cascade-ai 0.54.0 → 0.56.0

package/dist/desktop-core.cjs

@@ -18237,7 +18237,7 @@ var require_gaxios = __commonJS({
     var retry_js_1 = require_retry3();
     var stream_1 = __require("stream");
     var interceptor_js_1 = require_interceptor();
-    var randomUUID10 = async () => globalThis.crypto?.randomUUID() || (await import('crypto')).randomUUID();
+    var randomUUID11 = async () => globalThis.crypto?.randomUUID() || (await import('crypto')).randomUUID();
     var HTTP_STATUS_NO_CONTENT = 204;
     var Gaxios = class {
       agentCache = /* @__PURE__ */ new Map();
@@ -18510,7 +18510,7 @@ var require_gaxios = __commonJS({
          */
         ["Blob", "File", "FormData"].includes(opts.data?.constructor?.name || "");
         if (opts.multipart?.length) {
-          const boundary = await randomUUID10();
+          const boundary = await randomUUID11();
           preparedHeaders.set("content-type", `multipart/related; boundary=${boundary}`);
           opts.body = stream_1.Readable.from(this.getMultipartRequest(opts.multipart, boundary));
         } else if (shouldDirectlyPassData) {
@@ -30587,7 +30587,7 @@ var require_websocket = __commonJS({
     var http7 = __require("http");
     var net2 = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes4, createHash: createHash4 } = __require("crypto");
+    var { randomBytes: randomBytes4, createHash: createHash5 } = __require("crypto");
     var { Duplex, Readable: Readable5 } = __require("stream");
     var { URL: URL4 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -31255,7 +31255,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash4("sha1").update(key + GUID).digest("base64");
+        const digest = createHash5("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -31621,7 +31621,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter9 = __require("events");
     var http7 = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash4 } = __require("crypto");
+    var { createHash: createHash5 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -31928,7 +31928,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash4("sha1").update(key + GUID).digest("base64");
+        const digest = createHash5("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -224247,7 +224247,7 @@ function reconcilePrice(model, live) {
 }
 
 // src/constants.ts
-var CASCADE_VERSION = "0.54.0";
+var CASCADE_VERSION = "0.56.0";
 var CASCADE_CONFIG_DIR = ".cascade";
 var CASCADE_MD_FILE = "CASCADE.md";
 var CASCADE_IGNORE_FILE = ".cascadeignore";
@@ -253088,6 +253088,23 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter__default.default {
    */
   budgetState = "ok";
   budgetExceededReason;
+  /**
+   * Whether the run/session budget is permanently tripped, and why.
+   *
+   * A tier or worker that catches `BudgetExceededError` internally (T3Worker
+   * does, so one dead-end subtask doesn't crash the whole run) absorbs the
+   * exception into a normal FAILED/PARTIAL result — the tier returns as if
+   * nothing unusual happened. That silently skips `Cascade.run()`'s dedicated
+   * budget-exceeded handling (the `run:budget-exceeded` event and
+   * `lastInterruptedRun` for `/continue`). This lets a caller check the
+   * router's own state directly after a tier returns, regardless of how that
+   * tier chose to report the error internally.
+   */
+  budgetExceededInfo() {
+    if (this.runBudgetExceeded) return { reason: this.runBudgetExceededReason ?? "Per-task budget exceeded." };
+    if (this.budgetState === "exceeded") return { reason: this.budgetExceededReason ?? "Session budget exceeded." };
+    return null;
+  }
   tpmLimiter;
   localQueue;
   taskAnalyzer;
@@ -254745,6 +254762,13 @@ Now execute your subtask using this context where relevant.`
         this.peerBus?.publish(this.id, assignment.subtaskId, finalOutput2, "FAILED");
         return this.buildResult("ESCALATED", finalOutput2, { checksRun, passed, failed }, issues, correctionAttempts);
       }
+      if (err instanceof Error && err.name === "BudgetExceededError") {
+        issues.push(errMsg);
+        const stopped = output || errMsg;
+        this.setStatus("FAILED", stopped);
+        this.peerBus?.publish(this.id, assignment.subtaskId, stopped, "FAILED");
+        return this.buildResult("FAILED", stopped, { checksRun, passed, failed }, issues, correctionAttempts);
+      }
       issues.push(`Execution error: ${errMsg}`);
       const finalOutput = output || errMsg;
       this.setStatus("FAILED", finalOutput);
@@ -255766,6 +255790,26 @@ var RedactionLayer = class {
   }
 };
 
+// src/core/tiers/escalation-policy.ts
+function sectionNeedsDecision(results) {
+  return results.some((r4) => r4.status === "ESCALATED");
+}
+function settledEscalationStatus(results) {
+  const hasWork = results.some((r4) => r4.status === "COMPLETED" || !!r4.output);
+  return hasWork ? "PARTIAL" : "FAILED";
+}
+function composeRootSectionOutput(t2Result, completedOutputs) {
+  let output = `${t2Result.sectionSummary}
+
+${completedOutputs.join("\n\n")}`;
+  if (t2Result.status === "FAILED" && t2Result.issues?.length) {
+    output += `
+
+_(incomplete: ${t2Result.issues.join("; ")})_`;
+  }
+  return output;
+}
+
 // src/core/tiers/t2-manager.ts
 function buildT2SystemPrompt(hasPeerMessage) {
   return [
@@ -255791,6 +255835,19 @@ var T2Manager = class extends BaseTier {
   t2PeerBus;
   permissionEscalator;
   toolCreator;
+  /**
+   * Asked when a section ends ESCALATED — i.e. a worker hit something it could
+   * not decide alone. Without this the escalation was a dead end: the status
+   * said "needs a decision" and no decision was ever requested, so an MCP run
+   * that legitimately needed input just stopped there.
+   */
+  escalationCallback;
+  /**
+   * The one allowed retry has been spent. Retrying is bounded because an
+   * escalation loop that can re-ask forever burns a budget on a question that
+   * is not resolving; a second escalation is terminal instead.
+   */
+  escalationRetryUsed = false;
   /** Optional boardroom gate (Moderate / root-T2 runs) — pauses after decomposition. */
   planApprovalCallback;
   /** AbortController for the current T3 wave — aborted on cancel-and-respawn */
@@ -255839,6 +255896,10 @@ var T2Manager = class extends BaseTier {
   setToolCreator(creator) {
     this.toolCreator = creator;
   }
+  /** Ask the user what to do when a section escalates. */
+  setEscalationCallback(cb) {
+    this.escalationCallback = cb;
+  }
   /** Boardroom gate for Moderate (root-T2) runs: pause after decomposition. */
   setPlanApprovalCallback(cb) {
     this.planApprovalCallback = cb;
@@ -255943,9 +256004,57 @@ Guidance (must be followed): ${decision.note}`
         currentAction: "Aggregating T3 results",
         status: "IN_PROGRESS"
       });
-      const summary = await this.aggregateResults(assignment, t3Results);
+      let summary = await this.aggregateResults(assignment, t3Results);
       const issues = t3Results.filter((r4) => r4.status !== "COMPLETED").flatMap((r4) => r4.issues);
-      const overallStatus = this.determineStatus(t3Results);
+      let overallStatus = this.determineStatus(t3Results);
+      let userSkipped = false;
+      const hasEscalated = sectionNeedsDecision(t3Results);
+      const settleEscalated = async (reason) => {
+        if (reason) issues.push(reason);
+        summary = await this.aggregateResults(assignment, t3Results, { includeEscalated: true });
+        overallStatus = settledEscalationStatus(t3Results);
+      };
+      if (hasEscalated && this.escalationCallback && this.escalationRetryUsed) {
+        await settleEscalated("Escalated again after the retry \u2014 no further attempts were made.");
+      } else if (hasEscalated && !this.escalationCallback) {
+        await settleEscalated();
+      } else if (hasEscalated && this.escalationCallback) {
+        this.sendStatusUpdate({
+          progressPct: 95,
+          currentAction: "Escalated \u2014 waiting for your decision",
+          status: "ESCALATING"
+        });
+        const decision = await this.escalationCallback({
+          sectionId: assignment.sectionId,
+          sectionTitle: assignment.sectionTitle,
+          issues,
+          summary
+        });
+        this.log(`Escalation decision for "${assignment.sectionTitle}": ${decision.action}`);
+        if (decision.action === "skip") {
+          summary = await this.aggregateResults(assignment, t3Results, { includeEscalated: true });
+          overallStatus = settledEscalationStatus(t3Results);
+          userSkipped = decision.automatic !== true;
+        } else if (decision.action === "retry" || decision.action === "guidance") {
+          this.escalationRetryUsed = true;
+          const guided = decision.action === "guidance" && decision.note?.trim() ? {
+            ...assignment,
+            description: `${assignment.description}
+
+Guidance (must be followed): ${decision.note.trim()}`,
+            // Drop T1's preplanned subtasks so the retry re-decomposes with
+            // the guidance in hand. The workers execute from their subtask
+            // slices, not from this description — leaving the slices in
+            // place gave "Retry with guidance" byte-identical worker
+            // prompts to "Retry as-is", making the note do nothing at all.
+            t3Subtasks: []
+          } : assignment;
+          return await this.execute(guided, taskId, signal);
+        } else {
+          issues.push("Escalated, but no decision was received in time.");
+          overallStatus = "FAILED";
+        }
+      }
       const isOk = overallStatus === "COMPLETED" || overallStatus === "PARTIAL";
       this.setStatus(isOk ? "COMPLETED" : "FAILED", summary);
       const sectionAction = overallStatus === "COMPLETED" ? "Section complete" : overallStatus === "PARTIAL" ? "Section partially complete \u2014 some subtasks failed" : overallStatus === "ESCALATED" ? "Section escalated \u2014 needs a decision" : "Section failed \u2014 no subtask completed";
@@ -255956,7 +256065,8 @@ Guidance (must be followed): ${decision.note}`
         status: overallStatus,
         t3Results,
         sectionSummary: summary,
-        issues
+        issues,
+        ...userSkipped ? { userSkipped: true } : {}
       };
       this.publishSectionOutput(result);
       return result;
@@ -256015,7 +256125,7 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : ""),
       const jsonMatch = /\[[\s\S]*\]/.exec(result.content);
       if (!jsonMatch) throw new Error("No JSON array found");
       const parsed = JSON.parse(jsonMatch[0]);
-      return parsed.map((a2) => ({ ...a2, sectionTitle: assignment.sectionTitle }));
+      return parsed.map((a2) => ({ ...a2, sectionTitle: assignment.sectionTitle, constraints: a2.constraints ?? [] }));
     } catch {
       return [{
         subtaskId: crypto6.randomUUID(),
@@ -256390,8 +256500,10 @@ HIERARCHY CONTEXT: ${this.hierarchyContext}` : ""),
       result.status === "COMPLETED" ? "COMPLETED" : "FAILED"
     );
   }
-  async aggregateResults(assignment, results) {
-    const completed = results.filter((r4) => r4.status === "COMPLETED");
+  async aggregateResults(assignment, results, opts = {}) {
+    const completed = results.filter(
+      (r4) => r4.status === "COMPLETED" || opts.includeEscalated && r4.status === "ESCALATED" && r4.output
+    );
     if (!completed.length) return `Section ${assignment.sectionTitle} failed \u2014 no T3 workers completed.`;
     const peerOutputs = this.peerSyncBuffer.filter((p3) => p3.content?.type === "T2_SECTION_OUTPUT").map((p3) => `[Peer ${p3.fromId} Output]: ${p3.content.output}`).join("\n\n");
     const peerContext = peerOutputs ? `
@@ -256597,6 +256709,7 @@ var T1Administrator = class extends BaseTier {
   escalations = [];
   store;
   runBreaker;
+  escalationCallback;
   t2PeerBus = new PeerBus();
   permissionEscalator;
   toolCreator;
@@ -256611,6 +256724,10 @@ var T1Administrator = class extends BaseTier {
     this.toolRegistry = toolRegistry;
     this.config = config2;
   }
+  /** Ask the user what to do when any section escalates. */
+  setEscalationCallback(cb) {
+    this.escalationCallback = cb;
+  }
   /** Share the run-wide circuit breaker with every section manager. */
   setRunBreaker(breaker) {
     this.runBreaker = breaker;
@@ -256770,8 +256887,11 @@ Create a CORRECTION PLAN that contains only the new sections needed to fix the i
         reason: `Some T2 managers failed entirely: ${failedSections.map((s3) => s3.sectionTitle).join(", ")}. Errors: ${failedSections.flatMap((s3) => s3.issues).join("; ")}`
       };
     }
-    const sectionsText = t2Results.map((r4) => `**${r4.sectionTitle}**
-${r4.sectionSummary}`).join("\n\n");
+    const sectionsText = t2Results.map((r4) => {
+      const skipNote = r4.userSkipped ? "\n[The user was asked to retry or skip this section and explicitly chose to SKIP it. This is an intentional decision, not a failure \u2014 do not cite it as a reason to reject.]" : "";
+      return `**${r4.sectionTitle}**
+${r4.sectionSummary}${skipNote}`;
+    }).join("\n\n");
     const prompt = `You are a strict QA Reviewer for the Cascade AI system.
 Review the following execution outputs against the original user prompt.
 
@@ -256781,6 +256901,7 @@ T2 Manager Summaries:
 ${sectionsText}
 
 Does the current state of the workspace and the outputs fully satisfy the user's request?
+A section marked as user-skipped above is accepted as-is by the user's own choice \u2014 treat it as satisfied, not as a gap.
 If yes, reply with exactly: "APPROVED".
 If no, reply with "REJECTED: [Detailed reason explaining exactly what is missing or incorrect]".`;
     try {
@@ -256962,6 +257083,12 @@ SPEC RULES \u2014 each subtask is a self-contained spec slice (workers execute f
     if (!plan.sections || !Array.isArray(plan.sections) || plan.sections.length === 0) {
       throw new Error("Invalid plan: no sections");
     }
+    for (const section of plan.sections) {
+      section.constraints ??= [];
+      for (const subtask of section.t3Subtasks ?? []) {
+        subtask.constraints ??= [];
+      }
+    }
     const [min, max] = COMPLEXITY_T2_COUNT[plan.complexity] ?? [1, 8];
     if (plan.sections.length < min) ;
   }
@@ -256978,6 +257105,7 @@ SPEC RULES \u2014 each subtask is a self-contained spec slice (workers execute f
     const managers = sections.map((section) => {
       const manager = new T2Manager(this.router, this.toolRegistry, this.id);
       if (this.runBreaker) manager.setRunBreaker(this.runBreaker);
+      if (this.escalationCallback) manager.setEscalationCallback(this.escalationCallback);
       manager.setHierarchyContext(`You are a T2 Manager for the section "${section.sectionTitle}". You are part of a COMPLEX task overseen by T1 Administrator.`);
       if (this.store) {
         manager.setStore(this.store);
@@ -257187,7 +257315,10 @@ SPEC RULES \u2014 each subtask is a self-contained spec slice (workers execute f
   async compileFinalOutput(originalPrompt, plan, t2Results) {
     const completedSections = t2Results.filter((r4) => r4.status !== "FAILED");
     if (!completedSections.length) {
-      const allIssues = t2Results.flatMap((r4) => r4.t3Results.flatMap((t4) => t4.issues));
+      const allIssues = [
+        ...t2Results.flatMap((r4) => r4.issues ?? []),
+        ...t2Results.flatMap((r4) => r4.t3Results.flatMap((t4) => t4.issues))
+      ].filter(Boolean);
       const critical = allIssues.find((i4) => i4.includes("[CRITICAL_TOOL_ERROR]"));
       const stalled = allIssues.find((i4) => /^Stalled:/.test(i4));
       const topReason = critical ?? stalled ?? allIssues[0] ?? "no specific reason recorded";
@@ -257999,6 +258130,102 @@ var RunBreaker = class {
 
 // src/tools/registry.ts
 var import_ignore = __toESM(require_ignore(), 1);
+var MCP_TOOL_PREFIX = "mcp__";
+var MAX_SEGMENT_LENGTH = 24;
+var SEGMENT_HASH_LENGTH = 8;
+function boundedSegment(raw) {
+  const clean3 = sanitizeToolNameSegment(raw);
+  if (clean3.length <= MAX_SEGMENT_LENGTH) return clean3;
+  const hash = crypto6.createHash("sha256").update(raw, "utf8").digest("hex").slice(0, SEGMENT_HASH_LENGTH);
+  return `${clean3.slice(0, MAX_SEGMENT_LENGTH - SEGMENT_HASH_LENGTH - 1)}_${hash}`;
+}
+function isStableSegment(raw) {
+  return sanitizeToolNameSegment(raw) === raw && raw.length <= MAX_SEGMENT_LENGTH;
+}
+function sanitizeToolNameSegment(segment) {
+  const cleaned = segment.replace(/[^a-zA-Z0-9-]+/g, "_");
+  let start = 0;
+  let end = cleaned.length;
+  while (start < end && cleaned[start] === "_") start++;
+  while (end > start && cleaned[end - 1] === "_") end--;
+  return cleaned.slice(start, end) || "_";
+}
+function mcpToolName(serverName, toolName) {
+  return `${MCP_TOOL_PREFIX}${boundedSegment(serverName)}__${boundedSegment(toolName)}`;
+}
+function isMcpToolName(name) {
+  return name.startsWith(MCP_TOOL_PREFIX);
+}
+function uniqueMcpServerName(desired, existingNames) {
+  const taken = new Set(existingNames.map(mcpServerPrefix));
+  if (!taken.has(mcpServerPrefix(desired))) return desired;
+  for (let n8 = 2; n8 < 1e3; n8++) {
+    const candidate = `${desired} (${n8})`;
+    if (!taken.has(mcpServerPrefix(candidate))) return candidate;
+  }
+  return `${desired} (${crypto6.randomUUID().slice(0, 8)})`;
+}
+function disambiguateMcpServerNames(servers) {
+  const seenNames = [];
+  const renames = [];
+  const result = servers.map((s3) => {
+    const name = uniqueMcpServerName(s3.name, seenNames);
+    seenNames.push(name);
+    if (name === s3.name) return s3;
+    renames.push({ from: s3.name, to: name });
+    return { ...s3, name };
+  });
+  return { servers: renames.length ? result : servers, renames };
+}
+function assignMcpToolNames(tools) {
+  const names = new Array(tools.length);
+  const bases = tools.map((t4) => mcpToolName(t4.server, t4.tool));
+  const groups = /* @__PURE__ */ new Map();
+  bases.forEach((base, i4) => {
+    const g2 = groups.get(base);
+    if (g2) g2.push(i4);
+    else groups.set(base, [i4]);
+  });
+  const used = new Set(bases);
+  for (const [base, idx] of groups) {
+    if (idx.length === 1) {
+      names[idx[0]] = base;
+      continue;
+    }
+    const raw = (i4) => `${tools[i4].server}::${tools[i4].tool}`;
+    const isClean = (i4) => isStableSegment(tools[i4].server) && isStableSegment(tools[i4].tool);
+    const ordered = [...idx].sort((a2, b3) => {
+      const la = isClean(a2) ? 0 : 1;
+      const lb = isClean(b3) ? 0 : 1;
+      if (la !== lb) return la - lb;
+      const ra = raw(a2);
+      const rb = raw(b3);
+      return ra < rb ? -1 : ra > rb ? 1 : 0;
+    });
+    names[ordered[0]] = base;
+    let n8 = 2;
+    for (let rank3 = 1; rank3 < ordered.length; rank3++) {
+      let candidate = `${base}_${n8}`;
+      while (used.has(candidate)) {
+        n8++;
+        candidate = `${base}_${n8}`;
+      }
+      names[ordered[rank3]] = candidate;
+      used.add(candidate);
+      n8++;
+    }
+  }
+  return names;
+}
+function mcpServerPrefix(serverName) {
+  return `${MCP_TOOL_PREFIX}${boundedSegment(serverName)}__`;
+}
+function removeMcpServerDenials(disabledTools, serverName) {
+  if (!disabledTools?.length) return disabledTools;
+  const prefix = mcpServerPrefix(serverName);
+  const kept = disabledTools.filter((t4) => !t4.startsWith(prefix));
+  return kept.length === disabledTools.length ? disabledTools : kept;
+}
 var execAsync = util$1.promisify(child_process.exec);
 var ShellTool = class extends BaseTool {
   name = "shell";
@@ -286300,20 +286527,6 @@ ${text}`;
   }
 };
 
-// src/tools/tool-name.ts
-var MCP_TOOL_PREFIX = "mcp__";
-function sanitizeToolNameSegment(segment) {
-  const cleaned = segment.replace(/[^a-zA-Z0-9-]+/g, "_");
-  let start = 0;
-  let end = cleaned.length;
-  while (start < end && cleaned[start] === "_") start++;
-  while (end > start && cleaned[end - 1] === "_") end--;
-  return cleaned.slice(start, end) || "_";
-}
-function mcpToolName(serverName, toolName) {
-  return `${MCP_TOOL_PREFIX}${sanitizeToolNameSegment(serverName)}__${sanitizeToolNameSegment(toolName)}`;
-}
-
 // src/tools/mcp.ts
 var McpToolWrapper = class extends BaseTool {
   name;
@@ -286322,12 +286535,12 @@ var McpToolWrapper = class extends BaseTool {
   mcpClient;
   serverName;
   toolName;
-  constructor(mcpClient, serverName, toolName, description, inputSchema) {
+  constructor(mcpClient, serverName, toolName, description, inputSchema, registeredName) {
     super();
     this.mcpClient = mcpClient;
     this.serverName = serverName;
     this.toolName = toolName;
-    this.name = mcpToolName(serverName, toolName);
+    this.name = registeredName ?? mcpToolName(serverName, toolName);
     this.description = `[MCP:${serverName}] ${description}`;
     this.inputSchema = inputSchema;
   }
@@ -286398,22 +286611,35 @@ var ToolRegistry = class extends EventEmitter__default.default {
   getRegisteredPlugins() {
     return Array.from(this.plugins.keys());
   }
-  /** Registers all tools from an MCP client */
-  registerMcpTools(mcpClient) {
-    const definitions = mcpClient.getToolDefinitions();
-    for (const def of definitions) {
-      const [, serverName, toolName] = def.name.split("::");
-      if (!serverName || !toolName) continue;
+  /**
+   * Registers all tools from an MCP client.
+   *
+   * `isAllowed` receives the FINAL registered name (`mcp__server__tool`) — the
+   * same string the user sees and the same one that reaches the provider — so
+   * a per-tool opt-out in Settings can be expressed as a plain name list.
+   * Filtering here rather than at call time means a deselected tool is genuinely
+   * absent from the definitions handed to the model, so it is never proposed,
+   * never counted against the tool budget, and never has to be refused.
+   */
+  registerMcpTools(mcpClient, isAllowed) {
+    const parsed = mcpClient.getToolDefinitions().flatMap((def) => {
+      const [, server, tool] = def.name.split("::");
+      return server && tool ? [{ def, server, tool }] : [];
+    });
+    const names = assignMcpToolNames(parsed);
+    parsed.forEach(({ def, server, tool }, i4) => {
       const wrapper = new McpToolWrapper(
         mcpClient,
-        serverName,
-        toolName,
-        def.description.replace(`[MCP:${serverName}] `, ""),
-        def.inputSchema
+        server,
+        tool,
+        def.description.replace(`[MCP:${server}] `, ""),
+        def.inputSchema,
+        names[i4]
       );
+      if (isAllowed && !isAllowed(wrapper.name)) return;
       wrapper.setWorkspaceRoot(this.workspaceRoot);
       this.register(wrapper);
-    }
+    });
   }
   setIgnoredPaths(patterns) {
     this.ignoreMatcher = ignore().add(patterns);
@@ -300153,6 +300379,17 @@ function fileOAuthProvider(storePath) {
     }
   });
 }
+var oauthStoreLocks = /* @__PURE__ */ new Map();
+function withOAuthStoreLock(storePath, fn) {
+  const prev = oauthStoreLocks.get(storePath) ?? Promise.resolve();
+  const run = prev.then(fn, fn);
+  const tail = run.then(() => void 0, () => void 0);
+  oauthStoreLocks.set(storePath, tail);
+  void tail.then(() => {
+    if (oauthStoreLocks.get(storePath) === tail) oauthStoreLocks.delete(storePath);
+  });
+  return run;
+}
 function beginMcpOAuth(provider, serverUrl) {
   return auth(provider, { serverUrl });
 }
@@ -303103,7 +303340,50 @@ var GuidanceQueue = class {
   }
 };
 
+// src/tools/current-page.ts
+var MAX_PAGE_TEXT_CHARS = 4e4;
+var CurrentPageTool = class extends BaseTool {
+  name = "read_current_page";
+  description = 'Read the web page the user currently has open in the built-in browser \u2014 its URL, title, and visible text. Use this whenever the user refers to "this page", "what I am looking at", or asks about something on screen. Prefer it over web_fetch for the open page: it sees content behind a login and content rendered by JavaScript, which web_fetch cannot.';
+  inputSchema = {
+    type: "object",
+    properties: {},
+    required: []
+  };
+  provider;
+  constructor(provider) {
+    super();
+    this.provider = provider;
+  }
+  // Reading what is already on the user's screen changes nothing and reaches
+  // nothing they have not already opened themselves.
+  isDangerous() {
+    return false;
+  }
+  async execute(_input, _options) {
+    let page2;
+    try {
+      page2 = await this.provider();
+    } catch (err) {
+      return `Error: could not read the open page \u2014 ${err instanceof Error ? err.message : String(err)}`;
+    }
+    if (!page2) {
+      return "No page is open in the built-in browser. Ask the user to open one, or use web_fetch for a public URL.";
+    }
+    const text = page2.text.length > MAX_PAGE_TEXT_CHARS ? `${page2.text.slice(0, MAX_PAGE_TEXT_CHARS)}
+
+[truncated \u2014 the page is longer than ${MAX_PAGE_TEXT_CHARS} characters]` : page2.text;
+    return [
+      `URL: ${page2.url}`,
+      `Title: ${page2.title}`,
+      "",
+      text.trim() || "[the page rendered no readable text]"
+    ].join("\n");
+  }
+};
+
 // src/core/cascade.ts
+var ESCALATION_DECISION_TIMEOUT_MS = 5 * 6e4;
 function buildContextualPrompt(prompt, history = []) {
   const recent = history.slice(-6);
   if (recent.length === 0) return prompt;
@@ -303326,6 +303606,94 @@ var Cascade = class _Cascade extends EventEmitter__default.default {
       });
     });
   }
+  // ── Escalation decisions ────────────────────────────────────────────
+  //
+  // A section that ends ESCALATED used to be a dead end: the Cockpit showed
+  // "Section escalated — needs a decision" and no decision was ever requested,
+  // so the run stopped there having spent a full orchestration. This is the
+  // same round-trip shape as plan approval, with one deliberate difference —
+  // an unanswered escalation FAILS the section instead of proceeding.
+  //
+  // That direction is the safe one here. Plan approval defaults to "yes" on
+  // timeout because the plan is already the model's considered proposal;
+  // an escalation exists precisely BECAUSE the worker was not confident, so
+  // acting unattended is the option most likely to be wrong. And in cloud a
+  // waiting run holds server resources, so hanging is not free either.
+  // Keyed by request id, NOT a single slot. A Complex run dispatches each wave
+  // of ready sections with `Promise.all` (t1-administrator.ts), so two sections
+  // can be waiting on a decision at the same moment. A single field made that
+  // case fail hard rather than merely confusingly: the second escalation
+  // overwrote the first's resolver, the user's answer resolved only the second,
+  // and then the FIRST section's timer found the slot already empty and
+  // returned without resolving anything — parking the run forever, past its own
+  // timeout. Same class of bug as the twelve-failover dead-model race: a wave
+  // is concurrent, so per-run singletons are never safe inside it.
+  pendingEscalations = /* @__PURE__ */ new Map();
+  async requestEscalationDecision(ctx, taskId, signal) {
+    if (this.config.autonomy === "auto") return { action: "skip", automatic: true };
+    if (this.listenerCount("escalation:decision-required") === 0) return { action: "skip", automatic: true };
+    if (signal?.aborted) return { action: "skip", automatic: true };
+    const requestId = crypto6.randomUUID();
+    return await new Promise((resolve2) => {
+      let timeout;
+      const settle = (decision) => {
+        if (!this.pendingEscalations.delete(requestId)) return;
+        if (timeout) clearTimeout(timeout);
+        signal?.removeEventListener("abort", onAbort);
+        resolve2(decision);
+      };
+      const onAbort = () => settle({ action: "skip", automatic: true });
+      signal?.addEventListener("abort", onAbort, { once: true });
+      timeout = setTimeout(() => {
+        this.emit("escalation:timeout", { taskId, requestId, sectionId: ctx.sectionId });
+        settle({ action: "timeout" });
+      }, ESCALATION_DECISION_TIMEOUT_MS);
+      this.pendingEscalations.set(requestId, settle);
+      this.emit("escalation:decision-required", {
+        taskId,
+        requestId,
+        sectionId: ctx.sectionId,
+        sectionTitle: ctx.sectionTitle,
+        issues: ctx.issues,
+        summary: ctx.summary,
+        timeoutMs: ESCALATION_DECISION_TIMEOUT_MS
+      });
+    });
+  }
+  /**
+   * Resolve a pending escalation from a REPL / dashboard / cloud listener.
+   *
+   * `requestId` comes back from the `escalation:decision-required` event and is
+   * what makes an answer land on the section that asked. It is optional so a
+   * host with only one escalation in flight (and any caller that predates the
+   * id) still works: without it the oldest outstanding request is answered,
+   * which is correct whenever there is exactly one.
+   *
+   * `automatic` defaults to false — a call into this method is normally a real
+   * person answering the prompt. Pass `true` from a host that is itself
+   * settling the gate on nobody's behalf (a REST caller who never had a
+   * chance to connect, a session halt with no per-section review behind it),
+   * so T2 doesn't set `userSkipped` for a decision no one actually reviewed —
+   * see EscalationDecision.automatic.
+   */
+  resolveEscalation(action, note, requestId, automatic) {
+    const decision = { action, ...note ? { note } : {}, ...automatic ? { automatic: true } : {} };
+    if (requestId) {
+      this.pendingEscalations.get(requestId)?.(decision);
+      return;
+    }
+    const oldest = this.pendingEscalations.keys().next();
+    if (!oldest.done) this.pendingEscalations.get(oldest.value)?.(decision);
+  }
+  /**
+   * Release every parked escalation — run teardown, so none outlive the run.
+   * `automatic: true`: teardown resolving a section nobody answered is the
+   * same system-decided case as the early-return skips above, not a person
+   * reviewing and accepting that section's output.
+   */
+  releasePendingEscalations(action = "skip") {
+    for (const settle of Array.from(this.pendingEscalations.values())) settle({ action, automatic: true });
+  }
   /**
    * Resolve a pending boardroom plan approval from a REPL / dashboard listener.
    * An optional `note` re-plans and re-asks; an optional `editedPlan` is applied
@@ -303459,6 +303827,20 @@ ${input}` }],
     this.mediaSink = sink;
     this.registerMediaTools(this.workspacePath);
   }
+  /**
+   * Let the agent read the page the user has open in the host's browser.
+   *
+   * Host-supplied because only a host WITH a browser can answer it — so the
+   * tool is simply absent in the CLI and in hosted runs, rather than present
+   * and always failing. Registered outside `enabledTools` for the same reason
+   * media tools are: that allowlist is a blast-radius control for tools that
+   * touch the machine, and reading a page the user already opened touches
+   * nothing. `disabledTools` still removes it.
+   */
+  setCurrentPageProvider(provider) {
+    if ((this.config.tools?.disabledTools ?? []).includes("read_current_page")) return;
+    this.toolRegistry.register(new CurrentPageTool(provider));
+  }
   registerMediaTools(workspacePath) {
     const denied = new Set(this.config.tools?.disabledTools ?? []);
     const permitted = (name) => !denied.has(name);
@@ -303591,8 +303973,12 @@ ${last3.partialOutput}` : "");
         for (const server of this.config.tools.mcpServers) {
           try {
             const authProvider = server.oauthStore ? fileOAuthProvider(server.oauthStore) : void 0;
-            await this.mcpClient.connect(server, authProvider ? { authProvider } : {});
-            this.toolRegistry.registerMcpTools(this.mcpClient);
+            const connect = () => this.mcpClient.connect(server, authProvider ? { authProvider } : {});
+            await (server.oauthStore ? withOAuthStoreLock(server.oauthStore, connect) : connect());
+            this.toolRegistry.registerMcpTools(
+              this.mcpClient,
+              (name) => !(this.config.tools?.disabledTools ?? []).includes(name)
+            );
           } catch (err) {
             console.error(`Failed to connect to MCP server "${server.name}":`, err);
           }
@@ -304057,6 +304443,7 @@ ${prompt}` : prompt;
       } else if (complexity === "Moderate") {
         const t22 = new T2Manager(this.router, this.toolRegistry, "root");
         t22.setRunBreaker(runBreaker);
+        t22.setEscalationCallback((ctx) => this.requestEscalationDecision(ctx, taskId, options.signal));
         t22.setPresenter(true);
         t22.setHierarchyContext("You are the ROOT Manager for this task. There is no T1 Administrator involved in this run. You are responsible for decomposing the task and managing T3 workers directly.");
         if (identityPrompt) {
@@ -304101,11 +304488,17 @@ ${prompt}` : prompt;
         t2Results = [t2Result];
         const completed = t2Result.t3Results.filter((r4) => r4.status === "COMPLETED");
         if (completed.length > 0) {
-          finalOutput = t2Result.sectionSummary + "\n\n" + completed.map((r4) => r4.output).join("\n\n");
+          finalOutput = composeRootSectionOutput(
+            t2Result,
+            completed.map((r4) => typeof r4.output === "string" ? r4.output : JSON.stringify(r4.output))
+          );
         } else {
           const partial2 = t2Result.t3Results.map((r4) => typeof r4.output === "string" ? r4.output : "").filter((o3) => o3.trim()).sort((a2, b3) => b3.length - a2.length)[0];
           const reasons = Array.from(
-            new Set(t2Result.t3Results.flatMap((r4) => r4.issues ?? []).filter(Boolean))
+            new Set([
+              ...t2Result.issues ?? [],
+              ...t2Result.t3Results.flatMap((r4) => r4.issues ?? [])
+            ].filter(Boolean))
           );
           if (partial2) {
             finalOutput = reasons.length ? `${partial2}
@@ -304118,6 +304511,7 @@ _(incomplete: ${reasons.join("; ")})_` : partial2;
       } else {
         const t1 = new T1Administrator(this.router, this.toolRegistry, this.config);
         t1.setRunBreaker(runBreaker);
+        t1.setEscalationCallback((ctx) => this.requestEscalationDecision(ctx, taskId, options.signal));
         t1.setPresenter(true);
         t1.setHierarchyContext("You are the top-level Administrator. You are responsible for the overall plan and supervising multiple T2 Managers.");
         if (identityPrompt) {
@@ -304142,6 +304536,8 @@ _(incomplete: ${reasons.join("; ")})_` : partial2;
         finalOutput = result.output;
         t2Results = result.t2Results;
       }
+      const budgetInfo = this.router.budgetExceededInfo();
+      if (budgetInfo) throw new CascadeRouter.BudgetExceededError(budgetInfo.reason);
       const trip = runBreaker.reason();
       if (trip) {
         finalOutput = [
@@ -304182,6 +304578,10 @@ ${finalOutput}` : ""
         escalator.cancelAllPending();
       } catch {
       }
+      try {
+        this.releasePendingEscalations();
+      } catch {
+      }
       this.router.restoreTierModels();
       this.router.setRunSignal(void 0);
       if (this.taskAnalyzer) {
@@ -305498,6 +305898,13 @@ var ConfigManager = class {
   }
   async load() {
     this.config = await this.loadConfig();
+    const servers = this.config.tools?.mcpServers;
+    const { servers: disambiguated, renames } = servers?.length ? disambiguateMcpServerNames(servers) : { servers, renames: [] };
+    const mcpNamesChanged = renames.length > 0;
+    if (mcpNamesChanged && this.config.tools) {
+      this.config.tools.mcpServers = disambiguated;
+      this.renameMcpServerReferences(renames);
+    }
     this.ignore = new CascadeIgnore();
     await this.ignore.load(this.workspacePath);
     this.cascadeMd = await loadCascadeMd(this.workspacePath);
@@ -305506,6 +305913,7 @@ var ConfigManager = class {
     await this.injectEnvKeys();
     this.config.providers = mergeGlobalCredentials(this.config.providers, loadGlobalCredentials(this.globalDir));
     await this.ensureDefaultIdentity();
+    if (mcpNamesChanged) await this.save();
   }
   getConfig() {
     return this.config;
@@ -305589,6 +305997,66 @@ var ConfigManager = class {
       this.config.providers.push({ type: "ollama" });
     }
   }
+  /**
+   * Follow a disambiguation rename into `tools.mcpTrusted`.
+   *
+   * `mcpTrusted` is matched by EXACT name (`McpClient.connect()`). Two shapes
+   * of rename reach here, and they need OPPOSITE treatment:
+   *
+   * - Distinct raw names that only collide via sanitizing (`foo bar` /
+   *   `foo@bar`): each had its OWN trust entry, and the old string now belongs
+   *   to nothing — the server that used it moved away, so the entry has to
+   *   move with it. A plain rewrite is correct here.
+   * - Literally identical names (a hand-edited or duplicated config: two rows
+   *   both named `foo`): there is only ONE trust entry for both, since
+   *   `mcpTrusted` itself is deduplicated. `this.config.tools.mcpServers` has
+   *   already been updated to the disambiguated list by the time this runs
+   *   (see `load()`), so the untouched survivor is STILL named `foo` — a plain
+   *   rewrite would move the one entry entirely onto the renamed row and
+   *   leave the survivor untrusted. The entry must be kept for the survivor
+   *   AND granted to the renamed identity, not moved.
+   *
+   * Renames are grouped by `from` before either treatment is applied, and
+   * each group is settled in one step. Two DIFFERENT rows can start out with
+   * the exact same raw name and BOTH get renamed away (e.g. three servers
+   * named `foo bar`, `foo@bar`, `foo@bar` — the two `foo@bar` rows collide
+   * with `foo bar` and with each other, so both are renamed to distinct
+   * identities while `foo bar` survives untouched). Processing renames one at
+   * a time in that shape drops coverage: the first rename's REPLACE branch
+   * would erase `from` from `trusted` entirely, so the guard on the second
+   * rename with the same `from` sees it already gone and silently skips —
+   * granting trust to only one of the two renamed identities. Grouping first
+   * means every renamed identity that shares a `from` is added or substituted
+   * together, in the one pass that still sees the original entry.
+   *
+   * `tools.disabledTools` deliberately gets no equivalent treatment. It's
+   * matched by sanitized PREFIX, and a prefix collision is exactly what made
+   * an existing entry ambiguous between the two servers in the first place —
+   * there is no way to tell, from the stored string alone, which of the two
+   * a denial was meant for. Leaving those entries untouched resolves that
+   * ambiguity for free: the survivor keeps the original (now unique) prefix,
+   * so an old entry keeps applying to it, while the renamed server starts
+   * clean under its new prefix. Rewriting the entry to follow the rename
+   * would do the opposite — move a denial that already worked for the
+   * survivor onto a server it may never have meant to cover.
+   */
+  renameMcpServerReferences(renames) {
+    const tools = this.config.tools;
+    if (!tools?.mcpTrusted?.length || !renames.length) return;
+    const currentNames = new Set((tools.mcpServers ?? []).map((s3) => s3.name));
+    const byFrom = /* @__PURE__ */ new Map();
+    for (const { from, to } of renames) {
+      const tos = byFrom.get(from);
+      if (tos) tos.push(to);
+      else byFrom.set(from, [to]);
+    }
+    let trusted = tools.mcpTrusted;
+    for (const [from, tos] of byFrom) {
+      if (!trusted.includes(from)) continue;
+      trusted = currentNames.has(from) ? [...trusted, ...tos] : [...trusted.filter((n8) => n8 !== from), ...tos];
+    }
+    tools.mcpTrusted = Array.from(new Set(trusted));
+  }
   async ensureDefaultIdentity() {
     const existing = this.store.getDefaultIdentity();
     if (existing) return;
@@ -306492,6 +306960,14 @@ var DashboardSocket = class {
     this.secret = options.secret;
     this.setupHandlers();
   }
+  /** How many sockets are currently in a room — 0 means nobody can answer. */
+  roomSize(room) {
+    return this.io.sockets.adapter.rooms.get(room)?.size ?? 0;
+  }
+  /** Is this exact connection still live? A reconnect issues a NEW socket id. */
+  hasSocket(socketId) {
+    return this.io.sockets.sockets.has(socketId);
+  }
   broadcastToRoom(room, event, data) {
     this.io.to(room).emit(event, data);
   }
@@ -306563,6 +307039,22 @@ var DashboardSocket = class {
       });
     });
   }
+  /**
+   * A client subscribed to a session's room.
+   *
+   * The host uses this to replay a gate the run is already parked on. Socket.IO
+   * does not buffer room emissions, so a prompt broadcast while the renderer was
+   * reconnecting is simply gone; without a replay the section waits out its full
+   * timeout with the user sitting in front of a screen that never asked.
+   */
+  onJoinSession(callback) {
+    this.io.on("connection", (socket) => {
+      socket.on("join:session", (payload) => {
+        const { sessionId } = normalizeSessionSubscriptionPayload(payload);
+        if (sessionId) callback(sessionId, socket.id);
+      });
+    });
+  }
   onSessionRate(callback) {
     this.io.on("connection", (socket) => {
       socket.on("session:rate", (payload) => {
@@ -306600,6 +307092,31 @@ var DashboardSocket = class {
       });
     });
   }
+  /**
+   * A section escalated and the run is parked waiting for an answer. The
+   * desktop shows the escalation modal on `escalation:decision-required` and
+   * answers here.
+   *
+   * Unlike a plan decision, silence is NOT taken as consent — the SDK fails
+   * the section on timeout — so this handler only ever forwards a real choice.
+   */
+  onEscalationDecision(callback) {
+    this.io.on("connection", (socket) => {
+      socket.on("escalation:decide", (payload) => {
+        const action = payload?.action;
+        if (typeof payload?.sessionId !== "string") return;
+        if (action !== "retry" && action !== "skip" && action !== "guidance") return;
+        callback({
+          sessionId: payload.sessionId,
+          // Identifies WHICH parked section this answers — sections in a wave
+          // run concurrently, so more than one can be waiting.
+          requestId: typeof payload.requestId === "string" ? payload.requestId : void 0,
+          action,
+          note: typeof payload.note === "string" && payload.note.trim() ? payload.note.trim() : void 0
+        });
+      });
+    });
+  }
   onSessionSteer(callback) {
     this.io.on("connection", (socket) => {
       socket.on("session:steer", (payload) => {
@@ -306761,6 +307278,7 @@ function aggregateCostStats(sessions, opts = {}) {
 
 // src/dashboard/server.ts
 var __dirname2 = path26__namespace.default.dirname(Url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('desktop-core.cjs', document.baseURI).href))));
+var ORPHANED_ESCALATION_GRACE_MS = 3e4;
 var DashboardServer = class {
   app;
   httpServer;
@@ -306771,6 +307289,13 @@ var DashboardServer = class {
   globalStore = null;
   broadcastTimer = null;
   activeSessions = /* @__PURE__ */ new Map();
+  /**
+   * Supplied by the desktop shell so a run can read the page the user has
+   * open in the built-in browser. Absent in the CLI, where there is no
+   * browser — so the tool is simply not registered rather than present and
+   * always failing.
+   */
+  currentPageProvider;
   activeControllers = /* @__PURE__ */ new Map();
   /**
    * Run taskIds per chat session — file snapshots are keyed by the run's
@@ -306785,6 +307310,17 @@ var DashboardServer = class {
    * map is how that answer reaches the run that's blocked on it.
    */
   pendingApprovals = /* @__PURE__ */ new Map();
+  /**
+   * The escalation prompt a session is currently parked on, kept so it can be
+   * delivered to a client that was not reachable when it was raised.
+   *
+   * Socket.IO buffers nothing: a prompt emitted while the renderer is mid
+   * reconnect is gone, and the section then waits out its full five minutes
+   * with the user in front of a screen that never asked them anything. Holding
+   * the payload lets `join:session` replay it, and lets a run with no reachable
+   * client be settled instead of parked (see ORPHANED_ESCALATION_GRACE_MS).
+   */
+  pendingEscalations = /* @__PURE__ */ new Map();
   /**
    * The orchestration decision trail ("why") of each session's most recent
    * run — captured when the run ends so the desktop's Why panel can show it
@@ -306862,20 +307398,29 @@ var DashboardServer = class {
       if (forceTier) cfg = { ...cfg, routing: { ...cfg.routing, forceTier } };
       const cascade = new Cascade(cfg, this.workspacePath, this.store);
       this.activeSessions.set(sessionId, cascade);
+      if (this.currentPageProvider) cascade.setCurrentPageProvider(this.currentPageProvider);
       cascade.on("stream:token", (e3) => {
-        this.socket.emitToSocket(socketId, "stream:token", { sessionId, tierId: e3.tierId, text: e3.text, primary: e3.primary });
+        this.emitToSessionClients(socketId, sessionId, "stream:token", { sessionId, tierId: e3.tierId, text: e3.text, primary: e3.primary });
       });
       cascade.on("tier:status", (e3) => {
-        this.socket.emitToSocket(socketId, "tier:status", { sessionId, ...e3 });
+        this.emitToSessionClients(socketId, sessionId, "tier:status", { sessionId, ...e3 });
       });
       cascade.on("permission:user-required", (e3) => {
-        this.socket.emitToSocket(socketId, "permission:user-required", { sessionId, ...e3 });
+        this.emitToSessionClients(socketId, sessionId, "permission:user-required", { sessionId, ...e3 });
       });
       cascade.on("peer:message", (e3) => {
         this.socket.emitPeerMessage(e3);
       });
       cascade.on("plan:approval-required", (e3) => {
-        this.socket.emitToSocket(socketId, "plan:approval-required", { sessionId, ...e3 });
+        this.emitToSessionClients(socketId, sessionId, "plan:approval-required", { sessionId, ...e3 });
+      });
+      cascade.on("escalation:decision-required", (e3) => {
+        this.raiseEscalation(sessionId, socketId, e3);
+      });
+      cascade.on("escalation:timeout", (e3) => {
+        const ev = e3;
+        if (ev.requestId) this.clearPendingEscalation(ev.requestId);
+        this.emitToSessionClients(socketId, sessionId, "escalation:timeout", { sessionId, ...e3 });
       });
       try {
         const result = await cascade.run({
@@ -306886,7 +307431,7 @@ var DashboardServer = class {
         this.recordSessionTask(sessionId, result.taskId);
         this.persistRunEnd(sessionId, title, prompt, result.output, "COMPLETED", result);
         this.captureWhy(sessionId, cascade, result);
-        this.socket.emitToSocket(socketId, "session:complete", { sessionId, result });
+        this.emitToSessionClients(socketId, sessionId, "session:complete", { sessionId, result });
         this.socket.broadcast("cost:update", {
           sessionId,
           totalTokens: result.usage.totalTokens,
@@ -306899,7 +307444,7 @@ var DashboardServer = class {
       } catch (err) {
         this.persistRunEnd(sessionId, title, prompt, void 0, "FAILED");
         this.captureWhy(sessionId, cascade);
-        this.socket.emitToSocket(socketId, "session:error", {
+        this.emitToSessionClients(socketId, sessionId, "session:error", {
           sessionId,
           error: err instanceof Error ? err.message : String(err)
         });
@@ -306907,6 +307452,7 @@ var DashboardServer = class {
         this.activeSessions.delete(sessionId);
         this.activeControllers.delete(sessionId);
         this.denyPendingApprovals(sessionId);
+        this.clearSessionEscalations(sessionId);
       }
     });
     this.socket.onPlanDecision(({ sessionId, approved, note, editedPlan }) => {
@@ -306916,10 +307462,20 @@ var DashboardServer = class {
         editedPlan
       );
     });
+    this.socket.onEscalationDecision(({ sessionId, requestId, action, note }) => {
+      if (requestId) this.clearPendingEscalation(requestId);
+      else this.clearOldestSessionEscalation(sessionId);
+      this.activeSessions.get(sessionId)?.resolveEscalation(action, note, requestId);
+    });
+    this.socket.onJoinSession((sessionId, socketId) => {
+      this.replayEscalations(sessionId, socketId);
+    });
     this.socket.onSessionHalt((sessionId) => {
       this.activeControllers.get(sessionId)?.abort();
       this.denyPendingApprovals(sessionId);
       this.activeSessions.get(sessionId)?.resolvePlanApproval(false);
+      this.clearSessionEscalations(sessionId);
+      this.activeSessions.get(sessionId)?.resolveEscalation("skip", void 0, void 0, true);
     });
     this.socket.onApprovalResponse(({ requestId, approved, always }) => {
       const pending = this.pendingApprovals.get(requestId);
@@ -306934,6 +307490,10 @@ var DashboardServer = class {
       }
     });
   }
+  /** Wire the host's browser view in (desktop only). */
+  setCurrentPageProvider(provider) {
+    this.currentPageProvider = provider;
+  }
   async start() {
     const isLoopback = this.host === "127.0.0.1" || this.host === "::1" || this.host === "localhost";
     if (!isLoopback) {
@@ -307222,6 +307782,116 @@ var DashboardServer = class {
       this.activeSessions.delete(sessionId);
     }
   }
+  /**
+   * Is anyone able to answer for this session right now?
+   *
+   * The originating socket first — that connection is definitely watching this
+   * run — then the session room, which is where a client lands after a
+   * reconnect issues it a new socket id.
+   */
+  hasResponder(sessionId, socketId) {
+    if (socketId && this.socket.hasSocket(socketId)) return true;
+    return this.socket.roomSize(`session:${sessionId}`) > 0;
+  }
+  /**
+   * Send a run event to whoever is watching this session.
+   *
+   * A captured socket id goes stale the moment Socket.IO reconnects — the
+   * client is back, but under a new id, and `emitToSocket` on the old one is a
+   * silent no-op. Falling back to the session room keeps the run addressable
+   * across a reconnect; emitting to one OR the other (never both) keeps a
+   * client that is both the originator and a room member from seeing every
+   * token twice.
+   */
+  emitToSessionClients(socketId, sessionId, event, data) {
+    if (socketId && this.socket.hasSocket(socketId)) this.socket.emitToSocket(socketId, event, data);
+    else this.socket.broadcastToRoom(`session:${sessionId}`, event, data);
+  }
+  /**
+   * Raise an escalation prompt, and make sure it can still be answered.
+   *
+   * Held in `pendingEscalations` — keyed by requestId, because a Complex wave
+   * dispatches sections concurrently and two can be parked at once — so a
+   * client that joins late (or rejoins after a reconnect) gets every waiting
+   * prompt replayed. Keying by session would drop the first of a pair: its
+   * grace timer would be cleared by the second, leaving it parked for the full
+   * timeout with nobody able to answer it. If nobody is reachable at all, the gate is
+   * settled as `skip` after a short grace period rather than parked for the
+   * full timeout: that matches the SDK's policy when no listener exists, and
+   * five minutes of a held run is a real cost for a REST caller who has already
+   * hung up. The grace period exists so an ordinary two-second reconnect is not
+   * mistaken for an absent user.
+   */
+  raiseEscalation(sessionId, socketId, event) {
+    const requestId = typeof event.requestId === "string" && event.requestId ? event.requestId : crypto6.randomUUID();
+    const payload = { sessionId, ...event };
+    const entry = { payload, sessionId, requestId, raisedAt: Date.now() };
+    this.pendingEscalations.set(requestId, entry);
+    if (this.hasResponder(sessionId, socketId)) {
+      this.emitToSessionClients(socketId, sessionId, "escalation:decision-required", payload);
+      return;
+    }
+    entry.graceTimer = setTimeout(() => {
+      if (this.pendingEscalations.get(requestId) !== entry) return;
+      if (this.hasResponder(sessionId, socketId)) return;
+      this.pendingEscalations.delete(requestId);
+      this.activeSessions.get(sessionId)?.resolveEscalation("skip", "No client was connected to answer.", requestId, true);
+    }, ORPHANED_ESCALATION_GRACE_MS);
+  }
+  /**
+   * Replay EVERY parked prompt to a client that just subscribed to the session.
+   *
+   * Plural because a Complex run dispatches sections concurrently, so a wave can
+   * leave more than one waiting at the same time — the same reason the SDK keys
+   * its gates and the clients queue theirs.
+   *
+   * `timeoutMs` is recomputed as the time actually LEFT, because the SDK's timer
+   * has been running since the prompt was raised. Sent verbatim, a client
+   * reconnecting four minutes in would show a fresh five-minute countdown and
+   * then watch the section fail with four of those minutes still on the clock.
+   * A remaining duration is used rather than an absolute deadline so the two
+   * sides never have to agree on a wall clock.
+   */
+  replayEscalations(sessionId, socketId) {
+    for (const entry of this.pendingEscalations.values()) {
+      if (entry.sessionId !== sessionId) continue;
+      if (entry.graceTimer) {
+        clearTimeout(entry.graceTimer);
+        entry.graceTimer = void 0;
+      }
+      const originalTimeout = typeof entry.payload.timeoutMs === "number" ? entry.payload.timeoutMs : 0;
+      const remaining = Math.max(0, originalTimeout - (Date.now() - entry.raisedAt));
+      this.socket.emitToSocket(socketId, "escalation:decision-required", { ...entry.payload, timeoutMs: remaining });
+    }
+  }
+  /** Forget ONE parked prompt — the one that was answered or timed out. */
+  clearPendingEscalation(requestId) {
+    const entry = this.pendingEscalations.get(requestId);
+    if (!entry) return;
+    if (entry.graceTimer) clearTimeout(entry.graceTimer);
+    this.pendingEscalations.delete(requestId);
+  }
+  /**
+   * Forget the session's OLDEST prompt — for a client that answered without a
+   * requestId, which is exactly the gate `resolveEscalation` will settle.
+   * Insertion order makes `values()` oldest-first.
+   */
+  clearOldestSessionEscalation(sessionId) {
+    for (const [id, entry] of this.pendingEscalations) {
+      if (entry.sessionId !== sessionId) continue;
+      if (entry.graceTimer) clearTimeout(entry.graceTimer);
+      this.pendingEscalations.delete(id);
+      return;
+    }
+  }
+  /** Forget every prompt a session was parked on (run ended, or halted). */
+  clearSessionEscalations(sessionId) {
+    for (const [id, entry] of this.pendingEscalations) {
+      if (entry.sessionId !== sessionId) continue;
+      if (entry.graceTimer) clearTimeout(entry.graceTimer);
+      this.pendingEscalations.delete(id);
+    }
+  }
   /** Deny + clear any approvals still pending for a session (run end / abort). */
   denyPendingApprovals(sessionId) {
     for (const [id, pending] of this.pendingApprovals) {
@@ -307722,6 +308392,7 @@ ${prompt}`;
       void (async () => {
         const cascade = new Cascade(this.config, this.workspacePath, this.store);
         this.activeSessions.set(sessionId, cascade);
+        if (this.currentPageProvider) cascade.setCurrentPageProvider(this.currentPageProvider);
         cascade.on("stream:token", (e3) => {
           this.socket.broadcastToRoom(`session:${sessionId}`, "stream:token", { sessionId, tierId: e3.tierId, text: e3.text, primary: e3.primary });
         });
@@ -307737,6 +308408,14 @@ ${prompt}`;
         cascade.on("plan:approval-required", (e3) => {
           this.socket.broadcastToRoom(`session:${sessionId}`, "plan:approval-required", { sessionId, ...e3 });
         });
+        cascade.on("escalation:decision-required", (e3) => {
+          this.raiseEscalation(sessionId, void 0, e3);
+        });
+        cascade.on("escalation:timeout", (e3) => {
+          const ev = e3;
+          if (ev.requestId) this.clearPendingEscalation(ev.requestId);
+          this.socket.broadcastToRoom(`session:${sessionId}`, "escalation:timeout", { sessionId, ...e3 });
+        });
         try {
           const result = await cascade.run({
             prompt: runPrompt,
@@ -307764,6 +308443,7 @@ ${prompt}`;
         } finally {
           this.activeSessions.delete(sessionId);
           this.denyPendingApprovals(sessionId);
+          this.clearSessionEscalations(sessionId);
         }
       })();
     });
@@ -308096,6 +308776,41 @@ var HooksRunner = class {
   }
 };
 
+// src/mcp/discover.ts
+async function discoverMcpTools(servers) {
+  const results = [];
+  for (const server of servers) {
+    const client = new McpClient({ trustedServers: [server.name] });
+    try {
+      const authProvider = server.oauthStore ? fileOAuthProvider(server.oauthStore) : void 0;
+      const connect = () => client.connect(server, authProvider ? { authProvider } : {});
+      await (server.oauthStore ? withOAuthStoreLock(server.oauthStore, connect) : connect());
+      const parsed = client.getToolDefinitions().flatMap((def) => {
+        const [, serverName, toolName] = def.name.split("::");
+        return serverName && toolName ? [{ def, server: serverName, tool: toolName }] : [];
+      });
+      const names = assignMcpToolNames(parsed);
+      const tools = parsed.map(({ def, server: s3, tool }, i4) => ({
+        server: s3,
+        tool,
+        name: names[i4],
+        description: def.description.replace(`[MCP:${s3}] `, "")
+      }));
+      results.push({ server: server.name, tools });
+    } catch (err) {
+      results.push({
+        server: server.name,
+        tools: [],
+        error: err instanceof Error ? err.message : String(err)
+      });
+    } finally {
+      await client.disconnectAll().catch(() => {
+      });
+    }
+  }
+  return results;
+}
+
 // src/retrieval/chunk.ts
 var DEFAULTS2 = { targetChars: 2e3, overlapChars: 200, minChars: 80 };
 function splitLongBlock(block, max) {
@@ -308634,11 +309349,55 @@ function mergeByKey(local, incoming, key) {
   for (const i4 of incoming) map.set(key(i4), i4);
   return [...map.values()];
 }
+function uniqueServerName(desired, takenPrefixes) {
+  if (!takenPrefixes.has(mcpServerPrefix(desired))) return desired;
+  let n8 = 2;
+  while (takenPrefixes.has(mcpServerPrefix(`${desired} ${n8}`))) n8++;
+  return `${desired} ${n8}`;
+}
+function mergeMcpServers(local, incoming) {
+  const rewrite = /* @__PURE__ */ new Map();
+  if (!incoming?.length) return { servers: local, synced: [], rewrite };
+  const byName = /* @__PURE__ */ new Map();
+  for (const l2 of local ?? []) byName.set(l2.name, l2);
+  const prefixes = new Set([...byName.values()].map((m3) => mcpServerPrefix(m3.name)));
+  const synced = [];
+  for (const inc of incoming) {
+    if (byName.has(inc.name)) {
+      byName.set(inc.name, inc);
+      synced.push(inc);
+      continue;
+    }
+    const name = uniqueServerName(inc.name, prefixes);
+    if (name !== inc.name) rewrite.set(mcpServerPrefix(inc.name), mcpServerPrefix(name));
+    const server = name === inc.name ? inc : { ...inc, name };
+    byName.set(name, server);
+    synced.push(server);
+    prefixes.add(mcpServerPrefix(name));
+  }
+  return { servers: [...byName.values()], synced, rewrite };
+}
+function rewriteDisabledTools(tools, rewrite) {
+  if (!tools?.length || rewrite.size === 0) return tools;
+  return tools.map((t4) => {
+    for (const [from, to] of rewrite) if (t4.startsWith(from)) return to + t4.slice(from.length);
+    return t4;
+  });
+}
+function mergeDisabledTools(local, incoming, syncedServers) {
+  const prefixes = (syncedServers ?? []).map((m3) => mcpServerPrefix(m3.name));
+  const covered = (tool) => prefixes.some((p3) => tool.startsWith(p3));
+  const kept = (local ?? []).filter((t4) => !covered(t4));
+  const merged = [.../* @__PURE__ */ new Set([...kept, ...incoming ?? []])];
+  return merged.length ? merged : void 0;
+}
 function gatherSyncBundle(config2) {
-  const bundle = { v: 1 };
+  const bundle = { v: 2 };
   if (config2.providers?.length) bundle.providers = config2.providers;
   if (config2.tools?.webSearch) bundle.webSearch = config2.tools.webSearch;
   if (config2.tools?.mcpServers?.length) bundle.mcpServers = config2.tools.mcpServers;
+  const syncedDisabledTools = config2.tools?.disabledTools?.filter(isMcpToolName);
+  if (syncedDisabledTools?.length) bundle.disabledTools = syncedDisabledTools;
   if (config2.models) bundle.models = config2.models;
   if (config2.budget) bundle.budget = config2.budget;
   const prefs = {};
@@ -308653,7 +309412,16 @@ function applySyncBundle(bundle, config2) {
   const next = { ...config2, tools: { ...config2.tools } };
   if (bundle.providers) next.providers = mergeByKey(config2.providers, bundle.providers, providerSig) ?? [];
   if (bundle.webSearch) next.tools.webSearch = { ...config2.tools?.webSearch, ...bundle.webSearch };
-  if (bundle.mcpServers) next.tools.mcpServers = mergeByKey(config2.tools?.mcpServers, bundle.mcpServers, (m3) => m3.name);
+  const mcp = mergeMcpServers(config2.tools?.mcpServers, bundle.mcpServers);
+  if (bundle.mcpServers) next.tools.mcpServers = mcp.servers;
+  const carriesSelections = bundle.v >= 2 || bundle.disabledTools !== void 0;
+  if (carriesSelections && (bundle.mcpServers || bundle.disabledTools)) {
+    next.tools.disabledTools = mergeDisabledTools(
+      config2.tools?.disabledTools,
+      rewriteDisabledTools(bundle.disabledTools, mcp.rewrite),
+      bundle.mcpServers ? mcp.synced : void 0
+    );
+  }
   if (bundle.models) next.models = { ...config2.models, ...bundle.models };
   if (bundle.budget) next.budget = { ...config2.budget, ...bundle.budget };
   if (bundle.prefs) {
@@ -309088,6 +309856,7 @@ exports.CascadeToolError = CascadeToolError;
 exports.CloudClient = CloudClient;
 exports.CodeSearchTool = CodeSearchTool;
 exports.ConfigManager = ConfigManager;
+exports.CurrentPageTool = CurrentPageTool;
 exports.DEFAULT_API_PORT = DEFAULT_API_PORT;
 exports.DEFAULT_APPROVAL_REQUIRED = DEFAULT_APPROVAL_REQUIRED;
 exports.DEFAULT_AUTO_SUMMARIZE_AT = DEFAULT_AUTO_SUMMARIZE_AT;
@@ -309110,6 +309879,8 @@ exports.HooksRunner = HooksRunner;
 exports.Keystore = Keystore;
 exports.LLMReranker = LLMReranker;
 exports.LM_STUDIO_BASE_URL = LM_STUDIO_BASE_URL;
+exports.MAX_PAGE_TEXT_CHARS = MAX_PAGE_TEXT_CHARS;
+exports.MCP_TOOL_PREFIX = MCP_TOOL_PREFIX;
 exports.MODELS = MODELS;
 exports.McpClient = McpClient;
 exports.McpOAuthProvider = McpOAuthProvider;
@@ -309146,7 +309917,9 @@ exports.connectMcpWithLoopbackOAuth = connectMcpWithLoopbackOAuth;
 exports.createCascade = createCascade;
 exports.decryptSyncBlob = decryptJSON;
 exports.diffManifest = diffManifest;
+exports.disambiguateMcpServerNames = disambiguateMcpServerNames;
 exports.discoverMcpAuthServer = discoverMcpAuthServer;
+exports.discoverMcpTools = discoverMcpTools;
 exports.distillSessionFacts = distillSessionFacts;
 exports.embedderFromProviders = embedderFromProviders;
 exports.encryptSyncBlob = encryptJSON;
@@ -309155,12 +309928,17 @@ exports.gatherSyncBundle = gatherSyncBundle;
 exports.hashContent = hashContent;
 exports.heuristicCodeChunker = heuristicCodeChunker;
 exports.inferAzureBaseModel = inferAzureBaseModel;
+exports.isMcpToolName = isMcpToolName;
+exports.mcpServerPrefix = mcpServerPrefix;
+exports.mcpToolName = mcpToolName;
 exports.nodeHttpFetch = nodeHttpFetch;
 exports.parseRankOrder = parseRankOrder;
 exports.planRetrieval = planRetrieval;
 exports.preferIpv4Host = preferIpv4Host;
 exports.reciprocalRankFusion = reciprocalRankFusion;
 exports.refreshMcpToken = refreshMcpToken;
+exports.removeMcpServerDenials = removeMcpServerDenials;
 exports.runCascade = runCascade;
 exports.sessionWorthRemembering = sessionWorthRemembering;
 exports.streamCascade = streamCascade;
+exports.uniqueMcpServerName = uniqueMcpServerName;