@sunilaleti/hx 0.3.0-beta.1 → 1.0.0

package/dist/hx.js

@@ -825,7 +825,7 @@ var init_json = __esm({
 
 // src/paths.ts
 import { createHash } from "node:crypto";
-import { closeSync, mkdirSync, openSync } from "node:fs";
+import { chmodSync, closeSync, mkdirSync, openSync, statSync as statSync3 } from "node:fs";
 function userHome() {
   const override = process.env[HX_HOME_ENV];
   return override ? purePath(expandUser(override)) : join(purePath(home()), ".hx");
@@ -883,7 +883,13 @@ function projectInstructionsFiles(cwd, root) {
   return chain2.slice(0, index + 1).reverse().map((directory) => join(directory, "AGENTS.md"));
 }
 function ensureUserDirs() {
-  for (const path of [userHome(), sessionsDir(), userSkillsDir(), userAgentsDir(), logsDir()]) {
+  const root = userHome();
+  mkdirSync(root, { recursive: true, mode: 448 });
+  try {
+    if (statSync3(root).mode & 63) chmodSync(root, 448);
+  } catch {
+  }
+  for (const path of [sessionsDir(), userSkillsDir(), userAgentsDir(), logsDir()]) {
     mkdirSync(path, { recursive: true });
   }
   try {
@@ -932,7 +938,7 @@ var init_paths = __esm({
 });
 
 // src/auth/store.ts
-import { chmodSync, closeSync as closeSync2, mkdirSync as mkdirSync2, openSync as openSync2, renameSync, rmSync, writeSync } from "node:fs";
+import { chmodSync as chmodSync2, closeSync as closeSync2, mkdirSync as mkdirSync2, openSync as openSync2, renameSync, rmSync, writeSync } from "node:fs";
 function expired(credential, leeway = 300) {
   return Date.now() / 1e3 >= credential.expires - leeway;
 }
@@ -1088,7 +1094,7 @@ var init_store = __esm({
           throw error;
         }
         closeSync2(descriptor);
-        chmodSync(tmp, 384);
+        chmodSync2(tmp, 384);
         renameSync(tmp, path);
       }
     };
@@ -1744,13 +1750,13 @@ var init_base = __esm({
 });
 
 // src/which.ts
-import { accessSync, constants, statSync as statSync3 } from "node:fs";
+import { accessSync, constants, statSync as statSync4 } from "node:fs";
 function which(name, path = process.env.PATH) {
   const candidates2 = name.includes("/") ? [name] : (path ?? "").split(":").map((dir) => join(dir || ".", name));
   for (const candidate of candidates2) {
     try {
       accessSync(candidate, constants.X_OK);
-      if (statSync3(candidate).isFile()) return candidate;
+      if (statSync4(candidate).isFile()) return candidate;
     } catch {
     }
   }
@@ -2385,12 +2391,13 @@ function quote(text3) {
   if (SAFE.test(text3)) return text3;
   return `'${text3.replaceAll("'", `'"'"'`)}'`;
 }
-var WHITESPACE, SAFE;
+var WHITESPACE, SAFE, join2;
 var init_shlex = __esm({
   "src/shlex.ts"() {
     "use strict";
     WHITESPACE = " 	\r\n";
     SAFE = /^[%+,\-./0-9:=@A-Z_a-z]+$/;
+    join2 = (parts2) => parts2.map(quote).join(" ");
   }
 });
 
@@ -2584,7 +2591,7 @@ var init_messages = __esm({
 });
 
 // src/core/images.ts
-import { readFileSync as readFileSync2, statSync as statSync4 } from "node:fs";
+import { readFileSync as readFileSync2, statSync as statSync5 } from "node:fs";
 async function loadSharp() {
   sharpModule ??= (await import("sharp")).default;
   return sharpModule;
@@ -2627,7 +2634,7 @@ async function loadImage(data, label = "") {
 async function loadImageFile(path, label) {
   let bytes;
   try {
-    bytes = statSync4(path).size;
+    bytes = statSync5(path).size;
   } catch (error) {
     throw new ImageError(`cannot read ${path}: ${strerror(error)}`);
   }
@@ -5079,7 +5086,7 @@ import {
   openSync as openSync3,
   readdirSync as readdirSync2,
   realpathSync as realpathSync2,
-  statSync as statSync5,
+  statSync as statSync6,
   writeSync as writeSync2
 } from "node:fs";
 function servedName(name) {
@@ -5213,7 +5220,7 @@ function projectDir2(cwd) {
   const prefix = sanitized.slice(0, 200);
   try {
     for (const entry of readdirSync2(projects))
-      if (entry.startsWith(`${prefix}-`) && statSync5(join(projects, entry)).isDirectory())
+      if (entry.startsWith(`${prefix}-`) && statSync6(join(projects, entry)).isDirectory())
         return join(projects, entry);
   } catch {
   }
@@ -16962,7 +16969,7 @@ var require_abnf = __commonJS({
         scope: "attribute",
         match: regex.concat(IDENT, /(?=\s*=)/)
       };
-      const ASSIGNMENT = {
+      const ASSIGNMENT2 = {
         scope: "operator",
         match: /=\/?/
       };
@@ -16971,7 +16978,7 @@ var require_abnf = __commonJS({
         illegal: /[!@#$^&',?+~`|:]/,
         keywords: KEYWORDS,
         contains: [
-          ASSIGNMENT,
+          ASSIGNMENT2,
           RULE_DECLARATION,
           COMMENT,
           TERMINAL_BINARY,
@@ -30310,7 +30317,7 @@ var require_gams = __commonJS({
         illegal: "\\n",
         contains: [hljs.BACKSLASH_ESCAPE]
       };
-      const ASSIGNMENT = {
+      const ASSIGNMENT2 = {
         begin: "/",
         end: "/",
         keywords: KEYWORDS,
@@ -30332,7 +30339,7 @@ var require_gams = __commonJS({
         endsWithParent: true,
         contains: [
           QSTR,
-          ASSIGNMENT,
+          ASSIGNMENT2,
           {
             className: "comment",
             // one comment word, then possibly more
@@ -30379,7 +30386,7 @@ var require_gams = __commonJS({
               hljs.C_BLOCK_COMMENT_MODE,
               hljs.QUOTE_STRING_MODE,
               hljs.APOS_STRING_MODE,
-              ASSIGNMENT,
+              ASSIGNMENT2,
               DESCTEXT
             ]
           },
@@ -40434,7 +40441,7 @@ var require_makefile = __commonJS({
           // Added QUOTE_STRING as they can be a part of functions
         ]
       };
-      const ASSIGNMENT = { begin: "^" + hljs.UNDERSCORE_IDENT_RE + "\\s*(?=[:+?]?=)" };
+      const ASSIGNMENT2 = { begin: "^" + hljs.UNDERSCORE_IDENT_RE + "\\s*(?=[:+?]?=)" };
       const META = {
         className: "meta",
         begin: /^\.PHONY:/,
@@ -40466,7 +40473,7 @@ var require_makefile = __commonJS({
           VARIABLE,
           QUOTE_STRING,
           FUNC,
-          ASSIGNMENT,
+          ASSIGNMENT2,
           META,
           TARGET
         ]
@@ -67725,8 +67732,7 @@ init_net();
 init_py();
 
 // src/version.ts
-var VERSION = "0.3.0-beta.1";
-var PACKAGE = "@sunilaleti/hx";
+var VERSION = "1.0.0";
 
 // src/providers/codex.ts
 init_base();
@@ -68165,12 +68171,12 @@ init_images();
 
 // src/core/session.ts
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { appendFileSync, mkdirSync as mkdirSync7, statSync as statSync8, writeFileSync as writeFileSync4 } from "node:fs";
+import { appendFileSync, mkdirSync as mkdirSync7, statSync as statSync9, writeFileSync as writeFileSync4 } from "node:fs";
 
 // src/glob.ts
 init_pathlib();
 init_py();
-import { opendirSync, statSync as statSync6 } from "node:fs";
+import { opendirSync, statSync as statSync7 } from "node:fs";
 function translate(pattern) {
   let out = "";
   const chars = [...pattern];
@@ -68222,7 +68228,7 @@ function isDirEntry(directory, entry) {
   if (entry.isDirectory()) return true;
   if (!entry.isSymbolicLink()) return false;
   try {
-    return statSync6(join(directory, entry.name)).isDirectory();
+    return statSync7(join(directory, entry.name)).isDirectory();
   } catch {
     return false;
   }
@@ -68259,7 +68265,7 @@ function select(path, rest, out) {
     const child = join(path, part);
     if (tail3.length === 0) {
       try {
-        statSync6(child);
+        statSync7(child);
         out.push(child);
       } catch {
       }
@@ -68477,7 +68483,7 @@ function digestOf(path) {
 init_messages();
 
 // src/core/reads.ts
-import { statSync as statSync7 } from "node:fs";
+import { statSync as statSync8 } from "node:fs";
 var fileReadToDict = (read2) => ({
   index: read2.index,
   path: read2.path,
@@ -68516,7 +68522,7 @@ var STAT_DIGESTS = /* @__PURE__ */ new Map();
 function cachedDigest(key2) {
   let stamp;
   try {
-    const info = statSync7(key2, { bigint: true });
+    const info = statSync8(key2, { bigint: true });
     stamp = `${info.ino}:${info.size}:${info.mtimeNs}`;
   } catch {
     STAT_DIGESTS.delete(key2);
@@ -68908,7 +68914,7 @@ var BACKFILL_MAX_BYTES = 4e6;
 function backfilled(meta) {
   if (meta.promptCount || meta.messageCount <= 0) return meta;
   try {
-    if (statSync8(sessionTranscriptFile(meta.sessionId)).size > BACKFILL_MAX_BYTES) return meta;
+    if (statSync9(sessionTranscriptFile(meta.sessionId)).size > BACKFILL_MAX_BYTES) return meta;
   } catch {
     return meta;
   }
@@ -69034,6 +69040,75 @@ function changelog(version = null) {
   );
 }
 
+// src/mcp/approval.ts
+init_json();
+init_pathlib();
+init_paths();
+init_shlex();
+import { createHash as createHash8 } from "node:crypto";
+import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync5 } from "node:fs";
+var approvalsFile = (cwd) => join(projectStateDir(cwd), "mcp-approved.json");
+function fingerprint2(config2) {
+  const fields = {
+    transport: config2.transport,
+    command: config2.command,
+    args: config2.args,
+    env: config2.env,
+    url: config2.url,
+    headers: config2.headers
+  };
+  return createHash8("sha256").update(dumps(fields, { sortKeys: true })).digest("hex");
+}
+function readApprovals(cwd) {
+  const path = approvalsFile(cwd);
+  if (!isFile(path)) return {};
+  try {
+    const data = JSON.parse(readText(path));
+    if (typeof data !== "object" || data === null || Array.isArray(data)) return {};
+    return Object.fromEntries(
+      Object.entries(data).filter(
+        (entry) => typeof entry[1] === "string"
+      )
+    );
+  } catch {
+    return {};
+  }
+}
+function writeApprovals(cwd, approvals) {
+  const path = approvalsFile(cwd);
+  mkdirSync8(parent(path), { recursive: true });
+  writeFileSync5(path, `${dumps(approvals, { indent: 2, sortKeys: true })}
+`);
+}
+function approve(config2, cwd) {
+  writeApprovals(cwd, { ...readApprovals(cwd), [config2.name]: fingerprint2(config2) });
+}
+function revoke(name, cwd) {
+  const approvals = readApprovals(cwd);
+  if (!(name in approvals)) return;
+  delete approvals[name];
+  writeApprovals(cwd, approvals);
+}
+function partition(configs, cwd) {
+  const approvals = readApprovals(cwd);
+  const startable = [];
+  const waiting = [];
+  for (const config2 of configs) {
+    const approved = approvals[config2.name];
+    if (config2.source === "user" || approved === fingerprint2(config2)) startable.push(config2);
+    else waiting.push({ config: config2, changed: approved !== void 0 });
+  }
+  return [startable, waiting];
+}
+function describeServer(config2) {
+  if (config2.url) return config2.url;
+  return join2([config2.command ?? "", ...config2.args]);
+}
+function waitingNotice({ config: config2, changed }) {
+  const why = changed ? "has changed since you approved it" : "came with the project and has not been approved";
+  return `MCP server ${config2.name} in .hx/mcp.json ${why}, so HX has not started it. It ${config2.url ? "connects to" : "runs"}: ${describeServer(config2)}. Run \`hx mcp approve ${config2.name}\` to start it.`;
+}
+
 // src/mcp/client.ts
 init_json();
 init_net();
@@ -69614,7 +69689,7 @@ init_json();
 init_pathlib();
 init_paths();
 init_py();
-import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync6 } from "node:fs";
+import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync7 } from "node:fs";
 
 // src/tools/base.ts
 function toolResult(content, fields = {}) {
@@ -69671,7 +69746,7 @@ function isAbort(error, signal) {
 init_pathlib();
 init_paths();
 init_py();
-import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync5 } from "node:fs";
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync6 } from "node:fs";
 var MIN_BODY_CHARS = 200;
 function elision(omittedLines, omittedChars, path) {
   return `
@@ -69726,10 +69801,10 @@ function split2(lines2, charCap, lineCap, headRatio) {
 }
 function spill(text3, sessionId, toolUseId) {
   const directory = sessionOutputsDir(sessionId);
-  mkdirSync8(directory, { recursive: true });
+  mkdirSync9(directory, { recursive: true });
   const safe = toolUseId.replace(/[^A-Za-z0-9_.-]/g, "_") || "output";
   const path = join(directory, `${safe}.txt`);
-  writeFileSync5(path, text3, "utf8");
+  writeFileSync6(path, text3, "utf8");
   return path;
 }
 function summarizeForUi(text3, maxLen = 120) {
@@ -70295,6 +70370,7 @@ function serverConfig(fields) {
     enabled: true,
     timeout: 30,
     oauth: noOptions(),
+    source: "user",
     ...fields
   };
 }
@@ -70369,11 +70445,13 @@ async function normalise(raw, tool) {
   return [images2, problems];
 }
 var MCPManager = class {
-  constructor(configs, store = new AuthStore()) {
+  constructor(configs, store = new AuthStore(), waiting = []) {
     this.store = store;
+    this.waiting = waiting;
     this.configs = configs.filter((config2) => config2.enabled);
   }
   store;
+  waiting;
   configs;
   clients = /* @__PURE__ */ new Map();
   statuses = /* @__PURE__ */ new Map();
@@ -70585,13 +70663,16 @@ function buildTransport(config2, store) {
 var userMcpFile = () => join(userHome(), "mcp.json");
 function loadConfigs(cwd) {
   const merged = /* @__PURE__ */ new Map();
-  for (const path of [userMcpFile(), projectMcpFile(cwd)])
-    for (const config2 of readFile(path)) merged.set(config2.name, config2);
+  for (const [path, source] of [
+    [userMcpFile(), "user"],
+    [projectMcpFile(cwd), "project"]
+  ])
+    for (const config2 of readFile(path, source)) merged.set(config2.name, config2);
   return [...merged.keys()].sort(compareCodePoints).map((name) => merged.get(name));
 }
 var isObject7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var strings = (raw) => Object.fromEntries(Object.entries(isObject7(raw) ? raw : {}).map(([k, v]) => [k, String(v)]));
-function readFile(path) {
+function readFile(path, source) {
   if (!isFile(path)) return [];
   let data;
   try {
@@ -70617,7 +70698,8 @@ function readFile(path) {
         headers: strings(raw.headers),
         enabled: "enabled" in raw ? truthy(raw.enabled) : true,
         timeout: "timeout" in raw ? toFloat(raw.timeout) : 30,
-        oauth: optionsFromJson(raw.oauth)
+        oauth: optionsFromJson(raw.oauth),
+        source
       })
     );
   }
@@ -70632,7 +70714,7 @@ function readJson(path) {
     return {};
   }
 }
-var writeJson = (path, data) => writeFileSync6(path, `${dumps(data, { indent: 2, sortKeys: true })}
+var writeJson = (path, data) => writeFileSync7(path, `${dumps(data, { indent: 2, sortKeys: true })}
 `);
 function saveConfig(config2, cwd, userLevel = false) {
   const path = userLevel ? userMcpFile() : projectMcpFile(cwd);
@@ -70648,7 +70730,7 @@ function saveConfig(config2, cwd, userLevel = false) {
   const block2 = optionsToJson(config2.oauth);
   if (Object.keys(block2).length) entry.oauth = block2;
   servers[config2.name] = entry;
-  mkdirSync9(parent(path), { recursive: true });
+  mkdirSync10(parent(path), { recursive: true });
   writeJson(path, data);
   return path;
 }
@@ -70673,6 +70755,69 @@ function removeConfig(name, cwd, userLevel = false) {
 init_net();
 init_pathlib();
 init_paths();
+
+// src/providers/deferred.ts
+init_resolve();
+init_base();
+init_registry();
+var NOT_SIGNED_IN = "Not signed in yet. Type /login to sign in with ChatGPT Plus/Pro, Claude Pro/Max, an OpenRouter API key or Devin.";
+var NEEDS = {
+  openrouter: "an OpenRouter API key",
+  "openai-codex": "a ChatGPT Plus/Pro sign-in",
+  "claude-code": "a Claude Pro/Max sign-in",
+  devin: "a Devin sign-in"
+};
+function signInHint(modelId, resolver) {
+  if (!available(resolver).length) return NOT_SIGNED_IN;
+  const route = providerFor(modelId);
+  const needs = NEEDS[route.id] ?? `a ${route.label} sign-in`;
+  return `${modelId} needs ${needs}, which is not set up yet. Type /login to sign in, or /model to pick a model you can use.`;
+}
+var DeferredProvider = class {
+  constructor(modelId, resolver, sessionId, models) {
+    this.modelId = modelId;
+    this.resolver = resolver;
+    this.sessionId = sessionId;
+    this.models = models;
+  }
+  modelId;
+  resolver;
+  sessionId;
+  models;
+  inner = null;
+  get name() {
+    return this.inner?.name ?? providerFor(this.modelId).id;
+  }
+  /** The prompt-cache key, kept for the provider this becomes. */
+  setSessionId(sessionId) {
+    this.sessionId = sessionId;
+    this.inner?.setSessionId?.(sessionId);
+  }
+  /** A key saved now is read from the store when the provider is built. */
+  setApiKey(key2) {
+    this.inner?.setApiKey?.(key2);
+  }
+  async *astream(request2, signal) {
+    if (this.inner === null) {
+      try {
+        this.inner = buildProvider(request2.model, this.resolver, {
+          sessionId: this.sessionId,
+          models: this.models
+        });
+      } catch (error) {
+        if (error instanceof MissingCredential || error instanceof ExpiredCredential)
+          throw new ProviderError(signInHint(request2.model, this.resolver));
+        throw error;
+      }
+    }
+    yield* this.inner.astream(request2, signal);
+  }
+  async aclose() {
+    await this.inner?.aclose();
+  }
+};
+
+// src/cli.ts
 init_models();
 init_openrouter();
 init_registry();
@@ -71228,7 +71373,7 @@ init_py();
 
 // src/tools/anchors.ts
 init_py();
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 var WIDTHS = [4, 6, 8];
 var SEPARATOR = "\0";
 function split3(content) {
@@ -71243,7 +71388,7 @@ function window2(lines2, index) {
   return [previous, lines2[index], following].join(SEPARATOR);
 }
 function digests(lines2) {
-  return lines2.map((_, i) => createHash8("sha1").update(window2(lines2, i), "utf8").digest("hex"));
+  return lines2.map((_, i) => createHash9("sha1").update(window2(lines2, i), "utf8").digest("hex"));
 }
 function anchorWidth(full) {
   const distinct = new Set(full).size;
@@ -71289,7 +71434,7 @@ var AnchorError = class extends Error {
 init_images();
 init_pathlib();
 init_py();
-import { closeSync as closeSync6, existsSync as existsSync2, openSync as openSync6, readFileSync as readFileSync4, readSync as readSync2, statSync as statSync9 } from "node:fs";
+import { closeSync as closeSync6, existsSync as existsSync2, openSync as openSync6, readFileSync as readFileSync4, readSync as readSync2, statSync as statSync10 } from "node:fs";
 var DESCRIPTION = `Read a file from the local filesystem.
 
 Returns numbered lines, each labelled with a short content anchor:
@@ -71326,7 +71471,7 @@ var ReadTool = class extends Tool {
     if (isImagePath(path) || isBinary(path) && looksLikeImage(path)) return readImage(path);
     if (isBinary(path)) {
       throw new ToolError(
-        `${path}: binary file (${count(statSync9(path).size, "byte")}), not read as text`
+        `${path}: binary file (${count(statSync10(path).size, "byte")}), not read as text`
       );
     }
     const offset = Math.max(toInt(params.offset || 1), 1);
@@ -71417,16 +71562,16 @@ function clip2(line) {
 init_pathlib();
 import { randomBytes as randomBytes4 } from "node:crypto";
 import {
-  chmodSync as chmodSync2,
+  chmodSync as chmodSync3,
   closeSync as closeSync7,
   existsSync as existsSync3,
   lstatSync as lstatSync2,
-  mkdirSync as mkdirSync10,
+  mkdirSync as mkdirSync11,
   openSync as openSync7,
   renameSync as renameSync5,
   rmSync as rmSync3,
-  statSync as statSync10,
-  writeFileSync as writeFileSync7
+  statSync as statSync11,
+  writeFileSync as writeFileSync8
 } from "node:fs";
 var DESCRIPTION2 = `Write a file, overwriting it if it exists.
 
@@ -71472,7 +71617,7 @@ var WriteTool = class extends Tool {
       }
     }
     const existed = existsSync3(path);
-    mkdirSync10(parent(path), { recursive: true });
+    mkdirSync11(parent(path), { recursive: true });
     this.checkpoints?.capture(path);
     writeAtomic(path, content);
     ctx.reads.markRead(path);
@@ -71506,7 +71651,7 @@ function writeAtomic(path, content) {
   }
   let mode2;
   try {
-    mode2 = statSync10(target).mode & 4095;
+    mode2 = statSync11(target).mode & 4095;
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
     mode2 = null;
@@ -71515,11 +71660,11 @@ function writeAtomic(path, content) {
   const fd = openSync7(tmp, "wx", mode2 ?? 438);
   try {
     try {
-      writeFileSync7(fd, content, "utf8");
+      writeFileSync8(fd, content, "utf8");
     } finally {
       closeSync7(fd);
     }
-    if (mode2 !== null) chmodSync2(tmp, mode2);
+    if (mode2 !== null) chmodSync3(tmp, mode2);
     renameSync5(tmp, target);
   } catch (error) {
     rmSync3(tmp, { force: true });
@@ -72415,7 +72560,7 @@ ${gate.contextText}`;
     };
     for (const call of calls) {
       if (this.runsSerially(call)) {
-        for (const pending of concurrent) await run(pending);
+        if (concurrent.length) await gather(concurrent);
         concurrent = [];
         await run(call);
       } else concurrent.push(call);
@@ -72950,7 +73095,7 @@ init_lateinject();
 init_pathlib();
 init_py();
 import { spawnSync as spawnSync3 } from "node:child_process";
-import { statSync as statSync11 } from "node:fs";
+import { statSync as statSync12 } from "node:fs";
 var STATUS_COMMAND = ["git", "status", "--porcelain=v2", "--branch", "-z"];
 var ROOT_COMMAND = ["git", "rev-parse", "--show-toplevel"];
 var TIMEOUT_SECONDS = 2;
@@ -73089,7 +73234,7 @@ var BranchWatcher = class {
     if (head4 === null) return null;
     let stamp;
     try {
-      const info = statSync11(head4, { bigint: true });
+      const info = statSync12(head4, { bigint: true });
       stamp = `${info.mtimeNs}:${info.size}`;
     } catch {
       return this.current;
@@ -73193,7 +73338,7 @@ function statusCode(xy) {
 }
 function signature(path) {
   try {
-    const info = statSync11(path, { bigint: true });
+    const info = statSync12(path, { bigint: true });
     return `${info.mtimeNs}:${info.size}`;
   } catch {
     return "none";
@@ -73383,6 +73528,29 @@ init_py();
 init_shlex();
 var OPERATORS = ["&&", "||", ";;", ";", "|&", "|", "\n", "&"];
 var DYNAMIC_EXECUTABLES = /* @__PURE__ */ new Set(["eval", "exec", "source", ".", "env"]);
+var WRAPPERS = /* @__PURE__ */ new Set([
+  "builtin",
+  "caffeinate",
+  "chrt",
+  "command",
+  "doas",
+  "flock",
+  "gtimeout",
+  "ionice",
+  "nice",
+  "nohup",
+  "setsid",
+  "stdbuf",
+  "strace",
+  "sudo",
+  "taskset",
+  "time",
+  "timeout",
+  "unbuffer",
+  "watch",
+  "xargs"
+]);
+var ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*\+?=/;
 var FD_DUP = /^\d*>&\d*-?$/;
 var OUT_OP = /^(?:\d*>>?|&>>?)$/;
 var IN_OP = /^\d*<<?-?$/;
@@ -73468,7 +73636,17 @@ var READ_ONLY_COMMANDS = /* @__PURE__ */ new Set([
 var MUTATING_FLAGS = {
   sed: /* @__PURE__ */ new Set(["-i", "--in-place"]),
   awk: /* @__PURE__ */ new Set(["-i", "--include"]),
-  find: /* @__PURE__ */ new Set(["-delete", "-exec", "-execdir", "-ok", "-okdir", "-fprint", "-fprintf", "-fls"]),
+  find: /* @__PURE__ */ new Set([
+    "-delete",
+    "-exec",
+    "-execdir",
+    "-ok",
+    "-okdir",
+    "-fprint",
+    "-fprint0",
+    "-fprintf",
+    "-fls"
+  ]),
   fd: /* @__PURE__ */ new Set(["-x", "--exec", "-X", "--exec-batch"]),
   sort: /* @__PURE__ */ new Set(["-o", "--output", "--compress-program"]),
   tree: /* @__PURE__ */ new Set(["-o"]),
@@ -73643,10 +73821,18 @@ function toSegment(text3, inSub) {
   if (tokens.length === 0) return [null, [], true];
   const [words, redirects] = splitRedirections(tokens);
   if (words.length === 0) return [null, redirects, true];
-  const executable = words[0];
+  let first2 = 0;
+  while (first2 < words.length && ASSIGNMENT.test(words[first2])) first2++;
+  const executable = words[first2] ?? "";
   const ok = !executable.includes("$") && !executable.includes("`");
   return [
-    { raw: stripped, executable, args: words.slice(1), inSubstitution: inSub },
+    {
+      raw: stripped,
+      executable,
+      args: words.slice(first2 + 1),
+      assignments: words.slice(0, first2),
+      inSubstitution: inSub
+    },
     redirects,
     ok
   ];
@@ -73726,13 +73912,20 @@ function scan(text3) {
       index++;
       continue;
     }
-    if (text3.startsWith("$(", index) || char === "`") {
+    if (text3.startsWith("$(", index) || text3.startsWith("<(", index) || text3.startsWith(">(", index) || char === "`") {
       const [body, consumed, closed] = readSubstitution(text3, index);
       substitutions.push(...recurse(body, substitutions));
       ok = ok && closed;
       index += consumed;
       continue;
     }
+    if (char === "(" && strip(buffer)) {
+      const [body, consumed] = readSubstitution(text3, index);
+      substitutions.push(...recurse(body, substitutions));
+      ok = false;
+      index += consumed;
+      continue;
+    }
     if (char === "(" || char === ")") {
       index++;
       continue;
@@ -73770,27 +73963,51 @@ function readSubstitution(text3, index) {
     if (end === -1) return [text3.slice(index + 1), text3.length - index, false];
     return [text3.slice(index + 1, end), end - index + 1, true];
   }
+  const open = text3.indexOf("(", index);
   let depth = 0;
-  for (let cursor = index + 1; cursor < text3.length; cursor++) {
+  for (let cursor = open; cursor < text3.length; cursor++) {
     if (text3[cursor] === "(") depth++;
     else if (text3[cursor] === ")") {
       depth--;
-      if (depth === 0) return [text3.slice(index + 2, cursor), cursor - index + 1, true];
+      if (depth === 0) return [text3.slice(open + 1, cursor), cursor - index + 1, true];
     }
   }
-  return [text3.slice(index + 2), text3.length - index, false];
+  return [text3.slice(open + 1), text3.length - index, false];
 }
-function matchSpecifier(segment, pattern) {
+function matchSpecifier(segment, pattern, exact = false) {
   if (pattern === "*" || pattern === ":*") return true;
-  const commandLine = [segment.executable, ...segment.args].join(" ");
+  if (exact) return matchWords(written(segment), pattern);
+  return commandForms(segment).some((words) => matchWords(words, pattern));
+}
+function matchWords(words, pattern) {
+  const commandLine = words.join(" ");
   if (pattern.endsWith(":*")) {
     const prefix = strip(pattern.slice(0, -2));
     return commandLine === prefix || commandLine.startsWith(`${prefix} `);
   }
   if (pattern.includes(" ")) return commandLine === pattern;
-  return segment.executable === pattern;
+  return words[0] === pattern;
+}
+var written = (segment) => [...segment.assignments, segment.executable, ...segment.args].filter(Boolean);
+function commandForms(segment) {
+  const words = [segment.executable, ...segment.args].filter(Boolean);
+  const forms = [];
+  const add2 = (command2) => {
+    forms.push(command2);
+    const name = basename2(command2[0]);
+    if (name !== command2[0]) forms.push([name, ...command2.slice(1)]);
+  };
+  if (words.length === 0) return forms;
+  add2(words);
+  if (WRAPPERS.has(basename2(words[0]))) {
+    for (let index = 1; index < words.length; index++)
+      if (!words[index].startsWith("-")) add2(words.slice(index));
+  }
+  return forms;
 }
+var basename2 = (path) => path.slice(path.lastIndexOf("/") + 1);
 function isReadOnly(segment) {
+  if (segment.assignments.length) return false;
   if (segment.executable === "git") return gitIsReadOnly(segment.args);
   if (!READ_ONLY_COMMANDS.has(segment.executable)) return false;
   if (segment.executable === "env") return !envRunsACommand(segment.args);
@@ -73803,13 +74020,13 @@ function isReadOnly(segment) {
   );
 }
 var PROGRAM_TEXT_COMMANDS = /* @__PURE__ */ new Set(["awk", "sed"]);
-var AWK_WRITES = /system\s*\(|\|\s*["']|["']\s*\||print[f]?[^;}\n]*>/;
+var AWK_WRITES = /system\s*\(|\|\s*["']|["']\s*\||\|\s*getline\b|\|&|print[f]?[^;}\n]*[>|]|@(?:include|load)\b/;
 var PROGRAM_TEXT_OPTIONS = {
   awk: ["-e", "--source"],
   sed: ["-e", "--expression"]
 };
 var PROGRAM_FILE_OPTIONS = {
-  awk: ["-f", "--file", "-E", "--exec"],
+  awk: ["-f", "--file", "-E", "--exec", "-l", "--load"],
   sed: ["-f", "--file"]
 };
 function namesAnOutput(segment) {
@@ -73980,7 +74197,182 @@ function splitGitSubcommand(args) {
   return [null, []];
 }
 
+// src/permissions/sandbox.ts
+init_pathlib();
+init_which();
+import { randomBytes as randomBytes6 } from "node:crypto";
+import { closeSync as closeSync8, existsSync as existsSync4, mkdirSync as mkdirSync12, openSync as openSync8, rmSync as rmSync4, writeFileSync as writeFileSync9 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+var CREDENTIAL_PATHS = [
+  "~/.ssh/",
+  "~/.aws/",
+  "~/.gnupg/",
+  "~/.kube/",
+  "~/.docker/config.json",
+  "~/.config/gh/",
+  "~/.netrc",
+  "~/.npmrc",
+  "~/.pypirc",
+  "~/.hx/auth.json"
+];
+var Sandbox = class {
+  constructor(policy, backend) {
+    this.policy = policy;
+    this.backend = backend ?? detectBackend();
+  }
+  policy;
+  backend;
+  profilePath = null;
+  /** False when degraded to `none`. */
+  get active() {
+    return this.backend !== "none";
+  }
+  /** The argv to actually exec. */
+  wrap(argv) {
+    if (this.backend === "seatbelt")
+      return ["/usr/bin/sandbox-exec", "-f", this.writeProfile(), ...argv];
+    if (this.backend === "bubblewrap") return buildBwrapArgv(this.policy, argv);
+    return [...argv];
+  }
+  /** The generated Seatbelt profile - shown by `/permissions`. */
+  profileText() {
+    return buildSeatbeltProfile(this.policy);
+  }
+  writeProfile() {
+    if (this.profilePath === null || !existsSync4(this.profilePath)) {
+      const path = join(tmpdir2(), `hx-sandbox-${randomBytes6(4).toString("hex")}.sb`);
+      writeFileSync9(path, this.profileText(), { mode: 384 });
+      this.profilePath = path;
+    }
+    return this.profilePath;
+  }
+  cleanup() {
+    if (this.profilePath !== null) {
+      rmSync4(this.profilePath, { force: true });
+      this.profilePath = null;
+    }
+  }
+};
+function detectBackend() {
+  if (process.platform === "darwin" && existsSync4("/usr/bin/sandbox-exec")) return "seatbelt";
+  if (process.platform === "linux" && which("bwrap")) return "bubblewrap";
+  return "none";
+}
+function defaultPolicy(cwd, allowNetwork = false) {
+  const temp = resolve(tmpdir2());
+  const writable = [resolve(cwd), ...tempContainer(temp)];
+  for (const extra of ["~/.cache", "~/Library/Caches"]) {
+    const candidate = expandUser(extra);
+    if (isDir(candidate)) writable.push(resolve(candidate));
+  }
+  return {
+    writablePaths: [...new Set(writable)],
+    readablePaths: ["/"],
+    denyPaths: CREDENTIAL_PATHS.map((p) => ({
+      path: real(absolute(expandUser(p))),
+      isDir: p.endsWith("/")
+    })),
+    allowNetwork,
+    allowSubprocess: true,
+    cwd: resolve(cwd)
+  };
+}
+var DARWIN_TEMP_ROOT = "/private/var/folders";
+var isRelativeTo = (path, root) => path === root || path.startsWith(`${root.replace(/\/$/, "")}/`);
+function tempContainer(temp) {
+  const paths = [temp];
+  if (isRelativeTo(temp, DARWIN_TEMP_ROOT)) {
+    const container = parent(temp);
+    if (isRelativeTo(container, DARWIN_TEMP_ROOT) && container !== DARWIN_TEMP_ROOT)
+      paths.push(container);
+  }
+  return paths;
+}
+function buildSeatbeltProfile(policy) {
+  const lines2 = [
+    "(version 1)",
+    "(deny default)",
+    "",
+    ";; Process management",
+    "(allow process-fork)",
+    "(allow signal (target same-sandbox))",
+    "(allow sysctl-read)",
+    "(allow mach-lookup)",
+    "(allow ipc-posix-shm)",
+    policy.allowSubprocess ? "(allow process-exec*)" : "(deny process-exec*)",
+    "",
+    ";; Reads"
+  ];
+  for (const path of policy.readablePaths.length ? policy.readablePaths : ["/"]) {
+    lines2.push(`(allow file-read* (subpath ${sbplString(real(path))}))`);
+  }
+  lines2.push("", ";; Writes");
+  for (const path of policy.writablePaths)
+    lines2.push(`(allow file-write* (subpath ${sbplString(real(path))}))`);
+  for (const device of ["/dev/null", "/dev/stdout", "/dev/stderr", "/dev/tty", "/dev/urandom"]) {
+    lines2.push(`(allow file-write-data file-read-data (literal ${sbplString(device)}))`);
+  }
+  lines2.push("", ";; Network", policy.allowNetwork ? "(allow network*)" : "(deny network*)");
+  if (policy.denyPaths.length) {
+    lines2.push("", ";; Credentials - last match wins, so these override both allowances");
+    for (const denied of policy.denyPaths) {
+      lines2.push(`(deny file-read* file-write* (subpath ${sbplString(real(denied.path))}))`);
+    }
+  }
+  return `${lines2.join("\n")}
+`;
+}
+function credentialPathOf(path) {
+  for (const entry of CREDENTIAL_PATHS) {
+    const denied = real(absolute(expandUser(entry)));
+    if (path === denied || entry.endsWith("/") && isRelativeTo(path, denied)) return entry;
+  }
+  return null;
+}
+var real = (path) => resolve(path);
+function sbplString(path) {
+  return `"${path.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+function buildBwrapArgv(policy, argv) {
+  const command2 = [
+    "bwrap",
+    "--ro-bind",
+    "/",
+    "/",
+    "--dev",
+    "/dev",
+    "--proc",
+    "/proc",
+    "--die-with-parent"
+  ];
+  const writable = policy.writablePaths.map(real);
+  for (const path of writable) command2.push("--bind", path, path);
+  for (const denied of policy.denyPaths) {
+    const path = real(denied.path);
+    if (!existsSync4(path) && !ensureMountpoint(denied, writable)) continue;
+    if (isDir(path)) command2.push("--tmpfs", path, "--remount-ro", path);
+    else command2.push("--ro-bind", "/dev/null", path);
+  }
+  if (!policy.allowNetwork) command2.push("--unshare-net");
+  if (policy.cwd !== null) command2.push("--chdir", real(policy.cwd));
+  return [...command2, "--", ...argv];
+}
+function ensureMountpoint(denied, writable) {
+  const path = real(denied.path);
+  if (!writable.some((root) => isRelativeTo(path, root))) return false;
+  try {
+    mkdirSync12(parent(path), { recursive: true });
+    if (denied.isDir) mkdirSync12(path, { mode: 448, recursive: true });
+    else closeSync8(openSync8(path, "a", 384));
+  } catch {
+    return false;
+  }
+  return existsSync4(path);
+}
+
 // src/permissions/engine.ts
+var FILE_TOOLS = /* @__PURE__ */ new Set(["Read", "Write", "Edit", "Grep", "Glob", "Symbols"]);
+var PROTECTED_DIRS = /* @__PURE__ */ new Set([".git", ".hx"]);
 var DEFAULT_MUTATING_TOOLS = /* @__PURE__ */ new Set(["Bash", "Write", "Edit", "Task"]);
 function allSpecifiers(request2) {
   if (request2.specifiers?.length) return request2.specifiers;
@@ -74018,6 +74410,12 @@ var PermissionEngine = class _PermissionEngine {
     if (denial) return outcome("deny", "matched a deny rule", denial);
     if (this.sessionGrants.has(this.grantKey(request2)))
       return outcome("allow", "granted for this session");
+    const credential = this.credentialTouched(request2);
+    if (credential !== null) {
+      const named = this.matchAllow(request2, true);
+      if (named) return outcome("allow", "matched an allow rule", named);
+      return outcome("ask", `${credential} holds credentials`);
+    }
     if (request2.toolName === "Bash" && request2.specifier) {
       const parsed = parse4(request2.specifier);
       if (parsed.unparseable) {
@@ -74039,7 +74437,7 @@ var PermissionEngine = class _PermissionEngine {
       return outcome("allow", "read-only tool in plan mode");
     }
     if (!request2.mutating) return outcome("allow", "read-only tool");
-    if (this.mode === "acceptEdits" && _PermissionEngine.EDIT_TOOLS.has(request2.toolName)) {
+    if (this.mode === "acceptEdits" && _PermissionEngine.EDIT_TOOLS.has(request2.toolName) && this.editsProject(request2)) {
       return outcome("allow", "acceptEdits mode");
     }
     if (request2.toolName === "Bash" && request2.specifier) {
@@ -74051,6 +74449,33 @@ var PermissionEngine = class _PermissionEngine {
     }
     return outcome("ask", "mutating tool");
   }
+  /** Where `specifier` really is: absolute, with `..` and symlinks resolved. */
+  target(specifier) {
+    return realPath(purePath(expandUser(specifier)), resolve(this.cwd));
+  }
+  /** The credential file or folder a file tool's call reaches, as written in
+   * `CREDENTIAL_PATHS`, or `null`. */
+  credentialTouched(request2) {
+    if (!FILE_TOOLS.has(request2.toolName)) return null;
+    for (const specifier of allSpecifiers(request2)) {
+      const credential = credentialPathOf(this.target(specifier));
+      if (credential !== null) return credential;
+    }
+    return null;
+  }
+  /**
+   * Whether every file an edit changes is the project's own, which is all
+   * acceptEdits covers: inside the working directory once symlinks are
+   * resolved, and not in a folder whose files run code or grant permissions.
+   */
+  editsProject(request2) {
+    const root = resolve(this.cwd);
+    const prefix = root === "/" ? "/" : `${root}/`;
+    const targets = allSpecifiers(request2).map((specifier) => this.target(specifier));
+    return targets.length > 0 && targets.every(
+      (target) => target.startsWith(prefix) && !target.slice(prefix.length).split("/").some((part) => PROTECTED_DIRS.has(part))
+    );
+  }
   applies(rule2, request2) {
     return rule2.tool === request2.toolName || rule2.tool === "*";
   }
@@ -74062,13 +74487,14 @@ var PermissionEngine = class _PermissionEngine {
     return null;
   }
   /**
-   * Allow requires *every* segment to be covered. Any-segment matching is
-   * right for deny (`safe && danger` must be caught) but catastrophic for
-   * allow: `allow: Bash(git status:*)` would green-light `git status && rm -rf /`.
+   * Allow requires *every* segment to be covered, each as it is written.
+   * Any-segment matching is right for deny (`safe && danger` must be caught)
+   * but catastrophic for allow: `allow: Bash(git status:*)` would green-light
+   * `git status && rm -rf /`.
    */
-  matchAllow(request2) {
+  matchAllow(request2, named = false) {
     const candidates2 = this.rules.filter(
-      (rule2) => rule2.decision === "allow" && this.applies(rule2, request2)
+      (rule2) => rule2.decision === "allow" && this.applies(rule2, request2) && (!named || rule2.specifier !== null)
     );
     if (candidates2.length === 0) return null;
     if (request2.toolName !== "Bash" || !request2.specifier) {
@@ -74086,7 +74512,7 @@ var PermissionEngine = class _PermissionEngine {
     let first2 = null;
     for (const segment of parsed.segments) {
       const covering = candidates2.find(
-        (rule2) => rule2.specifier === null || matchSpecifier(segment, rule2.specifier)
+        (rule2) => rule2.specifier === null || matchSpecifier(segment, rule2.specifier, true)
       );
       if (covering === void 0) return null;
       first2 ??= covering;
@@ -74193,6 +74619,7 @@ function persistableRules(toolName, specifier) {
   return rules;
 }
 function rulePrefix(segment) {
+  if (segment.assignments.length || !segment.executable) return null;
   const first2 = segment.args[0];
   if (first2 !== void 0 && !first2.startsWith("-")) return `${segment.executable} ${first2}`;
   return null;
@@ -74361,172 +74788,6 @@ var InvalidRule = class extends Error {
   name = "InvalidRule";
 };
 
-// src/permissions/sandbox.ts
-init_pathlib();
-init_which();
-import { randomBytes as randomBytes6 } from "node:crypto";
-import { closeSync as closeSync8, existsSync as existsSync4, mkdirSync as mkdirSync11, openSync as openSync8, rmSync as rmSync4, writeFileSync as writeFileSync8 } from "node:fs";
-import { tmpdir as tmpdir2 } from "node:os";
-var CREDENTIAL_PATHS = [
-  "~/.ssh/",
-  "~/.aws/",
-  "~/.gnupg/",
-  "~/.kube/",
-  "~/.docker/config.json",
-  "~/.config/gh/",
-  "~/.netrc",
-  "~/.npmrc",
-  "~/.pypirc",
-  "~/.hx/auth.json"
-];
-var Sandbox = class {
-  constructor(policy, backend) {
-    this.policy = policy;
-    this.backend = backend ?? detectBackend();
-  }
-  policy;
-  backend;
-  profilePath = null;
-  /** False when degraded to `none`. */
-  get active() {
-    return this.backend !== "none";
-  }
-  /** The argv to actually exec. */
-  wrap(argv) {
-    if (this.backend === "seatbelt")
-      return ["/usr/bin/sandbox-exec", "-f", this.writeProfile(), ...argv];
-    if (this.backend === "bubblewrap") return buildBwrapArgv(this.policy, argv);
-    return [...argv];
-  }
-  /** The generated Seatbelt profile - shown by `/permissions`. */
-  profileText() {
-    return buildSeatbeltProfile(this.policy);
-  }
-  writeProfile() {
-    if (this.profilePath === null || !existsSync4(this.profilePath)) {
-      const path = join(tmpdir2(), `hx-sandbox-${randomBytes6(4).toString("hex")}.sb`);
-      writeFileSync8(path, this.profileText(), { mode: 384 });
-      this.profilePath = path;
-    }
-    return this.profilePath;
-  }
-  cleanup() {
-    if (this.profilePath !== null) {
-      rmSync4(this.profilePath, { force: true });
-      this.profilePath = null;
-    }
-  }
-};
-function detectBackend() {
-  if (process.platform === "darwin" && existsSync4("/usr/bin/sandbox-exec")) return "seatbelt";
-  if (process.platform === "linux" && which("bwrap")) return "bubblewrap";
-  return "none";
-}
-function defaultPolicy(cwd, allowNetwork = false) {
-  const temp = resolve(tmpdir2());
-  const writable = [resolve(cwd), ...tempContainer(temp)];
-  for (const extra of ["~/.cache", "~/Library/Caches"]) {
-    const candidate = expandUser(extra);
-    if (isDir(candidate)) writable.push(resolve(candidate));
-  }
-  return {
-    writablePaths: [...new Set(writable)],
-    readablePaths: ["/"],
-    denyPaths: CREDENTIAL_PATHS.map((p) => ({
-      path: real(absolute(expandUser(p))),
-      isDir: p.endsWith("/")
-    })),
-    allowNetwork,
-    allowSubprocess: true,
-    cwd: resolve(cwd)
-  };
-}
-var DARWIN_TEMP_ROOT = "/private/var/folders";
-var isRelativeTo = (path, root) => path === root || path.startsWith(`${root.replace(/\/$/, "")}/`);
-function tempContainer(temp) {
-  const paths = [temp];
-  if (isRelativeTo(temp, DARWIN_TEMP_ROOT)) {
-    const container = parent(temp);
-    if (isRelativeTo(container, DARWIN_TEMP_ROOT) && container !== DARWIN_TEMP_ROOT)
-      paths.push(container);
-  }
-  return paths;
-}
-function buildSeatbeltProfile(policy) {
-  const lines2 = [
-    "(version 1)",
-    "(deny default)",
-    "",
-    ";; Process management",
-    "(allow process-fork)",
-    "(allow signal (target same-sandbox))",
-    "(allow sysctl-read)",
-    "(allow mach-lookup)",
-    "(allow ipc-posix-shm)",
-    policy.allowSubprocess ? "(allow process-exec*)" : "(deny process-exec*)",
-    "",
-    ";; Reads"
-  ];
-  for (const path of policy.readablePaths.length ? policy.readablePaths : ["/"]) {
-    lines2.push(`(allow file-read* (subpath ${sbplString(real(path))}))`);
-  }
-  lines2.push("", ";; Writes");
-  for (const path of policy.writablePaths)
-    lines2.push(`(allow file-write* (subpath ${sbplString(real(path))}))`);
-  for (const device of ["/dev/null", "/dev/stdout", "/dev/stderr", "/dev/tty", "/dev/urandom"]) {
-    lines2.push(`(allow file-write-data file-read-data (literal ${sbplString(device)}))`);
-  }
-  lines2.push("", ";; Network", policy.allowNetwork ? "(allow network*)" : "(deny network*)");
-  if (policy.denyPaths.length) {
-    lines2.push("", ";; Credentials - last match wins, so these override both allowances");
-    for (const denied of policy.denyPaths) {
-      lines2.push(`(deny file-read* file-write* (subpath ${sbplString(real(denied.path))}))`);
-    }
-  }
-  return `${lines2.join("\n")}
-`;
-}
-var real = (path) => resolve(path);
-function sbplString(path) {
-  return `"${path.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
-}
-function buildBwrapArgv(policy, argv) {
-  const command2 = [
-    "bwrap",
-    "--ro-bind",
-    "/",
-    "/",
-    "--dev",
-    "/dev",
-    "--proc",
-    "/proc",
-    "--die-with-parent"
-  ];
-  const writable = policy.writablePaths.map(real);
-  for (const path of writable) command2.push("--bind", path, path);
-  for (const denied of policy.denyPaths) {
-    const path = real(denied.path);
-    if (!existsSync4(path) && !ensureMountpoint(denied, writable)) continue;
-    if (isDir(path)) command2.push("--tmpfs", path, "--remount-ro", path);
-    else command2.push("--ro-bind", "/dev/null", path);
-  }
-  if (!policy.allowNetwork) command2.push("--unshare-net");
-  if (policy.cwd !== null) command2.push("--chdir", real(policy.cwd));
-  return [...command2, "--", ...argv];
-}
-function ensureMountpoint(denied, writable) {
-  const path = real(denied.path);
-  if (!writable.some((root) => isRelativeTo(path, root))) return false;
-  try {
-    mkdirSync11(parent(path), { recursive: true });
-    if (denied.isDir) mkdirSync11(path, { mode: 448, recursive: true });
-    else closeSync8(openSync8(path, "a", 384));
-  } catch {
-    return false;
-  }
-  return existsSync4(path);
-}
-
 // src/runtime.ts
 init_models();
 init_registry();
@@ -74668,7 +74929,7 @@ init_py();
 init_shlex();
 import { execFile as execFile2, spawn as spawn7 } from "node:child_process";
 import { randomBytes as randomBytes7 } from "node:crypto";
-import { closeSync as closeSync9, mkdirSync as mkdirSync12, openSync as openSync9, readFileSync as readFileSync6 } from "node:fs";
+import { closeSync as closeSync9, mkdirSync as mkdirSync13, openSync as openSync9, readFileSync as readFileSync6 } from "node:fs";
 import { constants as constants3 } from "node:os";
 var DESCRIPTION5 = `Run a shell command in a persistent session.
 
@@ -74742,11 +75003,17 @@ var Reader = class {
     return this.chunks.shift() ?? Buffer.alloc(0);
   }
 };
+var POSIX_SHELLS = /* @__PURE__ */ new Set(["sh", "bash", "zsh", "dash", "ksh", "ksh93", "mksh", "ash", "yash"]);
+function posixShell(shell = null) {
+  const chosen = shell || process.env.SHELL || "";
+  if (POSIX_SHELLS.has(chosen.slice(chosen.lastIndexOf("/") + 1))) return chosen;
+  return isFile("/bin/bash") ? "/bin/bash" : "/bin/sh";
+}
 var PersistentShell = class {
   constructor(currentCwd, shell = null, env = {}, sandbox = null) {
     this.currentCwd = currentCwd;
     this.sandbox = sandbox;
-    this.shell = shell || process.env.SHELL || "/bin/bash";
+    this.shell = posixShell(shell);
     this.env = commandEnvironment({ ...env, HX: "1", TERM: "dumb" });
   }
   currentCwd;
@@ -74949,7 +75216,7 @@ var BackgroundJobs = class {
    */
   async start(command2, cwd, env, sandbox = null) {
     const jobId = `bg_${randomBytes7(4).toString("hex")}`;
-    mkdirSync12(this.logDir, { recursive: true });
+    mkdirSync13(this.logDir, { recursive: true });
     const logPath = join(this.logDir, `${jobId}.log`);
     let argv = ["/bin/sh", "-c", command2];
     if (sandbox !== null) argv = sandbox.wrap(argv);
@@ -75228,7 +75495,7 @@ init_json();
 init_py();
 
 // src/tools/glob.ts
-import { statSync as statSync12 } from "node:fs";
+import { statSync as statSync13 } from "node:fs";
 init_pathlib();
 init_py();
 var DESCRIPTION6 = `Find files by glob pattern (e.g. \`**/*.py\`, \`src/**/*.ts\`).
@@ -75259,6 +75526,10 @@ var GlobTool = class extends Tool {
       required: ["pattern"]
     };
   }
+  /** The folder searched, so a path rule covers a search of it. */
+  permissionSpecifier(params) {
+    return typeof params.path === "string" && params.path ? params.path : null;
+  }
   async run(params, ctx) {
     const root = searchRoot(params.path, ctx.cwd);
     if (!isDir(root)) throw new ToolError(`${root}: not a directory`);
@@ -75301,7 +75572,7 @@ function checkPattern(pattern) {
 var ignored = (path) => parts(path).some((part) => IGNORED_DIRS.has(part));
 function mtime(path) {
   try {
-    return statSync12(path).mtimeMs;
+    return statSync13(path).mtimeMs;
   } catch {
     return 0;
   }
@@ -75343,6 +75614,10 @@ var GrepTool = class extends Tool {
       required: ["pattern"]
     };
   }
+  /** The file or folder searched, so a path rule covers a search of it. */
+  permissionSpecifier(params) {
+    return typeof params.path === "string" && params.path ? params.path : null;
+  }
   async run(params, ctx) {
     const pattern = String(params.pattern);
     const ripgrep = which("rg");
@@ -75397,7 +75672,28 @@ function runRipgrep(rg, pattern, root, mode2, params) {
     }
     throw new ToolError(stderr || `ripgrep exited ${result2.status}`);
   }
-  return splitLines(result2.stdout ?? "").filter(Boolean);
+  const hidden = credentialsUnder(root);
+  return splitLines(result2.stdout ?? "").filter(
+    (line) => line && !hidden.some((credential) => credential.covers(line))
+  );
+}
+function credentialsUnder(root) {
+  const base = root.replace(/\/$/, "");
+  const real2 = resolve(root);
+  const found = [];
+  for (const entry of CREDENTIAL_PATHS) {
+    const spellings = /* @__PURE__ */ new Set([purePath(absolute(expandUser(entry))), resolve(expandUser(entry))]);
+    for (const path of spellings) {
+      let shown;
+      if (path.startsWith(`${real2}/`)) shown = base + path.slice(real2.length);
+      else if (path.startsWith(`${base}/`)) shown = path;
+      else continue;
+      found.push({
+        covers: entry.endsWith("/") ? (line) => line.startsWith(`${shown}/`) : (line) => line === shown || line.startsWith(`${shown}:`) || line.startsWith(`${shown}-`)
+      });
+    }
+  }
+  return found;
 }
 function search(regex, root, mode2, params) {
   const globFilter = String(params.glob || "");
@@ -75424,7 +75720,7 @@ function search(regex, root, mode2, params) {
 function walk(root) {
   if (isFile(root)) return [root];
   return glob(root, "**/*").filter(
-    (path) => isFile(path) && !parts(path).some((part) => IGNORED_DIRS.has(part))
+    (path) => isFile(path) && !parts(path).some((part) => IGNORED_DIRS.has(part)) && credentialPathOf(resolve(path)) === null
   );
 }
 function renderContext(path, lines2, hits, before2, after2) {
@@ -75437,7 +75733,7 @@ function renderContext(path, lines2, hits, before2, after2) {
 }
 
 // src/tools/symbols.ts
-import { readFileSync as readFileSync8, statSync as statSync13 } from "node:fs";
+import { readFileSync as readFileSync8, statSync as statSync14 } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname } from "node:path";
 init_json();
@@ -75511,11 +75807,11 @@ var LANGUAGES = {
   ".go": GO,
   ".rs": RUST
 };
-var PACKAGE2 = "@vscode/tree-sitter-wasm";
+var PACKAGE = "@vscode/tree-sitter-wasm";
 var load = createRequire(import.meta.url);
 function packageDir() {
   try {
-    return dirname(load.resolve(PACKAGE2));
+    return dirname(load.resolve(PACKAGE));
   } catch {
     return null;
   }
@@ -75529,9 +75825,9 @@ function parserFor(grammar) {
     parser = (async () => {
       const directory = packageDir();
       if (directory === null)
-        throw new ToolError(`tree-sitter is not installed: npm install -g ${PACKAGE2}`);
+        throw new ToolError(`tree-sitter is not installed: npm install -g ${PACKAGE}`);
       runtime ??= (async () => {
-        const module = load(PACKAGE2);
+        const module = load(PACKAGE);
         await module.Parser.init({ locateFile: (file) => join(directory, file) });
         return module;
       })();
@@ -75569,6 +75865,12 @@ var SymbolsTool = class extends Tool {
       required: ["mode"]
     };
   }
+  /** The file or folder read, so a path rule covers it. */
+  permissionSpecifier(params) {
+    for (const key2 of ["file_path", "path"])
+      if (typeof params[key2] === "string" && params[key2]) return params[key2];
+    return null;
+  }
   async run(params, ctx) {
     const mode2 = String(params.mode);
     const limit = toInt(params.limit || DEFAULT_LIMIT3);
@@ -75677,7 +75979,7 @@ function candidates(params, ctx) {
 }
 function mtime2(path) {
   try {
-    return statSync13(path).mtimeMs;
+    return statSync14(path).mtimeMs;
   } catch {
     return 0;
   }
@@ -75706,7 +76008,7 @@ function specFor(path) {
 async function parse5(path, spec2) {
   let size3;
   try {
-    size3 = statSync13(path).size;
+    size3 = statSync14(path).size;
   } catch (error) {
     throw new ToolError(`${path}: ${osErrorText(error)}`);
   }
@@ -76413,7 +76715,7 @@ ${listed2}
   They still apply to this project on this machine. Earlier versions of HX wrote them into the checkout; it no longer writes there at all.`
   ];
 }
-function buildRuntime(parsed, resume = null) {
+function buildRuntime(parsed, resume = null, signedOut = false) {
   ensureUserDirs();
   const settings = loadSettings(parsed.cwd, parsed.overrides);
   const bus = new EventBus();
@@ -76424,10 +76726,16 @@ function buildRuntime(parsed, resume = null) {
   models.loadCache();
   const modelInfo2 = models.getOrDefault(settings.models.model);
   const session = resume ? loadSession(resume) : newSession(settings.cwd, settings.models.model);
-  const provider = buildProvider(settings.models.model, auth, {
-    sessionId: session.meta.sessionId,
-    models
-  });
+  let provider;
+  try {
+    provider = buildProvider(settings.models.model, auth, {
+      sessionId: session.meta.sessionId,
+      models
+    });
+  } catch (error) {
+    if (!(signedOut && error instanceof MissingCredential)) throw error;
+    provider = new DeferredProvider(settings.models.model, auth, session.meta.sessionId, models);
+  }
   const sandbox = settings.permissions.sandbox ? new Sandbox(defaultPolicy(settings.cwd, settings.permissions.allowNetwork)) : null;
   const shell = new PersistentShell(settings.cwd, settings.bash.shell, {}, sandbox);
   const jobs = new BackgroundJobs(join(sessionOutputsDir(session.meta.sessionId), "jobs"));
@@ -76460,6 +76768,13 @@ function buildRuntime(parsed, resume = null) {
       `Ignored ${hooks.ignored.length} hook(s) declared in the project's shared settings - hooks run shell commands, so they are only loaded from your own settings. See /hooks.`
     );
   }
+  if (settings.bash.shell && posixShell(settings.bash.shell) !== settings.bash.shell)
+    notices.push(
+      `bash.shell is ${settings.bash.shell}, which does not speak POSIX sh; commands run in ${shell.shell}.`
+    );
+  const [mcpServers, waitingServers] = partition(loadConfigs(settings.cwd), settings.cwd);
+  const waiting = waitingServers.filter((server) => server.config.enabled);
+  for (const server of waiting) notices.push(waitingNotice(server));
   const agents = new Map(discover2(settings.cwd).map((agent) => [agent.name, agent]));
   const subagents = new SubagentRunner({
     definitions: agents,
@@ -76520,7 +76835,7 @@ function buildRuntime(parsed, resume = null) {
     tools,
     checkpoints,
     hooks,
-    new MCPManager(loadConfigs(settings.cwd)),
+    new MCPManager(mcpServers, void 0, waiting),
     notices
   );
 }
@@ -76540,7 +76855,7 @@ ${listed2}`,
 
 // src/trace.ts
 import { spawn as spawn8 } from "node:child_process";
-import { mkdirSync as mkdirSync13, writeFileSync as writeFileSync9 } from "node:fs";
+import { mkdirSync as mkdirSync14, writeFileSync as writeFileSync10 } from "node:fs";
 import { pathToFileURL } from "node:url";
 init_messages();
 init_json();
@@ -76584,8 +76899,8 @@ function renderHtml(trace) {
   return trace_template_default.replace(/__HX_TRACE_(?:TITLE|DATA)__/g, (match4) => filled[match4]);
 }
 function writeTrace(trace, path) {
-  mkdirSync13(parent(path), { recursive: true });
-  writeFileSync9(path, renderHtml(trace), "utf8");
+  mkdirSync14(parent(path), { recursive: true });
+  writeFileSync10(path, renderHtml(trace), "utf8");
   return path;
 }
 var defaultTracePath = (session) => join(sessionDir(session.meta.sessionId), TRACE_FILENAME);
@@ -77883,8 +78198,8 @@ var ProcessTerminal = class {
     let buffer = Buffer.from(data);
     while (buffer.length) {
       try {
-        const written = writeSync5(1, buffer);
-        buffer = buffer.subarray(written);
+        const written2 = writeSync5(1, buffer);
+        buffer = buffer.subarray(written2);
       } catch (error) {
         if (error.code === "EAGAIN") continue;
         return;
@@ -78292,13 +78607,302 @@ var ShiftEnter = class {
   }
 };
 
+// src/term/component.ts
+var Widget = class {
+  cache = [];
+  cacheWidth = -1;
+  isDirty = true;
+  render(width) {
+    if (this.isDirty || width !== this.cacheWidth) {
+      this.cache = this.draw(width);
+      this.cacheWidth = width;
+      this.isDirty = false;
+    }
+    return this.cache;
+  }
+  invalidate() {
+    this.isDirty = true;
+  }
+  get dirty() {
+    return this.isDirty;
+  }
+};
+var Container = class extends Widget {
+  children;
+  constructor(...children) {
+    super();
+    this.children = children;
+  }
+  add(child) {
+    this.children.push(child);
+    this.invalidate();
+    return child;
+  }
+  extend(children) {
+    this.children.push(...children);
+    this.invalidate();
+  }
+  clear() {
+    this.children = [];
+    this.invalidate();
+  }
+  remove(child) {
+    const index = this.children.indexOf(child);
+    if (index >= 0) {
+      this.children.splice(index, 1);
+      this.invalidate();
+    }
+  }
+  /** Concatenate the children, asking each: a clean child returns its cache,
+   * so a frame costs what actually changed. */
+  render(width) {
+    const lines2 = [];
+    for (const child of this.children) lines2.push(...child.render(width));
+    this.isDirty = false;
+    return lines2;
+  }
+  draw(width) {
+    return this.render(width);
+  }
+  /** Offer the key to each child until one takes it. */
+  handleInput(key2, data) {
+    for (const child of this.children) {
+      const handler = child.handleInput;
+      if (handler?.call(child, key2, data)) return true;
+    }
+    return false;
+  }
+};
+
+// src/term/primitives.ts
+var Text = class extends Widget {
+  constructor(content = "", paddingX = 1, paddingY = 0, tint2 = null) {
+    super();
+    this.content = content;
+    this.paddingX = paddingX;
+    this.paddingY = paddingY;
+    this.tint = tint2;
+  }
+  content;
+  paddingX;
+  paddingY;
+  tint;
+  get text() {
+    return this.content;
+  }
+  setText(text3) {
+    if (text3 !== this.content) {
+      this.content = text3;
+      this.invalidate();
+    }
+  }
+  draw(width) {
+    const inner = Math.max(1, width - 2 * this.paddingX);
+    const pad = " ".repeat(this.paddingX);
+    const body = wrap2(this.content, inner).map((line) => `${pad}${line}`);
+    const blank = Array(this.paddingY).fill("");
+    return [...blank, ...body, ...blank].map(
+      (line) => this.tint === null ? fillLine(line, width) : terminate(this.tint(padTo(line, width)))
+    );
+  }
+};
+var COLUMN = /^(\s*\S.*?[^\s.!?]\s{2,})\S/;
+function wrapAligned(paragraph2, width) {
+  const lines2 = wrap2(paragraph2, width);
+  if (lines2.length < 2) return lines2;
+  const plain2 = stripAnsi(paragraph2);
+  const column = COLUMN.exec(plain2);
+  const lead = column ? cellWidth(column[1]) : plain2.length - plain2.replace(/^ +/, "").length;
+  if (!(lead > 0 && lead <= Math.floor(width / 2))) return lines2;
+  const [head4, body] = splitAtCell(paragraph2, lead);
+  const rest = wrap2(body, width - lead);
+  return [head4 + rest[0], ...rest.slice(1).map((line) => " ".repeat(lead) + line)];
+}
+function splitAtCell(text3, cells) {
+  const tokens = tokenize(text3);
+  let seen = 0;
+  for (const [index, [isEscape, chunk]] of tokens.entries()) {
+    if (isEscape) continue;
+    if (seen >= cells) {
+      const head4 = tokens.slice(0, index);
+      const style = head4.filter(([isEscape2]) => isEscape2).map(([, c]) => c).join("");
+      return [
+        head4.map(([, c]) => c).join(""),
+        style + tokens.slice(index).map(([, c]) => c).join("")
+      ];
+    }
+    seen += cellWidth(chunk);
+  }
+  return [text3, ""];
+}
+var HangingText = class extends Widget {
+  constructor(prefix, body, paddingX = 1, tint2 = null) {
+    super();
+    this.prefix = prefix;
+    this.body = body;
+    this.paddingX = paddingX;
+    this.tint = tint2;
+    this.prefixWidth = cellWidth(prefix);
+  }
+  prefix;
+  body;
+  paddingX;
+  tint;
+  prefixWidth;
+  setBody(body) {
+    if (body !== this.body) {
+      this.body = body;
+      this.invalidate();
+    }
+  }
+  draw(width) {
+    const pad = " ".repeat(this.paddingX);
+    const inner = Math.max(1, width - 2 * this.paddingX - this.prefixWidth);
+    const hang = " ".repeat(this.prefixWidth);
+    const out = [];
+    for (const paragraph2 of this.body.split("\n")) {
+      wrapAligned(paragraph2, inner).forEach((line, index) => {
+        out.push(`${pad}${out.length === 0 && index === 0 ? this.prefix : hang}${line}`);
+      });
+    }
+    return out.map(
+      (line) => this.tint === null ? fillLine(line, width) : terminate(this.tint(padTo(line, width)))
+    );
+  }
+};
+var Box = class extends Widget {
+  constructor(paddingX = 1, paddingY = 1, tint2 = null, ...children) {
+    super();
+    this.paddingX = paddingX;
+    this.paddingY = paddingY;
+    this.tint = tint2;
+    this.children = children;
+  }
+  paddingX;
+  paddingY;
+  tint;
+  children;
+  add(child) {
+    this.children.push(child);
+    this.invalidate();
+    return child;
+  }
+  clear() {
+    this.children = [];
+    this.invalidate();
+  }
+  render(width) {
+    const inner = Math.max(1, width - 2 * this.paddingX);
+    const pad = " ".repeat(this.paddingX);
+    const body = this.children.flatMap(
+      (child) => child.render(inner).map((line) => `${pad}${stripTerminator(line)}`)
+    );
+    const blank = Array(this.paddingY).fill("");
+    return [...blank, ...body, ...blank].map(
+      (line) => this.tint === null ? fillLine(line, width) : terminate(this.tint(padTo(line, width)))
+    );
+  }
+  draw(width) {
+    return this.render(width);
+  }
+};
+var Spacer = class extends Widget {
+  constructor(lines2 = 1) {
+    super();
+    this.lines = lines2;
+  }
+  lines;
+  draw() {
+    return Array(this.lines).fill("");
+  }
+};
+var Rule = class extends Widget {
+  constructor(color2 = null, char = "\u2500") {
+    super();
+    this.color = color2;
+    this.char = char;
+  }
+  color;
+  char;
+  /** What the rule is painted with. */
+  get paint() {
+    return this.color;
+  }
+  setColor(color2) {
+    this.color = color2;
+    this.invalidate();
+  }
+  draw(width) {
+    const line = this.char.repeat(Math.max(1, width));
+    return [terminate(this.color ? this.color(line) : line)];
+  }
+};
+var LabelledRule = class extends Rule {
+  constructor(color2 = null, label = "", align = "left", char = "\u2500") {
+    super(color2, char);
+    this.label = label;
+    this.align = align;
+  }
+  label;
+  align;
+  setLabel(label) {
+    if (label !== this.label) {
+      this.label = label;
+      this.invalidate();
+    }
+  }
+  draw(width) {
+    const w = Math.max(1, width);
+    if (!this.label) return super.draw(w);
+    const label = ` ${this.label} `;
+    const labelWidth = cellWidth(label);
+    if (labelWidth + 4 > w) return super.draw(w);
+    const left = this.align === "center" ? Math.floor((w - labelWidth) / 2) : 2;
+    const right = w - labelWidth - left;
+    const paint = this.color ?? ((text3) => text3);
+    return [terminate(paint(this.char.repeat(left)) + label + paint(this.char.repeat(right)))];
+  }
+};
+var Lines = class extends Widget {
+  constructor(lines2, paddingX = 1, tint2 = null) {
+    super();
+    this.lines = lines2;
+    this.paddingX = paddingX;
+    this.tint = tint2;
+  }
+  lines;
+  paddingX;
+  tint;
+  setLines(lines2) {
+    this.lines = lines2;
+    this.invalidate();
+  }
+  draw(width) {
+    const pad = " ".repeat(this.paddingX);
+    const inner = Math.max(1, width - 2 * this.paddingX);
+    return this.lines.map((line) => `${pad}${truncateToWidth(stripTerminator(line), inner)}`).map(
+      (line) => this.tint === null ? fillLine(line, width) : terminate(this.tint(padTo(line, width)))
+    );
+  }
+};
+var stripTerminator = (line) => line.endsWith(SEGMENT_RESET) ? line.slice(0, -SEGMENT_RESET.length) : line;
+function padTo(line, width) {
+  let fitted = line;
+  let used2 = cellWidth(fitted);
+  if (used2 > width) {
+    fitted = truncateToWidth(fitted, width);
+    used2 = cellWidth(fitted);
+  }
+  return fitted + " ".repeat(Math.max(0, width - used2));
+}
+
 // src/tui/clipboard.ts
 init_images();
 init_pathlib();
 init_py();
 import { spawn as spawn9 } from "node:child_process";
 import { randomBytes as randomBytes8 } from "node:crypto";
-import { readFileSync as readFileSync9, rmSync as rmSync5, statSync as statSync14, writeFileSync as writeFileSync10 } from "node:fs";
+import { readFileSync as readFileSync9, rmSync as rmSync5, statSync as statSync15, writeFileSync as writeFileSync11 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 var MAX_OSC52_ENCODED = 1e5;
 var TIMEOUT_MS = 5e3;
@@ -78403,7 +79007,7 @@ async function readImage2(platform = process.platform, env = process.env) {
 }
 async function withScratch(fn) {
   const target = join(tmpdir3(), `hx-clipboard-${randomBytes8(4).toString("hex")}.img`);
-  writeFileSync10(target, "");
+  writeFileSync11(target, "");
   try {
     return await fn(target);
   } finally {
@@ -78465,7 +79069,7 @@ async function readLinux(env) {
 function copiedFile(path) {
   if (!isImagePath(path)) return null;
   try {
-    if (statSync14(path).size > MAX_SOURCE_BYTES)
+    if (statSync15(path).size > MAX_SOURCE_BYTES)
       throw new ClipboardError(`${basename(path)} is too large to attach`);
     return { data: readFileSync9(path), name: basename(path) };
   } catch (error) {
@@ -78481,7 +79085,7 @@ init_resolve();
 init_store();
 init_config();
 init_context();
-import { statSync as statSync15 } from "node:fs";
+import { statSync as statSync16 } from "node:fs";
 init_usage();
 init_json();
 init_net();
@@ -78944,295 +79548,6 @@ var THEME = new Theme();
 // src/tui/views/login.ts
 init_py();
 
-// src/term/component.ts
-var Widget = class {
-  cache = [];
-  cacheWidth = -1;
-  isDirty = true;
-  render(width) {
-    if (this.isDirty || width !== this.cacheWidth) {
-      this.cache = this.draw(width);
-      this.cacheWidth = width;
-      this.isDirty = false;
-    }
-    return this.cache;
-  }
-  invalidate() {
-    this.isDirty = true;
-  }
-  get dirty() {
-    return this.isDirty;
-  }
-};
-var Container = class extends Widget {
-  children;
-  constructor(...children) {
-    super();
-    this.children = children;
-  }
-  add(child) {
-    this.children.push(child);
-    this.invalidate();
-    return child;
-  }
-  extend(children) {
-    this.children.push(...children);
-    this.invalidate();
-  }
-  clear() {
-    this.children = [];
-    this.invalidate();
-  }
-  remove(child) {
-    const index = this.children.indexOf(child);
-    if (index >= 0) {
-      this.children.splice(index, 1);
-      this.invalidate();
-    }
-  }
-  /** Concatenate the children, asking each: a clean child returns its cache,
-   * so a frame costs what actually changed. */
-  render(width) {
-    const lines2 = [];
-    for (const child of this.children) lines2.push(...child.render(width));
-    this.isDirty = false;
-    return lines2;
-  }
-  draw(width) {
-    return this.render(width);
-  }
-  /** Offer the key to each child until one takes it. */
-  handleInput(key2, data) {
-    for (const child of this.children) {
-      const handler = child.handleInput;
-      if (handler?.call(child, key2, data)) return true;
-    }
-    return false;
-  }
-};
-
-// src/term/primitives.ts
-var Text = class extends Widget {
-  constructor(content = "", paddingX = 1, paddingY = 0, tint2 = null) {
-    super();
-    this.content = content;
-    this.paddingX = paddingX;
-    this.paddingY = paddingY;
-    this.tint = tint2;
-  }
-  content;
-  paddingX;
-  paddingY;
-  tint;
-  get text() {
-    return this.content;
-  }
-  setText(text3) {
-    if (text3 !== this.content) {
-      this.content = text3;
-      this.invalidate();
-    }
-  }
-  draw(width) {
-    const inner = Math.max(1, width - 2 * this.paddingX);
-    const pad = " ".repeat(this.paddingX);
-    const body = wrap2(this.content, inner).map((line) => `${pad}${line}`);
-    const blank = Array(this.paddingY).fill("");
-    return [...blank, ...body, ...blank].map(
-      (line) => this.tint === null ? fillLine(line, width) : terminate(this.tint(padTo(line, width)))
-    );
-  }
-};
-var COLUMN = /^(\s*\S.*?[^\s.!?]\s{2,})\S/;
-function wrapAligned(paragraph2, width) {
-  const lines2 = wrap2(paragraph2, width);
-  if (lines2.length < 2) return lines2;
-  const plain2 = stripAnsi(paragraph2);
-  const column = COLUMN.exec(plain2);
-  const lead = column ? cellWidth(column[1]) : plain2.length - plain2.replace(/^ +/, "").length;
-  if (!(lead > 0 && lead <= Math.floor(width / 2))) return lines2;
-  const [head4, body] = splitAtCell(paragraph2, lead);
-  const rest = wrap2(body, width - lead);
-  return [head4 + rest[0], ...rest.slice(1).map((line) => " ".repeat(lead) + line)];
-}
-function splitAtCell(text3, cells) {
-  const tokens = tokenize(text3);
-  let seen = 0;
-  for (const [index, [isEscape, chunk]] of tokens.entries()) {
-    if (isEscape) continue;
-    if (seen >= cells) {
-      const head4 = tokens.slice(0, index);
-      const style = head4.filter(([isEscape2]) => isEscape2).map(([, c]) => c).join("");
-      return [
-        head4.map(([, c]) => c).join(""),
-        style + tokens.slice(index).map(([, c]) => c).join("")
-      ];
-    }
-    seen += cellWidth(chunk);
-  }
-  return [text3, ""];
-}
-var HangingText = class extends Widget {
-  constructor(prefix, body, paddingX = 1, tint2 = null) {
-    super();
-    this.prefix = prefix;
-    this.body = body;
-    this.paddingX = paddingX;
-    this.tint = tint2;
-    this.prefixWidth = cellWidth(prefix);
-  }
-  prefix;
-  body;
-  paddingX;
-  tint;
-  prefixWidth;
-  setBody(body) {
-    if (body !== this.body) {
-      this.body = body;
-      this.invalidate();
-    }
-  }
-  draw(width) {
-    const pad = " ".repeat(this.paddingX);
-    const inner = Math.max(1, width - 2 * this.paddingX - this.prefixWidth);
-    const hang = " ".repeat(this.prefixWidth);
-    const out = [];
-    for (const paragraph2 of this.body.split("\n")) {
-      wrapAligned(paragraph2, inner).forEach((line, index) => {
-        out.push(`${pad}${out.length === 0 && index === 0 ? this.prefix : hang}${line}`);
-      });
-    }
-    return out.map(
-      (line) => this.tint === null ? fillLine(line, width) : terminate(this.tint(padTo(line, width)))
-    );
-  }
-};
-var Box = class extends Widget {
-  constructor(paddingX = 1, paddingY = 1, tint2 = null, ...children) {
-    super();
-    this.paddingX = paddingX;
-    this.paddingY = paddingY;
-    this.tint = tint2;
-    this.children = children;
-  }
-  paddingX;
-  paddingY;
-  tint;
-  children;
-  add(child) {
-    this.children.push(child);
-    this.invalidate();
-    return child;
-  }
-  clear() {
-    this.children = [];
-    this.invalidate();
-  }
-  render(width) {
-    const inner = Math.max(1, width - 2 * this.paddingX);
-    const pad = " ".repeat(this.paddingX);
-    const body = this.children.flatMap(
-      (child) => child.render(inner).map((line) => `${pad}${stripTerminator(line)}`)
-    );
-    const blank = Array(this.paddingY).fill("");
-    return [...blank, ...body, ...blank].map(
-      (line) => this.tint === null ? fillLine(line, width) : terminate(this.tint(padTo(line, width)))
-    );
-  }
-  draw(width) {
-    return this.render(width);
-  }
-};
-var Spacer = class extends Widget {
-  constructor(lines2 = 1) {
-    super();
-    this.lines = lines2;
-  }
-  lines;
-  draw() {
-    return Array(this.lines).fill("");
-  }
-};
-var Rule = class extends Widget {
-  constructor(color2 = null, char = "\u2500") {
-    super();
-    this.color = color2;
-    this.char = char;
-  }
-  color;
-  char;
-  /** What the rule is painted with. */
-  get paint() {
-    return this.color;
-  }
-  setColor(color2) {
-    this.color = color2;
-    this.invalidate();
-  }
-  draw(width) {
-    const line = this.char.repeat(Math.max(1, width));
-    return [terminate(this.color ? this.color(line) : line)];
-  }
-};
-var LabelledRule = class extends Rule {
-  constructor(color2 = null, label = "", align = "left", char = "\u2500") {
-    super(color2, char);
-    this.label = label;
-    this.align = align;
-  }
-  label;
-  align;
-  setLabel(label) {
-    if (label !== this.label) {
-      this.label = label;
-      this.invalidate();
-    }
-  }
-  draw(width) {
-    const w = Math.max(1, width);
-    if (!this.label) return super.draw(w);
-    const label = ` ${this.label} `;
-    const labelWidth = cellWidth(label);
-    if (labelWidth + 4 > w) return super.draw(w);
-    const left = this.align === "center" ? Math.floor((w - labelWidth) / 2) : 2;
-    const right = w - labelWidth - left;
-    const paint = this.color ?? ((text3) => text3);
-    return [terminate(paint(this.char.repeat(left)) + label + paint(this.char.repeat(right)))];
-  }
-};
-var Lines = class extends Widget {
-  constructor(lines2, paddingX = 1, tint2 = null) {
-    super();
-    this.lines = lines2;
-    this.paddingX = paddingX;
-    this.tint = tint2;
-  }
-  lines;
-  paddingX;
-  tint;
-  setLines(lines2) {
-    this.lines = lines2;
-    this.invalidate();
-  }
-  draw(width) {
-    const pad = " ".repeat(this.paddingX);
-    const inner = Math.max(1, width - 2 * this.paddingX);
-    return this.lines.map((line) => `${pad}${truncateToWidth(stripTerminator(line), inner)}`).map(
-      (line) => this.tint === null ? fillLine(line, width) : terminate(this.tint(padTo(line, width)))
-    );
-  }
-};
-var stripTerminator = (line) => line.endsWith(SEGMENT_RESET) ? line.slice(0, -SEGMENT_RESET.length) : line;
-function padTo(line, width) {
-  let fitted = line;
-  let used2 = cellWidth(fitted);
-  if (used2 > width) {
-    fitted = truncateToWidth(fitted, width);
-    used2 = cellWidth(fitted);
-  }
-  return fitted + " ".repeat(Math.max(0, width - used2));
-}
-
 // src/tui/format.ts
 init_py();
 
@@ -86255,7 +86570,7 @@ async function cmdAgents(ctx, _args) {
 }
 async function cmdMcp(ctx, args) {
   const manager = ctx.app.mcp;
-  if (manager === null || !manager.configs.length) {
+  if (manager === null || !manager.configs.length && !manager.waiting.length) {
     ctx.app.notice("No MCP servers configured. Add one with `hx mcp add`.", "warning");
     return;
   }
@@ -86297,7 +86612,10 @@ async function cmdMcp(ctx, args) {
       lines2.push(`  ${ljust(status3.name, 20)} ${status3.error} - /mcp login ${status3.name}`);
     else lines2.push(`  ${ljust(status3.name, 20)} unavailable - ${status3.error}`);
   }
-  ctx.app.notice(lines2.join("\n"), manager.status().every((s) => s.connected) ? "info" : "warning");
+  for (const { config: config2 } of manager.waiting)
+    lines2.push(`  ${ljust(config2.name, 20)} not approved - run \`hx mcp approve ${config2.name}\``);
+  const healthy = manager.status().every((s) => s.connected) && !manager.waiting.length;
+  ctx.app.notice(lines2.join("\n"), healthy ? "info" : "warning");
 }
 function onlyServerNeedingLogin(manager) {
   const waiting = manager.status().filter((s) => s.needsLogin);
@@ -86663,18 +86981,18 @@ async function cmdCopy(ctx, _args) {
 }
 async function cmdTrace(ctx, args) {
   const [target, openAfter] = traceArgs(args);
-  let written;
+  let written2;
   try {
-    written = writeSessionTrace(ctx, target);
+    written2 = writeSessionTrace(ctx, target);
   } catch (error) {
     if (!error.code) throw error;
     ctx.app.notice(`Could not write the trace: ${osErrorText(error)}`, "error");
     return;
   }
-  const opened = openAfter && await openInBrowser(written);
+  const opened = openAfter && await openInBrowser(written2);
   const trailer = openAfter && !opened ? " No browser could be launched here; open it yourself." : "";
   ctx.app.notice(
-    `Trace written to ${written} (${formatBytes(statSync15(written).size)}).${trailer}`,
+    `Trace written to ${written2} (${formatBytes(statSync16(written2).size)}).${trailer}`,
     "success"
   );
 }
@@ -87771,7 +88089,7 @@ var PermissionPrompt = class extends Framed {
 
 // src/tui/views/prompt.ts
 init_images();
-import { statSync as statSync16 } from "node:fs";
+import { statSync as statSync17 } from "node:fs";
 init_pathlib();
 init_py();
 
@@ -88249,7 +88567,7 @@ var FileCompleter = class _FileCompleter {
     }
     const mtime3 = (path) => {
       try {
-        return statSync16(path).mtimeMs;
+        return statSync17(path).mtimeMs;
       } catch {
         return 0;
       }
@@ -89042,6 +89360,13 @@ var HintsBar = class extends Widget {
     return [fillLine(` ${parts2.join(fg2("dim", SEPARATOR2))}`, width)];
   }
 };
+var LOGO = [
+  "    __  __  _  __",
+  "   / / / / | |/ /",
+  "  / /_/ /  |   /",
+  " / __  /  /   |",
+  "/_/ /_/  /_/|_|"
+];
 var Header = class extends Widget {
   constructor(version = "", quiet = false) {
     super();
@@ -89051,6 +89376,7 @@ var Header = class extends Widget {
   quiet;
   versionText;
   isExpanded = false;
+  showLogo = false;
   get version() {
     return this.versionText;
   }
@@ -89068,10 +89394,19 @@ var Header = class extends Widget {
   toggle() {
     this.expanded = !this.isExpanded;
   }
+  /** The logo above the title: on the first screen of someone not signed in. */
+  get logo() {
+    return this.showLogo;
+  }
+  set logo(value) {
+    this.showLogo = value;
+    this.invalidate();
+  }
   draw(width) {
     if (this.quiet) return [];
     const keys = keymap();
-    const lines2 = [fg2("accent", "hx", { bold: true }) + fg2("dim", ` v${this.versionText}`)];
+    const lines2 = this.showLogo ? [...LOGO.map((row) => fg2("accent", row, { bold: true })), ""] : [];
+    lines2.push(fg2("accent", "hx", { bold: true }) + fg2("dim", ` v${this.versionText}`));
     if (!this.isExpanded) {
       const inner = Math.max(1, width - 2);
       lines2.push(
@@ -89342,6 +89677,7 @@ var HXSession = class {
     this.view.dock.hints.setHints(HINTS);
     this.refreshStatus();
     if (this.loop.session.activeMessages().length) this.replayTranscript();
+    if (this.extra.signIn) this.showSignIn(this.extra.signIn);
     if (this.loop.permissions !== null)
       this.loop.permissions.asker = (request2) => this.askPermission(request2);
     const events = this.consumeEvents();
@@ -89385,6 +89721,13 @@ var HXSession = class {
       this.runner.requestRender();
     }
   }
+  /** Say how to sign in, a row below the header, under the logo - unless a
+   * resumed conversation is already on screen. */
+  showSignIn(hint2) {
+    if (!this.view.transcript.blocks.length) this.view.header.logo = true;
+    this.view.transcript.add(new Spacer(1));
+    this.view.transcript.add(new Notice(hint2, "warning"));
+  }
   // -- the surface the slash commands expect ---------------------------------
   get status() {
     return this.view.dock.status;
@@ -90352,7 +90695,6 @@ Usage:
   hx auth [set|clear]       Show or change the OpenRouter API key
   hx docs [SECTION|--all]   Print the manual, or one section of it
   hx changelog [VERSION]    Print what shipped in each version
-  hx upgrade                Update hx to the latest version
   hx --version              Show version
   hx --help                 Show this message
 
@@ -90416,25 +90758,10 @@ ${USAGE}`, process.stderr);
       return runMcpCommand(parsed.rest);
     case "trace":
       return runTraceCommand(parsed);
-    case "upgrade":
-      return runUpgradeCommand();
     default:
       return runTuiCommand(parsed);
   }
 }
-function runUpgradeCommand() {
-  const channel = VERSION.includes("-") ? "next" : "latest";
-  const npm = process.platform === "win32" ? "npm.cmd" : "npm";
-  const result2 = spawnSync5(npm, ["install", "--global", `${PACKAGE}@${channel}`], {
-    stdio: "inherit"
-  });
-  if (result2.error?.code === "ENOENT") {
-    print("npm is not installed. See https://nodejs.org/", process.stderr);
-    return 1;
-  }
-  if (result2.error) throw result2.error;
-  return result2.status ?? 1;
-}
 function parseArgs(args) {
   const parsed = {
     command: "tui",
@@ -90489,7 +90816,7 @@ function parseArgs(args) {
   }
   if (positional.length) {
     const [head4, ...tail3] = positional;
-    if (["resume", "prompt", "trace", "mcp", "upgrade", "auth"].includes(head4)) {
+    if (["resume", "prompt", "trace", "mcp", "auth"].includes(head4)) {
       parsed.command = head4;
       parsed.rest = tail3;
       if (head4 === "resume" && tail3.length) parsed.sessionId = tail3[0];
@@ -90952,25 +91279,28 @@ function runTraceCommand(parsed) {
     destination = purePath(expandUser(target));
     if (isDir(destination)) destination = join(destination, TRACE_FILENAME);
   }
-  let written;
+  let written2;
   try {
-    written = writeTrace(buildTrace(session), destination);
+    written2 = writeTrace(buildTrace(session), destination);
   } catch (error) {
     if (!error.code) throw error;
     print(`error: could not write the trace: ${osErrorText(error)}`, process.stderr);
     return 1;
   }
-  print(written);
+  print(written2);
   return 0;
 }
 var MCP_USAGE = `hx mcp list                                  Show configured servers
 hx mcp add NAME COMMAND [ARGS...]            Add a stdio server
 hx mcp add NAME --url URL [--header K:V]...  Add an HTTP server
+hx mcp approve NAME                          Let a server from the project's .hx/mcp.json start
 hx mcp login NAME                            Sign in to an HTTP server in the browser
 hx mcp logout NAME                           Forget a server's sign-in
 hx mcp remove NAME                           Remove a server
 
 Add --user to write to ~/.hx/mcp.json instead of the project's .hx/mcp.json.
+A server in the project's .hx/mcp.json came with the project, so it starts only
+once approved: \`hx mcp add\` approves what it adds, and \`hx mcp approve\` the rest.
 An HTTP server that asks for sign-in gets it over OAuth unless a --header
 already sends Authorization.
 `;
@@ -90989,7 +91319,14 @@ async function runMcpCommand(given) {
       print(MCP_USAGE);
       return 0;
     }
-    for (const status3 of await probeServers(configs)) {
+    const [startable, waiting] = partition(configs, cwd);
+    for (const { config: config2, changed } of waiting) {
+      const why = changed ? "changed since approved" : "not approved";
+      print(
+        `${ljust2(config2.name, 20)} ${why} - runs ${describeServer(config2)}; run \`hx mcp approve ${config2.name}\``
+      );
+    }
+    for (const status3 of await probeServers(startable)) {
       if (status3.needsLogin) {
         print(`${ljust2(status3.name, 20)} ${status3.error} - run \`hx mcp login ${status3.name}\``);
         continue;
@@ -91029,9 +91366,10 @@ ${MCP_USAGE}`, process.stderr);
       });
     }
     print(`Added ${name} to ${saveConfig(config2, cwd, userLevel)}`);
+    if (!userLevel) approve({ ...config2, source: "project" }, cwd);
     return 0;
   }
-  if (args[0] === "login" || args[0] === "logout") {
+  if (args[0] === "approve") {
     if (args.length < 2) {
       print(MCP_USAGE, process.stderr);
       return 2;
@@ -91041,6 +91379,33 @@ ${MCP_USAGE}`, process.stderr);
       print(`No server named ${args[1]}.`, process.stderr);
       return 1;
     }
+    if (server.source === "user") {
+      print(`${server.name} is in your own ~/.hx/mcp.json; it needs no approval.`);
+      return 0;
+    }
+    approve(server, cwd);
+    const does = server.url ? "connects to" : "runs";
+    print(`Approved ${server.name}. It ${does}: ${describeServer(server)}`);
+    return 0;
+  }
+  if (args[0] === "login" || args[0] === "logout") {
+    if (args.length < 2) {
+      print(MCP_USAGE, process.stderr);
+      return 2;
+    }
+    const configs = loadConfigs(cwd);
+    const server = configs.find((c) => c.name === args[1]);
+    if (server === void 0) {
+      print(`No server named ${args[1]}.`, process.stderr);
+      return 1;
+    }
+    if (args[0] === "login" && partition([server], cwd)[1].length) {
+      print(
+        `${server.name} has not been approved. Run \`hx mcp approve ${server.name}\` first.`,
+        process.stderr
+      );
+      return 1;
+    }
     return args[0] === "login" ? mcpLogin2(server) : mcpLogout(server);
   }
   if (args[0] === "remove") {
@@ -91049,6 +91414,7 @@ ${MCP_USAGE}`, process.stderr);
       return 2;
     }
     if (removeConfig(args[1], cwd, userLevel)) {
+      if (!userLevel) revoke(args[1], cwd);
       print(`Removed ${args[1]}.`);
       return 0;
     }
@@ -91132,17 +91498,12 @@ async function runTuiCommand(parsed) {
   try {
     resume = resumeTarget(parsed);
     moved = adoptSessionDirectory(parsed, resume);
-    runtime2 = buildRuntime(parsed, resume);
+    runtime2 = buildRuntime(parsed, resume, true);
   } catch (error) {
-    if (!(error instanceof MissingCredential)) return report(error);
-    if (await runLogin(error.providerId) !== 0) return report(error);
-    try {
-      runtime2 = buildRuntime(parsed, resume);
-    } catch (retry) {
-      return report(retry);
-    }
+    return report(error);
   }
   if (moved) runtime2.notices.push(moved);
+  const signIn2 = runtime2.provider instanceof DeferredProvider ? signInHint(runtime2.loop.model, runtime2.auth) : null;
   let relaunch = null;
   try {
     await runtime2.connectMcp();
@@ -91157,7 +91518,8 @@ async function runTuiCommand(parsed) {
       mcp: runtime2.mcp,
       notices: runtime2.notices,
       checkpoints: runtime2.checkpoints,
-      renameLeft
+      renameLeft,
+      signIn: signIn2
     });
   } finally {
     runtime2.bus.close();