@skein-code/cli 0.3.25 → 0.3.27

package/dist/cli.js

@@ -4,7 +4,7 @@
 import { createInterface as createInterface2 } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 import { writeFile as writeFile3 } from "node:fs/promises";
-import { basename as basename13, resolve as resolve25 } from "node:path";
+import { basename as basename14, resolve as resolve27 } from "node:path";
 import { Command, Option } from "commander";
 import chalk4 from "chalk";
 
@@ -220,7 +220,7 @@ function isSqliteBusy(error) {
 // package.json
 var package_default = {
   name: "@skein-code/cli",
-  version: "0.3.25",
+  version: "0.3.27",
   description: "A context-first, model-agnostic coding agent with an auditable terminal workspace.",
   type: "module",
   license: "MIT",
@@ -236,6 +236,19 @@ var package_default = {
   },
   skein: {
     releaseNotes: [
+      "MCP now follows a no-network search and inspect review before explicit workspace-bound manifest trust and lazy activation",
+      "Declarative capability manifests expose redacted source, version, tools, permissions, network, command, path, sensitive-field, process, and completion-evidence effects",
+      "Persistent disable and revoke unload active remote schemas while manifest fingerprint changes fail closed to untrusted",
+      "Server annotations cannot lower local permissions, named manifests reject injected undeclared schemas, and optional server failures remain isolated",
+      "Only explicitly required trusted MCP servers may block startup, while status inspection no longer connects optional servers",
+      "Sensitive MCP arguments are redacted from terminal, TUI, JSON, and approval events; unsupported external mutations remain completion-unresolved",
+      "Explain and review intents expose smaller built-in schema sets, and MCP activation reports deterministic eager-versus-loaded schema estimates plus top-match evidence",
+      "First-run setup now states that the primary agent needs API credentials and that provider subscriptions or signed-in coding CLIs are separate delegated tools",
+      "Permission prompts show the policy reason, redacted target, working directory, category risk, and explicit once, session, deny, and stop choices",
+      "The Recovery Center joins last-run state, failure repair hints, changed files, checkpoints, diff, audit, rollback, retry, and safe session resume",
+      "Read-only review commands pin working-tree, commit, or branch scope and inject a content-free redacted evidence bundle without storing it in the user transcript",
+      "JSON and JSONL terminal records now follow the published headless v1 schema with stable completed, verification, input, blocked, cancellation, turn, token, and error exit codes",
+      "Short terminal viewports clip long lists without overflow and pending clarifications cannot be consumed by recovery commands",
       "Durable sessions now separate a 250k-token context epoch from a 1m-token lifetime ceiling without changing the session id or deleting transcript history",
       "Content-free epoch handoffs preserve Task Contract criteria, unresolved failure circuits, changed files, and verification receipts across long runs",
       "Intent Sufficiency routes clear requests to execution, repository-inferable gaps to inspection, and genuine product choices to one persisted clarification",
@@ -1949,8 +1962,22 @@ var agentTeamConfigSchema = z2.object({
 }).partial();
 var mcpServerSchema = z2.object({
   enabled: z2.boolean().optional(),
+  required: z2.boolean().optional(),
   transport: z2.enum(["stdio", "http"]).optional(),
   description: z2.string().min(1).max(500).optional(),
+  version: z2.string().min(1).max(128).optional(),
+  tools: z2.array(z2.object({
+    name: z2.string().min(1).max(256),
+    description: z2.string().min(1).max(500).optional(),
+    permissions: z2.array(z2.enum(["read", "write", "shell", "git", "network"])).min(1).max(5),
+    network: z2.array(z2.string().min(1).max(500)).max(32).optional(),
+    commands: z2.array(z2.string().min(1).max(500)).max(32).optional(),
+    paths: z2.array(z2.string().min(1).max(4e3)).max(64).optional(),
+    sensitiveFields: z2.array(z2.string().min(1).max(256)).max(64).optional(),
+    background: z2.boolean().optional(),
+    processTree: z2.boolean().optional(),
+    completionEvidence: z2.enum(["full", "partial", "none"]).optional()
+  }).strict()).max(256).optional(),
   command: z2.string().min(1).max(512).optional(),
   args: z2.array(z2.string().max(4e3)).max(64).optional(),
   cwd: z2.string().max(4e3).optional(),
@@ -1959,7 +1986,33 @@ var mcpServerSchema = z2.object({
   headers: z2.record(z2.string(), z2.string().max(2e4)).optional(),
   timeoutMs: z2.number().int().positive().max(3e5).optional(),
   toolPrefix: z2.string().regex(/^[a-z][a-z0-9_-]{0,24}$/).optional()
-}).strict();
+}).strict().superRefine((server, context) => {
+  const names = /* @__PURE__ */ new Set();
+  for (const [index, tool] of (server.tools ?? []).entries()) {
+    if (names.has(tool.name)) {
+      context.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["tools", index, "name"],
+        message: `duplicate MCP capability tool: ${tool.name}`
+      });
+    }
+    names.add(tool.name);
+    if (tool.permissions.includes("shell") && !tool.commands?.length) {
+      context.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["tools", index, "commands"],
+        message: "MCP shell capability must declare command scopes"
+      });
+    }
+    if (tool.permissions.includes("write") && !tool.paths?.length) {
+      context.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["tools", index, "paths"],
+        message: "MCP write capability must declare path scopes"
+      });
+    }
+  }
+});
 var mcpConfigSchema = z2.object({
   enabled: z2.boolean().optional(),
   connectTimeoutMs: z2.number().int().positive().max(3e5).optional(),
@@ -3136,7 +3189,7 @@ function executableNames(command2) {
   return [command2, ...extensions.map((extension) => `${command2}${extension}`)];
 }
 function runProcess(command2, args, options) {
-  return new Promise((resolve26, reject) => {
+  return new Promise((resolve28, reject) => {
     const started = Date.now();
     const environment = options.inheritEnv === false ? {} : { ...process.env };
     for (const name of options.unsetEnv ?? []) delete environment[name];
@@ -3228,7 +3281,7 @@ function runProcess(command2, args, options) {
         reject(callbackError);
         return;
       }
-      resolve26({
+      resolve28({
         command: [command2, ...args].join(" "),
         exitCode: code ?? (timedOut ? 124 : 1),
         stdout,
@@ -5563,12 +5616,12 @@ function rankMentionSuggestions(candidates, partial, limit = 6) {
 }
 function rankMention(path, needle) {
   const lower = normalizeForMatch(path);
-  const basename14 = lower.slice(lower.lastIndexOf("/") + 1);
+  const basename15 = lower.slice(lower.lastIndexOf("/") + 1);
   const segments = lower.split("/");
   if (!needle) return segments.length * 100 + lower.length;
   if (lower === needle) return 0;
-  if (basename14 === needle) return 10 + lower.length;
-  if (basename14.startsWith(needle)) return 100 + basename14.length + lower.length / 1e3;
+  if (basename15 === needle) return 10 + lower.length;
+  if (basename15.startsWith(needle)) return 100 + basename15.length + lower.length / 1e3;
   if (segments.some((segment) => segment.startsWith(needle))) {
     return 200 + lower.indexOf(needle) + lower.length / 1e3;
   }
@@ -6315,11 +6368,11 @@ var CheckpointStore = class {
   }
   async capture(sessionId, paths, options = {}) {
     validateIdentifier(sessionId, "session");
-    const unique3 = [...new Set(paths)];
-    if (!unique3.length) return void 0;
-    return this.withManagedLease(() => this.captureUnlocked(sessionId, unique3, options));
+    const unique4 = [...new Set(paths)];
+    if (!unique4.length) return void 0;
+    return this.withManagedLease(() => this.captureUnlocked(sessionId, unique4, options));
   }
-  async captureUnlocked(sessionId, unique3, options) {
+  async captureUnlocked(sessionId, unique4, options) {
     const id = `${Date.now().toString(36)}-${randomUUID9()}`;
     const target = join9(this.directory, sessionId, id);
     const blobDirectory = join9(target, "blobs");
@@ -6328,7 +6381,7 @@ var CheckpointStore = class {
     await mkdir7(blobDirectory, { recursive: true });
     await this.assertManagedPath(blobDirectory);
     const entries = [];
-    for (const input2 of unique3) {
+    for (const input2 of unique4) {
       const path = await this.workspace.resolvePath(input2, { allowMissing: true });
       try {
         const info = await lstat10(path);
@@ -8607,6 +8660,16 @@ var ToolRegistry = class {
   has(name) {
     return this.tools.has(name) || this.aliases.has(name);
   }
+  /** Remove one exact tool instance without letting extensions evict core tools. */
+  unregister(name, expected) {
+    const current = this.tools.get(name);
+    if (!current || expected && current !== expected) return false;
+    this.tools.delete(name);
+    for (const [alias, target] of this.aliases) {
+      if (target === name) this.aliases.delete(alias);
+    }
+    return true;
+  }
   list() {
     return [...this.tools.values()];
   }
@@ -11489,6 +11552,7 @@ ${resolvedInput.decision}
             this.session.audit ?? [],
             this.session.duplicationSuppressions ?? []
           ).size > 0,
+          turnDirective.intent,
           request,
           loadedProgressiveTools
         );
@@ -11785,7 +11849,8 @@ ${input2}`
     }
     await this.persist();
     throwIfAborted(options.signal);
-    await emit({ type: "tool_start", call, category: tool.definition.category });
+    const displayCall = redactToolCallForDisplay(call, tool.definition.sensitiveFields ?? []);
+    await emit({ type: "tool_start", call: displayCall, category: tool.definition.category });
     const executionContext = {
       config: this.config,
       workspace: this.workspace,
@@ -11975,13 +12040,17 @@ ${completeContent}`;
       this.recordPermission(call, category, "allow", "Approved for this session.");
       return true;
     }
-    await emit({ type: "permission", call, category });
+    const displayCall = redactToolCallForDisplay(
+      call,
+      this.tools.get(call.name)?.definition.sensitiveFields ?? []
+    );
+    await emit({ type: "permission", call: displayCall, category, reason: decision.reason });
     if (!options.requestPermission) {
       this.recordPermission(call, category, "deny", "No permission handler was available.");
       return false;
     }
     try {
-      const grant = await options.requestPermission(call, category);
+      const grant = await options.requestPermission(displayCall, category, decision.reason);
       const allowed = grant === true || grant === "session";
       if (grant === "session") this.sessionApprovals.add(approvalKey);
       this.recordPermission(
@@ -11996,13 +12065,13 @@ ${completeContent}`;
       return false;
     }
   }
-  recordPermission(call, category, outcome, reason) {
+  recordPermission(call, category, outcome2, reason) {
     this.appendAudit({
       type: "permission",
       toolCallId: call.id,
       tool: call.name,
       category,
-      outcome,
+      outcome: outcome2,
       reason
     });
   }
@@ -12387,6 +12456,20 @@ function combineMeasurementSources(input2, output2, inputTokens, outputTokens) {
 function uniqueCategories(categories) {
   return [...new Set(categories)];
 }
+function redactToolCallForDisplay(call, sensitiveFields) {
+  if (!sensitiveFields.length) return call;
+  const sensitive = new Set(sensitiveFields.map((field) => field.toLocaleLowerCase()));
+  const redact2 = (value, path = []) => {
+    if (Array.isArray(value)) return value.map((item, index) => redact2(item, [...path, String(index)]));
+    if (!value || typeof value !== "object") return value;
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => {
+      const fieldPath = [...path, key].join(".").toLocaleLowerCase();
+      const field = key.toLocaleLowerCase();
+      return [key, sensitive.has(field) || sensitive.has(fieldPath) ? "<redacted>" : redact2(item, [...path, key])];
+    }));
+  };
+  return { ...call, arguments: redact2(call.arguments) };
+}
 function failedResult(call, content, failure) {
   return {
     toolCallId: call.id,
@@ -12402,9 +12485,9 @@ function failureSignatureFromMetadata(value) {
   const signature = value.signature;
   return typeof signature === "string" && signature ? signature : void 0;
 }
-function visibleToolDefinitions(tools, askMode, contractEnabled, artifactReadAvailable, duplicationAvailable, request, loadedProgressiveTools) {
+function visibleToolDefinitions(tools, askMode, contractEnabled, artifactReadAvailable, duplicationAvailable, intent, request, loadedProgressiveTools) {
   const eligible = tools.definitions().filter(
-    (tool) => (!askMode || tool.category === "read") && (contractEnabled || tool.name !== "task_contract") && (artifactReadAvailable || tool.name !== "read_tool_artifact") && (duplicationAvailable || tool.name !== "duplication_audit")
+    (tool) => (!askMode || tool.category === "read") && intentAllowsTool(intent, tool) && (contractEnabled || tool.name !== "task_contract") && (artifactReadAvailable || tool.name !== "read_tool_artifact") && (duplicationAvailable || tool.name !== "duplication_audit")
   );
   const progressive = eligible.filter((tool) => tool.progressive);
   if (progressive.length <= 8) return eligible;
@@ -12413,6 +12496,26 @@ function visibleToolDefinitions(tools, askMode, contractEnabled, artifactReadAva
   }
   return eligible.filter((tool) => !tool.progressive || loadedProgressiveTools.has(tool.name));
 }
+function intentAllowsTool(intent, tool) {
+  if (!BUILTIN_TOOL_NAMES.has(tool.name)) return true;
+  if (intent === "explain") return tool.category === "read";
+  if (intent === "review") return tool.category === "read" || tool.name === "git";
+  return true;
+}
+var BUILTIN_TOOL_NAMES = /* @__PURE__ */ new Set([
+  "read_file",
+  "read_tool_artifact",
+  "list_files",
+  "search_code",
+  "write_file",
+  "apply_patch",
+  "shell",
+  "git",
+  "task",
+  "task_contract",
+  "duplication_audit",
+  "working_memory"
+]);
 function selectProgressiveTools(tools, request, limit) {
   const terms = new Set(request.toLocaleLowerCase().match(/[\p{L}\p{N}_-]{2,}/gu) ?? []);
   return tools.map((tool) => {
@@ -13464,6 +13567,8 @@ var DelegationManager = class {
     return {
       definition: {
         name: "delegate",
+        source: "agent",
+        activation: "always",
         description: "Run independent read-only investigations with specialized isolated agents and return concise evidence-backed summaries.",
         category: "read",
         inputSchema: jsonSchema({
@@ -13511,6 +13616,8 @@ var DelegationManager = class {
     return {
       definition: {
         name: "team_run",
+        source: "agent",
+        activation: "always",
         description: "Run a visible multi-model council: parallel read-only specialists share findings, a reviewer challenges them, and one bounded revision round runs before returning an acceptance report.",
         category: "read",
         inputSchema: jsonSchema({
@@ -13555,6 +13662,8 @@ var DelegationManager = class {
     return {
       definition: {
         name: "writer_run",
+        source: "agent",
+        activation: "always",
         description: "Create one reviewed patch in a disposable Git worktree. This never changes the main workspace; use writer_integrate explicitly after review.",
         category: "write",
         inputSchema: jsonSchema({
@@ -13587,6 +13696,8 @@ var DelegationManager = class {
     return {
       definition: {
         name: "writer_integrate",
+        source: "agent",
+        activation: "always",
         description: "Explicitly apply one accepted writer patch to the main workspace after SHA, HEAD, cleanliness, path, and checkpoint gates pass.",
         category: "write",
         inputSchema: jsonSchema({
@@ -13649,18 +13760,18 @@ var DelegationManager = class {
       await this.recordAgent(board.id, writer, "write");
       const writerFailed = !writer.ok || !draft.patch || !draft.worktreeCleaned || signal?.aborted;
       if (writerFailed) {
-        const outcome = writer.termination === "cancelled" || signal?.aborted ? "cancelled" : "failed";
+        const outcome2 = writer.termination === "cancelled" || signal?.aborted ? "cancelled" : "failed";
         await this.teamStore.recordWriterLane(board.id, {
           profile: profile.name,
           reviewer: reviewer.name,
           baseCommit: draft.baseCommit,
-          outcome,
+          outcome: outcome2,
           patch: draft.patch,
           files: draft.files,
           worktreeCleaned: draft.worktreeCleaned
         });
         await this.teamStore.complete(board.id, { accepted: false, reviewRounds: 0, failed: true });
-        const status2 = outcome === "cancelled" ? "cancelled" : "failed";
+        const status2 = outcome2 === "cancelled" ? "cancelled" : "failed";
         const detail2 = !draft.worktreeCleaned ? "Writer worktree cleanup could not be verified; integration is blocked." : !draft.patch ? "Writer returned no patch." : writer.summary;
         await emit?.({ type: "writer_lane", id: board.id, status: status2, detail: detail2, files: draft.files });
         await emit?.({ type: "team_done", id: board.id, accepted: false, reviewRounds: 0 });
@@ -15009,6 +15120,61 @@ function keyEnvironmentName(provider) {
 // src/cli/output.ts
 import { createInterface } from "node:readline/promises";
 import chalk2, { Chalk } from "chalk";
+
+// src/cli/headless-contract.ts
+var HEADLESS_SCHEMA_VERSION = 1;
+var HEADLESS_EXIT_CODES = {
+  completed: 0,
+  error: 1,
+  needsInput: 2,
+  unverified: 3,
+  verificationFailed: 4,
+  blocked: 5,
+  cancelled: 6,
+  maxTurns: 7,
+  tokenBudget: 8
+};
+function resolveHeadlessOutcome(input2) {
+  if (input2.error !== void 0 || input2.reason === "error") {
+    return outcome("error", HEADLESS_EXIT_CODES.error, input2.reason ?? "error");
+  }
+  if (input2.reason === "needs_input") {
+    return outcome("needs_input", HEADLESS_EXIT_CODES.needsInput, input2.reason);
+  }
+  if (input2.reason === "blocked" || input2.completion?.acceptance?.state === "blocked") {
+    return outcome("blocked", HEADLESS_EXIT_CODES.blocked, input2.reason ?? "blocked");
+  }
+  if (input2.reason === "aborted" || input2.reason === "cancelled") {
+    return outcome("cancelled", HEADLESS_EXIT_CODES.cancelled, input2.reason);
+  }
+  if (input2.reason === "max_turns") {
+    return outcome("max_turns", HEADLESS_EXIT_CODES.maxTurns, input2.reason);
+  }
+  if (input2.reason === "token_budget") {
+    return outcome("token_budget", HEADLESS_EXIT_CODES.tokenBudget, input2.reason);
+  }
+  if (input2.reason === "verification_failed" || input2.completion?.status === "verification_failed") {
+    return outcome("verification_failed", HEADLESS_EXIT_CODES.verificationFailed, input2.reason ?? "verification_failed");
+  }
+  if (input2.reason === "unverified" || input2.completion?.status === "unverified") {
+    return outcome("unverified", HEADLESS_EXIT_CODES.unverified, input2.reason ?? "unverified");
+  }
+  if (input2.completion?.status === "verified") {
+    return outcome("verified", HEADLESS_EXIT_CODES.completed, input2.reason ?? "completed");
+  }
+  return outcome("completed", HEADLESS_EXIT_CODES.completed, input2.reason ?? "completed");
+}
+function outcome(status, exitCode, reason) {
+  return {
+    schemaVersion: HEADLESS_SCHEMA_VERSION,
+    ok: exitCode === HEADLESS_EXIT_CODES.completed,
+    status,
+    exitCode,
+    reason
+  };
+}
+
+// src/cli/output.ts
 var HeadlessReporter = class {
   constructor(options) {
     this.options = options;
@@ -15018,7 +15184,6 @@ var HeadlessReporter = class {
   options;
   finalResponse = "";
   tools = [];
-  eventError;
   context;
   streamedAssistant = false;
   completion;
@@ -15028,7 +15193,6 @@ var HeadlessReporter = class {
   onEvent = (event) => {
     if (event.type === "assistant") this.finalResponse = event.content;
     if (event.type === "tool_result") this.tools.push(event.result);
-    if (event.type === "error") this.eventError = event.error.message;
     if (event.type === "done") {
       this.doneReason = event.reason;
       this.completion = event.completion;
@@ -15046,26 +15210,33 @@ var HeadlessReporter = class {
     this.printText(event);
   };
   finish(session) {
+    const completion = this.completion ?? session.lastRun;
+    const reason = this.doneReason ?? session.lastRun?.reason;
+    const outcome2 = resolveHeadlessOutcome({
+      ...reason ? { reason } : {},
+      ...completion ? { completion } : {}
+    });
     if (this.options.format === "stream-json") {
       process.stdout.write(`${JSON.stringify({
         type: "session",
+        ...outcome2,
         session: sessionSummary(session)
       })}
 `);
-      return;
+      return outcome2;
     }
     if (this.options.format === "json") {
       process.stdout.write(`${JSON.stringify({
-        ok: this.doneReason === void 0 || this.doneReason === "completed" && this.completion?.status !== "verification_failed",
+        type: "result",
+        ...outcome2,
         response: this.finalResponse,
         session: sessionSummary(session),
-        ...this.doneReason ? { reason: this.doneReason } : {},
-        ...this.completion ? { completion: this.completion } : {},
+        ...completion ? { completion } : {},
         ...this.context ? { context: this.context } : {},
         tools: this.tools
       }, null, 2)}
 `);
-      return;
+      return outcome2;
     }
     if (this.options.quiet && this.finalResponse.trim()) {
       process.stdout.write(`${this.finalResponse.trim()}
@@ -15080,17 +15251,34 @@ ${this.glyphs.meta} ${session.changedFiles.length} changed files ${this.glyphs.s
 `
       ));
     }
+    return outcome2;
   }
-  fail(error) {
+  fail(error, session) {
     const message2 = error instanceof Error ? error.message : String(error);
-    if (this.options.format === "stream-json" && this.eventError === message2) return;
-    if (this.options.format === "json" || this.options.format === "stream-json") {
-      process.stdout.write(`${JSON.stringify({ type: "error", ok: false, error: message2 })}
+    const outcome2 = resolveHeadlessOutcome({ reason: "error", error });
+    if (this.options.format === "stream-json") {
+      process.stdout.write(`${JSON.stringify({
+        type: "final",
+        ...outcome2,
+        error: message2,
+        ...session ? { session: sessionSummary(session) } : {}
+      })}
 `);
-      return;
+      return outcome2;
+    }
+    if (this.options.format === "json") {
+      process.stdout.write(`${JSON.stringify({
+        type: "result",
+        ...outcome2,
+        error: message2,
+        ...session ? { session: sessionSummary(session) } : {}
+      }, null, 2)}
+`);
+      return outcome2;
     }
     process.stderr.write(`${this.paint.red(this.glyphs.error)} ${message2}
 `);
+    return outcome2;
   }
   printText(event) {
     const { quiet, compact: compact3 } = this.options;
@@ -15197,6 +15385,7 @@ ${this.glyphs.meta} ${session.changedFiles.length} changed files ${this.glyphs.s
         break;
       case "done":
         this.printCompletion(event.completion);
+        this.printStopReason(event.reason);
         break;
       case "error":
         break;
@@ -15227,8 +15416,20 @@ ${this.glyphs.meta} ${session.changedFiles.length} changed files ${this.glyphs.s
 `
     ));
   }
+  printStopReason(reason) {
+    if (reason === "aborted") {
+      process.stderr.write(this.paint.yellow(`${this.glyphs.warning} cancelled ${this.glyphs.separator} resume with --resume after inspecting the saved session
+`));
+    } else if (reason === "max_turns") {
+      process.stderr.write(this.paint.yellow(`${this.glyphs.warning} turn limit reached ${this.glyphs.separator} resume with --resume and a larger --max-turns value
+`));
+    } else if (reason === "token_budget") {
+      process.stderr.write(this.paint.yellow(`${this.glyphs.warning} token budget reached ${this.glyphs.separator} inspect the saved session before resuming with a larger --token-budget
+`));
+    }
+  }
 };
-async function askConsolePermission(call, category, color = !process.env.NO_COLOR) {
+async function askConsolePermission(call, category, color = !process.env.NO_COLOR, reason = `${category} tools require approval.`) {
   if (!process.stdin.isTTY || !process.stderr.isTTY) return false;
   const paint = color ? chalk2 : new Chalk({ level: 0 });
   const glyphs = resolveCliGlyphs();
@@ -15236,6 +15437,10 @@ async function askConsolePermission(call, category, color = !process.env.NO_COLO
 ${paint.yellow("Permission required")} ${paint.dim(`(${category})`)}
 `);
   process.stderr.write(`${paint.bold(call.name)}${formatToolDetail(call, paint)}
+`);
+  process.stderr.write(`${paint.dim(`Reason: ${reason}`)}
+`);
+  process.stderr.write(`${paint.yellow(`Risk: ${permissionRisk(category)}`)}
 `);
   const readline = createInterface({ input: process.stdin, output: process.stderr });
   try {
@@ -15245,6 +15450,13 @@ ${paint.yellow("Permission required")} ${paint.dim(`(${category})`)}
     readline.close();
   }
 }
+function permissionRisk(category) {
+  if (category === "read") return "workspace content may enter model context";
+  if (category === "write") return "workspace files may be created, replaced, or deleted";
+  if (category === "shell") return "a local process may read or change workspace state";
+  if (category === "git") return "repository state or remotes may change";
+  return "data may leave this machine or remote state may change";
+}
 function eventToJson(event) {
   if (event.type === "error") {
     return { type: event.type, error: event.error.message };
@@ -15350,7 +15562,7 @@ function commandNames(command2) {
 // src/ui/tui.tsx
 import { useCallback, useEffect as useEffect2, useMemo, useRef as useRef2, useState as useState2 } from "react";
 import { Box as Box2, render as render2, Text as Text3, useApp, useInput as useInput2, useWindowSize } from "ink";
-import { relative as relative9 } from "node:path";
+import { relative as relative10 } from "node:path";
 
 // src/ui/components.tsx
 import React2 from "react";
@@ -15369,11 +15581,13 @@ var commandDefinitions = [
   command("skills", "List discovered task playbooks"),
   command("agents", "List built-in and installed expert profiles"),
   command("connections", "Inspect shared model endpoints and setup status", "/connections [setup]"),
-  command("mcp", "Show external MCP server health and tools"),
+  command("mcp", "Search, inspect, trust, activate, disable, or revoke MCP capabilities", "/mcp [search|inspect|trust|activate|disable|revoke] [...]"),
   command("tools", "List built-in and MCP tools with permission categories"),
   command("permissions", "Inspect the active permission policy"),
   command("changes", "List files changed in the active session"),
   command("diff", "Open the current workspace diff in the transcript"),
+  command("review", "Run a read-only review with a fixed, redacted scope", "/review [working-tree|commit <ref>|branch <base-ref>]"),
+  command("recover", "Open recovery actions for the last incomplete run", "/recover [retry|resume|diff|rollback|audit]"),
   command("checkpoints", "List recoverable pre-mutation snapshots"),
   command("audit", "Review the hash-chained tool and permission timeline"),
   command("rollback", "Restore workspace files from a checkpoint", "/rollback [checkpoint-id]"),
@@ -15423,6 +15637,21 @@ function commandSuggestions(input2, options = {}) {
       description: item.description
     }));
   }
+  if (firstSpace >= 0 && commandName === "mcp") {
+    const query = argument.trim().toLocaleLowerCase();
+    return [
+      { name: "search", description: "Search redacted local capability manifests" },
+      { name: "inspect", description: "Review one manifest before trust" },
+      { name: "trust", description: "Trust the current manifest after confirmation" },
+      { name: "activate", description: "Connect a trusted server and load relevant schemas" },
+      { name: "disable", description: "Persistently disable a capability" },
+      { name: "revoke", description: "Revoke trust after confirmation" }
+    ].filter((item) => item.name.includes(query)).map((item) => ({
+      value: `/mcp ${item.name} `,
+      label: item.name,
+      description: item.description
+    }));
+  }
   if (firstSpace >= 0 && commandName === "connections") {
     return [{
       value: "/connections setup",
@@ -15430,6 +15659,28 @@ function commandSuggestions(input2, options = {}) {
       description: "Show the secure shared-connection setup command"
     }].filter((item) => item.label.includes(argument.trim().toLocaleLowerCase()));
   }
+  if (firstSpace >= 0 && commandName === "review") {
+    const query = argument.trim().toLocaleLowerCase();
+    return [
+      { value: "/review working-tree", label: "working-tree", description: "Review only the current working tree" },
+      { value: "/review commit ", label: "commit", description: "Review exactly one Git commit" },
+      { value: "/review branch ", label: "branch", description: "Review the current branch against one base ref" }
+    ].filter((item) => item.label.includes(query) || item.value.slice("/review ".length).startsWith(query));
+  }
+  if (firstSpace >= 0 && commandName === "recover") {
+    const query = argument.trim().toLocaleLowerCase();
+    return [
+      { name: "retry", description: "Repair and retry the latest failed operation once" },
+      { name: "resume", description: "Continue the most recent incomplete logical run" },
+      { name: "diff", description: "Inspect the current workspace patch" },
+      { name: "audit", description: "Review permission and tool evidence" },
+      { name: "rollback", description: "Choose a checkpoint to restore" }
+    ].filter((item) => item.name.includes(query)).map((item) => ({
+      value: `/recover ${item.name}`,
+      label: item.name,
+      description: item.description
+    }));
+  }
   if (firstSpace >= 0 && commandName === "memory") {
     const query = argument.trim().toLocaleLowerCase();
     return [
@@ -16407,7 +16658,7 @@ function TaskRail({ tasks, width = 80, glyphMode = "auto", maxItems }) {
     ] }) : null
   ] });
 }
-function PermissionCard({ call, category, width = 80, glyphMode = "auto", workspace, compact: compact3 = false }) {
+function PermissionCard({ call, category, reason, width = 80, glyphMode = "auto", workspace, compact: compact3 = false }) {
   const theme = useTheme();
   const glyphs = resolveGlyphs(glyphMode);
   const summary = permissionSummary(call);
@@ -16415,7 +16666,9 @@ function PermissionCard({ call, category, width = 80, glyphMode = "auto", worksp
   const innerWidth = Math.max(1, rowWidth - 2);
   const title = truncateDisplay(`Permission required ${glyphs.separator} ${category}`, innerWidth);
   const tool = truncateDisplay(`tool ${sanitizeInlineTerminalText(call.name)}`, innerWidth);
-  const summaryLine = truncateDisplay(`${summary.label} ${summary.value}`, innerWidth);
+  const summaryLine = truncateDisplay(`target ${summary.label} ${summary.value}`, innerWidth);
+  const reasonLine = truncateDisplay(`reason ${redactPermissionText(reason ?? `${category} tools require approval.`)}`, innerWidth);
+  const riskLine = truncateDisplay(`risk ${permissionRisk2(category)}`, innerWidth);
   const argumentCwd = typeof call.arguments.cwd === "string" ? call.arguments.cwd : void 0;
   const cwd = sanitizeInlineTerminalText(argumentCwd || workspace || "");
   const shortcuts = [
@@ -16440,6 +16693,8 @@ function PermissionCard({ call, category, width = 80, glyphMode = "auto", worksp
     /* @__PURE__ */ jsx(PermissionLine, { marker, children: /* @__PURE__ */ jsx(Text, { bold: true, color: theme.warning, children: title }) }),
     /* @__PURE__ */ jsx(PermissionLine, { marker, children: /* @__PURE__ */ jsx(Text, { color: theme.muted, children: tool }) }),
     /* @__PURE__ */ jsx(PermissionLine, { marker, children: /* @__PURE__ */ jsx(Text, { color: theme.text, children: summaryLine }) }),
+    /* @__PURE__ */ jsx(PermissionLine, { marker, children: /* @__PURE__ */ jsx(Text, { color: theme.muted, children: reasonLine }) }),
+    /* @__PURE__ */ jsx(PermissionLine, { marker, children: /* @__PURE__ */ jsx(Text, { color: theme.warning, children: riskLine }) }),
     cwd ? /* @__PURE__ */ jsx(PermissionLine, { marker, children: /* @__PURE__ */ jsx(Text, { color: theme.muted, children: truncateDisplay(`cwd ${compactDisplayPath(cwd, Math.max(1, innerWidth - 4))}`, innerWidth) }) }) : null,
     rowWidth >= 64 ? /* @__PURE__ */ jsx(Box, { paddingLeft: 2, children: /* @__PURE__ */ jsx(InlineRow, { parts: shortcuts, width: innerWidth, separator: `  ${glyphs.separator}  `, separatorColor: theme.border }) }) : rowWidth >= 28 ? /* @__PURE__ */ jsxs(Box, { paddingLeft: 2, flexDirection: "column", children: [
       /* @__PURE__ */ jsx(InlineRow, { parts: shortcuts.slice(0, 2), width: innerWidth, separator: "  ", separatorColor: theme.border }),
@@ -16460,6 +16715,13 @@ function PermissionLine({ marker, children }) {
     children
   ] });
 }
+function permissionRisk2(category) {
+  if (category === "read") return "workspace content may enter model context";
+  if (category === "write") return "workspace files may be created, replaced, or deleted";
+  if (category === "shell") return "a local process may read or change workspace state";
+  if (category === "git") return "repository state or remotes may change";
+  return "data may leave this machine or remote state may change";
+}
 function PromptBar({ busy, value, placeholder, width = 80, mode = "chat", queueCount = 0, queuePreview, attachments = [], glyphMode = "auto", children }) {
   const theme = useTheme();
   const glyphs = resolveGlyphs(glyphMode);
@@ -17744,6 +18006,40 @@ function clipTimelineItem(item, options) {
   if (item.kind === "notice") {
     return { ...item, text: tailText(item.text, width, options.rows) };
   }
+  if (item.kind === "list") {
+    if (options.rows <= 1) return { id: item.id, kind: "notice", text: truncateDisplay(item.title, width) };
+    const available = Math.max(1, options.rows - 2);
+    const entries = [];
+    let used = 0;
+    let firstIncluded = item.entries.length;
+    for (let index = item.entries.length - 1; index >= 0; index -= 1) {
+      const entry = item.entries[index];
+      const rows = 1 + (entry.detail ? 1 : 0);
+      if (entries.length && used + rows > available) break;
+      if (!entries.length && rows > available) {
+        const { detail: _detail, ...compactEntry } = entry;
+        entries.unshift(compactEntry);
+        firstIncluded = index;
+        used = 1;
+        break;
+      }
+      entries.unshift(entry);
+      firstIncluded = index;
+      used += rows;
+    }
+    if (firstIncluded > 0) {
+      while (entries.length > 1 && used >= available) {
+        const removed = entries.shift();
+        if (!removed) break;
+        firstIncluded += 1;
+        used -= 1 + (removed.detail ? 1 : 0);
+      }
+      if (used < available) {
+        entries.unshift({ label: `${terminalEllipsis()} ${firstIncluded} earlier entries hidden` });
+      }
+    }
+    return { ...item, entries };
+  }
   if (item.kind === "update") {
     const baseRows = width < 48 ? 3 : 2;
     if (options.rows < baseRows) {
@@ -17841,6 +18137,91 @@ function wrappedRows(value, width) {
   return sanitizeTerminalText(value).split("\n").reduce((rows, line) => rows + Math.max(1, Math.ceil(displayWidth(line) / safeWidth2)), 0);
 }
 
+// src/ui/review-bundle.ts
+import { relative as relative9 } from "node:path";
+var failureClasses = /* @__PURE__ */ new Set([
+  "schema_input",
+  "unknown_tool",
+  "permission_denied",
+  "command_exit",
+  "timeout",
+  "cancelled",
+  "hook",
+  "execution",
+  "no_progress",
+  "contract_required"
+]);
+function parseReviewScope(argument) {
+  const value = argument.trim();
+  if (!value || value === "working-tree") return { kind: "working-tree" };
+  const [kind, ref, ...extra] = value.split(/\s+/u);
+  if (kind !== "commit" && kind !== "branch" || !ref || extra.length) {
+    throw new Error("Usage: /review [working-tree|commit <ref>|branch <base-ref>]");
+  }
+  if (!/^[A-Za-z0-9._/@{}~^+-]{1,200}$/u.test(ref) || ref.startsWith("-")) {
+    throw new Error("Review refs must be a single Git revision without control characters or leading dashes.");
+  }
+  return { kind, ref };
+}
+function buildRedactedReviewBundle(session, workspaceRoot, scope) {
+  const lastRun = session.lastRun;
+  const failures = (session.audit ?? []).filter((event) => event.type === "tool" && event.outcome === "failure").slice(-8).map((event) => {
+    const receipt = failureReceipt2(event.metadata?.failure);
+    return {
+      tool: event.tool,
+      ...event.category ? { category: event.category } : {},
+      ...receipt?.class ? { class: receipt.class } : {},
+      ...receipt?.retryable !== void 0 ? { retryable: receipt.retryable } : {},
+      ...receipt?.circuitOpen !== void 0 ? { circuitOpen: receipt.circuitOpen } : {}
+    };
+  });
+  return {
+    version: 1,
+    redacted: true,
+    sessionId: session.id,
+    scope,
+    changedFiles: [...new Set(session.changedFiles.map((path) => relative9(workspaceRoot, path) || "."))].sort(),
+    ...lastRun ? {
+      lastRun: {
+        status: lastRun.status,
+        reason: lastRun.reason,
+        checks: lastRun.checks.map((check) => ({ tool: check.tool, kind: check.kind, ok: check.ok })),
+        ...lastRun.acceptance ? { acceptance: {
+          state: lastRun.acceptance.state,
+          satisfied: lastRun.acceptance.satisfied,
+          pending: lastRun.acceptance.pending,
+          blocked: lastRun.acceptance.blocked
+        } } : {}
+      }
+    } : {},
+    failures
+  };
+}
+function reviewRequest(scope) {
+  if (scope.kind === "working-tree") return "Review the current working tree changes.";
+  if (scope.kind === "commit") return `Review commit ${scope.ref}.`;
+  return `Review the current branch against ${scope.ref}.`;
+}
+function reviewTurnInstructions(bundle) {
+  return `A read-only review is active. Keep the review scope fixed to the bundle below. Do not mutate files, run write-capable tools, or widen the scope. Report actionable findings first with file and line evidence. Never reproduce credentials or secret values. The bundle is deliberately content-free and redacted.
+
+<redacted-review-bundle>
+${JSON.stringify(bundle, null, 2)}
+</redacted-review-bundle>`;
+}
+function failureReceipt2(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const record = value;
+  return {
+    ...isToolFailureClass(record.class) ? { class: record.class } : {},
+    ...typeof record.retryable === "boolean" ? { retryable: record.retryable } : {},
+    ...typeof record.circuitOpen === "boolean" ? { circuitOpen: record.circuitOpen } : {}
+  };
+}
+function isToolFailureClass(value) {
+  return typeof value === "string" && failureClasses.has(value);
+}
+
 // src/ui/timeline-reducers.ts
 var itemCounter = 0;
 var nextId = () => `ui-${Date.now()}-${itemCounter++}`;
@@ -18184,8 +18565,13 @@ function SkeinApp({ runner, config, extensions, initialPrompt, askMode = false,
     const timer = setInterval(() => setFrameIndex((value) => (value + 1) % spinnerFrames().length), 120);
     return () => clearInterval(timer);
   }, [busy]);
-  const requestPermission = useCallback((call, category) => {
-    return new Promise((resolve26) => setPermission({ call, category, resolve: resolve26 }));
+  const requestPermission = useCallback((call, category, reason) => {
+    return new Promise((resolve28) => setPermission({
+      call,
+      category,
+      ...reason ? { reason } : {},
+      resolve: resolve28
+    }));
   }, []);
   const onEvent = useCallback((event) => {
     switch (event.type) {
@@ -18205,7 +18591,7 @@ function SkeinApp({ runner, config, extensions, initialPrompt, askMode = false,
           ...event.packed.budgetReason ? { budgetReason: event.packed.budgetReason } : {},
           truncated: event.packed.truncated,
           spans: event.packed.hits.slice(0, 5).map((hit) => ({
-            path: relative9(runner.workspace.primaryRoot, hit.path) || hit.path,
+            path: relative10(runner.workspace.primaryRoot, hit.path) || hit.path,
             startLine: hit.startLine,
             endLine: hit.endLine,
             score: hit.score,
@@ -18309,7 +18695,7 @@ function SkeinApp({ runner, config, extensions, initialPrompt, askMode = false,
           id: nextId(),
           kind: "notice",
           tone: event.status === "ready" || event.status === "integrated" ? "success" : "error",
-          text: `Writer ${event.id.slice(0, 8)} ${event.status}${separator}${event.detail}`
+          text: `Writer ${event.id.slice(0, 8)} ${event.status}${separator}${event.detail}${event.status === "conflict" || event.status === "failed" || event.status === "cancelled" ? `${separator}Run /recover before retrying or restoring.` : ""}`
         });
         break;
       case "agent_done":
@@ -18348,7 +18734,7 @@ function SkeinApp({ runner, config, extensions, initialPrompt, askMode = false,
       case "error":
         lastEventError.current = event.error.message;
         setTimeline(endStreamingAssistants);
-        append({ id: nextId(), kind: "notice", tone: "error", text: event.error.message });
+        append({ id: nextId(), kind: "notice", tone: "error", text: `${event.error.message}${separator}Run /recover to inspect evidence, changes, and safe next actions.` });
         setActivity(void 0);
         break;
       case "done":
@@ -18372,7 +18758,7 @@ function SkeinApp({ runner, config, extensions, initialPrompt, askMode = false,
             id: nextId(),
             kind: "notice",
             tone: event.reason === "aborted" ? "info" : "error",
-            text: event.reason === "aborted" ? "Run interrupted." : event.reason === "max_turns" ? "Stopped at the configured turn limit." : event.reason === "token_budget" ? "Stopped at the configured token budget." : event.reason
+            text: event.reason === "aborted" ? "Run interrupted. Use /recover to inspect changes or resume safely." : event.reason === "max_turns" ? "Stopped at the configured turn limit. Use /recover resume after adjusting the limit." : event.reason === "token_budget" ? "Stopped at the configured token budget. Use /recover to inspect state before resuming with a larger budget." : event.reason
           });
         }
         break;
@@ -18386,9 +18772,16 @@ function SkeinApp({ runner, config, extensions, initialPrompt, askMode = false,
   const runLocalCommand = useCallback(async (value) => {
     if (!value.startsWith("/")) return false;
     const [rawCommand = "", ...rest] = value.slice(1).trim().split(/\s+/);
-    const command2 = rawCommand.toLocaleLowerCase();
-    const argument = rest.join(" ").trim();
+    let command2 = rawCommand.toLocaleLowerCase();
+    let argument = rest.join(" ").trim();
     if (!command2) return true;
+    if (command2 === "recover") {
+      const [action = "", ...actionRest] = argument.split(/\s+/u);
+      if (action === "diff" || action === "audit" || action === "rollback") {
+        command2 = action;
+        argument = actionRest.join(" ").trim();
+      }
+    }
     if (command2 === "exit" || command2 === "quit") {
       exit();
       return true;
@@ -18470,10 +18863,77 @@ function SkeinApp({ runner, config, extensions, initialPrompt, askMode = false,
       });
       return true;
     }
+    if (command2 === "review") {
+      const scope = parseReviewScope(argument);
+      const bundle = buildRedactedReviewBundle(runner.getSession(), runner.workspace.primaryRoot, scope);
+      return {
+        kind: "agent",
+        display: `/review ${scope.kind}${scope.kind === "working-tree" ? "" : ` ${scope.ref}`}`,
+        runInput: reviewRequest(scope),
+        turnInstructions: reviewTurnInstructions(bundle),
+        readOnly: true
+      };
+    }
+    if (command2 === "recover") {
+      const action = argument.toLocaleLowerCase();
+      const currentSession = runner.getSession();
+      const lastRun = currentSession.lastRun;
+      const lastFailure = (currentSession.audit ?? []).findLast((event) => event.type === "tool" && event.outcome === "failure");
+      const failure = recoveryFailure(lastFailure?.metadata?.failure);
+      if (action === "retry") {
+        if (currentSession.pendingInput) throw new Error("Answer the pending clarification before retrying an operation.");
+        if (!lastFailure) throw new Error("No failed operation is available to retry.");
+        return {
+          kind: "agent",
+          display: "/recover retry",
+          runInput: `Retry the most recent failed ${lastFailure.tool} operation after inspecting the current workspace state.`,
+          turnInstructions: "Resume the existing session. Use the recorded failure receipt and current files as authority. Apply its repair hint before one targeted retry; do not replay a circuit-open or non-retryable operation unchanged."
+        };
+      }
+      if (action === "resume") {
+        if (currentSession.pendingInput) throw new Error("Answer the pending clarification in the composer to resume the same logical run.");
+        if (!lastRun || lastRun.reason === "completed") throw new Error("The latest run is already complete.");
+        return {
+          kind: "agent",
+          display: "/recover resume",
+          runInput: "Resume the most recent incomplete run from its persisted state.",
+          turnInstructions: "Resume the existing session from its Task Contract, changed-file set, last-run receipt, and unresolved failures. Inspect current state before acting, keep prior successful evidence, and run only missing verification."
+        };
+      }
+      if (action) throw new Error("Usage: /recover [retry|resume|diff|rollback|audit]");
+      const checkpoints = await runner.checkpointStore.list(currentSession.id);
+      const latestCheckpoint = checkpoints[0];
+      appendList("Recovery Center", [
+        {
+          label: `Last run  ${lastRun?.status ?? "none"}${lastRun ? `${separator}${lastRun.reason}` : ""}`,
+          detail: lastRun?.detail ?? "No completed or interrupted run has been recorded.",
+          tone: lastRun?.status === "verified" || lastRun?.status === "no_changes" ? "success" : lastRun ? "warning" : "normal"
+        },
+        ...lastFailure ? [{
+          label: `Failure  ${lastFailure.tool}${failure?.class ? `${separator}${failure.class}` : ""}`,
+          detail: failure?.repairHint ?? "Inspect the audit timeline before retrying.",
+          tone: "error"
+        }] : [],
+        {
+          label: `Workspace  ${currentSession.changedFiles.length} changed file${currentSession.changedFiles.length === 1 ? "" : "s"}`,
+          detail: currentSession.changedFiles.length ? "/diff inspects the current patch." : "No tracked session changes."
+        },
+        {
+          label: `Checkpoint  ${latestCheckpoint ? latestCheckpoint.id.slice(0, 12) : "none"}`,
+          detail: latestCheckpoint ? `${latestCheckpoint.reason}${separator}${latestCheckpoint.entries.length} files${separator}/recover rollback` : "No pre-mutation snapshot is available for this session."
+        },
+        { label: "/recover retry", detail: lastFailure ? "Apply the repair hint, then retry the latest failure once." : "Unavailable until an operation fails." },
+        { label: "/recover resume", detail: currentSession.pendingInput ? "Unavailable: answer the pending clarification in the composer." : lastRun && lastRun.reason !== "completed" ? "Continue the incomplete logical run." : "No incomplete run to resume." },
+        { label: "/recover diff", detail: "Inspect the current workspace patch." },
+        { label: "/recover audit", detail: "Review permission and tool evidence." },
+        { label: "/recover rollback", detail: "Choose a checkpoint to restore." }
+      ]);
+      return true;
+    }
     if (command2 === "changes") {
       const changed = runner.getSession().changedFiles;
       appendList("Changed files", changed.length ? changed.map((path) => ({
-        label: relative9(runner.workspace.primaryRoot, path) || ".",
+        label: relative10(runner.workspace.primaryRoot, path) || ".",
         detail: path
       })) : [{ label: "No recorded changes." }]);
       return true;
@@ -18626,25 +19086,109 @@ function SkeinApp({ runner, config, extensions, initialPrompt, askMode = false,
       const skills = extensions?.listSkills() ?? [];
       appendList("Skills", skills.length ? skills.map((skill) => ({
         label: `${skill.name}  ${skill.scope}${skill.trusted ? "" : `${separator}untrusted`}`,
-        detail: `${skill.description}${separator}${relative9(runner.workspace.primaryRoot, skill.path) || skill.path}`,
+        detail: `${skill.description}${separator}${relative10(runner.workspace.primaryRoot, skill.path) || skill.path}`,
         tone: skill.trusted ? "normal" : "warning"
       })) : [{ label: "No skills discovered.", detail: "Add SKILL.md playbooks under .agents/skills, .claude/skills, or a configured directory." }]);
       return true;
     }
     if (command2 === "mcp") {
+      const [action = "list", server = "", ...tail] = argument.split(/\s+/u).filter(Boolean);
+      if (action === "search") {
+        const results = extensions?.mcpSearch([server, ...tail].filter(Boolean).join(" ")) ?? [];
+        appendList("MCP capability search", results.length ? results.map((result) => ({
+          label: `${result.name}  ${result.trust}${result.required ? `${separator}required` : ""}`,
+          detail: `${result.description}${separator}${result.version}${separator}${result.declaredTools || "dynamic"} tools`,
+          tone: result.trust === "trusted" ? "success" : result.trust === "revoked" ? "error" : "warning"
+        })) : [{ label: "No configured MCP capability matched." }]);
+        return true;
+      }
+      if (action === "inspect" || action === "trust") {
+        if (!server) {
+          append({ id: nextId(), kind: "notice", tone: "error", text: `Usage: /mcp ${action} <server>${action === "trust" ? " [--confirm]" : ""}` });
+          return true;
+        }
+        const manifest = extensions?.mcpInspect(server);
+        if (!manifest) {
+          append({ id: nextId(), kind: "notice", tone: "error", text: "MCP is disabled or unavailable." });
+          return true;
+        }
+        appendList(`MCP trust review \xB7 ${manifest.name}`, [
+          { label: `${manifest.source.kind}:${manifest.name}  ${manifest.version}`, detail: `${manifest.transport}${separator}${manifest.target}${manifest.required ? `${separator}required` : ""}` },
+          ...manifest.tools.length ? manifest.tools.flatMap((tool) => {
+            const tone = tool.permissions.some((category) => category !== "read" && category !== "network") ? "warning" : "normal";
+            return [
+              { label: `${tool.name}  ${tool.permissions.join("+")}`, detail: `completion evidence ${tool.completionEvidence}`, tone },
+              { label: "network scopes", detail: tool.network.join(", ") || "unspecified", tone },
+              { label: "command scopes", detail: tool.commands.join(", ") || "none", tone },
+              { label: "path scopes", detail: tool.paths.join(", ") || "none", tone },
+              { label: `sensitive fields  ${tool.sensitiveFields.join(", ") || "none"}`, detail: `${tool.background ? "background" : "foreground"}${separator}${tool.processTree ? "process-tree" : "single-process"}`, tone }
+            ];
+          }) : [{ label: "Dynamic remote tools", detail: "Undeclared tools stay network-only and do not receive Skein completion-evidence protection.", tone: "warning" }]
+        ]);
+        if (action === "trust") {
+          if (manifest.dynamicTools) {
+            append({ id: nextId(), kind: "notice", tone: "error", text: `Declare tools and effects for ${server} in user-owned config before trust can be granted.` });
+            return true;
+          }
+          if (!tail.includes("--confirm")) {
+            append({ id: nextId(), kind: "notice", tone: "warning", text: `Review complete. Run /mcp trust ${server} --confirm to trust this exact manifest fingerprint.` });
+          } else {
+            const status = await extensions?.mcpTrust(server);
+            append({ id: nextId(), kind: "notice", tone: status ? "success" : "error", text: status ? `Trusted MCP capability ${server}. Activation remains explicit.` : "MCP is unavailable." });
+          }
+        }
+        return true;
+      }
+      if (action === "activate") {
+        const query = tail.join(" ").trim();
+        if (!server || !query) {
+          append({ id: nextId(), kind: "notice", tone: "error", text: "Usage: /mcp activate <server> <capability query>" });
+          return true;
+        }
+        const result = await extensions?.mcpActivate(server, query);
+        append({
+          id: nextId(),
+          kind: "notice",
+          tone: result?.ok ? "success" : "error",
+          text: result?.ok ? `Activated ${server}; loaded ${result.registeredTools.length} of ${result.availableTools} schemas.` : `Could not activate ${server}: ${result?.status.error ?? result?.status.trust ?? "MCP unavailable"}`
+        });
+        return true;
+      }
+      if (action === "disable") {
+        if (!server) {
+          append({ id: nextId(), kind: "notice", tone: "error", text: "Usage: /mcp disable <server>" });
+          return true;
+        }
+        const status = await extensions?.mcpDisable(server);
+        append({ id: nextId(), kind: "notice", tone: status ? "success" : "error", text: status ? `Disabled MCP capability ${server}.` : "MCP is unavailable." });
+        return true;
+      }
+      if (action === "revoke") {
+        if (!server || !tail.includes("--confirm")) {
+          append({ id: nextId(), kind: "notice", tone: "warning", text: `Revocation removes persisted trust. Run /mcp revoke ${server || "<server>"} --confirm to continue.` });
+          return true;
+        }
+        const status = await extensions?.mcpRevoke(server);
+        append({ id: nextId(), kind: "notice", tone: status ? "success" : "error", text: status ? `Revoked MCP capability ${server}. Re-inspection and trust are required before reuse.` : "MCP is unavailable." });
+        return true;
+      }
+      if (action !== "list") {
+        append({ id: nextId(), kind: "notice", tone: "error", text: "Usage: /mcp [search|inspect|trust|activate|disable|revoke] [...]" });
+        return true;
+      }
       const servers = extensions?.mcpStatus() ?? [];
-      appendList("MCP", servers.length ? servers.map((server) => ({
-        label: `${server.name}  ${server.state}${server.serverVersion ? `${separator}v${server.serverVersion}` : ""}`,
-        detail: `${server.transport}${separator}${server.toolCount} tools${server.connectedAt ? `${separator}connected ${server.connectedAt.slice(11, 19)}` : ""}${server.error ? `${separator}${server.error}` : ""}`,
-        tone: server.state === "connected" ? "success" : server.state === "error" ? "error" : "warning"
+      appendList("MCP", servers.length ? servers.map((item) => ({
+        label: `${item.name}  ${item.state}${item.required ? `${separator}required` : ""}${item.serverVersion ? `${separator}v${item.serverVersion}` : ""}`,
+        detail: `${item.transport}${separator}${item.trust}${separator}${item.toolCount} tools${item.connectedAt ? `${separator}connected ${item.connectedAt.slice(11, 19)}` : ""}${item.error ? `${separator}${item.error}` : ""}`,
+        tone: item.state === "connected" ? "success" : item.state === "error" || item.state === "revoked" ? "error" : "warning"
       })) : [{ label: "No MCP servers configured." }]);
       return true;
     }
     if (command2 === "tools") {
       const definitions = runner.tools.definitions();
       appendList("Tools", definitions.map((tool) => ({
-        label: `${tool.name}  ${tool.category}`,
-        detail: tool.description,
+        label: `${tool.name}  ${tool.source ?? "builtin"}${separator}${(tool.permissionCategories ?? [tool.category]).join("+")}`,
+        detail: `${tool.activation ?? "always"}${tool.completionEvidence ? `${separator}evidence ${tool.completionEvidence}` : ""}${separator}${tool.description}`,
         tone: tool.category === "read" ? "normal" : tool.category === "network" ? "warning" : "normal"
       })));
       return true;
@@ -18956,7 +19500,7 @@ function SkeinApp({ runner, config, extensions, initialPrompt, askMode = false,
         lastEventError.current = void 0;
         try {
           const nextSession = await runner.run(current.runInput, {
-            askMode: interactionMode !== "build",
+            askMode: current.readOnly === true || interactionMode !== "build",
             signal: abortController.signal,
             ...current.turnInstructions || interactionMode === "plan" ? {
               turnInstructions: [
@@ -19026,10 +19570,10 @@ function SkeinApp({ runner, config, extensions, initialPrompt, askMode = false,
   }, [append, exit, interactionMode, onEvent, requestPermission, runLocalCommand, runner]);
   const submitFromComposer = useCallback((raw, mode = "normal") => {
     if (historySearch) {
-      const selected = resolveHistorySearch(historySearch, "select");
+      const selected2 = resolveHistorySearch(historySearch, "select");
       setHistorySearch(void 0);
       setHistoryIndex(-1);
-      void submit(selected, mode === "normal" && processing.current ? "steer" : mode);
+      void submit(selected2, mode === "normal" && processing.current ? "steer" : mode);
       return;
     }
     if (suggestionMode === "mention" && selectedSuggestion) {
@@ -19040,7 +19584,8 @@ function SkeinApp({ runner, config, extensions, initialPrompt, askMode = false,
         return;
       }
     }
-    const suggestion = selectedSuggestion;
+    const selected = selectedSuggestion;
+    const suggestion = selected && !(raw.startsWith(selected.value) && raw.slice(selected.value.length).trim()) ? selected : void 0;
     const normalized = raw.trimEnd();
     if (suggestion && raw.startsWith("/") && suggestion.value !== raw && suggestion.value.endsWith(" ") && suggestion.label !== normalized) {
       setInput(suggestion.value);
@@ -19068,8 +19613,8 @@ function SkeinApp({ runner, config, extensions, initialPrompt, askMode = false,
   }, [append]);
   function settlePermission(grant, stop = false) {
     if (!permission) return;
-    const { call, category, resolve: resolve26 } = permission;
-    resolve26(grant);
+    const { call, category, resolve: resolve28 } = permission;
+    resolve28(grant);
     setPermission(void 0);
     if (grant === "session") {
       append({
@@ -19079,6 +19624,14 @@ function SkeinApp({ runner, config, extensions, initialPrompt, askMode = false,
         text: `Allowed ${call.name} for this exact ${category} target during the session.`
       });
     }
+    if (grant === false) {
+      append({
+        id: nextId(),
+        kind: "notice",
+        tone: "info",
+        text: `Denied ${call.name}; the requested ${category} action was not run. Use /permissions to inspect policy or /recover to review the run.`
+      });
+    }
     if (stop) {
       requestRunStop();
     }
@@ -19422,7 +19975,7 @@ function SkeinApp({ runner, config, extensions, initialPrompt, askMode = false,
           )
         }
       )
-    ] }) : /* @__PURE__ */ jsx3(PermissionCard, { call: permission.call, category: permission.category, workspace: runner.workspace.primaryRoot, width: contentWidth, glyphMode, compact: constrainedHeight }),
+    ] }) : /* @__PURE__ */ jsx3(PermissionCard, { call: permission.call, category: permission.category, ...permission.reason ? { reason: permission.reason } : {}, workspace: runner.workspace.primaryRoot, width: contentWidth, glyphMode, compact: constrainedHeight }),
     showFooter ? /* @__PURE__ */ jsx3(
       Footer,
       {
@@ -19562,6 +20115,14 @@ function cloneValue(value) {
   if (value && typeof value === "object") return cloneRecord(value);
   return value;
 }
+function recoveryFailure(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const receipt = value;
+  return {
+    ...typeof receipt.class === "string" ? { class: sanitizeTerminalText(receipt.class).slice(0, 40) } : {},
+    ...typeof receipt.repairHint === "string" ? { repairHint: sanitizeTerminalText(receipt.repairHint).replace(/\s+/gu, " ").slice(0, 240) } : {}
+  };
+}
 function isExitCommand(value) {
   const command2 = localCommandName(value);
   return command2 === "exit" || command2 === "quit";
@@ -19579,6 +20140,9 @@ function shouldDeferLocalCommand(value) {
     "remember",
     "diff",
     "checkpoints",
+    "audit",
+    "rollback",
+    "recover",
     "workflow",
     "exit",
     "quit"
@@ -19598,7 +20162,7 @@ function composerAttachments(value) {
   return [...new Set(paths)].slice(-3);
 }
 function permissionRows(width, hasCwd, compact3) {
-  const content = 3 + (hasCwd ? 1 : 0);
+  const content = 5 + (hasCwd ? 1 : 0);
   if (width >= 64) return content + 2;
   if (width >= 28) return content + 3;
   if (compact3) return content + 3;
@@ -20392,7 +20956,7 @@ function titleForStep(step2) {
   return "Saving configuration";
 }
 function descriptionForStep(state) {
-  if (state.step === "method") return "Pick one connection path. You can change it later with configuration.";
+  if (state.step === "method") return "Skein's primary agent needs an API credential. OpenAI, Anthropic, and Gemini subscription logins are not API keys; signed-in coding CLIs are separate delegated tools.";
   if (state.step === "official-provider") return "Use the API credential issued by the selected provider.";
   if (state.step === "relay-protocol") return "The protocol is explicit so requests and credentials are never guessed.";
   if (state.step === "endpoint") return "Remote endpoints require HTTPS. Loopback development servers may use HTTP.";
@@ -20442,13 +21006,13 @@ async function runFirstRunOnboarding(initialConfig, options = {}) {
 }
 
 // src/runtime/extensions.ts
-import { resolve as resolve24 } from "node:path";
+import { resolve as resolve26 } from "node:path";
 
 // src/mcp/manager.ts
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import stripAnsi5 from "strip-ansi";
+import stripAnsi6 from "strip-ansi";
 
 // src/mcp/tool.ts
 import { createHash as createHash18 } from "node:crypto";
@@ -20460,36 +21024,61 @@ var MAX_SCHEMA_BYTES = 1e5;
 function createMcpToolAdapter(options) {
   const { remoteTool } = options;
   const inputSchema13 = copyInputSchema(remoteTool.inputSchema);
+  const permissionCategories = options.capability?.permissions ?? ["network"];
+  const completionEvidence = options.capability?.completionEvidence ?? "none";
+  const mutating = permissionCategories.some((category) => category === "write" || category === "shell" || category === "git");
   return {
     definition: {
       name: options.exposedName,
-      description: describeTool(options.serverName, remoteTool),
+      description: describeTool(options.serverName, remoteTool, options.capability),
       // MCP servers are an external trust boundary. Read-only annotations are
       // hints from that server and must not lower the local permission level.
       category: "network",
       inputSchema: inputSchema13,
-      progressive: true
+      progressive: true,
+      source: "mcp",
+      permissionCategories,
+      activation: "active",
+      completionEvidence,
+      ...options.capability?.sensitiveFields.length ? { sensitiveFields: options.capability.sensitiveFields } : {}
     },
-    permissionCategories: () => ["network"],
+    permissionCategories: () => permissionCategories,
+    ...mutating ? {
+      affectedPaths: async (arguments_, context) => resolveDeclaredMutationPaths(
+        arguments_,
+        options.capability?.paths ?? [],
+        context
+      )
+    } : {},
     async execute(arguments_, context) {
       assertArguments(arguments_);
+      const remoteArguments = mutating && completionEvidence === "full" && context.checkpointId ? { ...arguments_, _skein: { checkpointId: context.checkpointId } } : arguments_;
       const result = await options.callTool({
         name: remoteTool.name,
-        arguments: arguments_
+        arguments: remoteArguments
       }, {
         timeout: options.timeoutMs,
         maxTotalTimeout: options.timeoutMs,
         ...context.signal ? { signal: context.signal } : {}
       });
       const normalized = normalizeCallResult(result);
+      const evidence = mutating && completionEvidence === "full" ? await validateCompletionEvidence(normalized.structuredContent, context) : void 0;
       return {
         ok: !normalized.isError,
         content: normalized.content,
+        ...evidence ? { changedFiles: evidence.changedFiles } : {},
         metadata: {
           mcpServer: options.serverName,
           mcpTool: remoteTool.name,
           sourceBytes: normalized.sourceBytes,
           sourceTruncated: normalized.sourceTruncated,
+          capabilityPermissions: permissionCategories,
+          completionEvidence,
+          ...mutating ? {
+            changeTracking: evidence ? "complete" : "unresolved",
+            completionEvidenceVerified: Boolean(evidence)
+          } : {},
+          ...evidence ? evidence : {},
           ...normalized.isError ? { mcpError: true } : {}
         }
       };
@@ -20518,9 +21107,10 @@ function isUsableRemoteTool(tool) {
     return false;
   }
 }
-function describeTool(serverName, tool) {
+function describeTool(serverName, tool, capability) {
   const label = stripAnsi4(tool.title?.trim() || tool.name).replace(/[\u0000-\u001f\u007f]/g, " ").slice(0, 200);
-  const description = tool.description ? stripAnsi4(tool.description).replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, " ").trim().slice(0, MAX_DESCRIPTION_LENGTH) : void 0;
+  const sourceDescription = capability?.description ?? tool.description;
+  const description = sourceDescription ? stripAnsi4(sourceDescription).replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, " ").trim().slice(0, MAX_DESCRIPTION_LENGTH) : void 0;
   return description ? `[MCP ${serverName}/${label}] ${description}` : `Call the ${label} tool provided by the ${serverName} MCP server.`;
 }
 function copyInputSchema(schema) {
@@ -20559,7 +21149,46 @@ ${safeJson(result.structuredContent)}`);
 ${safeJson(result.toolResult)}`);
   }
   const content = sections.filter(Boolean).join("\n\n") || (isError ? "The MCP tool reported an error." : "The MCP tool completed without output.");
-  return boundResult(content, isError);
+  return { ...boundResult(content, isError), ...result.structuredContent === void 0 ? {} : { structuredContent: result.structuredContent } };
+}
+async function validateCompletionEvidence(structuredContent, context) {
+  if (!isRecord2(structuredContent)) return;
+  const receipt = isRecord2(structuredContent.skeinEvidence) ? structuredContent.skeinEvidence : void 0;
+  if (!receipt || !context.checkpointId || !Array.isArray(receipt.changedFiles) || receipt.changedFiles.length > 256 || typeof receipt.checkpointId !== "string" || !receipt.checkpointId.trim() || receipt.checkpointId !== context.checkpointId || !Array.isArray(receipt.artifactReceipts) || !receipt.artifactReceipts.length || !Array.isArray(receipt.completionEvidence) || !receipt.completionEvidence.length) return;
+  const changedFiles = [];
+  for (const path of receipt.changedFiles) {
+    if (typeof path !== "string" || !path.trim()) return;
+    try {
+      changedFiles.push(await context.workspace.resolvePath(path, { allowMissing: true }));
+    } catch {
+      return;
+    }
+  }
+  const artifactReceipts = receipt.artifactReceipts.filter((value) => typeof value === "string" && Boolean(value.trim())).map((value) => sanitizeInlineText(value).slice(0, 256));
+  const completionEvidenceRefs = receipt.completionEvidence.filter((value) => typeof value === "string" && Boolean(value.trim())).map((value) => sanitizeInlineText(value).slice(0, 256));
+  if (artifactReceipts.length !== receipt.artifactReceipts.length || completionEvidenceRefs.length !== receipt.completionEvidence.length) return;
+  return {
+    changedFiles,
+    checkpointId: sanitizeInlineText(receipt.checkpointId).slice(0, 256),
+    artifactReceipts,
+    completionEvidenceRefs
+  };
+}
+async function resolveDeclaredMutationPaths(arguments_, declaredPaths, context) {
+  const candidates = [];
+  for (const key of ["path", "file", "cwd"]) {
+    const value = arguments_[key];
+    if (typeof value === "string" && value.trim()) candidates.push(value);
+  }
+  if (Array.isArray(arguments_.paths)) {
+    candidates.push(...arguments_.paths.filter((value) => typeof value === "string" && Boolean(value.trim())));
+  }
+  candidates.push(...declaredPaths.filter((path) => !/[?*{}\[\]]/u.test(path)));
+  const resolved = [];
+  for (const candidate of [...new Set(candidates)].slice(0, 256)) {
+    resolved.push(await context.workspace.resolvePath(candidate, { allowMissing: true }));
+  }
+  return resolved;
 }
 function boundResult(content, isError) {
   const sourceBytes = Buffer.byteLength(content);
@@ -20787,6 +21416,221 @@ function isLoopbackHost(hostname) {
   return normalized === "localhost" || normalized === "::1" || normalized === "0:0:0:0:0:0:0:1" || isIpv4Loopback;
 }
 
+// src/mcp/capabilities.ts
+import { createHash as createHash19 } from "node:crypto";
+import { homedir as homedir4 } from "node:os";
+import { basename as basename12, isAbsolute as isAbsolute9, relative as relative11, resolve as resolve23 } from "node:path";
+import stripAnsi5 from "strip-ansi";
+function buildMcpCapabilityManifest(name, config, workspace = process.cwd()) {
+  const tools = (config.tools ?? []).map((tool) => normalizeTool(tool, workspace));
+  return {
+    schemaVersion: 1,
+    id: `mcp:${sanitizeIdentifier(name, "server")}`,
+    source: { kind: "mcp", owner: "user-config" },
+    name: sanitizeText(name, 64),
+    version: sanitizeText(config.version ?? "unversioned", 128),
+    required: config.required === true,
+    transport: config.transport ?? "stdio",
+    target: redactTransportTarget(config),
+    tools,
+    dynamicTools: tools.length === 0
+  };
+}
+function capabilityFingerprint(name, config, workspace = process.cwd()) {
+  const manifest = buildMcpCapabilityManifest(name, config, workspace);
+  const privateTransport = {
+    command: config.command ?? null,
+    args: config.args ?? [],
+    cwd: config.cwd ? resolve23(workspace, config.cwd) : null,
+    url: config.url ? redactUrl(config.url) : null,
+    envNames: Object.keys(config.env ?? {}).sort(),
+    headerNames: Object.keys(config.headers ?? {}).map((key) => key.toLocaleLowerCase()).sort()
+  };
+  return createHash19("sha256").update(stableJson2({ manifest, privateTransport })).digest("hex");
+}
+function searchMcpCapabilities(config, query) {
+  const terms = new Set(sanitizeText(query, 500).toLocaleLowerCase().match(/[\p{L}\p{N}_-]{2,}/gu) ?? []);
+  return Object.entries(config.servers ?? {}).map(([name, server]) => {
+    const description = sanitizeText(server.description ?? `${server.transport ?? "stdio"} MCP server`, 200);
+    const searchable = [name, description, server.version, ...(server.tools ?? []).flatMap((tool) => [
+      tool.name,
+      tool.description,
+      ...tool.permissions,
+      ...tool.commands ?? [],
+      ...tool.network ?? []
+    ])].filter(Boolean).join(" ").toLocaleLowerCase();
+    let score = 0;
+    for (const term of terms) if (searchable.includes(term)) score += term.length;
+    return {
+      name,
+      description,
+      version: sanitizeText(server.version ?? "unversioned", 128),
+      required: server.required === true,
+      transport: server.transport ?? "stdio",
+      declaredTools: server.tools?.length ?? 0,
+      score
+    };
+  }).filter((result) => terms.size === 0 || result.score > 0).sort((left, right) => right.score - left.score || left.name.localeCompare(right.name));
+}
+function declaredToolCapability(config, remoteName, workspace = process.cwd()) {
+  const declaration = config.tools?.find((tool) => tool.name === remoteName);
+  return declaration ? normalizeTool(declaration, workspace) : void 0;
+}
+function normalizeTool(tool, workspace) {
+  const permissions = uniquePermissions(["network", ...tool.permissions]);
+  return {
+    name: sanitizeText(tool.name, 256),
+    ...tool.description ? { description: sanitizeText(tool.description, 500) } : {},
+    permissions,
+    network: unique3(tool.network ?? []).map(redactNetworkTarget),
+    commands: unique3(tool.commands ?? []).map(redactCommand2),
+    paths: unique3(tool.paths ?? []).map((path) => redactPath(path, workspace)),
+    sensitiveFields: unique3(tool.sensitiveFields ?? []).map((field) => sanitizeText(field, 256)),
+    background: tool.background === true,
+    processTree: tool.processTree === true,
+    completionEvidence: tool.completionEvidence ?? "none"
+  };
+}
+function redactTransportTarget(config) {
+  if (config.transport === "http") return config.url ? redactUrl(config.url) : "<unconfigured HTTP endpoint>";
+  return config.command ? `<stdio command:${sanitizeText(basename12(config.command), 128)}>` : "<unconfigured stdio command>";
+}
+function redactUrl(value) {
+  try {
+    const url = new URL(value);
+    return `${url.protocol}//${url.host}${url.pathname}`;
+  } catch {
+    return "<invalid URL>";
+  }
+}
+function redactNetworkTarget(value) {
+  if (/^https?:\/\//iu.test(value)) return redactUrl(value);
+  return sanitizeText(value, 500).replace(/([?&](?:key|token|secret|password)=)[^&\s]*/giu, "$1<redacted>");
+}
+function redactCommand2(value) {
+  const command2 = sanitizeText(value, 500).split(/\s+/u)[0];
+  return command2 ? basename12(command2) : "<redacted command>";
+}
+function redactPath(value, workspace) {
+  const clean2 = sanitizeText(value, 4e3);
+  if (!isAbsolute9(clean2)) return clean2;
+  const absolute = resolve23(clean2);
+  const workspaceRelative = relative11(resolve23(workspace), absolute);
+  if (!workspaceRelative.startsWith("..") && !isAbsolute9(workspaceRelative)) {
+    return `<workspace>/${workspaceRelative || "."}`;
+  }
+  const homeRelative = relative11(homedir4(), absolute);
+  if (!homeRelative.startsWith("..") && !isAbsolute9(homeRelative)) return `~/${homeRelative}`;
+  return `<absolute>/${basename12(absolute)}`;
+}
+function uniquePermissions(values) {
+  const order = ["read", "write", "shell", "git", "network"];
+  const present = new Set(values);
+  return order.filter((category) => present.has(category));
+}
+function unique3(values) {
+  return [...new Set(values)].slice(0, 256);
+}
+function sanitizeIdentifier(value, fallback) {
+  return sanitizeText(value, 64).toLocaleLowerCase().replace(/[^a-z0-9_-]+/gu, "_").replace(/^_+|_+$/gu, "") || fallback;
+}
+function sanitizeText(value, maxLength) {
+  return stripAnsi5(value).replace(/[\u0000-\u001f\u007f]/gu, " ").replace(/\s+/gu, " ").trim().slice(0, maxLength);
+}
+function stableJson2(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson2).join(",")}]`;
+  if (value && typeof value === "object") {
+    const object = value;
+    return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${stableJson2(object[key])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+// src/mcp/trust-store.ts
+import { lstat as lstat21, mkdir as mkdir10, readFile as readFile20, realpath as realpath9 } from "node:fs/promises";
+import { dirname as dirname10, join as join21, resolve as resolve24 } from "node:path";
+import { z as z20 } from "zod";
+var trustRegistrySchema = z20.object({
+  version: z20.literal(1),
+  entries: z20.array(z20.object({
+    workspace: z20.string(),
+    server: z20.string().regex(/^[a-z][a-z0-9_-]{0,63}$/),
+    fingerprint: z20.string().regex(/^[a-f0-9]{64}$/),
+    state: z20.enum(["trusted", "disabled", "revoked"]),
+    updatedAt: z20.string()
+  }).strict()).max(1e3)
+}).strict();
+var McpTrustStore = class {
+  path;
+  usesDefaultPath;
+  constructor(options = {}) {
+    this.usesDefaultPath = options.path === void 0;
+    this.path = options.path ?? join21(resolveHomeNamespace(), "mcp-capability-trust.json");
+  }
+  async state(workspace, server, fingerprint) {
+    const resolvedWorkspace = await resolveWorkspace(workspace);
+    const registry = await this.read();
+    const entry = [...registry.entries].reverse().find((candidate) => candidate.workspace === resolvedWorkspace && candidate.server === server);
+    if (!entry) return "untrusted";
+    if (entry.state === "disabled" || entry.state === "revoked") return entry.state;
+    return entry.fingerprint === fingerprint ? "trusted" : "untrusted";
+  }
+  trust(workspace, server, fingerprint) {
+    return this.writeDecision(workspace, server, fingerprint, "trusted");
+  }
+  disable(workspace, server, fingerprint) {
+    return this.writeDecision(workspace, server, fingerprint, "disabled");
+  }
+  revoke(workspace, server, fingerprint) {
+    return this.writeDecision(workspace, server, fingerprint, "revoked");
+  }
+  async writeDecision(workspace, server, fingerprint, state) {
+    const operation = async () => {
+      const resolvedWorkspace = await resolveWorkspace(workspace);
+      const registry = await this.read();
+      const entries = registry.entries.filter((entry) => entry.workspace !== resolvedWorkspace || entry.server !== server);
+      entries.push({
+        workspace: resolvedWorkspace,
+        server,
+        fingerprint,
+        state,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      if (this.usesDefaultPath) {
+        const home = resolveHomeNamespace();
+        assertActiveHomeNamespacePath(this.path);
+        await assertNoSymlinkPath(dirname10(home), home);
+      }
+      await mkdir10(dirname10(this.path), { recursive: true, mode: 448 });
+      if (this.usesDefaultPath) {
+        const home = resolveHomeNamespace();
+        await assertNoSymlinkPath(dirname10(home), home);
+      }
+      await atomicWrite(
+        this.path,
+        `${JSON.stringify({ version: 1, entries: entries.slice(-1e3) }, null, 2)}
+`,
+        384
+      );
+    };
+    return this.usesDefaultPath ? withNamespaceLease(homeNamespacePaths().canonical, "shared", operation) : operation();
+  }
+  async read() {
+    try {
+      const info = await lstat21(this.path);
+      if (!info.isFile() || info.isSymbolicLink() || info.size > 1e6) {
+        return { version: 1, entries: [] };
+      }
+      return trustRegistrySchema.parse(JSON.parse(await readFile20(this.path, "utf8")));
+    } catch {
+      return { version: 1, entries: [] };
+    }
+  }
+};
+async function resolveWorkspace(workspace) {
+  return realpath9(resolve24(workspace)).catch(() => resolve24(workspace));
+}
+
 // src/mcp/manager.ts
 var MAX_SERVERS = 32;
 var MAX_TOOLS_PER_SERVER = 256;
@@ -20798,6 +21642,9 @@ var McpManager = class {
   constructor(config, options = {}) {
     this.config = config;
     this.options = options;
+    this.trustStore = options.trustStore ?? new McpTrustStore();
+    this.workspace = options.cwd ?? process.cwd();
+    this.requireTrust = options.requireTrust !== false;
     const entries = Object.entries(config.servers ?? {});
     for (const [index, [name, server]] of entries.entries()) {
       const transport = server.transport ?? "stdio";
@@ -20807,12 +21654,22 @@ var McpManager = class {
           state: "error",
           transport,
           toolCount: 0,
+          required: server.required === true,
+          trust: "untrusted",
           error: `MCP server limit exceeded (maximum ${MAX_SERVERS})`
         });
         continue;
       }
-      const state = config.enabled === false || server.enabled === false ? "disabled" : "disconnected";
-      this.statuses.set(name, { name, state, transport, toolCount: 0 });
+      const disabled = config.enabled === false || server.enabled === false;
+      const state = disabled ? "disabled" : this.requireTrust ? "untrusted" : "disconnected";
+      this.statuses.set(name, {
+        name,
+        state,
+        transport,
+        toolCount: 0,
+        required: server.required === true,
+        trust: disabled ? "disabled" : this.requireTrust ? "untrusted" : "trusted"
+      });
     }
   }
   config;
@@ -20822,12 +21679,108 @@ var McpManager = class {
   statuses = /* @__PURE__ */ new Map();
   toolOwners = /* @__PURE__ */ new Map();
   stableAdapters = /* @__PURE__ */ new Map();
+  registries = /* @__PURE__ */ new Set();
   options;
+  trustStore;
+  workspace;
+  requireTrust;
   shutdownController = new AbortController();
+  trustLoaded = false;
   closed = false;
+  /** Load persisted trust and prove availability for explicitly required servers. */
+  async initialize(signal) {
+    await this.ensureTrustLoaded();
+    const required = [...this.statuses.values()].filter((status) => status.required && status.state !== "disabled").map((status) => status.name);
+    const failures = [];
+    for (const name of required) {
+      const status = this.statuses.get(name);
+      if (status?.trust !== "trusted") {
+        failures.push(`${name}: capability manifest is ${status?.trust ?? "untrusted"}`);
+        continue;
+      }
+      const result = await this.connect(name, signal);
+      if (!result.ok) failures.push(`${name}: ${result.status.error ?? result.status.state}`);
+    }
+    if (failures.length) {
+      throw new Error(`Required MCP server unavailable: ${failures.join("; ")}`);
+    }
+  }
+  /** Refresh local trust state without connecting; used by status and review UIs. */
+  async loadTrust() {
+    await this.ensureTrustLoaded();
+  }
+  /** Compact, no-network capability controls advertised before remote schemas. */
+  catalogTools(registry) {
+    const names = this.catalogServerNames();
+    if (!names.length) return [];
+    const search = {
+      definition: {
+        name: "mcp_search",
+        description: "Search configured MCP capability manifests without connecting to a server or loading remote schemas.",
+        category: "read",
+        source: "mcp",
+        permissionCategories: ["read"],
+        activation: "catalog",
+        inputSchema: {
+          type: "object",
+          properties: {
+            query: { type: "string", maxLength: 500, description: "Capability, tool, permission, or server to find." }
+          },
+          required: ["query"],
+          additionalProperties: false
+        }
+      },
+      permissionCategories: () => ["read"],
+      execute: async (arguments_) => {
+        const query = typeof arguments_.query === "string" ? arguments_.query.trim() : "";
+        if (query.length > 500) throw new ToolInputError("MCP search query must be at most 500 characters");
+        await this.ensureTrustLoaded();
+        const results = this.search(query);
+        return {
+          content: results.length ? results.map((result) => `${result.name}: ${result.description} (${result.trust}, ${result.declaredTools || "dynamic"} tools)`).join("\n") : "No configured MCP capability matched the query.",
+          metadata: { mcpSearch: results }
+        };
+      }
+    };
+    const inspect = {
+      definition: {
+        name: "mcp_inspect",
+        description: "Inspect one redacted declarative MCP capability manifest and its local trust state without connecting.",
+        category: "read",
+        source: "mcp",
+        permissionCategories: ["read"],
+        activation: "catalog",
+        inputSchema: {
+          type: "object",
+          properties: {
+            server: { type: "string", enum: names, description: "Configured MCP server to inspect." }
+          },
+          required: ["server"],
+          additionalProperties: false
+        }
+      },
+      permissionCategories: () => ["read"],
+      execute: async (arguments_) => {
+        const server = typeof arguments_.server === "string" ? arguments_.server : "";
+        if (!names.includes(server)) throw new ToolInputError("MCP server is not available for inspection");
+        await this.ensureTrustLoaded();
+        const manifest = this.inspect(server);
+        return {
+          content: JSON.stringify({ manifest, trust: this.status(server)?.trust ?? "untrusted" }, null, 2),
+          metadata: {
+            mcpServer: server,
+            trust: this.status(server)?.trust ?? "untrusted",
+            manifestFingerprint: this.fingerprint(server)
+          }
+        };
+      }
+    };
+    const activation = this.activationTool(registry);
+    return activation ? [search, inspect, activation] : [search, inspect];
+  }
   /** Compact model-visible catalog; transport and remote discovery stay lazy. */
   activationTool(registry) {
-    const names = this.activatableServerNames();
+    const names = this.catalogServerNames();
     if (!names.length) return;
     const catalog = names.map((name) => {
       const server = this.config.servers[name];
@@ -20837,8 +21790,11 @@ var McpManager = class {
     return {
       definition: {
         name: "mcp_activate",
-        description: `Connect to one configured MCP server only when the current task needs it, discover its tools, and load at most ${LAZY_SCHEMA_LIMIT} relevant schemas. Available servers: ${catalog}`,
+        description: `Activate one already trusted MCP capability after mcp_search and mcp_inspect, then load at most ${LAZY_SCHEMA_LIMIT} relevant schemas. This tool cannot grant trust. Available servers: ${catalog}`,
         category: "network",
+        source: "mcp",
+        permissionCategories: ["network"],
+        activation: "catalog",
         inputSchema: {
           type: "object",
           properties: {
@@ -20859,9 +21815,10 @@ var McpManager = class {
         }
         const result = await this.activate(server, query, registry, context.signal);
         if (!result.ok) {
+          const trust = result.status.trust;
           return {
             ok: false,
-            content: `MCP server ${server} could not be activated: ${result.status.error ?? result.status.state}`,
+            content: trust !== "trusted" ? `MCP server ${server} is ${trust}. Review it with mcp_inspect; only the user can trust it with the CLI or /mcp trust confirmation flow.` : `MCP server ${server} could not be activated: ${result.status.error ?? result.status.state}`,
             metadata: activationMetadata(result)
           };
         }
@@ -20876,6 +21833,7 @@ var McpManager = class {
   }
   /** Connect/discover one server, then register only request-relevant schemas. */
   async activate(name, query, registry, signal) {
+    await this.ensureTrustLoaded();
     const connected = await this.connect(name, signal);
     if (!connected.ok) {
       return { ...connected, registeredTools: [], availableTools: 0, deferredTools: 0 };
@@ -20887,16 +21845,27 @@ var McpManager = class {
     const tools = [...connection.tools.values()];
     const selected = tools.length <= LAZY_SCHEMA_LIMIT ? tools : selectRelevantTools(tools, query, LAZY_SCHEMA_LIMIT);
     this.registerSelectedTools(registry, selected);
+    const ranked = rankRelevantTools(tools, query);
+    const eagerTokens = estimateTokens(JSON.stringify(tools.map((tool) => tool.definition)));
+    const loadedTokens = estimateTokens(JSON.stringify(selected.map((tool) => tool.definition)));
     return {
       ...connected,
       registeredTools: selected.map((tool) => tool.definition.name),
       availableTools: tools.length,
-      deferredTools: Math.max(0, tools.length - selected.length)
+      deferredTools: Math.max(0, tools.length - selected.length),
+      schemaBudget: {
+        eagerTokens,
+        loadedTokens,
+        savedTokens: Math.max(0, eagerTokens - loadedTokens),
+        topMatch: ranked[0]?.tool.definition.name ?? null,
+        queryMatched: (ranked[0]?.score ?? 0) > 0
+      }
     };
   }
   /** Connect enabled servers with a small concurrency bound. */
   async connectAll(signal) {
     if (this.closed) throw new Error("MCP manager is closed");
+    await this.ensureTrustLoaded();
     const configuredNames = Object.keys(this.config.servers ?? {});
     const names = configuredNames.slice(0, MAX_SERVERS);
     if (this.config.enabled === false) {
@@ -20917,10 +21886,14 @@ var McpManager = class {
   /** Connect one configured server. Connection errors are captured in status. */
   async connect(name, signal) {
     if (this.closed) throw new Error("MCP manager is closed");
+    await this.ensureTrustLoaded();
     const status = this.statuses.get(name);
     if (status?.state === "error" && status.error?.includes("server limit exceeded")) {
       return this.resultFor(name, false, 0);
     }
+    if (this.requireTrust && status?.trust !== "trusted") {
+      return this.resultFor(name, false, 0);
+    }
     const existing = this.pending.get(name);
     if (existing) return existing;
     const connectionController = new AbortController();
@@ -20948,9 +21921,11 @@ var McpManager = class {
     if (!current) throw new Error(`Unknown MCP server: ${name}`);
     const status = {
       name,
-      state: current.state === "disabled" ? "disabled" : "disconnected",
+      state: current.state === "disabled" || current.state === "revoked" || current.state === "untrusted" ? current.state : "disconnected",
       transport: current.transport,
-      toolCount: 0
+      toolCount: 0,
+      required: current.required,
+      trust: current.trust
     };
     this.statuses.set(name, status);
     return status;
@@ -20960,7 +21935,9 @@ var McpManager = class {
     if (this.closed) throw new Error("MCP manager is closed");
     const status = this.statuses.get(name);
     if (!status) throw new Error(`Unknown MCP server: ${name}`);
-    if (status.state === "disabled") return this.resultFor(name, false, 0);
+    if (status.state === "disabled" || status.state === "revoked" || status.state === "untrusted") {
+      return this.resultFor(name, false, 0);
+    }
     const pending = this.pending.get(name);
     if (pending) await pending;
     await this.disconnect(name);
@@ -20984,9 +21961,11 @@ var McpManager = class {
     for (const [name, status] of this.statuses) {
       this.statuses.set(name, {
         name,
-        state: status.state === "disabled" ? "disabled" : "closed",
+        state: status.state === "disabled" || status.state === "revoked" || status.state === "untrusted" ? status.state : "closed",
         transport: status.transport,
-        toolCount: 0
+        toolCount: 0,
+        required: status.required,
+        trust: status.trust
       });
     }
   }
@@ -20997,6 +21976,71 @@ var McpManager = class {
     const status = this.statuses.get(name);
     return status ? { ...status } : void 0;
   }
+  search(query = "") {
+    return searchMcpCapabilities(this.config, query).map((result) => {
+      const status = this.statuses.get(result.name);
+      return {
+        ...result,
+        state: status?.state ?? "error",
+        trust: status?.trust ?? "untrusted"
+      };
+    });
+  }
+  inspect(name) {
+    const server = this.config.servers?.[name];
+    if (!server) throw new Error(`Unknown MCP server: ${name}`);
+    return buildMcpCapabilityManifest(name, server, this.workspace);
+  }
+  fingerprint(name) {
+    const server = this.config.servers?.[name];
+    if (!server) throw new Error(`Unknown MCP server: ${name}`);
+    return capabilityFingerprint(name, server, this.workspace);
+  }
+  async trust(name) {
+    const server = this.config.servers?.[name];
+    if (!server) throw new Error(`Unknown MCP server: ${name}`);
+    if (this.config.enabled === false || server.enabled === false) {
+      throw new Error(`MCP server is disabled by configuration: ${name}`);
+    }
+    if (this.inspect(name).dynamicTools) {
+      throw new Error(`MCP capability ${name} cannot be trusted until its tools and effects are declared.`);
+    }
+    await this.trustStore.trust(this.workspace, name, this.fingerprint(name));
+    this.trustLoaded = true;
+    return this.setStatus(name, {
+      state: "disconnected",
+      trust: "trusted",
+      required: server.required === true,
+      transport: server.transport ?? "stdio",
+      toolCount: 0
+    });
+  }
+  async disable(name) {
+    const server = this.config.servers?.[name];
+    if (!server) throw new Error(`Unknown MCP server: ${name}`);
+    await this.disconnect(name);
+    this.unregisterServerTools(name);
+    await this.trustStore.disable(this.workspace, name, this.fingerprint(name));
+    return this.setStatus(name, {
+      state: "disabled",
+      trust: "disabled",
+      required: server.required === true,
+      toolCount: 0
+    });
+  }
+  async revoke(name) {
+    const server = this.config.servers?.[name];
+    if (!server) throw new Error(`Unknown MCP server: ${name}`);
+    await this.disconnect(name);
+    this.unregisterServerTools(name);
+    await this.trustStore.revoke(this.workspace, name, this.fingerprint(name));
+    return this.setStatus(name, {
+      state: "revoked",
+      trust: "revoked",
+      required: server.required === true,
+      toolCount: 0
+    });
+  }
   tools() {
     return [...this.connections.values()].flatMap((connection) => [...connection.tools.values()]).sort((a, b) => a.definition.name.localeCompare(b.definition.name));
   }
@@ -21008,6 +22052,7 @@ var McpManager = class {
     return this.registerSelectedTools(registry, this.tools());
   }
   registerSelectedTools(registry, tools) {
+    this.registries.add(registry);
     const registered = [];
     for (const tool of tools) {
       const existing = registry.get(tool.definition.name);
@@ -21022,9 +22067,38 @@ var McpManager = class {
     }
     return registered;
   }
-  activatableServerNames() {
-    if (this.config.enabled === false) return [];
-    return [...this.statuses.values()].filter((status) => status.state !== "disabled" && status.state !== "error").map((status) => status.name).sort((left, right) => left.localeCompare(right));
+  unregisterServerTools(name) {
+    for (const [identity2, tool] of this.stableAdapters) {
+      if (!identity2.startsWith(`${name}\0`)) continue;
+      for (const registry of this.registries) {
+        registry.unregister(tool.definition.name, tool);
+      }
+    }
+  }
+  catalogServerNames() {
+    return [...this.statuses.values()].filter((status) => !status.error?.includes("server limit exceeded")).map((status) => status.name).sort((left, right) => left.localeCompare(right));
+  }
+  async ensureTrustLoaded() {
+    if (this.trustLoaded) return;
+    for (const [name, server] of Object.entries(this.config.servers ?? {}).slice(0, MAX_SERVERS)) {
+      const current = this.statuses.get(name);
+      if (!current) continue;
+      if (this.config.enabled === false || server.enabled === false) {
+        this.setStatus(name, { state: "disabled", trust: "disabled", toolCount: 0 });
+        continue;
+      }
+      if (!this.requireTrust) {
+        this.setStatus(name, { state: "disconnected", trust: "trusted", toolCount: 0 });
+        continue;
+      }
+      const trust = await this.trustStore.state(this.workspace, name, this.fingerprint(name));
+      this.setStatus(name, {
+        state: trust === "trusted" ? "disconnected" : trust,
+        trust,
+        toolCount: 0
+      });
+    }
+    this.trustLoaded = true;
   }
   async connectInternal(name, signal) {
     const configured = this.config.servers?.[name];
@@ -21040,7 +22114,12 @@ var McpManager = class {
       return { name, ok: false, status, skippedTools: 0 };
     }
     if (this.config.enabled === false || configured.enabled === false) {
-      const status = this.setStatus(name, { state: "disabled", transport: transportKind, toolCount: 0 });
+      const status = this.setStatus(name, {
+        state: "disabled",
+        trust: "disabled",
+        transport: transportKind,
+        toolCount: 0
+      });
       return { name, ok: false, status, skippedTools: 0 };
     }
     if (this.connections.has(name)) {
@@ -21090,6 +22169,7 @@ var McpManager = class {
       const listed = await this.listRemoteTools(client, timeoutMs, signal);
       if (closedDuringConnect) throw new Error("MCP server closed during connection setup");
       const toolMap = this.buildAdapters(name, configured, listed.tools);
+      const undeclaredTools = configured.tools?.length ? listed.tools.filter((tool) => !configured.tools?.some((declared) => declared.name === tool.name)).length : 0;
       const connection = {
         name,
         client,
@@ -21111,7 +22191,12 @@ var McpManager = class {
         );
       }
       const status = this.setStatus(name, statusPatch);
-      return { name, ok: true, status, skippedTools: listed.skippedTools + listed.truncatedTools };
+      return {
+        name,
+        ok: true,
+        status,
+        skippedTools: listed.skippedTools + listed.truncatedTools + undeclaredTools
+      };
     } catch (error) {
       if (client) await closeQuietly(client);
       else if (transport) await closeTransportQuietly(transport);
@@ -21150,7 +22235,7 @@ var McpManager = class {
       stderr: "pipe"
     });
     transport.stderr?.on("data", (chunk) => {
-      const text = stripAnsi5(chunk.toString()).replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "").trim();
+      const text = stripAnsi6(chunk.toString()).replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "").trim();
       if (text) this.options.logger?.(`MCP ${name} stderr`, { text: text.slice(0, 2e3) });
     });
     return transport;
@@ -21200,6 +22285,8 @@ var McpManager = class {
       DEFAULT_TOOL_TIMEOUT
     );
     for (const remoteTool of remoteTools) {
+      const capability = declaredToolCapability(config, remoteTool.name, this.workspace);
+      if (config.tools?.length && !capability) continue;
       let exposedName = makeMcpToolName(namespace, remoteTool.name);
       const identity2 = `${serverName}\0${remoteTool.name}`;
       if (seen.has(exposedName) || this.isToolNameOwnedByAnother(exposedName, identity2)) {
@@ -21229,7 +22316,8 @@ var McpManager = class {
           exposedName,
           remoteTool,
           timeoutMs,
-          callTool
+          callTool,
+          ...capability ? { capability } : {}
         });
         this.stableAdapters.set(identity2, adapter);
       }
@@ -21264,6 +22352,8 @@ var McpManager = class {
       state: patch.state ?? current?.state ?? "disconnected",
       transport: patch.transport ?? current?.transport ?? "stdio",
       toolCount: patch.toolCount ?? current?.toolCount ?? 0,
+      required: patch.required ?? current?.required ?? false,
+      trust: patch.trust ?? current?.trust ?? "untrusted",
       ...patch.connectedAt !== void 0 ? { connectedAt: patch.connectedAt } : current?.connectedAt !== void 0 ? { connectedAt: current.connectedAt } : {},
       ...patch.serverVersion !== void 0 ? { serverVersion: patch.serverVersion } : current?.serverVersion !== void 0 ? { serverVersion: current.serverVersion } : {},
       ...patch.error !== void 0 ? { error: patch.error } : {}
@@ -21284,20 +22374,24 @@ function activationMetadata(result) {
     availableTools: result.availableTools,
     loadedTools: result.registeredTools,
     deferredTools: result.deferredTools,
-    skippedTools: result.skippedTools
+    skippedTools: result.skippedTools,
+    ...result.schemaBudget ? { schemaBudget: result.schemaBudget } : {}
   };
 }
 function selectRelevantTools(tools, query, limit) {
+  return rankRelevantTools(tools, query).slice(0, limit).map(({ tool }) => tool);
+}
+function rankRelevantTools(tools, query) {
   const terms = new Set(query.toLocaleLowerCase().match(/[\p{L}\p{N}_-]{2,}/gu) ?? []);
   return tools.map((tool) => {
     const searchable = `${tool.definition.name.replaceAll("_", " ")} ${tool.definition.description}`.toLocaleLowerCase();
     let score = 0;
     for (const term of terms) if (searchable.includes(term)) score += term.length;
     return { tool, score };
-  }).sort((left, right) => right.score - left.score || left.tool.definition.name.localeCompare(right.tool.definition.name)).slice(0, limit).map(({ tool }) => tool);
+  }).sort((left, right) => right.score - left.score || left.tool.definition.name.localeCompare(right.tool.definition.name));
 }
 function sanitizeCatalogText(value) {
-  return value ? stripAnsi5(value).replace(/[\u0000-\u001f\u007f]/g, " ").replace(/\s+/g, " ").trim().slice(0, 200) : "";
+  return value ? stripAnsi6(value).replace(/[\u0000-\u001f\u007f]/g, " ").replace(/\s+/g, " ").trim().slice(0, 200) : "";
 }
 function requestOptions(timeoutMs, signal) {
   return {
@@ -21331,7 +22425,7 @@ function errorMessage2(error) {
   return sanitizeStatusText(message2) || "Unknown MCP error";
 }
 function sanitizeStatusText(value) {
-  return stripAnsi5(value).replace(/[\u0000-\u001f\u007f]/g, " ").trim().slice(0, 1e3);
+  return stripAnsi6(value).replace(/[\u0000-\u001f\u007f]/g, " ").trim().slice(0, 1e3);
 }
 function timeoutError(timeoutMs) {
   const error = new Error(`MCP request timed out after ${timeoutMs} ms`);
@@ -21357,9 +22451,9 @@ async function closeTransportQuietly(transport) {
 }
 
 // src/memory/tools.ts
-import { z as z20 } from "zod";
-var scopeSchema = z20.enum(["user", "workspace", "session", "agent"]);
-var kindSchema = z20.enum(["semantic", "episodic", "procedural"]);
+import { z as z21 } from "zod";
+var scopeSchema = z21.enum(["user", "workspace", "session", "agent"]);
+var kindSchema = z21.enum(["semantic", "episodic", "procedural"]);
 function createMemoryTools(store) {
   return [
     {
@@ -21367,6 +22461,8 @@ function createMemoryTools(store) {
         name: "memory_search",
         description: "Search durable user, workspace, session, and agent memories relevant to the task.",
         category: "read",
+        source: "memory",
+        activation: "always",
         inputSchema: jsonSchema({
           query: { type: "string", description: "Natural-language memory query." },
           scope: { type: "string", enum: ["user", "workspace", "session", "agent"] },
@@ -21374,10 +22470,10 @@ function createMemoryTools(store) {
         }, ["query"])
       },
       async execute(arguments_, context) {
-        const input2 = z20.object({
-          query: z20.string().max(4e3),
+        const input2 = z21.object({
+          query: z21.string().max(4e3),
           scope: scopeSchema.optional(),
-          limit: z20.number().int().min(1).max(20).optional()
+          limit: z21.number().int().min(1).max(20).optional()
         }).parse(arguments_);
         const scopes = input2.scope ? [{ scope: input2.scope, scopeKey: scopeKey(input2.scope, context) }] : availableScopes(context);
         const records = store.search(input2.query, { scopes, limit: input2.limit ?? 8 });
@@ -21395,6 +22491,8 @@ ${record.content}`
         name: "memory_propose",
         description: "Propose a non-secret durable memory for user review. The candidate remains inactive until the user explicitly approves it.",
         category: "write",
+        source: "memory",
+        activation: "always",
         inputSchema: jsonSchema({
           content: { type: "string", description: "Concise fact, preference, experience, or procedure to propose. Never include secrets." },
           rationale: { type: "string", description: "Why this is useful beyond the current response and what evidence supports it." },
@@ -21409,17 +22507,17 @@ ${record.content}`
         }, ["content", "rationale"])
       },
       async execute(arguments_, context) {
-        const input2 = z20.object({
-          content: z20.string().min(1).max(12e3),
-          rationale: z20.string().min(1).max(1e3),
+        const input2 = z21.object({
+          content: z21.string().min(1).max(12e3),
+          rationale: z21.string().min(1).max(1e3),
           scope: scopeSchema.optional(),
           kind: kindSchema.optional(),
-          tags: z20.array(z20.string()).max(24).optional(),
-          importance: z20.number().min(0).max(1).optional(),
-          confidence: z20.number().min(0).max(1).optional(),
-          agent: z20.string().max(64).optional(),
-          revision: z20.string().max(240).optional(),
-          conflictKey: z20.string().max(240).optional()
+          tags: z21.array(z21.string()).max(24).optional(),
+          importance: z21.number().min(0).max(1).optional(),
+          confidence: z21.number().min(0).max(1).optional(),
+          agent: z21.string().max(64).optional(),
+          revision: z21.string().max(240).optional(),
+          conflictKey: z21.string().max(240).optional()
         }).strict().parse(arguments_);
         const scope = input2.scope ?? "workspace";
         const candidate = store.propose({
@@ -21451,15 +22549,17 @@ ${record.content}`
         name: "memory_forget",
         description: "Archive or permanently delete a memory by id.",
         category: "write",
+        source: "memory",
+        activation: "always",
         inputSchema: jsonSchema({
           id: { type: "string" },
           permanent: { type: "boolean" }
         }, ["id"])
       },
       async execute(arguments_) {
-        const input2 = z20.object({
-          id: z20.string().uuid(),
-          permanent: z20.boolean().optional()
+        const input2 = z21.object({
+          id: z21.string().uuid(),
+          permanent: z21.boolean().optional()
         }).parse(arguments_);
         const changed = input2.permanent ? store.remove(input2.id) : store.archive(input2.id);
         return {
@@ -21486,9 +22586,9 @@ function scopeKey(scope, context) {
 }
 
 // src/skills/catalog.ts
-import { lstat as lstat21, readFile as readFile20, readdir as readdir9, realpath as realpath9 } from "node:fs/promises";
-import { homedir as homedir4 } from "node:os";
-import { basename as basename12, join as join21, resolve as resolve23 } from "node:path";
+import { lstat as lstat22, readFile as readFile21, readdir as readdir9, realpath as realpath10 } from "node:fs/promises";
+import { homedir as homedir5 } from "node:os";
+import { basename as basename13, join as join22, resolve as resolve25 } from "node:path";
 import { parse as parseYaml3 } from "yaml";
 var SkillCatalog = class {
   constructor(workspace, config) {
@@ -21508,7 +22608,7 @@ var SkillCatalog = class {
     for (const location of locations) {
       const entries = await safeDirectories(location.path);
       for (const entry of entries) {
-        const skillPath = join21(location.path, entry, "SKILL.md");
+        const skillPath = join22(location.path, entry, "SKILL.md");
         const metadata = await readMetadata(skillPath);
         if (!metadata) continue;
         const descriptor = {
@@ -21556,30 +22656,30 @@ ${skill.content}
 </active-skills>`;
 }
 function discoveryLocations(workspace, configured) {
-  const home = homedir4();
-  const workspaceRoot = resolve23(workspace);
+  const home = homedir5();
+  const workspaceRoot = resolve25(workspace);
   return [
-    { path: join21(home, ".agents", "skills"), scope: "user", trusted: true },
-    { path: join21(home, ".claude", "skills"), scope: "user", trusted: true },
-    { path: join21(home, ".augment", "skills"), scope: "user", trusted: true },
-    { path: join21(resolveHomeNamespace(), "skills"), scope: "user", trusted: true },
+    { path: join22(home, ".agents", "skills"), scope: "user", trusted: true },
+    { path: join22(home, ".claude", "skills"), scope: "user", trusted: true },
+    { path: join22(home, ".augment", "skills"), scope: "user", trusted: true },
+    { path: join22(resolveHomeNamespace(), "skills"), scope: "user", trusted: true },
     ...configured.map((path) => {
-      const resolved = resolve23(workspaceRoot, path);
+      const resolved = resolve25(workspaceRoot, path);
       return {
         path: resolved,
         scope: "configured",
         trusted: !isInside(workspaceRoot, resolved)
       };
     }),
-    { path: join21(workspace, ".agents", "skills"), scope: "workspace", trusted: false },
-    { path: join21(workspace, ".claude", "skills"), scope: "workspace", trusted: false },
-    { path: join21(workspace, ".augment", "skills"), scope: "workspace", trusted: false },
-    { path: join21(resolveProjectNamespaceSync(workspaceRoot).active, "skills"), scope: "workspace", trusted: false }
+    { path: join22(workspace, ".agents", "skills"), scope: "workspace", trusted: false },
+    { path: join22(workspace, ".claude", "skills"), scope: "workspace", trusted: false },
+    { path: join22(workspace, ".augment", "skills"), scope: "workspace", trusted: false },
+    { path: join22(resolveProjectNamespaceSync(workspaceRoot).active, "skills"), scope: "workspace", trusted: false }
   ];
 }
 async function safeDirectories(path) {
   try {
-    const info = await lstat21(path);
+    const info = await lstat22(path);
     if (!info.isDirectory() || info.isSymbolicLink()) return [];
     const entries = await readdir9(path, { withFileTypes: true });
     return entries.filter((entry) => entry.isDirectory() && !entry.isSymbolicLink()).map((entry) => entry.name).slice(0, 500);
@@ -21593,7 +22693,7 @@ async function readMetadata(path) {
   const { frontmatter } = splitFrontmatter(raw);
   if (!frontmatter) return void 0;
   const parsed = parseYaml3(frontmatter);
-  const name = typeof parsed?.name === "string" ? parsed.name.trim() : basename12(resolve23(path, ".."));
+  const name = typeof parsed?.name === "string" ? parsed.name.trim() : basename13(resolve25(path, ".."));
   const description = typeof parsed?.description === "string" ? parsed.description.trim() : "";
   if (!/^[a-z][a-z0-9_-]{0,63}$/.test(name) || !description || description.length > 1e3) {
     return void 0;
@@ -21612,13 +22712,13 @@ async function readSkill(path, maxChars) {
 }
 async function safeRead(path, maxBytes) {
   try {
-    const info = await lstat21(path);
+    const info = await lstat22(path);
     if (!info.isFile() || info.isSymbolicLink() || info.size > maxBytes) return void 0;
-    const parent = resolve23(path, "..");
-    const resolvedParent = await realpath9(parent);
-    const resolvedPath = await realpath9(path);
+    const parent = resolve25(path, "..");
+    const resolvedParent = await realpath10(parent);
+    const resolvedPath = await realpath10(path);
     if (!resolvedPath.startsWith(`${resolvedParent}/`)) return void 0;
-    return await readFile20(path, "utf8");
+    return await readFile21(path, "utf8");
   } catch {
     return void 0;
   }
@@ -21663,7 +22763,7 @@ function escapeAttribute6(value) {
 }
 
 // src/workflows/catalog.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 var builtInWorkflows = [
   {
     name: "implement",
@@ -21748,13 +22848,15 @@ function createWorkflowTool(catalog) {
       name: "workflow_plan",
       description: "Load a built-in typed workflow for implementation, debugging, review, or refactoring.",
       category: "read",
+      source: "workflow",
+      activation: "always",
       inputSchema: jsonSchema({
         name: { type: "string", enum: catalog.list().map((workflow) => workflow.name) },
         task: { type: "string" }
       }, ["name", "task"])
     },
     async execute(arguments_) {
-      const input2 = z21.object({ name: z21.string(), task: z21.string().min(1).max(2e4) }).parse(arguments_);
+      const input2 = z22.object({ name: z22.string(), task: z22.string().min(1).max(2e4) }).parse(arguments_);
       const workflow = catalog.get(input2.name);
       if (!workflow) return { ok: false, content: `Unknown workflow: ${input2.name}` };
       return {
@@ -21797,9 +22899,10 @@ var ExtensionRuntime = class _ExtensionRuntime {
   workflows = new WorkflowCatalog();
   options;
   delegation;
+  registry;
   initialized = false;
   static async create(config, registry, options = {}) {
-    const runtime = new _ExtensionRuntime(config, resolve24(config.workspaceRoots[0] ?? process.cwd()), options);
+    const runtime = new _ExtensionRuntime(config, resolve26(config.workspaceRoots[0] ?? process.cwd()), options);
     try {
       await runtime.initialize(registry, options.signal);
       return runtime;
@@ -21820,8 +22923,8 @@ var ExtensionRuntime = class _ExtensionRuntime {
     }
     await this.skills?.discover();
     if (this.mcp) {
-      const activationTool = this.mcp.activationTool(registry);
-      if (activationTool) registry.register(activationTool);
+      await this.mcp.initialize(_signal);
+      for (const tool of this.mcp.catalogTools(registry)) registry.register(tool);
     }
     await this.profiles?.discover();
     if (this.config.agents?.enabled && this.profiles && this.options.provider && this.options.contextEngine) {
@@ -21842,6 +22945,7 @@ var ExtensionRuntime = class _ExtensionRuntime {
       }
     }
     registry.register(createWorkflowTool(this.workflows));
+    this.registry = registry;
     this.initialized = true;
   }
   async prepare(input2, session) {
@@ -21916,6 +23020,25 @@ var ExtensionRuntime = class _ExtensionRuntime {
   mcpStatus() {
     return this.mcp?.list() ?? [];
   }
+  mcpSearch(query = "") {
+    return this.mcp?.search(query) ?? [];
+  }
+  mcpInspect(name) {
+    return this.mcp?.inspect(name);
+  }
+  async mcpTrust(name) {
+    return this.mcp?.trust(name);
+  }
+  async mcpDisable(name) {
+    return this.mcp?.disable(name);
+  }
+  async mcpRevoke(name) {
+    return this.mcp?.revoke(name);
+  }
+  async mcpActivate(name, query, signal) {
+    if (!this.mcp || !this.registry) return;
+    return this.mcp.activate(name, query, this.registry, signal);
+  }
   cancelAgent(id) {
     return this.delegation?.cancelAgent(id) ?? false;
   }
@@ -22004,15 +23127,15 @@ function upgradeCommandOverride(env = process.env) {
   return trimmed ? trimmed : void 0;
 }
 function runUpgrade(plan) {
-  return new Promise((resolve26) => {
+  return new Promise((resolve28) => {
     const child = spawn2(plan.command, plan.args, {
       stdio: "inherit",
       shell: plan.shell ?? false
     });
-    child.on("error", () => resolve26({ ok: false, exitCode: 127, display: plan.display }));
+    child.on("error", () => resolve28({ ok: false, exitCode: 127, display: plan.display }));
     child.on("close", (code) => {
       const exitCode = code ?? 1;
-      resolve26({ ok: exitCode === 0, exitCode, display: plan.display });
+      resolve28({ ok: exitCode === 0, exitCode, display: plan.display });
     });
   });
 }
@@ -22193,7 +23316,7 @@ program.command("migrate").description("Inspect or migrate legacy .mosaic state
     process.stdout.write(`${recovery.status === "recovered" ? "Recovered" : "Recovery candidates"}: ${recovery.destination}
 `);
     for (const candidate of recovery.candidates) {
-      process.stdout.write(`  ${basename13(candidate.path)}  ${candidate.kind}  ${candidate.action}  ${candidate.detail}
+      process.stdout.write(`  ${basename14(candidate.path)}  ${candidate.kind}  ${candidate.action}  ${candidate.detail}
 `);
     }
     if (!options.yes && recovery.status === "ready") {
@@ -22274,7 +23397,7 @@ sessionCommand.command("export <id>").description("Export a session as Markdown"
   const store = new SessionStore(workspaceOption(options.workspace));
   const session = await requireSessionSelector(store, id);
   const markdown = sessionMarkdown(session);
-  if (options.output) await writeFile3(resolve25(options.output), markdown, "utf8");
+  if (options.output) await writeFile3(resolve27(options.output), markdown, "utf8");
   else process.stdout.write(markdown);
 });
 var checkpointCommand = program.command("checkpoint").description("Inspect and restore pre-mutation snapshots");
@@ -22587,7 +23710,7 @@ memoryCommand.command("reject <id>").description("Reject a memory proposal witho
   }
 });
 var mcpCommand = program.command("mcp").description("Inspect configured MCP servers");
-mcpCommand.command("status").description("Connect and report MCP server/tool status").option("-w, --workspace <path>", "workspace root").option("--config <path>", "explicit config file").option("--json", "print JSON").action(async (options) => {
+mcpCommand.command("status").description("Report redacted MCP trust and connection status without connecting optional servers").option("-w, --workspace <path>", "workspace root").option("--config <path>", "explicit config file").option("--json", "print JSON").action(async (options) => {
   const config = await runtimeConfig(workspaceOption(options.workspace), runtimeOptions(options));
   if (!config.mcp) return printObject([], options.json === true);
   const manager = new McpManager(config.mcp, {
@@ -22595,18 +23718,99 @@ mcpCommand.command("status").description("Connect and report MCP server/tool sta
     workspaceRoots: config.workspaceRoots
   });
   try {
-    await manager.connectAll();
+    await manager.loadTrust();
     const status = manager.list();
     if (options.json) printObject(status, true);
     else if (!status.length) process.stdout.write("No MCP servers configured.\n");
     else for (const server of status) {
-      process.stdout.write(`${server.name.padEnd(18)} ${server.state.padEnd(12)} ${server.toolCount} tools${server.error ? `  ${server.error}` : ""}
+      process.stdout.write(`${server.name.padEnd(18)} ${server.state.padEnd(12)} ${server.trust.padEnd(10)} ${server.required ? "required" : "optional"}  ${server.toolCount} tools${server.error ? `  ${server.error}` : ""}
 `);
     }
   } finally {
     await manager.close();
   }
 });
+mcpCommand.command("search [query...]").description("Search configured capability manifests without network access").option("-w, --workspace <path>", "workspace root").option("--config <path>", "explicit config file").option("--json", "print JSON").action(async (query, options) => {
+  const config = await runtimeConfig(workspaceOption(options.workspace), runtimeOptions(options));
+  if (!config.mcp) return printObject([], options.json === true);
+  const manager = createMcpManager(config);
+  await manager.loadTrust();
+  const results = manager.search(query.join(" "));
+  if (options.json) printObject(results, true);
+  else if (!results.length) process.stdout.write("No configured MCP capability matched.\n");
+  else for (const result of results) {
+    process.stdout.write(`${result.name.padEnd(18)} ${result.trust.padEnd(10)} ${result.version}  ${result.description}
+`);
+  }
+});
+mcpCommand.command("inspect <server>").description("Review a redacted declarative capability manifest without connecting").option("-w, --workspace <path>", "workspace root").option("--config <path>", "explicit config file").option("--json", "print JSON").action(async (server, options) => {
+  const config = await runtimeConfig(workspaceOption(options.workspace), runtimeOptions(options));
+  if (!config.mcp) throw new Error("MCP is not configured.");
+  const manager = createMcpManager(config);
+  await manager.loadTrust();
+  const review = {
+    manifest: manager.inspect(server),
+    fingerprint: manager.fingerprint(server),
+    trust: manager.status(server)?.trust ?? "untrusted"
+  };
+  if (options.json) printObject(review, true);
+  else printMcpManifest(review);
+});
+mcpCommand.command("trust <server>").description("Trust the current redacted manifest fingerprint after review").option("-w, --workspace <path>", "workspace root").option("--config <path>", "explicit config file").option("--json", "print JSON").option("--yes", "confirm trust non-interactively").action(async (server, options) => {
+  const config = await runtimeConfig(workspaceOption(options.workspace), runtimeOptions(options));
+  if (!config.mcp) throw new Error("MCP is not configured.");
+  const manager = createMcpManager(config);
+  await manager.loadTrust();
+  const review = {
+    manifest: manager.inspect(server),
+    fingerprint: manager.fingerprint(server),
+    trust: manager.status(server)?.trust ?? "untrusted"
+  };
+  if (!options.json) printMcpManifest(review);
+  if (!options.yes && !await confirm(`Trust this exact capability manifest for ${server}?`)) return;
+  const status = await manager.trust(server);
+  if (options.json) printObject({ manifest: review.manifest, fingerprint: review.fingerprint, status }, true);
+  else process.stdout.write(`Trusted ${server}. Activation remains explicit.
+`);
+});
+mcpCommand.command("activate <server> <query...>").description("Connect one trusted server and load only query-relevant schemas").option("-w, --workspace <path>", "workspace root").option("--config <path>", "explicit config file").option("--json", "print JSON").action(async (server, query, options) => {
+  const config = await runtimeConfig(workspaceOption(options.workspace), runtimeOptions(options));
+  if (!config.mcp) throw new Error("MCP is not configured.");
+  const manager = createMcpManager(config);
+  const registry = createDefaultToolRegistry();
+  try {
+    await manager.loadTrust();
+    const result = await manager.activate(server, query.join(" "), registry);
+    if (options.json) printObject(result, true);
+    else process.stdout.write(result.ok ? `Activated ${server}; loaded ${result.registeredTools.length}/${result.availableTools} relevant schemas.
+` : `Could not activate ${server}: ${result.status.error ?? result.status.trust}.
+`);
+    if (!result.ok) process.exitCode = 1;
+  } finally {
+    await manager.close();
+  }
+});
+mcpCommand.command("disable <server>").description("Persistently disable an MCP capability and unload its schemas").option("-w, --workspace <path>", "workspace root").option("--config <path>", "explicit config file").option("--json", "print JSON").action(async (server, options) => {
+  const config = await runtimeConfig(workspaceOption(options.workspace), runtimeOptions(options));
+  if (!config.mcp) throw new Error("MCP is not configured.");
+  const manager = createMcpManager(config);
+  await manager.loadTrust();
+  const status = await manager.disable(server);
+  if (options.json) printObject(status, true);
+  else process.stdout.write(`Disabled ${server}.
+`);
+});
+mcpCommand.command("revoke <server>").description("Revoke persisted MCP trust and require a fresh review").option("-w, --workspace <path>", "workspace root").option("--config <path>", "explicit config file").option("--json", "print JSON").option("--yes", "confirm revocation non-interactively").action(async (server, options) => {
+  const config = await runtimeConfig(workspaceOption(options.workspace), runtimeOptions(options));
+  if (!config.mcp) throw new Error("MCP is not configured.");
+  if (!options.yes && !await confirm(`Revoke persisted trust for ${server}?`)) return;
+  const manager = createMcpManager(config);
+  await manager.loadTrust();
+  const status = await manager.revoke(server);
+  if (options.json) printObject(status, true);
+  else process.stdout.write(`Revoked ${server}; inspect and trust the manifest before reuse.
+`);
+});
 program.command("rules").description("List user and workspace rules loaded into the agent").option("-w, --workspace <path>", "workspace root").option("--json", "print JSON").action(async (options) => {
   const rules = await discoverWorkspaceRules(workspaceOption(options.workspace));
   if (options.json) {
@@ -22636,14 +23840,26 @@ async function runCli() {
   try {
     await program.parseAsync(process.argv);
   } catch (error) {
-    const message2 = error instanceof Error ? error.message : String(error);
-    process.stderr.write(`${chalk4.red(cliGlyphs.error)} ${message2}
+    const format = structuredOutputFormat(process.argv);
+    if (format) {
+      const reporter = new HeadlessReporter({ format, color: false });
+      process.exitCode = reporter.fail(error).exitCode;
+    } else {
+      const message2 = error instanceof Error ? error.message : String(error);
+      process.stderr.write(`${chalk4.red(cliGlyphs.error)} ${message2}
 `);
-    process.exitCode = 1;
+      process.exitCode = 1;
+    }
   } finally {
     releaseCliNamespaceLeases(cliNamespaceLeases);
   }
 }
+function structuredOutputFormat(argv) {
+  const inline = argv.find((argument) => argument.startsWith("--output-format="))?.slice("--output-format=".length);
+  const index = argv.indexOf("--output-format");
+  const value = inline ?? (index >= 0 ? argv[index + 1] : void 0);
+  return value === "json" || value === "stream-json" ? value : void 0;
+}
 async function runChat(prompts, options) {
   const shouldPrint = options.print === true || !process.stdin.isTTY || !process.stdout.isTTY;
   if (options.ask && options.plan) throw new Error("--ask and --plan cannot be used together.");
@@ -22651,7 +23867,7 @@ async function runChat(prompts, options) {
   const stdinPrompt = !process.stdin.isTTY ? await readStdin() : "";
   const firstPrompt = [...prompts, stdinPrompt].filter(Boolean).join("\n\n").trim();
   if (shouldPrint && !firstPrompt) throw new Error("Provide a prompt argument or pipe input on stdin.");
-  const workspace = resolve25(options.workspace);
+  const workspace = resolve27(options.workspace);
   let config = await runtimeConfig(workspace, options);
   let completedOnboarding = false;
   if (!shouldPrint && needsFirstRunOnboarding(config)) {
@@ -22711,7 +23927,8 @@ async function runChat(prompts, options) {
     color: (options.color ?? config.ui.color) && !process.env.NO_COLOR
   });
   const colorOutput = (options.color ?? config.ui.color) && !process.env.NO_COLOR;
-  const requestPermission = options.yes ? async () => true : options.autoEdit ? async (_call, category) => category === "read" || category === "write" ? true : askConsolePermission(_call, category, colorOutput) : async (call, category) => askConsolePermission(call, category, colorOutput);
+  const requestPermission = options.yes ? async () => true : options.autoEdit ? async (_call, category, reason) => category === "read" || category === "write" ? true : askConsolePermission(_call, category, colorOutput, reason) : async (call, category, reason) => askConsolePermission(call, category, colorOutput, reason);
+  let extensionsClosed = false;
   try {
     let session = await runner.run(firstPrompt, {
       askMode: options.ask === true || options.plan === true,
@@ -22730,13 +23947,15 @@ async function runChat(prompts, options) {
         requestPermission
       });
     }
-    reporter.finish(session);
-    if (session.pendingInput) process.exitCode = 2;
+    await extensions.close();
+    extensionsClosed = true;
+    const outcome2 = reporter.finish(session);
+    process.exitCode = outcome2.exitCode;
   } catch (error) {
-    reporter.fail(error);
-    process.exitCode = 1;
+    const outcome2 = reporter.fail(error, runner.getSession());
+    process.exitCode = outcome2.exitCode;
   } finally {
-    await extensions.close();
+    if (!extensionsClosed) await extensions.close().catch(() => void 0);
   }
 }
 async function openMemoryStore(config) {
@@ -22878,14 +24097,14 @@ async function runAgentSetup(options) {
 `);
 }
 async function runtimeConfig(workspaceInput, options) {
-  const workspace = resolve25(workspaceInput);
+  const workspace = resolve27(workspaceInput);
   const loaded = await loadConfig(workspace, options.config, {
     trustProjectConfig: options.trustProjectConfig === true
   });
   const roots = [
     workspace,
     ...loaded.workspaceRoots,
-    ...(options.addWorkspace ?? []).map((root) => resolve25(workspace, root))
+    ...(options.addWorkspace ?? []).map((root) => resolve27(workspace, root))
   ];
   const provider = options.provider ? validateProvider(options.provider) : loaded.model.provider;
   return {
@@ -23023,6 +24242,36 @@ function sessionMarkdown(session) {
   return `${lines.join("\n")}
 `;
 }
+function createMcpManager(config) {
+  if (!config.mcp) throw new Error("MCP is not configured.");
+  return new McpManager(config.mcp, {
+    cwd: config.workspaceRoots[0] ?? process.cwd(),
+    workspaceRoots: config.workspaceRoots
+  });
+}
+function printMcpManifest(review) {
+  const { manifest } = review;
+  process.stdout.write(`MCP capability ${manifest.name} (${manifest.version})
+`);
+  process.stdout.write(`  Source: ${manifest.source.kind}/${manifest.source.owner}
+`);
+  process.stdout.write(`  Target: ${manifest.transport} ${manifest.target}
+`);
+  process.stdout.write(`  Trust: ${review.trust}  ${manifest.required ? "required" : "optional"}
+`);
+  process.stdout.write(`  Fingerprint: ${review.fingerprint}
+`);
+  if (!manifest.tools.length) {
+    process.stdout.write("  Tools: dynamically discovered; network-only, completion evidence unsupported\n");
+    return;
+  }
+  for (const tool of manifest.tools) {
+    process.stdout.write(`  ${tool.name}: ${tool.permissions.join("+")}  evidence=${tool.completionEvidence}
+`);
+    process.stdout.write(`    network=${tool.network.join(", ") || "unspecified"} commands=${tool.commands.join(", ") || "none"} paths=${tool.paths.join(", ") || "none"} sensitive=${tool.sensitiveFields.join(", ") || "none"}
+`);
+  }
+}
 async function confirm(prompt) {
   if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
   const readline = createInterface2({ input, output });
@@ -23042,7 +24291,7 @@ function collect(value, previous) {
 }
 function workspaceOption(value) {
   const rootOptions = program.opts();
-  return resolve25(value ?? rootOptions.workspace ?? process.cwd());
+  return resolve27(value ?? rootOptions.workspace ?? process.cwd());
 }
 function runtimeOptions(options) {
   const root = program.opts();