clixad 0.0.1-beta.47 → 0.0.1-beta.48

package/README.md

@@ -63,7 +63,11 @@ before it changes anything. `shift+tab` cycles through the permission modes. Bey
 - **Keeps a task list** on multi-step work, and **asks you** when guessing wrong would waste real
   work.
 - **Uses MCP servers** you configure in `.mcp.json` or `~/.clixad/mcp.json`; `/mcp` shows their
-  status. Every tool a server offers is put to you before it runs.
+  status. Every tool a server offers is put to you before it runs. A server from a project's
+  `.mcp.json` or `.clixad/mcp.json` starts only after you approve it (asked once per project, and
+  again if its entry changes; `/mcp approve` starts one later). A server gets `PATH`, `HOME` and the
+  locale from your environment and nothing else, so pass what it needs in its `env`, for example
+  `"env": { "GITHUB_TOKEN": "${GITHUB_TOKEN}" }`.
 
 Type `/help` for the commands, `@` to attach a file, and `!` to run a shell command yourself.
 
@@ -95,8 +99,8 @@ github.com/clixad/cli is an automatic one-way copy of the CLI's part of it, so a
 nowhere to be merged and is closed automatically. If you have a fix in mind, describe it in an
 issue.
 
-Please report security problems privately, through "Report a vulnerability" on the repository's
-Security tab, rather than in a public issue.
+Please report security problems by email to [info@clixad.io](mailto:info@clixad.io), not in a
+public GitHub issue. See [SECURITY.md](https://github.com/clixad/cli/blob/main/SECURITY.md).
 
 ## Status
 

package/dist/{chunk-TKGMAY4C.mjs → chunk-CNLFGTYS.mjs}

@@ -643,16 +643,16 @@ async function httpFailure(res, what) {
   return detail ? `${what} failed: ${res.status} \u2014 ${detail}` : `${what} failed: ${res.status}`;
 }
 function sleep(ms, signal) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     if (!signal) {
-      setTimeout(resolve5, ms);
+      setTimeout(resolve6, ms);
       return;
     }
-    if (signal.aborted) return resolve5();
+    if (signal.aborted) return resolve6();
     const done = () => {
       clearTimeout(timer);
       signal.removeEventListener("abort", done);
-      resolve5();
+      resolve6();
     };
     const timer = setTimeout(done, ms);
     signal.addEventListener("abort", done, { once: true });
@@ -2032,16 +2032,16 @@ async function devLogin(client, config, email, invite) {
   };
 }
 function sleep2(ms, signal) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     if (!signal) {
-      setTimeout(resolve5, ms);
+      setTimeout(resolve6, ms);
       return;
     }
-    if (signal.aborted) return resolve5();
+    if (signal.aborted) return resolve6();
     const done = () => {
       clearTimeout(timer);
       signal.removeEventListener("abort", done);
-      resolve5();
+      resolve6();
     };
     const timer = setTimeout(done, ms);
     signal.addEventListener("abort", done, { once: true });
@@ -2336,8 +2336,18 @@ ${renderTodos(items)}${warning}`;
 
 // src/tools.ts
 import { spawn as spawn4 } from "node:child_process";
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync3, statSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { isAbsolute, relative, resolve, dirname as dirname2, join as join3, sep } from "node:path";
+import {
+  existsSync as existsSync2,
+  lstatSync,
+  mkdirSync as mkdirSync3,
+  readdirSync,
+  readFileSync as readFileSync3,
+  readlinkSync,
+  realpathSync as realpathSync2,
+  statSync,
+  writeFileSync as writeFileSync3
+} from "node:fs";
+import { basename, isAbsolute, relative, resolve as resolve2, dirname as dirname3, join as join3, sep } from "node:path";
 
 // src/diff.ts
 var R = "\x1B[0m";
@@ -3026,9 +3036,10 @@ function decodeEntities(text) {
 
 // src/mcp.ts
 import { spawn as spawn3 } from "node:child_process";
-import { existsSync, readFileSync as readFileSync2 } from "node:fs";
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, realpathSync, renameSync as renameSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join2 } from "node:path";
+import { dirname as dirname2, join as join2, resolve } from "node:path";
 var CONNECT_TIMEOUT_MS = 2e4;
 var DEFAULT_CALL_TIMEOUT_MS = 12e4;
 var PROTOCOL_VERSION = "2025-06-18";
@@ -3039,14 +3050,20 @@ var McpError = class extends Error {
 function isHttpConfig(c) {
   return c.url !== void 0;
 }
-function mcpConfigPaths(root) {
-  return [join2(homedir2(), ".clixad", "mcp.json"), join2(root, ".mcp.json"), join2(root, ".clixad", "mcp.json")];
+function mcpConfigFiles(root) {
+  const personal = join2(homedir2(), ".clixad", "mcp.json");
+  const files = [{ path: personal, scope: "user" }];
+  for (const path of [join2(root, ".mcp.json"), join2(root, ".clixad", "mcp.json")]) {
+    if (resolve(path) !== resolve(personal)) files.push({ path, scope: "project" });
+  }
+  return files;
 }
 function loadMcpConfig(root) {
   const servers = {};
+  const origins = {};
   const sources = [];
   const errors = [];
-  for (const path of mcpConfigPaths(root)) {
+  for (const { path, scope } of mcpConfigFiles(root)) {
     if (!existsSync(path)) continue;
     let parsed;
     try {
@@ -3067,13 +3084,24 @@ function loadMcpConfig(root) {
     sources.push(short(path));
     for (const [name, raw] of Object.entries(declared)) {
       const config = validateServer(name, raw);
-      if (typeof config === "string") errors.push(`${short(path)}: ${config}`);
-      else servers[name] = config;
+      if (typeof config === "string") {
+        errors.push(`${short(path)}: ${config}`);
+        continue;
+      }
+      servers[name] = config;
+      origins[name] = {
+        scope,
+        file: short(path),
+        fingerprint: fingerprint(raw),
+        display: describeEntry(raw),
+        variables: [...new Set(variablesIn(raw))].sort()
+      };
     }
   }
-  return { servers, sources, errors };
+  return { servers, origins, sources, errors };
 }
 function validateServer(name, raw) {
+  if (/[\u0000-\u001f\u007f-\u009f]/.test(name)) return `server ${JSON.stringify(name)} has control characters in its name`;
   if (typeof raw !== "object" || raw === null) return `server "${name}" is not an object`;
   const c = raw;
   if (typeof c.url === "string") {
@@ -3114,6 +3142,109 @@ function expandMap(map) {
 function short(path) {
   return path.replace(homedir2(), "~");
 }
+function canonicalJson(value) {
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    const entries = Object.keys(value).sort().map((k) => `${JSON.stringify(k)}:${canonicalJson(value[k])}`);
+    return `{${entries.join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "null";
+}
+function fingerprint(raw) {
+  return createHash("sha256").update(canonicalJson(raw)).digest("hex");
+}
+function variablesIn(value) {
+  if (typeof value === "string") return [...value.matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g)].map((m) => m[1]);
+  if (Array.isArray(value)) return value.flatMap(variablesIn);
+  if (value && typeof value === "object") return Object.values(value).flatMap(variablesIn);
+  return [];
+}
+var MAX_DISPLAY_CHARS = 2e3;
+function shellWord(word) {
+  if (/^[\x21\x23-\x5b\x5d-\x7e]+$/.test(word)) return word;
+  return JSON.stringify(word).replace(/[^\x20-\x7e]/g, (ch) => `\\u${ch.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function describeEntry(raw) {
+  const strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
+  const pairs = (v) => isStringMap(v) ? Object.entries(v) : [];
+  const lines = [];
+  if (typeof raw.url === "string") {
+    lines.push(`${raw.type === "sse" ? "sse" : "http"} ${shellWord(raw.url)}`);
+    for (const [k, v] of pairs(raw.headers)) lines.push(`header ${shellWord(k)}: ${shellWord(v)}`);
+  } else {
+    lines.push([String(raw.command ?? ""), ...strings(raw.args)].map(shellWord).join(" "));
+    for (const [k, v] of pairs(raw.env)) lines.push(`env ${shellWord(k)}=${shellWord(v)}`);
+    if (typeof raw.cwd === "string") lines.push(`cwd ${shellWord(raw.cwd)}`);
+  }
+  const text = lines.join("\n");
+  return text.length > MAX_DISPLAY_CHARS ? `${text.slice(0, MAX_DISPLAY_CHARS)}\u2026 (${text.length - MAX_DISPLAY_CHARS} more characters; read the file before approving)` : text;
+}
+var INHERITED_ENV = {
+  posix: ["HOME", "LOGNAME", "PATH", "SHELL", "TERM", "USER", "LANG", "LC_ALL", "LC_CTYPE", "TMPDIR", "TZ"],
+  win32: [
+    "APPDATA",
+    "COMSPEC",
+    "HOMEDRIVE",
+    "HOMEPATH",
+    "LOCALAPPDATA",
+    "PATH",
+    "PATHEXT",
+    "PROCESSOR_ARCHITECTURE",
+    "PROGRAMFILES",
+    "SYSTEMDRIVE",
+    "SYSTEMROOT",
+    "TEMP",
+    "TMP",
+    "USERNAME",
+    "USERPROFILE",
+    "WINDIR"
+  ]
+};
+function mcpServerEnv(own = {}, source = process.env, platform2 = process.platform) {
+  const env = {};
+  const wanted = INHERITED_ENV[platform2 === "win32" ? "win32" : "posix"];
+  const byName = new Map(Object.keys(source).map((k) => [platform2 === "win32" ? k.toUpperCase() : k, k]));
+  for (const name of wanted) {
+    const key = byName.get(name);
+    const value = key === void 0 ? void 0 : source[key];
+    if (value !== void 0 && !value.startsWith("()")) env[name] = value;
+  }
+  return { ...env, ...own };
+}
+function mcpApprovalsPath() {
+  return join2(homedir2(), ".clixad", "mcp-approvals.json");
+}
+function workspaceKey(root) {
+  try {
+    return realpathSync.native(root);
+  } catch {
+    return resolve(root);
+  }
+}
+function readApprovals() {
+  try {
+    const parsed = JSON.parse(readFileSync2(mcpApprovalsPath(), "utf8"));
+    if (parsed?.version === 1 && parsed.projects && typeof parsed.projects === "object") return parsed;
+  } catch {
+  }
+  return { version: 1, projects: {} };
+}
+function mcpDecision(root, name, fingerprint2) {
+  const entry = readApprovals().projects[workspaceKey(root)]?.[name];
+  return entry && entry.fingerprint === fingerprint2 ? entry.decision : void 0;
+}
+function recordMcpDecision(root, servers, decision, at = /* @__PURE__ */ new Date()) {
+  const file = readApprovals();
+  const key = workspaceKey(root);
+  const project = file.projects[key] ??= {};
+  for (const server of servers) project[server.name] = { fingerprint: server.fingerprint, decision, at: at.toISOString() };
+  const path = mcpApprovalsPath();
+  mkdirSync2(dirname2(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.tmp`;
+  writeFileSync2(tmp, `${JSON.stringify(file, null, 2)}
+`, { encoding: "utf8", mode: 384 });
+  renameSync2(tmp, path);
+}
 var StdioTransport = class {
   child;
   buffer = "";
@@ -3124,10 +3255,13 @@ var StdioTransport = class {
   constructor(config, root) {
     this.child = spawn3(config.command, config.args ?? [], {
       cwd: config.cwd ?? root,
-      // The server's own env plus ours. `shell: false` on purpose: the command
-      // and its args are already separate, so there is nothing for a shell to
-      // re-split, and a path with a space in it would be split if there were.
-      env: { ...process.env, ...config.env ?? {} },
+      // What a program needs to run plus what the entry names, and never the
+      // rest of ours: this process's environment holds whatever the user
+      // exported, API keys included, and a server is somebody else's program.
+      // `shell: false` on purpose: the command and its args are already
+      // separate, so there is nothing for a shell to re-split, and a path with
+      // a space in it would be split if there were.
+      env: mcpServerEnv(config.env),
       stdio: ["pipe", "pipe", "pipe"],
       windowsHide: true,
       // npx and friends are .cmd shims on Windows, which CreateProcess cannot
@@ -3177,7 +3311,7 @@ var StdioTransport = class {
     if (this.exited) return Promise.reject(new McpError(this.exited));
     const id = ++this.seq;
     const payload = JSON.stringify({ jsonrpc: "2.0", id, method, params }) + "\n";
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       const settle = (fn) => {
         clearTimeout(timer);
         signal?.removeEventListener("abort", onAbort);
@@ -3191,7 +3325,7 @@ var StdioTransport = class {
       const onAbort = () => settle(() => reject(new McpError("cancelled")));
       signal?.addEventListener("abort", onAbort, { once: true });
       this.pending.set(id, {
-        resolve: (v) => settle(() => resolve5(v)),
+        resolve: (v) => settle(() => resolve6(v)),
         reject: (e) => settle(() => reject(e))
       });
       this.child.stdin?.write(payload, (err) => {
@@ -3315,23 +3449,42 @@ async function readSseResponse(res, id) {
   return null;
 }
 var McpServerConnection = class {
-  constructor(name, config, root) {
+  constructor(name, config, root, origin, held) {
     this.name = name;
     this.config = config;
-    this.transport = isHttpConfig(config) ? new HttpTransport(config) : new StdioTransport(config, root);
+    this.root = root;
+    this.origin = origin;
+    this.state = held ?? "connecting";
   }
   name;
   config;
-  state = "connecting";
+  root;
+  origin;
+  state;
   error;
   tools = [];
+  /**
+   * Created by `connect()` and nowhere else, because creating a stdio
+   * transport *is* starting the program. A held connection never has one.
+   */
   transport;
   get kind() {
     return isHttpConfig(this.config) ? "http" : "stdio";
   }
+  /** Lift the hold, after the user approved. Starts nothing by itself. */
+  release() {
+    if (this.state === "unapproved" || this.state === "declined") this.state = "connecting";
+  }
+  /** Remember a refusal, so `/mcp` can say why it is not running. */
+  decline() {
+    if (this.state === "unapproved") this.state = "declined";
+  }
   async connect(timeoutMs = CONNECT_TIMEOUT_MS) {
+    if (this.state !== "connecting" || this.transport) return;
+    const transport = isHttpConfig(this.config) ? new HttpTransport(this.config) : new StdioTransport(this.config, this.root);
+    this.transport = transport;
     try {
-      await this.transport.request(
+      await transport.request(
         "initialize",
         {
           protocolVersion: PROTOCOL_VERSION,
@@ -3340,8 +3493,8 @@ var McpServerConnection = class {
         },
         timeoutMs
       );
-      await this.transport.notify("notifications/initialized", {});
-      const listed = await this.transport.request("tools/list", {}, timeoutMs);
+      await transport.notify("notifications/initialized", {});
+      const listed = await transport.request("tools/list", {}, timeoutMs);
       this.tools = (listed?.tools ?? []).filter(
         (t) => typeof t?.name === "string" && t.name.length > 0
       ).map((t) => ({
@@ -3352,17 +3505,19 @@ var McpServerConnection = class {
         ...typeof t.description === "string" ? { description: t.description } : {},
         ...t.inputSchema && typeof t.inputSchema === "object" ? { inputSchema: t.inputSchema } : {}
       }));
+      if (this.state !== "connecting") return;
       this.state = "ready";
     } catch (err) {
+      if (this.state !== "connecting") return;
       this.state = "failed";
-      const diagnostics = this.transport.diagnostics();
+      const diagnostics = transport.diagnostics();
       this.error = err.message + (diagnostics ? `
   ${diagnostics.split("\n").slice(-3).join("\n  ")}` : "");
-      await this.transport.close().catch(() => void 0);
+      await transport.close().catch(() => void 0);
     }
   }
   async call(tool, args, timeoutMs, signal) {
-    if (this.state !== "ready") throw new McpError(`server "${this.name}" is ${this.state}`);
+    if (this.state !== "ready" || !this.transport) throw new McpError(`server "${this.name}" is ${this.state}`);
     const raw = await this.transport.request(
       "tools/call",
       { name: tool, arguments: args ?? {} },
@@ -3375,7 +3530,7 @@ var McpServerConnection = class {
   }
   async close() {
     this.state = "closed";
-    await this.transport.close().catch(() => void 0);
+    await this.transport?.close().catch(() => void 0);
   }
 };
 function renderContent(content, structured) {
@@ -3418,34 +3573,118 @@ function isMcpToolName(name) {
   return name.startsWith("mcp__");
 }
 var McpHub = class _McpHub {
-  constructor(servers) {
+  constructor(servers, root) {
     this.servers = servers;
+    this.root = root;
   }
   servers;
+  root;
   /**
-   * Connect to every configured server, in parallel, and never reject.
+   * Connect to every server given, in parallel, and never reject.
    *
+   * For servers the caller has already decided may run; a config read from
+   * disk goes through `fromConfig`, which holds the repository's servers.
    * Parallel because a slow server must not delay the others, and one that
    * cannot start must not delay anything: the whole point is that the REPL opens
    * whether or not somebody's Docker daemon is running today.
    */
   static async connect(servers, opts = { root: process.cwd() }) {
     const connections = Object.entries(servers).map(([name, config]) => new McpServerConnection(name, config, opts.root));
-    await Promise.all(connections.map((c) => c.connect(opts.timeoutMs)));
-    const taken = /* @__PURE__ */ new Set();
-    for (const conn of connections) {
+    const hub = new _McpHub(connections, opts.root);
+    await hub.startReleased(opts.timeoutMs);
+    return hub;
+  }
+  /**
+   * A hub for the config on disk, with nothing started yet.
+   *
+   * A server from `~/.clixad/mcp.json` is ready to start. A server from the
+   * workspace is held unless the user approved this exact entry for this
+   * workspace before, and stays held if they declined it. `startReleased`
+   * then starts what may start; `approve` releases the rest.
+   */
+  static fromConfig(loaded, opts) {
+    const connections = Object.entries(loaded.servers).map(([name, config]) => {
+      const origin = loaded.origins[name];
+      let held;
+      if (!origin || origin.scope !== "user") {
+        const decision = origin ? mcpDecision(opts.root, name, origin.fingerprint) : void 0;
+        held = decision === "approved" ? void 0 : decision === "declined" ? "declined" : "unapproved";
+      }
+      return new McpServerConnection(name, config, opts.root, origin, held);
+    });
+    return new _McpHub(connections, opts.root);
+  }
+  /** An empty hub — what a run with no config, or a scripted run, gets. */
+  static empty() {
+    return new _McpHub([], process.cwd());
+  }
+  /**
+   * Start every server that may start and has not been, in parallel. Returns
+   * the ones it started, so the caller can say how each one went.
+   */
+  async startReleased(timeoutMs) {
+    const starting = this.servers.filter((s) => s.state === "connecting");
+    await Promise.all(starting.map((c) => c.connect(timeoutMs)));
+    this.assignNames();
+    const names = new Set(starting.map((s) => s.name));
+    return this.status().filter((s) => names.has(s.name));
+  }
+  /**
+   * Give every listed tool its model-facing name. Names already given keep
+   * theirs, so a server approved later cannot rename a tool the model has
+   * already been told about. A collision (two servers with the same tool, or
+   * two long names that truncate together) is broken deterministically.
+   */
+  assignNames() {
+    const taken = new Set(this.servers.flatMap((s) => s.tools.map((t) => t.qualified)).filter(Boolean));
+    for (const conn of this.servers) {
       for (const tool of conn.tools) {
+        if (tool.qualified) continue;
         let name = qualifiedToolName(conn.name, tool.name);
         for (let i = 2; taken.has(name); i++) name = `${name.slice(0, 61)}_${i}`;
         taken.add(name);
         tool.qualified = name;
       }
     }
-    return new _McpHub(connections);
   }
-  /** An empty hub — what a run with no config, or a scripted run, gets. */
-  static empty() {
-    return new _McpHub([]);
+  /** The servers waiting for the user, with what the prompt shows. */
+  pending(opts = {}) {
+    return this.servers.filter((s) => s.state === "unapproved" || opts.includeDeclined && s.state === "declined").map((s) => ({
+      name: s.name,
+      file: s.origin?.file ?? "",
+      display: s.origin?.display ?? "",
+      variables: s.origin?.variables ?? [],
+      fingerprint: s.origin?.fingerprint ?? ""
+    }));
+  }
+  /**
+   * The user approved these held servers: remember it (bound to each entry as
+   * written) when asked to, and start them. Names that are not held are
+   * ignored. Returns how each one started.
+   */
+  async approve(names, opts) {
+    const chosen = this.held(names);
+    if (opts.remember) this.remember(chosen, "approved");
+    for (const s of chosen) s.release();
+    return this.startReleased(opts.timeoutMs);
+  }
+  /** The user declined these held servers: remember it, so they are not asked about again until the entry changes. */
+  decline(names) {
+    const chosen = this.held(names).filter((s) => s.state === "unapproved");
+    this.remember(chosen, "declined");
+    for (const s of chosen) s.decline();
+  }
+  held(names) {
+    const wanted = new Set(names);
+    return this.servers.filter((s) => wanted.has(s.name) && (s.state === "unapproved" || s.state === "declined"));
+  }
+  remember(servers, decision) {
+    const entries = servers.filter((s) => s.origin).map((s) => ({ name: s.name, fingerprint: s.origin.fingerprint }));
+    if (!entries.length) return;
+    try {
+      recordMcpDecision(this.root, entries, decision);
+    } catch {
+    }
   }
   tools() {
     return this.servers.filter((s) => s.state === "ready").flatMap((s) => s.tools);
@@ -3509,13 +3748,60 @@ var PermissionDeniedError = class extends ToolError {
   }
 };
 function safeResolve(root, p) {
-  const abs = isAbsolute(p) ? p : resolve(root, p);
-  const rel2 = relative(root, abs);
-  if (rel2 === ".." || rel2.startsWith(".." + sep) || isAbsolute(rel2)) {
-    throw new ToolError(`path escapes workspace: ${p}`);
+  const abs = isAbsolute(p) ? p : resolve2(root, p);
+  if (escapes(root, abs)) throw new ToolError(`path escapes workspace: ${p}`);
+  let real;
+  let realRoot;
+  try {
+    real = realLocation(abs);
+    realRoot = realLocation(resolve2(root));
+  } catch (err) {
+    const code = err.code;
+    throw new ToolError(code === "ELOOP" ? `${p}: the path goes through a symlink loop` : `cannot resolve ${p}`);
+  }
+  if (escapes(realRoot, real)) {
+    throw new ToolError(`path escapes workspace: ${p} is a symlink (or inside one) that points outside the workspace`);
   }
   return abs;
 }
+function escapes(root, abs) {
+  const rel2 = relative(root, abs);
+  return rel2 === ".." || rel2.startsWith(".." + sep) || isAbsolute(rel2);
+}
+var MAX_LINK_HOPS = 40;
+function realLocation(abs, hops = 0) {
+  try {
+    return realpathSync2.native(abs);
+  } catch (err) {
+    const code = err.code;
+    if (code !== "ENOENT" && code !== "ENOTDIR") throw err;
+  }
+  const parent = dirname3(abs);
+  if (parent === abs) return abs;
+  let link;
+  try {
+    if (lstatSync(abs).isSymbolicLink()) link = readlinkSync(abs);
+  } catch {
+  }
+  const realParent = realLocation(parent, hops);
+  if (link === void 0) return join3(realParent, basename(abs));
+  if (hops >= MAX_LINK_HOPS) throw Object.assign(new Error("too many symlinks"), { code: "ELOOP" });
+  return realLocation(resolve2(realParent, link), hops + 1);
+}
+function realRootOf(root) {
+  try {
+    return realLocation(resolve2(root));
+  } catch {
+    return resolve2(root);
+  }
+}
+function linkStaysInside(abs, realRoot) {
+  try {
+    return !escapes(realRoot, realpathSync2.native(abs));
+  } catch {
+    return false;
+  }
+}
 function rel(root, abs) {
   return relative(root, abs).replace(/\\/g, "/") || ".";
 }
@@ -3589,10 +3875,11 @@ function describeValue(value) {
   if (typeof value === "number") return "an unusable number";
   return typeof value === "object" ? "an object" : `a ${typeof value}`;
 }
-function entryKind(entry, abs) {
+function entryKind(entry, abs, realRoot) {
   if (entry.isDirectory()) return "dir";
   if (entry.isFile()) return "file";
   if (!entry.isSymbolicLink()) return "other";
+  if (!linkStaysInside(abs, realRoot)) return "other";
   try {
     const stat = statSync(abs);
     return stat.isDirectory() ? "dir" : stat.isFile() ? "file" : "other";
@@ -3730,9 +4017,10 @@ ${body2}` + (pdf.text.length > MAX_FILE_BYTES ? "\n\u2026 [truncated]" : "");
     if (!fsCall(`cannot list ${name}`, () => statSync(abs)).isDirectory()) {
       throw new ToolError(`${path} is a file \u2014 use read_file`);
     }
+    const realRoot = realRootOf(ctx.root);
     const entries = fsCall(`cannot list ${name}`, () => readdirSync(abs, { withFileTypes: true })).map(
       (entry) => {
-        const isDir = entryKind(entry, resolve(abs, entry.name)) === "dir";
+        const isDir = entryKind(entry, resolve2(abs, entry.name), realRoot) === "dir";
         return { name: isDir ? `${entry.name}/` : entry.name, isDir };
       }
     );
@@ -3812,9 +4100,10 @@ ${body2}` + (pdf.text.length > MAX_FILE_BYTES ? "\n\u2026 [truncated]" : "");
       path: name,
       root: ctx.root
     });
+    safeResolve(ctx.root, abs);
     fsCall(`cannot write ${name}`, () => {
-      mkdirSync2(dirname2(abs), { recursive: true });
-      writeFileSync2(abs, content, "utf8");
+      mkdirSync3(dirname3(abs), { recursive: true });
+      writeFileSync3(abs, content, "utf8");
     });
     ctx.present?.(view);
     return `wrote ${content.length} bytes to ${name}`;
@@ -3856,7 +4145,8 @@ ${body2}` + (pdf.text.length > MAX_FILE_BYTES ? "\n\u2026 [truncated]" : "");
       path: name,
       root: ctx.root
     });
-    fsCall(`cannot edit ${name}`, () => writeFileSync2(abs, after, "utf8"));
+    safeResolve(ctx.root, abs);
+    fsCall(`cannot edit ${name}`, () => writeFileSync3(abs, after, "utf8"));
     ctx.present?.(view);
     return `edited ${name} (${count > 1 ? `${count} occurrences` : "1 occurrence"})`;
   },
@@ -4262,6 +4552,7 @@ function walk(dir, root, visit) {
     visit(dir);
     return;
   }
+  const realRoot = realRootOf(root);
   let seen = 0;
   const stack = [dir];
   while (stack.length > 0) {
@@ -4274,7 +4565,7 @@ function walk(dir, root, visit) {
     }
     for (const entry of entries) {
       const abs = join3(current, entry.name);
-      const kind = entryKind(entry, abs);
+      const kind = entryKind(entry, abs, realRoot);
       if (kind === "dir") {
         if (entry.isSymbolicLink() || SKIP_DIRS.has(entry.name)) continue;
         stack.push(abs);
@@ -4285,7 +4576,6 @@ function walk(dir, root, visit) {
       if (!visit(abs)) return;
     }
   }
-  void root;
 }
 function globToRegExp(pattern) {
   const p = requireString(pattern, "glob", "pattern").replace(/\\/g, "/").replace(/^\.\//, "");
@@ -4590,7 +4880,7 @@ var TOOL_SCHEMA = [
 
 // src/auto-mode.ts
 import { homedir as homedir3 } from "node:os";
-import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2, sep as sep2 } from "node:path";
+import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
 function parseCommand(src) {
   const pipelines = [];
   let pipeline = [];
@@ -4763,9 +5053,9 @@ function expandHome(word, home) {
 function resolveWord(word, ctx) {
   const w = expandHome(word, ctx.home);
   if (w === null) return null;
-  if (isAbsolute2(w)) return resolve2(w);
+  if (isAbsolute2(w)) return resolve3(w);
   if (ctx.cwd === null) return null;
-  return resolve2(ctx.cwd, w);
+  return resolve3(ctx.cwd, w);
 }
 function within(parent, child) {
   const rel2 = relative2(parent, child);
@@ -5299,7 +5589,7 @@ function classify(command, root, home, depth) {
   if (FORK_BOMB.test(command)) return { kind: "dangerous", reason: "it is a fork bomb" };
   if (FETCH_AND_RUN.some((re) => re.test(command))) return { kind: "dangerous", reason: "it downloads code and runs it" };
   const parsed = parseCommand(command);
-  const ctx = { root: resolve2(root), home: resolve2(home), cwd: resolve2(root) };
+  const ctx = { root: resolve3(root), home: resolve3(home), cwd: resolve3(root) };
   for (const pipeline of parsed.pipelines) {
     let fetched = false;
     for (const cmd of pipeline) {
@@ -5816,7 +6106,7 @@ async function dispatch(ctx, name, args) {
 import { spawnSync } from "node:child_process";
 import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "node:fs";
 import { homedir as homedir4, platform } from "node:os";
-import { join as join4, parse, resolve as resolve3 } from "node:path";
+import { join as join4, parse, resolve as resolve4 } from "node:path";
 var MAX_CONTEXT_FILE_CHARS = 2e4;
 function contextFileCandidates(root) {
   return [join4(homedir4(), ".clixad", "CLIXAD.md"), join4(root, "AGENTS.md"), join4(root, "CLIXAD.md")];
@@ -5824,10 +6114,12 @@ function contextFileCandidates(root) {
 function collectContext(root, base = SYSTEM_PROMPT) {
   const parts = [base, environmentBlock(root)];
   const files = [];
+  const personal = join4(homedir4(), ".clixad", "CLIXAD.md");
   for (const path of contextFileCandidates(root)) {
     if (!existsSync3(path)) continue;
     let text;
     try {
+      if (path !== personal) safeResolve(root, path);
       text = readFileSync4(path, "utf8").trim();
     } catch {
       continue;
@@ -5882,8 +6174,8 @@ var INIT_PROMPT = "Create a CLIXAD.md file in the workspace root that tells a fu
 var INIT_HINT = "No CLIXAD.md in this project yet. /init writes one, and every later session here starts out knowing the layout.";
 var PROJECT_MARKERS = [".git", "package.json", "pyproject.toml", "Cargo.toml", "go.mod", "pom.xml", "Gemfile"];
 function shouldSuggestInit(root) {
-  const dir = resolve3(root);
-  if (dir === resolve3(homedir4()) || dir === parse(dir).root) return false;
+  const dir = resolve4(root);
+  if (dir === resolve4(homedir4()) || dir === parse(dir).root) return false;
   if (existsSync3(join4(dir, "CLIXAD.md")) || existsSync3(join4(dir, "AGENTS.md"))) return false;
   return PROJECT_MARKERS.some((name) => existsSync3(join4(dir, name)));
 }
@@ -6055,17 +6347,17 @@ var denyAll = async (req) => ({
 import {
   closeSync as closeSync2,
   existsSync as existsSync4,
-  mkdirSync as mkdirSync3,
+  mkdirSync as mkdirSync4,
   openSync as openSync2,
   readdirSync as readdirSync3,
   readFileSync as readFileSync5,
   readSync,
   rmSync,
   statSync as statSync2,
-  writeFileSync as writeFileSync3
+  writeFileSync as writeFileSync4
 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join5, resolve as resolve4 } from "node:path";
+import { join as join5, resolve as resolve5 } from "node:path";
 var ROOT = join5(homedir5(), ".clixad");
 var SESSION_DIR = join5(ROOT, "sessions");
 var HISTORY_FILE = join5(ROOT, "history");
@@ -6076,7 +6368,7 @@ function isSessionId(id) {
   return SESSION_ID.test(id);
 }
 function sameDirectory(a, b) {
-  const norm = (p) => process.platform === "win32" ? resolve4(p).toLowerCase() : resolve4(p);
+  const norm = (p) => process.platform === "win32" ? resolve5(p).toLowerCase() : resolve5(p);
   return norm(a) === norm(b);
 }
 function newSessionId() {
@@ -6085,9 +6377,9 @@ function newSessionId() {
 }
 function saveSession(session) {
   try {
-    mkdirSync3(SESSION_DIR, { recursive: true });
+    mkdirSync4(SESSION_DIR, { recursive: true });
     const stored = { ...session, messages: withoutImages(session.messages) };
-    writeFileSync3(join5(SESSION_DIR, `${session.id}.json`), JSON.stringify(stored), "utf8");
+    writeFileSync4(join5(SESSION_DIR, `${session.id}.json`), JSON.stringify(stored), "utf8");
     prune();
   } catch {
   }
@@ -6175,17 +6467,17 @@ function loadHistory() {
 }
 function saveHistory(entries) {
   try {
-    mkdirSync3(ROOT, { recursive: true });
-    writeFileSync3(HISTORY_FILE, entries.slice(0, MAX_HISTORY).reverse().join("\n") + "\n", "utf8");
+    mkdirSync4(ROOT, { recursive: true });
+    writeFileSync4(HISTORY_FILE, entries.slice(0, MAX_HISTORY).reverse().join("\n") + "\n", "utf8");
   } catch {
   }
 }
 
 // src/kimi.ts
 import { spawn as spawn5, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { dirname as dirname3, join as join6 } from "node:path";
+import { dirname as dirname4, join as join6 } from "node:path";
 var CONTEXT_TOKENS = {
   "gpt-5-nano": 4e5,
   "gemini-2.5-flash-lite": 1048576,
@@ -6265,8 +6557,8 @@ function runKimiCode(config, task, opts = {}) {
     return Promise.resolve(1);
   }
   const path = kimiConfigPath();
-  mkdirSync4(dirname3(path), { recursive: true });
-  writeFileSync4(path, buildKimiConfig({ gatewayUrl: config.gatewayUrl, token: config.token, modelId: config.model }), "utf8");
+  mkdirSync5(dirname4(path), { recursive: true });
+  writeFileSync5(path, buildKimiConfig({ gatewayUrl: config.gatewayUrl, token: config.token, modelId: config.model }), "utf8");
   const bin = process.env.CLIXAD_KIMI_BIN || "kimi";
   if (!binExists(bin)) {
     console.log("\n" + INSTALL_HELP);
@@ -6280,14 +6572,14 @@ function runKimiCode(config, task, opts = {}) {
     OPENAI_BASE_URL: `${config.gatewayUrl.replace(/\/+$/, "")}/v1`,
     OPENAI_API_KEY: config.token
   };
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     const child = process.platform === "win32" ? spawn5([bin, ...args].map(quoteWin).join(" "), { stdio: "inherit", env, shell: true }) : spawn5(bin, args, { stdio: "inherit", env });
     child.on("error", (err) => {
       if (err.code === "ENOENT") console.log("\n" + INSTALL_HELP);
       else console.error(`failed to launch Kimi CLI: ${err.message}`);
-      resolve5(127);
+      resolve6(127);
     });
-    child.on("exit", (code) => resolve5(code ?? 0));
+    child.on("exit", (code) => resolve6(code ?? 0));
   });
 }
 function quoteWin(s) {

package/dist/clixad.mjs

@@ -54,7 +54,7 @@ import {
   takeConfigNotices,
   toolSchemaFor,
   usd
-} from "./chunk-TKGMAY4C.mjs";
+} from "./chunk-CNLFGTYS.mjs";
 
 // src/tui/load.ts
 import * as nodeModule from "node:module";
@@ -133,7 +133,7 @@ async function withProductionReact(load) {
 }
 function loadTui() {
   boundInkCaches();
-  return withProductionReact(() => import("./tui-US36BPP3.mjs"));
+  return withProductionReact(() => import("./tui-M5SJRCHM.mjs"));
 }
 
 // src/title.ts

package/dist/{tui-US36BPP3.mjs → tui-M5SJRCHM.mjs}

@@ -105,7 +105,7 @@ import {
   visibleLength,
   webSearchCostLine,
   welcomeBanner
-} from "./chunk-TKGMAY4C.mjs";
+} from "./chunk-CNLFGTYS.mjs";
 
 // src/tui/index.tsx
 import "react";
@@ -486,7 +486,7 @@ var COMMANDS = [
   // enter complete the command instead of running it, and listing is what both
   // are for. `/bg kill <id>` still works when typed in full.
   { name: "bg", desc: "background commands the agent started" },
-  { name: "mcp", desc: "connected MCP servers and their tools" },
+  { name: "mcp", desc: "MCP servers and their tools (approve: start one from this project)" },
   { name: "exit", desc: "quit clixad" }
 ];
 function commandLabel(c) {
@@ -2271,17 +2271,10 @@ function App({
       }
     }).catch(() => void 0);
   }, []);
-  useEffect(() => {
-    const { servers, errors } = loadMcpConfig(root);
-    for (const problem of errors) push({ kind: "notice", tone: "warn", text: `  mcp config \u2014 ${problem}` });
-    const names = Object.keys(servers);
-    if (names.length === 0) return;
-    let cancelled = false;
-    void McpHub.connect(servers, { root }).then((hub) => {
-      if (cancelled) return void hub.close();
-      mcpRef.current = hub;
-      const ready = hub.status().filter((s) => s.state === "ready");
-      const failed2 = hub.status().filter((s) => s.state === "failed");
+  const reportMcpStarted = useCallback(
+    (started) => {
+      const ready = started.filter((s) => s.state === "ready");
+      const failed2 = started.filter((s) => s.state === "failed");
       if (ready.length) {
         push({
           kind: "notice",
@@ -2291,10 +2284,63 @@ function App({
       for (const server of failed2) {
         push({ kind: "notice", tone: "warn", text: `  mcp: ${server.name} did not start \u2014 ${server.error}` });
       }
+    },
+    [push]
+  );
+  const askMcpApproval = useCallback(
+    (hub, pending) => {
+      if (!pending.length) return;
+      const files = [...new Set(pending.map((p) => p.file))].join(" and ");
+      push({
+        kind: "notice",
+        tone: "warn",
+        text: `  ${files} in this project ${pending.length === 1 ? "wants to start an MCP server" : `wants to start ${pending.length} MCP servers`}. A server is a program that runs on this machine; nothing has been started.
+` + pending.map(
+          (p) => `    ${p.name}
+` + p.display.split("\n").map((line2) => `      ${line2}`).join("\n") + `
+      environment it gets: ${p.variables.length ? p.variables.join(", ") : "none beyond PATH, HOME and the locale"}`
+        ).join("\n")
+      });
+      const names = pending.map((p) => p.name);
+      setPickerSel(1);
+      setPicker({
+        title: pending.length === 1 ? `Start the MCP server "${names[0]}"?` : `Start these ${pending.length} MCP servers?`,
+        subtitle: "Only if you trust this project \xB7 esc: not now",
+        items: [
+          { value: "approve", label: "Yes, start", hint: "and remember it for this project until the config changes" },
+          { value: "later", label: "Not now", hint: "ask again next time \xB7 /mcp approve starts them" },
+          { value: "decline", label: "No", hint: "and don't ask again until the config changes" }
+        ],
+        onPick: (choice) => {
+          if (choice.value === "approve") {
+            push({ kind: "notice", text: `  mcp: starting ${names.join(", ")}` });
+            void hub.approve(names, { remember: true }).then(reportMcpStarted);
+          } else if (choice.value === "decline") {
+            hub.decline(names);
+            push({ kind: "notice", text: `  mcp: not starting ${names.join(", ")} \xB7 /mcp approve starts them` });
+          } else {
+            push({ kind: "notice", text: "  mcp: not started \xB7 /mcp approve starts them" });
+          }
+        },
+        onCancel: () => push({ kind: "notice", text: "  mcp: not started \xB7 /mcp approve starts them" })
+      });
+    },
+    [push, reportMcpStarted]
+  );
+  useEffect(() => {
+    const loaded = loadMcpConfig(root);
+    for (const problem of loaded.errors) push({ kind: "notice", tone: "warn", text: `  mcp config \u2014 ${problem}` });
+    if (Object.keys(loaded.servers).length === 0) return;
+    const hub = McpHub.fromConfig(loaded, { root });
+    mcpRef.current = hub;
+    let cancelled = false;
+    void hub.startReleased().then((started) => {
+      if (!cancelled) reportMcpStarted(started);
     });
+    askMcpApproval(hub, hub.pending());
     return () => {
       cancelled = true;
-      void mcpRef.current.close();
+      void hub.close();
     };
   }, []);
   useEffect(() => {
@@ -3644,7 +3690,27 @@ ${preferencesText}` : ""),
           return;
         }
         case "mcp": {
-          const status = mcpRef.current.status();
+          const hub = mcpRef.current;
+          const [verb, ...targets] = arg.split(/\s+/).filter(Boolean);
+          if (verb === "approve") {
+            const held = hub.pending({ includeDeclined: true });
+            if (!held.length) {
+              push({ kind: "notice", text: "  no MCP servers waiting for approval" });
+              return;
+            }
+            if (!targets.length || targets.includes("all")) return askMcpApproval(hub, held);
+            const unknown = targets.filter((t) => !held.some((h) => h.name === t));
+            if (unknown.length) {
+              push({
+                kind: "notice",
+                tone: "warn",
+                text: `  not waiting for approval: ${unknown.join(", ")} \xB7 waiting: ${held.map((h) => h.name).join(", ")}`
+              });
+              return;
+            }
+            return askMcpApproval(hub, held.filter((h) => targets.includes(h.name)));
+          }
+          const status = hub.status();
           if (!status.length) {
             push({
               kind: "notice",
@@ -3652,14 +3718,16 @@ ${preferencesText}` : ""),
             });
             return;
           }
+          const label = { unapproved: "not approved", declined: "declined" };
+          const anyHeld = status.some((s) => s.state === "unapproved" || s.state === "declined");
           push({
             kind: "notice",
             text: status.map((s) => {
-              const head = `  ${s.name.padEnd(16)} ${s.state.padEnd(10)} ${s.transport}`;
+              const head = `  ${s.name.padEnd(16)} ${(label[s.state] ?? s.state).padEnd(12)} ${s.transport}`;
               if (s.state === "ready") return `${head}  ${s.toolCount} tool${s.toolCount === 1 ? "" : "s"}`;
               return s.error ? `${head}
     ${s.error.split("\n").join("\n    ")}` : head;
-            }).join("\n")
+            }).join("\n") + (anyHeld ? "\n  /mcp approve shows what a server runs and starts it" : "")
           });
           return;
         }
@@ -3702,7 +3770,7 @@ ${preferencesText}` : ""),
           push({ kind: "notice", tone: "warn", text: `  unknown command: /${cmd} \u2014 try /help` });
       }
     },
-    [client, cols, config, cycleMode, exit, model, modelTaskHints, premium, push, replayConversation, root, runAdWall, runBusy, runBuy, runLogin, runTurn, setPremium, writeToStdout]
+    [askMcpApproval, client, cols, config, cycleMode, exit, model, modelTaskHints, premium, push, replayConversation, root, runAdWall, runBusy, runBuy, runLogin, runTurn, setPremium, writeToStdout]
   );
   const runShell = useCallback(
     async (command2) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clixad",
-  "version": "0.0.1-beta.47",
+  "version": "0.0.1-beta.48",
   "description": "Free AI coding agent in your terminal, funded by rewarded ads.",
   "license": "Apache-2.0",
   "type": "module",