@sideboard-ai/core 0.1.311 → 0.1.313

package/dist/index.cjs

@@ -12769,24 +12769,47 @@ var init_turn_trace = __esm({
 });
 
 // src/brightsy/config.ts
+function resolveBrightsyConfigFile(path2) {
+  try {
+    if ((0, import_node_fs27.existsSync)(path2) && (0, import_node_fs27.statSync)(path2).isDirectory()) {
+      return (0, import_node_path31.join)(path2, "config.json");
+    }
+  } catch {
+  }
+  return path2;
+}
 function brightsyConfigPath() {
   const override = process.env.BRIGHTSY_CONFIG?.trim();
-  if (override) return override;
-  return (0, import_node_path31.join)((0, import_node_os10.homedir)(), ".brightsy", "config.json");
+  const raw = override || (0, import_node_path31.join)((0, import_node_os10.homedir)(), ".brightsy", "config.json");
+  return resolveBrightsyConfigFile(raw);
 }
 function loadBrightsyConfig() {
   const path2 = brightsyConfigPath();
   if (!(0, import_node_fs27.existsSync)(path2)) {
     throw new Error("Brightsy not logged in \u2014 run `brightsy login` first");
   }
-  const raw = JSON.parse((0, import_node_fs27.readFileSync)(path2, "utf8"));
+  let text7;
+  try {
+    text7 = (0, import_node_fs27.readFileSync)(path2, "utf8");
+  } catch (err) {
+    const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
+    if (code === "EISDIR") {
+      throw new Error(
+        `Brightsy config is a directory (${path2}) \u2014 expected ~/.brightsy/config.json`
+      );
+    }
+    throw err;
+  }
+  const raw = JSON.parse(text7);
   if (!raw.access_token || !raw.account_id) {
     throw new Error("Brightsy config incomplete \u2014 run `brightsy login`");
   }
   return raw;
 }
 function saveBrightsyConfig(cfg) {
-  (0, import_node_fs27.writeFileSync)(brightsyConfigPath(), `${JSON.stringify(cfg, null, 2)}
+  const path2 = brightsyConfigPath();
+  (0, import_node_fs27.mkdirSync)((0, import_node_path31.dirname)(path2), { recursive: true });
+  (0, import_node_fs27.writeFileSync)(path2, `${JSON.stringify(cfg, null, 2)}
 `, {
     mode: 384
   });
@@ -13110,6 +13133,7 @@ var connected_teams_exports = {};
 __export(connected_teams_exports, {
   applyConnectedTeamToCli: () => applyConnectedTeamToCli,
   brightsyMcpServerName: () => brightsyMcpServerName,
+  brightsySessionShouldReplace: () => brightsySessionShouldReplace,
   connectBrightsyTeam: () => connectBrightsyTeam,
   disconnectBrightsyTeam: () => disconnectBrightsyTeam,
   ensureCliTeamTracked: () => ensureCliTeamTracked,
@@ -13150,6 +13174,25 @@ function listConnectedBrightsyTeams() {
 function getConnectedBrightsyTeamsRaw() {
   return readStore();
 }
+function teamFromCliSession(cfg, current) {
+  return {
+    ...current,
+    access_token: cfg.access_token,
+    refresh_token: cfg.refresh_token ?? current.refresh_token,
+    expires_at: cfg.expires_at ?? current.expires_at,
+    endpoint: cfg.endpoint ?? current.endpoint,
+    oauth_client_id: cfg.oauth_client_id ?? current.oauth_client_id,
+    slug: cfg.account_slug || current.slug
+  };
+}
+function brightsySessionShouldReplace(a, b) {
+  if (!a.access_token) return false;
+  const aStale = brightsyAccessTokenNeedsRefresh(a.expires_at);
+  const bStale = !b.access_token || brightsyAccessTokenNeedsRefresh(b.expires_at);
+  if (!aStale && bStale) return true;
+  if (aStale) return false;
+  return (a.expires_at ?? 0) > (b.expires_at ?? 0);
+}
 function applyConnectedTeamToCli(team) {
   let base = {};
   try {
@@ -13236,22 +13279,34 @@ async function ensureConnectedBrightsyTeamTokens(opts) {
     }
     next.push(refreshed);
   }
-  if (changed) writeStore(next);
   try {
     const cfg2 = loadBrightsyConfig();
-    const active = next.find((t) => t.id === cfg2.account_id);
-    if (active && active.access_token !== cfg2.access_token) {
-      applyConnectedTeamToCli(active);
+    const idx = next.findIndex((t) => t.id === cfg2.account_id);
+    if (idx >= 0) {
+      const active = next[idx];
+      if (brightsySessionShouldReplace(cfg2, active)) {
+        next[idx] = teamFromCliSession(cfg2, active);
+        changed = true;
+      } else if (active.access_token !== cfg2.access_token) {
+        applyConnectedTeamToCli(active);
+      }
     }
   } catch {
   }
+  if (changed) writeStore(next);
   return next;
 }
 function ensureCliTeamTracked(meta) {
   try {
     const cfg = loadBrightsyConfig();
     const existing = readStore();
-    if (existing.some((t) => t.id === cfg.account_id)) {
+    const idx = existing.findIndex((t) => t.id === cfg.account_id);
+    if (idx >= 0) {
+      const current = existing[idx];
+      if (brightsySessionShouldReplace(cfg, current)) {
+        existing[idx] = teamFromCliSession(cfg, current);
+        writeStore(existing);
+      }
       return listConnectedBrightsyTeams();
     }
     const team = {
@@ -13869,18 +13924,18 @@ function mcpUiContentSecurityPolicy(csp) {
   const connect = (csp?.connectDomains ?? []).join(" ");
   const frames = csp?.frameDomains?.length ? csp.frameDomains.join(" ") : "'none'";
   const base = csp?.baseUriDomains?.length ? csp.baseUriDomains.join(" ") : "'none'";
+  const connectSrc = connect ? `'self' ${connect}`.trim() : "'none'";
   return [
     "default-src 'none'",
-    `script-src 'self' 'unsafe-inline' 'unsafe-eval' ${resource}`.trim(),
+    `script-src 'self' 'unsafe-inline' ${resource}`.trim(),
     `style-src 'self' 'unsafe-inline' ${resource}`.trim(),
-    `img-src 'self' data: blob: ${resource}`.trim(),
-    `font-src 'self' data: ${resource}`.trim(),
-    `connect-src 'self' ${connect}`.trim(),
-    `media-src 'self' data: blob: ${resource}`.trim(),
+    `img-src 'self' data: ${resource}`.trim(),
+    `font-src 'self' ${resource}`.trim(),
+    `connect-src ${connectSrc}`,
+    `media-src 'self' data: ${resource}`.trim(),
     `frame-src ${frames}`,
     `base-uri ${base}`,
-    "object-src 'none'",
-    "form-action 'self'"
+    "object-src 'none'"
   ].join("; ");
 }
 function htmlText(text7, blob) {
@@ -13917,8 +13972,10 @@ function originList(value) {
   return out;
 }
 function originToken(value) {
+  const trimmed = value.trim();
+  if (/^(https?|wss?):\/\/\*\.[a-z0-9.-]+(?::\d+)?$/i.test(trimmed)) return trimmed;
   try {
-    const url = new URL(value.trim());
+    const url = new URL(trimmed);
     if (url.protocol !== "https:" && url.protocol !== "http:" && url.protocol !== "wss:" && url.protocol !== "ws:") {
       return null;
     }
@@ -15279,6 +15336,524 @@ var init_orch_mcp_isolation = __esm({
   }
 });
 
+// src/mcp-ui/visibility.ts
+function visibilityFromMeta(meta) {
+  const rec = asRecord4(meta);
+  const ui = asRecord4(rec.ui);
+  const raw = ui.visibility;
+  if (!Array.isArray(raw)) return ["model", "app"];
+  const out = [];
+  for (const item of raw) {
+    if (item !== "model" && item !== "app") continue;
+    if (!out.includes(item)) out.push(item);
+  }
+  return out.length ? out : ["model", "app"];
+}
+function toolVisibleTo(visibility, audience) {
+  const vis = visibility?.length ? visibility : ["model", "app"];
+  return vis.includes(audience);
+}
+function asRecord4(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  return value;
+}
+var init_visibility = __esm({
+  "src/mcp-ui/visibility.ts"() {
+    "use strict";
+  }
+});
+
+// src/mcp-ui/proxy-server.ts
+function attachMcpUiProxyHandlers(server, session) {
+  server.setRequestHandler(import_types.ListToolsRequestSchema, async () => {
+    const tools = await session.listTools();
+    return { tools: tools.filter((tool) => toolVisibleTo(tool.visibility, "model")).map(listedTool) };
+  });
+  server.setRequestHandler(import_types.CallToolRequestSchema, async (request) => {
+    const name = request.params.name;
+    const tools = await session.listTools();
+    const tool = tools.find((item) => item.name === name);
+    if (!tool || !toolVisibleTo(tool.visibility, "model")) {
+      throw new Error(`Tool ${name} is not available to the model`);
+    }
+    return await session.callTool(name, request.params.arguments ?? {});
+  });
+  server.setRequestHandler(import_types.ReadResourceRequestSchema, async (request) => {
+    const resource = await session.readResource(request.params.uri);
+    if (!resource) throw new Error(`Resource ${request.params.uri} was empty`);
+    return {
+      contents: [
+        {
+          uri: resource.uri,
+          ...resource.mimeType ? { mimeType: resource.mimeType } : {},
+          ...resource.text != null ? { text: resource.text } : {},
+          ...resource.blob != null ? { blob: resource.blob } : {}
+        }
+      ]
+    };
+  });
+  server.setRequestHandler(import_types.ListResourcesRequestSchema, async () => session.listResources());
+  server.setRequestHandler(
+    import_types.ListResourceTemplatesRequestSchema,
+    async () => session.listResourceTemplates()
+  );
+  server.setRequestHandler(import_types.ListPromptsRequestSchema, async () => session.listPrompts());
+  server.setRequestHandler(import_types.GetPromptRequestSchema, async (request) => {
+    return await session.getPrompt(request.params.name, request.params.arguments);
+  });
+  server.fallbackRequestHandler = async (request) => {
+    return await session.forward(request.method, request.params);
+  };
+}
+function listedTool(tool) {
+  return {
+    name: tool.name,
+    ...tool.description ? { description: tool.description } : {},
+    inputSchema: tool.inputSchema ?? { type: "object", properties: {} },
+    _meta: {
+      ui: {
+        ...tool.resourceUri ? { resourceUri: tool.resourceUri } : {},
+        visibility: tool.visibility
+      }
+    }
+  };
+}
+var import_server, import_types;
+var init_proxy_server = __esm({
+  "src/mcp-ui/proxy-server.ts"() {
+    "use strict";
+    import_server = require("@modelcontextprotocol/sdk/server/index.js");
+    import_types = require("@modelcontextprotocol/sdk/types.js");
+    init_visibility();
+  }
+});
+
+// src/mcp-ui/proxy-http.ts
+async function listenMcpUiProxy(opts) {
+  const token = (0, import_node_crypto11.randomBytes)(24).toString("hex");
+  const transports = /* @__PURE__ */ new Map();
+  const httpServer = (0, import_node_http.createServer)((req, res) => {
+    void handle(req, res);
+  });
+  await new Promise((resolve3, reject) => {
+    httpServer.once("error", reject);
+    httpServer.listen(0, "127.0.0.1", () => resolve3());
+  });
+  const addr = httpServer.address();
+  if (!addr || typeof addr === "string") throw new Error("mcp-ui proxy failed to bind");
+  const origin = `http://127.0.0.1:${addr.port}`;
+  async function handle(req, res) {
+    if (req.headers.authorization !== `Bearer ${token}`) {
+      res.writeHead(401).end();
+      return;
+    }
+    const target = parseMcpUiProxyPath(req.url);
+    if (!target) {
+      res.writeHead(404).end();
+      return;
+    }
+    try {
+      const session = await opts.sessionFor(target.server, target.dirsKey);
+      if (!session) {
+        res.writeHead(404).end();
+        return;
+      }
+      const header = req.headers["mcp-session-id"];
+      const sid = typeof header === "string" ? header : "";
+      const sessionKey = `${target.server}:${target.dirsKey}`;
+      let transport = sid ? transports.get(`${sessionKey}:${sid}`) : void 0;
+      if (!transport) {
+        if (req.method !== "POST") {
+          res.writeHead(400).end();
+          return;
+        }
+        const created = new import_streamableHttp.StreamableHTTPServerTransport({
+          sessionIdGenerator: () => (0, import_node_crypto11.randomUUID)(),
+          allowedHosts: ["127.0.0.1", "localhost"],
+          onsessioninitialized: (id) => {
+            transports.set(`${sessionKey}:${id}`, created);
+          },
+          onsessionclosed: (id) => {
+            transports.delete(`${sessionKey}:${id}`);
+          }
+        });
+        transport = created;
+        const mcp = new import_server2.Server(
+          { name: `sideboard-ui-proxy-${target.server}`, version: "1.0.0" },
+          { capabilities: session.capabilities() }
+        );
+        attachMcpUiProxyHandlers(mcp, session);
+        await mcp.connect(created);
+      }
+      await transport.handleRequest(req, res);
+    } catch {
+      if (!res.headersSent) res.writeHead(500).end();
+    }
+  }
+  return {
+    urlFor(server, dirsKey) {
+      const base = `${origin}/s/${encodeURIComponent(server)}`;
+      return dirsKey ? `${base}/d/${dirsKey}` : base;
+    },
+    headers: { Authorization: `Bearer ${token}` },
+    async close() {
+      await Promise.all([...transports.values()].map((item) => item.close().catch(() => void 0)));
+      transports.clear();
+      await new Promise((resolve3) => httpServer.close(() => resolve3()));
+    }
+  };
+}
+function parseMcpUiProxyPath(url) {
+  const path2 = (url ?? "").split("?")[0] ?? "";
+  if (!path2.startsWith("/s/")) return null;
+  const rest = path2.slice(3).replace(/\/$/, "");
+  const split = rest.indexOf("/d/");
+  try {
+    if (split < 0) {
+      const server2 = decodeURIComponent(rest).trim();
+      return server2 ? { server: server2, dirsKey: "" } : null;
+    }
+    const server = decodeURIComponent(rest.slice(0, split)).trim();
+    const dirsKey = rest.slice(split + 3);
+    if (!server || !/^[a-f0-9]{16}$/.test(dirsKey)) return null;
+    return { server, dirsKey };
+  } catch {
+    return null;
+  }
+}
+var import_node_crypto11, import_node_http, import_server2, import_streamableHttp;
+var init_proxy_http = __esm({
+  "src/mcp-ui/proxy-http.ts"() {
+    "use strict";
+    import_node_crypto11 = require("crypto");
+    import_node_http = require("http");
+    import_server2 = require("@modelcontextprotocol/sdk/server/index.js");
+    import_streamableHttp = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
+    init_proxy_server();
+  }
+});
+
+// src/mcp-ui/session.ts
+async function orEmpty(run2, fallback) {
+  try {
+    return await run2();
+  } catch {
+    return fallback;
+  }
+}
+async function openMcpUiSession(launch) {
+  return openMcpUiSessionFromTransport(transportForLaunch(launch));
+}
+async function openMcpUiSessionFromTransport(transport) {
+  const client = new import_client.Client(
+    { name: "sideboard", version: "1.0.0" },
+    { capabilities: UI_CAPABILITIES }
+  );
+  await client.connect(transport, { timeout: REQUEST_TIMEOUT_MS });
+  return {
+    async listTools() {
+      const listed = await client.listTools(void 0, { timeout: REQUEST_TIMEOUT_MS });
+      return listed.tools.map((tool) => {
+        const meta = tool._meta;
+        return {
+          name: tool.name,
+          ...tool.description ? { description: tool.description } : {},
+          ...tool.inputSchema ? { inputSchema: tool.inputSchema } : {},
+          resourceUri: uiResourceUriFromMeta(meta),
+          visibility: visibilityFromMeta(meta),
+          ...cspFromMeta(meta) ? { csp: cspFromMeta(meta) } : {}
+        };
+      });
+    },
+    listResources: () => orEmpty(
+      () => client.listResources(void 0, { timeout: REQUEST_TIMEOUT_MS }),
+      { resources: [] }
+    ),
+    listResourceTemplates: () => orEmpty(
+      () => client.listResourceTemplates(void 0, { timeout: REQUEST_TIMEOUT_MS }),
+      { resourceTemplates: [] }
+    ),
+    listPrompts: () => orEmpty(
+      () => client.listPrompts(void 0, { timeout: REQUEST_TIMEOUT_MS }),
+      { prompts: [] }
+    ),
+    getPrompt(name, args) {
+      return client.getPrompt({ name, arguments: args }, { timeout: REQUEST_TIMEOUT_MS });
+    },
+    async readResource(uri) {
+      const result = await client.readResource({ uri }, { timeout: REQUEST_TIMEOUT_MS });
+      const content = result.contents?.[0];
+      if (!content) return null;
+      const text7 = "text" in content && typeof content.text === "string" ? content.text : void 0;
+      const blob = "blob" in content && typeof content.blob === "string" ? content.blob : void 0;
+      return {
+        uri: content.uri,
+        ...content.mimeType ? { mimeType: content.mimeType } : {},
+        ...text7 != null ? { text: text7 } : {},
+        ...blob != null ? { blob } : {},
+        ...cspFromMeta(content._meta) ? { csp: cspFromMeta(content._meta) } : {}
+      };
+    },
+    async callTool(name, args) {
+      return client.callTool({ name, arguments: args }, void 0, { timeout: REQUEST_TIMEOUT_MS });
+    },
+    capabilities() {
+      const caps = client.getServerCapabilities() ?? {};
+      return {
+        tools: caps.tools ?? {},
+        resources: caps.resources ?? {},
+        prompts: caps.prompts ?? {},
+        completions: caps.completions ?? {},
+        ...caps.logging ? { logging: caps.logging } : {}
+      };
+    },
+    forward(method, params) {
+      return client.request(
+        { method, params },
+        import_types2.ResultSchema,
+        { timeout: REQUEST_TIMEOUT_MS }
+      );
+    },
+    async close() {
+      await client.close();
+    }
+  };
+}
+function transportForLaunch(launch) {
+  if (launch.kind === "stdio") {
+    return new import_stdio.StdioClientTransport({
+      command: launch.command,
+      args: launch.args,
+      env: { ...(0, import_stdio.getDefaultEnvironment)(), ...launch.env },
+      stderr: "ignore",
+      ...launch.cwd ? { cwd: launch.cwd } : {}
+    });
+  }
+  const url = new URL(launch.url);
+  const requestInit = launch.headers ? { headers: launch.headers } : void 0;
+  if (launch.kind === "sse") {
+    return new import_sse.SSEClientTransport(url, requestInit ? { requestInit } : void 0);
+  }
+  return new import_streamableHttp2.StreamableHTTPClientTransport(url, requestInit ? { requestInit } : void 0);
+}
+var import_client, import_sse, import_stdio, import_streamableHttp2, import_types2, REQUEST_TIMEOUT_MS, UI_CAPABILITIES;
+var init_session = __esm({
+  "src/mcp-ui/session.ts"() {
+    "use strict";
+    import_client = require("@modelcontextprotocol/sdk/client/index.js");
+    import_sse = require("@modelcontextprotocol/sdk/client/sse.js");
+    import_stdio = require("@modelcontextprotocol/sdk/client/stdio.js");
+    import_streamableHttp2 = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
+    import_types2 = require("@modelcontextprotocol/sdk/types.js");
+    init_meta();
+    init_visibility();
+    REQUEST_TIMEOUT_MS = 2e4;
+    UI_CAPABILITIES = {
+      extensions: {
+        "io.modelcontextprotocol/ui": {
+          mimeTypes: ["text/html;profile=mcp-app"]
+        }
+      }
+    };
+  }
+});
+
+// src/mcp-ui/host.ts
+function getMcpUiHost() {
+  if (!singleton) {
+    singleton = new McpUiHost({
+      entries: (projectDirs) => listUserClaudeMcpServerEntries((0, import_node_os16.homedir)(), projectDirs)
+    });
+  }
+  return singleton;
+}
+async function proxyClaudeUserMcp(orchestrator, projectDirs) {
+  if (orchestrator) return {};
+  const dirs = projectDirs.filter((d) => typeof d === "string" && d.length > 0);
+  return getMcpUiHost().proxyEntries(listUserClaudeMcpServerEntries((0, import_node_os16.homedir)(), dirs), dirs);
+}
+function closeMcpUiHost() {
+  const host = singleton;
+  singleton = void 0;
+  if (host) void host.closeAll();
+}
+function dirsKeyFor(projectDirs) {
+  if (!projectDirs?.length) return "";
+  return (0, import_node_crypto12.createHash)("sha256").update(projectDirs.join("\0")).digest("hex").slice(0, 16);
+}
+var import_node_crypto12, import_node_os16, TOOL_TTL_MS, McpUiHost, singleton;
+var init_host = __esm({
+  "src/mcp-ui/host.ts"() {
+    "use strict";
+    import_node_crypto12 = require("crypto");
+    import_node_os16 = require("os");
+    init_orch_mcp_isolation();
+    init_meta();
+    init_proxy_http();
+    init_session();
+    init_visibility();
+    TOOL_TTL_MS = 5 * 60 * 1e3;
+    McpUiHost = class {
+      constructor(opts) {
+        this.opts = opts;
+      }
+      opts;
+      sessions = /* @__PURE__ */ new Map();
+      toolLists = /* @__PURE__ */ new Map();
+      proxy;
+      proxyDirs = /* @__PURE__ */ new Map();
+      async viewForClaudeTool(toolName, projectDirs) {
+        const entries = this.userEntries(projectDirs);
+        const match = matchClaudeMcpTool(toolName, Object.keys(entries));
+        if (!match) return null;
+        const launch = parseMcpServerLaunch(entries[match.server] ?? {});
+        if (!launch) return null;
+        try {
+          const session = await this.sessionFor(match.server, launch);
+          const tools = await this.toolsFor(match.server, launch, session);
+          const tool = tools.find((item) => item.name === match.tool);
+          if (!tool?.resourceUri) return null;
+          const resource = await session.readResource(tool.resourceUri);
+          if (!resource) return null;
+          const html = htmlFromResourceContent(resource);
+          if (!html) return null;
+          const csp = resource.csp ?? tool.csp;
+          return {
+            server: match.server,
+            tool: match.tool,
+            uri: html.uri,
+            mimeType: html.mimeType,
+            html: html.html,
+            csp: mcpUiContentSecurityPolicy(csp)
+          };
+        } catch (err) {
+          console.error(
+            `[mcp-ui] ${match.server}/${match.tool}:`,
+            err instanceof Error ? err.message : err
+          );
+          return null;
+        }
+      }
+      /**
+       * Point Claude at loopback HTTP so it shares this host's upstream session
+       * and never sees `visibility: ["app"]` tools.
+       */
+      async proxyEntries(entries, projectDirs) {
+        const names = Object.keys(entries).filter((name) => name.trim());
+        if (names.length === 0) return {};
+        const dirsKey = dirsKeyFor(projectDirs);
+        this.proxyDirs.set(dirsKey, projectDirs);
+        try {
+          const listen = await this.ensureProxy();
+          const out = {};
+          for (const name of names) {
+            out[name] = {
+              type: "http",
+              url: listen.urlFor(name, dirsKey),
+              headers: listen.headers
+            };
+          }
+          return out;
+        } catch (err) {
+          console.error("[mcp-ui] proxy:", err instanceof Error ? err.message : err);
+          return { ...entries };
+        }
+      }
+      async callTool(server, tool, args, projectDirs) {
+        const entry = this.userEntries(projectDirs)[server];
+        if (!entry) throw new Error(`MCP server ${server} is not available`);
+        const launch = parseMcpServerLaunch(entry);
+        if (!launch) throw new Error(`MCP server ${server} is not available`);
+        const session = await this.sessionFor(server, launch);
+        const tools = await this.toolsFor(server, launch, session);
+        const info = tools.find((item) => item.name === tool);
+        if (!info || !toolVisibleTo(info.visibility, "app")) {
+          throw new Error(`Tool ${tool} is not available to the app`);
+        }
+        return session.callTool(tool, args);
+      }
+      async readResource(server, uri, projectDirs) {
+        const session = await this.sessionForName(server, projectDirs);
+        if (!session) throw new Error(`MCP server ${server} is not available`);
+        const resource = await session.readResource(uri);
+        if (!resource) throw new Error(`Resource ${uri} was empty`);
+        return {
+          contents: [
+            {
+              uri: resource.uri,
+              ...resource.mimeType ? { mimeType: resource.mimeType } : {},
+              ...resource.text != null ? { text: resource.text } : {},
+              ...resource.blob != null ? { blob: resource.blob } : {}
+            }
+          ]
+        };
+      }
+      async closeAll() {
+        const pending = [...this.sessions.values()];
+        const proxy = this.proxy;
+        this.sessions.clear();
+        this.toolLists.clear();
+        this.proxyDirs.clear();
+        this.proxy = void 0;
+        await Promise.all([
+          ...pending.map((session) => session.then((open) => open.close()).catch(() => void 0)),
+          proxy ? proxy.then((listen) => listen.close()).catch(() => void 0) : Promise.resolve()
+        ]);
+      }
+      ensureProxy() {
+        if (this.proxy) return this.proxy;
+        this.proxy = listenMcpUiProxy({
+          sessionFor: (server, dirsKey) => {
+            if (dirsKey && !this.proxyDirs.has(dirsKey)) return Promise.resolve(null);
+            return this.sessionForName(server, this.proxyDirs.get(dirsKey));
+          }
+        }).catch((err) => {
+          this.proxy = void 0;
+          throw err;
+        });
+        return this.proxy;
+      }
+      userEntries(projectDirs) {
+        const out = {};
+        for (const [name, entry] of Object.entries(this.opts.entries(projectDirs))) {
+          if (!name.trim() || isInjectedOrchMcpName(name) || !entry) continue;
+          out[name] = entry;
+        }
+        return out;
+      }
+      async sessionForName(server, projectDirs) {
+        const entry = this.userEntries(projectDirs)[server];
+        if (!entry) return null;
+        const launch = parseMcpServerLaunch(entry);
+        if (!launch) return null;
+        return this.sessionFor(server, launch);
+      }
+      sessionFor(server, launch) {
+        const key = `${server}
+${JSON.stringify(launch)}`;
+        const existing = this.sessions.get(key);
+        if (existing) return existing;
+        const open = this.opts.openSession ?? openMcpUiSession;
+        const pending = open(launch).catch((err) => {
+          this.sessions.delete(key);
+          throw err;
+        });
+        this.sessions.set(key, pending);
+        return pending;
+      }
+      async toolsFor(server, launch, session) {
+        const key = `${server}
+${JSON.stringify(launch)}`;
+        const cached2 = this.toolLists.get(key);
+        if (cached2 && cached2.key === key && Date.now() - cached2.at < TOOL_TTL_MS) return cached2.tools;
+        const tools = await session.listTools();
+        this.toolLists.set(key, { at: Date.now(), key, tools });
+        return tools;
+      }
+    };
+  }
+});
+
 // src/agents/types.ts
 function planModeTurnInstruction(planMode) {
   return planMode ? PLAN_MODE_INSTRUCTION : PLAN_MODE_OFF_INSTRUCTION;
@@ -15474,7 +16049,7 @@ function entryDir() {
   const cjsDir = typeof __dirname !== "undefined" ? __dirname : "";
   if (cjsDir) return cjsDir;
   try {
-    return (0, import_node_path41.dirname)((0, import_node_url2.fileURLToPath)(import_meta3.url));
+    return (0, import_node_path41.dirname)((0, import_node_url2.fileURLToPath)(import_meta5.url));
   } catch {
     try {
       const req = (0, import_node_module2.createRequire)(process.cwd() + "/");
@@ -15524,7 +16099,7 @@ async function buildClaudeRpcTurnCommand(req) {
     }
   };
 }
-var import_node_fs38, import_node_module2, import_node_path41, import_node_url2, import_meta3;
+var import_node_fs38, import_node_module2, import_node_path41, import_node_url2, import_meta5;
 var init_claude_host = __esm({
   "src/agents/claude-host.ts"() {
     "use strict";
@@ -15536,7 +16111,7 @@ var init_claude_host = __esm({
     init_pilot_tools();
     init_node_launch();
     init_packaged_runtime();
-    import_meta3 = {};
+    import_meta5 = {};
   }
 });
 
@@ -15939,16 +16514,15 @@ function parseIssuesJson(raw) {
   }
   return [];
 }
-var import_node_fs39, import_node_os16, CLAUDE_PROMPT_ARG_MAX, claudeAdapter;
+var import_node_fs39, CLAUDE_PROMPT_ARG_MAX, claudeAdapter;
 var init_claude = __esm({
   "src/agents/claude.ts"() {
     "use strict";
     import_node_fs39 = require("fs");
-    import_node_os16 = require("os");
     init_run();
     init_app_settings();
     init_claude_mcp();
-    init_orch_mcp_isolation();
+    init_host();
     init_error_detail();
     init_message_parts();
     init_injected_mcp();
@@ -16025,7 +16599,7 @@ var init_claude = __esm({
         });
         const injectedBrightsyNames = injectedServers.filter((s) => s.name === "brightsy" || s.name.startsWith("brightsy_")).map((s) => s.name);
         const chromeOn = claudeChromeEnabled();
-        const userMcpEntries = isOrchestrator ? {} : listUserClaudeMcpServerEntries((0, import_node_os16.homedir)(), [thread.repoPath, thread.worktreePath]);
+        const userMcpEntries = await proxyClaudeUserMcp(isOrchestrator, [thread.repoPath, thread.worktreePath]);
         let allowedTools;
         if (isOrchestrator) {
           allowedTools = [
@@ -16327,7 +16901,7 @@ function unwrapCodexMcpResult(result) {
     return String(result);
   }
 }
-function asRecord4(value) {
+function asRecord5(value) {
   if (value && typeof value === "object" && !Array.isArray(value)) {
     return value;
   }
@@ -16507,7 +17081,7 @@ var init_codex = __esm({
             }
             if (itemType === "mcp_tool_call" && item.id && item.server && item.tool) {
               const name = `mcp__${item.server}__${item.tool}`;
-              const input = asRecord4(item.arguments);
+              const input = asRecord5(item.arguments);
               const events = [
                 { type: "tool_use", id: item.id, name, input }
               ];
@@ -16654,7 +17228,7 @@ function thisModuleFile() {
   const cjsDir = typeof __dirname !== "undefined" ? __dirname : "";
   if (cjsDir) return (0, import_node_path43.join)(cjsDir, "cursor-sdk-resolve.js");
   try {
-    return (0, import_node_url3.fileURLToPath)(import_meta4.url);
+    return (0, import_node_url3.fileURLToPath)(import_meta6.url);
   } catch {
     return (0, import_node_path43.join)(process.cwd(), "package.json");
   }
@@ -16753,7 +17327,7 @@ function cursorSdkRipgrepCandidate(opts) {
   const nested = (0, import_node_path43.join)(root, "node_modules", pkg, "bin", bin);
   return (0, import_node_fs41.existsSync)(nested) ? nested : null;
 }
-var import_node_fs41, import_node_module3, import_node_path43, import_node_url3, import_meta4, CURSOR_SDK_INSTALL_HINT;
+var import_node_fs41, import_node_module3, import_node_path43, import_node_url3, import_meta6, CURSOR_SDK_INSTALL_HINT;
 var init_cursor_sdk_resolve = __esm({
   "src/agents/cursor-sdk-resolve.ts"() {
     "use strict";
@@ -16762,7 +17336,7 @@ var init_cursor_sdk_resolve = __esm({
     import_node_path43 = require("path");
     import_node_url3 = require("url");
     init_path();
-    import_meta4 = {};
+    import_meta6 = {};
     CURSOR_SDK_INSTALL_HINT = "Cursor SDK is not installed. Settings \u2192 Agents \u2192 Cursor \u2192 Install (`npm i -g @cursor/sdk`). Sideboard does not ship the SDK \u2014 update it anytime without a new Sideboard build.";
   }
 });
@@ -16812,20 +17386,20 @@ function turnCostUsdFromCursorUsage(before, after) {
   if (!(delta >= 0) || !Number.isFinite(delta)) return void 0;
   return delta / 100;
 }
-function asRecord5(value) {
+function asRecord6(value) {
   if (value && typeof value === "object" && !Array.isArray(value)) {
     return value;
   }
   return void 0;
 }
 function normalizeCursorToolCall(name, args) {
-  const raw = asRecord5(args);
+  const raw = asRecord6(args);
   const toolName = typeof raw?.toolName === "string" && raw.toolName.trim() ? raw.toolName.trim() : null;
-  const looksLikeMcp = name === "mcp" || toolName != null && (typeof raw?.providerIdentifier === "string" || asRecord5(raw?.args) != null);
+  const looksLikeMcp = name === "mcp" || toolName != null && (typeof raw?.providerIdentifier === "string" || asRecord6(raw?.args) != null);
   if (looksLikeMcp && toolName) {
     const providerRaw = typeof raw.providerIdentifier === "string" && raw.providerIdentifier.trim() ? raw.providerIdentifier.trim() : "sideboard";
     const provider = providerRaw.replace(/[^a-zA-Z0-9_-]/g, "_");
-    const nested = asRecord5(raw.args);
+    const nested = asRecord6(raw.args);
     return {
       name: `mcp__${provider}__${toolName}`,
       input: nested ?? { toolName }
@@ -16836,7 +17410,7 @@ function normalizeCursorToolCall(name, args) {
 function unwrapCursorToolResult(result) {
   if (result == null) return void 0;
   if (typeof result === "string") return result;
-  const rec = asRecord5(result);
+  const rec = asRecord6(result);
   if (!rec) {
     try {
       return JSON.stringify(result);
@@ -16847,18 +17421,18 @@ function unwrapCursorToolResult(result) {
   const collectTexts = (items) => {
     const texts = [];
     for (const item of items) {
-      const row2 = asRecord5(item);
+      const row2 = asRecord6(item);
       if (!row2) continue;
       if (typeof row2.text === "string") {
         texts.push(row2.text);
         continue;
       }
-      const nested = asRecord5(row2.text);
+      const nested = asRecord6(row2.text);
       if (typeof nested?.text === "string") texts.push(nested.text);
     }
     return texts;
   };
-  const value = asRecord5(rec.value);
+  const value = asRecord6(rec.value);
   if (value && Array.isArray(value.content)) {
     const texts = collectTexts(value.content);
     if (texts.length) return texts.join("\n");
@@ -16875,10 +17449,10 @@ function unwrapCursorToolResult(result) {
 }
 function cursorToolResultIsError(status, result) {
   if (status === "error") return true;
-  const rec = asRecord5(result);
+  const rec = asRecord6(result);
   if (!rec) return false;
   if (rec.status === "error") return true;
-  const value = asRecord5(rec.value);
+  const value = asRecord6(rec.value);
   return value?.isError === true;
 }
 function cursorSdkMessageToEvents(msg) {
@@ -17097,7 +17671,7 @@ function entryDir2() {
   const cjsDir = typeof __dirname !== "undefined" ? __dirname : "";
   if (cjsDir) return cjsDir;
   try {
-    return (0, import_node_path45.dirname)((0, import_node_url4.fileURLToPath)(import_meta5.url));
+    return (0, import_node_path45.dirname)((0, import_node_url4.fileURLToPath)(import_meta7.url));
   } catch {
     try {
       const req = (0, import_node_module5.createRequire)(process.cwd() + "/");
@@ -17126,7 +17700,7 @@ function cursorRunnerPath() {
   }
   return candidates[0];
 }
-var import_node_fs43, import_node_module5, import_node_path45, import_node_url4, import_meta5, FALLBACK_CURSOR_MODELS, cachedModels, MODEL_CACHE_MS, cursorAdapter;
+var import_node_fs43, import_node_module5, import_node_path45, import_node_url4, import_meta7, FALLBACK_CURSOR_MODELS, cachedModels, MODEL_CACHE_MS, cursorAdapter;
 var init_cursor = __esm({
   "src/agents/cursor.ts"() {
     "use strict";
@@ -17146,7 +17720,7 @@ var init_cursor = __esm({
     init_packaged_runtime();
     init_turn_input();
     init_cursor_events();
-    import_meta5 = {};
+    import_meta7 = {};
     FALLBACK_CURSOR_MODELS = [
       { id: "default", displayName: "Auto" },
       { id: "composer-2.5", displayName: "Composer 2.5" },
@@ -17420,7 +17994,7 @@ var init_opencode_host = __esm({
 });
 
 // src/agents/opencode.ts
-function asRecord6(value) {
+function asRecord7(value) {
   if (value && typeof value === "object" && !Array.isArray(value)) {
     return value;
   }
@@ -17616,7 +18190,7 @@ var init_opencode = __esm({
             const name = part?.tool ?? part?.name ?? obj.tool ?? obj.name ?? "tool";
             const state = part?.state;
             const input = (state?.input && typeof state.input === "object" ? state.input : void 0) ?? part?.input ?? obj.input;
-            const metadata = asRecord6(state?.metadata);
+            const metadata = asRecord7(state?.metadata);
             const id = opencodeToolId(
               name,
               part?.callID ?? part?.id ?? obj.id,
@@ -17651,7 +18225,7 @@ var init_opencode = __esm({
           }
           if (obj.type === "subtask_event") {
             const parentId = str4(obj.childSessionID) ?? str4(obj.childSessionId);
-            const part = asRecord6(obj.part);
+            const part = asRecord7(obj.part);
             if (!parentId || !part) return null;
             if (part.type === "text" && str4(part.text)) {
               return withTaskParent(
@@ -17662,8 +18236,8 @@ var init_opencode = __esm({
             if (part.type === "tool" || str4(part.tool)) {
               const name = str4(part.tool) ?? str4(part.name) ?? "tool";
               const id = str4(part.callID) ?? str4(part.id) ?? `${parentId}-${name}`;
-              const state = asRecord6(part.state);
-              const input = asRecord6(state?.input) ?? asRecord6(part.input);
+              const state = asRecord7(part.state);
+              const input = asRecord7(state?.input) ?? asRecord7(part.input);
               const nested = [
                 withEventParentId({ type: "tool_use", id, name, input }, parentId)
               ];
@@ -20081,7 +20655,7 @@ function forkMessageSlice(from, throughIndex) {
 function buildForkTranscriptAttachment(baseTitle, messages) {
   const title = baseTitle || "Chat";
   return {
-    id: (0, import_node_crypto11.randomUUID)(),
+    id: (0, import_node_crypto13.randomUUID)(),
     name: `Transcript of ${title}.md`,
     kind: "transcript",
     content: formatTranscriptMarkdown(title, messages)
@@ -20140,11 +20714,11 @@ function forkChatTab(input) {
   }
   return tab;
 }
-var import_node_crypto11;
+var import_node_crypto13;
 var init_chat_tabs = __esm({
   "src/threads/chat-tabs.ts"() {
     "use strict";
-    import_node_crypto11 = require("crypto");
+    import_node_crypto13 = require("crypto");
     init_context_compact();
     init_teams();
     init_worktree_labels();
@@ -20443,7 +21017,7 @@ function buildReviewRequestAttachment(content, opts) {
   const path2 = opts?.path ?? REVIEW_SKILL_PATH;
   const name = opts?.name ?? (path2 === REVIEW_SKILL_PATH ? REVIEW_SKILL_NAME : path2 === REPO_REVIEW_PATH || path2 === CONTEXT_REVIEW_PATH ? REPO_REVIEW_NAME : REVIEW_REQUEST_NAME);
   return {
-    id: (0, import_node_crypto12.randomUUID)(),
+    id: (0, import_node_crypto14.randomUUID)(),
     name,
     kind: "file",
     path: path2,
@@ -20499,11 +21073,11 @@ async function requestReview(threadRef, send3) {
   const started = await send3(tab.id, REVIEW_REQUEST_PREFILL);
   return { tab: started, from };
 }
-var import_node_crypto12, import_node_fs49, import_node_path50, REPO_REVIEW_PATH, REPO_REVIEW_NAME, CONTEXT_REVIEW_PATH, REVIEW_REQUEST_PATH, LEGACY_REVIEW_REQUEST_PATH, REVIEW_REQUEST_NAME, REVIEW_REQUEST_PREFILL, LEGACY_REVIEW_TEMPLATE_MARKERS;
+var import_node_crypto14, import_node_fs49, import_node_path50, REPO_REVIEW_PATH, REPO_REVIEW_NAME, CONTEXT_REVIEW_PATH, REVIEW_REQUEST_PATH, LEGACY_REVIEW_REQUEST_PATH, REVIEW_REQUEST_NAME, REVIEW_REQUEST_PREFILL, LEGACY_REVIEW_TEMPLATE_MARKERS;
 var init_request_review = __esm({
   "src/review/request-review.ts"() {
     "use strict";
-    import_node_crypto12 = require("crypto");
+    import_node_crypto14 = require("crypto");
     import_node_fs49 = require("fs");
     import_node_path50 = require("path");
     init_global_workspace();
@@ -22052,8 +22626,28 @@ var init_clone_repo = __esm({
   }
 });
 
+// src/mcp-ui/model-context.ts
+function stashMcpAppModelContext(threadId, text7) {
+  const body = text7.trim().slice(0, 8e3);
+  if (!body) return;
+  updateThread(threadId, { mcpAppModelContext: body });
+}
+function takeMcpAppModelContext(threadId) {
+  const thread = readThread(threadId);
+  const text7 = thread?.mcpAppModelContext?.trim();
+  if (!text7) return void 0;
+  updateThread(threadId, { mcpAppModelContext: null });
+  return text7;
+}
+var init_model_context = __esm({
+  "src/mcp-ui/model-context.ts"() {
+    "use strict";
+    init_thread_store();
+  }
+});
+
 // src/plan/plan-present.ts
-function asRecord7(v) {
+function asRecord8(v) {
   return v != null && typeof v === "object" && !Array.isArray(v) ? v : null;
 }
 function isPresentPlanToolName(name) {
@@ -22072,7 +22666,7 @@ function extractPresentedPlan(parts) {
   for (let i = parts.length - 1; i >= 0; i--) {
     const p = parts[i];
     if (p.type !== "tool" || !isPresentPlanToolName(p.name)) continue;
-    const input = asRecord7(p.input) ?? {};
+    const input = asRecord8(p.input) ?? {};
     const content = typeof input.content === "string" ? input.content : typeof input.plan === "string" ? input.plan : typeof input.markdown === "string" ? input.markdown : "";
     if (!content.trim()) continue;
     const title = typeof input.title === "string" && input.title.trim() ? input.title.trim() : "Plan";
@@ -22527,7 +23121,7 @@ function isUnclaimedSteerRequest(req) {
 }
 function nextSteerRequest(existing) {
   if (existing?.requestId && !existing.claimedAt) return existing;
-  return { requestId: (0, import_node_crypto13.randomUUID)(), requestedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  return { requestId: (0, import_node_crypto15.randomUUID)(), requestedAt: (/* @__PURE__ */ new Date()).toISOString() };
 }
 function claimSteerRequest(threadId) {
   const pending = readThread(threadId)?.steerRequest;
@@ -22536,11 +23130,11 @@ function claimSteerRequest(threadId) {
     steerRequest: { ...pending, claimedAt: (/* @__PURE__ */ new Date()).toISOString() }
   });
 }
-var import_node_crypto13;
+var import_node_crypto15;
 var init_steer_request = __esm({
   "src/orchestrator/steer-request.ts"() {
     "use strict";
-    import_node_crypto13 = require("crypto");
+    import_node_crypto15 = require("crypto");
     init_thread_store();
   }
 });
@@ -22785,8 +23379,8 @@ function resolveAbleTimeOAuthHost(requested, saved) {
   return fromSaved || void 0;
 }
 function createAbleTimePkce() {
-  const verifier = (0, import_node_crypto14.randomBytes)(32).toString("base64url");
-  const challenge = (0, import_node_crypto14.createHash)("sha256").update(verifier).digest("base64url");
+  const verifier = (0, import_node_crypto16.randomBytes)(32).toString("base64url");
+  const challenge = (0, import_node_crypto16.createHash)("sha256").update(verifier).digest("base64url");
   return { verifier, challenge };
 }
 function ableTimeOAuthAuthorizeUrl(clientId, state, codeChallenge, host) {
@@ -22891,7 +23485,7 @@ async function startAbleTimeOAuth(opts) {
     opts?.host,
     loadAppSettings().integrations.abletimeHost
   );
-  const state = (0, import_node_crypto14.randomBytes)(16).toString("hex");
+  const state = (0, import_node_crypto16.randomBytes)(16).toString("hex");
   const pkce = createAbleTimePkce();
   const authorizeUrl = ableTimeOAuthAuthorizeUrl(clientId, state, pkce.challenge, host);
   const timeoutMs = opts?.timeoutMs ?? 5 * 6e4;
@@ -22904,7 +23498,7 @@ async function startAbleTimeOAuth(opts) {
       if (err) reject(err);
       else resolve3(value);
     };
-    const server = (0, import_node_http.createServer)((req, res) => {
+    const server = (0, import_node_http2.createServer)((req, res) => {
       try {
         const url = new URL(req.url || "/", `http://127.0.0.1:${ABLETIME_OAUTH_PORT}`);
         if (url.pathname !== "/callback") {
@@ -22991,12 +23585,12 @@ async function startAbleTimeOAuth(opts) {
     return loadAppSettings();
   }
 }
-var import_node_crypto14, import_node_http, ABLETIME_OAUTH_CALLBACK_PATH, ABLETIME_OAUTH_PORT, ABLETIME_OAUTH_LOCAL_CALLBACK, ABLETIME_OAUTH_REDIRECT, BOUNCE_QUERY_KEYS, BAKED_ABLETIME_OAUTH_CLIENT_ID, ABLETIME_OAUTH_RESOURCE, REFRESH_SKEW_MS2, refreshInFlight2, ABLETIME_OAUTH_CANCELLED, AbleTimeOAuthCancelledError;
+var import_node_crypto16, import_node_http2, ABLETIME_OAUTH_CALLBACK_PATH, ABLETIME_OAUTH_PORT, ABLETIME_OAUTH_LOCAL_CALLBACK, ABLETIME_OAUTH_REDIRECT, BOUNCE_QUERY_KEYS, BAKED_ABLETIME_OAUTH_CLIENT_ID, ABLETIME_OAUTH_RESOURCE, REFRESH_SKEW_MS2, refreshInFlight2, ABLETIME_OAUTH_CANCELLED, AbleTimeOAuthCancelledError;
 var init_abletime_oauth = __esm({
   "src/integrations/abletime-oauth.ts"() {
     "use strict";
-    import_node_crypto14 = require("crypto");
-    import_node_http = require("http");
+    import_node_crypto16 = require("crypto");
+    import_node_http2 = require("http");
     init_fetch();
     init_app_settings();
     init_abletime_mcp();
@@ -23029,7 +23623,7 @@ __export(abletime_rest_exports, {
   looksLikeAbleTimeUlid: () => looksLikeAbleTimeUlid,
   textFromAbleTimeDoc: () => textFromAbleTimeDoc
 });
-function asRecord8(value) {
+function asRecord9(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function asString(value) {
@@ -23037,7 +23631,7 @@ function asString(value) {
 }
 function asList(value) {
   if (Array.isArray(value)) return value;
-  const record = asRecord8(value);
+  const record = asRecord9(value);
   if (!record) return [];
   for (const key of ["data", "tasks", "projects", "users", "items", "results"]) {
     if (Array.isArray(record[key])) return record[key];
@@ -23054,12 +23648,12 @@ function ableTimeDocFromText(text7) {
 }
 function textFromAbleTimeDoc(value) {
   if (typeof value === "string") return value.trim();
-  const record = asRecord8(value);
+  const record = asRecord9(value);
   if (!record) return "";
   if (typeof record.text === "string" && record.text.trim()) return record.text.trim();
   const chunks = [];
   const walk = (node) => {
-    const rec = asRecord8(node);
+    const rec = asRecord9(node);
     if (!rec) return;
     if (typeof rec.text === "string" && rec.text) chunks.push(rec.text);
     if (Array.isArray(rec.content)) rec.content.forEach(walk);
@@ -23121,7 +23715,7 @@ async function restPages(path2, opts, maxPages = 20) {
       query: { ...opts.query, ...cursor ? { cursor } : {} }
     });
     items.push(...asList(raw));
-    const page = asRecord8(asRecord8(raw)?.page);
+    const page = asRecord9(asRecord9(raw)?.page);
     const next = page ? asString(page.nextCursor) : "";
     if (!next) break;
     cursor = next;
@@ -23129,7 +23723,7 @@ async function restPages(path2, opts, maxPages = 20) {
   return items;
 }
 function userDisplayName(raw) {
-  const rec = asRecord8(raw);
+  const rec = asRecord9(raw);
   if (!rec) return null;
   const id = asString(rec.userId) || asString(rec.id);
   const name = [asString(rec.firstName), asString(rec.lastName)].filter(Boolean).join(" ") || asString(rec.username) || asString(rec.email) || asString(rec.name);
@@ -23137,7 +23731,7 @@ function userDisplayName(raw) {
   return { id: id || void 0, name };
 }
 function restTaskToRaw(raw, users) {
-  const rec = asRecord8(raw);
+  const rec = asRecord9(raw);
   if (!rec) return null;
   const id = asString(rec.timeflowTaskId) || asString(rec.taskId) || asString(rec.id);
   const identifier = asString(rec.taskRef) || asString(rec.reference) || id;
@@ -23145,7 +23739,7 @@ function restTaskToRaw(raw, users) {
   if (!id && !identifier && !title) return null;
   const assignee = users.get(asString(rec.assignedUserId));
   const comments = asList(rec.comments).map((item) => {
-    const comment = asRecord8(item) ?? {};
+    const comment = asRecord9(item) ?? {};
     const user = userDisplayName(comment);
     return {
       id: asString(comment.commentId) || asString(comment.id),
@@ -23175,13 +23769,13 @@ function restTaskToRaw(raw, users) {
   };
 }
 function restProjectToRaw(raw) {
-  const rec = asRecord8(raw);
+  const rec = asRecord9(raw);
   if (!rec) return null;
   const id = asString(rec.projectId) || asString(rec.id);
   const name = asString(rec.projectName) || asString(rec.name);
   if (!id && !name) return null;
   const categories = asList(rec.categories).map((item) => {
-    const cat = asRecord8(item) ?? {};
+    const cat = asRecord9(item) ?? {};
     return {
       id: asString(cat.projectCategoryId) || asString(cat.categoryId) || asString(cat.id),
       name: asString(cat.categoryName) || asString(cat.name)
@@ -23193,7 +23787,7 @@ async function listUsers(opts) {
   const users = /* @__PURE__ */ new Map();
   for (const item of await restPages("/users", opts).catch(() => [])) {
     const user = userDisplayName(item);
-    const rec = asRecord8(item);
+    const rec = asRecord9(item);
     const id = user?.id || (rec ? asString(rec.userId) : "");
     if (user && id) users.set(id, user);
   }
@@ -23319,10 +23913,10 @@ async function callAbleTimeRestTool(name, args = {}, opts) {
       if (!project) throw new Error("AbleTime has no projects to create a task in");
       const categories = asList(project.categories);
       const wantedCategory = firstStringArg(args, ["category_id", "categoryId", "category"]);
-      const category = categories.map((item) => asRecord8(item)).find((item) => {
+      const category = categories.map((item) => asRecord9(item)).find((item) => {
         if (!item || !wantedCategory) return false;
         return asString(item.id).toLowerCase() === wantedCategory.toLowerCase() || asString(item.name).toLowerCase() === wantedCategory.toLowerCase();
-      }) ?? asRecord8(categories[0]);
+      }) ?? asRecord9(categories[0]);
       const parentArg = firstStringArg(args, ["parent", "parent_id", "parentId", "related_task_id"]);
       const parentTaskId = parentArg ? await resolveRestParentTaskId(parentArg, requestOpts) : void 0;
       const created = await abletimeRestRequest("/tasks", {
@@ -23336,7 +23930,7 @@ async function callAbleTimeRestTool(name, args = {}, opts) {
         }
       });
       const state = firstStringArg(args, ["state"]);
-      const createdId = asString(asRecord8(created)?.timeflowTaskId);
+      const createdId = asString(asRecord9(created)?.timeflowTaskId);
       const description = asString(args.description);
       if (createdId && description) {
         await abletimeRestRequest(`/tasks/${encodeURIComponent(createdId)}`, {
@@ -23409,7 +24003,7 @@ async function callAbleTimeRestTool(name, args = {}, opts) {
         method: "POST",
         body: { content: ableTimeDocFromText(body) }
       });
-      const rec = asRecord8(created) ?? {};
+      const rec = asRecord9(created) ?? {};
       return {
         id: asString(rec.commentId) || void 0,
         body: textFromAbleTimeDoc(rec.content) || body
@@ -23504,7 +24098,7 @@ function rewriteAbleTimeError(message) {
   }
   return message;
 }
-function asRecord9(value) {
+function asRecord10(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function parseSseJson(body) {
@@ -23526,12 +24120,12 @@ function parseSseJson(body) {
   }
 }
 function unwrapToolResult(result) {
-  const record = asRecord9(result);
+  const record = asRecord10(result);
   if (!record) return result;
   const content = record.content;
   if (Array.isArray(content)) {
     const texts = content.map((part) => {
-      const item = asRecord9(part);
+      const item = asRecord10(part);
       if (!item) return "";
       return typeof item.text === "string" ? item.text : "";
     }).filter(Boolean);
@@ -23553,7 +24147,7 @@ function unwrapToolResult(result) {
   return result;
 }
 function textsFromUnknown(value) {
-  const record = asRecord9(value);
+  const record = asRecord10(value);
   if (!record) return "";
   if (typeof record.message === "string") return record.message;
   if (typeof record.error === "string") return record.error;
@@ -23600,7 +24194,7 @@ async function abletimeMcpRequest(method, params, opts) {
       return parseSseJson(body);
     }
   })();
-  const rpc = asRecord9(parsed);
+  const rpc = asRecord10(parsed);
   if (rpc?.error) {
     const detail = typeof rpc.error.message === "string" && rpc.error.message.trim() ? rpc.error.message : `AbleTime MCP error ${rpc.error.code ?? ""}`.trim();
     throw new Error(rewriteAbleTimeError(detail));
@@ -23755,7 +24349,7 @@ function uniqueAttachmentFileName(dir, originalName) {
     const candidate = `${stem}-${i}${ext}`;
     if (!(0, import_node_fs55.existsSync)((0, import_node_path56.join)(dir, candidate))) return candidate;
   }
-  return `${stem}-${(0, import_node_crypto15.randomUUID)()}${ext}`;
+  return `${stem}-${(0, import_node_crypto17.randomUUID)()}${ext}`;
 }
 function extractHttpUrls(markdown) {
   const text7 = markdown ?? "";
@@ -23861,13 +24455,13 @@ async function downloadAuthenticatedFile(opts) {
     ...contentType ? { contentType } : {}
   };
 }
-var import_node_fs55, import_node_path56, import_node_crypto15, ISSUE_ATTACHMENT_MAX_BYTES, MARKDOWN_IMAGE_RE, MARKDOWN_LINK_RE, HTML_SRC_RE, BARE_URL_RE, EXT_BY_MIME;
+var import_node_fs55, import_node_path56, import_node_crypto17, ISSUE_ATTACHMENT_MAX_BYTES, MARKDOWN_IMAGE_RE, MARKDOWN_LINK_RE, HTML_SRC_RE, BARE_URL_RE, EXT_BY_MIME;
 var init_issue_attachments = __esm({
   "src/integrations/issue-attachments.ts"() {
     "use strict";
     import_node_fs55 = require("fs");
     import_node_path56 = require("path");
-    import_node_crypto15 = require("crypto");
+    import_node_crypto17 = require("crypto");
     init_fetch();
     init_workspace_scratch();
     ISSUE_ATTACHMENT_MAX_BYTES = 25 * 1024 * 1024;
@@ -23892,7 +24486,7 @@ var init_issue_attachments = __esm({
 });
 
 // src/integrations/abletime-attachments.ts
-function asRecord10(value) {
+function asRecord11(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function asString2(value) {
@@ -23900,7 +24494,7 @@ function asString2(value) {
 }
 function asList2(value) {
   if (Array.isArray(value)) return value;
-  const record = asRecord10(value);
+  const record = asRecord11(value);
   if (!record) return [];
   for (const key of ["data", "tasks", "projects", "items", "results", "nodes"]) {
     if (Array.isArray(record[key])) return record[key];
@@ -23919,9 +24513,9 @@ function filesFromAbleTimeDoc(value) {
   const out = [];
   const seen = /* @__PURE__ */ new Set();
   const walk = (node) => {
-    const rec = asRecord10(node);
+    const rec = asRecord11(node);
     if (!rec) return;
-    const attrs = asRecord10(rec.attrs) ?? rec;
+    const attrs = asRecord11(rec.attrs) ?? rec;
     const url = asString2(attrs.src) || asString2(attrs.href) || asString2(attrs.url) || asString2(attrs.fileUrl) || asString2(attrs.downloadUrl);
     if (url && !seen.has(url)) {
       seen.add(url);
@@ -23939,7 +24533,7 @@ function filesFromAbleTimeDoc(value) {
 function listedAbleTimeFiles(raw) {
   const out = [];
   for (const item of asList2(raw)) {
-    const rec = asRecord10(item);
+    const rec = asRecord11(item);
     if (!rec) continue;
     const url = firstString(rec, ["url", "href", "src", "fileUrl", "downloadUrl", "permalink"]);
     if (!url) continue;
@@ -23959,7 +24553,7 @@ function mapAbleTimeAttachments(record) {
     ...filesFromAbleTimeDoc(record.description),
     ...filesFromAbleTimeDoc(record.content),
     ...asList2(record.comments).flatMap((item) => {
-      const rec = asRecord10(item);
+      const rec = asRecord11(item);
       return rec ? filesFromAbleTimeDoc(rec.content ?? rec.body) : [];
     })
   ].map((file) => ({
@@ -24001,7 +24595,7 @@ async function resolveAbleTimeAttachmentUrl(id, opts) {
     const json = await res.json().catch(() => null);
     const rec = json && typeof json === "object" && !Array.isArray(json) ? json.data && typeof json.data === "object" ? json.data : json : null;
     if (!rec) continue;
-    const url = firstString(rec, ["url", "href", "src", "fileUrl", "downloadUrl"]) || firstString(asRecord10(rec.file), ["url", "href"]);
+    const url = firstString(rec, ["url", "href", "src", "fileUrl", "downloadUrl"]) || firstString(asRecord11(rec.file), ["url", "href"]);
     if (url) {
       return {
         url,
@@ -24043,7 +24637,7 @@ var init_abletime_attachments = __esm({
 });
 
 // src/integrations/abletime-projects.ts
-function asRecord11(value) {
+function asRecord12(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function firstString2(record, keys) {
@@ -24056,7 +24650,7 @@ function firstString2(record, keys) {
 }
 function asList3(value) {
   if (Array.isArray(value)) return value;
-  const record = asRecord11(value);
+  const record = asRecord12(value);
   if (!record) return [];
   for (const key of ["data", "tasks", "projects", "items", "results", "nodes"]) {
     if (Array.isArray(record[key])) return record[key];
@@ -24064,7 +24658,7 @@ function asList3(value) {
   return [];
 }
 function ableTimeProjectFields(nested) {
-  const projectRecord = asRecord11(nested.project);
+  const projectRecord = asRecord12(nested.project);
   const projectId = firstString2(nested, ["project_id", "projectId"]) || firstString2(projectRecord, ["id"]) || void 0;
   const projectName = firstString2(nested, ["project_name", "projectName"]) || firstString2(projectRecord, ["name", "title"]) || void 0;
   if (!projectId && !projectName) return {};
@@ -24077,13 +24671,13 @@ function ableTimeProjectFields(nested) {
   };
 }
 function mapAbleTimeProject(raw) {
-  const record = asRecord11(raw);
+  const record = asRecord12(raw);
   if (!record) return null;
   const id = firstString2(record, ["id", "project_id", "projectId"]);
   const name = firstString2(record, ["name", "title", "projectName"]);
   if (!id && !name) return null;
   const categories = asList3(record.categories ?? record.category).map((item) => {
-    const rec = asRecord11(item);
+    const rec = asRecord12(item);
     if (!rec) return null;
     const categoryId = firstString2(rec, ["id", "category_id", "projectCategoryId", "categoryId"]);
     const categoryName = firstString2(rec, ["name", "title", "categoryName"]);
@@ -24119,7 +24713,7 @@ __export(abletime_exports, {
   updateAbleTimeTask: () => updateAbleTimeTask,
   verifyAbleTimeConnection: () => verifyAbleTimeConnection
 });
-function asRecord12(value) {
+function asRecord13(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function asString3(value) {
@@ -24136,14 +24730,14 @@ function firstString3(record, keys) {
 function firstRecord(record, keys) {
   if (!record) return null;
   for (const key of keys) {
-    const value = asRecord12(record[key]);
+    const value = asRecord13(record[key]);
     if (value) return value;
   }
   return null;
 }
 function asList4(value) {
   if (Array.isArray(value)) return value;
-  const record = asRecord12(value);
+  const record = asRecord13(value);
   if (!record) return [];
   for (const key of ["data", "tasks", "projects", "items", "results", "nodes"]) {
     if (Array.isArray(record[key])) return record[key];
@@ -24155,18 +24749,18 @@ function labelsOf(record) {
   if (!Array.isArray(raw)) return [];
   return raw.map((item) => {
     if (typeof item === "string") return item.trim();
-    const rec = asRecord12(item);
+    const rec = asRecord13(item);
     return rec ? firstString3(rec, ["name", "title", "label"]) : "";
   }).filter(Boolean);
 }
 function commentsOf(record) {
   const out = [];
   for (const item of asList4(record.comments ?? record.notes ?? record.discussion)) {
-    const rec = asRecord12(item);
+    const rec = asRecord13(item);
     if (!rec) continue;
     const body = firstString3(rec, ["body", "text", "comment", "message", "contentSanitized"]) || textFromAbleTimeDoc(rec.content);
     if (!body) continue;
-    const user = firstString3(asRecord12(rec.user) ?? asRecord12(rec.author), ["name", "display_name", "username"]) || firstString3(rec, ["user_name", "author", "username"]);
+    const user = firstString3(asRecord13(rec.user) ?? asRecord13(rec.author), ["name", "display_name", "username"]) || firstString3(rec, ["user_name", "author", "username"]);
     const id = firstString3(rec, ["id", "comment_id", "commentId"]);
     const url = firstString3(rec, ["url", "permalink"]);
     const createdAt = firstString3(rec, ["created_at", "createdAt", "created"]);
@@ -24193,7 +24787,7 @@ function taskUrl(task, host) {
   return `${base}/tasks/${slug}`;
 }
 function mapAbleTimeTask(raw, host) {
-  const record = asRecord12(raw);
+  const record = asRecord13(raw);
   if (!record) return null;
   const nested = firstRecord(record, ["task", "data"]) ?? record;
   const id = firstString3(nested, ["id", "task_id", "taskId", "timeflowTaskId"]);
@@ -24211,7 +24805,7 @@ function mapAbleTimeTask(raw, host) {
     description: firstString3(nested, ["description", "body", "details", "descriptionSanitized"]) || textFromAbleTimeDoc(nested.description) || void 0,
     state: firstString3(nested, ["state", "board_state", "boardState", "status", "taskState"]) || void 0,
     ...ableTimeProjectFields(nested),
-    categoryId: firstString3(nested, ["category_id", "categoryId", "projectCategoryId"]) || firstString3(asRecord12(nested.category), ["id"]) || void 0,
+    categoryId: firstString3(nested, ["category_id", "categoryId", "projectCategoryId"]) || firstString3(asRecord13(nested.category), ["id"]) || void 0,
     assignee: assigneeOf(nested),
     labels: labelsOf(nested),
     comments: commentsOf(nested),
@@ -24261,7 +24855,7 @@ function isOpenTask(task) {
 }
 async function getAbleTimeOrientation(opts) {
   const raw = await callAbleTimeTool("orientation", {}, opts);
-  const record = asRecord12(raw);
+  const record = asRecord13(raw);
   const viewerRec = firstRecord(record, ["viewer", "principal", "user", "actor", "me", "person"]) ?? record;
   const viewer = {
     id: firstString3(viewerRec, ["id", "user_id"]) || void 0,
@@ -24340,7 +24934,7 @@ async function commentAbleTimeTask(input, opts) {
     { id, task_id: id, task: id, body, comment: body, text: body },
     opts
   );
-  const rec = asRecord12(raw);
+  const rec = asRecord13(raw);
   return {
     id: rec ? firstString3(rec, ["id", "comment_id"]) || void 0 : void 0,
     body: rec ? firstString3(rec, ["body", "text", "comment"]) || body : body
@@ -25493,7 +26087,7 @@ function buildQuotaHandoffAttachment(from, limitText, fallbackAgent) {
     ...instructions
   ].join("\n");
   return {
-    id: (0, import_node_crypto16.randomUUID)(),
+    id: (0, import_node_crypto18.randomUUID)(),
     name: orch ? "Orchestration quota handoff.md" : "Quota handoff.md",
     kind: "transcript",
     content: body
@@ -25525,11 +26119,11 @@ function createQuotaFailoverChat(from, fallbackAgent, limitText, opts) {
   }
   return updateThread(tab.id, patch);
 }
-var import_node_crypto16, QUOTA_CONTINUE_PROMPT, QUOTA_CONTINUE_ACCOUNT_PROMPT, QUOTA_RESUME_PROMPT;
+var import_node_crypto18, QUOTA_CONTINUE_PROMPT, QUOTA_CONTINUE_ACCOUNT_PROMPT, QUOTA_RESUME_PROMPT;
 var init_quota_failover = __esm({
   "src/orchestrator/quota-failover.ts"() {
     "use strict";
-    import_node_crypto16 = require("crypto");
+    import_node_crypto18 = require("crypto");
     init_session_quota();
     init_app_settings();
     init_managed_accounts();
@@ -27605,7 +28199,7 @@ function compiledModuleDir() {
   const cjsDir = typeof __dirname !== "undefined" ? __dirname : "";
   if (cjsDir) return cjsDir;
   try {
-    const url = import_meta6.url;
+    const url = import_meta8.url;
     if (typeof url === "string" && url.length > 0) {
       return (0, import_node_path62.dirname)((0, import_node_url5.fileURLToPath)(url));
     }
@@ -27644,7 +28238,7 @@ function formatDetachedJobInvoke(scriptPath) {
   if (resolved) return `node ${JSON.stringify(resolved)}`;
   return "node scripts/detached-job.cjs";
 }
-var import_node_fs63, import_node_path62, import_node_url5, import_meta6, DETACHED_JOB_FILENAMES;
+var import_node_fs63, import_node_path62, import_node_url5, import_meta8, DETACHED_JOB_FILENAMES;
 var init_detached_job_path = __esm({
   "src/skills/detached-job-path.ts"() {
     "use strict";
@@ -27652,7 +28246,7 @@ var init_detached_job_path = __esm({
     import_node_path62 = require("path");
     import_node_url5 = require("url");
     init_packaged_runtime();
-    import_meta6 = {};
+    import_meta8 = {};
     DETACHED_JOB_FILENAMES = ["detached-job.cjs", "detached-job.js"];
   }
 });
@@ -28052,7 +28646,7 @@ function normalizeServiceOrigin(raw, fallback) {
     return fallback;
   }
 }
-function asRecord13(value) {
+function asRecord14(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function asString4(value) {
@@ -28085,7 +28679,7 @@ async function authorizedGet(url, token) {
   });
   const body = await readJson2(res);
   if (!res.ok) {
-    const record = asRecord13(body);
+    const record = asRecord14(body);
     const message = firstString4(record, ["message", "error", "error_description", "detail"]) || (typeof body === "string" ? body.trim().slice(0, 160) : "");
     throw new Error(
       message ? `${res.status}: ${message}` : `Request failed (${res.status})`
@@ -28099,28 +28693,28 @@ async function verifyOptionalService(input) {
   const spec = optionalServiceSpec(input.id);
   try {
     if (input.id === "vercel") {
-      const body2 = asRecord13(await authorizedGet("https://api.vercel.com/v2/user", token));
-      const user = asRecord13(body2?.user) ?? body2;
+      const body2 = asRecord14(await authorizedGet("https://api.vercel.com/v2/user", token));
+      const user = asRecord14(body2?.user) ?? body2;
       const name2 = firstString4(user, ["username", "name", "email"]) || "Vercel user";
       return { viewerName: name2 };
     }
     if (input.id === "supabase") {
       const body2 = await authorizedGet("https://api.supabase.com/v1/organizations", token);
       const list2 = Array.isArray(body2) ? body2 : [];
-      const first2 = asRecord13(list2[0]);
+      const first2 = asRecord14(list2[0]);
       const name2 = firstString4(first2, ["name", "slug"]) || "Supabase";
       return { viewerName: list2.length > 1 ? `${name2} +${list2.length - 1}` : name2 };
     }
     if (input.id === "posthog") {
       const host2 = normalizeServiceOrigin(input.host, spec.defaultHost ?? "https://us.posthog.com");
-      const body2 = asRecord13(await authorizedGet(`${host2}/api/users/@me/`, token));
+      const body2 = asRecord14(await authorizedGet(`${host2}/api/users/@me/`, token));
       const name2 = firstString4(body2, ["email", "distinct_id"]) || [firstString4(body2, ["first_name"]), firstString4(body2, ["last_name"])].filter(Boolean).join(" ") || "PostHog user";
       return { viewerName: name2, host: host2 };
     }
     const host = normalizeServiceOrigin(input.host, spec.defaultHost ?? "https://sentry.io");
     const body = await authorizedGet(`${host}/api/0/organizations/`, token);
     const list = Array.isArray(body) ? body : [];
-    const first = asRecord13(list[0]);
+    const first = asRecord14(list[0]);
     const name = firstString4(first, ["slug", "name"]) || "Sentry";
     return { viewerName: list.length > 1 ? `${name} +${list.length - 1}` : name, host };
   } catch (err) {
@@ -28994,10 +29588,10 @@ function collectActiveRunPorts(runs) {
   return [...ports];
 }
 function getOrchestrator() {
-  if (!singleton) {
-    singleton = new Orchestrator();
+  if (!singleton2) {
+    singleton2 = new Orchestrator();
   }
-  return singleton;
+  return singleton2;
 }
 async function startOrchestration(opts) {
   const repoPath = opts.repoPath?.trim();
@@ -29057,7 +29651,7 @@ async function startOrchestration(opts) {
   }
   return updated;
 }
-var import_node_events, import_node_crypto17, import_node_fs67, LIVE_TURN_SPAWN_GRACE_MS, RUN_SCRIPT_DESKTOP_ADOPT_MS, STALE_AGENT_PID_WAIT_MS, LIGHT_RECONCILE_THROTTLE_MS, Orchestrator, singleton;
+var import_node_events, import_node_crypto19, import_node_fs67, LIVE_TURN_SPAWN_GRACE_MS, RUN_SCRIPT_DESKTOP_ADOPT_MS, STALE_AGENT_PID_WAIT_MS, LIGHT_RECONCILE_THROTTLE_MS, Orchestrator, singleton2;
 var init_orchestrator = __esm({
   "src/orchestrator/orchestrator.ts"() {
     "use strict";
@@ -29065,7 +29659,7 @@ var init_orchestrator = __esm({
     init_injected_notices();
     init_task_state();
     init_wait_for_turn();
-    import_node_crypto17 = require("crypto");
+    import_node_crypto19 = require("crypto");
     import_node_fs67 = require("fs");
     init_error_detail();
     init_run();
@@ -29091,6 +29685,7 @@ var init_orchestrator = __esm({
     init_usage();
     init_thread_store();
     init_desktop_host();
+    init_model_context();
     init_agent_block();
     init_child_halt();
     init_stop_reason();
@@ -30089,6 +30684,7 @@ ${formatEnvReminder(projectNameForRepoPath(thread.repoPath || thread.worktreePat
             orchestrationReminder,
             prGateDirective,
             injectedNoticeContext,
+            takeMcpAppModelContext(threadId),
             expandedPrompt
           ].filter(Boolean).join("\n\n");
           if (!autoContinue && sentAttachments) {
@@ -30717,7 +31313,7 @@ ${formatEnvReminder(projectNameForRepoPath(thread.repoPath || thread.worktreePat
         const request = sameIntent ? pending : {
           op,
           scriptName: scriptName ?? null,
-          requestId: (0, import_node_crypto17.randomUUID)(),
+          requestId: (0, import_node_crypto19.randomUUID)(),
           requestedAt: (/* @__PURE__ */ new Date()).toISOString()
         };
         if (!sameIntent) {
@@ -31838,7 +32434,7 @@ ${formatEnvReminder(projectNameForRepoPath(thread.repoPath || thread.worktreePat
         return thread;
       }
     };
-    singleton = null;
+    singleton2 = null;
   }
 });
 
@@ -32955,6 +33551,7 @@ __export(index_exports, {
   startRelayServer: () => startRelayServer,
   startRemoteAccountLogin: () => startRemoteAccountLogin,
   startSlackOAuth: () => startSlackOAuth,
+  stashMcpAppModelContext: () => stashMcpAppModelContext,
   statWorktreePath: () => statWorktreePath,
   stopAgentRpcServer: () => stopAgentRpcServer,
   stripBrightsyNdjsonNoise: () => stripBrightsyNdjsonNoise,
@@ -33521,7 +34118,7 @@ init_schedule_runner();
 
 // src/host/serve.ts
 var import_node_child_process7 = require("child_process");
-var import_node_os22 = require("os");
+var import_node_os21 = require("os");
 init_system_ca();
 init_app_settings();
 init_desktop_host();
@@ -33534,7 +34131,7 @@ init_system_ca();
 
 // src/slack/public-dns.ts
 var import_node_dns = require("dns");
-var import_node_http2 = require("http");
+var import_node_http3 = require("http");
 var import_node_https = require("https");
 var PUBLIC_DNS = ["1.1.1.1", "8.8.8.8"];
 function finishLookup(options, callback, address, family) {
@@ -33664,213 +34261,12 @@ function buildPathRefAttachment(input) {
 init_stage_files();
 init_orchestrator();
 
-// src/mcp-ui/host.ts
-var import_node_os21 = require("os");
-init_orch_mcp_isolation();
-init_meta();
-
-// src/mcp-ui/session.ts
-var import_client2 = require("@modelcontextprotocol/sdk/client/index.js");
-var import_sse = require("@modelcontextprotocol/sdk/client/sse.js");
-var import_stdio = require("@modelcontextprotocol/sdk/client/stdio.js");
-var import_streamableHttp = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
-init_meta();
-var REQUEST_TIMEOUT_MS = 2e4;
-var UI_CAPABILITIES = {
-  extensions: {
-    "io.modelcontextprotocol/ui": {
-      mimeTypes: ["text/html;profile=mcp-app"]
-    }
-  }
-};
-async function openMcpUiSession(launch) {
-  return openMcpUiSessionFromTransport(transportForLaunch(launch));
-}
-async function openMcpUiSessionFromTransport(transport) {
-  const client = new import_client2.Client(
-    { name: "sideboard", version: "1.0.0" },
-    { capabilities: UI_CAPABILITIES }
-  );
-  await client.connect(transport, { timeout: REQUEST_TIMEOUT_MS });
-  return {
-    async listTools() {
-      const listed = await client.listTools(void 0, { timeout: REQUEST_TIMEOUT_MS });
-      return listed.tools.map((tool) => {
-        const meta = tool._meta;
-        return {
-          name: tool.name,
-          ...tool.description ? { description: tool.description } : {},
-          ...tool.inputSchema ? { inputSchema: tool.inputSchema } : {},
-          resourceUri: uiResourceUriFromMeta(meta),
-          ...cspFromMeta(meta) ? { csp: cspFromMeta(meta) } : {}
-        };
-      });
-    },
-    async readResource(uri) {
-      const result = await client.readResource({ uri }, { timeout: REQUEST_TIMEOUT_MS });
-      const content = result.contents?.[0];
-      if (!content) return null;
-      const text7 = "text" in content && typeof content.text === "string" ? content.text : void 0;
-      const blob = "blob" in content && typeof content.blob === "string" ? content.blob : void 0;
-      return {
-        uri: content.uri,
-        ...content.mimeType ? { mimeType: content.mimeType } : {},
-        ...text7 != null ? { text: text7 } : {},
-        ...blob != null ? { blob } : {},
-        ...cspFromMeta(content._meta) ? { csp: cspFromMeta(content._meta) } : {}
-      };
-    },
-    async callTool(name, args) {
-      return client.callTool({ name, arguments: args }, void 0, { timeout: REQUEST_TIMEOUT_MS });
-    },
-    async close() {
-      await client.close();
-    }
-  };
-}
-function transportForLaunch(launch) {
-  if (launch.kind === "stdio") {
-    return new import_stdio.StdioClientTransport({
-      command: launch.command,
-      args: launch.args,
-      env: { ...(0, import_stdio.getDefaultEnvironment)(), ...launch.env },
-      stderr: "ignore",
-      ...launch.cwd ? { cwd: launch.cwd } : {}
-    });
-  }
-  const url = new URL(launch.url);
-  const requestInit = launch.headers ? { headers: launch.headers } : void 0;
-  if (launch.kind === "sse") {
-    return new import_sse.SSEClientTransport(url, requestInit ? { requestInit } : void 0);
-  }
-  return new import_streamableHttp.StreamableHTTPClientTransport(url, requestInit ? { requestInit } : void 0);
-}
-
-// src/mcp-ui/host.ts
-var TOOL_TTL_MS = 5 * 60 * 1e3;
-var McpUiHost = class {
-  constructor(opts) {
-    this.opts = opts;
-  }
-  opts;
-  sessions = /* @__PURE__ */ new Map();
-  toolLists = /* @__PURE__ */ new Map();
-  async viewForClaudeTool(toolName, projectDirs) {
-    const entries = this.userEntries(projectDirs);
-    const match = matchClaudeMcpTool(toolName, Object.keys(entries));
-    if (!match) return null;
-    const launch = parseMcpServerLaunch(entries[match.server] ?? {});
-    if (!launch) return null;
-    try {
-      const session = await this.sessionFor(match.server, launch);
-      const tools = await this.toolsFor(match.server, launch, session);
-      const tool = tools.find((item) => item.name === match.tool);
-      if (!tool?.resourceUri) return null;
-      const resource = await session.readResource(tool.resourceUri);
-      if (!resource) return null;
-      const html = htmlFromResourceContent(resource);
-      if (!html) return null;
-      const csp = resource.csp ?? tool.csp;
-      return {
-        server: match.server,
-        tool: match.tool,
-        uri: html.uri,
-        mimeType: html.mimeType,
-        html: html.html,
-        csp: mcpUiContentSecurityPolicy(csp)
-      };
-    } catch (err) {
-      console.error(
-        `[mcp-ui] ${match.server}/${match.tool}:`,
-        err instanceof Error ? err.message : err
-      );
-      return null;
-    }
-  }
-  async callTool(server, tool, args, projectDirs) {
-    const session = await this.sessionForName(server, projectDirs);
-    if (!session) throw new Error(`MCP server ${server} is not available`);
-    return session.callTool(tool, args);
-  }
-  async readResource(server, uri, projectDirs) {
-    const session = await this.sessionForName(server, projectDirs);
-    if (!session) throw new Error(`MCP server ${server} is not available`);
-    const resource = await session.readResource(uri);
-    if (!resource) throw new Error(`Resource ${uri} was empty`);
-    return {
-      contents: [
-        {
-          uri: resource.uri,
-          ...resource.mimeType ? { mimeType: resource.mimeType } : {},
-          ...resource.text != null ? { text: resource.text } : {},
-          ...resource.blob != null ? { blob: resource.blob } : {}
-        }
-      ]
-    };
-  }
-  async closeAll() {
-    const pending = [...this.sessions.values()];
-    this.sessions.clear();
-    this.toolLists.clear();
-    await Promise.all(
-      pending.map((session) => session.then((open) => open.close()).catch(() => void 0))
-    );
-  }
-  userEntries(projectDirs) {
-    const out = {};
-    for (const [name, entry] of Object.entries(this.opts.entries(projectDirs))) {
-      if (!name.trim() || isInjectedOrchMcpName(name) || !entry) continue;
-      out[name] = entry;
-    }
-    return out;
-  }
-  async sessionForName(server, projectDirs) {
-    const entry = this.userEntries(projectDirs)[server];
-    if (!entry) return null;
-    const launch = parseMcpServerLaunch(entry);
-    if (!launch) return null;
-    return this.sessionFor(server, launch);
-  }
-  sessionFor(server, launch) {
-    const key = `${server}
-${JSON.stringify(launch)}`;
-    const existing = this.sessions.get(key);
-    if (existing) return existing;
-    const open = this.opts.openSession ?? openMcpUiSession;
-    const pending = open(launch).catch((err) => {
-      this.sessions.delete(key);
-      throw err;
-    });
-    this.sessions.set(key, pending);
-    return pending;
-  }
-  async toolsFor(server, launch, session) {
-    const key = `${server}
-${JSON.stringify(launch)}`;
-    const cached2 = this.toolLists.get(key);
-    if (cached2 && cached2.key === key && Date.now() - cached2.at < TOOL_TTL_MS) return cached2.tools;
-    const tools = await session.listTools();
-    this.toolLists.set(key, { at: Date.now(), key, tools });
-    return tools;
-  }
-};
-var singleton2;
-function getMcpUiHost() {
-  if (!singleton2) {
-    singleton2 = new McpUiHost({
-      entries: (projectDirs) => listUserClaudeMcpServerEntries((0, import_node_os21.homedir)(), projectDirs)
-    });
-  }
-  return singleton2;
-}
-function closeMcpUiHost() {
-  const host = singleton2;
-  singleton2 = void 0;
-  if (host) void host.closeAll();
-}
+// src/remote/phone-mcp-ui-listen.ts
+init_host();
+init_model_context();
 
 // src/remote/phone-chats.ts
-var import_node_crypto18 = require("crypto");
+var import_node_crypto20 = require("crypto");
 init_list_models();
 init_home_board();
 init_stage_files();
@@ -33892,10 +34288,10 @@ var MIN_MD_CHARS = 120;
 function oneLine2(value, max) {
   return value.replace(/[`\r\n]/g, " ").replace(/\s+/g, " ").trim().slice(0, max);
 }
-function asRecord14(value) {
+function asRecord15(value) {
   if (typeof value === "string") {
     try {
-      return asRecord14(JSON.parse(value));
+      return asRecord15(JSON.parse(value));
     } catch {
       return void 0;
     }
@@ -33970,7 +34366,7 @@ function toolContent(input) {
   if (!input) return "";
   const direct = input.content;
   if (typeof direct === "string") return direct;
-  const nested = asRecord14(direct);
+  const nested = asRecord15(direct);
   if (!nested) return "";
   for (const key of ["html", "markup", "text", "source", "content", "code"]) {
     if (typeof nested[key] === "string") return nested[key];
@@ -33993,7 +34389,7 @@ function phoneArtifactText(text7, parts, limit = Number.POSITIVE_INFINITY) {
   const extras = [];
   for (const part of parts ?? []) {
     if (part.type !== "tool" || part.parentId || !isArtifactTool(part.name)) continue;
-    const input = asRecord14(part.input);
+    const input = asRecord15(part.input);
     const content = toolContent(input);
     const hint = artifactHint(content);
     if (hint && hints.has(hint)) continue;
@@ -34012,7 +34408,7 @@ function phoneArtifactText(text7, parts, limit = Number.POSITIVE_INFINITY) {
 ${tail}` : tail;
 }
 function parseOpenArtifact(value, chatId) {
-  const record = asRecord14(value);
+  const record = asRecord15(value);
   if (!record) return "invalid";
   const title = oneLine2(str5(record.title), 200);
   if (!title) return "invalid";
@@ -34035,7 +34431,7 @@ function phoneArtifactDocuments(sources) {
     }
     for (const part of source.parts ?? []) {
       if (part.type !== "tool" || part.parentId || !isArtifactTool(part.name)) continue;
-      const input = asRecord14(part.input);
+      const input = asRecord15(part.input);
       const content = toolContent(input);
       const hint = artifactHint(content);
       if (hint && hints.has(hint)) continue;
@@ -34480,13 +34876,21 @@ function parsePhoneMcpUi(value, op, chatId) {
     }
     return { op: "mcp-ui", chatId, tool: tool2, callId, reqId: reqId2 };
   }
+  if (op === "mcp-ui-context") {
+    const reqId2 = controlText(value, "reqId");
+    const text7 = controlText(value, "text");
+    if (!reqId2 || reqId2.length > 40 || !text7 || text7.length > 8e3) return "invalid";
+    return { op, chatId, reqId: reqId2, text: text7 };
+  }
   if (op !== "mcp-ui-call" && op !== "mcp-ui-read") return "invalid";
   const reqId = controlText(value, "reqId");
   const server = controlText(value, "server");
   if (!reqId || reqId.length > 40 || !server || server.length > 120) return "invalid";
   if (op === "mcp-ui-read") {
     const uri = controlText(value, "uri");
-    if (!uri.startsWith("ui://") || uri.length > 500) return "invalid";
+    if (!uri || uri.length > 500 || /\s/.test(uri) || /^(javascript|data):/i.test(uri)) {
+      return "invalid";
+    }
     return { op, chatId, reqId, server, uri };
   }
   const tool = controlText(value, "tool");
@@ -34708,7 +35112,7 @@ function parsePhoneControl(value) {
   }
   if (op === "pane") return parsePhonePane(value, chatId);
   if (op === "open-artifact") return parseOpenArtifact(value, chatId);
-  if (op === "mcp-ui" || op === "mcp-ui-call" || op === "mcp-ui-read") return parsePhoneMcpUi(value, op, chatId);
+  if (op === "mcp-ui" || op === "mcp-ui-call" || op === "mcp-ui-read" || op === "mcp-ui-context") return parsePhoneMcpUi(value, op, chatId);
   if (op === "open-file" || op === "media") {
     const path2 = textField(value, "path");
     if (!path2 || path2.length > 2e3) return "invalid";
@@ -34975,13 +35379,13 @@ function phoneComposerOptions(thread) {
 }
 function phoneTurnAttachments(draft) {
   const links = (draft.links ?? []).map((link) => ({
-    id: (0, import_node_crypto18.randomUUID)(),
+    id: (0, import_node_crypto20.randomUUID)(),
     name: link.ref,
     kind: "issue",
     content: [`Linked issue: ${link.ref} \u2014 ${link.title}`, link.url ? `URL: ${link.url}` : null].filter(Boolean).join("\n")
   }));
   const files = (draft.files ?? []).map((file) => ({
-    id: (0, import_node_crypto18.randomUUID)(),
+    id: (0, import_node_crypto20.randomUUID)(),
     name: file.name,
     kind: "file",
     previewDataUrl: `data:application/octet-stream;base64,${file.dataBase64}`,
@@ -35317,7 +35721,9 @@ function deliverPhoneTurn(opts, chatId) {
 // src/remote/phone-mcp-ui-listen.ts
 var PHONE_HTML_CAP = 7e5;
 function dispatchPhoneMcpUi(cmd, opts) {
-  if (cmd.op !== "mcp-ui" && cmd.op !== "mcp-ui-call" && cmd.op !== "mcp-ui-read") return false;
+  if (cmd.op !== "mcp-ui" && cmd.op !== "mcp-ui-call" && cmd.op !== "mcp-ui-read" && cmd.op !== "mcp-ui-context") {
+    return false;
+  }
   const thread = readPhoneThread(cmd.chatId);
   const reqId = cmd.reqId;
   const chatId = cmd.chatId;
@@ -35327,6 +35733,11 @@ function dispatchPhoneMcpUi(cmd, opts) {
     return true;
   }
   const projectDirs = [thread.repoPath, thread.worktreePath];
+  if (cmd.op === "mcp-ui-context") {
+    stashMcpAppModelContext(thread.id, cmd.text);
+    emitControl(opts, { op: "mcp-ui-context", chatId, reqId, result: {} });
+    return true;
+  }
   if (cmd.op === "mcp-ui-call") {
     void getMcpUiHost().callTool(cmd.server, cmd.tool, cmd.args, projectDirs).then((result) => emitControl(opts, { op: "mcp-ui-call", chatId, reqId, result })).catch(
       (err) => emitControl(opts, { op: "mcp-ui-call", chatId, reqId, error: phoneError(err) })
@@ -36163,8 +36574,8 @@ init_fetch();
 init_issue_attachments();
 
 // src/integrations/linear-oauth.ts
-var import_node_crypto19 = require("crypto");
-var import_node_http3 = require("http");
+var import_node_crypto21 = require("crypto");
+var import_node_http4 = require("http");
 init_app_settings();
 init_fetch();
 
@@ -36195,8 +36606,8 @@ function linearOAuthCredentials() {
   return { clientId, clientSecret };
 }
 function createLinearPkce() {
-  const verifier = (0, import_node_crypto19.randomBytes)(32).toString("base64url");
-  const challenge = (0, import_node_crypto19.createHash)("sha256").update(verifier).digest("base64url");
+  const verifier = (0, import_node_crypto21.randomBytes)(32).toString("base64url");
+  const challenge = (0, import_node_crypto21.createHash)("sha256").update(verifier).digest("base64url");
   return { verifier, challenge };
 }
 function linearOAuthAuthorizeUrl(clientId, state, codeChallenge) {
@@ -36327,7 +36738,7 @@ async function startLinearOAuth(opts) {
     throw new LinearOAuthCancelledError();
   }
   const { clientId, clientSecret } = linearOAuthCredentials();
-  const state = (0, import_node_crypto19.randomBytes)(16).toString("hex");
+  const state = (0, import_node_crypto21.randomBytes)(16).toString("hex");
   const pkce = createLinearPkce();
   const authorizeUrl = linearOAuthAuthorizeUrl(clientId, state, pkce.challenge);
   const timeoutMs = opts?.timeoutMs ?? 5 * 6e4;
@@ -36340,7 +36751,7 @@ async function startLinearOAuth(opts) {
       if (err) reject(err);
       else resolve3(value);
     };
-    const server = (0, import_node_http3.createServer)((req, res) => {
+    const server = (0, import_node_http4.createServer)((req, res) => {
       try {
         const url = new URL(req.url || "/", `http://127.0.0.1:${LINEAR_OAUTH_PORT}`);
         if (url.pathname !== "/callback") {
@@ -38753,7 +39164,7 @@ function runRemoteHost(opts) {
 init_protocol();
 
 // src/relay/server.ts
-var import_node_http4 = require("http");
+var import_node_http5 = require("http");
 var import_ws4 = require("ws");
 
 // src/slack/oauth-redirect.ts
@@ -39162,7 +39573,7 @@ function connectSession(ws, opts, log) {
 }
 
 // src/slack/relay-protocol.ts
-var import_node_crypto20 = require("crypto");
+var import_node_crypto22 = require("crypto");
 var SLACK_RELAY_PING_INTERVAL_MS = 2e4;
 var SLACK_RELAY_PONG_TIMEOUT_MS = 15e3;
 function slackRelaySessionKey(teamId, userId, deviceId) {
@@ -39172,7 +39583,7 @@ function slackRelayUserKey(teamId, userId) {
   return `${teamId.trim()}:${userId.trim()}`;
 }
 function newSlackRelayEventId() {
-  return (0, import_node_crypto20.randomBytes)(12).toString("hex");
+  return (0, import_node_crypto22.randomBytes)(12).toString("hex");
 }
 function parseSlackRelayClientMessage(raw) {
   try {
@@ -39700,7 +40111,7 @@ async function tryServeStatic(req, res, root) {
 }
 
 // src/remote/hub.ts
-var import_node_crypto21 = require("crypto");
+var import_node_crypto23 = require("crypto");
 init_protocol();
 var CODE_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
 var CODE_TTL_MS = 10 * 60 * 1e3;
@@ -39711,7 +40122,7 @@ function send(socket, msg) {
   }
 }
 function newCode() {
-  const bytes = (0, import_node_crypto21.randomBytes)(6);
+  const bytes = (0, import_node_crypto23.randomBytes)(6);
   let code = "";
   for (let i = 0; i < 6; i++) code += CODE_ALPHABET[bytes[i] % CODE_ALPHABET.length];
   return code;
@@ -39970,7 +40381,7 @@ var RemoteHub = class {
       host.phone = null;
     }
     const created = sessionToken == null;
-    const token = sessionToken ?? (0, import_node_crypto21.randomBytes)(24).toString("hex");
+    const token = sessionToken ?? (0, import_node_crypto23.randomBytes)(24).toString("hex");
     if (host.sessionToken && host.sessionToken !== token) {
       this.phonesByToken.delete(host.sessionToken);
     }
@@ -40022,7 +40433,7 @@ var RemoteHub = class {
 init_protocol();
 
 // src/relay/accounts.ts
-var import_node_crypto22 = require("crypto");
+var import_node_crypto24 = require("crypto");
 var import_node_fs70 = require("fs");
 var import_node_module7 = require("module");
 var import_node_path68 = require("path");
@@ -40041,12 +40452,12 @@ function openDatabase(filePath) {
   return db;
 }
 function sha2562(value) {
-  return (0, import_node_crypto22.createHash)("sha256").update(value).digest("hex");
+  return (0, import_node_crypto24.createHash)("sha256").update(value).digest("hex");
 }
 function sameHash(a, b) {
   const left = Buffer.from(a);
   const right = Buffer.from(b);
-  return left.length === right.length && (0, import_node_crypto22.timingSafeEqual)(left, right);
+  return left.length === right.length && (0, import_node_crypto24.timingSafeEqual)(left, right);
 }
 function normalizeEmail(email) {
   const trimmed = email?.trim().toLowerCase() ?? "";
@@ -40151,7 +40562,7 @@ var RelayAccountStore = class {
         this.insertIdentity(issuer, subject, accountId, email, verified);
       } else {
         const byEmail = verified ? this.accountIdForVerifiedEmail(email) : void 0;
-        accountId = byEmail ?? (0, import_node_crypto22.randomUUID)();
+        accountId = byEmail ?? (0, import_node_crypto24.randomUUID)();
         if (!byEmail) {
           this.db.prepare("INSERT INTO accounts (id, created_at, device_cap) VALUES (?, ?, ?)").run(accountId, Date.now(), RELAY_DEVICE_CAP);
         }
@@ -40273,7 +40684,7 @@ var RelayAccountStore = class {
     ).run(issuer, subject, accountId, email, verified ? 1 : 0);
   }
   mintCredential(accountId) {
-    const credential = (0, import_node_crypto22.randomBytes)(32).toString("hex");
+    const credential = (0, import_node_crypto24.randomBytes)(32).toString("hex");
     this.db.prepare("INSERT INTO credentials (token_hash, account_id, created_at) VALUES (?, ?, ?)").run(sha2562(credential), accountId, Date.now());
     return credential;
   }
@@ -40748,7 +41159,7 @@ async function startRelayServer(opts) {
     sendJson2(res, 200, { ok: true, ...value.payload });
     return true;
   };
-  const httpServer = (0, import_node_http4.createServer)((req, res) => {
+  const httpServer = (0, import_node_http5.createServer)((req, res) => {
     void (async () => {
       const reqUrl = req.url || "/";
       if (accountStore && await handleRelayAccountHttp({
@@ -41085,7 +41496,7 @@ async function bindAbort(signal, stop) {
 }
 function flatInterfaces() {
   const out = [];
-  for (const rows of Object.values((0, import_node_os22.networkInterfaces)())) {
+  for (const rows of Object.values((0, import_node_os21.networkInterfaces)())) {
     if (!rows) continue;
     out.push(...rows);
   }
@@ -41182,7 +41593,7 @@ init_stage_files();
 init_consume_attachments();
 
 // src/composer/pasted-text.ts
-var import_node_crypto23 = require("crypto");
+var import_node_crypto25 = require("crypto");
 var PASTE_ATTACH_MIN_CHARS = 1200;
 var PASTE_ATTACH_MIN_LINES = 15;
 var PASTED_NAME_RE = /^Pasted text #(\d+)\.txt$/i;
@@ -41209,7 +41620,7 @@ function nextPastedTextName(existing) {
 }
 function buildPastedTextAttachment(text7, opts) {
   return {
-    id: opts?.id ?? (0, import_node_crypto23.randomUUID)(),
+    id: opts?.id ?? (0, import_node_crypto25.randomUUID)(),
     name: opts?.name ?? "Pasted text #1.txt",
     kind: "file",
     path: opts?.path,
@@ -41385,7 +41796,7 @@ function createClippedMcpServer() {
 
 // src/mcp/server.ts
 var import_zod11 = require("zod");
-var import_node_crypto26 = require("crypto");
+var import_node_crypto28 = require("crypto");
 var import_node_path73 = require("path");
 init_orchestrator();
 init_task_state();
@@ -42977,7 +43388,7 @@ function registerScheduleTools(server) {
 }
 
 // src/agent-rpc/handlers.ts
-var import_node_crypto24 = require("crypto");
+var import_node_crypto26 = require("crypto");
 var import_node_path70 = require("path");
 init_wait_for_job();
 init_wait_for_turn();
@@ -43008,7 +43419,7 @@ setToolPermissionPublisher({
     }
   }
 });
-function asRecord15(value) {
+function asRecord16(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return {};
   return value;
 }
@@ -43019,12 +43430,12 @@ function invalidParams(message) {
   return Object.assign(new Error(message), { rpcCode: -32602 });
 }
 var handlePermissionAsk = async (params, _ctx) => {
-  const rec = asRecord15(params);
+  const rec = asRecord16(params);
   const threadId = str6(rec.threadId).trim();
   const toolName = str6(rec.toolName).trim();
   if (!threadId) throw invalidParams("threadId is required");
   if (!toolName) throw invalidParams("toolName is required");
-  const input = asRecord15(rec.input);
+  const input = asRecord16(rec.input);
   const ask = {
     threadId,
     toolName,
@@ -43060,7 +43471,7 @@ var handlePermissionAsk = async (params, _ctx) => {
 // src/agent-rpc/handlers.ts
 init_protocol2();
 function presentArtifactResult(input) {
-  const id = input.artifact_id?.trim() || `artifact_${Date.now().toString(36)}_${(0, import_node_crypto24.randomUUID)().slice(0, 8)}`;
+  const id = input.artifact_id?.trim() || `artifact_${Date.now().toString(36)}_${(0, import_node_crypto26.randomUUID)().slice(0, 8)}`;
   return {
     ok: true,
     artifact_id: id,
@@ -43072,7 +43483,7 @@ function presentArtifactResult(input) {
     message: input.type === "log" ? "Log accepted. Same artifact_id appends; send only new lines next time." : "Artifact accepted. Sideboard desktop opens it in the side column beside chat."
   };
 }
-function asRecord16(value) {
+function asRecord17(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return {};
   return value;
 }
@@ -43096,7 +43507,7 @@ async function handleRuntimePing(_params, _ctx) {
   };
 }
 async function handlePresentArtifact(params, _ctx) {
-  const rec = asRecord16(params);
+  const rec = asRecord17(params);
   const title = str7(rec.title).trim();
   const type = str7(rec.type).trim();
   const allowed = ["html", "svg", "markdown", "react", "log"];
@@ -43120,7 +43531,7 @@ async function handlePresentArtifact(params, _ctx) {
   });
 }
 async function handleJobWait(params, ctx, waitFn = waitForDetachedJob) {
-  const rec = asRecord16(params);
+  const rec = asRecord17(params);
   const id = str7(rec.id).trim();
   if (!id) throw invalidParams2("id is required");
   const cwd = jobCwd(rec);
@@ -43144,7 +43555,7 @@ async function handleJobWait(params, ctx, waitFn = waitForDetachedJob) {
   };
 }
 async function handleJobStop(params, _ctx) {
-  const rec = asRecord16(params);
+  const rec = asRecord17(params);
   const id = str7(rec.id).trim();
   if (!id) throw invalidParams2("id is required");
   const reason = str7(rec.reason).trim() || void 0;
@@ -43172,7 +43583,7 @@ async function defaultTurnWait(ref, timeoutMs) {
   });
 }
 async function handleTurnWait(params, ctx, waitFn = defaultTurnWait) {
-  const rec = asRecord16(params);
+  const rec = asRecord17(params);
   const ref = str7(rec.ref).trim();
   if (!ref) throw invalidParams2("ref is required");
   const requested = typeof rec.timeoutMs === "number" && Number.isFinite(rec.timeoutMs) ? rec.timeoutMs : void 0;
@@ -43224,7 +43635,7 @@ init_worktree();
 init_paths();
 
 // src/board/board-pins.ts
-var import_node_crypto25 = require("crypto");
+var import_node_crypto27 = require("crypto");
 var import_node_fs72 = require("fs");
 var import_node_path71 = require("path");
 init_paths();
@@ -43256,7 +43667,7 @@ function addBoardPin(input) {
   const ref = input.ref.trim();
   if (!ref) throw new Error("Board item needs a ref");
   const pin = {
-    id: (0, import_node_crypto25.randomUUID)(),
+    id: (0, import_node_crypto27.randomUUID)(),
     kind: input.kind,
     ref,
     repoPath: input.repoPath.trim(),
@@ -44189,7 +44600,7 @@ async function startMcpServer() {
           const ident = issue?.identifier ?? ref.trim();
           const attachments = issue ? [
             {
-              id: (0, import_node_crypto26.randomUUID)(),
+              id: (0, import_node_crypto28.randomUUID)(),
               name: issue.identifier,
               kind: "issue",
               content: [
@@ -44751,8 +45162,8 @@ init_protocol2();
 init_metadata();
 
 // src/agent-rpc/server.ts
-var import_node_crypto27 = require("crypto");
-var import_node_http5 = require("http");
+var import_node_crypto29 = require("crypto");
+var import_node_http6 = require("http");
 var import_ws5 = require("ws");
 init_protocol2();
 init_metadata();
@@ -44760,7 +45171,7 @@ function tokensEqual(a, b) {
   const left = Buffer.from(a);
   const right = Buffer.from(b);
   if (left.length !== right.length) return false;
-  return (0, import_node_crypto27.timingSafeEqual)(left, right);
+  return (0, import_node_crypto29.timingSafeEqual)(left, right);
 }
 function authTokenFromUpgrade(req) {
   try {
@@ -44793,16 +45204,16 @@ var AgentRpcServer = class {
   async listen(opts = {}) {
     const host = opts.host ?? "127.0.0.1";
     const port = opts.port ?? 0;
-    const authToken = (0, import_node_crypto27.randomBytes)(24).toString("base64url");
+    const authToken = (0, import_node_crypto29.randomBytes)(24).toString("base64url");
     this.meta = {
-      runtimeId: (0, import_node_crypto27.randomUUID)(),
+      runtimeId: (0, import_node_crypto29.randomUUID)(),
       pid: process.pid,
       protocolVersion: AGENT_RPC_PROTOCOL_VERSION,
       authToken,
       startedAt: Date.now(),
       transports: []
     };
-    const http = (0, import_node_http5.createServer)((_req, res) => {
+    const http = (0, import_node_http6.createServer)((_req, res) => {
       res.statusCode = 404;
       res.end();
     });
@@ -45288,6 +45699,8 @@ init_oauth();
 init_injected_mcp();
 init_user_mcp_config();
 init_orch_mcp_isolation();
+init_host();
+init_model_context();
 init_meta();
 
 // src/slack/workspaces.ts
@@ -45386,7 +45799,7 @@ function slackTokenFor(ws, kind = "read") {
 }
 
 // src/slack/oauth.ts
-var import_node_crypto28 = require("crypto");
+var import_node_crypto30 = require("crypto");
 init_app_settings();
 var SLACK_BOT_SCOPES = [
   "app_mentions:read",
@@ -45480,7 +45893,7 @@ async function startSlackOAuth(opts) {
     throw new SlackOAuthCancelledError();
   }
   const { clientId } = slackOAuthCredentials();
-  const state = (0, import_node_crypto28.randomBytes)(16).toString("hex");
+  const state = (0, import_node_crypto30.randomBytes)(16).toString("hex");
   const authorizeUrl = slackOAuthAuthorizeUrl(clientId, state);
   const timeoutMs = opts?.timeoutMs ?? 5 * 6e4;
   const pollIntervalMs = opts?.pollIntervalMs ?? 400;
@@ -46389,7 +46802,7 @@ function resolveSlackListenMode(opts) {
 init_protocol();
 
 // src/relay/account-login.ts
-var import_node_crypto29 = require("crypto");
+var import_node_crypto31 = require("crypto");
 init_fetch();
 init_protocol();
 var RemoteAccountLoginCancelled = class extends Error {
@@ -46457,7 +46870,7 @@ async function readJson4(res, url) {
 async function startRemoteAccountLogin(opts) {
   if (opts.signal?.aborted) throw new RemoteAccountLoginCancelled();
   const origin = (opts.origin ?? remoteAccountHttpOrigin()).replace(/\/+$/, "");
-  const state = (0, import_node_crypto29.randomBytes)(16).toString("hex");
+  const state = (0, import_node_crypto31.randomBytes)(16).toString("hex");
   const timeoutMs = opts.timeoutMs ?? 5 * 6e4;
   const pollIntervalMs = opts.pollIntervalMs ?? 400;
   const linkToken = opts.linkToken?.trim() ?? "";
@@ -47853,6 +48266,7 @@ async function pollSlackOutboundWatches(opts) {
   startRelayServer,
   startRemoteAccountLogin,
   startSlackOAuth,
+  stashMcpAppModelContext,
   statWorktreePath,
   stopAgentRpcServer,
   stripBrightsyNdjsonNoise,