mixdog 1.1.1 → 1.2.0

package/src/lib/rules-builder.cjs

@@ -9,7 +9,6 @@
  *   - buildAgentRoleContent             — BP3: agent role/system rules
  *   - buildAgentRetrievalInjectionContent — BP3: narrow read-only retrieval role
  *   - buildLeadMetaContent              — BP2: Lead profile/settings context
- *   - buildInjectionContent             — legacy joined Lead session content
  *
  * 4-BP cache layout (composeSystemPrompt):
  *   BP1 = shared tool policy
@@ -400,27 +399,6 @@ function buildLeadLanguageContent({ DATA_DIR }) {
   return buildLanguageSection(DATA_DIR);
 }
 
-/**
- * Build the Lead injection content.
- */
-function buildInjectionContent({ PLUGIN_ROOT, DATA_DIR }) {
-  const parts = [];
-
-  const tool = buildSharedToolContent({ PLUGIN_ROOT });
-  if (tool) parts.push(tool);
-
-  const meta = buildLeadMetaContent({ PLUGIN_ROOT, DATA_DIR });
-  if (meta) parts.push(meta);
-
-  const role = buildLeadRoleContent({ PLUGIN_ROOT, DATA_DIR });
-  if (role) parts.push(role);
-
-  const language = buildLeadLanguageContent({ DATA_DIR });
-  if (language) parts.push(language);
-
-  return parts.join('\n\n');
-}
-
 function buildAgentRoleContent({ PLUGIN_ROOT, profile = 'full' }) {
   const AGENT_DIR = path.join(PLUGIN_ROOT, 'rules', 'agent');
   if (String(profile || 'full') === 'retrieval') {
@@ -455,7 +433,6 @@ module.exports = {
   buildLeadMetaContent,
   buildLeadLanguageContent,
   buildAgentRoleContent,
-  buildInjectionContent,
   buildAgentRetrievalInjectionContent,
   omitToolRoutes,
 };

package/src/rules/lead/LEAD.md

@@ -10,8 +10,8 @@
   never per-call narration or plan repeats.
 - Mid-task: a replacement supersedes, an addition folds in, a status question
   gets a brief answer while work continues.
-- Context is managed automatically: never propose stopping or stop on your own
-  judgment.
+- Context is managed automatically: never stop or propose stopping because of
+  context size.
 - Be a grounded, candid, and attentive collaborator: natural and respectful,
   without flattery, forced humor, mimicry, or stereotyping.
 <!-- tools: agent -->

package/src/rules/shared/70-delivery.md

@@ -8,8 +8,8 @@
   `src/app.ts:42`); files outside the Project always by absolute path; never a
   bare name, a path relative to another folder, or a `file://` URI.
 - Deliver requested visual artifacts (SVG, diagrams, HTML pages) as saved files
-  and give their path; never paste their source as the answer unless the user
-  asks for the code.
+  and give their path, which opens them in the browser panel; never open them
+  in the system browser or paste their source unless the user asks.
 
 <!-- tools: git -->
 - A commit request includes selecting and staging its changes; a stage-only

package/src/runtime/agent/orchestrator/agent-runtime/agent-dispatch/preset.mjs

@@ -35,6 +35,7 @@ function maintenanceRouteToPreset(routeOrName, agent) {
   const effort = String(routeOrName.effort || '').trim();
   if (effort) out.effort = effort;
   if (routeOrName.fast === true) out.fast = true;
+  if (routeOrName.autoEffort === false) out.autoEffort = false;
   if (routeOrName.modelParameters && typeof routeOrName.modelParameters === 'object') {
     out.modelParameters = { ...routeOrName.modelParameters };
   }

package/src/runtime/agent/orchestrator/agent-runtime/maintenance-route.mjs

@@ -12,6 +12,7 @@ function normalizeMaintenanceCandidate(candidate) {
     model,
     effort: String(candidate.effort || '').trim() || undefined,
     fast: candidate.fast === true,
+    ...(candidate.autoEffort === false ? { autoEffort: false } : {}),
   };
 }
 

package/src/runtime/agent/orchestrator/agent-runtime/session-builder.mjs

@@ -77,6 +77,7 @@ export function prepareAgentSession({
   sessionId,
   mcpScopeId,
   contextPercent,
+  contextTokens,
   selectedContextWindow,
 }) {
   const effectivePermission = resolveAgentSessionPermission(agent, permission);
@@ -115,6 +116,7 @@ export function prepareAgentSession({
     mcpScopeId: mcpScopeId || null,
   };
   if (contextPercent) sessionOpts.contextPercent = contextPercent;
+  if (contextTokens) sessionOpts.contextTokens = contextTokens;
   if (selectedContextWindow) sessionOpts.selectedContextWindow = selectedContextWindow;
   if (agentTag) sessionOpts.agentTag = agentTag;
   if (effectivePermission) sessionOpts.permission = effectivePermission;

package/src/runtime/agent/orchestrator/config-presets.mjs

@@ -141,6 +141,8 @@ export function normalizePreset(preset) {
   const out = { id, name, type: 'agent', provider, model };
   if (preset.effort) out.effort = String(preset.effort).trim();
   if (preset.fast === true && FAST_CAPABLE_PRESET_PROVIDERS.has(provider)) out.fast = true;
+  // Auto effort is on unless the preset opts out; only the off state is kept.
+  if (preset.autoEffort === false) out.autoEffort = false;
   out.tools = ['full', 'readonly', 'mcp'].includes(preset.tools) ? preset.tools : 'full';
   return out;
 }

package/src/runtime/agent/orchestrator/config-providers-merge.mjs

@@ -6,9 +6,21 @@
  * is dropped.
  */
 import { AGENT_PROVIDER_ENV, getAgentApiKey } from '../../shared/config.mjs';
+import { hasAgentApiKey } from '../../shared/provider-api-key.mjs';
 import { OPENAI_COMPAT_PRESETS } from './providers/openai-compat-presets.mjs';
 
-export function mergeStoredProviders({ raw, defaults, includeSecrets }) {
+/** `presenceOnly`: a stored key only marks its provider enabled; its value is
+ *  neither read nor attached. */
+export function mergeStoredProviders({ raw, defaults, includeSecrets, presenceOnly = false }) {
+  const storedKey = (name) => {
+    if (!presenceOnly) return getAgentApiKey(name);
+    return hasAgentApiKey(name) ? true : null;
+  };
+  const withKey = (entry, name, key) => ({
+    ...(entry || {}),
+    ...(presenceOnly ? {} : { apiKey: key }),
+    enabled: raw.providers?.[name]?.enabled !== false,
+  });
   // Deep-merge provider subkeys: unknown per-provider values are
   // preserved through save/load so future fields round-trip
   // without schema updates here.
@@ -39,14 +51,8 @@ export function mergeStoredProviders({ raw, defaults, includeSecrets }) {
   // stored key still ships 'no-key' → 401.
   if (includeSecrets) {
     for (const name of new Set([...Object.keys(AGENT_PROVIDER_ENV), ...Object.keys(OPENAI_COMPAT_PRESETS)])) {
-      const kc = getAgentApiKey(name);
-      if (kc) {
-        mergedProviders[name] = {
-          ...(mergedProviders[name] || {}),
-          apiKey: kc,
-          enabled: raw.providers?.[name]?.enabled !== false,
-        };
-      }
+      const kc = storedKey(name);
+      if (kc) mergedProviders[name] = withKey(mergedProviders[name], name, kc);
     }
   }
   // Custom providers: the keychain account is the generated custom-<uuid> id.
@@ -61,8 +67,8 @@ export function mergeStoredProviders({ raw, defaults, includeSecrets }) {
   if (includeSecrets) {
     for (const [name, val] of Object.entries(mergedProviders)) {
       if (val?.type !== 'custom' || !name.startsWith('custom-') || val.auth === 'none') continue;
-      const kc = getAgentApiKey(name);
-      if (kc) mergedProviders[name] = { ...val, apiKey: kc, enabled: raw.providers?.[name]?.enabled !== false };
+      const kc = storedKey(name);
+      if (kc) mergedProviders[name] = withKey(val, name, kc);
     }
   }
   // Cursor account access is OAuth-only. The dashboard's "API"

package/src/runtime/agent/orchestrator/config-storage.mjs

@@ -103,6 +103,7 @@ export function normalizeMaintenanceRoutes(rawMaint) {
     const effort = String(value.effort || '').trim();
     if (effort) route.effort = effort;
     if (value.fast === true) route.fast = true;
+    if (value.autoEffort === false) route.autoEffort = false;
     out[slot] = route;
   }
   return out;

package/src/runtime/agent/orchestrator/config.mjs

@@ -44,6 +44,7 @@ import {
 } from './config-storage.mjs';
 import { oauthCredentialProbeState, isOAuthProviderAvailable } from './providers/oauth-credential-probes.mjs';
 import { normalizeDeveloperConfig } from '../../shared/developer-options.mjs';
+import { normalizeWorktreeSettings } from '../../shared/worktrees/settings.mjs';
 
 export const {
   PROFILE_LANGUAGES,
@@ -204,6 +205,10 @@ function storedInstructionFiles(agent) {
 
 export function loadConfig(options = {}) {
   const includeSecrets = options.secrets !== false;
+  // `secrets: 'presence'`: credentials are detected (env, OAuth files, which
+  // keychain entries exist) but no keychain value is read or attached — the
+  // availability view the model proxy answers a server with.
+  const presenceOnly = options.secrets === 'presence';
   try {
     ensureDefaultsSeparated({ stripRouteDefaults: separateStoredAgent });
   } catch (err) {
@@ -219,7 +224,7 @@ export function loadConfig(options = {}) {
       const storageNeedsMigration = agentConfigStorageNeedsMigration(raw);
       raw = canonicalizeAgentStorage(raw);
       const defaults = buildDefaultConfig({ detectCredentials: includeSecrets });
-      const mergedProviders = mergeStoredProviders({ raw, defaults, includeSecrets });
+      const mergedProviders = mergeStoredProviders({ raw, defaults, includeSecrets, presenceOnly });
       // Drop unknown maintenance keys (e.g. truly legacy slot names from
       // pre-removal installs). Every valid fallback slot lives in
       // DEFAULT_MAINTENANCE, so the allow-list below is the single
@@ -274,6 +279,7 @@ export function loadConfig(options = {}) {
         shell: raw.shell && typeof raw.shell === 'object' ? raw.shell : {},
         update: raw.update && typeof raw.update === 'object' ? { ...raw.update } : {},
         recap: recapConfig,
+        worktree: normalizeWorktreeSettings(raw.worktree),
         developer: normalizeDeveloperConfig(raw.developer),
         modules: canonicalizeModulesStorage(raw.modules) || {},
         ...(raw.builtins && typeof raw.builtins === 'object'
@@ -316,6 +322,7 @@ export function loadConfig(options = {}) {
     shell: {},
     update: {},
     recap: { enabled: true },
+    worktree: normalizeWorktreeSettings(null),
     developer: {},
     modules: {},
     // No stored section at all is a brand-new profile: its built-ins start
@@ -421,6 +428,7 @@ function buildAgentSaveBuilder(config) {
       shell,
       update: config.update || {},
       recap: config.recap || {},
+      ...(config.worktree ? { worktree: config.worktree } : {}),
       modules,
       builtins,
     };

package/src/runtime/agent/orchestrator/mcp/client-config.mjs

@@ -15,8 +15,16 @@ export const AUTO_DETECT_PORTS = {
   'mixdog-memory': { discovery: 'memory', endpoint: '/mcp' },
 };
 const DEFAULT_MCP_CALL_TIMEOUT_MS = 120000;
-// Per-server STARTUP handshake budget (connect + listTools): 10s.
-const DEFAULT_MCP_STARTUP_TIMEOUT_MS = 10000;
+// Per-server STARTUP handshake budget (connect + paginated listTools): 30s.
+// Cold npx/uvx wrappers routinely need well over 10s to install and boot.
+const DEFAULT_MCP_STARTUP_TIMEOUT_MS = 30000;
+// Hard ceiling for a request that keeps reporting progress (each progress
+// notification resets the per-call timeout, this caps the total): 30min.
+const DEFAULT_MCP_MAX_TOTAL_TIMEOUT_MS = 1_800_000;
+// Largest delay setTimeout honours; anything larger fires after 1ms. Used as
+// the SDK request timeout when our own call timeout is disabled, so the SDK's
+// built-in 60s default never applies.
+export const MCP_MAX_TIMER_MS = 2_147_483_647;
 
 function isLoopbackMcpHost(hostname) {
   const host = String(hostname || '')
@@ -204,8 +212,9 @@ export function resolveMcpTransportKind(cfg) {
 // (e.g. a busy editor) must not stall a tool call indefinitely. Genuinely
 // long-running tools can raise/disable it via MIXDOG_MCP_CALL_TIMEOUT_MS or a
 // per-server timeoutMs/callTimeoutMs config value (0/off/none/false disables).
-// On expiry we close the transport so the next dispatch reconnects fresh, but
-// we do not retry the timed-out call automatically (avoids side-effect dupes).
+// On expiry only the timed-out request is cancelled (notifications/cancelled);
+// the server and its other in-flight calls stay up, and the timed-out call is
+// never retried automatically (avoids side-effect dupes).
 export function resolveMcpCallTimeoutMs(cfg = {}, env = process.env) {
   const raw =
     cfg?.timeoutMs ?? cfg?.timeout_ms ?? cfg?.callTimeoutMs ?? cfg?.call_timeout_ms ?? env?.MIXDOG_MCP_CALL_TIMEOUT_MS;
@@ -213,11 +222,42 @@ export function resolveMcpCallTimeoutMs(cfg = {}, env = process.env) {
   if (typeof raw === 'string' && /^(0|off|none|false)$/i.test(raw.trim())) return 0;
   const parsed = Number(raw);
   if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_MCP_CALL_TIMEOUT_MS;
-  return Math.round(parsed);
+  return Math.min(Math.round(parsed), MCP_MAX_TIMER_MS);
+}
+
+// Total cap for a call whose server keeps reporting progress. Default 30min.
+// Per-server override: maxTotalTimeoutMs / max_total_timeout_ms. Global env:
+// MIXDOG_MCP_MAX_TOTAL_TIMEOUT_MS. 0/off/none/false removes the cap.
+export function resolveMcpMaxTotalTimeoutMs(cfg = {}, env = process.env) {
+  const raw = cfg?.maxTotalTimeoutMs ?? cfg?.max_total_timeout_ms ?? env?.MIXDOG_MCP_MAX_TOTAL_TIMEOUT_MS;
+  if (raw == null || raw === '' || raw === false) return DEFAULT_MCP_MAX_TOTAL_TIMEOUT_MS;
+  if (raw === 0 || (typeof raw === 'string' && /^(0|off|none|false)$/i.test(raw.trim()))) return 0;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_MCP_MAX_TOTAL_TIMEOUT_MS;
+  return Math.min(Math.round(parsed), MCP_MAX_TIMER_MS);
+}
+
+/**
+ * The effective limits of one MCP request:
+ *  - callTimeoutMs: our per-call timeout (0 = disabled), reset on progress;
+ *  - sdkTimeoutMs: what the SDK gets as `timeout` — the call timeout, or the
+ *    largest timer when disabled so the SDK's 60s default never applies;
+ *  - maxTotalTimeoutMs: the progress-reset ceiling (never below the call
+ *    timeout), or undefined when the call is unbounded or the cap is off.
+ */
+export function resolveMcpRequestTimeouts(cfg = {}, env = process.env) {
+  const callTimeoutMs = resolveMcpCallTimeoutMs(cfg, env);
+  if (!(callTimeoutMs > 0)) return { callTimeoutMs: 0, sdkTimeoutMs: MCP_MAX_TIMER_MS, maxTotalTimeoutMs: undefined };
+  const cap = resolveMcpMaxTotalTimeoutMs(cfg, env);
+  return {
+    callTimeoutMs,
+    sdkTimeoutMs: callTimeoutMs,
+    maxTotalTimeoutMs: cap > 0 ? Math.max(cap, callTimeoutMs) : undefined,
+  };
 }
 
 // MCP per-server STARTUP timeout: bounds the connect + listTools handshake so a
-// slow or hung server can't stall boot or the first turn. Default 10s.
+// slow or hung server can't stall boot or the first turn. Default 30s.
 // Per-server override: startupTimeoutMs / startupTimeoutSec. Global
 // env: MIXDOG_MCP_STARTUP_TIMEOUT_MS. A value of 0/off/none/false disables it.
 export function resolveMcpStartupTimeoutMs(cfg = {}, env = process.env) {
@@ -235,5 +275,5 @@ export function resolveMcpStartupTimeoutMs(cfg = {}, env = process.env) {
   if (raw === 0 || (typeof raw === 'string' && /^(0|off|none|false)$/i.test(raw.trim()))) return 0;
   const parsed = Number(raw) * scale;
   if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_MCP_STARTUP_TIMEOUT_MS;
-  return Math.round(parsed);
+  return Math.min(Math.round(parsed), MCP_MAX_TIMER_MS);
 }

package/src/runtime/agent/orchestrator/mcp/client-handshake.mjs

@@ -4,14 +4,40 @@
  * and a discovery advert that refused the connection is distrusted.
  */
 import { markServiceUnreachable, isConnRefuseError } from '../../../shared/service-discovery.mjs';
-import { resolveMcpStartupTimeoutMs } from './client-config.mjs';
+import { MCP_MAX_TIMER_MS, resolveMcpStartupTimeoutMs } from './client-config.mjs';
+import { appendMcpStderrTail } from './client-transport.mjs';
 
-async function performHandshake(client, transport) {
-  await client.connect(transport);
+// tools/list pagination bounds: a server that never stops handing out cursors
+// (or repeats one) cannot loop the client forever.
+const MAX_MCP_TOOL_PAGES = 100;
+
+/**
+ * Every tool of a server: follows `nextCursor` until it is exhausted, repeats,
+ * or MAX_MCP_TOOL_PAGES is reached. A page with an invalid shape is returned
+ * as-is so the caller's shape validation reports it.
+ */
+export async function listAllMcpTools(client, requestOptions = undefined) {
+  const tools = [];
+  const seen = new Set();
+  let cursor = null;
+  for (let page = 0; page < MAX_MCP_TOOL_PAGES; page += 1) {
+    const result = await client.listTools(cursor ? { cursor } : undefined, requestOptions);
+    if (!result || !Array.isArray(result.tools)) return result;
+    tools.push(...result.tools);
+    const next = typeof result.nextCursor === 'string' && result.nextCursor ? result.nextCursor : null;
+    if (!next || seen.has(next)) break;
+    seen.add(next);
+    cursor = next;
+  }
+  return { tools };
+}
+
+async function performHandshake(client, transport, requestOptions) {
+  await client.connect(transport, requestOptions);
   const instructionsRaw = typeof client.getInstructions === 'function' ? client.getInstructions() : undefined;
   const instructions = typeof instructionsRaw === 'string' ? instructionsRaw.trim() : '';
   const capabilities = client.getServerCapabilities?.() || {};
-  const toolsResult = capabilities.tools ? await client.listTools() : { tools: [] };
+  const toolsResult = capabilities.tools ? await listAllMcpTools(client, requestOptions) : { tools: [] };
   return { instructions, toolsResult, capabilities };
 }
 
@@ -28,12 +54,24 @@ function startupTimeoutError(name, startupTimeoutMs) {
  * boot or the first turn. On expiry the pending transport/child is torn down
  * (nothing leaks) and this server fails like any other connect failure — the
  * parallel Promise.allSettled means other servers are unaffected.
- * Returns { instructions, toolsResult, capabilities }.
+ * The SDK's per-request timeout follows the same budget (its own 60s default
+ * would otherwise cut a longer or disabled budget short). Failures carry the
+ * server's stderr tail. Returns { instructions, toolsResult, capabilities }.
  */
-export async function runBoundedHandshake({ name, cfg, client, transport, autoDetectAdvert, closeServer }) {
+export async function runBoundedHandshake({
+  name,
+  cfg,
+  client,
+  transport,
+  autoDetectAdvert,
+  closeServer,
+  stderrTail = () => '',
+}) {
   const startupTimeoutMs = resolveMcpStartupTimeoutMs(cfg);
   const guard = { timer: null, timedOut: false };
-  const handshake = performHandshake(client, transport);
+  const handshake = performHandshake(client, transport, {
+    timeout: startupTimeoutMs > 0 ? startupTimeoutMs : MCP_MAX_TIMER_MS,
+  });
   try {
     if (startupTimeoutMs <= 0) return await handshake;
     const deadline = new Promise((_, rej) => {
@@ -63,7 +101,12 @@ export async function runBoundedHandshake({ name, cfg, client, transport, autoDe
       // Never let the late handshake settle into an unhandled rejection.
       handshake.catch(() => {});
     }
-    throw err;
+    const tail = stderrTail();
+    if (tail && err instanceof Error) {
+      err.message = appendMcpStderrTail(err.message, tail);
+      throw err;
+    }
+    throw tail ? new Error(appendMcpStderrTail(String(err), tail)) : err;
   } finally {
     if (guard.timer) clearTimeout(guard.timer);
   }

package/src/runtime/agent/orchestrator/mcp/client-transport.mjs

@@ -32,19 +32,35 @@ function resolveAutoDetectUrl(name, cfg) {
   return { url: `http://127.0.0.1:${port}${spec.endpoint}`, advert: { service: spec.discovery, port } };
 }
 
+// Bounded tail of a stdio server's stderr, kept for failure messages (a server
+// that dies at startup or mid-session usually says why on stderr).
+const MCP_STDERR_TAIL_CHARS = 4096;
+const noStderrTail = () => '';
+
+/** Append a server's stderr tail to a failure message (unchanged when empty). */
+export function appendMcpStderrTail(message, tail) {
+  const text = String(tail || '').trim();
+  return text ? `${message}\n--- server stderr (tail) ---\n${text}` : String(message);
+}
+
 function requestInitFor(cfg) {
   const headers = resolveMcpHttpHeaders(cfg);
   return headers && Object.keys(headers).length > 0 ? { requestInit: { headers } } : undefined;
 }
 
-/** Returns { transport, autoDetectAdvert }. */
+/** Returns { transport, autoDetectAdvert, stderrTail } — stderrTail() is the
+ *  last ~4 KB of a stdio server's (scrubbed) stderr, '' for remote transports. */
 export function createMcpTransport({ name, cfg, sdk, log }) {
   const { StdioClientTransport, StreamableHTTPClientTransport, SSEClientTransport, WebSocketClientTransport } = sdk;
   const kind = resolveMcpTransportKind(cfg);
   if (kind === 'autoDetect') {
     const { url, advert } = resolveAutoDetectUrl(name, cfg);
     log(`[mcp-client] Connecting "${name}" via autoDetect HTTP: ${url}\n`);
-    return { transport: new StreamableHTTPClientTransport(new URL(url)), autoDetectAdvert: advert };
+    return {
+      transport: new StreamableHTTPClientTransport(new URL(url)),
+      autoDetectAdvert: advert,
+      stderrTail: noStderrTail,
+    };
   }
   if (kind === 'http' || kind === 'sse') {
     const Transport = kind === 'http' ? StreamableHTTPClientTransport : SSEClientTransport;
@@ -54,13 +70,14 @@ export function createMcpTransport({ name, cfg, sdk, log }) {
     return {
       transport: opts ? new Transport(new URL(url), opts) : new Transport(new URL(url)),
       autoDetectAdvert: null,
+      stderrTail: noStderrTail,
     };
   }
   if (kind === 'ws') {
     // WebSocketClientTransport ctor takes only a URL; headers are ignored.
     const url = normalizeMcpTransportUrl(expandEnvVars(String(cfg.url ?? '')), 'ws');
     log(`[mcp-client] Connecting "${name}" via WebSocket: ${mcpUrlForLog(url)}\n`);
-    return { transport: new WebSocketClientTransport(new URL(url)), autoDetectAdvert: null };
+    return { transport: new WebSocketClientTransport(new URL(url)), autoDetectAdvert: null, stderrTail: noStderrTail };
   }
   if (kind === 'stdio') {
     const transport = new StdioClientTransport({
@@ -70,10 +87,13 @@ export function createMcpTransport({ name, cfg, sdk, log }) {
       env: resolveMcpStdioEnvironment(cfg),
       stderr: cfg.stderr ?? 'pipe',
     });
+    let tail = '';
     transport.stderr?.on?.('data', (chunk) => {
-      log(`[mcp:${name}:stderr] ${scrubMcpConnectionMessage(chunk, cfg)}`);
+      const text = scrubMcpConnectionMessage(chunk, cfg);
+      tail = (tail + text).slice(-MCP_STDERR_TAIL_CHARS);
+      log(`[mcp:${name}:stderr] ${text}`);
     });
-    return { transport, autoDetectAdvert: null };
+    return { transport, autoDetectAdvert: null, stderrTail: () => tail.trim() };
   }
   throw new Error(
     `Invalid config for "${name}": need autoDetect, type (stdio/http/sse/ws), url (http), or command (stdio)`