agen-vektor 0.3.25 → 0.3.27

package/README.md

@@ -29,7 +29,7 @@ render cleanly right where you work.*
 
 - **Interactive TUI** — chat, agent status, tool execution, diff viewer, input. Keyboard driven, mouse-aware, works on 80×24 terminals and survives resize. Scroll the chat with PgUp/PgDn, the mouse wheel, or ↑/↓ while the input line is empty.
 - **Agent loop** — plan → inspect → tool call → result → review → fix → retry until done (with an iteration cap).
-- **Tools** — read/write/edit files, list directories, search files, run shell commands, git, fetch web pages, and **live web search out of the box** (no key needed — searches relay through the VectorHead gateway; bring your own Exa/Serper/Brave key to use your own quota).
+- **Tools** — read/write/edit files, list directories, search files, run shell commands, git, fetch web pages, and **live web search out of the box** (no key needed — searches relay through the VectorHead gateway; bring your own Exa/Serper/Brave key to use your own quota). Extensible via **MCP servers** (`mcp__<server>__<tool>`, local stdio JSON-RPC, always permission-ask).
 - **Skills** — 14 bundled, agentskills.io-format skills with progressive disclosure (`list_skills` / `read_skill` tools, `/skills` in the TUI); drop your own into `~/.vector/skills/` or `.agents/skills/`.
 - **Agent files** — SOUL.md / MEMORY.md / USER.md / AGENTS.md auto-seeded in `~/.vector/` and injected into the system prompt (identity, notes, preferences, project rules).
 - **Security first** — command policy classifies every shell command (SAFE / ASK / DANGEROUS / BLOCKED), permission prompts before risky actions, `--yolo` mode with warnings, and API keys are never printed or persisted to sessions.
@@ -158,6 +158,7 @@ Type `/` inside VectorHead — suggestions filter as you type:
 | `/continue` | Continue the current/last session |
 | `/soul` `/memory` `/user` `/agents` | Edit agent files (SOUL/MEMORY/USER/AGENTS.md) |
 | `/skills` | List installed skills |
+| `/mcp` | Probe a configured MCP server and list the tools it provides |
 | `/diff` | Show diff viewer |
 | `/git` | Run `git status` |
 | `/compact` | Compact context (truncate old messages) |
@@ -431,6 +432,43 @@ npm run build
 - Persistent permission rules per project
 - Windows support (WSL-focused)
 
+## MCP (Model Context Protocol)
+
+VectorHead can extend its own toolset with **local MCP servers** — small
+programs spawned on the same device the agent runs on (Termux included),
+speaking JSON-RPC 2.0 over stdio. No SDK, no extra dependencies, no hosting:
+this is the same spawn pattern the `shell` tool uses (detached process group,
+per-request timeouts, kill-on-exit — an exiting VectorHead never leaves
+orphaned MCP processes behind).
+
+Configure servers in `~/.vector/config.json` (mode 0600, so per-server `env`
+secrets stay private):
+
+```json
+{
+  "mcpServers": {
+    "everything": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-everything"],
+      "enabled": true
+    }
+  }
+}
+```
+
+- On startup every enabled server is spawned, the `initialize` handshake
+  completes, and its catalog is imported into the tool registry as
+  `mcp__<server>__<tool>` (e.g. `mcp__everything__echo`) — collision-free
+  with built-in tools.
+- A broken/garbage server is **skipped with a warning** — it can never
+  prevent the agent from starting.
+- `/mcp` in the TUI probes a configured server on demand and lists the tools
+  it would provide.
+- **Trust model:** MCP tools are third-party code. Every MCP tool runs with
+  `permission: 'ask'` — even in `--yolo` mode you approve each call — and
+  results are truncated like shell output. Tool descriptions come from the
+  server and are treated as untrusted data (prompt-injection surface).
+
 ## Changelog
 
 ### 0.3.15

package/dist/agent/agent.js

@@ -19,6 +19,8 @@ const rules_1 = require("./rules");
 const skills_1 = require("./skills");
 const skills_tool_1 = require("../tools/skills-tool");
 const background_1 = require("../tools/background");
+const mcp_1 = require("../tools/mcp");
+const logger_1 = require("../utils/logger");
 class Agent {
     config;
     provider;
@@ -75,10 +77,50 @@ class Agent {
             // output_from_background / stop_background_job).
             ...(0, background_1.createBackgroundTools)(),
         ]);
+        this.initMcpServers();
     }
     async run(request, signal) {
         return this.runLoop(request, [], signal);
     }
+    /**
+     * Spawn configured MCP servers and register their tools. Fire-and-forget
+     * (constructor must stay sync — the CLI path never awaited it): failures
+     * are contained per-server (warn + skip) and a broken MCP server can
+     * never prevent the agent from starting. Registration happens as soon as
+     * each server finishes its handshake.
+     */
+    async initMcpServers() {
+        const servers = this.config.mcpServers ?? {};
+        for (const [id, cfg] of Object.entries(servers)) {
+            if (cfg && cfg.enabled === false)
+                continue;
+            if (!cfg || !cfg.command)
+                continue;
+            void this.initOneMcpServer(id, cfg);
+        }
+    }
+    async initOneMcpServer(id, cfg) {
+        const conn = new mcp_1.McpConnection(id, cfg);
+        try {
+            await conn.connect();
+            const specs = await conn.listTools();
+            this.tools.registerMany((0, mcp_1.mcpToolsFromSpecs)(conn, specs));
+            this.mcpConnections.push(conn);
+        }
+        catch (err) {
+            // One broken MCP server must never take the agent down.
+            conn.close();
+            logger_1.logger.warn(`MCP server "${id}" skipped: ${err.message}`);
+        }
+    }
+    /** Live MCP connections owned by this Agent (closed via dispose()). */
+    mcpConnections = [];
+    /** Tear down MCP server processes (called on TUI exit / new run setup). */
+    dispose() {
+        for (const c of this.mcpConnections)
+            c.close();
+        this.mcpConnections = [];
+    }
     /**
      * Run continuing from a prior conversation (multi-turn continuity).
      * The previous turn's messages are passed as history so the model

package/dist/agent/loop.js

@@ -345,6 +345,7 @@ async function runAgentLoop(userRequest, opts, callbacks = {}) {
                         permissions,
                         onActivity: callbacks.onActivity,
                         maxOutput: 30_000,
+                        signal,
                     });
                 }
                 catch (err) {
@@ -389,6 +390,7 @@ async function runAgentLoop(userRequest, opts, callbacks = {}) {
                         permissions,
                         onActivity: callbacks.onActivity,
                         maxOutput: 30_000,
+                        signal,
                     });
                 }
                 catch (err) {

package/dist/agent/session.js

@@ -103,7 +103,16 @@ function saveSession(name, messages, opts) {
         })),
     }));
     const data = { meta, messages: sanitized };
-    fs.writeFileSync(fileFor(name), JSON.stringify(data, null, 2));
+    // 0600 (security audit 2026-09-13): sessions hold the user's full
+    // conversation history (code paths, project names) — owner read/write only.
+    const p = fileFor(name);
+    fs.writeFileSync(p, JSON.stringify(data, null, 2), { mode: 0o600 });
+    try {
+        fs.chmodSync(p, 0o600);
+    }
+    catch {
+        /* some filesystems (e.g. some Termux setups) ignore chmod */
+    }
 }
 function deleteSession(name) {
     try {

package/dist/cli/index.js

@@ -299,6 +299,9 @@ async function runTui(opts) {
         theme: opts.theme,
         onExit: () => {
             exit = true;
+            // MCP servers are detached process-group spawns (shell.ts pattern) —
+            // they would survive a clean TUI exit as orphans. Tear them down here.
+            agent.dispose();
         },
     });
     app.setPermissionResolver((d) => {
@@ -429,6 +432,13 @@ async function runTui(opts) {
         process.stdout.write(terminal_1.ANSI.showCursor);
         process.stdout.removeListener('resize', onResize);
         cleanup();
+        // Keluar TANPA syarat: dulu proses Node bisa tetap hidup setelah main
+        // loop berakhir — pending ask-permission promise atau child shell yang
+        // masih memegang stdio menjaga event loop tetap menyala dan terminal
+        // tampak "hang setengah keluar" (user harus kill manual, laporan
+        // 2026-09-14). MCP punya orphan guard-nya sendiri; di sini kita cukup
+        // memastikan TIDAK ADA yang menahan proses setelah TUI off.
+        process.exit(0);
     }
 }
 function sleep(ms) {

package/dist/config/config.js

@@ -131,7 +131,15 @@ function loadConfig() {
 }
 function saveConfig(config) {
     (0, paths_1.ensureDirs)();
-    fs.writeFileSync((0, paths_1.getConfigPath)(), JSON.stringify(config, null, 2) + '\n');
+    // 0600 (security audit 2026-09-13): config.json can carry inline provider
+    // options.apiKey for custom providers — same restriction as credentials.json.
+    fs.writeFileSync((0, paths_1.getConfigPath)(), JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+    try {
+        fs.chmodSync((0, paths_1.getConfigPath)(), 0o600);
+    }
+    catch {
+        /* some filesystems (e.g. some Termux setups) ignore chmod */
+    }
 }
 /** Effective config, applying environment variable overrides. */
 function effectiveConfig(base) {

package/dist/config/credentials.js

@@ -146,5 +146,11 @@ function redact(text) {
     return text
         .replace(/(sk-[A-Za-z0-9_-]{8,})/g, 'sk-***REDACTED***')
         .replace(/(Bearer\s+)[A-Za-z0-9._-]{12,}/gi, '$1***REDACTED***')
-        .replace(/(api[_-]?key["']?\s*[:=]\s*["']?)[^"'\s,;]+/gi, '$1***REDACTED***');
+        .replace(/(api[_-]?key["']?\s*[:=]\s*["']?)[^"'\s,;]+/gi, '$1***REDACTED***')
+        // Known vendor token shapes (security audit 2026-09-13): GitHub PATs,
+        // Google API keys, xAI keys, VectorHead gateway admin tokens.
+        .replace(/(ghp_[A-Za-z0-9]{8,}|github_pat_[A-Za-z0-9_]{8,})/g, '***REDACTED***')
+        .replace(/(AIza[A-Za-z0-9_-]{8,})/g, '***REDACTED***')
+        .replace(/(xai-[A-Za-z0-9]{8,})/g, '***REDACTED***')
+        .replace(/(vgadm_[A-Za-z0-9_-]{8,})/g, '***REDACTED***');
 }

package/dist/config/free-tier.js

@@ -66,9 +66,11 @@ exports.FREE_PROVIDER_ID = 'vectorhead-free';
  * (ketemu via smoke test 0.3.22). Router Kilo terverifikasi live end-to-end
  * (chat 200, dijawab dots-3-note-preview:free). Riwayat trap yang sama:
  * `deepseek-ai/DeepSeek-V4-Flash` → `claude-sonnet-4-6` → `glm-5.3-flash`
- * (dua flip 2026-09-06/07) → sekarang kilo-auto/free.
+ * (dua flip 2026-09-06/07) → `kilo-auto/free` (2026-09-13) → **z-ai/glm-5.3-free**
+ * (2026-09-14: katalog gateway tinggal 2 model — `kilo-auto/free` TIDAK lagi
+ * dilayani; default baru terverifikasi live: 1 request → 200 OK, jawaban "hai").
  */
-exports.FREE_DEFAULT_MODEL = 'kilo-auto/free';
+exports.FREE_DEFAULT_MODEL = 'z-ai/glm-5.3-free';
 /** The providers-map entry for the free tier (idempotent — same shape always). */
 function freeProviderDef() {
     // When a catalog has been fetched in this process, the gateway URL and
@@ -94,7 +96,7 @@ function freeProviderDef() {
         },
         model: exports.FREE_DEFAULT_MODEL,
         models: Object.keys(models).length > 0 ? models : {
-            [exports.FREE_DEFAULT_MODEL]: { name: 'Kilo Auto (free)' },
+            [exports.FREE_DEFAULT_MODEL]: { name: 'GLM 5.3 (free)' },
         },
     };
 }
@@ -108,6 +110,7 @@ exports.FREE_LEGACY_MODELS = [
     'deepseek-ai/DeepSeek-V4-Flash',
     'claude-sonnet-4-6',
     'glm-5.3-flash',
+    'kilo-auto/free',
 ];
 /**
  * Ensure the free provider entry exists in the config's providers map

package/dist/tools/git.js

@@ -136,7 +136,7 @@ ${exports.gitCommitGuidePrompt}`,
             if (!allowed) {
                 return { output: `Permission denied by user: ${cmd}` };
             }
-            const res = await (0, shell_1.runShell)(cmd, ctx.cwd, { timeoutMs: 60_000 });
+            const res = await (0, shell_1.runShell)(cmd, ctx.cwd, { timeoutMs: 60_000, signal: ctx.signal });
             const out = [res.stdout, res.stderr].filter(Boolean).join('\n[stderr]\n');
             return {
                 output: `${res.exitCode === 0 ? 'exit 0' : `exit ${res.exitCode ?? '?'}`}${out ? '\n' + out : ''}`,

package/dist/tools/mcp.js

@@ -0,0 +1,419 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpConnection = exports.MCP_CALL_TIMEOUT_MS = exports.MCP_CLIENT_INFO = exports.MCP_PROTOCOL_VERSION = void 0;
+exports.mcpToolName = mcpToolName;
+exports.mcpProbeTools = mcpProbeTools;
+exports.mcpToolsFromSpecs = mcpToolsFromSpecs;
+/**
+ * MCP (Model Context Protocol) client — minimal, zero-dependency.
+ *
+ * Speaks JSON-RPC 2.0 over stdio with LOCAL MCP servers, spawned on the same
+ * device the agent runs on (Termux included). This is exactly the `shell`
+ * tool's spawn pattern: detached process group + killTree + resolve-on-exit.
+ *
+ * Protocol surface implemented (spec 2026-07-28 subset):
+ *   initialize        → protocolVersion + capabilities handshake
+ *   tools/list        → tool catalog (imported into the registry, prefixed)
+ *   tools/call        → execute, result text becomes the loop's tool result
+ *   notifications/*   → accepted and ignored (initialized, cancelled, …)
+ *
+ * Tool MCP = UNTRUSTED third party (konsep.md 2026-09-13): results are
+ * truncated, permissions follow the normal SAFE/ASK/DANGEROUS flow and are
+ * NEVER auto-approved (the tool always declares `permission: 'ask'`).
+ */
+const node_child_process_1 = require("node:child_process");
+/** Wire protocol version we negotiate (MCP spec 2026-07-28). */
+exports.MCP_PROTOCOL_VERSION = '2025-06-18';
+/** Client info reported during the initialize handshake. */
+exports.MCP_CLIENT_INFO = { name: 'vectorhead', version: '0.1.0' };
+/** Fallback handshake timeout — an MCP server that never answers is skipped. */
+const INIT_TIMEOUT_MS = 10_000;
+/** Per-call timeout default for tools/call. */
+exports.MCP_CALL_TIMEOUT_MS = 60_000;
+/** Result text cap returned to the model (mirrors shell tool sizing). */
+const MAX_RESULT_CHARS = 30_000;
+/** All live MCP connections in this process (orphan guard, see exit hook). */
+const liveConnections = new Set();
+/** Registry-facing name: mcp__<server>__<tool> (collision-free, konsep.md). */
+function mcpToolName(server, tool) {
+    return `mcp__${server}__${tool}`;
+}
+function encodeRequest(req) {
+    return JSON.stringify(req) + '\n';
+}
+/**
+ * Extract exactly ONE JSON value from the head of `buf`.
+ * Returns [value, rest] or null when no complete value is buffered yet.
+ * Uses an incremental brace/bracket/string-escape scanner — newline-delimited
+ * framing per the MCP stdio transport, but tolerant of pretty-printed output.
+ */
+function tryParseOne(buf) {
+    let i = 0;
+    const n = buf.length;
+    // skip leading whitespace
+    while (i < n && (buf[i] === ' ' || buf[i] === '\n' || buf[i] === '\r' || buf[i] === '\t'))
+        i++;
+    if (i >= n)
+        return null;
+    const start = i;
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    for (; i < n; i++) {
+        const c = buf[i];
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (c === '\\')
+                escaped = true;
+            else if (c === '"')
+                inString = false;
+            continue;
+        }
+        if (c === '"')
+            inString = true;
+        else if (c === '{' || c === '[')
+            depth++;
+        else if (c === '}' || c === ']') {
+            depth--;
+            if (depth === 0) {
+                const raw = buf.slice(start, i + 1);
+                try {
+                    return { value: JSON.parse(raw), rest: buf.slice(i + 1) };
+                }
+                catch {
+                    return null; // malformed → caller treats the buffer as garbage
+                }
+            }
+        }
+        else if (depth === 0 && c !== '{' && c !== '[') {
+            // Bare scalar (not valid JSON-RPC) — treat as garbage.
+            return null;
+        }
+    }
+    return null; // incomplete
+}
+/**
+ * One-shot helper used by the TUI /config surface and tests: connect,
+ * list tools, shut down. Nothing is left running.
+ */
+async function mcpProbeTools(server, cfg, timeoutMs = INIT_TIMEOUT_MS) {
+    const conn = new McpConnection(server, cfg);
+    try {
+        await conn.connect(timeoutMs);
+        const tools = await conn.listTools(timeoutMs);
+        return { ok: true, tools };
+    }
+    catch (err) {
+        return { ok: false, error: err.message, tools: [] };
+    }
+    finally {
+        conn.close();
+    }
+}
+/**
+ * A live connection to ONE MCP server process. Lifecycle: connect() →
+ * listTools()/callTool() ×N → close(). Every pending request carries its own
+ * timeout so a wedged server can never hang the agent loop.
+ */
+class McpConnection {
+    server;
+    cfg;
+    child = null;
+    nextId = 1;
+    pending = new Map();
+    buf = '';
+    connectReject = null;
+    exitCode = null;
+    closed = false;
+    constructor(server, cfg) {
+        this.server = server;
+        this.cfg = cfg;
+        liveConnections.add(this);
+    }
+    /** Spawn the server process and complete the initialize handshake. */
+    connect(timeoutMs = INIT_TIMEOUT_MS) {
+        return new Promise((resolve, reject) => {
+            if (this.child) {
+                resolve();
+                return;
+            }
+            let settled = false;
+            const done = () => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                this.connectReject = null;
+            };
+            const timer = setTimeout(() => {
+                this.connectReject = null;
+                if (settled)
+                    return;
+                settled = true;
+                this.close();
+                reject(new Error(`MCP server "${this.server}" did not answer initialize within ${timeoutMs}ms`));
+            }, timeoutMs);
+            try {
+                this.child = (0, node_child_process_1.spawn)(this.cfg.command, this.cfg.args ?? [], {
+                    stdio: ['pipe', 'pipe', 'pipe'],
+                    env: { ...process.env, ...(this.cfg.env ?? {}) },
+                    detached: true, // own process group → killTree works (shell.ts pattern)
+                });
+            }
+            catch (err) {
+                done();
+                reject(new Error(`MCP server "${this.server}" failed to spawn: ${err.message}`));
+                return;
+            }
+            this.connectReject = (e) => {
+                done();
+                reject(e);
+            };
+            this.child.stdout?.on('data', (d) => this.onData(d));
+            this.child.stderr?.on('data', () => {
+                // stderr is diagnostics only — deliberately dropped, capped by the
+                // OS pipe; a chatty server cannot OOM us or block the connection.
+            });
+            this.child.on('error', (err) => {
+                const e = new Error(`MCP server "${this.server}" spawn error: ${err.message}`);
+                this.connectReject?.(e);
+                this.failAll(e);
+            });
+            this.child.on('exit', (code) => {
+                this.exitCode = code;
+                const e = new Error(`MCP server "${this.server}" exited (code ${code ?? '?'})`);
+                this.connectReject?.(e);
+                this.failAll(e);
+            });
+            this.send('initialize', {
+                protocolVersion: exports.MCP_PROTOCOL_VERSION,
+                capabilities: {},
+                clientInfo: exports.MCP_CLIENT_INFO,
+            })
+                .then(() => {
+                // Completed-initialization notification (spec: client MUST send
+                // this before any other request after initialize resolves).
+                this.notify('notifications/initialized');
+                done();
+                resolve();
+            })
+                .catch((err) => {
+                done();
+                this.close();
+                reject(err);
+            });
+        });
+    }
+    /** Fetch the server's tool catalog. */
+    async listTools(timeoutMs = INIT_TIMEOUT_MS) {
+        const res = (await this.request('tools/list', {}, timeoutMs));
+        const list = Array.isArray(res?.tools) ? res.tools : [];
+        const out = [];
+        for (const t of list) {
+            if (!t || typeof t.name !== 'string' || !t.name)
+                continue;
+            out.push({
+                server: this.server,
+                name: t.name,
+                description: typeof t.description === 'string' ? t.description : undefined,
+                inputSchema: t.inputSchema && typeof t.inputSchema === 'object' ? t.inputSchema : undefined,
+            });
+        }
+        return out;
+    }
+    /**
+     * Execute a tool call. Returns the concatenated text blocks of the result
+     * (MCP content array), or an "isError" message when the server flags it.
+     */
+    async callTool(tool, args, timeoutMs = this.cfg.timeoutMs ?? exports.MCP_CALL_TIMEOUT_MS) {
+        const res = (await this.request('tools/call', { name: tool, arguments: args }, timeoutMs));
+        const parts = [];
+        for (const block of Array.isArray(res?.content) ? res.content : []) {
+            if (block && typeof block.text === 'string')
+                parts.push(block.text);
+        }
+        let text = parts.join('\n');
+        if (res?.isError)
+            text = text || 'MCP tool reported an error (no detail)';
+        if (!text && res?.structuredContent !== undefined) {
+            try {
+                text = JSON.stringify(res.structuredContent);
+            }
+            catch {
+                /* fall through to empty */
+            }
+        }
+        return { text: truncate(text, MAX_RESULT_CHARS), isError: Boolean(res?.isError), data: res?.structuredContent };
+    }
+    /** Kill the server process (whole process group) and fail pending calls. */
+    close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        liveConnections.delete(this);
+        const e = new Error(`MCP server "${this.server}" connection closed`);
+        this.connectReject?.(e);
+        this.failAll(e);
+        if (this.child && this.child.pid != null) {
+            try {
+                process.kill(-this.child.pid, 'SIGKILL');
+            }
+            catch {
+                /* group already gone */
+            }
+            try {
+                this.child.kill('SIGKILL');
+            }
+            catch {
+                /* already gone */
+            }
+        }
+        this.child = null;
+    }
+    exitCodeOf() {
+        return this.exitCode;
+    }
+    /** PID of the spawned server process (null when not connected). */
+    childPid() {
+        return this.child?.pid ?? null;
+    }
+    // ── internals ──
+    onData(d) {
+        this.buf += d.toString();
+        // Guard: an insane buffer means the server is not speaking JSON-RPC.
+        if (this.buf.length > 4_000_000) {
+            const e = new Error(`MCP server "${this.server}" produced non-JSON output (buffer overflow)`);
+            this.connectReject?.(e);
+            this.failAll(e);
+            this.close();
+            return;
+        }
+        for (;;) {
+            const parsed = tryParseOne(this.buf);
+            if (!parsed)
+                break;
+            this.buf = parsed.rest;
+            const msg = parsed.value;
+            if (msg && typeof msg === 'object' && typeof msg.id === 'number' &&
+                !('method' in msg) // request/notification yang di-echo balik bukan respons
+            ) {
+                if ('result' in msg || 'error' in msg) {
+                    const p = this.pending.get(msg.id);
+                    if (p) {
+                        this.pending.delete(msg.id);
+                        clearTimeout(p.timer);
+                        if (msg.error)
+                            p.reject(new Error(`MCP error ${msg.error.code}: ${msg.error.message}`));
+                        else
+                            p.resolve(msg.result);
+                    }
+                }
+            }
+            // Notifications (method, no id) are intentionally ignored.
+        }
+    }
+    failAll(e) {
+        for (const [, p] of this.pending) {
+            clearTimeout(p.timer);
+            p.reject(e);
+        }
+        this.pending.clear();
+    }
+    request(method, params, timeoutMs) {
+        const id = this.nextId++;
+        const req = { jsonrpc: '2.0', id, method, params };
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                reject(new Error(`MCP server "${this.server}" timed out on ${method} after ${timeoutMs}ms`));
+            }, timeoutMs);
+            this.pending.set(id, { resolve, reject, timer });
+            try {
+                this.child?.stdin?.write(encodeRequest(req));
+            }
+            catch (err) {
+                this.pending.delete(id);
+                clearTimeout(timer);
+                reject(new Error(`MCP server "${this.server}" write failed: ${err.message}`));
+            }
+        });
+    }
+    notify(method, params) {
+        try {
+            this.child?.stdin?.write(JSON.stringify({ jsonrpc: '2.0', method, params }) + '\n');
+        }
+        catch {
+            /* best-effort */
+        }
+    }
+    send(method, params, timeoutMs = INIT_TIMEOUT_MS) {
+        return this.request(method, params, timeoutMs);
+    }
+}
+exports.McpConnection = McpConnection;
+function truncate(text, max) {
+    if (text.length <= max)
+        return text;
+    return text.slice(0, max) + `\n... [truncated ${text.length - max} chars]`;
+}
+// Safety net against ORPHANED MCP servers: every spawned server belongs to its
+// own detached process group, which survives a normal process.exit(). No
+// matter how the agent exits (TUI exit, unhandled error, process.exit in the
+// CLI), live connections are killed here — close() is idempotent.
+process.on('exit', () => {
+    for (const c of liveConnections)
+        c.close();
+});
+// ─── Registry bridge ─────────────────────────────────────────────────────────
+/**
+ * Build registry Tool objects for an MCP server's catalog. Every tool is
+ * permission 'ask' — MCP servers are UNTRUSTED (konsep.md): even in yolo mode
+ * the PermissionManager keeps prompting (see security/permissions.ts).
+ */
+function mcpToolsFromSpecs(conn, specs) {
+    return specs.map((spec) => {
+        const name = mcpToolName(spec.server, spec.name);
+        const description = (spec.description ? spec.description.trim() : '') +
+            `\n\n[Provided by MCP server "${spec.server}" — third-party tool; args follow the server's JSON schema.]`;
+        const parameters = spec.inputSchema && Object.keys(spec.inputSchema).length > 0
+            ? spec.inputSchema
+            : { type: 'object', properties: {}, additionalProperties: true };
+        return {
+            definition: { name, description, parameters },
+            // eslint-disable-next-line @typescript-eslint/no-unused-vars
+            async execute(args, ctx) {
+                ctx.onActivity?.('mcp', `${name} (via MCP server "${spec.server}")`);
+                // Permission gate BEFORE execution (shell.ts/git.ts pattern). The
+                // result-level label below is metadata for the TUI only — it must
+                // never be mistaken for an actual consent check.
+                const allowed = await ctx.permissions.decide({
+                    tool: 'mcp',
+                    summary: `${name} (via MCP server "${spec.server}")`,
+                    level: 'ask',
+                });
+                if (!allowed) {
+                    return {
+                        output: `Permission denied by user:\n${name}`,
+                        summary: `${name} → denied by user`,
+                    };
+                }
+                try {
+                    const r = await conn.callTool(spec.name, args);
+                    return {
+                        output: r.isError ? `MCP tool error: ${r.text}` : r.text,
+                        data: { mcpServer: spec.server, mcpTool: spec.name, structured: r.data },
+                        permission: 'ask',
+                        summary: `${name} → ${r.isError ? 'error' : 'ok'}`,
+                    };
+                }
+                catch (err) {
+                    return {
+                        output: `ERROR: MCP server "${spec.server}" failed: ${err.message}`,
+                        summary: `${name} → mcp failure`,
+                    };
+                }
+            },
+        };
+    });
+}

package/dist/tools/shell.js

@@ -13,6 +13,28 @@ const node_child_process_1 = require("node:child_process");
 // watcher …) would otherwise keep the tool — and the whole agent loop —
 // hanging until the grandchild dies ("sering nyangkut di shell", 2026-09-10).
 const ORPHAN_GRACE_MS = 500;
+// Every in-flight shell is tracked here so a hard exit can never leave one
+// behind ("kadang hang keluar", 2026-09-14): a detached child holding the
+// TTY pipes keeps the Node process alive AFTER the TUI main loop exits —
+// the user sees a half-dead terminal. MCP already guards its servers the
+// same way (mcp.ts orphan guard).
+const activeShells = new Set();
+let exitGuardInstalled = false;
+function installExitGuard() {
+    if (exitGuardInstalled)
+        return;
+    exitGuardInstalled = true;
+    process.on('exit', () => {
+        for (const kill of activeShells) {
+            try {
+                kill();
+            }
+            catch {
+                /* already gone */
+            }
+        }
+    });
+}
 function runShell(command, cwd, opts = {}) {
     return new Promise((resolve) => {
         const timeoutMs = opts.timeoutMs || 120_000;
@@ -46,6 +68,28 @@ function runShell(command, cwd, opts = {}) {
                 /* already gone */
             }
         };
+        // Abort support: when the user interrupts the run (Esc / Ctrl+C) the
+        // whole shell tree is killed immediately and the tool resolves — the
+        // agent loop previously kept AWAITING a command the user had already
+        // abandoned (interrupt felt "macet" until the command finished on its
+        // own, 2026-09-14).
+        const onAbort = () => {
+            timedOut = true; // same reporting as a timeout: killed, not finished
+            killTree();
+            // 'exit' fires once the shell dies and finishes the promise.
+        };
+        if (opts.signal) {
+            if (opts.signal.aborted)
+                onAbort();
+            else
+                opts.signal.addEventListener('abort', onAbort, { once: true });
+        }
+        activeShells.add(killTree);
+        const releaseShell = () => {
+            activeShells.delete(killTree);
+            if (opts.signal)
+                opts.signal.removeEventListener('abort', onAbort);
+        };
         const finish = (code) => {
             if (settled)
                 return;
@@ -53,8 +97,10 @@ function runShell(command, cwd, opts = {}) {
             clearTimeout(timer);
             if (graceTimer)
                 clearTimeout(graceTimer);
+            releaseShell();
             resolve({ stdout, stderr, exitCode: code, timedOut });
         };
+        installExitGuard();
         const timer = setTimeout(() => {
             timedOut = true;
             killTree(); // was: child.kill() only — orphaned children kept the pipe open and the promise hanging past the timeout
@@ -142,6 +188,7 @@ function createShellTool() {
             }
             const result = await runShell(command, ctx.cwd, {
                 timeoutMs: Number(args.timeout_ms) || 120_000,
+                signal: ctx.signal,
             });
             const maxOut = ctx.maxOutput || 30_000;
             let out = '';

package/dist/tui/app.js

@@ -57,6 +57,7 @@ const themes_1 = require("./themes");
 const diff_1 = require("./diff");
 const commands_1 = require("./commands");
 const suggest_1 = require("./suggest");
+const mcp_1 = require("../tools/mcp");
 const provider_1 = require("../providers/provider");
 const planner_1 = require("../agent/planner");
 const extras_1 = require("../tools/extras");
@@ -776,7 +777,13 @@ class App {
             this.markDirty();
             const p = this.pendingPrompt;
             this.pendingPrompt = '';
-            await this.submit(p);
+            // Fire-and-forget: dulu `await this.submit(p)` menjadikan SELURUH agent
+            // run bagian dari tick() — main loop render di cli/index.ts menunggu
+            // di bawahnya, jadi `vector "task"` tampak BEKU (tanpa spinner, tanpa
+            // Working line, tanpa respons keyboard) sampai run selesai. Jalur
+            // Enter/followup lewat handleKey memang fire-and-forget sejak awal;
+            // initial prompt kini disamakan.
+            void this.submit(p).catch(() => { });
         }
         if (this.planToExecute) {
             this.markDirty();
@@ -2159,6 +2166,13 @@ class App {
             case '/settings':
                 this.modal = { type: 'settings' };
                 break;
+            // MCP dialog (konsep.md 2026-09-13): probe each configured server
+            // one-shot (connect → tools/list → close, nothing left running) and
+            // show the result read-only. No server process is ever left behind by
+            // this dialog — live connections belong to the Agent (initMcpServers).
+            case '/mcp':
+                await this.openMcpDialog();
+                break;
             case '/status':
                 this.modal = { type: 'status' };
                 break;
@@ -2570,6 +2584,33 @@ class App {
                     this.modal = { type: 'none' };
                     m.resolve({ allow: true, remember: false });
                 }
+                else if (ev.name === 'ctrl_c') {
+                    // Dulu Ctrl+C di sini DIABAIKAN (handleKey hanya meng-intercept
+                    // saat modal.type === 'none') — modal Permission tampak "macet":
+                    // berapa kali pun ditekan tidak ada yang terjadi, dan user tidak
+                    // bisa menyelamatkan run dari tool yang mau dieksekusi. Kini
+                    // Ctrl+C menolak izin SEKALIGUS menghentikan run (konvensi
+                    // interrupt), lalu arm exit 2-detik persis jalur Ctrl+C biasa.
+                    const m = modal;
+                    this.modal = { type: 'none' };
+                    m.resolve({ allow: false, remember: false });
+                    const now = Date.now();
+                    this.ctrlCArmed = true;
+                    this.ctrlCArmedAt = now;
+                    setTimeout(() => {
+                        if (this.ctrlCArmedAt === now)
+                            this.ctrlCArmed = false;
+                    }, App.CTRL_C_WINDOW_MS);
+                    if (this.running) {
+                        this.wasAbortedByUser = true;
+                        this.abortController?.abort();
+                        this.status = 'Stopping…';
+                        this.statusColor = terminal_1.ANSI.yellow;
+                        this.running = false;
+                        this.applyInterruptionNotice();
+                        this.addSystem('Interrupted — press Ctrl+C once more within 2s to exit.');
+                    }
+                }
                 else if (ev.name === 'escape' || (ev.name === 'char' && (ev.char === 'n' || ev.char === 'N'))) {
                     const m = modal;
                     this.modal = { type: 'none' };
@@ -2838,6 +2879,54 @@ class App {
         }
     }
     // ─── Message helpers ──────────────────────────────────────────
+    /**
+     * /mcp dialog: probe every configured MCP server one-shot (konsep.md
+     * 2026-09-13). Uses mcpProbeTools (connect → tools/list → close) so the
+     * dialog NEVER leaves a server process running — live connections belong
+     * to the Agent. Per-server failures are contained (warn + skip); the
+     * probe timeout is 6s so a wedged server can't freeze the TUI for long.
+     */
+    async openMcpDialog() {
+        const servers = Object.entries(this.agent.config.mcpServers ?? {});
+        if (servers.length === 0) {
+            this.addSystem('MCP: no servers configured. Add one to ~/.vector/config.json:\n' +
+                '  "mcpServers": { "everything": { "command": "npx",\n' +
+                '    "args": ["-y", "@modelcontextprotocol/server-everything"] } }');
+            return;
+        }
+        this.addSystem(`MCP: probing ${servers.length} server(s)…`);
+        const lines = [];
+        for (const [id, cfg] of servers) {
+            if (!cfg || !cfg.command) {
+                lines.push(`  ${id}: (no command — skipped)`);
+                continue;
+            }
+            if (cfg.enabled === false) {
+                lines.push(`  ${id}: disabled (cfg.enabled=false)`);
+                continue;
+            }
+            const t0 = Date.now();
+            const probe = await (0, mcp_1.mcpProbeTools)(id, cfg, 6000);
+            const ms = Date.now() - t0;
+            if (!probe.ok) {
+                lines.push(`  ${id}: FAILED (${ms}ms) — ${probe.error ?? 'unknown error'}`);
+                continue;
+            }
+            const args = cfg.args?.length ? ` ${cfg.args.join(' ')}` : '';
+            lines.push(`  ${id}: ok (${ms}ms) — command: ${cfg.command}${args}`);
+            if (probe.tools.length === 0) {
+                lines.push('    tools: (none advertised)');
+            }
+            else {
+                for (const t of probe.tools) {
+                    lines.push(`    - ${(0, mcp_1.mcpToolName)(id, t.name)}${t.description ? ` — ${t.description.split('\n')[0]}` : ''}`);
+                }
+            }
+        }
+        lines.push('');
+        lines.push('Registered tools stay permission: ask — MCP tools are never auto-approved.');
+        this.modal = { type: 'text', title: 'MCP servers', body: lines };
+    }
     addSystem(text) {
         this.markDirty();
         this.messages.push({ kind: 'system', content: text, ts: Date.now() });

package/dist/tui/commands.js

@@ -25,6 +25,7 @@ exports.COMMANDS = [
     { id: 'session', description: 'manage sessions (list / switch)' },
     { id: 'session-name', description: 'set session name (arg optional)' },
     { id: 'settings', description: 'view settings (provider, model, limits, files)' },
+    { id: 'mcp', description: 'MCP servers — probe config, list tools per server' },
     { id: 'status', description: 'agent status (running, cwd, session)' },
     { id: 'clear', description: 'clear chat (keep the same session id)' },
     { id: 'new', description: 'fresh conversation — new session id (old one saved)' },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agen-vektor",
-  "version": "0.3.25",
+  "version": "0.3.27",
   "description": "VectorHead (agen-vektor) — AI Coding Agent CLI/TUI for Linux & Termux. Multi-provider, tool calling, session, permission system.",
   "type": "commonjs",
   "bin": {