clixad 0.0.1-beta.47 → 0.0.1-beta.49

package/README.md

@@ -63,7 +63,11 @@ before it changes anything. `shift+tab` cycles through the permission modes. Bey
 - **Keeps a task list** on multi-step work, and **asks you** when guessing wrong would waste real
   work.
 - **Uses MCP servers** you configure in `.mcp.json` or `~/.clixad/mcp.json`; `/mcp` shows their
-  status. Every tool a server offers is put to you before it runs.
+  status. Every tool a server offers is put to you before it runs. A server from a project's
+  `.mcp.json` or `.clixad/mcp.json` starts only after you approve it (asked once per project, and
+  again if its entry changes; `/mcp approve` starts one later). A server gets `PATH`, `HOME` and the
+  locale from your environment and nothing else, so pass what it needs in its `env`, for example
+  `"env": { "GITHUB_TOKEN": "${GITHUB_TOKEN}" }`.
 
 Type `/help` for the commands, `@` to attach a file, and `!` to run a shell command yourself.
 
@@ -95,8 +99,8 @@ github.com/clixad/cli is an automatic one-way copy of the CLI's part of it, so a
 nowhere to be merged and is closed automatically. If you have a fix in mind, describe it in an
 issue.
 
-Please report security problems privately, through "Report a vulnerability" on the repository's
-Security tab, rather than in a public issue.
+Please report security problems by email to [info@clixad.io](mailto:info@clixad.io), not in a
+public GitHub issue. See [SECURITY.md](https://github.com/clixad/cli/blob/main/SECURITY.md).
 
 ## Status
 

package/dist/{chunk-TKGMAY4C.mjs → chunk-E7SAKAVQ.mjs}

@@ -468,6 +468,13 @@ var MaintenanceError = class extends Error {
   }
 };
 var MAINTENANCE = "maintenance";
+var PromptTooLongError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PromptTooLongError";
+  }
+};
+var PROMPT_TOO_LONG = "prompt_too_long";
 async function refusal503(res, what) {
   const text = await res.text().catch(() => "");
   try {
@@ -537,7 +544,7 @@ async function refusal400(res, what) {
   const text = await res.text().catch(() => "");
   try {
     const body = JSON.parse(text);
-    if (body.error === "prompt_too_long" && typeof body.message === "string") return new Error(body.message);
+    if (body.error === PROMPT_TOO_LONG && typeof body.message === "string") return new PromptTooLongError(body.message);
   } catch {
   }
   const detail = safeDetail(text);
@@ -643,16 +650,16 @@ async function httpFailure(res, what) {
   return detail ? `${what} failed: ${res.status} \u2014 ${detail}` : `${what} failed: ${res.status}`;
 }
 function sleep(ms, signal) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     if (!signal) {
-      setTimeout(resolve5, ms);
+      setTimeout(resolve6, ms);
       return;
     }
-    if (signal.aborted) return resolve5();
+    if (signal.aborted) return resolve6();
     const done = () => {
       clearTimeout(timer);
       signal.removeEventListener("abort", done);
-      resolve5();
+      resolve6();
     };
     const timer = setTimeout(done, ms);
     signal.addEventListener("abort", done, { once: true });
@@ -1482,6 +1489,7 @@ var GatewayClient = class {
     }
     if (premiumRefusal) throw premiumRefusal;
     if (streamError && streamErrorType === MAINTENANCE) throw new MaintenanceError(streamError);
+    if (streamError && streamErrorType === PROMPT_TOO_LONG) throw new PromptTooLongError(streamError);
     if (streamError && streamErrorType && LIMIT_REFUSALS.has(streamErrorType)) {
       throw new LimitRefusalError(streamError, streamErrorType, spendable ? { figures: spendable, balance } : void 0);
     }
@@ -2032,16 +2040,16 @@ async function devLogin(client, config, email, invite) {
   };
 }
 function sleep2(ms, signal) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     if (!signal) {
-      setTimeout(resolve5, ms);
+      setTimeout(resolve6, ms);
       return;
     }
-    if (signal.aborted) return resolve5();
+    if (signal.aborted) return resolve6();
     const done = () => {
       clearTimeout(timer);
       signal.removeEventListener("abort", done);
-      resolve5();
+      resolve6();
     };
     const timer = setTimeout(done, ms);
     signal.addEventListener("abort", done, { once: true });
@@ -2336,8 +2344,18 @@ ${renderTodos(items)}${warning}`;
 
 // src/tools.ts
 import { spawn as spawn4 } from "node:child_process";
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync3, statSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { isAbsolute, relative, resolve, dirname as dirname2, join as join3, sep } from "node:path";
+import {
+  existsSync as existsSync2,
+  lstatSync,
+  mkdirSync as mkdirSync3,
+  readdirSync,
+  readFileSync as readFileSync3,
+  readlinkSync,
+  realpathSync as realpathSync2,
+  statSync,
+  writeFileSync as writeFileSync3
+} from "node:fs";
+import { basename, isAbsolute, relative, resolve as resolve2, dirname as dirname3, join as join3, sep } from "node:path";
 
 // src/diff.ts
 var R = "\x1B[0m";
@@ -3026,9 +3044,10 @@ function decodeEntities(text) {
 
 // src/mcp.ts
 import { spawn as spawn3 } from "node:child_process";
-import { existsSync, readFileSync as readFileSync2 } from "node:fs";
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, realpathSync, renameSync as renameSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join2 } from "node:path";
+import { dirname as dirname2, join as join2, resolve } from "node:path";
 var CONNECT_TIMEOUT_MS = 2e4;
 var DEFAULT_CALL_TIMEOUT_MS = 12e4;
 var PROTOCOL_VERSION = "2025-06-18";
@@ -3039,14 +3058,20 @@ var McpError = class extends Error {
 function isHttpConfig(c) {
   return c.url !== void 0;
 }
-function mcpConfigPaths(root) {
-  return [join2(homedir2(), ".clixad", "mcp.json"), join2(root, ".mcp.json"), join2(root, ".clixad", "mcp.json")];
+function mcpConfigFiles(root) {
+  const personal = join2(homedir2(), ".clixad", "mcp.json");
+  const files = [{ path: personal, scope: "user" }];
+  for (const path of [join2(root, ".mcp.json"), join2(root, ".clixad", "mcp.json")]) {
+    if (resolve(path) !== resolve(personal)) files.push({ path, scope: "project" });
+  }
+  return files;
 }
 function loadMcpConfig(root) {
   const servers = {};
+  const origins = {};
   const sources = [];
   const errors = [];
-  for (const path of mcpConfigPaths(root)) {
+  for (const { path, scope } of mcpConfigFiles(root)) {
     if (!existsSync(path)) continue;
     let parsed;
     try {
@@ -3067,13 +3092,24 @@ function loadMcpConfig(root) {
     sources.push(short(path));
     for (const [name, raw] of Object.entries(declared)) {
       const config = validateServer(name, raw);
-      if (typeof config === "string") errors.push(`${short(path)}: ${config}`);
-      else servers[name] = config;
+      if (typeof config === "string") {
+        errors.push(`${short(path)}: ${config}`);
+        continue;
+      }
+      servers[name] = config;
+      origins[name] = {
+        scope,
+        file: short(path),
+        fingerprint: fingerprint(raw),
+        display: describeEntry(raw),
+        variables: [...new Set(variablesIn(raw))].sort()
+      };
     }
   }
-  return { servers, sources, errors };
+  return { servers, origins, sources, errors };
 }
 function validateServer(name, raw) {
+  if (/[\u0000-\u001f\u007f-\u009f]/.test(name)) return `server ${JSON.stringify(name)} has control characters in its name`;
   if (typeof raw !== "object" || raw === null) return `server "${name}" is not an object`;
   const c = raw;
   if (typeof c.url === "string") {
@@ -3114,6 +3150,109 @@ function expandMap(map) {
 function short(path) {
   return path.replace(homedir2(), "~");
 }
+function canonicalJson(value) {
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    const entries = Object.keys(value).sort().map((k) => `${JSON.stringify(k)}:${canonicalJson(value[k])}`);
+    return `{${entries.join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "null";
+}
+function fingerprint(raw) {
+  return createHash("sha256").update(canonicalJson(raw)).digest("hex");
+}
+function variablesIn(value) {
+  if (typeof value === "string") return [...value.matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g)].map((m) => m[1]);
+  if (Array.isArray(value)) return value.flatMap(variablesIn);
+  if (value && typeof value === "object") return Object.values(value).flatMap(variablesIn);
+  return [];
+}
+var MAX_DISPLAY_CHARS = 2e3;
+function shellWord(word) {
+  if (/^[\x21\x23-\x5b\x5d-\x7e]+$/.test(word)) return word;
+  return JSON.stringify(word).replace(/[^\x20-\x7e]/g, (ch) => `\\u${ch.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function describeEntry(raw) {
+  const strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
+  const pairs = (v) => isStringMap(v) ? Object.entries(v) : [];
+  const lines = [];
+  if (typeof raw.url === "string") {
+    lines.push(`${raw.type === "sse" ? "sse" : "http"} ${shellWord(raw.url)}`);
+    for (const [k, v] of pairs(raw.headers)) lines.push(`header ${shellWord(k)}: ${shellWord(v)}`);
+  } else {
+    lines.push([String(raw.command ?? ""), ...strings(raw.args)].map(shellWord).join(" "));
+    for (const [k, v] of pairs(raw.env)) lines.push(`env ${shellWord(k)}=${shellWord(v)}`);
+    if (typeof raw.cwd === "string") lines.push(`cwd ${shellWord(raw.cwd)}`);
+  }
+  const text = lines.join("\n");
+  return text.length > MAX_DISPLAY_CHARS ? `${text.slice(0, MAX_DISPLAY_CHARS)}\u2026 (${text.length - MAX_DISPLAY_CHARS} more characters; read the file before approving)` : text;
+}
+var INHERITED_ENV = {
+  posix: ["HOME", "LOGNAME", "PATH", "SHELL", "TERM", "USER", "LANG", "LC_ALL", "LC_CTYPE", "TMPDIR", "TZ"],
+  win32: [
+    "APPDATA",
+    "COMSPEC",
+    "HOMEDRIVE",
+    "HOMEPATH",
+    "LOCALAPPDATA",
+    "PATH",
+    "PATHEXT",
+    "PROCESSOR_ARCHITECTURE",
+    "PROGRAMFILES",
+    "SYSTEMDRIVE",
+    "SYSTEMROOT",
+    "TEMP",
+    "TMP",
+    "USERNAME",
+    "USERPROFILE",
+    "WINDIR"
+  ]
+};
+function mcpServerEnv(own = {}, source = process.env, platform2 = process.platform) {
+  const env = {};
+  const wanted = INHERITED_ENV[platform2 === "win32" ? "win32" : "posix"];
+  const byName = new Map(Object.keys(source).map((k) => [platform2 === "win32" ? k.toUpperCase() : k, k]));
+  for (const name of wanted) {
+    const key = byName.get(name);
+    const value = key === void 0 ? void 0 : source[key];
+    if (value !== void 0 && !value.startsWith("()")) env[name] = value;
+  }
+  return { ...env, ...own };
+}
+function mcpApprovalsPath() {
+  return join2(homedir2(), ".clixad", "mcp-approvals.json");
+}
+function workspaceKey(root) {
+  try {
+    return realpathSync.native(root);
+  } catch {
+    return resolve(root);
+  }
+}
+function readApprovals() {
+  try {
+    const parsed = JSON.parse(readFileSync2(mcpApprovalsPath(), "utf8"));
+    if (parsed?.version === 1 && parsed.projects && typeof parsed.projects === "object") return parsed;
+  } catch {
+  }
+  return { version: 1, projects: {} };
+}
+function mcpDecision(root, name, fingerprint2) {
+  const entry = readApprovals().projects[workspaceKey(root)]?.[name];
+  return entry && entry.fingerprint === fingerprint2 ? entry.decision : void 0;
+}
+function recordMcpDecision(root, servers, decision, at = /* @__PURE__ */ new Date()) {
+  const file = readApprovals();
+  const key = workspaceKey(root);
+  const project = file.projects[key] ??= {};
+  for (const server of servers) project[server.name] = { fingerprint: server.fingerprint, decision, at: at.toISOString() };
+  const path = mcpApprovalsPath();
+  mkdirSync2(dirname2(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.tmp`;
+  writeFileSync2(tmp, `${JSON.stringify(file, null, 2)}
+`, { encoding: "utf8", mode: 384 });
+  renameSync2(tmp, path);
+}
 var StdioTransport = class {
   child;
   buffer = "";
@@ -3124,10 +3263,13 @@ var StdioTransport = class {
   constructor(config, root) {
     this.child = spawn3(config.command, config.args ?? [], {
       cwd: config.cwd ?? root,
-      // The server's own env plus ours. `shell: false` on purpose: the command
-      // and its args are already separate, so there is nothing for a shell to
-      // re-split, and a path with a space in it would be split if there were.
-      env: { ...process.env, ...config.env ?? {} },
+      // What a program needs to run plus what the entry names, and never the
+      // rest of ours: this process's environment holds whatever the user
+      // exported, API keys included, and a server is somebody else's program.
+      // `shell: false` on purpose: the command and its args are already
+      // separate, so there is nothing for a shell to re-split, and a path with
+      // a space in it would be split if there were.
+      env: mcpServerEnv(config.env),
       stdio: ["pipe", "pipe", "pipe"],
       windowsHide: true,
       // npx and friends are .cmd shims on Windows, which CreateProcess cannot
@@ -3177,7 +3319,7 @@ var StdioTransport = class {
     if (this.exited) return Promise.reject(new McpError(this.exited));
     const id = ++this.seq;
     const payload = JSON.stringify({ jsonrpc: "2.0", id, method, params }) + "\n";
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       const settle = (fn) => {
         clearTimeout(timer);
         signal?.removeEventListener("abort", onAbort);
@@ -3191,7 +3333,7 @@ var StdioTransport = class {
       const onAbort = () => settle(() => reject(new McpError("cancelled")));
       signal?.addEventListener("abort", onAbort, { once: true });
       this.pending.set(id, {
-        resolve: (v) => settle(() => resolve5(v)),
+        resolve: (v) => settle(() => resolve6(v)),
         reject: (e) => settle(() => reject(e))
       });
       this.child.stdin?.write(payload, (err) => {
@@ -3315,23 +3457,42 @@ async function readSseResponse(res, id) {
   return null;
 }
 var McpServerConnection = class {
-  constructor(name, config, root) {
+  constructor(name, config, root, origin, held) {
     this.name = name;
     this.config = config;
-    this.transport = isHttpConfig(config) ? new HttpTransport(config) : new StdioTransport(config, root);
+    this.root = root;
+    this.origin = origin;
+    this.state = held ?? "connecting";
   }
   name;
   config;
-  state = "connecting";
+  root;
+  origin;
+  state;
   error;
   tools = [];
+  /**
+   * Created by `connect()` and nowhere else, because creating a stdio
+   * transport *is* starting the program. A held connection never has one.
+   */
   transport;
   get kind() {
     return isHttpConfig(this.config) ? "http" : "stdio";
   }
+  /** Lift the hold, after the user approved. Starts nothing by itself. */
+  release() {
+    if (this.state === "unapproved" || this.state === "declined") this.state = "connecting";
+  }
+  /** Remember a refusal, so `/mcp` can say why it is not running. */
+  decline() {
+    if (this.state === "unapproved") this.state = "declined";
+  }
   async connect(timeoutMs = CONNECT_TIMEOUT_MS) {
+    if (this.state !== "connecting" || this.transport) return;
+    const transport = isHttpConfig(this.config) ? new HttpTransport(this.config) : new StdioTransport(this.config, this.root);
+    this.transport = transport;
     try {
-      await this.transport.request(
+      await transport.request(
         "initialize",
         {
           protocolVersion: PROTOCOL_VERSION,
@@ -3340,8 +3501,8 @@ var McpServerConnection = class {
         },
         timeoutMs
       );
-      await this.transport.notify("notifications/initialized", {});
-      const listed = await this.transport.request("tools/list", {}, timeoutMs);
+      await transport.notify("notifications/initialized", {});
+      const listed = await transport.request("tools/list", {}, timeoutMs);
       this.tools = (listed?.tools ?? []).filter(
         (t) => typeof t?.name === "string" && t.name.length > 0
       ).map((t) => ({
@@ -3352,17 +3513,19 @@ var McpServerConnection = class {
         ...typeof t.description === "string" ? { description: t.description } : {},
         ...t.inputSchema && typeof t.inputSchema === "object" ? { inputSchema: t.inputSchema } : {}
       }));
+      if (this.state !== "connecting") return;
       this.state = "ready";
     } catch (err) {
+      if (this.state !== "connecting") return;
       this.state = "failed";
-      const diagnostics = this.transport.diagnostics();
+      const diagnostics = transport.diagnostics();
       this.error = err.message + (diagnostics ? `
   ${diagnostics.split("\n").slice(-3).join("\n  ")}` : "");
-      await this.transport.close().catch(() => void 0);
+      await transport.close().catch(() => void 0);
     }
   }
   async call(tool, args, timeoutMs, signal) {
-    if (this.state !== "ready") throw new McpError(`server "${this.name}" is ${this.state}`);
+    if (this.state !== "ready" || !this.transport) throw new McpError(`server "${this.name}" is ${this.state}`);
     const raw = await this.transport.request(
       "tools/call",
       { name: tool, arguments: args ?? {} },
@@ -3375,7 +3538,7 @@ var McpServerConnection = class {
   }
   async close() {
     this.state = "closed";
-    await this.transport.close().catch(() => void 0);
+    await this.transport?.close().catch(() => void 0);
   }
 };
 function renderContent(content, structured) {
@@ -3418,34 +3581,118 @@ function isMcpToolName(name) {
   return name.startsWith("mcp__");
 }
 var McpHub = class _McpHub {
-  constructor(servers) {
+  constructor(servers, root) {
     this.servers = servers;
+    this.root = root;
   }
   servers;
+  root;
   /**
-   * Connect to every configured server, in parallel, and never reject.
+   * Connect to every server given, in parallel, and never reject.
    *
+   * For servers the caller has already decided may run; a config read from
+   * disk goes through `fromConfig`, which holds the repository's servers.
    * Parallel because a slow server must not delay the others, and one that
    * cannot start must not delay anything: the whole point is that the REPL opens
    * whether or not somebody's Docker daemon is running today.
    */
   static async connect(servers, opts = { root: process.cwd() }) {
     const connections = Object.entries(servers).map(([name, config]) => new McpServerConnection(name, config, opts.root));
-    await Promise.all(connections.map((c) => c.connect(opts.timeoutMs)));
-    const taken = /* @__PURE__ */ new Set();
-    for (const conn of connections) {
+    const hub = new _McpHub(connections, opts.root);
+    await hub.startReleased(opts.timeoutMs);
+    return hub;
+  }
+  /**
+   * A hub for the config on disk, with nothing started yet.
+   *
+   * A server from `~/.clixad/mcp.json` is ready to start. A server from the
+   * workspace is held unless the user approved this exact entry for this
+   * workspace before, and stays held if they declined it. `startReleased`
+   * then starts what may start; `approve` releases the rest.
+   */
+  static fromConfig(loaded, opts) {
+    const connections = Object.entries(loaded.servers).map(([name, config]) => {
+      const origin = loaded.origins[name];
+      let held;
+      if (!origin || origin.scope !== "user") {
+        const decision = origin ? mcpDecision(opts.root, name, origin.fingerprint) : void 0;
+        held = decision === "approved" ? void 0 : decision === "declined" ? "declined" : "unapproved";
+      }
+      return new McpServerConnection(name, config, opts.root, origin, held);
+    });
+    return new _McpHub(connections, opts.root);
+  }
+  /** An empty hub — what a run with no config, or a scripted run, gets. */
+  static empty() {
+    return new _McpHub([], process.cwd());
+  }
+  /**
+   * Start every server that may start and has not been, in parallel. Returns
+   * the ones it started, so the caller can say how each one went.
+   */
+  async startReleased(timeoutMs) {
+    const starting = this.servers.filter((s) => s.state === "connecting");
+    await Promise.all(starting.map((c) => c.connect(timeoutMs)));
+    this.assignNames();
+    const names = new Set(starting.map((s) => s.name));
+    return this.status().filter((s) => names.has(s.name));
+  }
+  /**
+   * Give every listed tool its model-facing name. Names already given keep
+   * theirs, so a server approved later cannot rename a tool the model has
+   * already been told about. A collision (two servers with the same tool, or
+   * two long names that truncate together) is broken deterministically.
+   */
+  assignNames() {
+    const taken = new Set(this.servers.flatMap((s) => s.tools.map((t) => t.qualified)).filter(Boolean));
+    for (const conn of this.servers) {
       for (const tool of conn.tools) {
+        if (tool.qualified) continue;
         let name = qualifiedToolName(conn.name, tool.name);
         for (let i = 2; taken.has(name); i++) name = `${name.slice(0, 61)}_${i}`;
         taken.add(name);
         tool.qualified = name;
       }
     }
-    return new _McpHub(connections);
   }
-  /** An empty hub — what a run with no config, or a scripted run, gets. */
-  static empty() {
-    return new _McpHub([]);
+  /** The servers waiting for the user, with what the prompt shows. */
+  pending(opts = {}) {
+    return this.servers.filter((s) => s.state === "unapproved" || opts.includeDeclined && s.state === "declined").map((s) => ({
+      name: s.name,
+      file: s.origin?.file ?? "",
+      display: s.origin?.display ?? "",
+      variables: s.origin?.variables ?? [],
+      fingerprint: s.origin?.fingerprint ?? ""
+    }));
+  }
+  /**
+   * The user approved these held servers: remember it (bound to each entry as
+   * written) when asked to, and start them. Names that are not held are
+   * ignored. Returns how each one started.
+   */
+  async approve(names, opts) {
+    const chosen = this.held(names);
+    if (opts.remember) this.remember(chosen, "approved");
+    for (const s of chosen) s.release();
+    return this.startReleased(opts.timeoutMs);
+  }
+  /** The user declined these held servers: remember it, so they are not asked about again until the entry changes. */
+  decline(names) {
+    const chosen = this.held(names).filter((s) => s.state === "unapproved");
+    this.remember(chosen, "declined");
+    for (const s of chosen) s.decline();
+  }
+  held(names) {
+    const wanted = new Set(names);
+    return this.servers.filter((s) => wanted.has(s.name) && (s.state === "unapproved" || s.state === "declined"));
+  }
+  remember(servers, decision) {
+    const entries = servers.filter((s) => s.origin).map((s) => ({ name: s.name, fingerprint: s.origin.fingerprint }));
+    if (!entries.length) return;
+    try {
+      recordMcpDecision(this.root, entries, decision);
+    } catch {
+    }
   }
   tools() {
     return this.servers.filter((s) => s.state === "ready").flatMap((s) => s.tools);
@@ -3509,13 +3756,60 @@ var PermissionDeniedError = class extends ToolError {
   }
 };
 function safeResolve(root, p) {
-  const abs = isAbsolute(p) ? p : resolve(root, p);
-  const rel2 = relative(root, abs);
-  if (rel2 === ".." || rel2.startsWith(".." + sep) || isAbsolute(rel2)) {
-    throw new ToolError(`path escapes workspace: ${p}`);
+  const abs = isAbsolute(p) ? p : resolve2(root, p);
+  if (escapes(root, abs)) throw new ToolError(`path escapes workspace: ${p}`);
+  let real;
+  let realRoot;
+  try {
+    real = realLocation(abs);
+    realRoot = realLocation(resolve2(root));
+  } catch (err) {
+    const code = err.code;
+    throw new ToolError(code === "ELOOP" ? `${p}: the path goes through a symlink loop` : `cannot resolve ${p}`);
+  }
+  if (escapes(realRoot, real)) {
+    throw new ToolError(`path escapes workspace: ${p} is a symlink (or inside one) that points outside the workspace`);
   }
   return abs;
 }
+function escapes(root, abs) {
+  const rel2 = relative(root, abs);
+  return rel2 === ".." || rel2.startsWith(".." + sep) || isAbsolute(rel2);
+}
+var MAX_LINK_HOPS = 40;
+function realLocation(abs, hops = 0) {
+  try {
+    return realpathSync2.native(abs);
+  } catch (err) {
+    const code = err.code;
+    if (code !== "ENOENT" && code !== "ENOTDIR") throw err;
+  }
+  const parent = dirname3(abs);
+  if (parent === abs) return abs;
+  let link;
+  try {
+    if (lstatSync(abs).isSymbolicLink()) link = readlinkSync(abs);
+  } catch {
+  }
+  const realParent = realLocation(parent, hops);
+  if (link === void 0) return join3(realParent, basename(abs));
+  if (hops >= MAX_LINK_HOPS) throw Object.assign(new Error("too many symlinks"), { code: "ELOOP" });
+  return realLocation(resolve2(realParent, link), hops + 1);
+}
+function realRootOf(root) {
+  try {
+    return realLocation(resolve2(root));
+  } catch {
+    return resolve2(root);
+  }
+}
+function linkStaysInside(abs, realRoot) {
+  try {
+    return !escapes(realRoot, realpathSync2.native(abs));
+  } catch {
+    return false;
+  }
+}
 function rel(root, abs) {
   return relative(root, abs).replace(/\\/g, "/") || ".";
 }
@@ -3589,10 +3883,11 @@ function describeValue(value) {
   if (typeof value === "number") return "an unusable number";
   return typeof value === "object" ? "an object" : `a ${typeof value}`;
 }
-function entryKind(entry, abs) {
+function entryKind(entry, abs, realRoot) {
   if (entry.isDirectory()) return "dir";
   if (entry.isFile()) return "file";
   if (!entry.isSymbolicLink()) return "other";
+  if (!linkStaysInside(abs, realRoot)) return "other";
   try {
     const stat = statSync(abs);
     return stat.isDirectory() ? "dir" : stat.isFile() ? "file" : "other";
@@ -3730,9 +4025,10 @@ ${body2}` + (pdf.text.length > MAX_FILE_BYTES ? "\n\u2026 [truncated]" : "");
     if (!fsCall(`cannot list ${name}`, () => statSync(abs)).isDirectory()) {
       throw new ToolError(`${path} is a file \u2014 use read_file`);
     }
+    const realRoot = realRootOf(ctx.root);
     const entries = fsCall(`cannot list ${name}`, () => readdirSync(abs, { withFileTypes: true })).map(
       (entry) => {
-        const isDir = entryKind(entry, resolve(abs, entry.name)) === "dir";
+        const isDir = entryKind(entry, resolve2(abs, entry.name), realRoot) === "dir";
         return { name: isDir ? `${entry.name}/` : entry.name, isDir };
       }
     );
@@ -3812,9 +4108,10 @@ ${body2}` + (pdf.text.length > MAX_FILE_BYTES ? "\n\u2026 [truncated]" : "");
       path: name,
       root: ctx.root
     });
+    safeResolve(ctx.root, abs);
     fsCall(`cannot write ${name}`, () => {
-      mkdirSync2(dirname2(abs), { recursive: true });
-      writeFileSync2(abs, content, "utf8");
+      mkdirSync3(dirname3(abs), { recursive: true });
+      writeFileSync3(abs, content, "utf8");
     });
     ctx.present?.(view);
     return `wrote ${content.length} bytes to ${name}`;
@@ -3856,7 +4153,8 @@ ${body2}` + (pdf.text.length > MAX_FILE_BYTES ? "\n\u2026 [truncated]" : "");
       path: name,
       root: ctx.root
     });
-    fsCall(`cannot edit ${name}`, () => writeFileSync2(abs, after, "utf8"));
+    safeResolve(ctx.root, abs);
+    fsCall(`cannot edit ${name}`, () => writeFileSync3(abs, after, "utf8"));
     ctx.present?.(view);
     return `edited ${name} (${count > 1 ? `${count} occurrences` : "1 occurrence"})`;
   },
@@ -4262,6 +4560,7 @@ function walk(dir, root, visit) {
     visit(dir);
     return;
   }
+  const realRoot = realRootOf(root);
   let seen = 0;
   const stack = [dir];
   while (stack.length > 0) {
@@ -4274,7 +4573,7 @@ function walk(dir, root, visit) {
     }
     for (const entry of entries) {
       const abs = join3(current, entry.name);
-      const kind = entryKind(entry, abs);
+      const kind = entryKind(entry, abs, realRoot);
       if (kind === "dir") {
         if (entry.isSymbolicLink() || SKIP_DIRS.has(entry.name)) continue;
         stack.push(abs);
@@ -4285,7 +4584,6 @@ function walk(dir, root, visit) {
       if (!visit(abs)) return;
     }
   }
-  void root;
 }
 function globToRegExp(pattern) {
   const p = requireString(pattern, "glob", "pattern").replace(/\\/g, "/").replace(/^\.\//, "");
@@ -4590,7 +4888,7 @@ var TOOL_SCHEMA = [
 
 // src/auto-mode.ts
 import { homedir as homedir3 } from "node:os";
-import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2, sep as sep2 } from "node:path";
+import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
 function parseCommand(src) {
   const pipelines = [];
   let pipeline = [];
@@ -4763,9 +5061,9 @@ function expandHome(word, home) {
 function resolveWord(word, ctx) {
   const w = expandHome(word, ctx.home);
   if (w === null) return null;
-  if (isAbsolute2(w)) return resolve2(w);
+  if (isAbsolute2(w)) return resolve3(w);
   if (ctx.cwd === null) return null;
-  return resolve2(ctx.cwd, w);
+  return resolve3(ctx.cwd, w);
 }
 function within(parent, child) {
   const rel2 = relative2(parent, child);
@@ -5299,7 +5597,7 @@ function classify(command, root, home, depth) {
   if (FORK_BOMB.test(command)) return { kind: "dangerous", reason: "it is a fork bomb" };
   if (FETCH_AND_RUN.some((re) => re.test(command))) return { kind: "dangerous", reason: "it downloads code and runs it" };
   const parsed = parseCommand(command);
-  const ctx = { root: resolve2(root), home: resolve2(home), cwd: resolve2(root) };
+  const ctx = { root: resolve3(root), home: resolve3(home), cwd: resolve3(root) };
   for (const pipeline of parsed.pipelines) {
     let fetched = false;
     for (const cmd of pipeline) {
@@ -5816,7 +6114,7 @@ async function dispatch(ctx, name, args) {
 import { spawnSync } from "node:child_process";
 import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "node:fs";
 import { homedir as homedir4, platform } from "node:os";
-import { join as join4, parse, resolve as resolve3 } from "node:path";
+import { join as join4, parse, resolve as resolve4 } from "node:path";
 var MAX_CONTEXT_FILE_CHARS = 2e4;
 function contextFileCandidates(root) {
   return [join4(homedir4(), ".clixad", "CLIXAD.md"), join4(root, "AGENTS.md"), join4(root, "CLIXAD.md")];
@@ -5824,10 +6122,12 @@ function contextFileCandidates(root) {
 function collectContext(root, base = SYSTEM_PROMPT) {
   const parts = [base, environmentBlock(root)];
   const files = [];
+  const personal = join4(homedir4(), ".clixad", "CLIXAD.md");
   for (const path of contextFileCandidates(root)) {
     if (!existsSync3(path)) continue;
     let text;
     try {
+      if (path !== personal) safeResolve(root, path);
       text = readFileSync4(path, "utf8").trim();
     } catch {
       continue;
@@ -5882,8 +6182,8 @@ var INIT_PROMPT = "Create a CLIXAD.md file in the workspace root that tells a fu
 var INIT_HINT = "No CLIXAD.md in this project yet. /init writes one, and every later session here starts out knowing the layout.";
 var PROJECT_MARKERS = [".git", "package.json", "pyproject.toml", "Cargo.toml", "go.mod", "pom.xml", "Gemfile"];
 function shouldSuggestInit(root) {
-  const dir = resolve3(root);
-  if (dir === resolve3(homedir4()) || dir === parse(dir).root) return false;
+  const dir = resolve4(root);
+  if (dir === resolve4(homedir4()) || dir === parse(dir).root) return false;
   if (existsSync3(join4(dir, "CLIXAD.md")) || existsSync3(join4(dir, "AGENTS.md"))) return false;
   return PROJECT_MARKERS.some((name) => existsSync3(join4(dir, name)));
 }
@@ -6055,17 +6355,17 @@ var denyAll = async (req) => ({
 import {
   closeSync as closeSync2,
   existsSync as existsSync4,
-  mkdirSync as mkdirSync3,
+  mkdirSync as mkdirSync4,
   openSync as openSync2,
   readdirSync as readdirSync3,
   readFileSync as readFileSync5,
   readSync,
   rmSync,
   statSync as statSync2,
-  writeFileSync as writeFileSync3
+  writeFileSync as writeFileSync4
 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join5, resolve as resolve4 } from "node:path";
+import { join as join5, resolve as resolve5 } from "node:path";
 var ROOT = join5(homedir5(), ".clixad");
 var SESSION_DIR = join5(ROOT, "sessions");
 var HISTORY_FILE = join5(ROOT, "history");
@@ -6076,7 +6376,7 @@ function isSessionId(id) {
   return SESSION_ID.test(id);
 }
 function sameDirectory(a, b) {
-  const norm = (p) => process.platform === "win32" ? resolve4(p).toLowerCase() : resolve4(p);
+  const norm = (p) => process.platform === "win32" ? resolve5(p).toLowerCase() : resolve5(p);
   return norm(a) === norm(b);
 }
 function newSessionId() {
@@ -6085,9 +6385,9 @@ function newSessionId() {
 }
 function saveSession(session) {
   try {
-    mkdirSync3(SESSION_DIR, { recursive: true });
+    mkdirSync4(SESSION_DIR, { recursive: true });
     const stored = { ...session, messages: withoutImages(session.messages) };
-    writeFileSync3(join5(SESSION_DIR, `${session.id}.json`), JSON.stringify(stored), "utf8");
+    writeFileSync4(join5(SESSION_DIR, `${session.id}.json`), JSON.stringify(stored), "utf8");
     prune();
   } catch {
   }
@@ -6175,17 +6475,17 @@ function loadHistory() {
 }
 function saveHistory(entries) {
   try {
-    mkdirSync3(ROOT, { recursive: true });
-    writeFileSync3(HISTORY_FILE, entries.slice(0, MAX_HISTORY).reverse().join("\n") + "\n", "utf8");
+    mkdirSync4(ROOT, { recursive: true });
+    writeFileSync4(HISTORY_FILE, entries.slice(0, MAX_HISTORY).reverse().join("\n") + "\n", "utf8");
   } catch {
   }
 }
 
 // src/kimi.ts
 import { spawn as spawn5, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { dirname as dirname3, join as join6 } from "node:path";
+import { dirname as dirname4, join as join6 } from "node:path";
 var CONTEXT_TOKENS = {
   "gpt-5-nano": 4e5,
   "gemini-2.5-flash-lite": 1048576,
@@ -6265,8 +6565,8 @@ function runKimiCode(config, task, opts = {}) {
     return Promise.resolve(1);
   }
   const path = kimiConfigPath();
-  mkdirSync4(dirname3(path), { recursive: true });
-  writeFileSync4(path, buildKimiConfig({ gatewayUrl: config.gatewayUrl, token: config.token, modelId: config.model }), "utf8");
+  mkdirSync5(dirname4(path), { recursive: true });
+  writeFileSync5(path, buildKimiConfig({ gatewayUrl: config.gatewayUrl, token: config.token, modelId: config.model }), "utf8");
   const bin = process.env.CLIXAD_KIMI_BIN || "kimi";
   if (!binExists(bin)) {
     console.log("\n" + INSTALL_HELP);
@@ -6280,14 +6580,14 @@ function runKimiCode(config, task, opts = {}) {
     OPENAI_BASE_URL: `${config.gatewayUrl.replace(/\/+$/, "")}/v1`,
     OPENAI_API_KEY: config.token
   };
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     const child = process.platform === "win32" ? spawn5([bin, ...args].map(quoteWin).join(" "), { stdio: "inherit", env, shell: true }) : spawn5(bin, args, { stdio: "inherit", env });
     child.on("error", (err) => {
       if (err.code === "ENOENT") console.log("\n" + INSTALL_HELP);
       else console.error(`failed to launch Kimi CLI: ${err.message}`);
-      resolve5(127);
+      resolve6(127);
     });
-    child.on("exit", (code) => resolve5(code ?? 0));
+    child.on("exit", (code) => resolve6(code ?? 0));
   });
 }
 function quoteWin(s) {
@@ -6538,6 +6838,24 @@ var COMPACT_THRESHOLD = 0.75;
 function shouldCompact(messages, contextTokens, threshold = COMPACT_THRESHOLD) {
   return conversationTokens(messages) > contextTokens * threshold;
 }
+function compactBudget(contextTokens) {
+  return Math.floor(contextTokens * COMPACT_THRESHOLD);
+}
+function messageWeight(message) {
+  let images = 0;
+  const content = Array.isArray(message.content) ? message.content.map((part) => {
+    if (part.type !== "image_url") return part;
+    images++;
+    return { ...part, image_url: { url: "" } };
+  }) : message.content;
+  const bytes = Buffer.byteLength(JSON.stringify({ ...message, content }));
+  return Math.ceil(bytes / 4) + images * IMAGE_TOKEN_ESTIMATE;
+}
+function requestTokens(messages) {
+  let total = 0;
+  for (const m of messages) total += messageWeight(m);
+  return total;
+}
 function cutPoint(messages, keepTurns = 2) {
   let seen = 0;
   for (let i = messages.length - 1; i > 0; i--) {
@@ -6547,37 +6865,187 @@ function cutPoint(messages, keepTurns = 2) {
   }
   return 0;
 }
+function safeCuts(messages) {
+  const open = /* @__PURE__ */ new Set();
+  const cuts = [];
+  for (let i = 1; i <= messages.length; i++) {
+    const prev = messages[i - 1];
+    if (prev.role === "assistant") for (const call of prev.tool_calls ?? []) open.add(call.id);
+    if (prev.role === "tool" && prev.tool_call_id) open.delete(prev.tool_call_id);
+    if (open.size === 0 && (i === messages.length || messages[i].role !== "tool")) cuts.push(i);
+  }
+  return cuts;
+}
 var SUMMARY_LEAD = "Summary of the earlier conversation:\n\n";
 var SUMMARY_ACK = "Understood \u2014 continuing from that summary.";
-var SUMMARY_PROMPT = "Summarise the conversation above for your future self, which will continue the work without seeing it. Cover: what the user asked for, what was already changed (files and the reasoning), what was learned about the codebase, and what is still open. Be specific about file paths and names. No preamble.";
-async function compact(client, model, messages, opts = {}) {
-  const cut2 = cutPoint(messages, opts.keepTurns ?? 2);
-  if (cut2 <= 1) return void 0;
+function withSummary(summary, rest) {
+  const lead = { role: "user", content: `${SUMMARY_LEAD}${summary}` };
+  return rest[0]?.role === "assistant" ? [lead, ...rest] : [lead, { role: "assistant", content: SUMMARY_ACK }, ...rest];
+}
+function summaryReserve(budget) {
+  return Math.min(1e4, Math.max(1e3, Math.floor(budget / 6)));
+}
+function summaryPrompt(words) {
+  return `Summarise the conversation above for your future self, which will continue the work without seeing it. Cover: what the user asked for, what was already changed (files and the reasoning), what was learned about the codebase, and what is still open. Be specific about file paths and names. If it opens with a summary of earlier messages, carry what that summary says forward. At most ${words.toLocaleString("en-US")} words. No preamble.`;
+}
+function planCompaction(messages, contextTokens, keepTurns = 2) {
+  if (messages.length < 2) return void 0;
+  const budget = compactBudget(contextTokens);
+  const suffix = new Array(messages.length + 1).fill(0);
+  for (let i = messages.length - 1; i >= 0; i--) suffix[i] = suffix[i + 1] + messageWeight(messages[i]);
+  const total = suffix[0];
+  const tail = (from) => suffix[from];
+  const fixed = total - suffix[1] + summaryReserve(budget) + messageWeight({ role: "assistant", content: SUMMARY_ACK });
+  const preferred = cutPoint(messages, keepTurns);
+  const over = total > budget;
+  if (!over) return preferred > 1 ? { cut: preferred, fits: fixed + tail(preferred) <= budget, over } : void 0;
+  const cuts = safeCuts(messages).filter((c) => c >= Math.max(preferred, 2));
+  if (cuts.length === 0) return void 0;
+  const keep = Math.min(budget - fixed, Math.floor(budget / 2));
+  const cut2 = cuts.find((c) => tail(c) <= keep) ?? cuts.at(-1);
+  return { cut: cut2, fits: fixed + tail(cut2) <= budget, over };
+}
+function cutNote(left) {
+  return `
+\u2026 [${left.toLocaleString("en-US")} more characters left out here]`;
+}
+function capText(text, limit) {
+  return text.length > limit ? `${text.slice(0, limit)}${cutNote(text.length - limit)}` : text;
+}
+function capArguments(json, limit) {
+  const walk2 = (v) => {
+    if (typeof v === "string") return capText(v, limit);
+    if (Array.isArray(v)) return v.map(walk2);
+    if (v && typeof v === "object") return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, walk2(x)]));
+    return v;
+  };
+  try {
+    return JSON.stringify(walk2(JSON.parse(json)));
+  } catch {
+    return json.length > limit ? JSON.stringify({ arguments: capText(json, limit) }) : json;
+  }
+}
+function capMessage(message, limit) {
+  const content = typeof message.content === "string" ? capText(message.content, limit) : Array.isArray(message.content) ? message.content.map((part) => part.type === "text" ? { ...part, text: capText(part.text, limit) } : part) : message.content;
+  const out = { ...message, content };
+  if (message.tool_calls) {
+    out.tool_calls = message.tool_calls.map((c) => ({
+      ...c,
+      function: { ...c.function, arguments: capArguments(c.function.arguments, limit) }
+    }));
+  }
+  return out;
+}
+function withoutImages2(message) {
+  if (!Array.isArray(message.content)) return message;
+  return {
+    ...message,
+    content: message.content.map(
+      (part) => part.type === "image_url" ? { type: "text", text: "[an image, not shown here]" } : part
+    )
+  };
+}
+function longestText(messages) {
+  let longest = 0;
+  for (const m of messages) {
+    longest = Math.max(longest, messageText(m).length);
+    for (const c of m.tool_calls ?? []) longest = Math.max(longest, c.function.arguments.length);
+  }
+  return longest;
+}
+function shrinkToFit(messages, room) {
+  if (requestTokens(messages) <= room) return messages;
+  const plain2 = messages.map(withoutImages2);
+  if (requestTokens(plain2) <= room) return plain2;
+  const capped = (limit) => plain2.map((m) => capMessage(m, limit));
+  let lo = 0;
+  let hi = longestText(plain2);
+  while (lo < hi) {
+    const mid = Math.ceil((lo + hi) / 2);
+    if (requestTokens(capped(mid)) <= room) lo = mid;
+    else hi = mid - 1;
+  }
+  return capped(lo);
+}
+async function compact(client, model, messages, contextTokens, opts = {}) {
+  const plan = planCompaction(messages, contextTokens, opts.keepTurns ?? 2);
+  if (!plan) return void 0;
+  const { cut: cut2 } = plan;
+  const budget = compactBudget(contextTokens);
+  const system = messages[0];
+  const prompt = { role: "user", content: summaryPrompt(Math.floor(summaryReserve(budget) / 2)) };
+  const bounds = [1, ...safeCuts(messages).filter((c) => c > 1 && c < cut2), cut2];
+  const rounds = [];
+  for (let i = 0; i + 1 < bounds.length; i++) rounds.push(messages.slice(bounds[i], bounds[i + 1]));
   const before = conversationTokens(messages);
-  const turn = await client.chatStream(
-    [...messages.slice(0, cut2), { role: "user", content: SUMMARY_PROMPT }],
-    model,
-    // The `/effort` setting applies to every call on the model, a summary
-    // included: somebody who turned it down to save credits saves them here too.
-    { signal: opts.signal, effort: opts.effort }
-  );
-  const summary = messageText(turn.message).trim() || "(no summary returned)";
-  const compacted = [
-    messages[0],
-    { role: "user", content: `${SUMMARY_LEAD}${summary}` },
-    { role: "assistant", content: SUMMARY_ACK },
-    ...messages.slice(cut2)
-  ];
+  let summary;
+  let creditsCharged = 0;
+  let balance = 0;
+  let spendable;
+  let calls = 0;
+  let next = 0;
+  while (next < rounds.length) {
+    const room = Math.max(
+      1e3,
+      budget - requestTokens([system, prompt]) - (summary === void 0 ? 0 : requestTokens(withSummary(summary, [])))
+    );
+    let chunk = shrinkToFit(rounds[next++], room);
+    while (next < rounds.length) {
+      const round = rounds[next];
+      const left = room - requestTokens(chunk);
+      if (requestTokens(round) <= left) {
+        chunk = [...chunk, ...round];
+        next++;
+        continue;
+      }
+      if (requestTokens(round) > room && left >= room / 2) {
+        chunk = [...chunk, ...shrinkToFit(round, left)];
+        next++;
+      }
+      break;
+    }
+    const request = [system, ...summary === void 0 ? chunk : withSummary(summary, chunk), prompt];
+    let text = "";
+    for (let attempt = 0; attempt < 2 && !text; attempt++) {
+      const turn = await client.chatStream(request, model, { signal: opts.signal, effort: opts.effort });
+      calls++;
+      creditsCharged += turn.creditsCharged;
+      balance = turn.balance;
+      spendable = turn.spendable;
+      text = messageText(turn.message).trim();
+    }
+    if (!text) throw new Error("the model returned an empty summary, so the conversation was left as it was");
+    summary = text;
+  }
+  const tailMessages = messages.slice(cut2);
+  let final = summary ?? "";
+  const excess = requestTokens([system, ...withSummary(final, tailMessages)]) - budget;
+  if (excess > 0) {
+    const lead = { role: "user", content: final };
+    final = messageText(shrinkToFit([lead], Math.max(0, messageWeight(lead) - excess - 1))[0]);
+  }
+  const compacted = [system, ...withSummary(final, tailMessages)];
   return {
     messages: compacted,
-    summary,
-    creditsCharged: turn.creditsCharged,
-    balance: turn.balance,
-    ...turn.spendable ? { spendable: turn.spendable } : {},
+    summary: final,
+    creditsCharged,
+    balance,
+    ...spendable ? { spendable } : {},
     before,
-    after: conversationTokens(compacted)
+    after: conversationTokens(compacted),
+    calls
   };
 }
+var COMPACT_ADVICE = "The work done so far is kept. Run /compact to summarise the conversation, this task's steps included, then send a message to carry on. /clear starts over, and /model switches to a model that takes longer conversations.";
+function withCompactAdvice(refusal) {
+  const lines = refusal.split("\n");
+  if (lines.length === 3) return [lines[0], COMPACT_ADVICE, lines[2]].join("\n");
+  return [...lines, COMPACT_ADVICE].join("\n");
+}
+function compactionHelps(messages, contextTokens) {
+  const plan = planCompaction(messages, contextTokens);
+  return plan !== void 0 && plan.over && plan.fits;
+}
 
 // src/version.ts
 import { readFileSync as readFileSync6 } from "node:fs";
@@ -6687,6 +7155,7 @@ export {
   PremiumLockedError,
   LimitRefusalError,
   MaintenanceError,
+  PromptTooLongError,
   shortfallHeadline,
   AuthError,
   GatewayClient,
@@ -6771,6 +7240,8 @@ export {
   SUMMARY_LEAD,
   SUMMARY_ACK,
   compact,
+  withCompactAdvice,
+  compactionHelps,
   VERSION,
   VERSION_LABEL,
   isNewerVersion,

package/dist/clixad.mjs

@@ -54,7 +54,7 @@ import {
   takeConfigNotices,
   toolSchemaFor,
   usd
-} from "./chunk-TKGMAY4C.mjs";
+} from "./chunk-E7SAKAVQ.mjs";
 
 // src/tui/load.ts
 import * as nodeModule from "node:module";
@@ -133,7 +133,7 @@ async function withProductionReact(load) {
 }
 function loadTui() {
   boundInkCaches();
-  return withProductionReact(() => import("./tui-US36BPP3.mjs"));
+  return withProductionReact(() => import("./tui-2H2XRALC.mjs"));
 }
 
 // src/title.ts

package/dist/{tui-US36BPP3.mjs → tui-2H2XRALC.mjs}

@@ -18,6 +18,7 @@ import {
   NO_SEARCH_INSTRUCTION,
   PaywallError,
   PremiumLockedError,
+  PromptTooLongError,
   SPINNER_TICKS_PER_FRAME,
   SUMMARY_ACK,
   SUMMARY_LEAD,
@@ -35,6 +36,7 @@ import {
   colorEnabled,
   compact,
   compactBanner,
+  compactionHelps,
   contextTokensFor,
   conversationTokens,
   createPermit,
@@ -104,8 +106,9 @@ import {
   usd,
   visibleLength,
   webSearchCostLine,
-  welcomeBanner
-} from "./chunk-TKGMAY4C.mjs";
+  welcomeBanner,
+  withCompactAdvice
+} from "./chunk-E7SAKAVQ.mjs";
 
 // src/tui/index.tsx
 import "react";
@@ -486,7 +489,7 @@ var COMMANDS = [
   // enter complete the command instead of running it, and listing is what both
   // are for. `/bg kill <id>` still works when typed in full.
   { name: "bg", desc: "background commands the agent started" },
-  { name: "mcp", desc: "connected MCP servers and their tools" },
+  { name: "mcp", desc: "MCP servers and their tools (approve: start one from this project)" },
   { name: "exit", desc: "quit clixad" }
 ];
 function commandLabel(c) {
@@ -2271,17 +2274,10 @@ function App({
       }
     }).catch(() => void 0);
   }, []);
-  useEffect(() => {
-    const { servers, errors } = loadMcpConfig(root);
-    for (const problem of errors) push({ kind: "notice", tone: "warn", text: `  mcp config \u2014 ${problem}` });
-    const names = Object.keys(servers);
-    if (names.length === 0) return;
-    let cancelled = false;
-    void McpHub.connect(servers, { root }).then((hub) => {
-      if (cancelled) return void hub.close();
-      mcpRef.current = hub;
-      const ready = hub.status().filter((s) => s.state === "ready");
-      const failed2 = hub.status().filter((s) => s.state === "failed");
+  const reportMcpStarted = useCallback(
+    (started) => {
+      const ready = started.filter((s) => s.state === "ready");
+      const failed2 = started.filter((s) => s.state === "failed");
       if (ready.length) {
         push({
           kind: "notice",
@@ -2291,10 +2287,63 @@ function App({
       for (const server of failed2) {
         push({ kind: "notice", tone: "warn", text: `  mcp: ${server.name} did not start \u2014 ${server.error}` });
       }
+    },
+    [push]
+  );
+  const askMcpApproval = useCallback(
+    (hub, pending) => {
+      if (!pending.length) return;
+      const files = [...new Set(pending.map((p) => p.file))].join(" and ");
+      push({
+        kind: "notice",
+        tone: "warn",
+        text: `  ${files} in this project ${pending.length === 1 ? "wants to start an MCP server" : `wants to start ${pending.length} MCP servers`}. A server is a program that runs on this machine; nothing has been started.
+` + pending.map(
+          (p) => `    ${p.name}
+` + p.display.split("\n").map((line2) => `      ${line2}`).join("\n") + `
+      environment it gets: ${p.variables.length ? p.variables.join(", ") : "none beyond PATH, HOME and the locale"}`
+        ).join("\n")
+      });
+      const names = pending.map((p) => p.name);
+      setPickerSel(1);
+      setPicker({
+        title: pending.length === 1 ? `Start the MCP server "${names[0]}"?` : `Start these ${pending.length} MCP servers?`,
+        subtitle: "Only if you trust this project \xB7 esc: not now",
+        items: [
+          { value: "approve", label: "Yes, start", hint: "and remember it for this project until the config changes" },
+          { value: "later", label: "Not now", hint: "ask again next time \xB7 /mcp approve starts them" },
+          { value: "decline", label: "No", hint: "and don't ask again until the config changes" }
+        ],
+        onPick: (choice) => {
+          if (choice.value === "approve") {
+            push({ kind: "notice", text: `  mcp: starting ${names.join(", ")}` });
+            void hub.approve(names, { remember: true }).then(reportMcpStarted);
+          } else if (choice.value === "decline") {
+            hub.decline(names);
+            push({ kind: "notice", text: `  mcp: not starting ${names.join(", ")} \xB7 /mcp approve starts them` });
+          } else {
+            push({ kind: "notice", text: "  mcp: not started \xB7 /mcp approve starts them" });
+          }
+        },
+        onCancel: () => push({ kind: "notice", text: "  mcp: not started \xB7 /mcp approve starts them" })
+      });
+    },
+    [push, reportMcpStarted]
+  );
+  useEffect(() => {
+    const loaded = loadMcpConfig(root);
+    for (const problem of loaded.errors) push({ kind: "notice", tone: "warn", text: `  mcp config \u2014 ${problem}` });
+    if (Object.keys(loaded.servers).length === 0) return;
+    const hub = McpHub.fromConfig(loaded, { root });
+    mcpRef.current = hub;
+    let cancelled = false;
+    void hub.startReleased().then((started) => {
+      if (!cancelled) reportMcpStarted(started);
     });
+    askMcpApproval(hub, hub.pending());
     return () => {
       cancelled = true;
-      void mcpRef.current.close();
+      void hub.close();
     };
   }, []);
   useEffect(() => {
@@ -2692,10 +2741,13 @@ function App({
       try {
         const window = contextWindow(model2);
         if (shouldCompact([{ role: "system", content: contextRef.current.systemPrompt }, ...history], window)) {
-          const res = await compact(client, model2, [
-            { role: "system", content: contextRef.current.systemPrompt },
-            ...history
-          ], { signal: ac.signal, effort: savedEffort(config, model2) });
+          const res = await compact(
+            client,
+            model2,
+            [{ role: "system", content: contextRef.current.systemPrompt }, ...history],
+            window,
+            { signal: ac.signal, effort: savedEffort(config, model2) }
+          );
           if (res) {
             history = res.messages.slice(1);
             setMessages(history);
@@ -2853,6 +2905,7 @@ ${preferencesText}` : ""),
           setMessages(kept);
           persist(kept);
         }
+        const compactAdvised = err instanceof PromptTooLongError && kept !== void 0 && compactionHelps([{ role: "system", content: contextRef.current.systemPrompt }, ...kept], contextWindow(model2));
         if ((err instanceof LimitRefusalError || err instanceof PremiumLockedError) && err.spendable) {
           balanceSeqRef.current++;
           takeSpendable(err.spendable.figures, err.spendable.balance);
@@ -2909,10 +2962,12 @@ ${preferencesText}` : ""),
           push({ kind: "notice", tone: "error", text: NOT_SIGNED_IN });
         } else if (err instanceof MaintenanceError) {
           push({ kind: "notice", tone: "warn", text: `  ${errorNotice(err.message, void 0, "  ")}` });
+        } else if (compactAdvised) {
+          push({ kind: "notice", tone: "error", text: `  error: ${errorNotice(withCompactAdvice(err.message), void 0, "  ")}` });
         } else {
           push({ kind: "notice", tone: "error", text: `  error: ${errorNotice(err.message, void 0, "  ")}` });
         }
-        if (kept && !(err instanceof PaywallError) && !(err instanceof PremiumLockedError)) {
+        if (kept && !(err instanceof PaywallError) && !(err instanceof PremiumLockedError) && !compactAdvised) {
           push({ kind: "notice", text: KEPT_AFTER_ERROR });
         }
       } finally {
@@ -3353,15 +3408,17 @@ ${preferencesText}` : ""),
           push({ kind: "notice", text: `  mode \u2192 ${MODE_LABEL[permRef.current.mode]}` });
           return;
         }
-        // A model call like any other, so esc has to stop it like any other —
-        // and stopping it costs nothing, since the summary only replaces the
-        // conversation once the call has come back whole.
+        // Model calls like any other, so esc has to stop them like any other.
+        // Stopping leaves the conversation as it was, since the summary only
+        // replaces it once every call has come back whole; a summary that took
+        // several calls has been charged for the ones already finished.
         case "compact":
           await runBusy(COMPACTING, async (signal) => {
             const res = await compact(
               client,
               model,
               [{ role: "system", content: contextRef.current.systemPrompt }, ...messagesRef.current],
+              contextWindow(model),
               { signal, effort: savedEffort(config, model) }
             );
             if (!res) return void push({ kind: "notice", text: "  nothing to compact yet" });
@@ -3644,7 +3701,27 @@ ${preferencesText}` : ""),
           return;
         }
         case "mcp": {
-          const status = mcpRef.current.status();
+          const hub = mcpRef.current;
+          const [verb, ...targets] = arg.split(/\s+/).filter(Boolean);
+          if (verb === "approve") {
+            const held = hub.pending({ includeDeclined: true });
+            if (!held.length) {
+              push({ kind: "notice", text: "  no MCP servers waiting for approval" });
+              return;
+            }
+            if (!targets.length || targets.includes("all")) return askMcpApproval(hub, held);
+            const unknown = targets.filter((t) => !held.some((h) => h.name === t));
+            if (unknown.length) {
+              push({
+                kind: "notice",
+                tone: "warn",
+                text: `  not waiting for approval: ${unknown.join(", ")} \xB7 waiting: ${held.map((h) => h.name).join(", ")}`
+              });
+              return;
+            }
+            return askMcpApproval(hub, held.filter((h) => targets.includes(h.name)));
+          }
+          const status = hub.status();
           if (!status.length) {
             push({
               kind: "notice",
@@ -3652,14 +3729,16 @@ ${preferencesText}` : ""),
             });
             return;
           }
+          const label = { unapproved: "not approved", declined: "declined" };
+          const anyHeld = status.some((s) => s.state === "unapproved" || s.state === "declined");
           push({
             kind: "notice",
             text: status.map((s) => {
-              const head = `  ${s.name.padEnd(16)} ${s.state.padEnd(10)} ${s.transport}`;
+              const head = `  ${s.name.padEnd(16)} ${(label[s.state] ?? s.state).padEnd(12)} ${s.transport}`;
               if (s.state === "ready") return `${head}  ${s.toolCount} tool${s.toolCount === 1 ? "" : "s"}`;
               return s.error ? `${head}
     ${s.error.split("\n").join("\n    ")}` : head;
-            }).join("\n")
+            }).join("\n") + (anyHeld ? "\n  /mcp approve shows what a server runs and starts it" : "")
           });
           return;
         }
@@ -3702,7 +3781,7 @@ ${preferencesText}` : ""),
           push({ kind: "notice", tone: "warn", text: `  unknown command: /${cmd} \u2014 try /help` });
       }
     },
-    [client, cols, config, cycleMode, exit, model, modelTaskHints, premium, push, replayConversation, root, runAdWall, runBusy, runBuy, runLogin, runTurn, setPremium, writeToStdout]
+    [askMcpApproval, client, cols, config, cycleMode, exit, model, modelTaskHints, premium, push, replayConversation, root, runAdWall, runBusy, runBuy, runLogin, runTurn, setPremium, writeToStdout]
   );
   const runShell = useCallback(
     async (command2) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clixad",
-  "version": "0.0.1-beta.47",
+  "version": "0.0.1-beta.49",
   "description": "Free AI coding agent in your terminal, funded by rewarded ads.",
   "license": "Apache-2.0",
   "type": "module",