cascade-ai 0.54.0 → 0.55.0

package/dist/cli.js

@@ -1746,7 +1746,7 @@ var CASCADE_VERSION, CASCADE_CONFIG_FILE, CASCADE_DB_FILE, CASCADE_DASHBOARD_SEC
 var init_constants = __esm({
   "src/constants.ts"() {
     init_pricing();
-    CASCADE_VERSION = "0.54.0";
+    CASCADE_VERSION = "0.55.0";
     CASCADE_CONFIG_FILE = ".cascade/config.json";
     CASCADE_DB_FILE = ".cascade/memory.db";
     CASCADE_DASHBOARD_SECRET_FILE = ".cascade/dashboard-secret";
@@ -5389,6 +5389,102 @@ function mergeGlobalCredentials(workspaceProviders, globalProviders) {
   }
   return merged;
 }
+var MCP_TOOL_PREFIX = "mcp__";
+var MAX_SEGMENT_LENGTH = 24;
+var SEGMENT_HASH_LENGTH = 8;
+function boundedSegment(raw) {
+  const clean = sanitizeToolNameSegment(raw);
+  if (clean.length <= MAX_SEGMENT_LENGTH) return clean;
+  const hash = createHash("sha256").update(raw, "utf8").digest("hex").slice(0, SEGMENT_HASH_LENGTH);
+  return `${clean.slice(0, MAX_SEGMENT_LENGTH - SEGMENT_HASH_LENGTH - 1)}_${hash}`;
+}
+function isStableSegment(raw) {
+  return sanitizeToolNameSegment(raw) === raw && raw.length <= MAX_SEGMENT_LENGTH;
+}
+function sanitizeToolNameSegment(segment) {
+  const cleaned = segment.replace(/[^a-zA-Z0-9-]+/g, "_");
+  let start = 0;
+  let end = cleaned.length;
+  while (start < end && cleaned[start] === "_") start++;
+  while (end > start && cleaned[end - 1] === "_") end--;
+  return cleaned.slice(start, end) || "_";
+}
+function mcpToolName(serverName, toolName) {
+  return `${MCP_TOOL_PREFIX}${boundedSegment(serverName)}__${boundedSegment(toolName)}`;
+}
+function isMcpToolName(name) {
+  return name.startsWith(MCP_TOOL_PREFIX);
+}
+function uniqueMcpServerName(desired, existingNames) {
+  const taken = new Set(existingNames.map(mcpServerPrefix));
+  if (!taken.has(mcpServerPrefix(desired))) return desired;
+  for (let n = 2; n < 1e3; n++) {
+    const candidate = `${desired} (${n})`;
+    if (!taken.has(mcpServerPrefix(candidate))) return candidate;
+  }
+  return `${desired} (${randomUUID().slice(0, 8)})`;
+}
+function disambiguateMcpServerNames(servers) {
+  const seenNames = [];
+  const renames = [];
+  const result = servers.map((s) => {
+    const name = uniqueMcpServerName(s.name, seenNames);
+    seenNames.push(name);
+    if (name === s.name) return s;
+    renames.push({ from: s.name, to: name });
+    return { ...s, name };
+  });
+  return { servers: renames.length ? result : servers, renames };
+}
+function assignMcpToolNames(tools) {
+  const names = new Array(tools.length);
+  const bases = tools.map((t) => mcpToolName(t.server, t.tool));
+  const groups = /* @__PURE__ */ new Map();
+  bases.forEach((base, i) => {
+    const g = groups.get(base);
+    if (g) g.push(i);
+    else groups.set(base, [i]);
+  });
+  const used = new Set(bases);
+  for (const [base, idx] of groups) {
+    if (idx.length === 1) {
+      names[idx[0]] = base;
+      continue;
+    }
+    const raw = (i) => `${tools[i].server}::${tools[i].tool}`;
+    const isClean = (i) => isStableSegment(tools[i].server) && isStableSegment(tools[i].tool);
+    const ordered = [...idx].sort((a, b) => {
+      const la = isClean(a) ? 0 : 1;
+      const lb = isClean(b) ? 0 : 1;
+      if (la !== lb) return la - lb;
+      const ra = raw(a);
+      const rb = raw(b);
+      return ra < rb ? -1 : ra > rb ? 1 : 0;
+    });
+    names[ordered[0]] = base;
+    let n = 2;
+    for (let rank3 = 1; rank3 < ordered.length; rank3++) {
+      let candidate = `${base}_${n}`;
+      while (used.has(candidate)) {
+        n++;
+        candidate = `${base}_${n}`;
+      }
+      names[ordered[rank3]] = candidate;
+      used.add(candidate);
+      n++;
+    }
+  }
+  return names;
+}
+function mcpServerPrefix(serverName) {
+  return `${MCP_TOOL_PREFIX}${boundedSegment(serverName)}__`;
+}
+function removeMcpServerDenials(disabledTools, serverName) {
+  if (!disabledTools?.length) return disabledTools;
+  const prefix = mcpServerPrefix(serverName);
+  const kept = disabledTools.filter((t) => !t.startsWith(prefix));
+  return kept.length === disabledTools.length ? disabledTools : kept;
+}
 
 // src/config/index.ts
 init_constants();
@@ -5412,6 +5508,13 @@ var ConfigManager = class {
   }
   async load() {
     this.config = await this.loadConfig();
+    const servers = this.config.tools?.mcpServers;
+    const { servers: disambiguated, renames } = servers?.length ? disambiguateMcpServerNames(servers) : { servers, renames: [] };
+    const mcpNamesChanged = renames.length > 0;
+    if (mcpNamesChanged && this.config.tools) {
+      this.config.tools.mcpServers = disambiguated;
+      this.renameMcpServerReferences(renames);
+    }
     this.ignore = new CascadeIgnore();
     await this.ignore.load(this.workspacePath);
     this.cascadeMd = await loadCascadeMd(this.workspacePath);
@@ -5420,6 +5523,7 @@ var ConfigManager = class {
     await this.injectEnvKeys();
     this.config.providers = mergeGlobalCredentials(this.config.providers, loadGlobalCredentials(this.globalDir));
     await this.ensureDefaultIdentity();
+    if (mcpNamesChanged) await this.save();
   }
   getConfig() {
     return this.config;
@@ -5503,6 +5607,66 @@ var ConfigManager = class {
       this.config.providers.push({ type: "ollama" });
     }
   }
+  /**
+   * Follow a disambiguation rename into `tools.mcpTrusted`.
+   *
+   * `mcpTrusted` is matched by EXACT name (`McpClient.connect()`). Two shapes
+   * of rename reach here, and they need OPPOSITE treatment:
+   *
+   * - Distinct raw names that only collide via sanitizing (`foo bar` /
+   *   `foo@bar`): each had its OWN trust entry, and the old string now belongs
+   *   to nothing — the server that used it moved away, so the entry has to
+   *   move with it. A plain rewrite is correct here.
+   * - Literally identical names (a hand-edited or duplicated config: two rows
+   *   both named `foo`): there is only ONE trust entry for both, since
+   *   `mcpTrusted` itself is deduplicated. `this.config.tools.mcpServers` has
+   *   already been updated to the disambiguated list by the time this runs
+   *   (see `load()`), so the untouched survivor is STILL named `foo` — a plain
+   *   rewrite would move the one entry entirely onto the renamed row and
+   *   leave the survivor untrusted. The entry must be kept for the survivor
+   *   AND granted to the renamed identity, not moved.
+   *
+   * Renames are grouped by `from` before either treatment is applied, and
+   * each group is settled in one step. Two DIFFERENT rows can start out with
+   * the exact same raw name and BOTH get renamed away (e.g. three servers
+   * named `foo bar`, `foo@bar`, `foo@bar` — the two `foo@bar` rows collide
+   * with `foo bar` and with each other, so both are renamed to distinct
+   * identities while `foo bar` survives untouched). Processing renames one at
+   * a time in that shape drops coverage: the first rename's REPLACE branch
+   * would erase `from` from `trusted` entirely, so the guard on the second
+   * rename with the same `from` sees it already gone and silently skips —
+   * granting trust to only one of the two renamed identities. Grouping first
+   * means every renamed identity that shares a `from` is added or substituted
+   * together, in the one pass that still sees the original entry.
+   *
+   * `tools.disabledTools` deliberately gets no equivalent treatment. It's
+   * matched by sanitized PREFIX, and a prefix collision is exactly what made
+   * an existing entry ambiguous between the two servers in the first place —
+   * there is no way to tell, from the stored string alone, which of the two
+   * a denial was meant for. Leaving those entries untouched resolves that
+   * ambiguity for free: the survivor keeps the original (now unique) prefix,
+   * so an old entry keeps applying to it, while the renamed server starts
+   * clean under its new prefix. Rewriting the entry to follow the rename
+   * would do the opposite — move a denial that already worked for the
+   * survivor onto a server it may never have meant to cover.
+   */
+  renameMcpServerReferences(renames) {
+    const tools = this.config.tools;
+    if (!tools?.mcpTrusted?.length || !renames.length) return;
+    const currentNames = new Set((tools.mcpServers ?? []).map((s) => s.name));
+    const byFrom = /* @__PURE__ */ new Map();
+    for (const { from, to } of renames) {
+      const tos = byFrom.get(from);
+      if (tos) tos.push(to);
+      else byFrom.set(from, [to]);
+    }
+    let trusted = tools.mcpTrusted;
+    for (const [from, tos] of byFrom) {
+      if (!trusted.includes(from)) continue;
+      trusted = currentNames.has(from) ? [...trusted, ...tos] : [...trusted.filter((n) => n !== from), ...tos];
+    }
+    tools.mcpTrusted = Array.from(new Set(trusted));
+  }
   async ensureDefaultIdentity() {
     const existing = this.store.getDefaultIdentity();
     if (existing) return;
@@ -5518,26 +5682,6 @@ var ConfigManager = class {
   }
 };
 
-// src/tools/tool-name.ts
-var MCP_TOOL_PREFIX = "mcp__";
-function sanitizeToolNameSegment(segment) {
-  const cleaned = segment.replace(/[^a-zA-Z0-9-]+/g, "_");
-  let start = 0;
-  let end = cleaned.length;
-  while (start < end && cleaned[start] === "_") start++;
-  while (end > start && cleaned[end - 1] === "_") end--;
-  return cleaned.slice(start, end) || "_";
-}
-function mcpToolName(serverName, toolName) {
-  return `${MCP_TOOL_PREFIX}${sanitizeToolNameSegment(serverName)}__${sanitizeToolNameSegment(toolName)}`;
-}
-function isMcpToolName(name) {
-  return name.startsWith(MCP_TOOL_PREFIX);
-}
-function mcpServerPrefix(serverName) {
-  return `${MCP_TOOL_PREFIX}${sanitizeToolNameSegment(serverName)}__`;
-}
-
 // src/cli/utils/terminal-input.ts
 var PASTE_START = "\x1B[200~";
 var PASTE_END = "\x1B[201~";
@@ -6983,6 +7127,23 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
    */
   budgetState = "ok";
   budgetExceededReason;
+  /**
+   * Whether the run/session budget is permanently tripped, and why.
+   *
+   * A tier or worker that catches `BudgetExceededError` internally (T3Worker
+   * does, so one dead-end subtask doesn't crash the whole run) absorbs the
+   * exception into a normal FAILED/PARTIAL result — the tier returns as if
+   * nothing unusual happened. That silently skips `Cascade.run()`'s dedicated
+   * budget-exceeded handling (the `run:budget-exceeded` event and
+   * `lastInterruptedRun` for `/continue`). This lets a caller check the
+   * router's own state directly after a tier returns, regardless of how that
+   * tier chose to report the error internally.
+   */
+  budgetExceededInfo() {
+    if (this.runBudgetExceeded) return { reason: this.runBudgetExceededReason ?? "Per-task budget exceeded." };
+    if (this.budgetState === "exceeded") return { reason: this.budgetExceededReason ?? "Session budget exceeded." };
+    return null;
+  }
   tpmLimiter;
   localQueue;
   taskAnalyzer;
@@ -8641,6 +8802,13 @@ Now execute your subtask using this context where relevant.`
         this.peerBus?.publish(this.id, assignment.subtaskId, finalOutput2, "FAILED");
         return this.buildResult("ESCALATED", finalOutput2, { checksRun, passed, failed }, issues, correctionAttempts);
       }
+      if (err instanceof Error && err.name === "BudgetExceededError") {
+        issues.push(errMsg);
+        const stopped = output || errMsg;
+        this.setStatus("FAILED", stopped);
+        this.peerBus?.publish(this.id, assignment.subtaskId, stopped, "FAILED");
+        return this.buildResult("FAILED", stopped, { checksRun, passed, failed }, issues, correctionAttempts);
+      }
       issues.push(`Execution error: ${errMsg}`);
       const finalOutput = output || errMsg;
       this.setStatus("FAILED", finalOutput);
@@ -9662,6 +9830,26 @@ var RedactionLayer = class {
   }
 };
 
+// src/core/tiers/escalation-policy.ts
+function sectionNeedsDecision(results) {
+  return results.some((r) => r.status === "ESCALATED");
+}
+function settledEscalationStatus(results) {
+  const hasWork = results.some((r) => r.status === "COMPLETED" || !!r.output);
+  return hasWork ? "PARTIAL" : "FAILED";
+}
+function composeRootSectionOutput(t2Result, completedOutputs) {
+  let output = `${t2Result.sectionSummary}
+
+${completedOutputs.join("\n\n")}`;
+  if (t2Result.status === "FAILED" && t2Result.issues?.length) {
+    output += `
+
+_(incomplete: ${t2Result.issues.join("; ")})_`;
+  }
+  return output;
+}
+
 // src/core/tiers/t2-manager.ts
 function buildT2SystemPrompt(hasPeerMessage) {
   return [
@@ -9687,6 +9875,19 @@ var T2Manager = class extends BaseTier {
   t2PeerBus;
   permissionEscalator;
   toolCreator;
+  /**
+   * Asked when a section ends ESCALATED — i.e. a worker hit something it could
+   * not decide alone. Without this the escalation was a dead end: the status
+   * said "needs a decision" and no decision was ever requested, so an MCP run
+   * that legitimately needed input just stopped there.
+   */
+  escalationCallback;
+  /**
+   * The one allowed retry has been spent. Retrying is bounded because an
+   * escalation loop that can re-ask forever burns a budget on a question that
+   * is not resolving; a second escalation is terminal instead.
+   */
+  escalationRetryUsed = false;
   /** Optional boardroom gate (Moderate / root-T2 runs) — pauses after decomposition. */
   planApprovalCallback;
   /** AbortController for the current T3 wave — aborted on cancel-and-respawn */
@@ -9735,6 +9936,10 @@ var T2Manager = class extends BaseTier {
   setToolCreator(creator) {
     this.toolCreator = creator;
   }
+  /** Ask the user what to do when a section escalates. */
+  setEscalationCallback(cb) {
+    this.escalationCallback = cb;
+  }
   /** Boardroom gate for Moderate (root-T2) runs: pause after decomposition. */
   setPlanApprovalCallback(cb) {
     this.planApprovalCallback = cb;
@@ -9839,9 +10044,57 @@ Guidance (must be followed): ${decision.note}`
         currentAction: "Aggregating T3 results",
         status: "IN_PROGRESS"
       });
-      const summary = await this.aggregateResults(assignment, t3Results);
+      let summary = await this.aggregateResults(assignment, t3Results);
       const issues = t3Results.filter((r) => r.status !== "COMPLETED").flatMap((r) => r.issues);
-      const overallStatus = this.determineStatus(t3Results);
+      let overallStatus = this.determineStatus(t3Results);
+      let userSkipped = false;
+      const hasEscalated = sectionNeedsDecision(t3Results);
+      const settleEscalated = async (reason) => {
+        if (reason) issues.push(reason);
+        summary = await this.aggregateResults(assignment, t3Results, { includeEscalated: true });
+        overallStatus = settledEscalationStatus(t3Results);
+      };
+      if (hasEscalated && this.escalationCallback && this.escalationRetryUsed) {
+        await settleEscalated("Escalated again after the retry \u2014 no further attempts were made.");
+      } else if (hasEscalated && !this.escalationCallback) {
+        await settleEscalated();
+      } else if (hasEscalated && this.escalationCallback) {
+        this.sendStatusUpdate({
+          progressPct: 95,
+          currentAction: "Escalated \u2014 waiting for your decision",
+          status: "ESCALATING"
+        });
+        const decision = await this.escalationCallback({
+          sectionId: assignment.sectionId,
+          sectionTitle: assignment.sectionTitle,
+          issues,
+          summary
+        });
+        this.log(`Escalation decision for "${assignment.sectionTitle}": ${decision.action}`);
+        if (decision.action === "skip") {
+          summary = await this.aggregateResults(assignment, t3Results, { includeEscalated: true });
+          overallStatus = settledEscalationStatus(t3Results);
+          userSkipped = decision.automatic !== true;
+        } else if (decision.action === "retry" || decision.action === "guidance") {
+          this.escalationRetryUsed = true;
+          const guided = decision.action === "guidance" && decision.note?.trim() ? {
+            ...assignment,
+            description: `${assignment.description}
+
+Guidance (must be followed): ${decision.note.trim()}`,
+            // Drop T1's preplanned subtasks so the retry re-decomposes with
+            // the guidance in hand. The workers execute from their subtask
+            // slices, not from this description — leaving the slices in
+            // place gave "Retry with guidance" byte-identical worker
+            // prompts to "Retry as-is", making the note do nothing at all.
+            t3Subtasks: []
+          } : assignment;
+          return await this.execute(guided, taskId, signal);
+        } else {
+          issues.push("Escalated, but no decision was received in time.");
+          overallStatus = "FAILED";
+        }
+      }
       const isOk = overallStatus === "COMPLETED" || overallStatus === "PARTIAL";
       this.setStatus(isOk ? "COMPLETED" : "FAILED", summary);
       const sectionAction = overallStatus === "COMPLETED" ? "Section complete" : overallStatus === "PARTIAL" ? "Section partially complete \u2014 some subtasks failed" : overallStatus === "ESCALATED" ? "Section escalated \u2014 needs a decision" : "Section failed \u2014 no subtask completed";
@@ -9852,7 +10105,8 @@ Guidance (must be followed): ${decision.note}`
         status: overallStatus,
         t3Results,
         sectionSummary: summary,
-        issues
+        issues,
+        ...userSkipped ? { userSkipped: true } : {}
       };
       this.publishSectionOutput(result);
       return result;
@@ -10286,8 +10540,10 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : ""),
       result.status === "COMPLETED" ? "COMPLETED" : "FAILED"
     );
   }
-  async aggregateResults(assignment, results) {
-    const completed = results.filter((r) => r.status === "COMPLETED");
+  async aggregateResults(assignment, results, opts = {}) {
+    const completed = results.filter(
+      (r) => r.status === "COMPLETED" || opts.includeEscalated && r.status === "ESCALATED" && r.output
+    );
     if (!completed.length) return `Section ${assignment.sectionTitle} failed \u2014 no T3 workers completed.`;
     const peerOutputs = this.peerSyncBuffer.filter((p) => p.content?.type === "T2_SECTION_OUTPUT").map((p) => `[Peer ${p.fromId} Output]: ${p.content.output}`).join("\n\n");
     const peerContext = peerOutputs ? `
@@ -10496,6 +10752,7 @@ var T1Administrator = class extends BaseTier {
   escalations = [];
   store;
   runBreaker;
+  escalationCallback;
   t2PeerBus = new PeerBus();
   permissionEscalator;
   toolCreator;
@@ -10510,6 +10767,10 @@ var T1Administrator = class extends BaseTier {
     this.toolRegistry = toolRegistry;
     this.config = config;
   }
+  /** Ask the user what to do when any section escalates. */
+  setEscalationCallback(cb) {
+    this.escalationCallback = cb;
+  }
   /** Share the run-wide circuit breaker with every section manager. */
   setRunBreaker(breaker) {
     this.runBreaker = breaker;
@@ -10669,8 +10930,11 @@ Create a CORRECTION PLAN that contains only the new sections needed to fix the i
         reason: `Some T2 managers failed entirely: ${failedSections.map((s) => s.sectionTitle).join(", ")}. Errors: ${failedSections.flatMap((s) => s.issues).join("; ")}`
       };
     }
-    const sectionsText = t2Results.map((r) => `**${r.sectionTitle}**
-${r.sectionSummary}`).join("\n\n");
+    const sectionsText = t2Results.map((r) => {
+      const skipNote = r.userSkipped ? "\n[The user was asked to retry or skip this section and explicitly chose to SKIP it. This is an intentional decision, not a failure \u2014 do not cite it as a reason to reject.]" : "";
+      return `**${r.sectionTitle}**
+${r.sectionSummary}${skipNote}`;
+    }).join("\n\n");
     const prompt = `You are a strict QA Reviewer for the Cascade AI system.
 Review the following execution outputs against the original user prompt.
 
@@ -10680,6 +10944,7 @@ T2 Manager Summaries:
 ${sectionsText}
 
 Does the current state of the workspace and the outputs fully satisfy the user's request?
+A section marked as user-skipped above is accepted as-is by the user's own choice \u2014 treat it as satisfied, not as a gap.
 If yes, reply with exactly: "APPROVED".
 If no, reply with "REJECTED: [Detailed reason explaining exactly what is missing or incorrect]".`;
     try {
@@ -10877,6 +11142,7 @@ SPEC RULES \u2014 each subtask is a self-contained spec slice (workers execute f
     const managers = sections.map((section) => {
       const manager = new T2Manager(this.router, this.toolRegistry, this.id);
       if (this.runBreaker) manager.setRunBreaker(this.runBreaker);
+      if (this.escalationCallback) manager.setEscalationCallback(this.escalationCallback);
       manager.setHierarchyContext(`You are a T2 Manager for the section "${section.sectionTitle}". You are part of a COMPLEX task overseen by T1 Administrator.`);
       if (this.store) {
         manager.setStore(this.store);
@@ -11086,7 +11352,10 @@ SPEC RULES \u2014 each subtask is a self-contained spec slice (workers execute f
   async compileFinalOutput(originalPrompt, plan, t2Results) {
     const completedSections = t2Results.filter((r) => r.status !== "FAILED");
     if (!completedSections.length) {
-      const allIssues = t2Results.flatMap((r) => r.t3Results.flatMap((t) => t.issues));
+      const allIssues = [
+        ...t2Results.flatMap((r) => r.issues ?? []),
+        ...t2Results.flatMap((r) => r.t3Results.flatMap((t) => t.issues))
+      ].filter(Boolean);
       const critical = allIssues.find((i) => i.includes("[CRITICAL_TOOL_ERROR]"));
       const stalled = allIssues.find((i) => /^Stalled:/.test(i));
       const topReason = critical ?? stalled ?? allIssues[0] ?? "no specific reason recorded";
@@ -13325,12 +13594,12 @@ var McpToolWrapper = class extends BaseTool {
   mcpClient;
   serverName;
   toolName;
-  constructor(mcpClient, serverName, toolName, description, inputSchema) {
+  constructor(mcpClient, serverName, toolName, description, inputSchema, registeredName) {
     super();
     this.mcpClient = mcpClient;
     this.serverName = serverName;
     this.toolName = toolName;
-    this.name = mcpToolName(serverName, toolName);
+    this.name = registeredName ?? mcpToolName(serverName, toolName);
     this.description = `[MCP:${serverName}] ${description}`;
     this.inputSchema = inputSchema;
   }
@@ -13401,22 +13670,35 @@ var ToolRegistry = class extends EventEmitter {
   getRegisteredPlugins() {
     return Array.from(this.plugins.keys());
   }
-  /** Registers all tools from an MCP client */
-  registerMcpTools(mcpClient) {
-    const definitions = mcpClient.getToolDefinitions();
-    for (const def of definitions) {
-      const [, serverName, toolName] = def.name.split("::");
-      if (!serverName || !toolName) continue;
+  /**
+   * Registers all tools from an MCP client.
+   *
+   * `isAllowed` receives the FINAL registered name (`mcp__server__tool`) — the
+   * same string the user sees and the same one that reaches the provider — so
+   * a per-tool opt-out in Settings can be expressed as a plain name list.
+   * Filtering here rather than at call time means a deselected tool is genuinely
+   * absent from the definitions handed to the model, so it is never proposed,
+   * never counted against the tool budget, and never has to be refused.
+   */
+  registerMcpTools(mcpClient, isAllowed) {
+    const parsed = mcpClient.getToolDefinitions().flatMap((def) => {
+      const [, server, tool] = def.name.split("::");
+      return server && tool ? [{ def, server, tool }] : [];
+    });
+    const names = assignMcpToolNames(parsed);
+    parsed.forEach(({ def, server, tool }, i) => {
       const wrapper = new McpToolWrapper(
         mcpClient,
-        serverName,
-        toolName,
-        def.description.replace(`[MCP:${serverName}] `, ""),
-        def.inputSchema
+        server,
+        tool,
+        def.description.replace(`[MCP:${server}] `, ""),
+        def.inputSchema,
+        names[i]
       );
+      if (isAllowed && !isAllowed(wrapper.name)) return;
       wrapper.setWorkspaceRoot(this.workspaceRoot);
       this.register(wrapper);
-    }
+    });
   }
   setIgnoredPaths(patterns) {
     this.ignoreMatcher = ignore2().add(patterns);
@@ -13753,6 +14035,17 @@ function fileOAuthProvider(storePath) {
     }
   });
 }
+var oauthStoreLocks = /* @__PURE__ */ new Map();
+function withOAuthStoreLock(storePath, fn) {
+  const prev = oauthStoreLocks.get(storePath) ?? Promise.resolve();
+  const run = prev.then(fn, fn);
+  const tail = run.then(() => void 0, () => void 0);
+  oauthStoreLocks.set(storePath, tail);
+  void tail.then(() => {
+    if (oauthStoreLocks.get(storePath) === tail) oauthStoreLocks.delete(storePath);
+  });
+  return run;
+}
 async function connectMcpWithLoopbackOAuth(opts) {
   const listener = await startCallbackListener(opts);
   const transport = new StreamableHTTPClientTransport(new URL(opts.serverUrl), {
@@ -16233,7 +16526,50 @@ var GuidanceQueue = class {
   }
 };
 
+// src/tools/current-page.ts
+var MAX_PAGE_TEXT_CHARS = 4e4;
+var CurrentPageTool = class extends BaseTool {
+  name = "read_current_page";
+  description = 'Read the web page the user currently has open in the built-in browser \u2014 its URL, title, and visible text. Use this whenever the user refers to "this page", "what I am looking at", or asks about something on screen. Prefer it over web_fetch for the open page: it sees content behind a login and content rendered by JavaScript, which web_fetch cannot.';
+  inputSchema = {
+    type: "object",
+    properties: {},
+    required: []
+  };
+  provider;
+  constructor(provider) {
+    super();
+    this.provider = provider;
+  }
+  // Reading what is already on the user's screen changes nothing and reaches
+  // nothing they have not already opened themselves.
+  isDangerous() {
+    return false;
+  }
+  async execute(_input, _options) {
+    let page2;
+    try {
+      page2 = await this.provider();
+    } catch (err) {
+      return `Error: could not read the open page \u2014 ${err instanceof Error ? err.message : String(err)}`;
+    }
+    if (!page2) {
+      return "No page is open in the built-in browser. Ask the user to open one, or use web_fetch for a public URL.";
+    }
+    const text = page2.text.length > MAX_PAGE_TEXT_CHARS ? `${page2.text.slice(0, MAX_PAGE_TEXT_CHARS)}
+
+[truncated \u2014 the page is longer than ${MAX_PAGE_TEXT_CHARS} characters]` : page2.text;
+    return [
+      `URL: ${page2.url}`,
+      `Title: ${page2.title}`,
+      "",
+      text.trim() || "[the page rendered no readable text]"
+    ].join("\n");
+  }
+};
+
 // src/core/cascade.ts
+var ESCALATION_DECISION_TIMEOUT_MS = 5 * 6e4;
 function buildContextualPrompt(prompt, history = []) {
   const recent = history.slice(-6);
   if (recent.length === 0) return prompt;
@@ -16456,6 +16792,94 @@ var Cascade = class _Cascade extends EventEmitter {
       });
     });
   }
+  // ── Escalation decisions ────────────────────────────────────────────
+  //
+  // A section that ends ESCALATED used to be a dead end: the Cockpit showed
+  // "Section escalated — needs a decision" and no decision was ever requested,
+  // so the run stopped there having spent a full orchestration. This is the
+  // same round-trip shape as plan approval, with one deliberate difference —
+  // an unanswered escalation FAILS the section instead of proceeding.
+  //
+  // That direction is the safe one here. Plan approval defaults to "yes" on
+  // timeout because the plan is already the model's considered proposal;
+  // an escalation exists precisely BECAUSE the worker was not confident, so
+  // acting unattended is the option most likely to be wrong. And in cloud a
+  // waiting run holds server resources, so hanging is not free either.
+  // Keyed by request id, NOT a single slot. A Complex run dispatches each wave
+  // of ready sections with `Promise.all` (t1-administrator.ts), so two sections
+  // can be waiting on a decision at the same moment. A single field made that
+  // case fail hard rather than merely confusingly: the second escalation
+  // overwrote the first's resolver, the user's answer resolved only the second,
+  // and then the FIRST section's timer found the slot already empty and
+  // returned without resolving anything — parking the run forever, past its own
+  // timeout. Same class of bug as the twelve-failover dead-model race: a wave
+  // is concurrent, so per-run singletons are never safe inside it.
+  pendingEscalations = /* @__PURE__ */ new Map();
+  async requestEscalationDecision(ctx, taskId, signal) {
+    if (this.config.autonomy === "auto") return { action: "skip", automatic: true };
+    if (this.listenerCount("escalation:decision-required") === 0) return { action: "skip", automatic: true };
+    if (signal?.aborted) return { action: "skip", automatic: true };
+    const requestId = randomUUID();
+    return await new Promise((resolve2) => {
+      let timeout;
+      const settle = (decision) => {
+        if (!this.pendingEscalations.delete(requestId)) return;
+        if (timeout) clearTimeout(timeout);
+        signal?.removeEventListener("abort", onAbort);
+        resolve2(decision);
+      };
+      const onAbort = () => settle({ action: "skip", automatic: true });
+      signal?.addEventListener("abort", onAbort, { once: true });
+      timeout = setTimeout(() => {
+        this.emit("escalation:timeout", { taskId, requestId, sectionId: ctx.sectionId });
+        settle({ action: "timeout" });
+      }, ESCALATION_DECISION_TIMEOUT_MS);
+      this.pendingEscalations.set(requestId, settle);
+      this.emit("escalation:decision-required", {
+        taskId,
+        requestId,
+        sectionId: ctx.sectionId,
+        sectionTitle: ctx.sectionTitle,
+        issues: ctx.issues,
+        summary: ctx.summary,
+        timeoutMs: ESCALATION_DECISION_TIMEOUT_MS
+      });
+    });
+  }
+  /**
+   * Resolve a pending escalation from a REPL / dashboard / cloud listener.
+   *
+   * `requestId` comes back from the `escalation:decision-required` event and is
+   * what makes an answer land on the section that asked. It is optional so a
+   * host with only one escalation in flight (and any caller that predates the
+   * id) still works: without it the oldest outstanding request is answered,
+   * which is correct whenever there is exactly one.
+   *
+   * `automatic` defaults to false — a call into this method is normally a real
+   * person answering the prompt. Pass `true` from a host that is itself
+   * settling the gate on nobody's behalf (a REST caller who never had a
+   * chance to connect, a session halt with no per-section review behind it),
+   * so T2 doesn't set `userSkipped` for a decision no one actually reviewed —
+   * see EscalationDecision.automatic.
+   */
+  resolveEscalation(action, note, requestId, automatic) {
+    const decision = { action, ...note ? { note } : {}, ...automatic ? { automatic: true } : {} };
+    if (requestId) {
+      this.pendingEscalations.get(requestId)?.(decision);
+      return;
+    }
+    const oldest = this.pendingEscalations.keys().next();
+    if (!oldest.done) this.pendingEscalations.get(oldest.value)?.(decision);
+  }
+  /**
+   * Release every parked escalation — run teardown, so none outlive the run.
+   * `automatic: true`: teardown resolving a section nobody answered is the
+   * same system-decided case as the early-return skips above, not a person
+   * reviewing and accepting that section's output.
+   */
+  releasePendingEscalations(action = "skip") {
+    for (const settle of Array.from(this.pendingEscalations.values())) settle({ action, automatic: true });
+  }
   /**
    * Resolve a pending boardroom plan approval from a REPL / dashboard listener.
    * An optional `note` re-plans and re-asks; an optional `editedPlan` is applied
@@ -16589,6 +17013,20 @@ ${input}` }],
     this.mediaSink = sink;
     this.registerMediaTools(this.workspacePath);
   }
+  /**
+   * Let the agent read the page the user has open in the host's browser.
+   *
+   * Host-supplied because only a host WITH a browser can answer it — so the
+   * tool is simply absent in the CLI and in hosted runs, rather than present
+   * and always failing. Registered outside `enabledTools` for the same reason
+   * media tools are: that allowlist is a blast-radius control for tools that
+   * touch the machine, and reading a page the user already opened touches
+   * nothing. `disabledTools` still removes it.
+   */
+  setCurrentPageProvider(provider) {
+    if ((this.config.tools?.disabledTools ?? []).includes("read_current_page")) return;
+    this.toolRegistry.register(new CurrentPageTool(provider));
+  }
   registerMediaTools(workspacePath) {
     const denied = new Set(this.config.tools?.disabledTools ?? []);
     const permitted = (name) => !denied.has(name);
@@ -16721,8 +17159,12 @@ ${last.partialOutput}` : "");
         for (const server of this.config.tools.mcpServers) {
           try {
             const authProvider = server.oauthStore ? fileOAuthProvider(server.oauthStore) : void 0;
-            await this.mcpClient.connect(server, authProvider ? { authProvider } : {});
-            this.toolRegistry.registerMcpTools(this.mcpClient);
+            const connect = () => this.mcpClient.connect(server, authProvider ? { authProvider } : {});
+            await (server.oauthStore ? withOAuthStoreLock(server.oauthStore, connect) : connect());
+            this.toolRegistry.registerMcpTools(
+              this.mcpClient,
+              (name) => !(this.config.tools?.disabledTools ?? []).includes(name)
+            );
           } catch (err) {
             console.error(`Failed to connect to MCP server "${server.name}":`, err);
           }
@@ -17187,6 +17629,7 @@ ${prompt}` : prompt;
       } else if (complexity === "Moderate") {
         const t2 = new T2Manager(this.router, this.toolRegistry, "root");
         t2.setRunBreaker(runBreaker);
+        t2.setEscalationCallback((ctx) => this.requestEscalationDecision(ctx, taskId, options.signal));
         t2.setPresenter(true);
         t2.setHierarchyContext("You are the ROOT Manager for this task. There is no T1 Administrator involved in this run. You are responsible for decomposing the task and managing T3 workers directly.");
         if (identityPrompt) {
@@ -17231,11 +17674,17 @@ ${prompt}` : prompt;
         t2Results = [t2Result];
         const completed = t2Result.t3Results.filter((r) => r.status === "COMPLETED");
         if (completed.length > 0) {
-          finalOutput = t2Result.sectionSummary + "\n\n" + completed.map((r) => r.output).join("\n\n");
+          finalOutput = composeRootSectionOutput(
+            t2Result,
+            completed.map((r) => typeof r.output === "string" ? r.output : JSON.stringify(r.output))
+          );
         } else {
           const partial = t2Result.t3Results.map((r) => typeof r.output === "string" ? r.output : "").filter((o) => o.trim()).sort((a, b) => b.length - a.length)[0];
           const reasons = Array.from(
-            new Set(t2Result.t3Results.flatMap((r) => r.issues ?? []).filter(Boolean))
+            new Set([
+              ...t2Result.issues ?? [],
+              ...t2Result.t3Results.flatMap((r) => r.issues ?? [])
+            ].filter(Boolean))
           );
           if (partial) {
             finalOutput = reasons.length ? `${partial}
@@ -17248,6 +17697,7 @@ _(incomplete: ${reasons.join("; ")})_` : partial;
       } else {
         const t1 = new T1Administrator(this.router, this.toolRegistry, this.config);
         t1.setRunBreaker(runBreaker);
+        t1.setEscalationCallback((ctx) => this.requestEscalationDecision(ctx, taskId, options.signal));
         t1.setPresenter(true);
         t1.setHierarchyContext("You are the top-level Administrator. You are responsible for the overall plan and supervising multiple T2 Managers.");
         if (identityPrompt) {
@@ -17272,6 +17722,8 @@ _(incomplete: ${reasons.join("; ")})_` : partial;
         finalOutput = result.output;
         t2Results = result.t2Results;
       }
+      const budgetInfo = this.router.budgetExceededInfo();
+      if (budgetInfo) throw new CascadeRouter.BudgetExceededError(budgetInfo.reason);
       const trip = runBreaker.reason();
       if (trip) {
         finalOutput = [
@@ -17312,6 +17764,10 @@ ${finalOutput}` : ""
         escalator.cancelAllPending();
       } catch {
       }
+      try {
+        this.releasePendingEscalations();
+      } catch {
+      }
       this.router.restoreTierModels();
       this.router.setRunSignal(void 0);
       if (this.taskAnalyzer) {
@@ -21738,11 +22194,55 @@ function mergeByKey(local, incoming, key) {
   for (const i of incoming) map.set(key(i), i);
   return [...map.values()];
 }
+function uniqueServerName(desired, takenPrefixes) {
+  if (!takenPrefixes.has(mcpServerPrefix(desired))) return desired;
+  let n = 2;
+  while (takenPrefixes.has(mcpServerPrefix(`${desired} ${n}`))) n++;
+  return `${desired} ${n}`;
+}
+function mergeMcpServers(local, incoming) {
+  const rewrite = /* @__PURE__ */ new Map();
+  if (!incoming?.length) return { servers: local, synced: [], rewrite };
+  const byName = /* @__PURE__ */ new Map();
+  for (const l of local ?? []) byName.set(l.name, l);
+  const prefixes = new Set([...byName.values()].map((m) => mcpServerPrefix(m.name)));
+  const synced = [];
+  for (const inc of incoming) {
+    if (byName.has(inc.name)) {
+      byName.set(inc.name, inc);
+      synced.push(inc);
+      continue;
+    }
+    const name = uniqueServerName(inc.name, prefixes);
+    if (name !== inc.name) rewrite.set(mcpServerPrefix(inc.name), mcpServerPrefix(name));
+    const server = name === inc.name ? inc : { ...inc, name };
+    byName.set(name, server);
+    synced.push(server);
+    prefixes.add(mcpServerPrefix(name));
+  }
+  return { servers: [...byName.values()], synced, rewrite };
+}
+function rewriteDisabledTools(tools, rewrite) {
+  if (!tools?.length || rewrite.size === 0) return tools;
+  return tools.map((t) => {
+    for (const [from, to] of rewrite) if (t.startsWith(from)) return to + t.slice(from.length);
+    return t;
+  });
+}
+function mergeDisabledTools(local, incoming, syncedServers) {
+  const prefixes = (syncedServers ?? []).map((m) => mcpServerPrefix(m.name));
+  const covered = (tool) => prefixes.some((p) => tool.startsWith(p));
+  const kept = (local ?? []).filter((t) => !covered(t));
+  const merged = [.../* @__PURE__ */ new Set([...kept, ...incoming ?? []])];
+  return merged.length ? merged : void 0;
+}
 function gatherSyncBundle(config) {
-  const bundle = { v: 1 };
+  const bundle = { v: 2 };
   if (config.providers?.length) bundle.providers = config.providers;
   if (config.tools?.webSearch) bundle.webSearch = config.tools.webSearch;
   if (config.tools?.mcpServers?.length) bundle.mcpServers = config.tools.mcpServers;
+  const syncedDisabledTools = config.tools?.disabledTools?.filter(isMcpToolName);
+  if (syncedDisabledTools?.length) bundle.disabledTools = syncedDisabledTools;
   if (config.models) bundle.models = config.models;
   if (config.budget) bundle.budget = config.budget;
   const prefs = {};
@@ -21757,7 +22257,16 @@ function applySyncBundle(bundle, config) {
   const next = { ...config, tools: { ...config.tools } };
   if (bundle.providers) next.providers = mergeByKey(config.providers, bundle.providers, providerSig) ?? [];
   if (bundle.webSearch) next.tools.webSearch = { ...config.tools?.webSearch, ...bundle.webSearch };
-  if (bundle.mcpServers) next.tools.mcpServers = mergeByKey(config.tools?.mcpServers, bundle.mcpServers, (m) => m.name);
+  const mcp2 = mergeMcpServers(config.tools?.mcpServers, bundle.mcpServers);
+  if (bundle.mcpServers) next.tools.mcpServers = mcp2.servers;
+  const carriesSelections = bundle.v >= 2 || bundle.disabledTools !== void 0;
+  if (carriesSelections && (bundle.mcpServers || bundle.disabledTools)) {
+    next.tools.disabledTools = mergeDisabledTools(
+      config.tools?.disabledTools,
+      rewriteDisabledTools(bundle.disabledTools, mcp2.rewrite),
+      bundle.mcpServers ? mcp2.synced : void 0
+    );
+  }
   if (bundle.models) next.models = { ...config.models, ...bundle.models };
   if (bundle.budget) next.budget = { ...config.budget, ...bundle.budget };
   if (bundle.prefs) {
@@ -22098,12 +22607,19 @@ function defaultName(url) {
   }
 }
 async function mcpConnectCommand(url, opts = {}) {
-  const name = opts.name?.trim() || defaultName(url);
-  const store = new FileMcpOAuthStore(storePathFor(name));
+  const desiredName = opts.name?.trim() || defaultName(url);
   console.log(chalk7.magenta("\n  \u25C8 Connect an MCP server via OAuth"));
   console.log(chalk7.dim(`  ${url}
 `));
   try {
+    const cm = new ConfigManager(process.cwd());
+    await cm.load();
+    const config = cm.getConfig();
+    config.tools = config.tools ?? {};
+    const servers = config.tools.mcpServers ?? [];
+    const existingIdx = servers.findIndex((s) => s.name === desiredName);
+    const name = existingIdx >= 0 ? desiredName : uniqueMcpServerName(desiredName, servers.map((s) => s.name));
+    const store = new FileMcpOAuthStore(storePathFor(name));
     await connectMcpWithLoopbackOAuth({
       serverUrl: url,
       store,
@@ -22113,14 +22629,8 @@ async function mcpConnectCommand(url, opts = {}) {
         openBrowser2(u);
       }
     });
-    const cm = new ConfigManager(process.cwd());
-    await cm.load();
-    const config = cm.getConfig();
-    config.tools = config.tools ?? {};
-    const servers = config.tools.mcpServers ?? [];
     const entry = { name, url, oauthStore: storePathFor(name) };
-    const idx = servers.findIndex((s) => s.name === name);
-    if (idx >= 0) servers[idx] = entry;
+    if (existingIdx >= 0) servers[existingIdx] = entry;
     else servers.push(entry);
     config.tools.mcpServers = servers;
     config.tools.mcpTrusted = Array.from(/* @__PURE__ */ new Set([...config.tools.mcpTrusted ?? [], name]));
@@ -22165,6 +22675,7 @@ async function mcpRemoveCommand(name) {
   }
   config.tools.mcpServers = servers.filter((s) => s.name !== name);
   config.tools.mcpTrusted = (config.tools.mcpTrusted ?? []).filter((n) => n !== name);
+  config.tools.disabledTools = removeMcpServerDenials(config.tools.disabledTools, name);
   if (match.oauthStore) {
     try {
       new FileMcpOAuthStore(match.oauthStore).clear();
@@ -22271,6 +22782,14 @@ var DashboardSocket = class {
     this.secret = options.secret;
     this.setupHandlers();
   }
+  /** How many sockets are currently in a room — 0 means nobody can answer. */
+  roomSize(room) {
+    return this.io.sockets.adapter.rooms.get(room)?.size ?? 0;
+  }
+  /** Is this exact connection still live? A reconnect issues a NEW socket id. */
+  hasSocket(socketId) {
+    return this.io.sockets.sockets.has(socketId);
+  }
   broadcastToRoom(room, event, data) {
     this.io.to(room).emit(event, data);
   }
@@ -22342,6 +22861,22 @@ var DashboardSocket = class {
       });
     });
   }
+  /**
+   * A client subscribed to a session's room.
+   *
+   * The host uses this to replay a gate the run is already parked on. Socket.IO
+   * does not buffer room emissions, so a prompt broadcast while the renderer was
+   * reconnecting is simply gone; without a replay the section waits out its full
+   * timeout with the user sitting in front of a screen that never asked.
+   */
+  onJoinSession(callback) {
+    this.io.on("connection", (socket) => {
+      socket.on("join:session", (payload) => {
+        const { sessionId } = normalizeSessionSubscriptionPayload(payload);
+        if (sessionId) callback(sessionId, socket.id);
+      });
+    });
+  }
   onSessionRate(callback) {
     this.io.on("connection", (socket) => {
       socket.on("session:rate", (payload) => {
@@ -22379,6 +22914,31 @@ var DashboardSocket = class {
       });
     });
   }
+  /**
+   * A section escalated and the run is parked waiting for an answer. The
+   * desktop shows the escalation modal on `escalation:decision-required` and
+   * answers here.
+   *
+   * Unlike a plan decision, silence is NOT taken as consent — the SDK fails
+   * the section on timeout — so this handler only ever forwards a real choice.
+   */
+  onEscalationDecision(callback) {
+    this.io.on("connection", (socket) => {
+      socket.on("escalation:decide", (payload) => {
+        const action = payload?.action;
+        if (typeof payload?.sessionId !== "string") return;
+        if (action !== "retry" && action !== "skip" && action !== "guidance") return;
+        callback({
+          sessionId: payload.sessionId,
+          // Identifies WHICH parked section this answers — sections in a wave
+          // run concurrently, so more than one can be waiting.
+          requestId: typeof payload.requestId === "string" ? payload.requestId : void 0,
+          action,
+          note: typeof payload.note === "string" && payload.note.trim() ? payload.note.trim() : void 0
+        });
+      });
+    });
+  }
   onSessionSteer(callback) {
     this.io.on("connection", (socket) => {
       socket.on("session:steer", (payload) => {
@@ -22540,6 +23100,7 @@ function aggregateCostStats(sessions2, opts = {}) {
 
 // src/dashboard/server.ts
 var __dirname$1 = path32.dirname(fileURLToPath(import.meta.url));
+var ORPHANED_ESCALATION_GRACE_MS = 3e4;
 var DashboardServer = class {
   app;
   httpServer;
@@ -22550,6 +23111,13 @@ var DashboardServer = class {
   globalStore = null;
   broadcastTimer = null;
   activeSessions = /* @__PURE__ */ new Map();
+  /**
+   * Supplied by the desktop shell so a run can read the page the user has
+   * open in the built-in browser. Absent in the CLI, where there is no
+   * browser — so the tool is simply not registered rather than present and
+   * always failing.
+   */
+  currentPageProvider;
   activeControllers = /* @__PURE__ */ new Map();
   /**
    * Run taskIds per chat session — file snapshots are keyed by the run's
@@ -22564,6 +23132,17 @@ var DashboardServer = class {
    * map is how that answer reaches the run that's blocked on it.
    */
   pendingApprovals = /* @__PURE__ */ new Map();
+  /**
+   * The escalation prompt a session is currently parked on, kept so it can be
+   * delivered to a client that was not reachable when it was raised.
+   *
+   * Socket.IO buffers nothing: a prompt emitted while the renderer is mid
+   * reconnect is gone, and the section then waits out its full five minutes
+   * with the user in front of a screen that never asked them anything. Holding
+   * the payload lets `join:session` replay it, and lets a run with no reachable
+   * client be settled instead of parked (see ORPHANED_ESCALATION_GRACE_MS).
+   */
+  pendingEscalations = /* @__PURE__ */ new Map();
   /**
    * The orchestration decision trail ("why") of each session's most recent
    * run — captured when the run ends so the desktop's Why panel can show it
@@ -22641,20 +23220,29 @@ var DashboardServer = class {
       if (forceTier) cfg = { ...cfg, routing: { ...cfg.routing, forceTier } };
       const cascade = new Cascade(cfg, this.workspacePath, this.store);
       this.activeSessions.set(sessionId, cascade);
+      if (this.currentPageProvider) cascade.setCurrentPageProvider(this.currentPageProvider);
       cascade.on("stream:token", (e) => {
-        this.socket.emitToSocket(socketId, "stream:token", { sessionId, tierId: e.tierId, text: e.text, primary: e.primary });
+        this.emitToSessionClients(socketId, sessionId, "stream:token", { sessionId, tierId: e.tierId, text: e.text, primary: e.primary });
       });
       cascade.on("tier:status", (e) => {
-        this.socket.emitToSocket(socketId, "tier:status", { sessionId, ...e });
+        this.emitToSessionClients(socketId, sessionId, "tier:status", { sessionId, ...e });
       });
       cascade.on("permission:user-required", (e) => {
-        this.socket.emitToSocket(socketId, "permission:user-required", { sessionId, ...e });
+        this.emitToSessionClients(socketId, sessionId, "permission:user-required", { sessionId, ...e });
       });
       cascade.on("peer:message", (e) => {
         this.socket.emitPeerMessage(e);
       });
       cascade.on("plan:approval-required", (e) => {
-        this.socket.emitToSocket(socketId, "plan:approval-required", { sessionId, ...e });
+        this.emitToSessionClients(socketId, sessionId, "plan:approval-required", { sessionId, ...e });
+      });
+      cascade.on("escalation:decision-required", (e) => {
+        this.raiseEscalation(sessionId, socketId, e);
+      });
+      cascade.on("escalation:timeout", (e) => {
+        const ev = e;
+        if (ev.requestId) this.clearPendingEscalation(ev.requestId);
+        this.emitToSessionClients(socketId, sessionId, "escalation:timeout", { sessionId, ...e });
       });
       try {
         const result = await cascade.run({
@@ -22665,7 +23253,7 @@ var DashboardServer = class {
         this.recordSessionTask(sessionId, result.taskId);
         this.persistRunEnd(sessionId, title, prompt, result.output, "COMPLETED", result);
         this.captureWhy(sessionId, cascade, result);
-        this.socket.emitToSocket(socketId, "session:complete", { sessionId, result });
+        this.emitToSessionClients(socketId, sessionId, "session:complete", { sessionId, result });
         this.socket.broadcast("cost:update", {
           sessionId,
           totalTokens: result.usage.totalTokens,
@@ -22678,7 +23266,7 @@ var DashboardServer = class {
       } catch (err) {
         this.persistRunEnd(sessionId, title, prompt, void 0, "FAILED");
         this.captureWhy(sessionId, cascade);
-        this.socket.emitToSocket(socketId, "session:error", {
+        this.emitToSessionClients(socketId, sessionId, "session:error", {
           sessionId,
           error: err instanceof Error ? err.message : String(err)
         });
@@ -22686,6 +23274,7 @@ var DashboardServer = class {
         this.activeSessions.delete(sessionId);
         this.activeControllers.delete(sessionId);
         this.denyPendingApprovals(sessionId);
+        this.clearSessionEscalations(sessionId);
       }
     });
     this.socket.onPlanDecision(({ sessionId, approved, note, editedPlan }) => {
@@ -22695,10 +23284,20 @@ var DashboardServer = class {
         editedPlan
       );
     });
+    this.socket.onEscalationDecision(({ sessionId, requestId, action, note }) => {
+      if (requestId) this.clearPendingEscalation(requestId);
+      else this.clearOldestSessionEscalation(sessionId);
+      this.activeSessions.get(sessionId)?.resolveEscalation(action, note, requestId);
+    });
+    this.socket.onJoinSession((sessionId, socketId) => {
+      this.replayEscalations(sessionId, socketId);
+    });
     this.socket.onSessionHalt((sessionId) => {
       this.activeControllers.get(sessionId)?.abort();
       this.denyPendingApprovals(sessionId);
       this.activeSessions.get(sessionId)?.resolvePlanApproval(false);
+      this.clearSessionEscalations(sessionId);
+      this.activeSessions.get(sessionId)?.resolveEscalation("skip", void 0, void 0, true);
     });
     this.socket.onApprovalResponse(({ requestId, approved, always }) => {
       const pending = this.pendingApprovals.get(requestId);
@@ -22713,6 +23312,10 @@ var DashboardServer = class {
       }
     });
   }
+  /** Wire the host's browser view in (desktop only). */
+  setCurrentPageProvider(provider) {
+    this.currentPageProvider = provider;
+  }
   async start() {
     const isLoopback = this.host === "127.0.0.1" || this.host === "::1" || this.host === "localhost";
     if (!isLoopback) {
@@ -23001,6 +23604,116 @@ var DashboardServer = class {
       this.activeSessions.delete(sessionId);
     }
   }
+  /**
+   * Is anyone able to answer for this session right now?
+   *
+   * The originating socket first — that connection is definitely watching this
+   * run — then the session room, which is where a client lands after a
+   * reconnect issues it a new socket id.
+   */
+  hasResponder(sessionId, socketId) {
+    if (socketId && this.socket.hasSocket(socketId)) return true;
+    return this.socket.roomSize(`session:${sessionId}`) > 0;
+  }
+  /**
+   * Send a run event to whoever is watching this session.
+   *
+   * A captured socket id goes stale the moment Socket.IO reconnects — the
+   * client is back, but under a new id, and `emitToSocket` on the old one is a
+   * silent no-op. Falling back to the session room keeps the run addressable
+   * across a reconnect; emitting to one OR the other (never both) keeps a
+   * client that is both the originator and a room member from seeing every
+   * token twice.
+   */
+  emitToSessionClients(socketId, sessionId, event, data) {
+    if (socketId && this.socket.hasSocket(socketId)) this.socket.emitToSocket(socketId, event, data);
+    else this.socket.broadcastToRoom(`session:${sessionId}`, event, data);
+  }
+  /**
+   * Raise an escalation prompt, and make sure it can still be answered.
+   *
+   * Held in `pendingEscalations` — keyed by requestId, because a Complex wave
+   * dispatches sections concurrently and two can be parked at once — so a
+   * client that joins late (or rejoins after a reconnect) gets every waiting
+   * prompt replayed. Keying by session would drop the first of a pair: its
+   * grace timer would be cleared by the second, leaving it parked for the full
+   * timeout with nobody able to answer it. If nobody is reachable at all, the gate is
+   * settled as `skip` after a short grace period rather than parked for the
+   * full timeout: that matches the SDK's policy when no listener exists, and
+   * five minutes of a held run is a real cost for a REST caller who has already
+   * hung up. The grace period exists so an ordinary two-second reconnect is not
+   * mistaken for an absent user.
+   */
+  raiseEscalation(sessionId, socketId, event) {
+    const requestId = typeof event.requestId === "string" && event.requestId ? event.requestId : randomUUID();
+    const payload = { sessionId, ...event };
+    const entry = { payload, sessionId, requestId, raisedAt: Date.now() };
+    this.pendingEscalations.set(requestId, entry);
+    if (this.hasResponder(sessionId, socketId)) {
+      this.emitToSessionClients(socketId, sessionId, "escalation:decision-required", payload);
+      return;
+    }
+    entry.graceTimer = setTimeout(() => {
+      if (this.pendingEscalations.get(requestId) !== entry) return;
+      if (this.hasResponder(sessionId, socketId)) return;
+      this.pendingEscalations.delete(requestId);
+      this.activeSessions.get(sessionId)?.resolveEscalation("skip", "No client was connected to answer.", requestId, true);
+    }, ORPHANED_ESCALATION_GRACE_MS);
+  }
+  /**
+   * Replay EVERY parked prompt to a client that just subscribed to the session.
+   *
+   * Plural because a Complex run dispatches sections concurrently, so a wave can
+   * leave more than one waiting at the same time — the same reason the SDK keys
+   * its gates and the clients queue theirs.
+   *
+   * `timeoutMs` is recomputed as the time actually LEFT, because the SDK's timer
+   * has been running since the prompt was raised. Sent verbatim, a client
+   * reconnecting four minutes in would show a fresh five-minute countdown and
+   * then watch the section fail with four of those minutes still on the clock.
+   * A remaining duration is used rather than an absolute deadline so the two
+   * sides never have to agree on a wall clock.
+   */
+  replayEscalations(sessionId, socketId) {
+    for (const entry of this.pendingEscalations.values()) {
+      if (entry.sessionId !== sessionId) continue;
+      if (entry.graceTimer) {
+        clearTimeout(entry.graceTimer);
+        entry.graceTimer = void 0;
+      }
+      const originalTimeout = typeof entry.payload.timeoutMs === "number" ? entry.payload.timeoutMs : 0;
+      const remaining = Math.max(0, originalTimeout - (Date.now() - entry.raisedAt));
+      this.socket.emitToSocket(socketId, "escalation:decision-required", { ...entry.payload, timeoutMs: remaining });
+    }
+  }
+  /** Forget ONE parked prompt — the one that was answered or timed out. */
+  clearPendingEscalation(requestId) {
+    const entry = this.pendingEscalations.get(requestId);
+    if (!entry) return;
+    if (entry.graceTimer) clearTimeout(entry.graceTimer);
+    this.pendingEscalations.delete(requestId);
+  }
+  /**
+   * Forget the session's OLDEST prompt — for a client that answered without a
+   * requestId, which is exactly the gate `resolveEscalation` will settle.
+   * Insertion order makes `values()` oldest-first.
+   */
+  clearOldestSessionEscalation(sessionId) {
+    for (const [id, entry] of this.pendingEscalations) {
+      if (entry.sessionId !== sessionId) continue;
+      if (entry.graceTimer) clearTimeout(entry.graceTimer);
+      this.pendingEscalations.delete(id);
+      return;
+    }
+  }
+  /** Forget every prompt a session was parked on (run ended, or halted). */
+  clearSessionEscalations(sessionId) {
+    for (const [id, entry] of this.pendingEscalations) {
+      if (entry.sessionId !== sessionId) continue;
+      if (entry.graceTimer) clearTimeout(entry.graceTimer);
+      this.pendingEscalations.delete(id);
+    }
+  }
   /** Deny + clear any approvals still pending for a session (run end / abort). */
   denyPendingApprovals(sessionId) {
     for (const [id, pending] of this.pendingApprovals) {
@@ -23501,6 +24214,7 @@ ${prompt}`;
       void (async () => {
         const cascade = new Cascade(this.config, this.workspacePath, this.store);
         this.activeSessions.set(sessionId, cascade);
+        if (this.currentPageProvider) cascade.setCurrentPageProvider(this.currentPageProvider);
         cascade.on("stream:token", (e) => {
           this.socket.broadcastToRoom(`session:${sessionId}`, "stream:token", { sessionId, tierId: e.tierId, text: e.text, primary: e.primary });
         });
@@ -23516,6 +24230,14 @@ ${prompt}`;
         cascade.on("plan:approval-required", (e) => {
           this.socket.broadcastToRoom(`session:${sessionId}`, "plan:approval-required", { sessionId, ...e });
         });
+        cascade.on("escalation:decision-required", (e) => {
+          this.raiseEscalation(sessionId, void 0, e);
+        });
+        cascade.on("escalation:timeout", (e) => {
+          const ev = e;
+          if (ev.requestId) this.clearPendingEscalation(ev.requestId);
+          this.socket.broadcastToRoom(`session:${sessionId}`, "escalation:timeout", { sessionId, ...e });
+        });
         try {
           const result = await cascade.run({
             prompt: runPrompt,
@@ -23543,6 +24265,7 @@ ${prompt}`;
         } finally {
           this.activeSessions.delete(sessionId);
           this.denyPendingApprovals(sessionId);
+          this.clearSessionEscalations(sessionId);
         }
       })();
     });