@usabledev/usable-chat 1.210.0 → 1.212.0

package/cli.js

@@ -45714,6 +45714,11 @@ var init_model_pricing = __esm({
         output: 1e-5,
         multiplier: 16
       },
+      "anthropic/claude-sonnet-5.5": {
+        input: 2e-6,
+        output: 1e-5,
+        multiplier: 16
+      },
       // Deepseek Models
       "deepseek/deepseek-chat": {
         input: 32e-8,
@@ -47013,6 +47018,29 @@ var init_model_registry_generated = __esm({
         },
         createdAt: 1790094732
       },
+      {
+        id: "anthropic/claude-sonnet-5.5",
+        displayName: "Claude Sonnet 5.5",
+        vendor: "anthropic",
+        category: "balanced",
+        capabilities: {
+          vision: true,
+          reasoning: true,
+          maxTokens: 128e3,
+          contextLength: 1e6
+        },
+        pricing: {
+          inputPer1M: 2,
+          outputPer1M: 10,
+          multiplier: 16
+        },
+        availability: {
+          mainChat: false,
+          experts: true,
+          embeds: true
+        },
+        createdAt: 1790553600
+      },
       {
         id: "openai/gpt-6-astra",
         displayName: "GPT-6 Astra",
@@ -47940,7 +47968,7 @@ var init_model_registry_generated = __esm({
         category: "balanced",
         capabilities: {
           vision: true,
-          reasoning: false,
+          reasoning: true,
           maxTokens: 128e3,
           contextLength: 1e6
         },
@@ -52618,6 +52646,7 @@ var init_model_registry = __esm({
       },
       "claude-sonnet-4-6": { bedrockId: "anthropic.claude-sonnet-4-6", crossRegion: true },
       "claude-sonnet-5": { bedrockId: "global.anthropic.claude-sonnet-5", crossRegion: false },
+      "claude-sonnet-5-5": { bedrockId: "global.anthropic.claude-sonnet-5-5", crossRegion: false },
       "claude-opus-5": { bedrockId: "global.anthropic.claude-opus-5", crossRegion: false },
       "claude-opus-5-5": { bedrockId: "global.anthropic.claude-opus-5-5", crossRegion: false },
       // Opus 4.7 uses the Global Cross-Region Inference profile (no regional Geo access required)
@@ -95134,6 +95163,12 @@ var init_beta_features = __esm({
         name: "Research mode",
         description: "Run structured, sourced research with specialist workers and an HTML report."
       },
+      "auto-model": {
+        key: "auto-model",
+        name: "Auto model",
+        description: "Use Jev to choose a curated model for each text request.",
+        failureMessage: "Could not save Auto model. Try again."
+      },
       "configurable-hooks": {
         key: "configurable-hooks",
         name: "Configurable hooks",
@@ -95160,7 +95195,8 @@ var init_beta_features = __esm({
     betaFeatureGrantSchema = external_exports.object({
       enabled: external_exports.boolean(),
       enabledAt: external_exports.string().datetime(),
-      enabledBy: external_exports.string()
+      enabledBy: external_exports.string(),
+      autoModelChoices: external_exports.object({ simple: external_exports.string(), advanced: external_exports.string() }).optional()
     });
     userBetaFeaturesSchema = external_exports.record(external_exports.string(), betaFeatureGrantSchema);
   }
@@ -106896,11 +106932,11 @@ var require_randomUUID = __commonJS({
 var require_dist_cjs31 = __commonJS({
   "node_modules/.pnpm/@smithy+uuid@1.1.2/node_modules/@smithy/uuid/dist-cjs/index.js"(exports2) {
     "use strict";
-    var randomUUID15 = require_randomUUID();
+    var randomUUID16 = require_randomUUID();
     var decimalToHex = Array.from({ length: 256 }, (_16, i19) => i19.toString(16).padStart(2, "0"));
     var v43 = () => {
-      if (randomUUID15.randomUUID) {
-        return randomUUID15.randomUUID();
+      if (randomUUID16.randomUUID) {
+        return randomUUID16.randomUUID();
       }
       const rnds = new Uint8Array(16);
       crypto.getRandomValues(rnds);
@@ -138218,6 +138254,7 @@ async function callClaude(apiKey, request, options2) {
 function extractClaudeModel(modelId) {
   const modelMap = {
     // Claude Sonnet 5 models
+    "anthropic/claude-sonnet-5.5": "claude-sonnet-5-5",
     "anthropic/claude-sonnet-5": "claude-sonnet-5",
     // Claude Sonnet 4.5 models
     "anthropic/claude-sonnet-4.5": "claude-sonnet-4-5-20250929",
@@ -144784,8 +144821,8 @@ var require_utils = __commonJS({
     var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
     var HOST_DELIM_RE = /[@/?#:]/g;
     var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
-    function reescapeHostDelimiters(host, isIP3) {
-      const re10 = isIP3 ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
+    function reescapeHostDelimiters(host, isIP4) {
+      const re10 = isIP4 ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
       re10.lastIndex = 0;
       return host.replace(re10, (ch) => HOST_DELIMS[ch]);
     }
@@ -145267,7 +145304,7 @@ var require_fast_uri = __commonJS({
         fragment: void 0
       };
       let malformedAuthorityOrPort = false;
-      let isIP3 = false;
+      let isIP4 = false;
       if (options2.reference === "suffix") {
         if (options2.scheme) {
           uri = options2.scheme + ":" + uri;
@@ -145297,9 +145334,9 @@ var require_fast_uri = __commonJS({
           if (ipv4result === false) {
             const ipv6result = normalizeIPv6(parsed.host);
             parsed.host = ipv6result.host.toLowerCase();
-            isIP3 = ipv6result.isIPV6;
+            isIP4 = ipv6result.isIPV6;
           } else {
-            isIP3 = true;
+            isIP4 = true;
           }
         }
         if (parsed.scheme === void 0 && parsed.userinfo === void 0 && parsed.host === void 0 && parsed.port === void 0 && parsed.query === void 0 && !parsed.path) {
@@ -145316,7 +145353,7 @@ var require_fast_uri = __commonJS({
         }
         const schemeHandler = getSchemeHandler(options2.scheme || parsed.scheme);
         if (!options2.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-          if (parsed.host && (options2.domainHost || schemeHandler && schemeHandler.domainHost) && isIP3 === false && nonSimpleDomain(parsed.host)) {
+          if (parsed.host && (options2.domainHost || schemeHandler && schemeHandler.domainHost) && isIP4 === false && nonSimpleDomain(parsed.host)) {
             try {
               parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
             } catch (e15) {
@@ -145330,7 +145367,7 @@ var require_fast_uri = __commonJS({
               parsed.scheme = unescape(parsed.scheme);
             }
             if (parsed.host !== void 0) {
-              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP3);
+              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP4);
             }
           }
           if (parsed.path) {
@@ -162764,6 +162801,12 @@ var init_schema_mcp = __esm({
         lastError: text2("last_error"),
         deletedAt: timestamp("deleted_at", { withTimezone: true }),
         sourceEventId: varchar("source_event_id", { length: 255 }),
+        // User approval for credential-bearing profiles (see services/mcp-approval.ts).
+        // Existing rows are grandfathered with approved_via='legacy' and no fingerprint.
+        origin: varchar("origin", { length: 16 }).notNull().default("legacy").$type(),
+        approvedFingerprint: varchar("approved_fingerprint", { length: 80 }),
+        approvedAt: timestamp("approved_at", { withTimezone: true }),
+        approvedVia: varchar("approved_via", { length: 32 }),
         createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
         updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
       },
@@ -163435,6 +163478,41 @@ var init_tool = __esm({
   }
 });
 
+// src/core/pause/envelope.ts
+function isMcpApprovalPause(output) {
+  if (!output || typeof output !== "object") return false;
+  const pause = output.__pause;
+  return pause !== void 0 && pause.kind === MCP_APPROVAL_PAUSE_KIND && typeof pause.resumeToken === "string" && typeof pause.mcpApproval?.profileId === "string" && typeof pause.mcpApproval.fingerprint === "string";
+}
+function detectPause(toolResult, toolCallId) {
+  if (isAskQuestionPause(toolResult)) {
+    return {
+      resumeToken: toolResult.__pause.resumeToken,
+      questions: toolResult.__pause.questions,
+      context: toolResult.__pause.context,
+      toolCallId
+    };
+  }
+  if (isMcpApprovalPause(toolResult)) {
+    return {
+      kind: MCP_APPROVAL_PAUSE_KIND,
+      resumeToken: toolResult.__pause.resumeToken,
+      mcpApproval: toolResult.__pause.mcpApproval,
+      action: toolResult.__pause.action,
+      toolCallId
+    };
+  }
+  return null;
+}
+var MCP_APPROVAL_PAUSE_KIND;
+var init_envelope = __esm({
+  "src/core/pause/envelope.ts"() {
+    "use strict";
+    init_tool();
+    MCP_APPROVAL_PAUSE_KIND = "mcp-approval";
+  }
+});
+
 // src/core/ai/provider-attempt.ts
 function providerAttemptAbortError(attempt) {
   const reason = attempt.signal.reason;
@@ -164100,15 +164178,10 @@ async function adaptClaudeStream(stream, options2) {
                 });
                 multiplexer.send(cardEvent);
               }
-              if (isAskQuestionPause(toolResult)) {
+              const pause = detectPause(toolResult, id);
+              if (pause) {
                 pauseDetected = true;
-                if (onPauseDetected) {
-                  await onPauseDetected({
-                    resumeToken: toolResult.__pause.resumeToken,
-                    questions: toolResult.__pause.questions,
-                    context: toolResult.__pause.context
-                  });
-                }
+                if (onPauseDetected) await onPauseDetected(pause);
                 return { toolResult };
               }
               if (toolResult?.__parentToolCall === true) {
@@ -164381,15 +164454,10 @@ async function adaptClaudeStream(stream, options2) {
                 });
                 multiplexer.send(cardEvent);
               }
-              if (isAskQuestionPause(toolResult)) {
+              const pause = detectPause(toolResult, id);
+              if (pause) {
                 pauseDetected = true;
-                if (onPauseDetected) {
-                  await onPauseDetected({
-                    resumeToken: toolResult.__pause.resumeToken,
-                    questions: toolResult.__pause.questions,
-                    context: toolResult.__pause.context
-                  });
-                }
+                if (onPauseDetected) await onPauseDetected(pause);
                 return { toolResult };
               }
               if (toolResult?.__parentToolCall === true) {
@@ -164609,7 +164677,7 @@ var init_claude_stream_adapter = __esm({
     "use strict";
     init_logger();
     init_store();
-    init_tool();
+    init_envelope();
     init_provider_attempt();
   }
 });
@@ -164725,15 +164793,10 @@ async function adaptOpenRouterStream(stream, options2) {
         });
         multiplexer.send(cardEvent);
       }
-      if (isAskQuestionPause(toolResult)) {
+      const pause = detectPause(toolResult, id);
+      if (pause) {
         pauseDetected = true;
-        if (onPauseDetected) {
-          await onPauseDetected({
-            resumeToken: toolResult.__pause.resumeToken,
-            questions: toolResult.__pause.questions,
-            context: toolResult.__pause.context
-          });
-        }
+        if (onPauseDetected) await onPauseDetected(pause);
         return;
       }
       if (toolResult?.__parentToolCall === true) {
@@ -165310,7 +165373,7 @@ var init_openrouter_stream_adapter = __esm({
     "use strict";
     init_logger();
     init_store();
-    init_tool();
+    init_envelope();
     init_provider_attempt();
   }
 });
@@ -165358,8 +165421,8 @@ var init_model_tiers = __esm({
         name: "Heavy Reasoning",
         models: [
           {
-            id: "anthropic/claude-sonnet-5",
-            displayName: "Claude Sonnet 5",
+            id: "anthropic/claude-sonnet-5.5",
+            displayName: "Claude Sonnet 5.5",
             description: "Best for professional tasks, coding, agents, and long conversations",
             provider: "Anthropic",
             costTier: "Expensive",
@@ -166139,7 +166202,7 @@ function mapModeToModel(modeId) {
   const modeMap = {
     standard: "anthropic/claude-haiku-4.5",
     "quick-thinking": "anthropic/claude-haiku-4.5",
-    "deep-thinking": "anthropic/claude-sonnet-5",
+    "deep-thinking": "anthropic/claude-sonnet-5.5",
     "multi-lingual": "google/gemini-3.1-pro-preview",
     "standard-fallback": "openai/gpt-5-mini"
   };
@@ -166162,6 +166225,7 @@ var init_model_config = __esm({
       "anthropic/claude-sonnet-4.5": { vision: true, reasoning: true },
       "anthropic/claude-sonnet-4.6": { vision: true, reasoning: true },
       "anthropic/claude-sonnet-5": { vision: true, reasoning: true },
+      "anthropic/claude-sonnet-5.5": { vision: true, reasoning: true },
       "anthropic/claude-haiku-4.5": { vision: true, reasoning: true },
       "anthropic/claude-4.5-haiku": { vision: true, reasoning: true },
       "anthropic/claude-4.5-sonnet": { vision: true, reasoning: true },
@@ -175114,7 +175178,7 @@ var require_gaxios = __commonJS({
     var retry_js_1 = require_retry();
     var stream_1 = __require("stream");
     var interceptor_js_1 = require_interceptor();
-    var randomUUID15 = async () => globalThis.crypto?.randomUUID() || (await import("crypto")).randomUUID();
+    var randomUUID16 = async () => globalThis.crypto?.randomUUID() || (await import("crypto")).randomUUID();
     var HTTP_STATUS_NO_CONTENT = 204;
     var Gaxios = class {
       agentCache = /* @__PURE__ */ new Map();
@@ -175387,7 +175451,7 @@ var require_gaxios = __commonJS({
          */
         ["Blob", "File", "FormData"].includes(opts.data?.constructor?.name || "");
         if (opts.multipart?.length) {
-          const boundary = await randomUUID15();
+          const boundary = await randomUUID16();
           preparedHeaders.set("content-type", `multipart/related; boundary=${boundary}`);
           opts.body = stream_1.Readable.from(this.getMultipartRequest(opts.multipart, boundary));
         } else if (shouldDirectlyPassData) {
@@ -205823,15 +205887,10 @@ async function callGeminiDirect({
           try {
             if (abortSignal?.aborted) break;
             let toolResult = await executeToolByName(toolName, toolArgs, { ...context3, toolCallId });
-            if (isAskQuestionPause(toolResult)) {
+            const pause = detectPause(toolResult, toolCallId);
+            if (pause) {
               pauseDetected = true;
-              if (onPauseDetected) {
-                await onPauseDetected({
-                  resumeToken: toolResult.__pause.resumeToken,
-                  questions: toolResult.__pause.questions,
-                  context: toolResult.__pause.context
-                });
-              }
+              if (onPauseDetected) await onPauseDetected(pause);
               completedToolCalls.push({ id: toolCallId, name: toolName, arguments: toolArgs });
               break;
             }
@@ -205996,15 +206055,10 @@ async function callGeminiDirect({
             try {
               if (abortSignal?.aborted) break;
               let toolResult = await executeToolByName(toolName, toolArgs, { ...context3, toolCallId });
-              if (isAskQuestionPause(toolResult)) {
+              const pause = detectPause(toolResult, toolCallId);
+              if (pause) {
                 pauseDetected = true;
-                if (onPauseDetected) {
-                  await onPauseDetected({
-                    resumeToken: toolResult.__pause.resumeToken,
-                    questions: toolResult.__pause.questions,
-                    context: toolResult.__pause.context
-                  });
-                }
+                if (onPauseDetected) await onPauseDetected(pause);
                 completedToolCalls.push({ id: toolCallId, name: toolName, arguments: toolArgs });
                 break;
               }
@@ -206261,7 +206315,7 @@ var init_gemini_direct_stream_adapter = __esm({
     init_node2();
     init_esm2();
     init_store();
-    init_tool();
+    init_envelope();
     init_provider_attempt();
   }
 });
@@ -207715,6 +207769,7 @@ var init_tool_categories = __esm({
       "update-project",
       "mcp_config_apply",
       "mcp_config_request_secret",
+      "mcp_server_request_approval",
       "mcp_call_tool",
       "mcp_server_create",
       "mcp_server_update",
@@ -219362,7 +219417,7 @@ HOW TO USE THIS:
 - \`model\`: **default to \`quick-thinking\` (alias for \`anthropic/claude-haiku-4.5\`) unless you have a specific reason not to.** Subagents are billed in addition to your own turn \u2014 every Sonnet-class subagent doubles cost. Guidance:
     - **\`quick-thinking\` / \`anthropic/claude-haiku-4.5\`** (cheapest, fast, strong tool use) \u2014 use this for: web/Usable search, summarisation, classification, simple extraction, drafting, tabular work, anything where one-shot quality is "good enough". Should be your **default**.
     - **\`google/gemini-3.8-flash\`** (cheap, huge context, multimodal/multi-lingual) \u2014 use this when: you need to read a 100k+-token document, the task is multi-lingual, or there's image/audio input.
-    - **\`deep-thinking\` / \`anthropic/claude-sonnet-5\`** (5\u201310\xD7 the cost of Haiku) \u2014 only use when: the work requires multi-step reasoning over conflicting evidence, code generation against a specific architecture, or careful policy/risk judgement. If you find yourself reaching for this for "research", reach for Haiku first.
+    - **\`deep-thinking\` / \`anthropic/claude-sonnet-5.5\`** (5\u201310\xD7 the cost of Haiku) \u2014 only use when: the work requires multi-step reasoning over conflicting evidence, code generation against a specific architecture, or careful policy/risk judgement. If you find yourself reaching for this for "research", reach for Haiku first.
     - **\`google/gemini-3.1-pro-preview\`** \u2014 only when both massive context AND deep reasoning are required.
 - \`allowedTools\`: tool names exactly as they appear in YOUR own tool list. Raw MCP names (no \`mcp__usable__\` prefix) for built-in / MCP tools; \`parent_*\` prefixed names for embed-host tools registered by the surrounding application (e.g. \`parent_search_vessel_registry\`). Subagents in embed contexts CAN use parent tools \u2014 list them here just like any other tool.
 - \`systemPrompt\` (optional): override the default worker-agent system prompt.
@@ -220244,6 +220299,7 @@ function buildMcpServerToolsPromptSection({
       "- Prefer user-wide profile tools: `mcp_server_list`, `mcp_server_create`, `mcp_server_update`, `mcp_server_delete`, and `mcp_server_test`.",
       "- Use legacy sandbox config tools `mcp_config_list`, `mcp_config_propose`, `mcp_config_test`, and `mcp_config_apply` only when the user explicitly asks for legacy per-sandbox MCP config.",
       "- Never ask the user to reveal secret values. Use `vault_secret_list` to find full secret IDs, or exact Vault secret names when the create/update tool allows them.",
+      "- A server that would receive Vault secrets stays inactive until the user approves it in the app. You cannot approve it: when a tool result says `approvalRequired`, share the `approvalUrl` and wait. Changing its URL, command, or secret bindings requires approval again.",
       "- For npx/uvx API-key MCP servers, put command/header flags in `args` and bind secret values through `envSecretRefs`, not `headersSecretRefs`.",
       '- Groundcover API-key setup uses `runner: "npx"`, `package: "mcp-remote"`, args including `https://mcp.groundcover.com/api/mcp`, `--header`, `Authorization:${GROUNDCOVER_API_KEY}`, and `envSecretRefs: { "GROUNDCOVER_API_KEY": "<secret-id-or-name>" }`.',
       "- After command-based MCP config changes, use `sandbox_list` then `sandbox_restart` if a running execution environment needs a fresh start."
@@ -220522,6 +220578,43 @@ var init_store2 = __esm({
   }
 });
 
+// src/core/pause/mcp-approval.ts
+var mcp_approval_exports = {};
+__export2(mcp_approval_exports, {
+  buildMcpApprovalPause: () => buildMcpApprovalPause,
+  buildMcpApprovalPlaceholder: () => buildMcpApprovalPlaceholder,
+  formatMcpApprovalDecision: () => formatMcpApprovalDecision
+});
+import { randomUUID as randomUUID5 } from "node:crypto";
+function buildMcpApprovalPause(approval, action5) {
+  return {
+    __pause: {
+      kind: MCP_APPROVAL_PAUSE_KIND,
+      resumeToken: randomUUID5(),
+      mcpApproval: approval,
+      action: action5
+    }
+  };
+}
+function buildMcpApprovalPlaceholder(approval) {
+  return `[Awaiting user approval for MCP server "${approval.name}" \u2014 approval card is open]`;
+}
+function formatMcpApprovalDecision(params) {
+  const { approval, action: action5, decision } = params;
+  const subject = `MCP server "${approval.name}" (id ${approval.profileId}, ${approval.target})`;
+  const done = action5 === "requested" ? "" : ` It was ${action5}.`;
+  if (decision === "approved") {
+    return `User approved ${subject} to use its Vault secrets.${done} It is now active: test it with mcp_server_test before using its tools.`;
+  }
+  return `User rejected ${subject}; it stays disabled and receives no secrets.${done} Do not retry or re-create it unless the user asks.`;
+}
+var init_mcp_approval = __esm({
+  "src/core/pause/mcp-approval.ts"() {
+    "use strict";
+    init_envelope();
+  }
+});
+
 // src/lib/services/user.service.ts
 var user_service_exports = {};
 __export2(user_service_exports, {
@@ -223154,32 +223247,15 @@ var init_hook_definition = __esm({
   }
 });
 
-// src/lib/hooks/hook-runtime.ts
-import { lookup } from "node:dns/promises";
-import { request as httpRequest } from "node:http";
-import { request as httpsRequest } from "node:https";
+// src/lib/net/guarded-fetch.ts
 import { isIP as isIP2 } from "node:net";
-function boundedJson(value, maxBytes, code = "HOOK_RUNTIME_LIMIT") {
-  const json3 = JSON.stringify(value ?? null);
-  if (Buffer.byteLength(json3, "utf8") > maxBytes) throw new Error(code);
-  return json3;
-}
-function usableOrigin() {
-  try {
-    return config2.mcp.url ? new URL(config2.mcp.url).origin : null;
-  } catch {
-    return null;
-  }
-}
-function sanitizedUrl(url3) {
-  return `${url3.origin}${url3.pathname}`;
-}
 function normalizeIpLiteral(address) {
   return address.toLowerCase().replace(/^\[|\]$/g, "");
 }
 function embeddedIpv4Address(address) {
-  const suffix = address.startsWith("::ffff:") ? address.slice("::ffff:".length) : address.startsWith("::") ? address.slice(2) : "";
-  if (!suffix) return null;
+  const prefix2 = ["::ffff:", "64:ff9b::", "::"].find((candidate) => address.startsWith(candidate));
+  if (!prefix2) return null;
+  const suffix = address.slice(prefix2.length);
   if (isIP2(suffix) === 4) return suffix;
   const match2 = /^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(suffix);
   if (!match2) return null;
@@ -223196,7 +223272,40 @@ function isForbiddenAddress(address) {
     const [a22 = 0, b32 = 0] = normalized.split(".").map(Number);
     return a22 === 0 || a22 === 10 || a22 === 127 || a22 === 100 && b32 >= 64 && b32 <= 127 || a22 === 169 && b32 === 254 || a22 === 172 && b32 >= 16 && b32 <= 31 || a22 === 192 && b32 === 0 || a22 === 192 && b32 === 168 || a22 === 198 && (b32 === 18 || b32 === 19) || a22 === 198 && b32 === 51 || a22 === 203 && b32 === 0 || a22 >= 224;
   }
-  return normalized.startsWith("fc") || normalized.startsWith("fd") || normalized.startsWith("fe8") || normalized.startsWith("fe9") || normalized.startsWith("fea") || normalized.startsWith("feb") || normalized.startsWith("ff") || normalized.startsWith("2001:db8");
+  return normalized.startsWith("fc") || normalized.startsWith("fd") || /^fe[89a-f]/.test(normalized) || normalized.startsWith("ff") || normalized.startsWith("2001:db8");
+}
+var MCP_FETCH_POLICY;
+var init_guarded_fetch = __esm({
+  "src/lib/net/guarded-fetch.ts"() {
+    "use strict";
+    MCP_FETCH_POLICY = {
+      allowHttp: true,
+      maxResponseBytes: 5 * 1024 * 1024,
+      timeoutMs: 3e4,
+      maxRedirects: 5
+    };
+  }
+});
+
+// src/lib/hooks/hook-runtime.ts
+import { lookup } from "node:dns/promises";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { isIP as isIP3 } from "node:net";
+function boundedJson(value, maxBytes, code = "HOOK_RUNTIME_LIMIT") {
+  const json3 = JSON.stringify(value ?? null);
+  if (Buffer.byteLength(json3, "utf8") > maxBytes) throw new Error(code);
+  return json3;
+}
+function usableOrigin() {
+  try {
+    return config2.mcp.url ? new URL(config2.mcp.url).origin : null;
+  } catch {
+    return null;
+  }
+}
+function sanitizedUrl(url3) {
+  return `${url3.origin}${url3.pathname}`;
 }
 async function validateDestination(url3) {
   if (Buffer.byteLength(url3.toString()) > LIMITS.urlBytes || url3.username || url3.password) {
@@ -223213,8 +223322,8 @@ async function validateDestination(url3) {
   if (url3.hostname === "localhost" || url3.hostname.endsWith(".local")) {
     throw new Error("HOOK_FETCH_DESTINATION_BLOCKED");
   }
-  const hostname2 = normalizeIpLiteral(url3.hostname);
-  const addresses = isIP2(hostname2) ? [{ address: hostname2 }] : await lookup(hostname2, { all: true, verbatim: true });
+  const hostname2 = url3.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  const addresses = isIP3(hostname2) ? [{ address: hostname2 }] : await lookup(hostname2, { all: true, verbatim: true });
   if (addresses.length === 0 || addresses.some(({ address }) => isForbiddenAddress(address))) {
     throw new Error("HOOK_FETCH_DESTINATION_BLOCKED");
   }
@@ -223612,6 +223721,7 @@ var init_hook_runtime = __esm({
     "use strict";
     init_config();
     init_dist15();
+    init_guarded_fetch();
     LIMITS = {
       memoryBytes: 16 * 1024 * 1024,
       stackBytes: 256 * 1024,
@@ -225376,12 +225486,12 @@ var init_hook_runtime_token = __esm({
 });
 
 // src/lib/hooks/hook-test-confirmation.ts
-import { randomUUID as randomUUID5 } from "node:crypto";
+import { randomUUID as randomUUID6 } from "node:crypto";
 async function issueHookTestConfirmation(userId, conversationId, turnId) {
   if (!await isRedisAvailable()) return null;
   const redis = getRedis();
   if (!redis) return null;
-  const token = randomUUID5();
+  const token = randomUUID6();
   await redis.set(
     `hook-test-confirmation:${token}`,
     JSON.stringify({ userId, conversationId, turnId }),
@@ -230847,7 +230957,7 @@ var init_conversation_resource_authorization = __esm({
 });
 
 // src/lib/services/hook-definition.service.ts
-import { createHash as createHash10, randomUUID as randomUUID6 } from "node:crypto";
+import { createHash as createHash10, randomUUID as randomUUID7 } from "node:crypto";
 function deterministicUuid(namespace, value) {
   const bytes = Buffer.from(
     createHash10("sha256").update(`${namespace}\0${value}`).digest().subarray(0, 16)
@@ -230858,8 +230968,8 @@ function deterministicUuid(namespace, value) {
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
 async function createHookDefinition(pathway, userId, input, idempotencyKey) {
-  const hookId = idempotencyKey ? deterministicUuid("usable-chat:hook-definition", `${userId}:${idempotencyKey}`) : randomUUID6();
-  const revisionId = idempotencyKey ? deterministicUuid("usable-chat:hook-revision", hookId) : randomUUID6();
+  const hookId = idempotencyKey ? deterministicUuid("usable-chat:hook-definition", `${userId}:${idempotencyKey}`) : randomUUID7();
+  const revisionId = idempotencyKey ? deterministicUuid("usable-chat:hook-revision", hookId) : randomUUID7();
   const existingHook = await getHookDefinition(userId, hookId);
   if (existingHook) return existingHook;
   const timestamp2 = (/* @__PURE__ */ new Date()).toISOString();
@@ -230873,7 +230983,7 @@ async function createHookDefinition(pathway, userId, input, idempotencyKey) {
   const order = (existing.at(-1)?.order ?? -1) + 1;
   await pathway.write("hook-definition.0/hook-definition.created.0", {
     data: {
-      id: randomUUID6(),
+      id: randomUUID7(),
       timestamp: timestamp2,
       hookId,
       revisionId,
@@ -230922,11 +231032,11 @@ async function reviseHookDefinition(pathway, userId, hookId, baseRevision, input
     ).orderBy(asc(hookDefinitions.order));
     order = (rows.at(-1)?.order ?? -1) + 1;
   }
-  const revisionId = randomUUID6();
+  const revisionId = randomUUID7();
   try {
     await pathway.write("hook-definition.0/hook-definition.revised.0", {
       data: {
-        id: randomUUID6(),
+        id: randomUUID7(),
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         hookId,
         revisionId,
@@ -230954,7 +231064,7 @@ async function setHookActivation(pathway, userId, hookId, enabled2) {
   if (!await getHookDefinition(userId, hookId)) return null;
   await pathway.write("hook-definition.0/hook-definition.activation-changed.0", {
     data: {
-      id: randomUUID6(),
+      id: randomUUID7(),
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       hookId,
       userId,
@@ -230966,7 +231076,7 @@ async function setHookActivation(pathway, userId, hookId, enabled2) {
 async function reorderHookDefinitions(pathway, userId, input) {
   await pathway.write("hook-definition.0/hook-definition.reordered.0", {
     data: {
-      id: randomUUID6(),
+      id: randomUUID7(),
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       userId,
       ...input
@@ -301777,7 +301887,7 @@ var init_httpHeaders = __esm({
 });
 
 // node_modules/.pnpm/@typespec+ts-http-runtime@0.3.4/node_modules/@typespec/ts-http-runtime/dist/esm/util/uuidUtils.js
-function randomUUID7() {
+function randomUUID8() {
   return crypto.randomUUID();
 }
 var init_uuidUtils = __esm({
@@ -301831,7 +301941,7 @@ var init_pipelineRequest = __esm({
         this.abortSignal = options2.abortSignal;
         this.onUploadProgress = options2.onUploadProgress;
         this.onDownloadProgress = options2.onDownloadProgress;
-        this.requestId = options2.requestId || randomUUID7();
+        this.requestId = options2.requestId || randomUUID8();
         this.allowInsecureConnection = options2.allowInsecureConnection ?? false;
         this.enableBrowserStreams = options2.enableBrowserStreams ?? false;
         this.requestOverrides = options2.requestOverrides;
@@ -303535,7 +303645,7 @@ var init_concat = __esm({
 
 // node_modules/.pnpm/@typespec+ts-http-runtime@0.3.4/node_modules/@typespec/ts-http-runtime/dist/esm/policies/multipartPolicy.js
 function generateBoundary() {
-  return `----AzSDKFormBoundary${randomUUID7()}`;
+  return `----AzSDKFormBoundary${randomUUID8()}`;
 }
 function encodeHeaders(headers) {
   let result = "";
@@ -304164,8 +304274,8 @@ var init_typeGuards2 = __esm({
 function isError2(e15) {
   return isError(e15);
 }
-function randomUUID8() {
-  return randomUUID7();
+function randomUUID9() {
+  return randomUUID8();
 }
 var isNodeLike2;
 var init_esm40 = __esm({
@@ -333527,7 +333637,7 @@ var init_BlobLeaseClient = __esm({
           this._containerOrBlobOperation = clientContext.blob;
         }
         if (!leaseId2) {
-          leaseId2 = randomUUID8();
+          leaseId2 = randomUUID9();
         }
         this._leaseId = leaseId2;
       }
@@ -337934,7 +338044,7 @@ var init_Clients = __esm({
             throw new RangeError(`The buffer's size is too big or the BlockSize is too small;the number of blocks must be <= ${BLOCK_BLOB_MAX_BLOCKS}`);
           }
           const blockList = [];
-          const blockIDPrefix = randomUUID8();
+          const blockIDPrefix = randomUUID9();
           let transferProgress = 0;
           const batch = new Batch(options2.concurrency);
           for (let i19 = 0; i19 < numBlocks; i19++) {
@@ -338015,7 +338125,7 @@ var init_Clients = __esm({
         }
         return tracingClient.withSpan("BlockBlobClient-uploadStream", options2, async (updatedOptions) => {
           let blockNum = 0;
-          const blockIDPrefix = randomUUID8();
+          const blockIDPrefix = randomUUID9();
           let transferProgress = 0;
           const blockList = [];
           const scheduler = new BufferScheduler(
@@ -339140,7 +339250,7 @@ var init_BlobBatch = __esm({
       constructor() {
         this.operationCount = 0;
         this.body = "";
-        const tempGuid = randomUUID8();
+        const tempGuid = randomUUID9();
         this.boundary = `batch_${tempGuid}`;
         this.subRequestPrefix = `--${this.boundary}${HTTP_LINE_ENDING}${HeaderConstants.CONTENT_TYPE}: application/http${HTTP_LINE_ENDING}${HeaderConstants.CONTENT_TRANSFER_ENCODING}: binary`;
         this.multipartContentType = `multipart/mixed; boundary=${this.boundary}`;
@@ -359212,7 +359322,7 @@ __export2(auth_refresh_coordination_exports, {
   compressAccessTokenRotation: () => compressAccessTokenRotation,
   coordinateAccessTokenRefresh: () => coordinateAccessTokenRefresh
 });
-import { createHash as createHash12, randomUUID as randomUUID9 } from "node:crypto";
+import { createHash as createHash12, randomUUID as randomUUID10 } from "node:crypto";
 async function coordinateAccessTokenRefresh(token, refresh2) {
   const redis = getRedis();
   const secret = process.env.NEXTAUTH_SECRET;
@@ -359264,7 +359374,7 @@ async function coordinateAccessTokenRefresh(token, refresh2) {
     }
     throw new Error("refresh_rotation_chain_limit");
   }
-  const owner = randomUUID9();
+  const owner = randomUUID10();
   if (!await redis.set(key2, owner, "EX", TTL, "NX")) {
     for (let attempt = 0; attempt < 20; attempt++) {
       await new Promise((resolve9) => setTimeout(resolve9, 250));
@@ -361655,7 +361765,7 @@ var init_host_jwt = __esm({
 });
 
 // src/lib/work-runtime/resume-proof.ts
-import { createHash as createHash14, createHmac as createHmac4, randomUUID as randomUUID10, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+import { createHash as createHash14, createHmac as createHmac4, randomUUID as randomUUID11, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 function encoded(value) {
   return Buffer.from(value).toString("base64url");
 }
@@ -362500,7 +362610,7 @@ __export2(file_storage_service_exports, {
   FileStorageService: () => FileStorageService,
   fileStorageService: () => fileStorageService
 });
-import { randomUUID as randomUUID11 } from "node:crypto";
+import { randomUUID as randomUUID12 } from "node:crypto";
 function estimateBase64Bytes2(base643) {
   const content = base643.includes(",") ? base643.split(",")[1] : base643;
   const len = content.length;
@@ -362583,7 +362693,7 @@ var init_file_storage_service = __esm({
             mimeType: stored2.mimeType ?? params.mimeType
           };
         }
-        const id = randomUUID11();
+        const id = randomUUID12();
         const preview = params.previewBytes ?? params.bytes;
         const llm = params.llmBytes ?? preview;
         const estimatedTokens = Math.ceil(Math.ceil(llm.byteLength * 4 / 3) / 100);
@@ -362750,7 +362860,7 @@ var init_file_storage_service = __esm({
        * For documents: keeps extractedContent as text and optional originalContent as base64 bytes.
        */
       async storeFile(params) {
-        const fileId = randomUUID11();
+        const fileId = randomUUID12();
         let extractedContent = params.extractedContent;
         let originalContent = params.originalContent ?? null;
         if (params.fileType === "image" && params.contentType === "base64") {
@@ -363039,7 +363149,7 @@ var init_file_storage_service = __esm({
           paths = await storage.uploadVariants({
             fileId,
             userId,
-            namespace: `migration-${randomUUID11()}`,
+            namespace: `migration-${randomUUID12()}`,
             variants: {
               original: { bytes: original2, mimeType },
               preview: { bytes: preview, mimeType: "image/webp" },
@@ -363304,7 +363414,7 @@ var init_file_storage_service = __esm({
 });
 
 // src/core/orchestrator/index.ts
-import { createHash as createHash17, randomUUID as randomUUID12 } from "node:crypto";
+import { createHash as createHash17, randomUUID as randomUUID13 } from "node:crypto";
 function shouldRecoverSilentStop({
   text: text5,
   lastStepHadToolErrors,
@@ -363859,21 +363969,24 @@ function createPauseCallback({
   pauseSignaled
 }) {
   return async (data2) => {
-    orchestrationLogger.info("Pause detected \u2014 askUserQuestion (deferred persist)", {
-      resumeToken: data2.resumeToken,
-      questionCount: data2.questions.length
-    });
+    orchestrationLogger.info(
+      data2.kind === "mcp-approval" ? "Pause detected \u2014 MCP approval (deferred persist)" : "Pause detected \u2014 askUserQuestion (deferred persist)",
+      {
+        resumeToken: data2.resumeToken,
+        ...data2.kind === "mcp-approval" ? { profileId: data2.mcpApproval.profileId } : { questionCount: data2.questions.length }
+      }
+    );
     pendingPauseRef.current = { data: data2 };
     pauseSignaled.current = true;
   };
 }
-function replacePauseToolResultPlaceholder(messages4, toolUseId) {
+function replacePauseToolResultPlaceholder(messages4, toolUseId, placeholder2 = ASK_QUESTION_PLACEHOLDER) {
   for (const msg of messages4) {
     if (msg.role === "user" && Array.isArray(msg.content)) {
       const parts = msg.content;
       for (const part of parts) {
         if (part.type === "tool_result" && part.tool_use_id === toolUseId) {
-          part.content = ASK_QUESTION_PLACEHOLDER;
+          part.content = placeholder2;
           return true;
         }
       }
@@ -363881,7 +363994,7 @@ function replacePauseToolResultPlaceholder(messages4, toolUseId) {
     const oaiMsg = msg;
     if (oaiMsg.role === "tool" && oaiMsg.tool_call_id === toolUseId) {
       ;
-      msg.content = ASK_QUESTION_PLACEHOLDER;
+      msg.content = placeholder2;
       return true;
     }
   }
@@ -363903,6 +364016,22 @@ async function drainPendingPause({
   resolveStreamComplete
 }) {
   const { data: data2 } = pending;
+  if (data2.kind === "mcp-approval") {
+    return drainMcpApprovalPause({
+      data: data2,
+      toolCalls,
+      emitter,
+      multiplexer,
+      context: context3,
+      messageId,
+      correlationId,
+      conversationMessages,
+      persona,
+      config: config3,
+      embedSnapshot,
+      resolveStreamComplete
+    });
+  }
   const askToolCall = toolCalls.find((tc) => tc.name === "ask-user-question");
   const pausedToolUseId = askToolCall?.id;
   if (pausedToolUseId) {
@@ -363943,7 +364072,7 @@ async function drainPendingPause({
       if (durable && conversationId && pausedToolUseId) {
         await context3.sessionPathway.write("chat-interaction.0/chat-interaction.updated.0", {
           data: {
-            id: randomUUID12(),
+            id: randomUUID13(),
             interactionId: data2.resumeToken,
             conversationId,
             assistantMessageId: messageId,
@@ -364027,6 +364156,81 @@ async function drainPendingPause({
   multiplexer.close();
   resolveStreamComplete();
 }
+async function drainMcpApprovalPause({
+  data: data2,
+  toolCalls,
+  emitter,
+  multiplexer,
+  context: context3,
+  messageId,
+  correlationId,
+  conversationMessages,
+  persona,
+  config: config3,
+  embedSnapshot,
+  resolveStreamComplete
+}) {
+  const { buildMcpApprovalPlaceholder: buildMcpApprovalPlaceholder2 } = await Promise.resolve().then(() => (init_mcp_approval(), mcp_approval_exports));
+  const pausedToolUseId = toolCalls.find((tc) => tc.id === data2.toolCallId)?.id ?? [...toolCalls].reverse().find((tc) => tc.name.startsWith("mcp_server_"))?.id;
+  if (pausedToolUseId) {
+    replacePauseToolResultPlaceholder(
+      conversationMessages,
+      pausedToolUseId,
+      buildMcpApprovalPlaceholder2(data2.mcpApproval)
+    );
+  } else {
+    orchestrationLogger.warn("MCP approval pause signaled but its tool_call was not found");
+  }
+  const snapshot2 = ensureToolCallIntegrity([...conversationMessages]);
+  const lastSequence = emitter.getSequence();
+  const now2 = /* @__PURE__ */ new Date();
+  try {
+    const { storePauseState: storePauseState2 } = await Promise.resolve().then(() => (init_store2(), store_exports));
+    await storePauseState2({
+      kind: "mcp-approval",
+      mcpApproval: data2.mcpApproval,
+      mcpAction: data2.action,
+      resumeToken: data2.resumeToken,
+      userId: context3.session?.user?.id || "",
+      conversationId: context3.metadata?.conversationId,
+      messageId,
+      correlationId,
+      lastSequence,
+      conversationMessages: snapshot2,
+      pausedToolUseId,
+      persona,
+      config: config3,
+      questions: [],
+      temporary: context3.metadata?.temporary === true,
+      embedSnapshot,
+      pausedAt: now2.toISOString(),
+      expiresAt: new Date(now2.getTime() + 60 * 60 * 1e3).toISOString()
+    });
+  } catch (error41) {
+    orchestrationLogger.warn("MCP approval pause cache unavailable; approval still works", {
+      resumeToken: data2.resumeToken,
+      error: error41 instanceof Error ? error41.message : String(error41)
+    });
+  }
+  const approvalEvent = emitter.emit(
+    "mcp-approval-request",
+    {
+      interactionId: data2.resumeToken,
+      resumeToken: data2.resumeToken,
+      approval: data2.mcpApproval,
+      action: data2.action
+    }
+  );
+  multiplexer.send(approvalEvent);
+  orchestrationLogger.info("MCP approval requested, closing stream", {
+    resumeToken: data2.resumeToken,
+    profileId: data2.mcpApproval.profileId,
+    pausedToolUseId,
+    lastSequence
+  });
+  multiplexer.close();
+  resolveStreamComplete();
+}
 function safeProviderErrorCategory(value) {
   return typeof value === "string" && providerErrorCategories.has(value) ? value : void 0;
 }
@@ -364038,7 +364242,7 @@ function beginNumberedProviderAttempt(budget, route) {
   const attempt = budget.begin(route);
   const number4 = (providerAttemptNumbers.get(budget) ?? 0) + 1;
   providerAttemptNumbers.set(budget, number4);
-  return { attempt, id: randomUUID12(), number: number4, startedAt: Date.now() };
+  return { attempt, id: randomUUID13(), number: number4, startedAt: Date.now() };
 }
 function hasProviderAttemptCapacity(budget) {
   return (providerAttemptNumbers.get(budget) ?? 0) < budget.maxAttempts;
@@ -364137,7 +364341,7 @@ async function callLLM({
   }
   const effectiveZdr2 = openRouterPolicy.effectiveZdr;
   const resolveDirectPolicy = (route) => resolveProviderPolicy({ modelId: selectedModelId, route, ...providerPrivacy });
-  const safeCorrelationId = safeProviderIdentifier(context3.correlationId) ?? safeProviderIdentifier(context3.messageId) ?? randomUUID12();
+  const safeCorrelationId = safeProviderIdentifier(context3.correlationId) ?? safeProviderIdentifier(context3.messageId) ?? randomUUID13();
   const safeModel = getModelById(selectedModelId) || getModelEntry(selectedModelId) ? selectedModelId : void 0;
   const endpointIdentity = (endpoint) => createHash17("sha256").update(endpoint).digest("hex").slice(0, 16);
   const circuitPolicy = (endpoint) => `zdr:${effectiveZdr2 ? "required" : "disabled"}:endpoint:${endpointIdentity(endpoint)}`;
@@ -366302,7 +366506,7 @@ Folder behavior:
       }
     };
   }
-  const planMessage = config3.enableTools ? "\u{1F527} Engaging model with tools..." : "\u{1F4AC} Responding with selected model...";
+  const planMessage = config3.autoModelNotice ?? (config3.enableTools ? "\u{1F527} Engaging model with tools..." : "\u{1F4AC} Responding with selected model...");
   const planEvent = emitter.emit("plan", {
     plan: planMessage,
     steps: config3.maxSteps
@@ -368468,7 +368672,7 @@ Continue once without hiding or replacing your prior response.`
   };
 }
 function createOrchestratorRequest(messages4, context3, config3, persona, apiKey, mcpTools, anthropicApiKey, providerBaseUrl, providerAuthToken, codexAuth) {
-  const messageId = context3.messageId || randomUUID12();
+  const messageId = context3.messageId || randomUUID13();
   if (!context3.sessionPathway) {
     throw new Error(
       "sessionPathway is required but not provided. Ensure createSessionPathwaysForAPI() is called in the API route and sessionPathway is passed to createOrchestratorRequest."
@@ -370366,7 +370570,7 @@ var init_skills3 = __esm({
 // src/adapters/cli/subagent.ts
 import { spawn as spawn5 } from "node:child_process";
 import { basename as basename8 } from "node:path";
-import { randomUUID as randomUUID13 } from "node:crypto";
+import { randomUUID as randomUUID14 } from "node:crypto";
 function currentSubagentDepth() {
   const d21 = Number(process.env.USABLE_SUBAGENT_DEPTH ?? 0);
   return Number.isFinite(d21) && d21 > 0 ? Math.floor(d21) : 0;
@@ -370465,7 +370669,7 @@ function publicTask(task) {
   };
 }
 function startCliSubagentTask(input) {
-  const taskId = input.taskId ?? randomUUID13();
+  const taskId = input.taskId ?? randomUUID14();
   const abortController = new AbortController();
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const run2 = input._run ?? runCliSubagent;
@@ -385940,7 +386144,7 @@ var init_todo_checklist = __esm({
 // src/cli/warp-agent.ts
 import { openSync, writeSync } from "node:fs";
 import { basename as basename9 } from "node:path";
-import { randomUUID as randomUUID14 } from "node:crypto";
+import { randomUUID as randomUUID15 } from "node:crypto";
 function isWarpAgentHost() {
   return !!process.env.WARP_CLI_AGENT_PROTOCOL_VERSION && process.platform !== "win32";
 }
@@ -385993,7 +386197,7 @@ var init_warp_agent = __esm({
     "use strict";
     WARP_AGENT_SLUG = "usable-chat";
     APP_NAME = "usable-chat";
-    sessionId = randomUUID14();
+    sessionId = randomUUID15();
   }
 });
 
@@ -391935,7 +392139,7 @@ init_tui_select();
 init_model_registry();
 
 // package.json
-var version2 = "1.210.0";
+var version2 = "1.212.0";
 
 // src/adapters/cli/model-catalog.ts
 init_codex_auth();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usabledev/usable-chat",
-  "version": "1.210.0",
+  "version": "1.212.0",
   "description": "usable-chat — terminal harness for usable-chat (headless + TUI)",
   "type": "module",
   "bin": {