chainlesschain 0.162.107 → 0.162.109

package/src/lib/mcp-auth-target.js

@@ -0,0 +1,53 @@
+/**
+ * mcp-auth-target — resolve a `cc mcp login|logout <target>` argument.
+ *
+ * Claude-Code 2.1.186 parity: `mcp login <name>` / `mcp logout <name>` accept
+ * the NAME of a configured MCP server, not only a raw URL. A `target` that
+ * already looks like a `scheme://…` URL is used verbatim (fast path — no DB
+ * needed); otherwise it is treated as a configured-server name and resolved to
+ * its stored url via the injected `lookupServer(name)` callback.
+ *
+ * Pure (no DB / IO of its own) so it is unit-testable; the caller supplies the
+ * `lookupServer` resolver (DB-backed in the command, a stub in tests).
+ */
+
+/** A `scheme://` URL (http, https, …) — not a bare host or a server name. */
+export function isUrlLike(s) {
+  return /^[a-z][a-z0-9+.-]*:\/\//i.test(String(s || "").trim());
+}
+
+/**
+ * Resolve a login/logout target to a concrete server URL.
+ *
+ * @param {string} target  a URL or a configured MCP server name
+ * @param {(name: string) => ({ name?: string, url?: string|null,
+ *   transport?: string }|null)} [lookupServer]  name → server config (or null)
+ * @returns {{ url: string, name: string|null, source: "url"|"config" }}
+ * @throws {Error} when target is empty, names an unknown server, or names a
+ *   server that has no http(s) url (stdio servers cannot do OAuth login)
+ */
+export function resolveMcpAuthTarget(target, lookupServer) {
+  const t = typeof target === "string" ? target.trim() : "";
+  if (!t) {
+    throw new Error("a server URL or configured server name is required");
+  }
+  if (isUrlLike(t)) {
+    return { url: t, name: null, source: "url" };
+  }
+  const server = typeof lookupServer === "function" ? lookupServer(t) : null;
+  if (!server) {
+    throw new Error(
+      `no configured MCP server named "${t}" (and it is not a URL) — ` +
+        `run "cc mcp servers" to list, or pass the full https:// URL`,
+    );
+  }
+  const url = server.url || null;
+  if (!url || !isUrlLike(url)) {
+    throw new Error(
+      `configured server "${t}" has no http(s) URL (transport: ` +
+        `${server.transport || "stdio"}); OAuth login only applies to remote ` +
+        `http/sse MCP servers`,
+    );
+  }
+  return { url, name: server.name || t, source: "config" };
+}

package/src/lib/repl-completer.js

@@ -136,23 +136,62 @@ export function makeAtCompleter(opts = {}) {
     ? [...new Set(opts.slashCommands)].sort()
     : [];
 
+  // User/project custom slash commands (.claude/commands/*.md → `/git:commit`),
+  // surfaced in TAB completion the same as built-ins (Claude-Code parity — its
+  // slash autocomplete includes user-authored commands too). Pulled from an
+  // injected SYNC source so newly authored command files become completable
+  // without a restart and `/cd` follows whichever project's commands apply.
+  // Cached with the same short TTL as the IDE source so a burst of TABs never
+  // re-walks the filesystem.
+  const getDynamic =
+    typeof opts.getDynamicSlashCommands === "function"
+      ? opts.getDynamicSlashCommands
+      : null;
+  let dynCache = [];
+  let dynFetchedAt = -Infinity;
+  const dynamicSlashCommands = () => {
+    if (!getDynamic) return [];
+    if (now() - dynFetchedAt < IDE_CACHE_TTL_MS) return dynCache;
+    try {
+      const list = getDynamic();
+      dynCache = Array.isArray(list)
+        ? list.filter((c) => typeof c === "string" && c)
+        : [];
+    } catch {
+      dynCache = []; // a broken command source never breaks completion
+    }
+    dynFetchedAt = now();
+    return dynCache;
+  };
+  const mergedSlashCommands = () => {
+    const dyn = dynamicSlashCommands();
+    if (!dyn.length) return slashCommands; // common case: built-ins only
+    return [...new Set([...slashCommands, ...dyn])].sort();
+  };
+
   const completer = (line) => {
     // `/command` completion (Claude-Code parity): only while typing the
-    // command token itself — once a space follows, args are the user's.
-    const slash = /^\/([A-Za-z_-]*)$/.exec(line);
-    if (slash && slashCommands.length) {
-      const pref = `/${slash[1].toLowerCase()}`;
-      const hits = slashCommands.filter((c) =>
-        c.toLowerCase().startsWith(pref),
-      );
-      return [hits, line];
+    // command token itself — once a space follows, args are the user's. The
+    // token charset includes `:` / `.` / digits so namespaced custom commands
+    // (`/git:commit` from commands/git/commit.md) complete too.
+    const slash = /^\/([A-Za-z0-9:._-]*)$/.exec(line);
+    if (slash) {
+      const all = mergedSlashCommands();
+      if (all.length) {
+        const pref = `/${slash[1].toLowerCase()}`;
+        const hits = all.filter((c) => c.toLowerCase().startsWith(pref));
+        return [hits, line];
+      }
     }
     const at = extractAtPrefix(line);
     if (!at) return [[], line];
     refreshIde(); // async top-up for the NEXT tab; this one uses the cache
     const norm = fwd(at.prefix).toLowerCase();
     const fromIde = ideFiles.filter((f) => f.toLowerCase().startsWith(norm));
-    const fromFs = fileCandidates(at.prefix, { cwd: getCwd(), deps: opts.deps });
+    const fromFs = fileCandidates(at.prefix, {
+      cwd: getCwd(),
+      deps: opts.deps,
+    });
     const merged = [...new Set([...fromIde, ...fromFs])].slice(
       0,
       MAX_CANDIDATES,

package/src/lib/shell-approval.js

@@ -19,20 +19,20 @@
  * riskLevel, policy }` so callers don't have to juggle two decision types.
  */
 
-const sharedShellPolicy = require("../runtime/coding-agent-shell-policy.cjs");
-const {
-  APPROVAL_RISK: RISK,
-  APPROVAL_DECISION: DECISION,
-} = require("@chainlesschain/session-core");
+import sharedShellPolicy from "../runtime/coding-agent-shell-policy.cjs";
+import {
+  APPROVAL_RISK as RISK,
+  APPROVAL_DECISION as DECISION,
+} from "@chainlesschain/session-core";
 
-const SHELL_TO_RISK = {
+export const SHELL_TO_RISK = {
   allow: RISK.LOW,
   warn: RISK.MEDIUM,
   deny: RISK.HIGH,
   reroute: RISK.HIGH,
 };
 
-async function evaluateShellCommandWithApproval({
+export async function evaluateShellCommandWithApproval({
   command,
   sessionId = null,
   approvalGate = null,
@@ -89,8 +89,3 @@ async function evaluateShellCommandWithApproval({
     policy: gateResult.policy,
   };
 }
-
-module.exports = {
-  evaluateShellCommandWithApproval,
-  SHELL_TO_RISK,
-};

package/src/lib/skill-loader.js

@@ -129,8 +129,12 @@ export function parseSkillMd(content) {
       const key = trimmed.slice(0, colonIndex).trim();
       let value = trimmed.slice(colonIndex + 1).trim();
 
-      // Convert kebab-case to camelCase
-      const camelKey = key.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
+      // Normalize frontmatter key case to camelCase. Claude-Code skills
+      // (auto-loaded from .claude/skills) may author keys in kebab-case,
+      // snake_case, or camelCase interchangeably (Claude Code 2.1.186), e.g.
+      // `display-name` / `display_name` / `displayName`. Treat all three the
+      // same so the field reads below (data.displayName, …) pick them up.
+      const camelKey = key.replace(/[-_]([a-z])/g, (_, c) => c.toUpperCase());
 
       if (value === "") {
         currentKey = camelKey;

package/src/lib/suggest-name.js

@@ -0,0 +1,91 @@
+/**
+ * suggest-name — "did you mean?" suggestions for a mistyped identifier.
+ *
+ * Combines substring containment (a partial name) with bounded Levenshtein edit
+ * distance (single-char typos / transpositions) so `cc mcp remove cotnext7`
+ * suggests `context7`. Pure + dependency-free; reusable by any command that
+ * resolves a user-supplied name against a known set (MCP servers, skills, …).
+ *
+ * Claude-Code 2.1.186 parity: `mcp get/remove` typo suggestions.
+ */
+
+/** Levenshtein edit distance between two strings (iterative two-row, O(n*m)). */
+export function editDistance(a, b) {
+  a = String(a ?? "");
+  b = String(b ?? "");
+  if (a === b) return 0;
+  if (!a.length) return b.length;
+  if (!b.length) return a.length;
+  let prev = Array.from({ length: b.length + 1 }, (_, i) => i);
+  let curr = new Array(b.length + 1);
+  for (let i = 1; i <= a.length; i++) {
+    curr[0] = i;
+    for (let j = 1; j <= b.length; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      curr[j] = Math.min(prev[j] + 1, curr[j - 1] + 1, prev[j - 1] + cost);
+    }
+    const tmp = prev;
+    prev = curr;
+    curr = tmp;
+  }
+  return prev[b.length];
+}
+
+/**
+ * Rank candidates by closeness to `target` and return up to `limit` names.
+ * A candidate qualifies if it contains `target` (or vice-versa) as a
+ * case-insensitive substring, OR is within `maxDistance` edits (default scales
+ * with target length, capped at 3). Exact matches are excluded (not a typo).
+ * Output is ordered: substring matches first, then by edit distance, then
+ * alphabetically (stable).
+ *
+ * @param {string} target
+ * @param {string[]} candidates
+ * @param {{ limit?: number, maxDistance?: number }} [opts]
+ * @returns {string[]}
+ */
+export function suggestNames(target, candidates, opts = {}) {
+  const t = String(target ?? "")
+    .trim()
+    .toLowerCase();
+  if (!t || !Array.isArray(candidates)) return [];
+  const limit = opts.limit ?? 3;
+  const maxDistance =
+    opts.maxDistance ?? Math.min(3, Math.max(1, Math.floor(t.length / 3)));
+  const scored = [];
+  for (const raw of candidates) {
+    const name = String(raw ?? "");
+    if (!name) continue;
+    const lc = name.toLowerCase();
+    if (lc === t) continue; // exact match isn't a "did you mean"
+    const contains = lc.includes(t) || t.includes(lc);
+    const dist = editDistance(t, lc);
+    if (contains || dist <= maxDistance) {
+      scored.push({ name, contains: contains ? 0 : 1, dist });
+    }
+  }
+  scored.sort((a, b) => {
+    if (a.contains !== b.contains) return a.contains - b.contains;
+    if (a.dist !== b.dist) return a.dist - b.dist;
+    return a.name < b.name ? -1 : a.name > b.name ? 1 : 0;
+  });
+  return scored.slice(0, limit).map((s) => s.name);
+}
+
+/**
+ * Build a `<noun> "<target>" not found` message, appending a `— did you mean
+ * "x", "y"?` hint when there are close candidates. Returns just the base when
+ * there are none.
+ *
+ * @param {string} target
+ * @param {string[]} candidates
+ * @param {{ noun?: string, limit?: number, maxDistance?: number }} [opts]
+ * @returns {string}
+ */
+export function notFoundWithSuggestion(target, candidates, opts = {}) {
+  const noun = opts.noun || "item";
+  const base = `${noun} "${target}" not found`;
+  const hints = suggestNames(target, candidates, opts);
+  if (!hints.length) return base;
+  return `${base} — did you mean ${hints.map((h) => `"${h}"`).join(", ")}?`;
+}

package/src/lib/task-model-selector.js

@@ -24,7 +24,7 @@ export const TaskType = {
  */
 const TASK_MODEL_MAP = {
   [TaskType.CHAT]: {
-    volcengine: "doubao-seed-1-6-251015",
+    volcengine: "doubao-seed-2-1-pro-260628",
     openai: "gpt-4o-mini",
     anthropic: "claude-sonnet-4-6",
     deepseek: "deepseek-chat",
@@ -36,7 +36,7 @@ const TASK_MODEL_MAP = {
     ollama: "qwen2.5:7b",
   },
   [TaskType.CODE]: {
-    volcengine: "doubao-seed-1-6-251015",
+    volcengine: "doubao-seed-2-1-pro-260628",
     openai: "gpt-4o",
     anthropic: "claude-sonnet-4-6",
     deepseek: "deepseek-coder",
@@ -48,7 +48,7 @@ const TASK_MODEL_MAP = {
     ollama: "qwen2.5-coder:14b",
   },
   [TaskType.REASONING]: {
-    volcengine: "doubao-seed-1-6-251015",
+    volcengine: "doubao-seed-2-1-pro-260628",
     openai: "o1",
     anthropic: "claude-opus-4-6",
     deepseek: "deepseek-reasoner",
@@ -72,7 +72,7 @@ const TASK_MODEL_MAP = {
     ollama: "qwen2:7b",
   },
   [TaskType.TRANSLATE]: {
-    volcengine: "doubao-seed-1-6-251015",
+    volcengine: "doubao-seed-2-1-pro-260628",
     openai: "gpt-4o",
     anthropic: "claude-sonnet-4-6",
     deepseek: "deepseek-chat",
@@ -84,7 +84,7 @@ const TASK_MODEL_MAP = {
     ollama: "qwen2:7b",
   },
   [TaskType.CREATIVE]: {
-    volcengine: "doubao-seed-1-6-251015",
+    volcengine: "doubao-seed-2-1-pro-260628",
     openai: "gpt-4o",
     anthropic: "claude-opus-4-6",
     deepseek: "deepseek-chat",

package/src/repl/agent-repl.js

@@ -894,6 +894,7 @@ export async function startAgentRepl(options = {}) {
   // `@` tab-completion (Claude-Code @-mention parity): filesystem paths +
   // (when the IDE bridge is connected) the editor's open tabs ranked first.
   const { makeAtCompleter } = await import("../lib/repl-completer.js");
+  const { discoverCommands } = await import("../lib/slash-commands.js");
   const atCompleter = makeAtCompleter({
     // cwd left unset on purpose: the completer resolves process.cwd() lazily
     // so it follows `/cd` mid-session.
@@ -941,6 +942,17 @@ export async function startAgentRepl(options = {}) {
       "/ultrathink",
       "/vim",
     ],
+    // User/project custom commands (.claude/commands/*.md) join TAB completion
+    // alongside the built-ins above. Sync + best-effort; the completer
+    // TTL-caches the result so this filesystem walk runs at most once per few
+    // seconds, and process.cwd() makes it follow `/cd` mid-session.
+    getDynamicSlashCommands: () => {
+      try {
+        return discoverCommands(process.cwd()).map((cmd) => `/${cmd.name}`);
+      } catch {
+        return [];
+      }
+    },
     getIdeOpenFiles: async () => {
       const exec = _adhocMcp?.externalToolExecutors?.mcp__ide__getOpenEditors;
       if (!exec || exec.kind !== "mcp" || !_adhocMcp?.mcpClient?.callTool) {
@@ -1305,7 +1317,9 @@ export async function startAgentRepl(options = {}) {
       logger.log(
         `  ${chalk.cyan("… \\")}         End a line with \\ to continue input onto the next line`,
       );
-      logger.log(`  ${chalk.cyan("/exit")}       Exit the agent`);
+      logger.log(
+        `  ${chalk.cyan("/exit")}       Exit the agent (alias: /quit)`,
+      );
       logger.log(
         `  ${chalk.cyan("/model")}      Show/change model (/model <name>)`,
       );
@@ -1326,6 +1340,9 @@ export async function startAgentRepl(options = {}) {
       logger.log(
         `  ${chalk.cyan("/theme")}      Color theme (/theme <auto|dark|light|mono>; mono = no color)`,
       );
+      logger.log(
+        `  ${chalk.cyan("/output-style")} Response persona (/output-style <name|list>; explanatory/learning built-in)`,
+      );
       logger.log(
         `  ${chalk.cyan("/config")}     Show config; ${chalk.cyan("/config <key>")} read, ${chalk.cyan("/config <key>=<val>")} set, ${chalk.cyan("/config --help")} keys`,
       );
@@ -1411,6 +1428,9 @@ export async function startAgentRepl(options = {}) {
       logger.log(
         `  ${chalk.cyan("/ide")}        IDE bridge status (connected editor, tools, or why not)`,
       );
+      logger.log(
+        `  ${chalk.cyan("/mcp")}        MCP server status + tools (/mcp <name> for one server)`,
+      );
       logger.log(chalk.bold("\nCapabilities:"));
       logger.log("  Read, write, and edit files");
       logger.log("  Run shell commands (git, npm, etc.)");

package/src/repl/slash-macro.js

@@ -15,7 +15,11 @@
  * @param {string} input  raw REPL line
  * @param {object} [opts] { cwd, deps:{ getCommand, expandCommand } }
  * @returns {Promise<{matched:boolean, promptText:string, warnings:string[],
- *                    name?:string, scope?:string}>}
+ *                    name?:string, scope?:string, model?:string|null,
+ *                    allowedTools?:string|null}>}
+ *   `model` / `allowedTools` are the matched command's frontmatter (or null),
+ *   so a caller running the macro as a whole turn can scope the run the same
+ *   way `cc command run` does.
  */
 export async function resolveSlashMacro(input, opts = {}) {
   const cwd = opts.cwd || process.cwd();
@@ -41,5 +45,7 @@ export async function resolveSlashMacro(input, opts = {}) {
     warnings,
     name: macro.name,
     scope: macro.scope,
+    model: macro.model || null,
+    allowedTools: macro.allowedTools || null,
   };
 }

package/src/runtime/agent-core.js

@@ -1546,17 +1546,43 @@ async function executeToolInner(
       }
       // Hashline mode: prefix each line with a 6-char content hash tag
       // so downstream edit_file_hashed calls can anchor by hash.
-      const rendered = args.hashed === true ? annotateLines(content) : content;
+      let rendered = args.hashed === true ? annotateLines(content) : content;
+
+      // Line-range slice (Claude-Code Read offset/limit parity): `offset` is the
+      // 1-based first line, `limit` the max line count — so a file larger than
+      // the size cap can be paged through instead of being stuck at its head.
+      // Coerces numeric strings the model may emit ("10" → 10).
+      const toPos = (v) => {
+        const n = typeof v === "number" ? v : parseInt(v, 10);
+        return Number.isInteger(n) && n > 0 ? n : null;
+      };
+      const offset = toPos(args.offset);
+      const limit = toPos(args.limit);
+      let range = null;
+      if (offset || limit) {
+        const lines = rendered.split("\n");
+        const start = offset ? offset - 1 : 0;
+        const end = limit != null ? start + limit : lines.length;
+        rendered = lines.slice(start, end).join("\n");
+        range = {
+          startLine: Math.min(start + 1, lines.length),
+          endLine: Math.min(end, lines.length),
+          totalLines: lines.length,
+        };
+      }
+
       if (rendered.length > 50000) {
         return attachDescriptor({
           content: rendered.substring(0, 50000) + "\n...(truncated)",
           size: rendered.length,
           hashed: args.hashed === true,
+          ...(range ? { range } : {}),
         });
       }
       return attachDescriptor({
         content: rendered,
         hashed: args.hashed === true,
+        ...(range ? { range } : {}),
       });
     }
 
@@ -2633,6 +2659,36 @@ async function _executeRunCode(args, cwd) {
  */
 export const MAX_SUB_AGENT_DEPTH = 5;
 
+/**
+ * Per-tool-result character cap fed back to the model. One giant tool output (a
+ * huge file, a verbose command, an MCP blob) must not blow the context window —
+ * but the model is TOLD when output is cut, instead of the old silent
+ * `substring(0, 5000)` that sliced mid-content with no marker and undercut even
+ * read_file's own 50k self-limit. Tools that self-limit (read_file, notebook
+ * render) stay below this; it is the final safety net for the ones that don't
+ * (run_shell, search_files, run_code, MCP). Override with CC_MAX_TOOL_RESULT_CHARS.
+ */
+export const MAX_TOOL_RESULT_CHARS = (() => {
+  const n = Number(process.env.CC_MAX_TOOL_RESULT_CHARS);
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : 50000;
+})();
+
+/**
+ * Cap a serialized tool result to `max` chars, appending a visible truncation
+ * marker (with the original length + how to get the rest) when it overflows —
+ * so the model never silently receives a mid-content slice. Pure; exported for
+ * tests.
+ */
+export function capToolResultString(serialized, max = MAX_TOOL_RESULT_CHARS) {
+  const s = String(serialized ?? "");
+  if (s.length <= max) return s;
+  return (
+    s.slice(0, max) +
+    `\n…[tool output truncated: showing the first ${max} of ${s.length} chars` +
+    ` — narrow the request (read a line range, grep, or paginate) to see the rest]`
+  );
+}
+
 /**
  * Execute a spawn_sub_agent tool call.
  * Creates an isolated SubAgentContext, runs it, and returns only the summary.
@@ -3112,7 +3168,7 @@ export async function chatWithTools(rawMessages, options) {
     dashscope: "qwen-turbo",
     mistral: "mistral-large-latest",
     gemini: "gemini-2.0-flash",
-    volcengine: "doubao-seed-1-6-251015",
+    volcengine: "doubao-seed-2-1-pro-260628",
   };
 
   // Real token streaming (--include-partial-messages) for every OpenAI-compatible
@@ -4586,7 +4642,10 @@ export async function* agentLoop(messages, options) {
 
       // Append budget warning to tool result so the LLM sees it
       const warningMsg = budget.toWarningMessage();
-      const resultStr = JSON.stringify(toolResult).substring(0, 5000);
+      // Cap an individual tool result so one giant output can't blow the
+      // context — but tell the model when we cut it (no more silent
+      // mid-content slice). See MAX_TOOL_RESULT_CHARS / capToolResultString.
+      const resultStr = capToolResultString(JSON.stringify(toolResult));
       const toolContent = warningMsg
         ? `${resultStr}\n\n${warningMsg}`
         : resultStr;

package/src/runtime/coding-agent-contract-shared.cjs

@@ -28,11 +28,21 @@ const CODING_AGENT_TOOL_CONTRACTS = Object.freeze([
     kind: "filesystem",
     tier: "mvp",
     description:
-      "Read a file's content. Jupyter notebooks (.ipynb) are rendered as a compact cell listing (index/id/type/source, outputs hidden) for use with notebook_edit — pass raw:true for the underlying JSON.",
+      "Read a file's content. For a large file, page through it with offset+limit (line range) instead of re-reading the head. Jupyter notebooks (.ipynb) are rendered as a compact cell listing (index/id/type/source, outputs hidden) for use with notebook_edit — pass raw:true for the underlying JSON.",
     inputSchema: {
       type: "object",
       properties: {
         path: { type: "string", description: "File path to read" },
+        offset: {
+          type: "integer",
+          description:
+            "1-based line number to start reading from (omit to read from the top). Use with limit to page a large file.",
+        },
+        limit: {
+          type: "integer",
+          description:
+            "Maximum number of lines to return starting at offset (omit to read to end, subject to the size cap).",
+        },
         hashed: {
           type: "boolean",
           description:

package/src/runtime/headless-runner.js

@@ -250,7 +250,10 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     );
   }
 
-  const model = options.model || "qwen2.5:7b";
+  // `let` (not const): a custom-command macro's `model:` frontmatter may
+  // override it below (when the user passed no explicit --model), mirroring
+  // `cc command run`.
+  let model = options.model || "qwen2.5:7b";
   const provider = options.provider || "ollama";
   const baseUrl = options.baseUrl || "http://localhost:11434";
   const apiKey = options.apiKey || null;
@@ -369,12 +372,60 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     return { exitCode: isError ? 1 : 0, result: text, isError };
   }
 
+  // ── Custom slash-command macros (Claude-Code parity: a .claude/commands/*
+  // command runs in `-p` mode too, not just the interactive REPL). A leading
+  // `/name …` that resolves to a user/project command is expanded into its
+  // prompt template ($ARGUMENTS / $1.. + !`bang` + @file) before the turn; an
+  // unknown `/...` (or plain text) is left untouched so it reaches the LLM
+  // verbatim. expandCommand already runs @file expansion, so the @-ref pass
+  // below is skipped when a macro matched. Opt out with options.slashMacros:false.
+  let userContent = prompt;
+  let slashExpanded = false;
+  // A matched command's `allowed-tools:` frontmatter scopes the run (parsed
+  // below into enabledToolNames) the same way `cc command run` does.
+  let macroAllowedTools = null;
+  if (options.slashMacros !== false && prompt.startsWith("/")) {
+    try {
+      const doMacro =
+        deps.resolveSlashMacro ||
+        (await import("../repl/slash-macro.js")).resolveSlashMacro;
+      const macro = await doMacro(prompt, { cwd });
+      if (macro && macro.matched) {
+        userContent = macro.promptText;
+        slashExpanded = true;
+        for (const w of macro.warnings || []) {
+          writeErr(`  /${macro.name}: ${w}\n`);
+        }
+        writeErr(`  command: /${macro.name} [${macro.scope}]\n`);
+        // Frontmatter `model:` / `allowed-tools:` scope the run exactly like
+        // `cc command run` — but an explicit --model / --allowed-tools still
+        // wins (those arrive as a set options.model / options.allowedTools).
+        if (macro.model && !options.model) {
+          model = macro.model;
+          writeErr(`  command: model → ${model}\n`);
+          try {
+            const { maybeWarnDeprecatedModel } =
+              await import("../lib/model-deprecation.js");
+            maybeWarnDeprecatedModel({ model });
+          } catch {
+            // deprecation notice is best-effort
+          }
+        }
+        if (macro.allowedTools && !options.allowedTools) {
+          macroAllowedTools = parseToolList(macro.allowedTools);
+        }
+      }
+    } catch {
+      // macro resolution is best-effort — fall back to the literal prompt
+    }
+  }
+
   // ── Expand @file references in the prompt (Claude-Code parity) ─────────
   // `@path/to/file` tokens are augmented with the referenced file contents (or
   // a dir listing) so `cc agent -p "review @src/x.js"` works without a manual
   // cat-pipe. Opt out with `--no-file-refs` (options.expandFileRefs === false).
-  let userContent = prompt;
-  if (options.expandFileRefs !== false) {
+  // Skipped when a slash macro already expanded (expandCommand ran @refs).
+  if (!slashExpanded && options.expandFileRefs !== false) {
     const doExpand = deps.expandFileRefs || expandFileRefsAsync;
     const expanded = await doExpand(prompt, { cwd });
     userContent = expanded.prompt;
@@ -388,7 +439,9 @@ export async function runAgentHeadless(options = {}, deps = {}) {
   // ── Permission + tool resolution ──────────────────────────────────────
   const perm = resolvePermissionMode(options.permissionMode);
   const enabledToolNames = resolveEnabledTools({
-    allowedTools: options.allowedTools,
+    // An explicit --allowed-tools wins; otherwise a matched command's
+    // `allowed-tools:` frontmatter scopes the run (null when neither applies).
+    allowedTools: options.allowedTools || macroAllowedTools,
     readOnly: perm.readOnly,
   });
   const disabledTools = options.disallowedTools || [];