codeep 2.14.0 → 2.16.0

package/dist/utils/git.js

@@ -1,4 +1,4 @@
-import { execSync, spawnSync } from 'child_process';
+import { execSync, execFileSync, spawnSync } from 'child_process';
 import { existsSync } from 'fs';
 import { join } from 'path';
 /**
@@ -397,3 +397,113 @@ export function createBranchAndCommit(prompt, actions, cwd = process.cwd()) {
         hash: commitResult.hash,
     };
 }
+/** Max bytes we'll inline from a single `@git` mention. */
+export const MAX_GIT_BYTES = 64 * 1024;
+/**
+ * Characters a git ref/pathspec may contain for `@git` mentions. Deliberately
+ * conservative: word chars plus the punctuation real refs use
+ * (`main..feature`, `HEAD~3`, `v1.2.0^{}`, `main:src/x.ts`, `origin/main`).
+ * A leading `-` is rejected separately so a ref can never be read as a flag.
+ */
+const SAFE_GIT_REF = /^[A-Za-z0-9._/:~^@{}-]+$/;
+export function isSafeGitRef(token) {
+    return token.length > 0 && !token.startsWith('-') && SAFE_GIT_REF.test(token);
+}
+/**
+ * The only flags `@git diff …` may pass through. An allowlist rather than a
+ * deny-list because several git flags write files or run commands
+ * (`--output=`, `--ext-diff`), which would turn a mention into a side effect.
+ */
+const GIT_DIFF_FLAG_ALLOWLIST = new Set([
+    '--staged', '--cached', '--stat', '--numstat', '--shortstat',
+    '--name-only', '--name-status', '--patch', '-p', '--no-color',
+]);
+/**
+ * Resolve a `@git <ref>` mention to inline content. The `ref` can be:
+ *
+ * - `diff`           — unstaged changes (`git diff`)
+ * - `diff --staged`  — staged changes (`git diff --cached`)
+ * - `diff a..b`      — diff between two refs (`git diff a..b`)
+ * - `HEAD`           — the latest commit's full diff vs its parent
+ * - `<sha>`          — a specific commit's patch (`git show <sha>`)
+ * - `<ref>:<path>`   — a file at a ref (`git show main:src/x.ts`)
+ * - `<ref>`          — any other git ref → `git show`
+ *
+ * Sync (spawn-based) so it slots into the mention-expansion pipeline.
+ */
+export function getGitContent(ref, cwd = process.cwd()) {
+    if (!isGitRepository(cwd)) {
+        return { success: false, content: '', label: ref, error: 'not a git repository' };
+    }
+    const trimmed = ref.trim();
+    if (!trimmed) {
+        return { success: false, content: '', label: ref, error: 'empty git ref' };
+    }
+    // Pick the git subcommand based on the ref shape. NOTE: the ref comes from
+    // free-form prompt text (`@git <ref>`), which may be pasted from an issue,
+    // a log, or model output — so it is UNTRUSTED. We therefore (a) build an
+    // argv array and spawn git directly with `execFileSync` (no `/bin/sh`, so
+    // `;`, `|`, backticks and friends are inert), and (b) validate every token,
+    // because argv alone doesn't stop *argument* injection — a ref that starts
+    // with `-` would still be read by git as a flag (e.g. `--output=…` writes a
+    // file). Anything unrecognized is rejected rather than guessed at.
+    let args;
+    let label;
+    if (trimmed === 'diff') {
+        args = ['diff'];
+        label = 'diff (unstaged)';
+    }
+    else if (trimmed === 'diff --staged' || trimmed === 'diff --cached' || trimmed === 'staged') {
+        args = ['diff', '--cached'];
+        label = 'diff (staged)';
+    }
+    else if (trimmed.startsWith('diff ')) {
+        // e.g. `diff main..feature` or `diff HEAD~3` or `diff --stat`
+        const rest = trimmed.slice('diff '.length).trim();
+        const tokens = rest.split(/\s+/).filter(Boolean);
+        const bad = tokens.find(t => !(isSafeGitRef(t) || GIT_DIFF_FLAG_ALLOWLIST.has(t)));
+        if (bad) {
+            return { success: false, content: '', label: ref, error: `unsupported git argument: ${bad}` };
+        }
+        args = ['diff', ...tokens];
+        label = `diff (${rest})`;
+    }
+    else if (trimmed === 'HEAD' || trimmed === '@') {
+        // Show the latest commit's patch.
+        args = ['show', 'HEAD'];
+        label = 'HEAD';
+    }
+    else {
+        // Any other ref → `git show`. Works for SHAs, tags, branches, and
+        // `<ref>:<path>` (file-at-ref) forms.
+        if (!isSafeGitRef(trimmed)) {
+            return { success: false, content: '', label: ref, error: `unsupported git ref: ${trimmed}` };
+        }
+        args = ['show', trimmed];
+        label = trimmed;
+    }
+    try {
+        const out = execFileSync('git', args, {
+            cwd,
+            encoding: 'utf-8',
+            maxBuffer: 4 * 1024 * 1024,
+        });
+        const content = (out ?? '').trimEnd();
+        if (!content) {
+            return { success: false, content: '', label, error: 'empty result (no changes / unknown ref)' };
+        }
+        // Truncate to the cap so a massive diff can't blow the context.
+        const capped = content.length > MAX_GIT_BYTES
+            ? content.slice(0, MAX_GIT_BYTES) + `\n\n… (truncated at ${MAX_GIT_BYTES / 1024}KB)`
+            : content;
+        return { success: true, content: capped, label };
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        // git show exits non-zero on unknown refs; surface a friendly reason.
+        const reason = /unknown revision|bad revision|ambiguous argument/i.test(msg)
+            ? `unknown git ref: ${trimmed}`
+            : msg;
+        return { success: false, content: '', label, error: reason };
+    }
+}

package/dist/utils/hooks.d.ts

@@ -44,6 +44,11 @@
  * machine the first time they trigger an agent tool call. The welcome
  * banner warns when hooks exist (see `summarizeHooks`); we do not run
  * hooks from `~/.codeep/hooks/` (global) for that reason.
+ *
+ * Platform note: hooks are POSIX shell (`.sh`) scripts. On macOS/Linux they
+ * run directly; on Windows they run through Git Bash's `sh` if installed.
+ * Windows without a POSIX shell → hooks are reported `unsupported` and skipped
+ * (never blocking). See `resolveShellMode` and the README "Windows notes".
  */
 export declare function isHooksTrusted(workspaceRoot: string): boolean;
 export declare function trustWorkspaceHooks(workspaceRoot: string): void;
@@ -75,7 +80,28 @@ export interface HookResult {
     /** True when a hook script exists but the workspace isn't trusted, so it was
      *  skipped (not run). Lets callers surface "run /hooks trust to enable". */
     untrusted?: boolean;
+    /** True when a hook script exists but this OS can't run it — Codeep hooks are
+     *  POSIX shell (`.sh`) scripts and no `sh` was found (e.g. Windows without
+     *  Git Bash). A non-blocking skip; surfaced by `/hooks` + the welcome banner. */
+    unsupported?: boolean;
 }
+/**
+ * Decide how a `.sh` hook runs on this platform. On POSIX it's executed
+ * directly (shebang); on Windows it needs a `sh`/`bash` interpreter, and if
+ * none is installed hooks are `unsupported` (skipped, never blocking). Pure +
+ * injectable so the platform matrix is unit-testable.
+ */
+export declare function resolveShellMode(platform?: NodeJS.Platform, findShell?: () => string | null): {
+    mode: 'direct';
+} | {
+    mode: 'shell';
+    shell: string;
+} | {
+    mode: 'unsupported';
+};
+/** True when this OS can actually run `.sh` hooks. Drives the `/hooks` and
+ *  welcome-banner "unsupported" state. */
+export declare function hooksExecutable(platform?: NodeJS.Platform, findShell?: () => string | null): boolean;
 /**
  * Execute the configured hook for an event, if any. Returns `executed: false`
  * if no script exists. Caller is responsible for checking `blocked` and

package/dist/utils/hooks.js

@@ -44,6 +44,11 @@
  * machine the first time they trigger an agent tool call. The welcome
  * banner warns when hooks exist (see `summarizeHooks`); we do not run
  * hooks from `~/.codeep/hooks/` (global) for that reason.
+ *
+ * Platform note: hooks are POSIX shell (`.sh`) scripts. On macOS/Linux they
+ * run directly; on Windows they run through Git Bash's `sh` if installed.
+ * Windows without a POSIX shell → hooks are reported `unsupported` and skipped
+ * (never blocking). See `resolveShellMode` and the README "Windows notes".
  */
 import { existsSync, readdirSync, statSync, accessSync, constants } from 'fs';
 import { join } from 'path';
@@ -80,6 +85,45 @@ const NOT_EXECUTED = { executed: false, exitCode: 0, stdout: '', stderr: '', blo
 function getHooksDir(workspaceRoot) {
     return join(workspaceRoot, '.codeep', 'hooks');
 }
+/**
+ * Locate a POSIX shell able to run `.sh` hooks on Windows. `.sh` scripts can't
+ * be `spawn`ed directly there (no shebang support), so we invoke them through
+ * `sh`/`bash`. Scans PATH plus the default Git-for-Windows install locations.
+ * Returns the shell's path, or null if none is installed.
+ */
+function findWindowsPosixShell() {
+    const candidates = [];
+    for (const dir of (process.env.PATH ?? '').split(';')) {
+        if (dir)
+            candidates.push(join(dir, 'sh.exe'), join(dir, 'bash.exe'));
+    }
+    candidates.push('C:\\Program Files\\Git\\bin\\sh.exe', 'C:\\Program Files\\Git\\usr\\bin\\sh.exe', 'C:\\Program Files (x86)\\Git\\bin\\sh.exe');
+    for (const c of candidates) {
+        try {
+            if (statSync(c).isFile())
+                return c;
+        }
+        catch { /* next candidate */ }
+    }
+    return null;
+}
+/**
+ * Decide how a `.sh` hook runs on this platform. On POSIX it's executed
+ * directly (shebang); on Windows it needs a `sh`/`bash` interpreter, and if
+ * none is installed hooks are `unsupported` (skipped, never blocking). Pure +
+ * injectable so the platform matrix is unit-testable.
+ */
+export function resolveShellMode(platform = process.platform, findShell = findWindowsPosixShell) {
+    if (platform !== 'win32')
+        return { mode: 'direct' };
+    const shell = findShell();
+    return shell ? { mode: 'shell', shell } : { mode: 'unsupported' };
+}
+/** True when this OS can actually run `.sh` hooks. Drives the `/hooks` and
+ *  welcome-banner "unsupported" state. */
+export function hooksExecutable(platform = process.platform, findShell = findWindowsPosixShell) {
+    return resolveShellMode(platform, findShell).mode !== 'unsupported';
+}
 function findHookScript(workspaceRoot, event) {
     const dir = getHooksDir(workspaceRoot);
     if (!existsSync(dir))
@@ -120,6 +164,14 @@ export function runHook(ctx, opts = {}) {
     if (!isHooksTrusted(ctx.workspaceRoot)) {
         return { executed: false, exitCode: 0, stdout: '', stderr: '', blocked: false, untrusted: true, scriptPath: script };
     }
+    // Platform gate: a `.sh` hook needs a POSIX shell. On Windows without one we
+    // must NOT spawn the script directly — that fails, and for a blocking event
+    // (pre_tool_call / pre_commit) a spawn error would wedge every tool call.
+    // Skip cleanly instead and let `/hooks` explain why.
+    const shellMode = resolveShellMode();
+    if (shellMode.mode === 'unsupported') {
+        return { executed: false, exitCode: 0, stdout: '', stderr: '', blocked: false, unsupported: true, scriptPath: script };
+    }
     const env = {
         ...process.env,
         CODEEP_HOOK_EVENT: ctx.event,
@@ -146,9 +198,12 @@ export function runHook(ctx, opts = {}) {
     // 30s ceiling so a runaway lint / test command can't wedge the agent
     // loop. Configurable per-call so tests can use a tight timeout.
     const timeout = opts.timeoutMs ?? 30_000;
+    // POSIX: run the script directly (shebang). Windows-with-shell: invoke it
+    // through the located `sh`/`bash` so the shebang isn't required.
+    const [cmd, cmdArgs] = shellMode.mode === 'shell' ? [shellMode.shell, [script]] : [script, []];
     let proc;
     try {
-        proc = spawnSync(script, [], {
+        proc = spawnSync(cmd, cmdArgs, {
             cwd: ctx.workspaceRoot,
             env,
             timeout,
@@ -250,6 +305,16 @@ export function formatHookTrust(workspaceRoot) {
     const hooks = listInstalledHooks(workspaceRoot);
     if (hooks.length === 0)
         return '';
+    if (!hooksExecutable()) {
+        return [
+            '⚠️ These hooks **cannot run on this system.** Codeep hooks are POSIX shell',
+            '(`.sh`) scripts, and no `sh` was found — on Windows this means Git Bash',
+            "isn't installed or isn't on your PATH.",
+            '',
+            'Install [Git for Windows](https://git-scm.com/download/win) (it provides',
+            '`sh.exe`) or add a POSIX shell to PATH. See the “Windows notes” in the README.',
+        ].join('\n');
+    }
     if (isHooksTrusted(workspaceRoot)) {
         return '✓ This workspace is **trusted** — its hooks will run. Use `/hooks untrust` to revoke.';
     }
@@ -267,6 +332,9 @@ export function summarizeHooks(workspaceRoot) {
     if (hooks.length === 0)
         return '';
     const list = hooks.map(h => h.event).join(', ');
+    if (!hooksExecutable()) {
+        return `${hooks.length} hook${hooks.length === 1 ? '' : 's'} present but this system has no POSIX shell — they won't run (see README “Windows notes”) (${list})`;
+    }
     if (!isHooksTrusted(workspaceRoot)) {
         return `${hooks.length} hook${hooks.length === 1 ? '' : 's'} present but NOT trusted — run /hooks trust to enable (${list})`;
     }

package/dist/utils/keychain.js

@@ -1,22 +1,17 @@
 import { logger } from './logger.js';
-// keytar is a native addon — load it LAZILY (on first use), never at module
-// top level. A top-level `await import()` here gives the module a top-level
-// await, which makes `bun build --compile` reject any CommonJS require() that
-// transitively depends on this file (renderer/main.js → codeepCloud → config →
-// keychain). Lazy loading keeps the module side-effect-free at import time.
-let _keytar = null;
-let _keytarTried = false;
-async function loadKeytar() {
-    if (!_keytarTried) {
-        _keytarTried = true;
+let _keyring = null;
+let _keyringTried = false;
+async function loadKeyring() {
+    if (!_keyringTried) {
+        _keyringTried = true;
         try {
-            _keytar = (await import('keytar')).default;
+            _keyring = (await import('@napi-rs/keyring'));
         }
         catch {
-            _keytar = null; /* native addon unavailable */
+            _keyring = null; /* native binary unavailable (headless / minimal install) */
         }
     }
-    return _keytar;
+    return _keyring;
 }
 const SERVICE_NAME = 'codeep';
 class KeychainStorage {
@@ -25,11 +20,12 @@ class KeychainStorage {
     }
     async getApiKey(providerId) {
         try {
-            const kt = await loadKeytar();
-            if (!kt)
+            const kr = await loadKeyring();
+            if (!kr)
                 return null;
             const account = this.getAccountName(providerId);
-            return await kt.getPassword(SERVICE_NAME, account);
+            const entry = new kr.AsyncEntry(SERVICE_NAME, account);
+            return await entry.getPassword();
         }
         catch (error) {
             logger.debug(`Failed to get API key from keychain: ${error}`);
@@ -38,11 +34,12 @@ class KeychainStorage {
     }
     async setApiKey(providerId, apiKey) {
         try {
-            const kt = await loadKeytar();
-            if (!kt)
-                throw new Error('keytar unavailable');
+            const kr = await loadKeyring();
+            if (!kr)
+                throw new Error('keyring unavailable');
             const account = this.getAccountName(providerId);
-            await kt.setPassword(SERVICE_NAME, account, apiKey);
+            const entry = new kr.AsyncEntry(SERVICE_NAME, account);
+            await entry.setPassword(apiKey);
         }
         catch (error) {
             throw new Error(`Failed to store API key in keychain: ${error}`);
@@ -50,11 +47,12 @@ class KeychainStorage {
     }
     async deleteApiKey(providerId) {
         try {
-            const kt = await loadKeytar();
-            if (!kt)
+            const kr = await loadKeyring();
+            if (!kr)
                 return;
             const account = this.getAccountName(providerId);
-            await kt.deletePassword(SERVICE_NAME, account);
+            const entry = new kr.AsyncEntry(SERVICE_NAME, account);
+            await entry.deletePassword();
         }
         catch (error) {
             logger.debug(`Failed to delete API key from keychain: ${error}`);
@@ -99,22 +97,26 @@ class FallbackStorage {
 class SmartStorage {
     keychain;
     fallback;
+    config;
     useKeychain = true;
     keychainTested = false;
+    warnedLegacyKeytar = false;
     constructor(config) {
         this.keychain = new KeychainStorage();
         this.fallback = new FallbackStorage(config);
+        this.config = config;
     }
     async ensureKeychainTested() {
         if (this.keychainTested)
             return;
         try {
             const testKey = '__codeep_test__';
-            const kt = await loadKeytar();
-            if (!kt)
-                throw new Error('keytar unavailable');
-            await kt.setPassword(SERVICE_NAME, testKey, 'test');
-            await kt.deletePassword(SERVICE_NAME, testKey);
+            const kr = await loadKeyring();
+            if (!kr)
+                throw new Error('keyring unavailable');
+            const entry = new kr.AsyncEntry(SERVICE_NAME, testKey);
+            await entry.setPassword('test');
+            await entry.deletePassword();
             this.useKeychain = true;
         }
         catch {
@@ -135,7 +137,21 @@ class SmartStorage {
             if (key)
                 return key;
         }
-        return this.fallback.getApiKey(providerId);
+        const fromFallback = await this.fallback.getApiKey(providerId);
+        // Migration note (Linux/Windows only): keys stored by the old keytar
+        // addon live under a different credential-store naming than keyring-rs
+        // uses, so they're invisible here — and the plaintext copies were
+        // already purged by the keysSecured migration. Nothing to silently
+        // recover; tell the user once so a missing key isn't a mystery.
+        // (macOS is unaffected — both libraries share the same Keychain items.)
+        if (fromFallback === null && !this.warnedLegacyKeytar
+            && process.platform !== 'darwin' && this.useKeychain
+            && this.config?.get?.('keysSecured') === true) {
+            this.warnedLegacyKeytar = true;
+            logger.warn('API keys saved by Codeep ≤ 2.14 (keytar) can\'t be read by the new keychain backend on this OS. ' +
+                'Re-add the affected key with /login <provider> <key> — it will be stored under the new backend.');
+        }
+        return fromFallback;
     }
     async setApiKey(providerId, apiKey) {
         await this.ensureKeychainTested();

package/dist/utils/logger.d.ts

@@ -2,6 +2,17 @@
  * Set current project path for local logging
  */
 export declare function setLogProjectPath(projectPath: string | null): void;
+type LogLevel = 'info' | 'warn' | 'error' | 'debug';
+export interface LogEntry {
+    timestamp: string;
+    level: LogLevel;
+    message: string;
+    data?: any;
+}
+/**
+ * Format log entry as string
+ */
+export declare function formatLogEntry(entry: LogEntry): string;
 /**
  * Logger API
  */
@@ -31,3 +42,4 @@ export declare function logStartup(version: string): void;
  * Log application error
  */
 export declare function logAppError(error: Error, context?: string): void;
+export {};

package/dist/utils/logger.js

@@ -49,7 +49,7 @@ function getLogFilePaths() {
 /**
  * Format log entry as string
  */
-function formatLogEntry(entry) {
+export function formatLogEntry(entry) {
     const dataStr = entry.data ? ` ${JSON.stringify(entry.data)}` : '';
     return `[${entry.timestamp}] [${entry.level.toUpperCase()}] ${entry.message}${dataStr}\n`;
 }

package/dist/utils/mcpConfig.d.ts

@@ -34,8 +34,34 @@ export interface McpConfigFile {
  * Load MCP server definitions for a workspace. Project entries shadow
  * global entries with the same server name. Workspace-less calls
  * (TUI without project) return only the global config.
+ *
+ * Sources read (highest precedence first on name collisions):
+ *   1. <workspace>/.codeep/mcp_servers.json  (Codeep-native project file)
+ *   2. <workspace>/.mcp.json                 (cross-tool standard — same
+ *      shape Claude Code/Cursor/Kilo Code read, so users can keep one MCP
+ *      config for their whole fleet)
+ *   3. ~/.codeep/mcp_servers.json            (global — user's machine)
  */
 export declare function loadMcpServerConfig(workspaceRoot?: string): McpServer[];
+/**
+ * Same sources as `loadMcpServerConfig`, but split by trust domain:
+ * `global` (~/.codeep — the user's own machine-wide file) vs `workspace`
+ * (files that arrive WITH a repo: `.codeep/mcp_servers.json` + `.mcp.json`).
+ *
+ * Workspace entries are attacker-controllable — anyone who clones a repo
+ * containing one of these files would otherwise spawn arbitrary commands
+ * at startup — so callers must gate them behind `isWorkspaceMcpTrusted`
+ * before spawning (mirrors the `trustedHookProjects` gate for hooks).
+ * On name collisions a workspace entry shadows a global one, matching
+ * the merged loader's precedence.
+ */
+export declare function loadMcpServerConfigSplit(workspaceRoot?: string): {
+    global: McpServer[];
+    workspace: McpServer[];
+};
+export declare function isWorkspaceMcpTrusted(workspaceRoot: string): boolean;
+export declare function trustWorkspaceMcp(workspaceRoot: string): void;
+export declare function untrustWorkspaceMcp(workspaceRoot: string): void;
 /**
  * Merge two server lists: ACP-provided + on-disk. ACP wins on collisions
  * — the client knows its own config, so a Zed-passed server overrides a

package/dist/utils/mcpConfig.js

@@ -28,8 +28,50 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
 import { join, dirname } from 'path';
 import { homedir } from 'os';
+import { config } from '../config/index.js';
 const PROJECT_CONFIG_PATH = '.codeep/mcp_servers.json';
+const PROJECT_DOTMCP_PATH = '.mcp.json';
 const GLOBAL_CONFIG_PATH = '.codeep/mcp_servers.json';
+/**
+ * Expand `${VAR}` / `${VAR:-default}` references from the process env —
+ * the same substitution Claude Code applies to `.mcp.json`, so a shared
+ * config with `"env": {"GITHUB_TOKEN": "${GITHUB_TOKEN}"}` works verbatim.
+ *
+ * Unset vars WITHOUT a default keep the literal `${VAR}` text: silently
+ * substituting '' would hide the misconfiguration, and the literal at
+ * least shows up as-is in error messages / `/mcp` output. (Previously the
+ * literal also SHADOWED a real env var of the same name at spawn time —
+ * expansion when the var IS set fixes that.)
+ */
+function expandEnvRefs(value) {
+    return value.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g, (match, name, def) => {
+        const fromEnv = process.env[name];
+        if (fromEnv !== undefined)
+            return fromEnv;
+        if (def !== undefined)
+            return def;
+        return match;
+    });
+}
+function expandRecord(rec) {
+    if (!rec)
+        return undefined;
+    const out = {};
+    for (const [k, v] of Object.entries(rec))
+        out[k] = typeof v === 'string' ? expandEnvRefs(v) : v;
+    return out;
+}
+/** Apply ${VAR} expansion to every string field of a server entry. */
+function expandServer(s) {
+    return {
+        ...s,
+        command: typeof s.command === 'string' ? expandEnvRefs(s.command) : s.command,
+        args: Array.isArray(s.args) ? s.args.map(a => expandEnvRefs(a)) : s.args,
+        env: expandRecord(s.env),
+        url: typeof s.url === 'string' ? expandEnvRefs(s.url) : s.url,
+        headers: expandRecord(s.headers),
+    };
+}
 function parseEntries(raw, source) {
     let parsed;
     try {
@@ -46,7 +88,9 @@ function parseEntries(raw, source) {
         return [];
     if (Array.isArray(servers)) {
         // Defensively filter — any entry needs name + either command or url.
-        return servers.filter(s => s && typeof s.name === 'string' && (typeof s.command === 'string' || typeof s.url === 'string'));
+        return servers
+            .filter(s => s && typeof s.name === 'string' && (typeof s.command === 'string' || typeof s.url === 'string'))
+            .map(expandServer);
     }
     return Object.entries(servers).flatMap(([name, cfg]) => {
         if (!cfg)
@@ -56,7 +100,7 @@ function parseEntries(raw, source) {
         const hasHttp = typeof cfg.url === 'string';
         if (!hasStdio && !hasHttp)
             return [];
-        return [{
+        return [expandServer({
                 name,
                 command: hasStdio ? cfg.command : undefined,
                 args: Array.isArray(cfg.args) ? cfg.args.filter(a => typeof a === 'string') : [],
@@ -65,7 +109,7 @@ function parseEntries(raw, source) {
                 headers: cfg.headers && typeof cfg.headers === 'object'
                     ? cfg.headers
                     : undefined,
-            }];
+            })];
     });
 }
 function loadFromFile(path) {
@@ -83,20 +127,81 @@ function loadFromFile(path) {
  * Load MCP server definitions for a workspace. Project entries shadow
  * global entries with the same server name. Workspace-less calls
  * (TUI without project) return only the global config.
+ *
+ * Sources read (highest precedence first on name collisions):
+ *   1. <workspace>/.codeep/mcp_servers.json  (Codeep-native project file)
+ *   2. <workspace>/.mcp.json                 (cross-tool standard — same
+ *      shape Claude Code/Cursor/Kilo Code read, so users can keep one MCP
+ *      config for their whole fleet)
+ *   3. ~/.codeep/mcp_servers.json            (global — user's machine)
  */
 export function loadMcpServerConfig(workspaceRoot) {
     const globalServers = loadFromFile(join(homedir(), GLOBAL_CONFIG_PATH));
     const projectServers = workspaceRoot
         ? loadFromFile(join(workspaceRoot, PROJECT_CONFIG_PATH))
         : [];
-    // Project wins on name collisions.
+    const dotMcpServers = workspaceRoot
+        ? loadFromFile(join(workspaceRoot, PROJECT_DOTMCP_PATH))
+        : [];
+    // Higher-precedence sources win on name collisions: project (Codeep-native)
+    // beats .mcp.json beats global.
     const byName = new Map();
     for (const s of globalServers)
         byName.set(s.name, s);
+    for (const s of dotMcpServers)
+        byName.set(s.name, s);
     for (const s of projectServers)
         byName.set(s.name, s);
     return [...byName.values()];
 }
+/**
+ * Same sources as `loadMcpServerConfig`, but split by trust domain:
+ * `global` (~/.codeep — the user's own machine-wide file) vs `workspace`
+ * (files that arrive WITH a repo: `.codeep/mcp_servers.json` + `.mcp.json`).
+ *
+ * Workspace entries are attacker-controllable — anyone who clones a repo
+ * containing one of these files would otherwise spawn arbitrary commands
+ * at startup — so callers must gate them behind `isWorkspaceMcpTrusted`
+ * before spawning (mirrors the `trustedHookProjects` gate for hooks).
+ * On name collisions a workspace entry shadows a global one, matching
+ * the merged loader's precedence.
+ */
+export function loadMcpServerConfigSplit(workspaceRoot) {
+    const globalServers = loadFromFile(join(homedir(), GLOBAL_CONFIG_PATH));
+    if (!workspaceRoot)
+        return { global: globalServers, workspace: [] };
+    const projectServers = loadFromFile(join(workspaceRoot, PROJECT_CONFIG_PATH));
+    const dotMcpServers = loadFromFile(join(workspaceRoot, PROJECT_DOTMCP_PATH));
+    const byName = new Map();
+    for (const s of dotMcpServers)
+        byName.set(s.name, s);
+    for (const s of projectServers)
+        byName.set(s.name, s);
+    const workspace = [...byName.values()];
+    const workspaceNames = new Set(workspace.map(s => s.name));
+    return {
+        global: globalServers.filter(s => !workspaceNames.has(s.name)),
+        workspace,
+    };
+}
+// ── Workspace MCP trust ────────────────────────────────────────────────────────
+// Workspace-sourced MCP servers spawn child processes with repo-author-chosen
+// command/args/env, so they need a one-time per-workspace approval — the same
+// model as `trustedHookProjects` for hooks. Global (~/.codeep) servers are the
+// user's own config and never need approval.
+export function isWorkspaceMcpTrusted(workspaceRoot) {
+    const cur = config.get('trustedMcpProjects') ?? [];
+    return cur.includes(workspaceRoot);
+}
+export function trustWorkspaceMcp(workspaceRoot) {
+    const cur = config.get('trustedMcpProjects') ?? [];
+    if (!cur.includes(workspaceRoot))
+        config.set('trustedMcpProjects', [...cur, workspaceRoot]);
+}
+export function untrustWorkspaceMcp(workspaceRoot) {
+    const cur = config.get('trustedMcpProjects') ?? [];
+    config.set('trustedMcpProjects', cur.filter((p) => p !== workspaceRoot));
+}
 /**
  * Merge two server lists: ACP-provided + on-disk. ACP wins on collisions
  * — the client knows its own config, so a Zed-passed server overrides a