@skein-code/cli 0.3.26 → 0.3.28

package/dist/cli.js

@@ -4,7 +4,7 @@
 import { createInterface as createInterface2 } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 import { writeFile as writeFile3 } from "node:fs/promises";
-import { basename as basename13, resolve as resolve25 } from "node:path";
+import { basename as basename14, resolve as resolve27 } from "node:path";
 import { Command, Option } from "commander";
 import chalk4 from "chalk";
 
@@ -220,7 +220,7 @@ function isSqliteBusy(error) {
 // package.json
 var package_default = {
   name: "@skein-code/cli",
-  version: "0.3.26",
+  version: "0.3.28",
   description: "A context-first, model-agnostic coding agent with an auditable terminal workspace.",
   type: "module",
   license: "MIT",
@@ -236,6 +236,14 @@ var package_default = {
   },
   skein: {
     releaseNotes: [
+      "MCP trust and revoke confirmation rendering now has a deterministic cross-platform release regression gate",
+      "MCP now follows a no-network search and inspect review before explicit workspace-bound manifest trust and lazy activation",
+      "Declarative capability manifests expose redacted source, version, tools, permissions, network, command, path, sensitive-field, process, and completion-evidence effects",
+      "Persistent disable and revoke unload active remote schemas while manifest fingerprint changes fail closed to untrusted",
+      "Server annotations cannot lower local permissions, named manifests reject injected undeclared schemas, and optional server failures remain isolated",
+      "Only explicitly required trusted MCP servers may block startup, while status inspection no longer connects optional servers",
+      "Sensitive MCP arguments are redacted from terminal, TUI, JSON, and approval events; unsupported external mutations remain completion-unresolved",
+      "Explain and review intents expose smaller built-in schema sets, and MCP activation reports deterministic eager-versus-loaded schema estimates plus top-match evidence",
       "First-run setup now states that the primary agent needs API credentials and that provider subscriptions or signed-in coding CLIs are separate delegated tools",
       "Permission prompts show the policy reason, redacted target, working directory, category risk, and explicit once, session, deny, and stop choices",
       "The Recovery Center joins last-run state, failure repair hints, changed files, checkpoints, diff, audit, rollback, retry, and safe session resume",
@@ -1955,8 +1963,22 @@ var agentTeamConfigSchema = z2.object({
 }).partial();
 var mcpServerSchema = z2.object({
   enabled: z2.boolean().optional(),
+  required: z2.boolean().optional(),
   transport: z2.enum(["stdio", "http"]).optional(),
   description: z2.string().min(1).max(500).optional(),
+  version: z2.string().min(1).max(128).optional(),
+  tools: z2.array(z2.object({
+    name: z2.string().min(1).max(256),
+    description: z2.string().min(1).max(500).optional(),
+    permissions: z2.array(z2.enum(["read", "write", "shell", "git", "network"])).min(1).max(5),
+    network: z2.array(z2.string().min(1).max(500)).max(32).optional(),
+    commands: z2.array(z2.string().min(1).max(500)).max(32).optional(),
+    paths: z2.array(z2.string().min(1).max(4e3)).max(64).optional(),
+    sensitiveFields: z2.array(z2.string().min(1).max(256)).max(64).optional(),
+    background: z2.boolean().optional(),
+    processTree: z2.boolean().optional(),
+    completionEvidence: z2.enum(["full", "partial", "none"]).optional()
+  }).strict()).max(256).optional(),
   command: z2.string().min(1).max(512).optional(),
   args: z2.array(z2.string().max(4e3)).max(64).optional(),
   cwd: z2.string().max(4e3).optional(),
@@ -1965,7 +1987,33 @@ var mcpServerSchema = z2.object({
   headers: z2.record(z2.string(), z2.string().max(2e4)).optional(),
   timeoutMs: z2.number().int().positive().max(3e5).optional(),
   toolPrefix: z2.string().regex(/^[a-z][a-z0-9_-]{0,24}$/).optional()
-}).strict();
+}).strict().superRefine((server, context) => {
+  const names = /* @__PURE__ */ new Set();
+  for (const [index, tool] of (server.tools ?? []).entries()) {
+    if (names.has(tool.name)) {
+      context.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["tools", index, "name"],
+        message: `duplicate MCP capability tool: ${tool.name}`
+      });
+    }
+    names.add(tool.name);
+    if (tool.permissions.includes("shell") && !tool.commands?.length) {
+      context.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["tools", index, "commands"],
+        message: "MCP shell capability must declare command scopes"
+      });
+    }
+    if (tool.permissions.includes("write") && !tool.paths?.length) {
+      context.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["tools", index, "paths"],
+        message: "MCP write capability must declare path scopes"
+      });
+    }
+  }
+});
 var mcpConfigSchema = z2.object({
   enabled: z2.boolean().optional(),
   connectTimeoutMs: z2.number().int().positive().max(3e5).optional(),
@@ -3142,7 +3190,7 @@ function executableNames(command2) {
   return [command2, ...extensions.map((extension) => `${command2}${extension}`)];
 }
 function runProcess(command2, args, options) {
-  return new Promise((resolve26, reject) => {
+  return new Promise((resolve28, reject) => {
     const started = Date.now();
     const environment = options.inheritEnv === false ? {} : { ...process.env };
     for (const name of options.unsetEnv ?? []) delete environment[name];
@@ -3234,7 +3282,7 @@ function runProcess(command2, args, options) {
         reject(callbackError);
         return;
       }
-      resolve26({
+      resolve28({
         command: [command2, ...args].join(" "),
         exitCode: code ?? (timedOut ? 124 : 1),
         stdout,
@@ -5569,12 +5617,12 @@ function rankMentionSuggestions(candidates, partial, limit = 6) {
 }
 function rankMention(path, needle) {
   const lower = normalizeForMatch(path);
-  const basename14 = lower.slice(lower.lastIndexOf("/") + 1);
+  const basename15 = lower.slice(lower.lastIndexOf("/") + 1);
   const segments = lower.split("/");
   if (!needle) return segments.length * 100 + lower.length;
   if (lower === needle) return 0;
-  if (basename14 === needle) return 10 + lower.length;
-  if (basename14.startsWith(needle)) return 100 + basename14.length + lower.length / 1e3;
+  if (basename15 === needle) return 10 + lower.length;
+  if (basename15.startsWith(needle)) return 100 + basename15.length + lower.length / 1e3;
   if (segments.some((segment) => segment.startsWith(needle))) {
     return 200 + lower.indexOf(needle) + lower.length / 1e3;
   }
@@ -6321,11 +6369,11 @@ var CheckpointStore = class {
   }
   async capture(sessionId, paths, options = {}) {
     validateIdentifier(sessionId, "session");
-    const unique3 = [...new Set(paths)];
-    if (!unique3.length) return void 0;
-    return this.withManagedLease(() => this.captureUnlocked(sessionId, unique3, options));
+    const unique4 = [...new Set(paths)];
+    if (!unique4.length) return void 0;
+    return this.withManagedLease(() => this.captureUnlocked(sessionId, unique4, options));
   }
-  async captureUnlocked(sessionId, unique3, options) {
+  async captureUnlocked(sessionId, unique4, options) {
     const id = `${Date.now().toString(36)}-${randomUUID9()}`;
     const target = join9(this.directory, sessionId, id);
     const blobDirectory = join9(target, "blobs");
@@ -6334,7 +6382,7 @@ var CheckpointStore = class {
     await mkdir7(blobDirectory, { recursive: true });
     await this.assertManagedPath(blobDirectory);
     const entries = [];
-    for (const input2 of unique3) {
+    for (const input2 of unique4) {
       const path = await this.workspace.resolvePath(input2, { allowMissing: true });
       try {
         const info = await lstat10(path);
@@ -8613,6 +8661,16 @@ var ToolRegistry = class {
   has(name) {
     return this.tools.has(name) || this.aliases.has(name);
   }
+  /** Remove one exact tool instance without letting extensions evict core tools. */
+  unregister(name, expected) {
+    const current = this.tools.get(name);
+    if (!current || expected && current !== expected) return false;
+    this.tools.delete(name);
+    for (const [alias, target] of this.aliases) {
+      if (target === name) this.aliases.delete(alias);
+    }
+    return true;
+  }
   list() {
     return [...this.tools.values()];
   }
@@ -11495,6 +11553,7 @@ ${resolvedInput.decision}
             this.session.audit ?? [],
             this.session.duplicationSuppressions ?? []
           ).size > 0,
+          turnDirective.intent,
           request,
           loadedProgressiveTools
         );
@@ -11791,7 +11850,8 @@ ${input2}`
     }
     await this.persist();
     throwIfAborted(options.signal);
-    await emit({ type: "tool_start", call, category: tool.definition.category });
+    const displayCall = redactToolCallForDisplay(call, tool.definition.sensitiveFields ?? []);
+    await emit({ type: "tool_start", call: displayCall, category: tool.definition.category });
     const executionContext = {
       config: this.config,
       workspace: this.workspace,
@@ -11981,13 +12041,17 @@ ${completeContent}`;
       this.recordPermission(call, category, "allow", "Approved for this session.");
       return true;
     }
-    await emit({ type: "permission", call, category, reason: decision.reason });
+    const displayCall = redactToolCallForDisplay(
+      call,
+      this.tools.get(call.name)?.definition.sensitiveFields ?? []
+    );
+    await emit({ type: "permission", call: displayCall, category, reason: decision.reason });
     if (!options.requestPermission) {
       this.recordPermission(call, category, "deny", "No permission handler was available.");
       return false;
     }
     try {
-      const grant = await options.requestPermission(call, category, decision.reason);
+      const grant = await options.requestPermission(displayCall, category, decision.reason);
       const allowed = grant === true || grant === "session";
       if (grant === "session") this.sessionApprovals.add(approvalKey);
       this.recordPermission(
@@ -12393,6 +12457,20 @@ function combineMeasurementSources(input2, output2, inputTokens, outputTokens) {
 function uniqueCategories(categories) {
   return [...new Set(categories)];
 }
+function redactToolCallForDisplay(call, sensitiveFields) {
+  if (!sensitiveFields.length) return call;
+  const sensitive = new Set(sensitiveFields.map((field) => field.toLocaleLowerCase()));
+  const redact2 = (value, path = []) => {
+    if (Array.isArray(value)) return value.map((item, index) => redact2(item, [...path, String(index)]));
+    if (!value || typeof value !== "object") return value;
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => {
+      const fieldPath = [...path, key].join(".").toLocaleLowerCase();
+      const field = key.toLocaleLowerCase();
+      return [key, sensitive.has(field) || sensitive.has(fieldPath) ? "<redacted>" : redact2(item, [...path, key])];
+    }));
+  };
+  return { ...call, arguments: redact2(call.arguments) };
+}
 function failedResult(call, content, failure) {
   return {
     toolCallId: call.id,
@@ -12408,9 +12486,9 @@ function failureSignatureFromMetadata(value) {
   const signature = value.signature;
   return typeof signature === "string" && signature ? signature : void 0;
 }
-function visibleToolDefinitions(tools, askMode, contractEnabled, artifactReadAvailable, duplicationAvailable, request, loadedProgressiveTools) {
+function visibleToolDefinitions(tools, askMode, contractEnabled, artifactReadAvailable, duplicationAvailable, intent, request, loadedProgressiveTools) {
   const eligible = tools.definitions().filter(
-    (tool) => (!askMode || tool.category === "read") && (contractEnabled || tool.name !== "task_contract") && (artifactReadAvailable || tool.name !== "read_tool_artifact") && (duplicationAvailable || tool.name !== "duplication_audit")
+    (tool) => (!askMode || tool.category === "read") && intentAllowsTool(intent, tool) && (contractEnabled || tool.name !== "task_contract") && (artifactReadAvailable || tool.name !== "read_tool_artifact") && (duplicationAvailable || tool.name !== "duplication_audit")
   );
   const progressive = eligible.filter((tool) => tool.progressive);
   if (progressive.length <= 8) return eligible;
@@ -12419,6 +12497,26 @@ function visibleToolDefinitions(tools, askMode, contractEnabled, artifactReadAva
   }
   return eligible.filter((tool) => !tool.progressive || loadedProgressiveTools.has(tool.name));
 }
+function intentAllowsTool(intent, tool) {
+  if (!BUILTIN_TOOL_NAMES.has(tool.name)) return true;
+  if (intent === "explain") return tool.category === "read";
+  if (intent === "review") return tool.category === "read" || tool.name === "git";
+  return true;
+}
+var BUILTIN_TOOL_NAMES = /* @__PURE__ */ new Set([
+  "read_file",
+  "read_tool_artifact",
+  "list_files",
+  "search_code",
+  "write_file",
+  "apply_patch",
+  "shell",
+  "git",
+  "task",
+  "task_contract",
+  "duplication_audit",
+  "working_memory"
+]);
 function selectProgressiveTools(tools, request, limit) {
   const terms = new Set(request.toLocaleLowerCase().match(/[\p{L}\p{N}_-]{2,}/gu) ?? []);
   return tools.map((tool) => {
@@ -13470,6 +13568,8 @@ var DelegationManager = class {
     return {
       definition: {
         name: "delegate",
+        source: "agent",
+        activation: "always",
         description: "Run independent read-only investigations with specialized isolated agents and return concise evidence-backed summaries.",
         category: "read",
         inputSchema: jsonSchema({
@@ -13517,6 +13617,8 @@ var DelegationManager = class {
     return {
       definition: {
         name: "team_run",
+        source: "agent",
+        activation: "always",
         description: "Run a visible multi-model council: parallel read-only specialists share findings, a reviewer challenges them, and one bounded revision round runs before returning an acceptance report.",
         category: "read",
         inputSchema: jsonSchema({
@@ -13561,6 +13663,8 @@ var DelegationManager = class {
     return {
       definition: {
         name: "writer_run",
+        source: "agent",
+        activation: "always",
         description: "Create one reviewed patch in a disposable Git worktree. This never changes the main workspace; use writer_integrate explicitly after review.",
         category: "write",
         inputSchema: jsonSchema({
@@ -13593,6 +13697,8 @@ var DelegationManager = class {
     return {
       definition: {
         name: "writer_integrate",
+        source: "agent",
+        activation: "always",
         description: "Explicitly apply one accepted writer patch to the main workspace after SHA, HEAD, cleanliness, path, and checkpoint gates pass.",
         category: "write",
         inputSchema: jsonSchema({
@@ -15476,7 +15582,7 @@ var commandDefinitions = [
   command("skills", "List discovered task playbooks"),
   command("agents", "List built-in and installed expert profiles"),
   command("connections", "Inspect shared model endpoints and setup status", "/connections [setup]"),
-  command("mcp", "Show external MCP server health and tools"),
+  command("mcp", "Search, inspect, trust, activate, disable, or revoke MCP capabilities", "/mcp [search|inspect|trust|activate|disable|revoke] [...]"),
   command("tools", "List built-in and MCP tools with permission categories"),
   command("permissions", "Inspect the active permission policy"),
   command("changes", "List files changed in the active session"),
@@ -15532,6 +15638,21 @@ function commandSuggestions(input2, options = {}) {
       description: item.description
     }));
   }
+  if (firstSpace >= 0 && commandName === "mcp") {
+    const query = argument.trim().toLocaleLowerCase();
+    return [
+      { name: "search", description: "Search redacted local capability manifests" },
+      { name: "inspect", description: "Review one manifest before trust" },
+      { name: "trust", description: "Trust the current manifest after confirmation" },
+      { name: "activate", description: "Connect a trusted server and load relevant schemas" },
+      { name: "disable", description: "Persistently disable a capability" },
+      { name: "revoke", description: "Revoke trust after confirmation" }
+    ].filter((item) => item.name.includes(query)).map((item) => ({
+      value: `/mcp ${item.name} `,
+      label: item.name,
+      description: item.description
+    }));
+  }
   if (firstSpace >= 0 && commandName === "connections") {
     return [{
       value: "/connections setup",
@@ -18446,11 +18567,11 @@ function SkeinApp({ runner, config, extensions, initialPrompt, askMode = false,
     return () => clearInterval(timer);
   }, [busy]);
   const requestPermission = useCallback((call, category, reason) => {
-    return new Promise((resolve26) => setPermission({
+    return new Promise((resolve28) => setPermission({
       call,
       category,
       ...reason ? { reason } : {},
-      resolve: resolve26
+      resolve: resolve28
     }));
   }, []);
   const onEvent = useCallback((event) => {
@@ -18972,19 +19093,103 @@ function SkeinApp({ runner, config, extensions, initialPrompt, askMode = false,
       return true;
     }
     if (command2 === "mcp") {
+      const [action = "list", server = "", ...tail] = argument.split(/\s+/u).filter(Boolean);
+      if (action === "search") {
+        const results = extensions?.mcpSearch([server, ...tail].filter(Boolean).join(" ")) ?? [];
+        appendList("MCP capability search", results.length ? results.map((result) => ({
+          label: `${result.name}  ${result.trust}${result.required ? `${separator}required` : ""}`,
+          detail: `${result.description}${separator}${result.version}${separator}${result.declaredTools || "dynamic"} tools`,
+          tone: result.trust === "trusted" ? "success" : result.trust === "revoked" ? "error" : "warning"
+        })) : [{ label: "No configured MCP capability matched." }]);
+        return true;
+      }
+      if (action === "inspect" || action === "trust") {
+        if (!server) {
+          append({ id: nextId(), kind: "notice", tone: "error", text: `Usage: /mcp ${action} <server>${action === "trust" ? " [--confirm]" : ""}` });
+          return true;
+        }
+        const manifest = extensions?.mcpInspect(server);
+        if (!manifest) {
+          append({ id: nextId(), kind: "notice", tone: "error", text: "MCP is disabled or unavailable." });
+          return true;
+        }
+        appendList(`MCP trust review \xB7 ${manifest.name}`, [
+          { label: `${manifest.source.kind}:${manifest.name}  ${manifest.version}`, detail: `${manifest.transport}${separator}${manifest.target}${manifest.required ? `${separator}required` : ""}` },
+          ...manifest.tools.length ? manifest.tools.flatMap((tool) => {
+            const tone = tool.permissions.some((category) => category !== "read" && category !== "network") ? "warning" : "normal";
+            return [
+              { label: `${tool.name}  ${tool.permissions.join("+")}`, detail: `completion evidence ${tool.completionEvidence}`, tone },
+              { label: "network scopes", detail: tool.network.join(", ") || "unspecified", tone },
+              { label: "command scopes", detail: tool.commands.join(", ") || "none", tone },
+              { label: "path scopes", detail: tool.paths.join(", ") || "none", tone },
+              { label: `sensitive fields  ${tool.sensitiveFields.join(", ") || "none"}`, detail: `${tool.background ? "background" : "foreground"}${separator}${tool.processTree ? "process-tree" : "single-process"}`, tone }
+            ];
+          }) : [{ label: "Dynamic remote tools", detail: "Undeclared tools stay network-only and do not receive Skein completion-evidence protection.", tone: "warning" }]
+        ]);
+        if (action === "trust") {
+          if (manifest.dynamicTools) {
+            append({ id: nextId(), kind: "notice", tone: "error", text: `Declare tools and effects for ${server} in user-owned config before trust can be granted.` });
+            return true;
+          }
+          if (!tail.includes("--confirm")) {
+            append({ id: nextId(), kind: "notice", tone: "warning", text: `Review complete. Run /mcp trust ${server} --confirm to trust this exact manifest fingerprint.` });
+          } else {
+            const status = await extensions?.mcpTrust(server);
+            append({ id: nextId(), kind: "notice", tone: status ? "success" : "error", text: status ? `Trusted MCP capability ${server}. Activation remains explicit.` : "MCP is unavailable." });
+          }
+        }
+        return true;
+      }
+      if (action === "activate") {
+        const query = tail.join(" ").trim();
+        if (!server || !query) {
+          append({ id: nextId(), kind: "notice", tone: "error", text: "Usage: /mcp activate <server> <capability query>" });
+          return true;
+        }
+        const result = await extensions?.mcpActivate(server, query);
+        append({
+          id: nextId(),
+          kind: "notice",
+          tone: result?.ok ? "success" : "error",
+          text: result?.ok ? `Activated ${server}; loaded ${result.registeredTools.length} of ${result.availableTools} schemas.` : `Could not activate ${server}: ${result?.status.error ?? result?.status.trust ?? "MCP unavailable"}`
+        });
+        return true;
+      }
+      if (action === "disable") {
+        if (!server) {
+          append({ id: nextId(), kind: "notice", tone: "error", text: "Usage: /mcp disable <server>" });
+          return true;
+        }
+        const status = await extensions?.mcpDisable(server);
+        append({ id: nextId(), kind: "notice", tone: status ? "success" : "error", text: status ? `Disabled MCP capability ${server}.` : "MCP is unavailable." });
+        return true;
+      }
+      if (action === "revoke") {
+        if (!server || !tail.includes("--confirm")) {
+          append({ id: nextId(), kind: "notice", tone: "warning", text: `Revocation removes persisted trust. Run /mcp revoke ${server || "<server>"} --confirm to continue.` });
+          return true;
+        }
+        const status = await extensions?.mcpRevoke(server);
+        append({ id: nextId(), kind: "notice", tone: status ? "success" : "error", text: status ? `Revoked MCP capability ${server}. Re-inspection and trust are required before reuse.` : "MCP is unavailable." });
+        return true;
+      }
+      if (action !== "list") {
+        append({ id: nextId(), kind: "notice", tone: "error", text: "Usage: /mcp [search|inspect|trust|activate|disable|revoke] [...]" });
+        return true;
+      }
       const servers = extensions?.mcpStatus() ?? [];
-      appendList("MCP", servers.length ? servers.map((server) => ({
-        label: `${server.name}  ${server.state}${server.serverVersion ? `${separator}v${server.serverVersion}` : ""}`,
-        detail: `${server.transport}${separator}${server.toolCount} tools${server.connectedAt ? `${separator}connected ${server.connectedAt.slice(11, 19)}` : ""}${server.error ? `${separator}${server.error}` : ""}`,
-        tone: server.state === "connected" ? "success" : server.state === "error" ? "error" : "warning"
+      appendList("MCP", servers.length ? servers.map((item) => ({
+        label: `${item.name}  ${item.state}${item.required ? `${separator}required` : ""}${item.serverVersion ? `${separator}v${item.serverVersion}` : ""}`,
+        detail: `${item.transport}${separator}${item.trust}${separator}${item.toolCount} tools${item.connectedAt ? `${separator}connected ${item.connectedAt.slice(11, 19)}` : ""}${item.error ? `${separator}${item.error}` : ""}`,
+        tone: item.state === "connected" ? "success" : item.state === "error" || item.state === "revoked" ? "error" : "warning"
       })) : [{ label: "No MCP servers configured." }]);
       return true;
     }
     if (command2 === "tools") {
       const definitions = runner.tools.definitions();
       appendList("Tools", definitions.map((tool) => ({
-        label: `${tool.name}  ${tool.category}`,
-        detail: tool.description,
+        label: `${tool.name}  ${tool.source ?? "builtin"}${separator}${(tool.permissionCategories ?? [tool.category]).join("+")}`,
+        detail: `${tool.activation ?? "always"}${tool.completionEvidence ? `${separator}evidence ${tool.completionEvidence}` : ""}${separator}${tool.description}`,
         tone: tool.category === "read" ? "normal" : tool.category === "network" ? "warning" : "normal"
       })));
       return true;
@@ -19409,8 +19614,8 @@ function SkeinApp({ runner, config, extensions, initialPrompt, askMode = false,
   }, [append]);
   function settlePermission(grant, stop = false) {
     if (!permission) return;
-    const { call, category, resolve: resolve26 } = permission;
-    resolve26(grant);
+    const { call, category, resolve: resolve28 } = permission;
+    resolve28(grant);
     setPermission(void 0);
     if (grant === "session") {
       append({
@@ -20802,13 +21007,13 @@ async function runFirstRunOnboarding(initialConfig, options = {}) {
 }
 
 // src/runtime/extensions.ts
-import { resolve as resolve24 } from "node:path";
+import { resolve as resolve26 } from "node:path";
 
 // src/mcp/manager.ts
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import stripAnsi5 from "strip-ansi";
+import stripAnsi6 from "strip-ansi";
 
 // src/mcp/tool.ts
 import { createHash as createHash18 } from "node:crypto";
@@ -20820,36 +21025,61 @@ var MAX_SCHEMA_BYTES = 1e5;
 function createMcpToolAdapter(options) {
   const { remoteTool } = options;
   const inputSchema13 = copyInputSchema(remoteTool.inputSchema);
+  const permissionCategories = options.capability?.permissions ?? ["network"];
+  const completionEvidence = options.capability?.completionEvidence ?? "none";
+  const mutating = permissionCategories.some((category) => category === "write" || category === "shell" || category === "git");
   return {
     definition: {
       name: options.exposedName,
-      description: describeTool(options.serverName, remoteTool),
+      description: describeTool(options.serverName, remoteTool, options.capability),
       // MCP servers are an external trust boundary. Read-only annotations are
       // hints from that server and must not lower the local permission level.
       category: "network",
       inputSchema: inputSchema13,
-      progressive: true
+      progressive: true,
+      source: "mcp",
+      permissionCategories,
+      activation: "active",
+      completionEvidence,
+      ...options.capability?.sensitiveFields.length ? { sensitiveFields: options.capability.sensitiveFields } : {}
     },
-    permissionCategories: () => ["network"],
+    permissionCategories: () => permissionCategories,
+    ...mutating ? {
+      affectedPaths: async (arguments_, context) => resolveDeclaredMutationPaths(
+        arguments_,
+        options.capability?.paths ?? [],
+        context
+      )
+    } : {},
     async execute(arguments_, context) {
       assertArguments(arguments_);
+      const remoteArguments = mutating && completionEvidence === "full" && context.checkpointId ? { ...arguments_, _skein: { checkpointId: context.checkpointId } } : arguments_;
       const result = await options.callTool({
         name: remoteTool.name,
-        arguments: arguments_
+        arguments: remoteArguments
       }, {
         timeout: options.timeoutMs,
         maxTotalTimeout: options.timeoutMs,
         ...context.signal ? { signal: context.signal } : {}
       });
       const normalized = normalizeCallResult(result);
+      const evidence = mutating && completionEvidence === "full" ? await validateCompletionEvidence(normalized.structuredContent, context) : void 0;
       return {
         ok: !normalized.isError,
         content: normalized.content,
+        ...evidence ? { changedFiles: evidence.changedFiles } : {},
         metadata: {
           mcpServer: options.serverName,
           mcpTool: remoteTool.name,
           sourceBytes: normalized.sourceBytes,
           sourceTruncated: normalized.sourceTruncated,
+          capabilityPermissions: permissionCategories,
+          completionEvidence,
+          ...mutating ? {
+            changeTracking: evidence ? "complete" : "unresolved",
+            completionEvidenceVerified: Boolean(evidence)
+          } : {},
+          ...evidence ? evidence : {},
           ...normalized.isError ? { mcpError: true } : {}
         }
       };
@@ -20878,9 +21108,10 @@ function isUsableRemoteTool(tool) {
     return false;
   }
 }
-function describeTool(serverName, tool) {
+function describeTool(serverName, tool, capability) {
   const label = stripAnsi4(tool.title?.trim() || tool.name).replace(/[\u0000-\u001f\u007f]/g, " ").slice(0, 200);
-  const description = tool.description ? stripAnsi4(tool.description).replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, " ").trim().slice(0, MAX_DESCRIPTION_LENGTH) : void 0;
+  const sourceDescription = capability?.description ?? tool.description;
+  const description = sourceDescription ? stripAnsi4(sourceDescription).replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, " ").trim().slice(0, MAX_DESCRIPTION_LENGTH) : void 0;
   return description ? `[MCP ${serverName}/${label}] ${description}` : `Call the ${label} tool provided by the ${serverName} MCP server.`;
 }
 function copyInputSchema(schema) {
@@ -20919,7 +21150,46 @@ ${safeJson(result.structuredContent)}`);
 ${safeJson(result.toolResult)}`);
   }
   const content = sections.filter(Boolean).join("\n\n") || (isError ? "The MCP tool reported an error." : "The MCP tool completed without output.");
-  return boundResult(content, isError);
+  return { ...boundResult(content, isError), ...result.structuredContent === void 0 ? {} : { structuredContent: result.structuredContent } };
+}
+async function validateCompletionEvidence(structuredContent, context) {
+  if (!isRecord2(structuredContent)) return;
+  const receipt = isRecord2(structuredContent.skeinEvidence) ? structuredContent.skeinEvidence : void 0;
+  if (!receipt || !context.checkpointId || !Array.isArray(receipt.changedFiles) || receipt.changedFiles.length > 256 || typeof receipt.checkpointId !== "string" || !receipt.checkpointId.trim() || receipt.checkpointId !== context.checkpointId || !Array.isArray(receipt.artifactReceipts) || !receipt.artifactReceipts.length || !Array.isArray(receipt.completionEvidence) || !receipt.completionEvidence.length) return;
+  const changedFiles = [];
+  for (const path of receipt.changedFiles) {
+    if (typeof path !== "string" || !path.trim()) return;
+    try {
+      changedFiles.push(await context.workspace.resolvePath(path, { allowMissing: true }));
+    } catch {
+      return;
+    }
+  }
+  const artifactReceipts = receipt.artifactReceipts.filter((value) => typeof value === "string" && Boolean(value.trim())).map((value) => sanitizeInlineText(value).slice(0, 256));
+  const completionEvidenceRefs = receipt.completionEvidence.filter((value) => typeof value === "string" && Boolean(value.trim())).map((value) => sanitizeInlineText(value).slice(0, 256));
+  if (artifactReceipts.length !== receipt.artifactReceipts.length || completionEvidenceRefs.length !== receipt.completionEvidence.length) return;
+  return {
+    changedFiles,
+    checkpointId: sanitizeInlineText(receipt.checkpointId).slice(0, 256),
+    artifactReceipts,
+    completionEvidenceRefs
+  };
+}
+async function resolveDeclaredMutationPaths(arguments_, declaredPaths, context) {
+  const candidates = [];
+  for (const key of ["path", "file", "cwd"]) {
+    const value = arguments_[key];
+    if (typeof value === "string" && value.trim()) candidates.push(value);
+  }
+  if (Array.isArray(arguments_.paths)) {
+    candidates.push(...arguments_.paths.filter((value) => typeof value === "string" && Boolean(value.trim())));
+  }
+  candidates.push(...declaredPaths.filter((path) => !/[?*{}\[\]]/u.test(path)));
+  const resolved = [];
+  for (const candidate of [...new Set(candidates)].slice(0, 256)) {
+    resolved.push(await context.workspace.resolvePath(candidate, { allowMissing: true }));
+  }
+  return resolved;
 }
 function boundResult(content, isError) {
   const sourceBytes = Buffer.byteLength(content);
@@ -21147,6 +21417,221 @@ function isLoopbackHost(hostname) {
   return normalized === "localhost" || normalized === "::1" || normalized === "0:0:0:0:0:0:0:1" || isIpv4Loopback;
 }
 
+// src/mcp/capabilities.ts
+import { createHash as createHash19 } from "node:crypto";
+import { homedir as homedir4 } from "node:os";
+import { basename as basename12, isAbsolute as isAbsolute9, relative as relative11, resolve as resolve23 } from "node:path";
+import stripAnsi5 from "strip-ansi";
+function buildMcpCapabilityManifest(name, config, workspace = process.cwd()) {
+  const tools = (config.tools ?? []).map((tool) => normalizeTool(tool, workspace));
+  return {
+    schemaVersion: 1,
+    id: `mcp:${sanitizeIdentifier(name, "server")}`,
+    source: { kind: "mcp", owner: "user-config" },
+    name: sanitizeText(name, 64),
+    version: sanitizeText(config.version ?? "unversioned", 128),
+    required: config.required === true,
+    transport: config.transport ?? "stdio",
+    target: redactTransportTarget(config),
+    tools,
+    dynamicTools: tools.length === 0
+  };
+}
+function capabilityFingerprint(name, config, workspace = process.cwd()) {
+  const manifest = buildMcpCapabilityManifest(name, config, workspace);
+  const privateTransport = {
+    command: config.command ?? null,
+    args: config.args ?? [],
+    cwd: config.cwd ? resolve23(workspace, config.cwd) : null,
+    url: config.url ? redactUrl(config.url) : null,
+    envNames: Object.keys(config.env ?? {}).sort(),
+    headerNames: Object.keys(config.headers ?? {}).map((key) => key.toLocaleLowerCase()).sort()
+  };
+  return createHash19("sha256").update(stableJson2({ manifest, privateTransport })).digest("hex");
+}
+function searchMcpCapabilities(config, query) {
+  const terms = new Set(sanitizeText(query, 500).toLocaleLowerCase().match(/[\p{L}\p{N}_-]{2,}/gu) ?? []);
+  return Object.entries(config.servers ?? {}).map(([name, server]) => {
+    const description = sanitizeText(server.description ?? `${server.transport ?? "stdio"} MCP server`, 200);
+    const searchable = [name, description, server.version, ...(server.tools ?? []).flatMap((tool) => [
+      tool.name,
+      tool.description,
+      ...tool.permissions,
+      ...tool.commands ?? [],
+      ...tool.network ?? []
+    ])].filter(Boolean).join(" ").toLocaleLowerCase();
+    let score = 0;
+    for (const term of terms) if (searchable.includes(term)) score += term.length;
+    return {
+      name,
+      description,
+      version: sanitizeText(server.version ?? "unversioned", 128),
+      required: server.required === true,
+      transport: server.transport ?? "stdio",
+      declaredTools: server.tools?.length ?? 0,
+      score
+    };
+  }).filter((result) => terms.size === 0 || result.score > 0).sort((left, right) => right.score - left.score || left.name.localeCompare(right.name));
+}
+function declaredToolCapability(config, remoteName, workspace = process.cwd()) {
+  const declaration = config.tools?.find((tool) => tool.name === remoteName);
+  return declaration ? normalizeTool(declaration, workspace) : void 0;
+}
+function normalizeTool(tool, workspace) {
+  const permissions = uniquePermissions(["network", ...tool.permissions]);
+  return {
+    name: sanitizeText(tool.name, 256),
+    ...tool.description ? { description: sanitizeText(tool.description, 500) } : {},
+    permissions,
+    network: unique3(tool.network ?? []).map(redactNetworkTarget),
+    commands: unique3(tool.commands ?? []).map(redactCommand2),
+    paths: unique3(tool.paths ?? []).map((path) => redactPath(path, workspace)),
+    sensitiveFields: unique3(tool.sensitiveFields ?? []).map((field) => sanitizeText(field, 256)),
+    background: tool.background === true,
+    processTree: tool.processTree === true,
+    completionEvidence: tool.completionEvidence ?? "none"
+  };
+}
+function redactTransportTarget(config) {
+  if (config.transport === "http") return config.url ? redactUrl(config.url) : "<unconfigured HTTP endpoint>";
+  return config.command ? `<stdio command:${sanitizeText(basename12(config.command), 128)}>` : "<unconfigured stdio command>";
+}
+function redactUrl(value) {
+  try {
+    const url = new URL(value);
+    return `${url.protocol}//${url.host}${url.pathname}`;
+  } catch {
+    return "<invalid URL>";
+  }
+}
+function redactNetworkTarget(value) {
+  if (/^https?:\/\//iu.test(value)) return redactUrl(value);
+  return sanitizeText(value, 500).replace(/([?&](?:key|token|secret|password)=)[^&\s]*/giu, "$1<redacted>");
+}
+function redactCommand2(value) {
+  const command2 = sanitizeText(value, 500).split(/\s+/u)[0];
+  return command2 ? basename12(command2) : "<redacted command>";
+}
+function redactPath(value, workspace) {
+  const clean2 = sanitizeText(value, 4e3);
+  if (!isAbsolute9(clean2)) return clean2;
+  const absolute = resolve23(clean2);
+  const workspaceRelative = relative11(resolve23(workspace), absolute);
+  if (!workspaceRelative.startsWith("..") && !isAbsolute9(workspaceRelative)) {
+    return `<workspace>/${workspaceRelative || "."}`;
+  }
+  const homeRelative = relative11(homedir4(), absolute);
+  if (!homeRelative.startsWith("..") && !isAbsolute9(homeRelative)) return `~/${homeRelative}`;
+  return `<absolute>/${basename12(absolute)}`;
+}
+function uniquePermissions(values) {
+  const order = ["read", "write", "shell", "git", "network"];
+  const present = new Set(values);
+  return order.filter((category) => present.has(category));
+}
+function unique3(values) {
+  return [...new Set(values)].slice(0, 256);
+}
+function sanitizeIdentifier(value, fallback) {
+  return sanitizeText(value, 64).toLocaleLowerCase().replace(/[^a-z0-9_-]+/gu, "_").replace(/^_+|_+$/gu, "") || fallback;
+}
+function sanitizeText(value, maxLength) {
+  return stripAnsi5(value).replace(/[\u0000-\u001f\u007f]/gu, " ").replace(/\s+/gu, " ").trim().slice(0, maxLength);
+}
+function stableJson2(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson2).join(",")}]`;
+  if (value && typeof value === "object") {
+    const object = value;
+    return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${stableJson2(object[key])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+// src/mcp/trust-store.ts
+import { lstat as lstat21, mkdir as mkdir10, readFile as readFile20, realpath as realpath9 } from "node:fs/promises";
+import { dirname as dirname10, join as join21, resolve as resolve24 } from "node:path";
+import { z as z20 } from "zod";
+var trustRegistrySchema = z20.object({
+  version: z20.literal(1),
+  entries: z20.array(z20.object({
+    workspace: z20.string(),
+    server: z20.string().regex(/^[a-z][a-z0-9_-]{0,63}$/),
+    fingerprint: z20.string().regex(/^[a-f0-9]{64}$/),
+    state: z20.enum(["trusted", "disabled", "revoked"]),
+    updatedAt: z20.string()
+  }).strict()).max(1e3)
+}).strict();
+var McpTrustStore = class {
+  path;
+  usesDefaultPath;
+  constructor(options = {}) {
+    this.usesDefaultPath = options.path === void 0;
+    this.path = options.path ?? join21(resolveHomeNamespace(), "mcp-capability-trust.json");
+  }
+  async state(workspace, server, fingerprint) {
+    const resolvedWorkspace = await resolveWorkspace(workspace);
+    const registry = await this.read();
+    const entry = [...registry.entries].reverse().find((candidate) => candidate.workspace === resolvedWorkspace && candidate.server === server);
+    if (!entry) return "untrusted";
+    if (entry.state === "disabled" || entry.state === "revoked") return entry.state;
+    return entry.fingerprint === fingerprint ? "trusted" : "untrusted";
+  }
+  trust(workspace, server, fingerprint) {
+    return this.writeDecision(workspace, server, fingerprint, "trusted");
+  }
+  disable(workspace, server, fingerprint) {
+    return this.writeDecision(workspace, server, fingerprint, "disabled");
+  }
+  revoke(workspace, server, fingerprint) {
+    return this.writeDecision(workspace, server, fingerprint, "revoked");
+  }
+  async writeDecision(workspace, server, fingerprint, state) {
+    const operation = async () => {
+      const resolvedWorkspace = await resolveWorkspace(workspace);
+      const registry = await this.read();
+      const entries = registry.entries.filter((entry) => entry.workspace !== resolvedWorkspace || entry.server !== server);
+      entries.push({
+        workspace: resolvedWorkspace,
+        server,
+        fingerprint,
+        state,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      if (this.usesDefaultPath) {
+        const home = resolveHomeNamespace();
+        assertActiveHomeNamespacePath(this.path);
+        await assertNoSymlinkPath(dirname10(home), home);
+      }
+      await mkdir10(dirname10(this.path), { recursive: true, mode: 448 });
+      if (this.usesDefaultPath) {
+        const home = resolveHomeNamespace();
+        await assertNoSymlinkPath(dirname10(home), home);
+      }
+      await atomicWrite(
+        this.path,
+        `${JSON.stringify({ version: 1, entries: entries.slice(-1e3) }, null, 2)}
+`,
+        384
+      );
+    };
+    return this.usesDefaultPath ? withNamespaceLease(homeNamespacePaths().canonical, "shared", operation) : operation();
+  }
+  async read() {
+    try {
+      const info = await lstat21(this.path);
+      if (!info.isFile() || info.isSymbolicLink() || info.size > 1e6) {
+        return { version: 1, entries: [] };
+      }
+      return trustRegistrySchema.parse(JSON.parse(await readFile20(this.path, "utf8")));
+    } catch {
+      return { version: 1, entries: [] };
+    }
+  }
+};
+async function resolveWorkspace(workspace) {
+  return realpath9(resolve24(workspace)).catch(() => resolve24(workspace));
+}
+
 // src/mcp/manager.ts
 var MAX_SERVERS = 32;
 var MAX_TOOLS_PER_SERVER = 256;
@@ -21158,6 +21643,9 @@ var McpManager = class {
   constructor(config, options = {}) {
     this.config = config;
     this.options = options;
+    this.trustStore = options.trustStore ?? new McpTrustStore();
+    this.workspace = options.cwd ?? process.cwd();
+    this.requireTrust = options.requireTrust !== false;
     const entries = Object.entries(config.servers ?? {});
     for (const [index, [name, server]] of entries.entries()) {
       const transport = server.transport ?? "stdio";
@@ -21167,12 +21655,22 @@ var McpManager = class {
           state: "error",
           transport,
           toolCount: 0,
+          required: server.required === true,
+          trust: "untrusted",
           error: `MCP server limit exceeded (maximum ${MAX_SERVERS})`
         });
         continue;
       }
-      const state = config.enabled === false || server.enabled === false ? "disabled" : "disconnected";
-      this.statuses.set(name, { name, state, transport, toolCount: 0 });
+      const disabled = config.enabled === false || server.enabled === false;
+      const state = disabled ? "disabled" : this.requireTrust ? "untrusted" : "disconnected";
+      this.statuses.set(name, {
+        name,
+        state,
+        transport,
+        toolCount: 0,
+        required: server.required === true,
+        trust: disabled ? "disabled" : this.requireTrust ? "untrusted" : "trusted"
+      });
     }
   }
   config;
@@ -21182,12 +21680,108 @@ var McpManager = class {
   statuses = /* @__PURE__ */ new Map();
   toolOwners = /* @__PURE__ */ new Map();
   stableAdapters = /* @__PURE__ */ new Map();
+  registries = /* @__PURE__ */ new Set();
   options;
+  trustStore;
+  workspace;
+  requireTrust;
   shutdownController = new AbortController();
+  trustLoaded = false;
   closed = false;
+  /** Load persisted trust and prove availability for explicitly required servers. */
+  async initialize(signal) {
+    await this.ensureTrustLoaded();
+    const required = [...this.statuses.values()].filter((status) => status.required && status.state !== "disabled").map((status) => status.name);
+    const failures = [];
+    for (const name of required) {
+      const status = this.statuses.get(name);
+      if (status?.trust !== "trusted") {
+        failures.push(`${name}: capability manifest is ${status?.trust ?? "untrusted"}`);
+        continue;
+      }
+      const result = await this.connect(name, signal);
+      if (!result.ok) failures.push(`${name}: ${result.status.error ?? result.status.state}`);
+    }
+    if (failures.length) {
+      throw new Error(`Required MCP server unavailable: ${failures.join("; ")}`);
+    }
+  }
+  /** Refresh local trust state without connecting; used by status and review UIs. */
+  async loadTrust() {
+    await this.ensureTrustLoaded();
+  }
+  /** Compact, no-network capability controls advertised before remote schemas. */
+  catalogTools(registry) {
+    const names = this.catalogServerNames();
+    if (!names.length) return [];
+    const search = {
+      definition: {
+        name: "mcp_search",
+        description: "Search configured MCP capability manifests without connecting to a server or loading remote schemas.",
+        category: "read",
+        source: "mcp",
+        permissionCategories: ["read"],
+        activation: "catalog",
+        inputSchema: {
+          type: "object",
+          properties: {
+            query: { type: "string", maxLength: 500, description: "Capability, tool, permission, or server to find." }
+          },
+          required: ["query"],
+          additionalProperties: false
+        }
+      },
+      permissionCategories: () => ["read"],
+      execute: async (arguments_) => {
+        const query = typeof arguments_.query === "string" ? arguments_.query.trim() : "";
+        if (query.length > 500) throw new ToolInputError("MCP search query must be at most 500 characters");
+        await this.ensureTrustLoaded();
+        const results = this.search(query);
+        return {
+          content: results.length ? results.map((result) => `${result.name}: ${result.description} (${result.trust}, ${result.declaredTools || "dynamic"} tools)`).join("\n") : "No configured MCP capability matched the query.",
+          metadata: { mcpSearch: results }
+        };
+      }
+    };
+    const inspect = {
+      definition: {
+        name: "mcp_inspect",
+        description: "Inspect one redacted declarative MCP capability manifest and its local trust state without connecting.",
+        category: "read",
+        source: "mcp",
+        permissionCategories: ["read"],
+        activation: "catalog",
+        inputSchema: {
+          type: "object",
+          properties: {
+            server: { type: "string", enum: names, description: "Configured MCP server to inspect." }
+          },
+          required: ["server"],
+          additionalProperties: false
+        }
+      },
+      permissionCategories: () => ["read"],
+      execute: async (arguments_) => {
+        const server = typeof arguments_.server === "string" ? arguments_.server : "";
+        if (!names.includes(server)) throw new ToolInputError("MCP server is not available for inspection");
+        await this.ensureTrustLoaded();
+        const manifest = this.inspect(server);
+        return {
+          content: JSON.stringify({ manifest, trust: this.status(server)?.trust ?? "untrusted" }, null, 2),
+          metadata: {
+            mcpServer: server,
+            trust: this.status(server)?.trust ?? "untrusted",
+            manifestFingerprint: this.fingerprint(server)
+          }
+        };
+      }
+    };
+    const activation = this.activationTool(registry);
+    return activation ? [search, inspect, activation] : [search, inspect];
+  }
   /** Compact model-visible catalog; transport and remote discovery stay lazy. */
   activationTool(registry) {
-    const names = this.activatableServerNames();
+    const names = this.catalogServerNames();
     if (!names.length) return;
     const catalog = names.map((name) => {
       const server = this.config.servers[name];
@@ -21197,8 +21791,11 @@ var McpManager = class {
     return {
       definition: {
         name: "mcp_activate",
-        description: `Connect to one configured MCP server only when the current task needs it, discover its tools, and load at most ${LAZY_SCHEMA_LIMIT} relevant schemas. Available servers: ${catalog}`,
+        description: `Activate one already trusted MCP capability after mcp_search and mcp_inspect, then load at most ${LAZY_SCHEMA_LIMIT} relevant schemas. This tool cannot grant trust. Available servers: ${catalog}`,
         category: "network",
+        source: "mcp",
+        permissionCategories: ["network"],
+        activation: "catalog",
         inputSchema: {
           type: "object",
           properties: {
@@ -21219,9 +21816,10 @@ var McpManager = class {
         }
         const result = await this.activate(server, query, registry, context.signal);
         if (!result.ok) {
+          const trust = result.status.trust;
           return {
             ok: false,
-            content: `MCP server ${server} could not be activated: ${result.status.error ?? result.status.state}`,
+            content: trust !== "trusted" ? `MCP server ${server} is ${trust}. Review it with mcp_inspect; only the user can trust it with the CLI or /mcp trust confirmation flow.` : `MCP server ${server} could not be activated: ${result.status.error ?? result.status.state}`,
             metadata: activationMetadata(result)
           };
         }
@@ -21236,6 +21834,7 @@ var McpManager = class {
   }
   /** Connect/discover one server, then register only request-relevant schemas. */
   async activate(name, query, registry, signal) {
+    await this.ensureTrustLoaded();
     const connected = await this.connect(name, signal);
     if (!connected.ok) {
       return { ...connected, registeredTools: [], availableTools: 0, deferredTools: 0 };
@@ -21247,16 +21846,27 @@ var McpManager = class {
     const tools = [...connection.tools.values()];
     const selected = tools.length <= LAZY_SCHEMA_LIMIT ? tools : selectRelevantTools(tools, query, LAZY_SCHEMA_LIMIT);
     this.registerSelectedTools(registry, selected);
+    const ranked = rankRelevantTools(tools, query);
+    const eagerTokens = estimateTokens(JSON.stringify(tools.map((tool) => tool.definition)));
+    const loadedTokens = estimateTokens(JSON.stringify(selected.map((tool) => tool.definition)));
     return {
       ...connected,
       registeredTools: selected.map((tool) => tool.definition.name),
       availableTools: tools.length,
-      deferredTools: Math.max(0, tools.length - selected.length)
+      deferredTools: Math.max(0, tools.length - selected.length),
+      schemaBudget: {
+        eagerTokens,
+        loadedTokens,
+        savedTokens: Math.max(0, eagerTokens - loadedTokens),
+        topMatch: ranked[0]?.tool.definition.name ?? null,
+        queryMatched: (ranked[0]?.score ?? 0) > 0
+      }
     };
   }
   /** Connect enabled servers with a small concurrency bound. */
   async connectAll(signal) {
     if (this.closed) throw new Error("MCP manager is closed");
+    await this.ensureTrustLoaded();
     const configuredNames = Object.keys(this.config.servers ?? {});
     const names = configuredNames.slice(0, MAX_SERVERS);
     if (this.config.enabled === false) {
@@ -21277,10 +21887,14 @@ var McpManager = class {
   /** Connect one configured server. Connection errors are captured in status. */
   async connect(name, signal) {
     if (this.closed) throw new Error("MCP manager is closed");
+    await this.ensureTrustLoaded();
     const status = this.statuses.get(name);
     if (status?.state === "error" && status.error?.includes("server limit exceeded")) {
       return this.resultFor(name, false, 0);
     }
+    if (this.requireTrust && status?.trust !== "trusted") {
+      return this.resultFor(name, false, 0);
+    }
     const existing = this.pending.get(name);
     if (existing) return existing;
     const connectionController = new AbortController();
@@ -21308,9 +21922,11 @@ var McpManager = class {
     if (!current) throw new Error(`Unknown MCP server: ${name}`);
     const status = {
       name,
-      state: current.state === "disabled" ? "disabled" : "disconnected",
+      state: current.state === "disabled" || current.state === "revoked" || current.state === "untrusted" ? current.state : "disconnected",
       transport: current.transport,
-      toolCount: 0
+      toolCount: 0,
+      required: current.required,
+      trust: current.trust
     };
     this.statuses.set(name, status);
     return status;
@@ -21320,7 +21936,9 @@ var McpManager = class {
     if (this.closed) throw new Error("MCP manager is closed");
     const status = this.statuses.get(name);
     if (!status) throw new Error(`Unknown MCP server: ${name}`);
-    if (status.state === "disabled") return this.resultFor(name, false, 0);
+    if (status.state === "disabled" || status.state === "revoked" || status.state === "untrusted") {
+      return this.resultFor(name, false, 0);
+    }
     const pending = this.pending.get(name);
     if (pending) await pending;
     await this.disconnect(name);
@@ -21344,9 +21962,11 @@ var McpManager = class {
     for (const [name, status] of this.statuses) {
       this.statuses.set(name, {
         name,
-        state: status.state === "disabled" ? "disabled" : "closed",
+        state: status.state === "disabled" || status.state === "revoked" || status.state === "untrusted" ? status.state : "closed",
         transport: status.transport,
-        toolCount: 0
+        toolCount: 0,
+        required: status.required,
+        trust: status.trust
       });
     }
   }
@@ -21357,6 +21977,71 @@ var McpManager = class {
     const status = this.statuses.get(name);
     return status ? { ...status } : void 0;
   }
+  search(query = "") {
+    return searchMcpCapabilities(this.config, query).map((result) => {
+      const status = this.statuses.get(result.name);
+      return {
+        ...result,
+        state: status?.state ?? "error",
+        trust: status?.trust ?? "untrusted"
+      };
+    });
+  }
+  inspect(name) {
+    const server = this.config.servers?.[name];
+    if (!server) throw new Error(`Unknown MCP server: ${name}`);
+    return buildMcpCapabilityManifest(name, server, this.workspace);
+  }
+  fingerprint(name) {
+    const server = this.config.servers?.[name];
+    if (!server) throw new Error(`Unknown MCP server: ${name}`);
+    return capabilityFingerprint(name, server, this.workspace);
+  }
+  async trust(name) {
+    const server = this.config.servers?.[name];
+    if (!server) throw new Error(`Unknown MCP server: ${name}`);
+    if (this.config.enabled === false || server.enabled === false) {
+      throw new Error(`MCP server is disabled by configuration: ${name}`);
+    }
+    if (this.inspect(name).dynamicTools) {
+      throw new Error(`MCP capability ${name} cannot be trusted until its tools and effects are declared.`);
+    }
+    await this.trustStore.trust(this.workspace, name, this.fingerprint(name));
+    this.trustLoaded = true;
+    return this.setStatus(name, {
+      state: "disconnected",
+      trust: "trusted",
+      required: server.required === true,
+      transport: server.transport ?? "stdio",
+      toolCount: 0
+    });
+  }
+  async disable(name) {
+    const server = this.config.servers?.[name];
+    if (!server) throw new Error(`Unknown MCP server: ${name}`);
+    await this.disconnect(name);
+    this.unregisterServerTools(name);
+    await this.trustStore.disable(this.workspace, name, this.fingerprint(name));
+    return this.setStatus(name, {
+      state: "disabled",
+      trust: "disabled",
+      required: server.required === true,
+      toolCount: 0
+    });
+  }
+  async revoke(name) {
+    const server = this.config.servers?.[name];
+    if (!server) throw new Error(`Unknown MCP server: ${name}`);
+    await this.disconnect(name);
+    this.unregisterServerTools(name);
+    await this.trustStore.revoke(this.workspace, name, this.fingerprint(name));
+    return this.setStatus(name, {
+      state: "revoked",
+      trust: "revoked",
+      required: server.required === true,
+      toolCount: 0
+    });
+  }
   tools() {
     return [...this.connections.values()].flatMap((connection) => [...connection.tools.values()]).sort((a, b) => a.definition.name.localeCompare(b.definition.name));
   }
@@ -21368,6 +22053,7 @@ var McpManager = class {
     return this.registerSelectedTools(registry, this.tools());
   }
   registerSelectedTools(registry, tools) {
+    this.registries.add(registry);
     const registered = [];
     for (const tool of tools) {
       const existing = registry.get(tool.definition.name);
@@ -21382,9 +22068,38 @@ var McpManager = class {
     }
     return registered;
   }
-  activatableServerNames() {
-    if (this.config.enabled === false) return [];
-    return [...this.statuses.values()].filter((status) => status.state !== "disabled" && status.state !== "error").map((status) => status.name).sort((left, right) => left.localeCompare(right));
+  unregisterServerTools(name) {
+    for (const [identity2, tool] of this.stableAdapters) {
+      if (!identity2.startsWith(`${name}\0`)) continue;
+      for (const registry of this.registries) {
+        registry.unregister(tool.definition.name, tool);
+      }
+    }
+  }
+  catalogServerNames() {
+    return [...this.statuses.values()].filter((status) => !status.error?.includes("server limit exceeded")).map((status) => status.name).sort((left, right) => left.localeCompare(right));
+  }
+  async ensureTrustLoaded() {
+    if (this.trustLoaded) return;
+    for (const [name, server] of Object.entries(this.config.servers ?? {}).slice(0, MAX_SERVERS)) {
+      const current = this.statuses.get(name);
+      if (!current) continue;
+      if (this.config.enabled === false || server.enabled === false) {
+        this.setStatus(name, { state: "disabled", trust: "disabled", toolCount: 0 });
+        continue;
+      }
+      if (!this.requireTrust) {
+        this.setStatus(name, { state: "disconnected", trust: "trusted", toolCount: 0 });
+        continue;
+      }
+      const trust = await this.trustStore.state(this.workspace, name, this.fingerprint(name));
+      this.setStatus(name, {
+        state: trust === "trusted" ? "disconnected" : trust,
+        trust,
+        toolCount: 0
+      });
+    }
+    this.trustLoaded = true;
   }
   async connectInternal(name, signal) {
     const configured = this.config.servers?.[name];
@@ -21400,7 +22115,12 @@ var McpManager = class {
       return { name, ok: false, status, skippedTools: 0 };
     }
     if (this.config.enabled === false || configured.enabled === false) {
-      const status = this.setStatus(name, { state: "disabled", transport: transportKind, toolCount: 0 });
+      const status = this.setStatus(name, {
+        state: "disabled",
+        trust: "disabled",
+        transport: transportKind,
+        toolCount: 0
+      });
       return { name, ok: false, status, skippedTools: 0 };
     }
     if (this.connections.has(name)) {
@@ -21450,6 +22170,7 @@ var McpManager = class {
       const listed = await this.listRemoteTools(client, timeoutMs, signal);
       if (closedDuringConnect) throw new Error("MCP server closed during connection setup");
       const toolMap = this.buildAdapters(name, configured, listed.tools);
+      const undeclaredTools = configured.tools?.length ? listed.tools.filter((tool) => !configured.tools?.some((declared) => declared.name === tool.name)).length : 0;
       const connection = {
         name,
         client,
@@ -21471,7 +22192,12 @@ var McpManager = class {
         );
       }
       const status = this.setStatus(name, statusPatch);
-      return { name, ok: true, status, skippedTools: listed.skippedTools + listed.truncatedTools };
+      return {
+        name,
+        ok: true,
+        status,
+        skippedTools: listed.skippedTools + listed.truncatedTools + undeclaredTools
+      };
     } catch (error) {
       if (client) await closeQuietly(client);
       else if (transport) await closeTransportQuietly(transport);
@@ -21510,7 +22236,7 @@ var McpManager = class {
       stderr: "pipe"
     });
     transport.stderr?.on("data", (chunk) => {
-      const text = stripAnsi5(chunk.toString()).replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "").trim();
+      const text = stripAnsi6(chunk.toString()).replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "").trim();
       if (text) this.options.logger?.(`MCP ${name} stderr`, { text: text.slice(0, 2e3) });
     });
     return transport;
@@ -21560,6 +22286,8 @@ var McpManager = class {
       DEFAULT_TOOL_TIMEOUT
     );
     for (const remoteTool of remoteTools) {
+      const capability = declaredToolCapability(config, remoteTool.name, this.workspace);
+      if (config.tools?.length && !capability) continue;
       let exposedName = makeMcpToolName(namespace, remoteTool.name);
       const identity2 = `${serverName}\0${remoteTool.name}`;
       if (seen.has(exposedName) || this.isToolNameOwnedByAnother(exposedName, identity2)) {
@@ -21589,7 +22317,8 @@ var McpManager = class {
           exposedName,
           remoteTool,
           timeoutMs,
-          callTool
+          callTool,
+          ...capability ? { capability } : {}
         });
         this.stableAdapters.set(identity2, adapter);
       }
@@ -21624,6 +22353,8 @@ var McpManager = class {
       state: patch.state ?? current?.state ?? "disconnected",
       transport: patch.transport ?? current?.transport ?? "stdio",
       toolCount: patch.toolCount ?? current?.toolCount ?? 0,
+      required: patch.required ?? current?.required ?? false,
+      trust: patch.trust ?? current?.trust ?? "untrusted",
       ...patch.connectedAt !== void 0 ? { connectedAt: patch.connectedAt } : current?.connectedAt !== void 0 ? { connectedAt: current.connectedAt } : {},
       ...patch.serverVersion !== void 0 ? { serverVersion: patch.serverVersion } : current?.serverVersion !== void 0 ? { serverVersion: current.serverVersion } : {},
       ...patch.error !== void 0 ? { error: patch.error } : {}
@@ -21644,20 +22375,24 @@ function activationMetadata(result) {
     availableTools: result.availableTools,
     loadedTools: result.registeredTools,
     deferredTools: result.deferredTools,
-    skippedTools: result.skippedTools
+    skippedTools: result.skippedTools,
+    ...result.schemaBudget ? { schemaBudget: result.schemaBudget } : {}
   };
 }
 function selectRelevantTools(tools, query, limit) {
+  return rankRelevantTools(tools, query).slice(0, limit).map(({ tool }) => tool);
+}
+function rankRelevantTools(tools, query) {
   const terms = new Set(query.toLocaleLowerCase().match(/[\p{L}\p{N}_-]{2,}/gu) ?? []);
   return tools.map((tool) => {
     const searchable = `${tool.definition.name.replaceAll("_", " ")} ${tool.definition.description}`.toLocaleLowerCase();
     let score = 0;
     for (const term of terms) if (searchable.includes(term)) score += term.length;
     return { tool, score };
-  }).sort((left, right) => right.score - left.score || left.tool.definition.name.localeCompare(right.tool.definition.name)).slice(0, limit).map(({ tool }) => tool);
+  }).sort((left, right) => right.score - left.score || left.tool.definition.name.localeCompare(right.tool.definition.name));
 }
 function sanitizeCatalogText(value) {
-  return value ? stripAnsi5(value).replace(/[\u0000-\u001f\u007f]/g, " ").replace(/\s+/g, " ").trim().slice(0, 200) : "";
+  return value ? stripAnsi6(value).replace(/[\u0000-\u001f\u007f]/g, " ").replace(/\s+/g, " ").trim().slice(0, 200) : "";
 }
 function requestOptions(timeoutMs, signal) {
   return {
@@ -21691,7 +22426,7 @@ function errorMessage2(error) {
   return sanitizeStatusText(message2) || "Unknown MCP error";
 }
 function sanitizeStatusText(value) {
-  return stripAnsi5(value).replace(/[\u0000-\u001f\u007f]/g, " ").trim().slice(0, 1e3);
+  return stripAnsi6(value).replace(/[\u0000-\u001f\u007f]/g, " ").trim().slice(0, 1e3);
 }
 function timeoutError(timeoutMs) {
   const error = new Error(`MCP request timed out after ${timeoutMs} ms`);
@@ -21717,9 +22452,9 @@ async function closeTransportQuietly(transport) {
 }
 
 // src/memory/tools.ts
-import { z as z20 } from "zod";
-var scopeSchema = z20.enum(["user", "workspace", "session", "agent"]);
-var kindSchema = z20.enum(["semantic", "episodic", "procedural"]);
+import { z as z21 } from "zod";
+var scopeSchema = z21.enum(["user", "workspace", "session", "agent"]);
+var kindSchema = z21.enum(["semantic", "episodic", "procedural"]);
 function createMemoryTools(store) {
   return [
     {
@@ -21727,6 +22462,8 @@ function createMemoryTools(store) {
         name: "memory_search",
         description: "Search durable user, workspace, session, and agent memories relevant to the task.",
         category: "read",
+        source: "memory",
+        activation: "always",
         inputSchema: jsonSchema({
           query: { type: "string", description: "Natural-language memory query." },
           scope: { type: "string", enum: ["user", "workspace", "session", "agent"] },
@@ -21734,10 +22471,10 @@ function createMemoryTools(store) {
         }, ["query"])
       },
       async execute(arguments_, context) {
-        const input2 = z20.object({
-          query: z20.string().max(4e3),
+        const input2 = z21.object({
+          query: z21.string().max(4e3),
           scope: scopeSchema.optional(),
-          limit: z20.number().int().min(1).max(20).optional()
+          limit: z21.number().int().min(1).max(20).optional()
         }).parse(arguments_);
         const scopes = input2.scope ? [{ scope: input2.scope, scopeKey: scopeKey(input2.scope, context) }] : availableScopes(context);
         const records = store.search(input2.query, { scopes, limit: input2.limit ?? 8 });
@@ -21755,6 +22492,8 @@ ${record.content}`
         name: "memory_propose",
         description: "Propose a non-secret durable memory for user review. The candidate remains inactive until the user explicitly approves it.",
         category: "write",
+        source: "memory",
+        activation: "always",
         inputSchema: jsonSchema({
           content: { type: "string", description: "Concise fact, preference, experience, or procedure to propose. Never include secrets." },
           rationale: { type: "string", description: "Why this is useful beyond the current response and what evidence supports it." },
@@ -21769,17 +22508,17 @@ ${record.content}`
         }, ["content", "rationale"])
       },
       async execute(arguments_, context) {
-        const input2 = z20.object({
-          content: z20.string().min(1).max(12e3),
-          rationale: z20.string().min(1).max(1e3),
+        const input2 = z21.object({
+          content: z21.string().min(1).max(12e3),
+          rationale: z21.string().min(1).max(1e3),
           scope: scopeSchema.optional(),
           kind: kindSchema.optional(),
-          tags: z20.array(z20.string()).max(24).optional(),
-          importance: z20.number().min(0).max(1).optional(),
-          confidence: z20.number().min(0).max(1).optional(),
-          agent: z20.string().max(64).optional(),
-          revision: z20.string().max(240).optional(),
-          conflictKey: z20.string().max(240).optional()
+          tags: z21.array(z21.string()).max(24).optional(),
+          importance: z21.number().min(0).max(1).optional(),
+          confidence: z21.number().min(0).max(1).optional(),
+          agent: z21.string().max(64).optional(),
+          revision: z21.string().max(240).optional(),
+          conflictKey: z21.string().max(240).optional()
         }).strict().parse(arguments_);
         const scope = input2.scope ?? "workspace";
         const candidate = store.propose({
@@ -21811,15 +22550,17 @@ ${record.content}`
         name: "memory_forget",
         description: "Archive or permanently delete a memory by id.",
         category: "write",
+        source: "memory",
+        activation: "always",
         inputSchema: jsonSchema({
           id: { type: "string" },
           permanent: { type: "boolean" }
         }, ["id"])
       },
       async execute(arguments_) {
-        const input2 = z20.object({
-          id: z20.string().uuid(),
-          permanent: z20.boolean().optional()
+        const input2 = z21.object({
+          id: z21.string().uuid(),
+          permanent: z21.boolean().optional()
         }).parse(arguments_);
         const changed = input2.permanent ? store.remove(input2.id) : store.archive(input2.id);
         return {
@@ -21846,9 +22587,9 @@ function scopeKey(scope, context) {
 }
 
 // src/skills/catalog.ts
-import { lstat as lstat21, readFile as readFile20, readdir as readdir9, realpath as realpath9 } from "node:fs/promises";
-import { homedir as homedir4 } from "node:os";
-import { basename as basename12, join as join21, resolve as resolve23 } from "node:path";
+import { lstat as lstat22, readFile as readFile21, readdir as readdir9, realpath as realpath10 } from "node:fs/promises";
+import { homedir as homedir5 } from "node:os";
+import { basename as basename13, join as join22, resolve as resolve25 } from "node:path";
 import { parse as parseYaml3 } from "yaml";
 var SkillCatalog = class {
   constructor(workspace, config) {
@@ -21868,7 +22609,7 @@ var SkillCatalog = class {
     for (const location of locations) {
       const entries = await safeDirectories(location.path);
       for (const entry of entries) {
-        const skillPath = join21(location.path, entry, "SKILL.md");
+        const skillPath = join22(location.path, entry, "SKILL.md");
         const metadata = await readMetadata(skillPath);
         if (!metadata) continue;
         const descriptor = {
@@ -21916,30 +22657,30 @@ ${skill.content}
 </active-skills>`;
 }
 function discoveryLocations(workspace, configured) {
-  const home = homedir4();
-  const workspaceRoot = resolve23(workspace);
+  const home = homedir5();
+  const workspaceRoot = resolve25(workspace);
   return [
-    { path: join21(home, ".agents", "skills"), scope: "user", trusted: true },
-    { path: join21(home, ".claude", "skills"), scope: "user", trusted: true },
-    { path: join21(home, ".augment", "skills"), scope: "user", trusted: true },
-    { path: join21(resolveHomeNamespace(), "skills"), scope: "user", trusted: true },
+    { path: join22(home, ".agents", "skills"), scope: "user", trusted: true },
+    { path: join22(home, ".claude", "skills"), scope: "user", trusted: true },
+    { path: join22(home, ".augment", "skills"), scope: "user", trusted: true },
+    { path: join22(resolveHomeNamespace(), "skills"), scope: "user", trusted: true },
     ...configured.map((path) => {
-      const resolved = resolve23(workspaceRoot, path);
+      const resolved = resolve25(workspaceRoot, path);
       return {
         path: resolved,
         scope: "configured",
         trusted: !isInside(workspaceRoot, resolved)
       };
     }),
-    { path: join21(workspace, ".agents", "skills"), scope: "workspace", trusted: false },
-    { path: join21(workspace, ".claude", "skills"), scope: "workspace", trusted: false },
-    { path: join21(workspace, ".augment", "skills"), scope: "workspace", trusted: false },
-    { path: join21(resolveProjectNamespaceSync(workspaceRoot).active, "skills"), scope: "workspace", trusted: false }
+    { path: join22(workspace, ".agents", "skills"), scope: "workspace", trusted: false },
+    { path: join22(workspace, ".claude", "skills"), scope: "workspace", trusted: false },
+    { path: join22(workspace, ".augment", "skills"), scope: "workspace", trusted: false },
+    { path: join22(resolveProjectNamespaceSync(workspaceRoot).active, "skills"), scope: "workspace", trusted: false }
   ];
 }
 async function safeDirectories(path) {
   try {
-    const info = await lstat21(path);
+    const info = await lstat22(path);
     if (!info.isDirectory() || info.isSymbolicLink()) return [];
     const entries = await readdir9(path, { withFileTypes: true });
     return entries.filter((entry) => entry.isDirectory() && !entry.isSymbolicLink()).map((entry) => entry.name).slice(0, 500);
@@ -21953,7 +22694,7 @@ async function readMetadata(path) {
   const { frontmatter } = splitFrontmatter(raw);
   if (!frontmatter) return void 0;
   const parsed = parseYaml3(frontmatter);
-  const name = typeof parsed?.name === "string" ? parsed.name.trim() : basename12(resolve23(path, ".."));
+  const name = typeof parsed?.name === "string" ? parsed.name.trim() : basename13(resolve25(path, ".."));
   const description = typeof parsed?.description === "string" ? parsed.description.trim() : "";
   if (!/^[a-z][a-z0-9_-]{0,63}$/.test(name) || !description || description.length > 1e3) {
     return void 0;
@@ -21972,13 +22713,13 @@ async function readSkill(path, maxChars) {
 }
 async function safeRead(path, maxBytes) {
   try {
-    const info = await lstat21(path);
+    const info = await lstat22(path);
     if (!info.isFile() || info.isSymbolicLink() || info.size > maxBytes) return void 0;
-    const parent = resolve23(path, "..");
-    const resolvedParent = await realpath9(parent);
-    const resolvedPath = await realpath9(path);
+    const parent = resolve25(path, "..");
+    const resolvedParent = await realpath10(parent);
+    const resolvedPath = await realpath10(path);
     if (!resolvedPath.startsWith(`${resolvedParent}/`)) return void 0;
-    return await readFile20(path, "utf8");
+    return await readFile21(path, "utf8");
   } catch {
     return void 0;
   }
@@ -22023,7 +22764,7 @@ function escapeAttribute6(value) {
 }
 
 // src/workflows/catalog.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 var builtInWorkflows = [
   {
     name: "implement",
@@ -22108,13 +22849,15 @@ function createWorkflowTool(catalog) {
       name: "workflow_plan",
       description: "Load a built-in typed workflow for implementation, debugging, review, or refactoring.",
       category: "read",
+      source: "workflow",
+      activation: "always",
       inputSchema: jsonSchema({
         name: { type: "string", enum: catalog.list().map((workflow) => workflow.name) },
         task: { type: "string" }
       }, ["name", "task"])
     },
     async execute(arguments_) {
-      const input2 = z21.object({ name: z21.string(), task: z21.string().min(1).max(2e4) }).parse(arguments_);
+      const input2 = z22.object({ name: z22.string(), task: z22.string().min(1).max(2e4) }).parse(arguments_);
       const workflow = catalog.get(input2.name);
       if (!workflow) return { ok: false, content: `Unknown workflow: ${input2.name}` };
       return {
@@ -22157,9 +22900,10 @@ var ExtensionRuntime = class _ExtensionRuntime {
   workflows = new WorkflowCatalog();
   options;
   delegation;
+  registry;
   initialized = false;
   static async create(config, registry, options = {}) {
-    const runtime = new _ExtensionRuntime(config, resolve24(config.workspaceRoots[0] ?? process.cwd()), options);
+    const runtime = new _ExtensionRuntime(config, resolve26(config.workspaceRoots[0] ?? process.cwd()), options);
     try {
       await runtime.initialize(registry, options.signal);
       return runtime;
@@ -22180,8 +22924,8 @@ var ExtensionRuntime = class _ExtensionRuntime {
     }
     await this.skills?.discover();
     if (this.mcp) {
-      const activationTool = this.mcp.activationTool(registry);
-      if (activationTool) registry.register(activationTool);
+      await this.mcp.initialize(_signal);
+      for (const tool of this.mcp.catalogTools(registry)) registry.register(tool);
     }
     await this.profiles?.discover();
     if (this.config.agents?.enabled && this.profiles && this.options.provider && this.options.contextEngine) {
@@ -22202,6 +22946,7 @@ var ExtensionRuntime = class _ExtensionRuntime {
       }
     }
     registry.register(createWorkflowTool(this.workflows));
+    this.registry = registry;
     this.initialized = true;
   }
   async prepare(input2, session) {
@@ -22276,6 +23021,25 @@ var ExtensionRuntime = class _ExtensionRuntime {
   mcpStatus() {
     return this.mcp?.list() ?? [];
   }
+  mcpSearch(query = "") {
+    return this.mcp?.search(query) ?? [];
+  }
+  mcpInspect(name) {
+    return this.mcp?.inspect(name);
+  }
+  async mcpTrust(name) {
+    return this.mcp?.trust(name);
+  }
+  async mcpDisable(name) {
+    return this.mcp?.disable(name);
+  }
+  async mcpRevoke(name) {
+    return this.mcp?.revoke(name);
+  }
+  async mcpActivate(name, query, signal) {
+    if (!this.mcp || !this.registry) return;
+    return this.mcp.activate(name, query, this.registry, signal);
+  }
   cancelAgent(id) {
     return this.delegation?.cancelAgent(id) ?? false;
   }
@@ -22364,15 +23128,15 @@ function upgradeCommandOverride(env = process.env) {
   return trimmed ? trimmed : void 0;
 }
 function runUpgrade(plan) {
-  return new Promise((resolve26) => {
+  return new Promise((resolve28) => {
     const child = spawn2(plan.command, plan.args, {
       stdio: "inherit",
       shell: plan.shell ?? false
     });
-    child.on("error", () => resolve26({ ok: false, exitCode: 127, display: plan.display }));
+    child.on("error", () => resolve28({ ok: false, exitCode: 127, display: plan.display }));
     child.on("close", (code) => {
       const exitCode = code ?? 1;
-      resolve26({ ok: exitCode === 0, exitCode, display: plan.display });
+      resolve28({ ok: exitCode === 0, exitCode, display: plan.display });
     });
   });
 }
@@ -22553,7 +23317,7 @@ program.command("migrate").description("Inspect or migrate legacy .mosaic state
     process.stdout.write(`${recovery.status === "recovered" ? "Recovered" : "Recovery candidates"}: ${recovery.destination}
 `);
     for (const candidate of recovery.candidates) {
-      process.stdout.write(`  ${basename13(candidate.path)}  ${candidate.kind}  ${candidate.action}  ${candidate.detail}
+      process.stdout.write(`  ${basename14(candidate.path)}  ${candidate.kind}  ${candidate.action}  ${candidate.detail}
 `);
     }
     if (!options.yes && recovery.status === "ready") {
@@ -22634,7 +23398,7 @@ sessionCommand.command("export <id>").description("Export a session as Markdown"
   const store = new SessionStore(workspaceOption(options.workspace));
   const session = await requireSessionSelector(store, id);
   const markdown = sessionMarkdown(session);
-  if (options.output) await writeFile3(resolve25(options.output), markdown, "utf8");
+  if (options.output) await writeFile3(resolve27(options.output), markdown, "utf8");
   else process.stdout.write(markdown);
 });
 var checkpointCommand = program.command("checkpoint").description("Inspect and restore pre-mutation snapshots");
@@ -22947,7 +23711,7 @@ memoryCommand.command("reject <id>").description("Reject a memory proposal witho
   }
 });
 var mcpCommand = program.command("mcp").description("Inspect configured MCP servers");
-mcpCommand.command("status").description("Connect and report MCP server/tool status").option("-w, --workspace <path>", "workspace root").option("--config <path>", "explicit config file").option("--json", "print JSON").action(async (options) => {
+mcpCommand.command("status").description("Report redacted MCP trust and connection status without connecting optional servers").option("-w, --workspace <path>", "workspace root").option("--config <path>", "explicit config file").option("--json", "print JSON").action(async (options) => {
   const config = await runtimeConfig(workspaceOption(options.workspace), runtimeOptions(options));
   if (!config.mcp) return printObject([], options.json === true);
   const manager = new McpManager(config.mcp, {
@@ -22955,18 +23719,99 @@ mcpCommand.command("status").description("Connect and report MCP server/tool sta
     workspaceRoots: config.workspaceRoots
   });
   try {
-    await manager.connectAll();
+    await manager.loadTrust();
     const status = manager.list();
     if (options.json) printObject(status, true);
     else if (!status.length) process.stdout.write("No MCP servers configured.\n");
     else for (const server of status) {
-      process.stdout.write(`${server.name.padEnd(18)} ${server.state.padEnd(12)} ${server.toolCount} tools${server.error ? `  ${server.error}` : ""}
+      process.stdout.write(`${server.name.padEnd(18)} ${server.state.padEnd(12)} ${server.trust.padEnd(10)} ${server.required ? "required" : "optional"}  ${server.toolCount} tools${server.error ? `  ${server.error}` : ""}
 `);
     }
   } finally {
     await manager.close();
   }
 });
+mcpCommand.command("search [query...]").description("Search configured capability manifests without network access").option("-w, --workspace <path>", "workspace root").option("--config <path>", "explicit config file").option("--json", "print JSON").action(async (query, options) => {
+  const config = await runtimeConfig(workspaceOption(options.workspace), runtimeOptions(options));
+  if (!config.mcp) return printObject([], options.json === true);
+  const manager = createMcpManager(config);
+  await manager.loadTrust();
+  const results = manager.search(query.join(" "));
+  if (options.json) printObject(results, true);
+  else if (!results.length) process.stdout.write("No configured MCP capability matched.\n");
+  else for (const result of results) {
+    process.stdout.write(`${result.name.padEnd(18)} ${result.trust.padEnd(10)} ${result.version}  ${result.description}
+`);
+  }
+});
+mcpCommand.command("inspect <server>").description("Review a redacted declarative capability manifest without connecting").option("-w, --workspace <path>", "workspace root").option("--config <path>", "explicit config file").option("--json", "print JSON").action(async (server, options) => {
+  const config = await runtimeConfig(workspaceOption(options.workspace), runtimeOptions(options));
+  if (!config.mcp) throw new Error("MCP is not configured.");
+  const manager = createMcpManager(config);
+  await manager.loadTrust();
+  const review = {
+    manifest: manager.inspect(server),
+    fingerprint: manager.fingerprint(server),
+    trust: manager.status(server)?.trust ?? "untrusted"
+  };
+  if (options.json) printObject(review, true);
+  else printMcpManifest(review);
+});
+mcpCommand.command("trust <server>").description("Trust the current redacted manifest fingerprint after review").option("-w, --workspace <path>", "workspace root").option("--config <path>", "explicit config file").option("--json", "print JSON").option("--yes", "confirm trust non-interactively").action(async (server, options) => {
+  const config = await runtimeConfig(workspaceOption(options.workspace), runtimeOptions(options));
+  if (!config.mcp) throw new Error("MCP is not configured.");
+  const manager = createMcpManager(config);
+  await manager.loadTrust();
+  const review = {
+    manifest: manager.inspect(server),
+    fingerprint: manager.fingerprint(server),
+    trust: manager.status(server)?.trust ?? "untrusted"
+  };
+  if (!options.json) printMcpManifest(review);
+  if (!options.yes && !await confirm(`Trust this exact capability manifest for ${server}?`)) return;
+  const status = await manager.trust(server);
+  if (options.json) printObject({ manifest: review.manifest, fingerprint: review.fingerprint, status }, true);
+  else process.stdout.write(`Trusted ${server}. Activation remains explicit.
+`);
+});
+mcpCommand.command("activate <server> <query...>").description("Connect one trusted server and load only query-relevant schemas").option("-w, --workspace <path>", "workspace root").option("--config <path>", "explicit config file").option("--json", "print JSON").action(async (server, query, options) => {
+  const config = await runtimeConfig(workspaceOption(options.workspace), runtimeOptions(options));
+  if (!config.mcp) throw new Error("MCP is not configured.");
+  const manager = createMcpManager(config);
+  const registry = createDefaultToolRegistry();
+  try {
+    await manager.loadTrust();
+    const result = await manager.activate(server, query.join(" "), registry);
+    if (options.json) printObject(result, true);
+    else process.stdout.write(result.ok ? `Activated ${server}; loaded ${result.registeredTools.length}/${result.availableTools} relevant schemas.
+` : `Could not activate ${server}: ${result.status.error ?? result.status.trust}.
+`);
+    if (!result.ok) process.exitCode = 1;
+  } finally {
+    await manager.close();
+  }
+});
+mcpCommand.command("disable <server>").description("Persistently disable an MCP capability and unload its schemas").option("-w, --workspace <path>", "workspace root").option("--config <path>", "explicit config file").option("--json", "print JSON").action(async (server, options) => {
+  const config = await runtimeConfig(workspaceOption(options.workspace), runtimeOptions(options));
+  if (!config.mcp) throw new Error("MCP is not configured.");
+  const manager = createMcpManager(config);
+  await manager.loadTrust();
+  const status = await manager.disable(server);
+  if (options.json) printObject(status, true);
+  else process.stdout.write(`Disabled ${server}.
+`);
+});
+mcpCommand.command("revoke <server>").description("Revoke persisted MCP trust and require a fresh review").option("-w, --workspace <path>", "workspace root").option("--config <path>", "explicit config file").option("--json", "print JSON").option("--yes", "confirm revocation non-interactively").action(async (server, options) => {
+  const config = await runtimeConfig(workspaceOption(options.workspace), runtimeOptions(options));
+  if (!config.mcp) throw new Error("MCP is not configured.");
+  if (!options.yes && !await confirm(`Revoke persisted trust for ${server}?`)) return;
+  const manager = createMcpManager(config);
+  await manager.loadTrust();
+  const status = await manager.revoke(server);
+  if (options.json) printObject(status, true);
+  else process.stdout.write(`Revoked ${server}; inspect and trust the manifest before reuse.
+`);
+});
 program.command("rules").description("List user and workspace rules loaded into the agent").option("-w, --workspace <path>", "workspace root").option("--json", "print JSON").action(async (options) => {
   const rules = await discoverWorkspaceRules(workspaceOption(options.workspace));
   if (options.json) {
@@ -23023,7 +23868,7 @@ async function runChat(prompts, options) {
   const stdinPrompt = !process.stdin.isTTY ? await readStdin() : "";
   const firstPrompt = [...prompts, stdinPrompt].filter(Boolean).join("\n\n").trim();
   if (shouldPrint && !firstPrompt) throw new Error("Provide a prompt argument or pipe input on stdin.");
-  const workspace = resolve25(options.workspace);
+  const workspace = resolve27(options.workspace);
   let config = await runtimeConfig(workspace, options);
   let completedOnboarding = false;
   if (!shouldPrint && needsFirstRunOnboarding(config)) {
@@ -23253,14 +24098,14 @@ async function runAgentSetup(options) {
 `);
 }
 async function runtimeConfig(workspaceInput, options) {
-  const workspace = resolve25(workspaceInput);
+  const workspace = resolve27(workspaceInput);
   const loaded = await loadConfig(workspace, options.config, {
     trustProjectConfig: options.trustProjectConfig === true
   });
   const roots = [
     workspace,
     ...loaded.workspaceRoots,
-    ...(options.addWorkspace ?? []).map((root) => resolve25(workspace, root))
+    ...(options.addWorkspace ?? []).map((root) => resolve27(workspace, root))
   ];
   const provider = options.provider ? validateProvider(options.provider) : loaded.model.provider;
   return {
@@ -23398,6 +24243,36 @@ function sessionMarkdown(session) {
   return `${lines.join("\n")}
 `;
 }
+function createMcpManager(config) {
+  if (!config.mcp) throw new Error("MCP is not configured.");
+  return new McpManager(config.mcp, {
+    cwd: config.workspaceRoots[0] ?? process.cwd(),
+    workspaceRoots: config.workspaceRoots
+  });
+}
+function printMcpManifest(review) {
+  const { manifest } = review;
+  process.stdout.write(`MCP capability ${manifest.name} (${manifest.version})
+`);
+  process.stdout.write(`  Source: ${manifest.source.kind}/${manifest.source.owner}
+`);
+  process.stdout.write(`  Target: ${manifest.transport} ${manifest.target}
+`);
+  process.stdout.write(`  Trust: ${review.trust}  ${manifest.required ? "required" : "optional"}
+`);
+  process.stdout.write(`  Fingerprint: ${review.fingerprint}
+`);
+  if (!manifest.tools.length) {
+    process.stdout.write("  Tools: dynamically discovered; network-only, completion evidence unsupported\n");
+    return;
+  }
+  for (const tool of manifest.tools) {
+    process.stdout.write(`  ${tool.name}: ${tool.permissions.join("+")}  evidence=${tool.completionEvidence}
+`);
+    process.stdout.write(`    network=${tool.network.join(", ") || "unspecified"} commands=${tool.commands.join(", ") || "none"} paths=${tool.paths.join(", ") || "none"} sensitive=${tool.sensitiveFields.join(", ") || "none"}
+`);
+  }
+}
 async function confirm(prompt) {
   if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
   const readline = createInterface2({ input, output });
@@ -23417,7 +24292,7 @@ function collect(value, previous) {
 }
 function workspaceOption(value) {
   const rootOptions = program.opts();
-  return resolve25(value ?? rootOptions.workspace ?? process.cwd());
+  return resolve27(value ?? rootOptions.workspace ?? process.cwd());
 }
 function runtimeOptions(options) {
   const root = program.opts();