidOAuthConfig(value: unknown): boolean {
+	return (
+		isRecord(value) &&
+		isOptionalString(value.clientId) &&
+		isOptionalString(value.clientSecret) &&
+		isOptionalString(value.redirectUri) &&
+		(value.callbackPort === undefined ||
+			(typeof value.callbackPort === "number" &&
+				Number.isInteger(value.callbackPort) &&
+				value.callbackPort >= 1 &&
+				value.callbackPort <= 65_535)) &&
+		isOptionalString(value.callbackPath)
+	);
+}
+function isValidExactServerConfig(value: unknown): boolean {
+	if (!isRecord(value)) return false;
+	return (
+		isOptionalBoolean(value.enabled) &&
+		isOptionalBoolean(value.autoload) &&
+		isOptionalBoolean(value.noInheritEnv) &&
+		(value.timeout === undefined ||
+			(typeof value.timeout === "number" && Number.isFinite(value.timeout) && value.timeout > 0)) &&
+		isOptionalString(value.command) &&
+		(value.args === undefined || isStringArray(value.args)) &&
+		(value.env === undefined || isStringRecord(value.env)) &&
+		isOptionalString(value.cwd) &&
+		isOptionalString(value.url) &&
+		(value.headers === undefined || isStringRecord(value.headers)) &&
+		(value.type === undefined || value.type === "stdio" || value.type === "sse" || value.type === "http") &&
+		(value.auth === undefined || isValidAuthConfig(value.auth)) &&
+		(value.oauth === undefined || isValidOAuthConfig(value.oauth))
+	);
+}
+function validateExactMCPConfig(config: unknown): {
+	config: MCPConfigFile | null;
+	hasInvalidServer: boolean;
+} {
+	if (!isRecord(config)) return { config: null, hasInvalidServer: false };
+	if (config.disabledServers !== undefined && !isStringArray(config.disabledServers)) {
+		return { config: null, hasInvalidServer: false };
+	}
+	if (config.mcpServers === undefined) {
+		return { config: config as MCPConfigFile, hasInvalidServer: false };
+	}
+	if (!isRecord(config.mcpServers)) return { config: null, hasInvalidServer: false };
+	const validServers: Record<string, unknown> = Object.create(null);
+	let hasInvalidServer = false;
+	for (const [name, serverConfig] of Object.entries(config.mcpServers)) {
+		if (PROTOTYPE_SENSITIVE_SERVER_NAMES.has(name) || !isValidExactServerConfig(serverConfig)) {
+			hasInvalidServer = true;
+			continue;
+		}
+		validServers[name] = serverConfig;
+	}
+	return {
+		config: { ...config, mcpServers: validServers } as MCPConfigFile,
+		hasInvalidServer,
+	};
 }
 
 /**
  * Transform raw MCP config to canonical MCPServer format.
  */
-function transformMCPConfig(config: MCPConfigFile, source: SourceMeta): MCPServer[] {
+function transformMCPConfig(config: MCPConfigFile, source: SourceMeta, quiet = false): MCPServer[] {
 	const servers: MCPServer[] = [];
 
 	if (config.mcpServers) {
@@ -66,7 +157,7 @@ function transformMCPConfig(config: MCPConfigFile, source: SourceMeta): MCPServe
 			if (serverConfig.enabled !== undefined) {
 				if (typeof serverConfig.enabled === "boolean") {
 					enabled = serverConfig.enabled;
-				} else {
+				} else if (!quiet) {
 					logger.warn("MCP server has invalid 'enabled' value, ignoring", { name, value: serverConfig.enabled });
 				}
 			}
@@ -79,7 +170,7 @@ function transformMCPConfig(config: MCPConfigFile, source: SourceMeta): MCPServe
 					serverConfig.timeout > 0
 				) {
 					timeout = serverConfig.timeout;
-				} else {
+				} else if (!quiet) {
 					logger.warn("MCP server has invalid 'timeout' value, ignoring", { name, value: serverConfig.timeout });
 				}
 			}
@@ -88,7 +179,7 @@ function transformMCPConfig(config: MCPConfigFile, source: SourceMeta): MCPServe
 			if (serverConfig.autoload !== undefined) {
 				if (typeof serverConfig.autoload === "boolean") {
 					autoload = serverConfig.autoload;
-				} else {
+				} else if (!quiet) {
 					logger.warn("MCP server has invalid 'autoload' value, ignoring", { name, value: serverConfig.autoload });
 				}
 			}
@@ -97,7 +188,7 @@ function transformMCPConfig(config: MCPConfigFile, source: SourceMeta): MCPServe
 			if (serverConfig.noInheritEnv !== undefined) {
 				if (typeof serverConfig.noInheritEnv === "boolean") {
 					noInheritEnv = serverConfig.noInheritEnv;
-				} else {
+				} else if (!quiet) {
 					logger.warn("MCP server has invalid 'noInheritEnv' value, ignoring", {
 						name,
 						value: serverConfig.noInheritEnv,
@@ -139,33 +230,249 @@ function transformMCPConfig(config: MCPConfigFile, source: SourceMeta): MCPServe
 	return servers;
 }
 
+interface ExactMCPConfigIdentity {
+	dev: bigint;
+	ino: bigint;
+	mode: bigint;
+}
+
+interface ExactMCPConfigFileState extends ExactMCPConfigIdentity {
+	size: bigint;
+	mtimeNs: bigint;
+	ctimeNs: bigint;
+	nlink: bigint;
+}
+
+interface ExactMCPConfigPathState {
+	ancestors: ExactMCPConfigIdentity[];
+	file: ExactMCPConfigFileState;
+}
+
+function exactMCPConfigIdentity(stat: fs.BigIntStats): ExactMCPConfigIdentity {
+	return {
+		dev: stat.dev,
+		ino: stat.ino,
+		mode: stat.mode,
+	};
+}
+
+function exactMCPConfigFileState(stat: fs.BigIntStats): ExactMCPConfigFileState | null {
+	if (stat.isSymbolicLink() || !stat.isFile() || stat.nlink !== 1n) return null;
+	return {
+		...exactMCPConfigIdentity(stat),
+		size: stat.size,
+		mtimeNs: stat.mtimeNs,
+		ctimeNs: stat.ctimeNs,
+		nlink: stat.nlink,
+	};
+}
+
+function exactMCPConfigDirectoryIdentity(stat: fs.BigIntStats): ExactMCPConfigIdentity | null {
+	if (stat.isSymbolicLink() || !stat.isDirectory()) return null;
+	return exactMCPConfigIdentity(stat);
+}
+
+async function exactMCPConfigPathState(filePath: string): Promise<ExactMCPConfigPathState | null> {
+	if (!path.isAbsolute(filePath)) return null;
+
+	const root = path.parse(filePath).root;
+	const components = filePath
+		.slice(root.length)
+		.split(process.platform === "win32" ? /[\\/]+/ : path.sep)
+		.filter(component => component.length > 0);
+	if (
+		root.length === 0 ||
+		components.length === 0 ||
+		components.some(component => component === "." || component === "..")
+	) {
+		return null;
+	}
+
+	let componentPath = root;
+	const rootIdentity = exactMCPConfigDirectoryIdentity(await fsPromises.lstat(componentPath, { bigint: true }));
+	if (!rootIdentity) return null;
+	const ancestors = [rootIdentity];
+
+	for (const [index, component] of components.entries()) {
+		componentPath = path.join(componentPath, component);
+		const componentState = await fsPromises.lstat(componentPath, { bigint: true });
+		if (index === components.length - 1) {
+			const file = exactMCPConfigFileState(componentState);
+			return file ? { ancestors, file } : null;
+		}
+		const directoryIdentity = exactMCPConfigDirectoryIdentity(componentState);
+		if (!directoryIdentity) return null;
+		ancestors.push(directoryIdentity);
+	}
+
+	return null;
+}
+
+function isSameExactMCPConfigIdentity(expected: ExactMCPConfigIdentity, actual: ExactMCPConfigIdentity): boolean {
+	return expected.dev === actual.dev && expected.ino === actual.ino && expected.mode === actual.mode;
+}
+
+function isSameExactMCPConfigFileState(expected: ExactMCPConfigFileState, actual: ExactMCPConfigFileState): boolean {
+	return (
+		isSameExactMCPConfigIdentity(expected, actual) &&
+		expected.size === actual.size &&
+		expected.mtimeNs === actual.mtimeNs &&
+		expected.ctimeNs === actual.ctimeNs &&
+		expected.nlink === actual.nlink
+	);
+}
+
+function isSameExactMCPConfigPathState(expected: ExactMCPConfigPathState, actual: ExactMCPConfigPathState): boolean {
+	return (
+		expected.ancestors.length === actual.ancestors.length &&
+		expected.ancestors.every((identity, index) => {
+			const actualIdentity = actual.ancestors[index];
+			return actualIdentity !== undefined && isSameExactMCPConfigIdentity(identity, actualIdentity);
+		}) &&
+		isSameExactMCPConfigFileState(expected.file, actual.file)
+	);
+}
+
+function isExpectedExactMCPConfigReadError(error: unknown): boolean {
+	if (!isRecord(error) || typeof error.code !== "string") return false;
+	return ["EACCES", "EISDIR", "ELOOP", "ENOENT", "ENAMETOOLONG", "ENOTDIR", "EPERM", "ESTALE"].includes(error.code);
+}
+
+async function readExactMCPConfigDescriptorBytes(handle: fsPromises.FileHandle, size: bigint): Promise<Buffer | null> {
+	if (size > BigInt(Number.MAX_SAFE_INTEGER)) return null;
+
+	const bytes = Buffer.allocUnsafe(Number(size));
+	let offset = 0;
+	while (offset < bytes.length) {
+		const { bytesRead } = await handle.read(bytes, offset, bytes.length - offset, offset);
+		if (bytesRead === 0) return null;
+		offset += bytesRead;
+	}
+	return bytes;
+}
+
+// Windows does not support O_NOFOLLOW. The lstat/fstat checks below remain required there.
+const EXACT_MCP_CONFIG_OPEN_FLAGS =
+	fs.constants.O_RDONLY | (process.platform === "win32" ? 0 : (fs.constants.O_NOFOLLOW ?? 0));
+
+/**
+ * Exact-file trust policy for quiet explicit MCP configs:
+ * the supplied absolute path must contain only non-link components before and after reading;
+ * the root and every ancestor directory must retain their identities; the leaf must be a regular,
+ * non-link file with one link; and one descriptor supplies all content and exact byte revalidation.
+ */
+async function readExactMCPConfigFile(filePath: string): Promise<string | null> {
+	let handle: fsPromises.FileHandle | undefined;
+	let content: string | null = null;
+	let primaryFailure: unknown;
+	let hasPrimaryFailure = false;
+	try {
+		const initialPathState = await exactMCPConfigPathState(filePath);
+		if (initialPathState) {
+			handle = await fsPromises.open(filePath, EXACT_MCP_CONFIG_OPEN_FLAGS);
+			const openedFileState = exactMCPConfigFileState(await handle.stat({ bigint: true }));
+			const beforeReadPathState = await exactMCPConfigPathState(filePath);
+			if (
+				openedFileState &&
+				beforeReadPathState &&
+				isSameExactMCPConfigFileState(initialPathState.file, openedFileState) &&
+				isSameExactMCPConfigPathState(initialPathState, beforeReadPathState)
+			) {
+				const candidate = await handle.readFile();
+				const afterReadFileState = exactMCPConfigFileState(await handle.stat({ bigint: true }));
+				const afterReadPathState = await exactMCPConfigPathState(filePath);
+				if (
+					afterReadFileState &&
+					afterReadPathState &&
+					isSameExactMCPConfigFileState(initialPathState.file, afterReadFileState) &&
+					isSameExactMCPConfigPathState(initialPathState, afterReadPathState)
+				) {
+					const revalidated = await readExactMCPConfigDescriptorBytes(handle, initialPathState.file.size);
+					const afterRevalidationFileState = exactMCPConfigFileState(await handle.stat({ bigint: true }));
+					const afterRevalidationPathState = await exactMCPConfigPathState(filePath);
+					if (
+						revalidated &&
+						candidate.equals(revalidated) &&
+						afterRevalidationFileState &&
+						afterRevalidationPathState &&
+						isSameExactMCPConfigFileState(initialPathState.file, afterRevalidationFileState) &&
+						isSameExactMCPConfigPathState(initialPathState, afterRevalidationPathState)
+					) {
+						content = candidate.toString("utf8");
+					}
+				}
+			}
+		}
+	} catch (error) {
+		if (!isExpectedExactMCPConfigReadError(error)) {
+			hasPrimaryFailure = true;
+			primaryFailure = error;
+		}
+	}
+
+	let closeFailure: unknown;
+	let hasCloseFailure = false;
+	if (handle) {
+		try {
+			await handle.close();
+		} catch (error) {
+			hasCloseFailure = true;
+			closeFailure = error;
+		}
+	}
+	if (hasPrimaryFailure) throw primaryFailure;
+	if (hasCloseFailure) throw closeFailure;
+	return content;
+}
+
 /**
  * Load MCP servers from a JSON file.
  */
-async function loadMCPJsonFile(
-	_ctx: LoadContext,
-	path: string,
+export async function loadMCPJsonFile(
+	filePath: string,
 	level: "user" | "project",
-): Promise<LoadResult<MCPServer>> {
+	options?: { quiet?: boolean; useCache?: boolean },
+): Promise<MCPJsonLoadResult> {
 	const warnings: string[] = [];
 	const items: MCPServer[] = [];
 
-	const content = await readFile(path);
+	const content = options?.quiet
+		? await readExactMCPConfigFile(filePath)
+		: options?.useCache === false
+			? await Bun.file(filePath)
+					.text()
+					.catch(() => null)
+			: await readFile(filePath);
 	if (content === null) {
-		return { items, warnings };
+		if (options?.quiet) warnings.push("MCP configuration unavailable");
+		return { items, warnings, disabledServers: [] };
 	}
 
-	const config = tryParseJson<MCPConfigFile>(content);
+	const config = tryParseJson<unknown>(content);
 	if (!config) {
-		warnings.push(`Failed to parse JSON in ${path}`);
-		return { items, warnings };
+		warnings.push(options?.quiet ? "MCP configuration unavailable" : `Failed to parse JSON in ${filePath}`);
+		return { items, warnings, disabledServers: [] };
 	}
+	let validConfig: MCPConfigFile;
+	if (options?.quiet) {
+		const validation = validateExactMCPConfig(config);
+		if (!validation.config) {
+			warnings.push("MCP configuration unavailable");
+			return { items, warnings, disabledServers: [] };
+		}
+		if (validation.hasInvalidServer) warnings.push("MCP configuration unavailable");
+		validConfig = validation.config;
+	} else {
+		validConfig = config as MCPConfigFile;
+	}
+	const source = createSourceMeta(PROVIDER_ID, filePath, level);
+	items.push(...transformMCPConfig(validConfig, source, options?.quiet));
 
-	const source = createSourceMeta(PROVIDER_ID, path, level);
-	const servers = transformMCPConfig(config, source);
-	items.push(...servers);
-
-	return { items, warnings };
+	return {
+		items,
+		warnings,
+		disabledServers: isStringArray(validConfig.disabledServers) ? validConfig.disabledServers : [],
+	};
 }
 
 /**
@@ -174,7 +481,7 @@ async function loadMCPJsonFile(
 async function load(ctx: LoadContext): Promise<LoadResult<MCPServer>> {
 	const filenames = ["mcp.json", ".mcp.json"];
 	const results = await Promise.all(
-		filenames.map(filename => loadMCPJsonFile(ctx, path.join(ctx.cwd, filename), "project")),
+		filenames.map(filename => loadMCPJsonFile(path.join(ctx.cwd, filename), "project")),
 	);
 
 	const allItems = results.flatMap(r => r.items);