norn-cli 3.0.0 → 3.1.0

package/dist/cli.js

@@ -16439,7 +16439,7 @@ var require_form_data = __commonJS({
     var parseUrl = require("url").parse;
     var fs31 = require("fs");
     var Stream6 = require("stream").Stream;
-    var crypto9 = require("crypto");
+    var crypto10 = require("crypto");
     var mime = require_mime_types();
     var asynckit = require_asynckit();
     var setToStringTag = require_es_set_tostringtag();
@@ -16645,7 +16645,7 @@ var require_form_data = __commonJS({
       return Buffer.concat([dataBuffer, Buffer.from(this._lastBoundary())]);
     };
     FormData5.prototype._generateBoundary = function() {
-      this._boundary = "--------------------------" + crypto9.randomBytes(12).toString("hex");
+      this._boundary = "--------------------------" + crypto10.randomBytes(12).toString("hex");
     };
     FormData5.prototype.getLengthSync = function() {
       var knownLength = this._overheadLength + this._valueLength;
@@ -19957,7 +19957,7 @@ var require_cert_signatures = __commonJS({
 var require_sasl = __commonJS({
   "node_modules/pg/lib/crypto/sasl.js"(exports2, module2) {
     "use strict";
-    var crypto9 = require_utils3();
+    var crypto10 = require_utils3();
     var { signatureAlgorithmHashFromCertificate } = require_cert_signatures();
     function startSession(mechanisms, stream4) {
       const candidates = ["SCRAM-SHA-256"];
@@ -19969,7 +19969,7 @@ var require_sasl = __commonJS({
       if (mechanism === "SCRAM-SHA-256-PLUS" && typeof stream4.getPeerCertificate !== "function") {
         throw new Error("SASL: Mechanism SCRAM-SHA-256-PLUS requires a certificate");
       }
-      const clientNonce = crypto9.randomBytes(18).toString("base64");
+      const clientNonce = crypto10.randomBytes(18).toString("base64");
       const gs2Header = mechanism === "SCRAM-SHA-256-PLUS" ? "p=tls-server-end-point" : stream4 ? "y" : "n";
       return {
         mechanism,
@@ -20004,20 +20004,20 @@ var require_sasl = __commonJS({
         const peerCert = stream4.getPeerCertificate().raw;
         let hashName = signatureAlgorithmHashFromCertificate(peerCert);
         if (hashName === "MD5" || hashName === "SHA-1") hashName = "SHA-256";
-        const certHash = await crypto9.hashByName(hashName, peerCert);
+        const certHash = await crypto10.hashByName(hashName, peerCert);
         const bindingData = Buffer.concat([Buffer.from("p=tls-server-end-point,,"), Buffer.from(certHash)]);
         channelBinding = bindingData.toString("base64");
       }
       const clientFinalMessageWithoutProof = "c=" + channelBinding + ",r=" + sv.nonce;
       const authMessage = clientFirstMessageBare + "," + serverFirstMessage + "," + clientFinalMessageWithoutProof;
       const saltBytes = Buffer.from(sv.salt, "base64");
-      const saltedPassword = await crypto9.deriveKey(password, saltBytes, sv.iteration);
-      const clientKey = await crypto9.hmacSha256(saltedPassword, "Client Key");
-      const storedKey = await crypto9.sha256(clientKey);
-      const clientSignature = await crypto9.hmacSha256(storedKey, authMessage);
+      const saltedPassword = await crypto10.deriveKey(password, saltBytes, sv.iteration);
+      const clientKey = await crypto10.hmacSha256(saltedPassword, "Client Key");
+      const storedKey = await crypto10.sha256(clientKey);
+      const clientSignature = await crypto10.hmacSha256(storedKey, authMessage);
       const clientProof = xorBuffers(Buffer.from(clientKey), Buffer.from(clientSignature)).toString("base64");
-      const serverKey = await crypto9.hmacSha256(saltedPassword, "Server Key");
-      const serverSignatureBytes = await crypto9.hmacSha256(serverKey, authMessage);
+      const serverKey = await crypto10.hmacSha256(saltedPassword, "Server Key");
+      const serverSignatureBytes = await crypto10.hmacSha256(serverKey, authMessage);
       session.message = "SASLResponse";
       session.serverSignature = Buffer.from(serverSignatureBytes).toString("base64");
       session.response = clientFinalMessageWithoutProof + ",p=" + clientProof;
@@ -22185,7 +22185,7 @@ var require_client = __commonJS({
     var Query2 = require_query();
     var defaults5 = require_defaults2();
     var Connection2 = require_connection();
-    var crypto9 = require_utils3();
+    var crypto10 = require_utils3();
     var activeQueryDeprecationNotice = nodeUtils.deprecate(
       () => {
       },
@@ -22420,7 +22420,7 @@ var require_client = __commonJS({
       _handleAuthMD5Password(msg) {
         this._getPassword(async () => {
           try {
-            const hashedPassword = await crypto9.postgresMd5PasswordHash(this.user, this.password, msg.salt);
+            const hashedPassword = await crypto10.postgresMd5PasswordHash(this.user, this.password, msg.salt);
             this.connection.password(hashedPassword);
           } catch (e2) {
             this.emit("error", e2);
@@ -38205,14 +38205,14 @@ var require_buffer_equal_constant_time = __commonJS({
 var require_jwa = __commonJS({
   "node_modules/jwa/index.js"(exports2, module2) {
     var Buffer5 = require_safe_buffer().Buffer;
-    var crypto9 = require("crypto");
+    var crypto10 = require("crypto");
     var formatEcdsa = require_ecdsa_sig_formatter();
     var util4 = require("util");
     var MSG_INVALID_ALGORITHM = '"%s" is not a valid algorithm.\n  Supported algorithms are:\n  "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512" and "none".';
     var MSG_INVALID_SECRET = "secret must be a string or buffer";
     var MSG_INVALID_VERIFIER_KEY = "key must be a string or a buffer";
     var MSG_INVALID_SIGNER_KEY = "key must be a string, a buffer or an object";
-    var supportsKeyObjects = typeof crypto9.createPublicKey === "function";
+    var supportsKeyObjects = typeof crypto10.createPublicKey === "function";
     if (supportsKeyObjects) {
       MSG_INVALID_VERIFIER_KEY += " or a KeyObject";
       MSG_INVALID_SECRET += "or a KeyObject";
@@ -38302,17 +38302,17 @@ var require_jwa = __commonJS({
       return function sign(thing, secret) {
         checkIsSecretKey(secret);
         thing = normalizeInput(thing);
-        var hmac = crypto9.createHmac("sha" + bits, secret);
+        var hmac = crypto10.createHmac("sha" + bits, secret);
         var sig = (hmac.update(thing), hmac.digest("base64"));
         return fromBase64(sig);
       };
     }
     var bufferEqual;
-    var timingSafeEqual = "timingSafeEqual" in crypto9 ? function timingSafeEqual2(a, b) {
+    var timingSafeEqual = "timingSafeEqual" in crypto10 ? function timingSafeEqual2(a, b) {
       if (a.byteLength !== b.byteLength) {
         return false;
       }
-      return crypto9.timingSafeEqual(a, b);
+      return crypto10.timingSafeEqual(a, b);
     } : function timingSafeEqual2(a, b) {
       if (!bufferEqual) {
         bufferEqual = require_buffer_equal_constant_time();
@@ -38329,7 +38329,7 @@ var require_jwa = __commonJS({
       return function sign(thing, privateKey) {
         checkIsPrivateKey(privateKey);
         thing = normalizeInput(thing);
-        var signer = crypto9.createSign("RSA-SHA" + bits);
+        var signer = crypto10.createSign("RSA-SHA" + bits);
         var sig = (signer.update(thing), signer.sign(privateKey, "base64"));
         return fromBase64(sig);
       };
@@ -38339,7 +38339,7 @@ var require_jwa = __commonJS({
         checkIsPublicKey(publicKey);
         thing = normalizeInput(thing);
         signature = toBase64(signature);
-        var verifier = crypto9.createVerify("RSA-SHA" + bits);
+        var verifier = crypto10.createVerify("RSA-SHA" + bits);
         verifier.update(thing);
         return verifier.verify(publicKey, signature, "base64");
       };
@@ -38348,11 +38348,11 @@ var require_jwa = __commonJS({
       return function sign(thing, privateKey) {
         checkIsPrivateKey(privateKey);
         thing = normalizeInput(thing);
-        var signer = crypto9.createSign("RSA-SHA" + bits);
+        var signer = crypto10.createSign("RSA-SHA" + bits);
         var sig = (signer.update(thing), signer.sign({
           key: privateKey,
-          padding: crypto9.constants.RSA_PKCS1_PSS_PADDING,
-          saltLength: crypto9.constants.RSA_PSS_SALTLEN_DIGEST
+          padding: crypto10.constants.RSA_PKCS1_PSS_PADDING,
+          saltLength: crypto10.constants.RSA_PSS_SALTLEN_DIGEST
         }, "base64"));
         return fromBase64(sig);
       };
@@ -38362,12 +38362,12 @@ var require_jwa = __commonJS({
         checkIsPublicKey(publicKey);
         thing = normalizeInput(thing);
         signature = toBase64(signature);
-        var verifier = crypto9.createVerify("RSA-SHA" + bits);
+        var verifier = crypto10.createVerify("RSA-SHA" + bits);
         verifier.update(thing);
         return verifier.verify({
           key: publicKey,
-          padding: crypto9.constants.RSA_PKCS1_PSS_PADDING,
-          saltLength: crypto9.constants.RSA_PSS_SALTLEN_DIGEST
+          padding: crypto10.constants.RSA_PKCS1_PSS_PADDING,
+          saltLength: crypto10.constants.RSA_PSS_SALTLEN_DIGEST
         }, signature, "base64");
       };
     }
@@ -41653,7 +41653,7 @@ var require_msal_node = __commonJS({
     var http5 = require("http");
     var https5 = require("https");
     var uuid3 = (init_esm_node(), __toCommonJS(esm_node_exports));
-    var crypto9 = require("crypto");
+    var crypto10 = require("crypto");
     var msalCommon = require_lib4();
     var jwt2 = require_jsonwebtoken();
     var fs31 = require("fs");
@@ -48697,7 +48697,7 @@ Headers: ${JSON.stringify(headers)}`
        * @param buffer
        */
       sha256(buffer) {
-        return crypto9.createHash(Hash.SHA256).update(buffer).digest();
+        return crypto10.createHash(Hash.SHA256).update(buffer).digest();
       }
     };
     var PkceGenerator = class {
@@ -48720,7 +48720,7 @@ Headers: ${JSON.stringify(headers)}`
         const charArr = [];
         const maxNumber = 256 - 256 % CharSet.CV_CHARSET.length;
         while (charArr.length <= RANDOM_OCTET_SIZE) {
-          const byte = crypto9.randomBytes(1)[0];
+          const byte = crypto10.randomBytes(1)[0];
           if (byte >= maxNumber) {
             continue;
           }
@@ -67089,17 +67089,17 @@ var require_md4 = __commonJS({
         return method;
       };
       var nodeWrap = function(method) {
-        var crypto9 = require("crypto");
+        var crypto10 = require("crypto");
         var Buffer5 = require("buffer").Buffer;
         var nodeMethod = function(message) {
           if (typeof message === "string") {
-            return crypto9.createHash("md4").update(message, "utf8").digest("hex");
+            return crypto10.createHash("md4").update(message, "utf8").digest("hex");
           } else if (ARRAY_BUFFER && message instanceof ArrayBuffer) {
             message = new Uint8Array(message);
           } else if (message.length === void 0) {
             return method(message);
           }
-          return crypto9.createHash("md4").update(new Buffer5(message)).digest("hex");
+          return crypto10.createHash("md4").update(new Buffer5(message)).digest("hex");
         };
         return nodeMethod;
       };
@@ -67432,7 +67432,7 @@ var require_ntlm_payload = __commonJS({
     });
     exports2.default = void 0;
     var _writableTrackingBuffer = _interopRequireDefault(require_writable_tracking_buffer());
-    var crypto9 = _interopRequireWildcard(require("crypto"));
+    var crypto10 = _interopRequireWildcard(require("crypto"));
     var _jsMd = _interopRequireDefault(require_md4());
     function _interopRequireWildcard(e2, t2) {
       if ("function" == typeof WeakMap) var r2 = /* @__PURE__ */ new WeakMap(), n = /* @__PURE__ */ new WeakMap();
@@ -67569,7 +67569,7 @@ var require_ntlm_payload = __commonJS({
         return Buffer.from(_jsMd.default.arrayBuffer(unicodeString));
       }
       hmacMD5(data, key) {
-        return crypto9.createHmac("MD5", key).update(data).digest();
+        return crypto10.createHmac("MD5", key).update(data).digest();
       }
     };
     var _default2 = exports2.default = NTLMResponsePayload;
@@ -101313,13 +101313,13 @@ var uuid42;
 var init_uuid = __esm({
   "node_modules/@anthropic-ai/sdk/internal/utils/uuid.mjs"() {
     uuid42 = function() {
-      const { crypto: crypto9 } = globalThis;
-      if (crypto9?.randomUUID) {
-        uuid42 = crypto9.randomUUID.bind(crypto9);
-        return crypto9.randomUUID();
+      const { crypto: crypto10 } = globalThis;
+      if (crypto10?.randomUUID) {
+        uuid42 = crypto10.randomUUID.bind(crypto10);
+        return crypto10.randomUUID();
       }
       const u8 = new Uint8Array(1);
-      const randomByte = crypto9 ? () => crypto9.getRandomValues(u8)[0] : () => Math.random() * 255 & 255;
+      const randomByte = crypto10 ? () => crypto10.getRandomValues(u8)[0] : () => Math.random() * 255 & 255;
       return "10000000-1000-4000-8000-100000000000".replace(/[018]/g, (c) => (+c ^ randomByte() & 15 >> +c / 4).toString(16));
     };
   }
@@ -107496,7 +107496,7 @@ async function findRg() {
   }
   return null;
 }
-var fs17, fssync2, path19, cp, crypto7, readline, _BashSession_instances, _BashSession_proc, _BashSession_buf, _BashSession_truncated, _BashSession_closed, _BashSession_waiting, _BashSession_append, BASH_OUTPUT_LIMIT, BASH_DEFAULT_TIMEOUT_MS, DEFAULT_MAX_FILE_BYTES, GREP_OUTPUT_LIMIT, GREP_MAX_LINE_LENGTH, GLOB_RESULT_LIMIT, BashTimeoutError, ANSI_RE, fsGlob, BashSession, WALK_MAX_DEPTH, WALK_MAX_ENTRIES;
+var fs17, fssync2, path19, cp, crypto8, readline, _BashSession_instances, _BashSession_proc, _BashSession_buf, _BashSession_truncated, _BashSession_closed, _BashSession_waiting, _BashSession_append, BASH_OUTPUT_LIMIT, BASH_DEFAULT_TIMEOUT_MS, DEFAULT_MAX_FILE_BYTES, GREP_OUTPUT_LIMIT, GREP_MAX_LINE_LENGTH, GLOB_RESULT_LIMIT, BashTimeoutError, ANSI_RE, fsGlob, BashSession, WALK_MAX_DEPTH, WALK_MAX_ENTRIES;
 var init_node = __esm({
   "node_modules/@anthropic-ai/sdk/tools/agent-toolset/node.mjs"() {
     init_tslib();
@@ -107504,7 +107504,7 @@ var init_node = __esm({
     fssync2 = __toESM(require("node:fs"), 1);
     path19 = __toESM(require("node:path"), 1);
     cp = __toESM(require("node:child_process"), 1);
-    crypto7 = __toESM(require("node:crypto"), 1);
+    crypto8 = __toESM(require("node:crypto"), 1);
     readline = __toESM(require("node:readline"), 1);
     init_error();
     init_ToolError();
@@ -107570,7 +107570,7 @@ var init_node = __esm({
         signal?.throwIfAborted();
         __classPrivateFieldSet2(this, _BashSession_buf, "", "f");
         __classPrivateFieldSet2(this, _BashSession_truncated, false, "f");
-        const sentinel3 = `__ANT_CMD_${crypto7.randomUUID()}_DONE__`;
+        const sentinel3 = `__ANT_CMD_${crypto8.randomUUID()}_DONE__`;
         const sentinelSplit = `${sentinel3.slice(0, 8)}''${sentinel3.slice(8)}`;
         const wrapped = `{ ${command}
 } </dev/null 2>&1; printf '\\n${sentinelSplit}%d\\n' $?
@@ -124335,22 +124335,22 @@ var require_crypto2 = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.NodeCrypto = void 0;
-    var crypto9 = require("crypto");
+    var crypto10 = require("crypto");
     var NodeCrypto = class {
       async sha256DigestBase64(str2) {
-        return crypto9.createHash("sha256").update(str2).digest("base64");
+        return crypto10.createHash("sha256").update(str2).digest("base64");
       }
       randomBytesBase64(count) {
-        return crypto9.randomBytes(count).toString("base64");
+        return crypto10.randomBytes(count).toString("base64");
       }
       async verify(pubkey, data, signature) {
-        const verifier = crypto9.createVerify("RSA-SHA256");
+        const verifier = crypto10.createVerify("RSA-SHA256");
         verifier.update(data);
         verifier.end();
         return verifier.verify(pubkey, signature, "base64");
       }
       async sign(privateKey, data) {
-        const signer = crypto9.createSign("RSA-SHA256");
+        const signer = crypto10.createSign("RSA-SHA256");
         signer.update(data);
         signer.end();
         return signer.sign(privateKey, "base64");
@@ -124368,7 +124368,7 @@ var require_crypto2 = __commonJS({
        *   string in hexadecimal encoding.
        */
       async sha256DigestHex(str2) {
-        return crypto9.createHash("sha256").update(str2).digest("hex");
+        return crypto10.createHash("sha256").update(str2).digest("hex");
       }
       /**
        * Computes the HMAC hash of a message using the provided crypto key and the
@@ -124380,7 +124380,7 @@ var require_crypto2 = __commonJS({
        */
       async signWithHmacSha256(key, msg) {
         const cryptoKey = typeof key === "string" ? key : toBuffer(key);
-        return toArrayBuffer(crypto9.createHmac("sha256", cryptoKey).update(msg).digest());
+        return toArrayBuffer(crypto10.createHmac("sha256", cryptoKey).update(msg).digest());
       }
     };
     exports2.NodeCrypto = NodeCrypto;
@@ -125071,10 +125071,10 @@ var require_oauth2client = __commonJS({
        * https://github.com/googleapis/google-auth-library-nodejs/blob/main/samples/oauth2-codeVerifier.js
        */
       async generateCodeVerifierAsync() {
-        const crypto9 = (0, crypto_1.createCrypto)();
-        const randomString2 = crypto9.randomBytesBase64(96);
+        const crypto10 = (0, crypto_1.createCrypto)();
+        const randomString2 = crypto10.randomBytesBase64(96);
         const codeVerifier = randomString2.replace(/\+/g, "~").replace(/=/g, "_").replace(/\//g, "-");
-        const unencodedCodeChallenge = await crypto9.sha256DigestBase64(codeVerifier);
+        const unencodedCodeChallenge = await crypto10.sha256DigestBase64(codeVerifier);
         const codeChallenge = unencodedCodeChallenge.split("=")[0].replace(/\+/g, "-").replace(/\//g, "_");
         return { codeVerifier, codeChallenge };
       }
@@ -125515,7 +125515,7 @@ var require_oauth2client = __commonJS({
        * @return Returns a promise resolving to LoginTicket on verification.
        */
       async verifySignedJwtWithCertsAsync(jwt2, certs, requiredAudience, issuers, maxExpiry) {
-        const crypto9 = (0, crypto_1.createCrypto)();
+        const crypto10 = (0, crypto_1.createCrypto)();
         if (!maxExpiry) {
           maxExpiry = _OAuth2Client.DEFAULT_MAX_TOKEN_LIFETIME_SECS_;
         }
@@ -125528,7 +125528,7 @@ var require_oauth2client = __commonJS({
         let envelope;
         let payload;
         try {
-          envelope = JSON.parse(crypto9.decodeBase64StringUtf8(segments[0]));
+          envelope = JSON.parse(crypto10.decodeBase64StringUtf8(segments[0]));
         } catch (err) {
           if (err instanceof Error) {
             err.message = `Can't parse token envelope: ${segments[0]}': ${err.message}`;
@@ -125539,7 +125539,7 @@ var require_oauth2client = __commonJS({
           throw new Error("Can't parse token envelope: " + segments[0]);
         }
         try {
-          payload = JSON.parse(crypto9.decodeBase64StringUtf8(segments[1]));
+          payload = JSON.parse(crypto10.decodeBase64StringUtf8(segments[1]));
         } catch (err) {
           if (err instanceof Error) {
             err.message = `Can't parse token payload '${segments[0]}`;
@@ -125556,7 +125556,7 @@ var require_oauth2client = __commonJS({
         if (envelope.alg === "ES256") {
           signature = formatEcdsa.joseToDer(signature, "ES256").toString("base64");
         }
-        const verified = await crypto9.verify(cert, signed, signature);
+        const verified = await crypto10.verify(cert, signed, signature);
         if (!verified) {
           throw new Error("Invalid token signature: " + jwt2);
         }
@@ -128126,14 +128126,14 @@ var require_awsrequestsigner = __commonJS({
       }
     };
     exports2.AwsRequestSigner = AwsRequestSigner;
-    async function sign(crypto9, key, msg) {
-      return await crypto9.signWithHmacSha256(key, msg);
-    }
-    async function getSigningKey(crypto9, key, dateStamp, region, serviceName) {
-      const kDate = await sign(crypto9, `AWS4${key}`, dateStamp);
-      const kRegion = await sign(crypto9, kDate, region);
-      const kService = await sign(crypto9, kRegion, serviceName);
-      const kSigning = await sign(crypto9, kService, "aws4_request");
+    async function sign(crypto10, key, msg) {
+      return await crypto10.signWithHmacSha256(key, msg);
+    }
+    async function getSigningKey(crypto10, key, dateStamp, region, serviceName) {
+      const kDate = await sign(crypto10, `AWS4${key}`, dateStamp);
+      const kRegion = await sign(crypto10, kDate, region);
+      const kService = await sign(crypto10, kRegion, serviceName);
+      const kSigning = await sign(crypto10, kService, "aws4_request");
       return kSigning;
     }
     async function generateAuthenticationHeaderMap(options) {
@@ -129099,7 +129099,7 @@ var require_gdchclient = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.GdchClient = exports2.GDCH_SERVICE_ACCOUNT_TYPE = void 0;
-    var crypto9 = require("crypto");
+    var crypto10 = require("crypto");
     var fs31 = require("fs");
     var https5 = require("https");
     var oauth2client_1 = require_oauth2client();
@@ -129290,7 +129290,7 @@ var require_gdchclient = __commonJS({
         const encodedHeader = this.base64UrlEncode(JSON.stringify(header));
         const encodedPayload = this.base64UrlEncode(JSON.stringify(payload));
         const signingInput = `${encodedHeader}.${encodedPayload}`;
-        const signature = crypto9.sign("sha256", Buffer.from(signingInput), {
+        const signature = crypto10.sign("sha256", Buffer.from(signingInput), {
           key: this.privateKey,
           dsaEncoding: "ieee-p1363"
         });
@@ -130153,24 +130153,24 @@ var require_googleauth = __commonJS({
           const signed = await client.sign(data);
           return signed.signedBlob;
         }
-        const crypto9 = (0, crypto_1.createCrypto)();
+        const crypto10 = (0, crypto_1.createCrypto)();
         if (client instanceof jwtclient_1.JWT && client.key) {
-          const sign = await crypto9.sign(client.key, data);
+          const sign = await crypto10.sign(client.key, data);
           return sign;
         }
         const creds = await this.getCredentials();
         if (!creds.client_email) {
           throw new Error("Cannot sign data without `client_email`.");
         }
-        return this.signBlob(crypto9, creds.client_email, data, endpoint);
+        return this.signBlob(crypto10, creds.client_email, data, endpoint);
       }
-      async signBlob(crypto9, emailOrUniqueId, data, endpoint) {
+      async signBlob(crypto10, emailOrUniqueId, data, endpoint) {
         const url3 = new URL(endpoint + `${emailOrUniqueId}:signBlob`);
         const res = await this.request({
           method: "POST",
           url: url3.href,
           data: {
-            payload: crypto9.encodeBase64StringUtf8(data)
+            payload: crypto10.encodeBase64StringUtf8(data)
           },
           retry: true,
           retryConfig: {
@@ -132825,7 +132825,7 @@ var require_websocket = __commonJS({
     var http5 = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes2, createHash: createHash7 } = require("crypto");
+    var { randomBytes: randomBytes2, createHash: createHash8 } = require("crypto");
     var { Duplex, Readable: Readable4 } = require("stream");
     var { URL: URL3 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -133493,7 +133493,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash7("sha1").update(key + GUID).digest("base64");
+        const digest = createHash8("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -133862,7 +133862,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter2 = require("events");
     var http5 = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash7 } = require("crypto");
+    var { createHash: createHash8 } = require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -134169,7 +134169,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash7("sha1").update(key + GUID).digest("base64");
+        const digest = createHash8("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -157481,7 +157481,7 @@ var fsPromises = __toESM(require("fs/promises"));
 var path32 = __toESM(require("path"));
 
 // src/parser.ts
-var path3 = __toESM(require("path"));
+var path4 = __toESM(require("path"));
 
 // src/quotedString.ts
 function decodeQuotedStringLiteral(literal2) {
@@ -158653,6 +158653,49 @@ var IDENTIFIER = "[a-zA-Z_][a-zA-Z0-9_]*";
 var MODEL_PROVIDERS = ["anthropic", "google", "local", "openai"];
 var MODEL_PROVIDER = new RegExp(`^(${MODEL_PROVIDERS.join("|")})$`, "i");
 var MODEL_DIRECTIVES = ["provider", "name", "apiKey", "baseUrl"];
+var MCP_DIRECTIVES = {
+  transport: { transport: "both", repeatable: false },
+  command: { transport: "stdio", repeatable: false },
+  cwd: { transport: "stdio", repeatable: false },
+  env: { transport: "stdio", repeatable: true },
+  url: { transport: "http", repeatable: false },
+  header: { transport: "http", repeatable: true },
+  timeout: { transport: "http", repeatable: false },
+  session: { transport: "both", repeatable: false }
+};
+var MCP_DIRECTIVE_NAMES = Object.keys(MCP_DIRECTIVES);
+var MCP_SESSION_SCOPES = ["run", "agent", "call"];
+function splitCommandParts(value) {
+  const parts = [];
+  const pattern = /"([^"]*)"|'([^']*)'|(\S+)/g;
+  let match2;
+  while ((match2 = pattern.exec(value)) !== null) {
+    parts.push(match2[1] ?? match2[2] ?? match2[3]);
+  }
+  return parts;
+}
+function splitNamedDirective(value) {
+  const match2 = value.trim().match(/^(\S+)\s+(.+)$/);
+  if (!match2) {
+    return void 0;
+  }
+  return { name: match2[1], value: match2[2].trim() };
+}
+var HTTP_HEADER_NAME = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
+function splitHeaderDirective(value) {
+  const colonForm = value.trim().match(/^([^\s:]+)\s*:\s*(.+)$/);
+  if (colonForm) {
+    return { name: colonForm[1], value: colonForm[2].trim() };
+  }
+  return splitNamedDirective(value);
+}
+var LIMIT_DIRECTIVES = {
+  max_tokens: "maxTokens",
+  max_depth: "maxDepth",
+  max_invocations: "maxInvocations",
+  max_turns: "maxTurns",
+  contract_retries: "contractRetries"
+};
 function parseError(lineNumber, message, code) {
   return { lineNumber, message, code, blocking: true };
 }
@@ -158790,6 +158833,38 @@ function validateAgentScope(scope, options = {}) {
   const checkUnknownReferences = options.checkUnknownReferences ?? true;
   const reportedMissingDescriptions = /* @__PURE__ */ new Set();
   const checkedAcceptsRoots = /* @__PURE__ */ new Set();
+  if (options.configuredMcpAliases) {
+    const configured = options.configuredMcpAliases;
+    const resolvable = (agent, alias) => agent.mcpServers?.has(alias.toLowerCase()) === true || configured.has(alias.toLowerCase());
+    for (const agent of scope.values()) {
+      for (const tool of agent.tools) {
+        if (resolvable(agent, tool.mcpAlias)) {
+          continue;
+        }
+        errors.push({
+          ...parseError(
+            tool.lineNumber,
+            `Tool '${tool.name}' uses MCP alias '${tool.mcpAlias}', which is not declared in this sidecar and not found in norn.config.json mcp.servers. Declare it with 'mcp ${tool.mcpAlias} ... end mcp' or add it to the config.`,
+            "agent-tool-mcp-undeclared"
+          ),
+          sourcePath: agent.sourcePath
+        });
+      }
+      for (const grant of agent.grantedMcpServers ?? []) {
+        if (resolvable(agent, grant.alias)) {
+          continue;
+        }
+        errors.push({
+          ...parseError(
+            grant.lineNumber,
+            `Agent '${agent.name}' grants MCP server '${grant.alias}', which is not declared in this sidecar and not found in norn.config.json mcp.servers. Declare it with 'mcp ${grant.alias} ... end mcp' or add it to the config.`,
+            "agent-mcp-grant-unknown"
+          ),
+          sourcePath: agent.sourcePath
+        });
+      }
+    }
+  }
   for (const caller of scope.values()) {
     for (const reference of caller.callableAgents) {
       const target = scope.get(reference.name.toLowerCase());
@@ -158854,13 +158929,137 @@ function validateAgentScope(scope, options = {}) {
 function parseNornAgentFile(content, sourcePath) {
   const lines = content.split(/\r?\n/);
   const models = /* @__PURE__ */ new Map();
-  const mcpAliases = /* @__PURE__ */ new Map();
+  const mcpServers = /* @__PURE__ */ new Map();
   const agents = [];
   const errors = [];
   const agentNames = /* @__PURE__ */ new Map();
   let pending;
   let pendingModel;
+  let pendingMcp;
   let sawAgent = false;
+  const reportBareMcpAlias = (mcp) => {
+    errors.push(parseError(
+      mcp.lineNumber,
+      `'mcp ${mcp.alias}' no longer declares a server. Either declare it here:
+mcp ${mcp.alias}
+    transport stdio
+    command <command> <args\u2026>
+end mcp
+\u2026or delete this line and grant it from the agent that uses it \u2014 an alias with no block resolves through norn.config.json mcp.servers.`,
+      "agent-mcp-bare-alias-removed"
+    ));
+  };
+  const finishMcp = (lineNumber) => {
+    if (!pendingMcp) {
+      errors.push(parseError(lineNumber, "Unexpected 'end mcp' without a matching mcp block.", "agent-mcp-end-unexpected"));
+      return;
+    }
+    const mcp = pendingMcp;
+    pendingMcp = void 0;
+    const transport = mcp.values.transport;
+    const templatedTransport = Boolean(transport?.value.includes("{{"));
+    let resolvedTransport;
+    if (!transport) {
+      errors.push(parseError(
+        mcp.lineNumber,
+        `MCP server '${mcp.alias}' requires a transport directive. Expected stdio or http.`,
+        "agent-mcp-transport-missing"
+      ));
+      mcp.invalid = true;
+    } else if (!templatedTransport) {
+      const lowered = transport.value.toLowerCase();
+      if (lowered !== "stdio" && lowered !== "http") {
+        errors.push(parseError(
+          transport.lineNumber,
+          `Unknown transport '${transport.value}' in MCP server '${mcp.alias}'. Expected stdio or http.`,
+          "agent-mcp-transport-invalid"
+        ));
+        mcp.invalid = true;
+      } else {
+        resolvedTransport = lowered;
+      }
+    }
+    if (resolvedTransport) {
+      for (const directive of MCP_DIRECTIVE_NAMES) {
+        const allowed = MCP_DIRECTIVES[directive].transport;
+        if (allowed === "both" || allowed === resolvedTransport) {
+          continue;
+        }
+        const declaredLines = directive === "env" ? mcp.envTemplates.map((entry) => entry.lineNumber) : directive === "header" ? mcp.headerTemplates.map((entry) => entry.lineNumber) : mcp.values[directive] ? [mcp.values[directive].lineNumber] : [];
+        for (const declaredLine of declaredLines) {
+          errors.push(parseError(
+            declaredLine,
+            `'${directive}' is not allowed under transport ${resolvedTransport} in MCP server '${mcp.alias}'. It belongs to transport ${allowed}.`,
+            "agent-mcp-directive-not-allowed"
+          ));
+          mcp.invalid = true;
+        }
+      }
+      if (resolvedTransport === "stdio" && mcp.commandTemplates.length === 0) {
+        errors.push(parseError(
+          mcp.lineNumber,
+          `MCP server '${mcp.alias}' uses transport stdio and requires a command directive.`,
+          "agent-mcp-command-missing"
+        ));
+        mcp.invalid = true;
+      }
+      if (resolvedTransport === "http" && !mcp.values.url) {
+        errors.push(parseError(
+          mcp.lineNumber,
+          `MCP server '${mcp.alias}' uses transport http and requires a url directive. Norn dials the endpoint; it never starts the server.`,
+          "agent-mcp-url-missing"
+        ));
+        mcp.invalid = true;
+      }
+    }
+    let timeoutMs;
+    const timeout = mcp.values.timeout;
+    if (timeout) {
+      const parsedTimeout = /^\d+$/.test(timeout.value) ? Number(timeout.value) : Number.NaN;
+      if (!Number.isSafeInteger(parsedTimeout) || parsedTimeout <= 0) {
+        errors.push(parseError(
+          timeout.lineNumber,
+          `timeout in MCP server '${mcp.alias}' requires a positive integer of milliseconds.`,
+          "agent-mcp-timeout-invalid"
+        ));
+        mcp.invalid = true;
+      } else {
+        timeoutMs = parsedTimeout;
+      }
+    }
+    let session = "run";
+    const sessionValue = mcp.values.session;
+    if (sessionValue) {
+      const lowered = sessionValue.value.toLowerCase();
+      if (!MCP_SESSION_SCOPES.includes(lowered)) {
+        errors.push(parseError(
+          sessionValue.lineNumber,
+          `Unknown session lifetime '${sessionValue.value}' in MCP server '${mcp.alias}'. Expected one of: ${MCP_SESSION_SCOPES.join(", ")}.`,
+          "agent-mcp-session-invalid"
+        ));
+        mcp.invalid = true;
+      } else {
+        session = lowered;
+      }
+    }
+    if (mcp.invalid) {
+      return;
+    }
+    mcpServers.set(mcp.alias.toLowerCase(), {
+      alias: mcp.alias,
+      transportTemplate: transport.value,
+      commandTemplates: mcp.commandTemplates,
+      ...mcp.values.cwd ? { cwdTemplate: mcp.values.cwd.value } : {},
+      ...mcp.envTemplates.length > 0 ? { envTemplates: mcp.envTemplates } : {},
+      ...mcp.values.url ? { urlTemplate: mcp.values.url.value } : {},
+      ...mcp.headerTemplates.length > 0 ? { headerTemplates: mcp.headerTemplates } : {},
+      ...timeoutMs !== void 0 ? { timeoutMs } : {},
+      session,
+      lineNumber: mcp.lineNumber,
+      endLineNumber: lineNumber,
+      sourcePath
+    });
+  };
   const finishModel = (lineNumber) => {
     if (!pendingModel) {
       errors.push(parseError(lineNumber, "Unexpected 'end model' without a matching model block.", "agent-model-end-unexpected"));
@@ -158943,15 +159142,19 @@ function parseNornAgentFile(content, sourcePath) {
         }
       }
     }
-    for (const tool of pending.tools) {
-      if (!mcpAliases.has(tool.mcpAlias.toLowerCase())) {
-        errors.push(parseError(
-          tool.lineNumber,
-          `Tool '${tool.name}' uses undeclared MCP alias '${tool.mcpAlias}'. Add 'mcp ${tool.mcpAlias}' at file scope.`,
-          "agent-tool-mcp-undeclared"
-        ));
-        pending.invalid = true;
+    for (const grant of pending.grantedMcpServers) {
+      const narrowed = pending.tools.filter(
+        (tool) => tool.mcpAlias.toLowerCase() === grant.alias.toLowerCase()
+      );
+      if (narrowed.length === 0) {
+        continue;
       }
+      errors.push(parseError(
+        grant.lineNumber,
+        `Agent '${pending.name}' grants all of MCP server '${grant.alias}' and also names ${narrowed.map((tool) => `'${tool.name}'`).join(", ")} from it. Keep one: 'mcp ${grant.alias}' for every tool it advertises, or 'tools' for exactly those.`,
+        "agent-mcp-grant-redundant"
+      ));
+      pending.invalid = true;
     }
     if (!pending.invalid && model && pending.systemPrompt) {
       agents.push({
@@ -158963,12 +159166,15 @@ function parseNornAgentFile(content, sourcePath) {
         descriptionFile: pending.description?.file,
         systemPromptFile: pending.systemPrompt.file,
         tools: pending.tools,
+        ...pending.grantedMcpServers.length > 0 ? { grantedMcpServers: pending.grantedMcpServers } : {},
         callableAgents: pending.callableAgents,
+        mcpServers,
         accepts: pending.accepts,
         returns: pending.returns,
         maxTokens: pending.maxTokens?.value,
         maxDepth: pending.maxDepth?.value,
         maxInvocations: pending.maxInvocations?.value,
+        maxTurns: pending.maxTurns?.value,
         contractRetries: pending.contractRetries?.value,
         sourcePath,
         lineNumber: pending.lineNumber,
@@ -158981,6 +159187,101 @@ function parseNornAgentFile(content, sourcePath) {
     const rawLine = lines[index];
     const withoutComment = stripInlineComment(rawLine);
     const trimmed = withoutComment.trim();
+    if (pendingMcp) {
+      if (!trimmed) {
+        continue;
+      }
+      if (/^end\s+mcp$/i.test(trimmed)) {
+        finishMcp(index);
+        continue;
+      }
+      const mcpDirectiveMatch = trimmed.match(
+        new RegExp(`^(${MCP_DIRECTIVE_NAMES.join("|")})\\b\\s*(.*)$`, "i")
+      );
+      if (mcpDirectiveMatch) {
+        const directive = MCP_DIRECTIVE_NAMES.find(
+          (candidate) => candidate === mcpDirectiveMatch[1].toLowerCase()
+        );
+        const rawValue = mcpDirectiveMatch[2].trim();
+        pendingMcp.sawDirective = true;
+        if (directive === "env" || directive === "header") {
+          const named = directive === "header" ? splitHeaderDirective(rawValue) : splitNamedDirective(rawValue);
+          if (!named) {
+            errors.push(parseError(
+              index,
+              `${directive} in MCP server '${pendingMcp.alias}' requires ${directive === "env" ? "<NAME> <value>" : "<Name>: <value>"}.`,
+              `agent-mcp-${directive}-malformed`
+            ));
+            pendingMcp.invalid = true;
+            continue;
+          }
+          if (directive === "header" && !HTTP_HEADER_NAME.test(named.name)) {
+            errors.push(parseError(
+              index,
+              `Header name '${named.name}' in MCP server '${pendingMcp.alias}' is not a valid HTTP header name. Use letters, digits, and -_.`,
+              "agent-mcp-header-name-invalid"
+            ));
+            pendingMcp.invalid = true;
+            continue;
+          }
+          const entry = { name: named.name, valueTemplate: named.value, lineNumber: index };
+          if (directive === "env") {
+            pendingMcp.envTemplates.push(entry);
+          } else {
+            pendingMcp.headerTemplates.push(entry);
+          }
+          continue;
+        }
+        if (pendingMcp.values[directive]) {
+          errors.push(parseError(
+            index,
+            `MCP server '${pendingMcp.alias}' declares ${directive} more than once.`,
+            "agent-mcp-directive-duplicate"
+          ));
+          pendingMcp.invalid = true;
+          continue;
+        }
+        if (!rawValue) {
+          errors.push(parseError(
+            index,
+            `MCP server '${pendingMcp.alias}' declares ${directive} with no value.`,
+            "agent-mcp-directive-empty"
+          ));
+          pendingMcp.invalid = true;
+          continue;
+        }
+        pendingMcp.values[directive] = {
+          value: directive === "command" ? rawValue : normalizeDirectiveValue(rawValue),
+          lineNumber: index
+        };
+        if (directive === "command") {
+          pendingMcp.commandTemplates = splitCommandParts(rawValue);
+        }
+        continue;
+      }
+      if (!pendingMcp.sawDirective) {
+        reportBareMcpAlias(pendingMcp);
+        pendingMcp = void 0;
+        index--;
+        continue;
+      }
+      if (/^mcp\b/i.test(trimmed)) {
+        errors.push(parseError(index, `Nested mcp blocks are not allowed (inside '${pendingMcp.alias}').`, "agent-mcp-nested"));
+      } else if (/^(agent|model)\b/i.test(trimmed)) {
+        errors.push(parseError(pendingMcp.lineNumber, `MCP server '${pendingMcp.alias}' is missing 'end mcp'.`, "agent-mcp-unterminated"));
+        pendingMcp = void 0;
+        index--;
+        continue;
+      } else {
+        errors.push(parseError(
+          index,
+          `Unknown directive in MCP server '${pendingMcp.alias}': '${trimmed}'. Expected ${MCP_DIRECTIVE_NAMES.join(", ")}, or 'end mcp'.`,
+          "agent-mcp-directive-unknown"
+        ));
+      }
+      pendingMcp.invalid = true;
+      continue;
+    }
     if (pendingModel) {
       if (!trimmed) {
         continue;
@@ -159075,17 +159376,30 @@ end model`,
       }
       const mcpMatch = trimmed.match(new RegExp(`^mcp\\s+(${IDENTIFIER})$`, "i"));
       if (mcpMatch) {
+        const alias = mcpMatch[1];
+        let invalid = false;
         if (sawAgent) {
-          errors.push(parseError(index, "MCP aliases must be declared before the first agent block.", "agent-mcp-not-at-top"));
-          continue;
+          errors.push(parseError(index, "MCP server blocks must be declared before the first agent block.", "agent-mcp-not-at-top"));
+          invalid = true;
         }
-        const alias = mcpMatch[1];
-        const lowerAlias = alias.toLowerCase();
-        if (mcpAliases.has(lowerAlias)) {
+        if (mcpServers.has(alias.toLowerCase())) {
           errors.push(parseError(index, `Duplicate MCP alias '${alias}'.`, "agent-mcp-duplicate"));
-        } else {
-          mcpAliases.set(lowerAlias, alias);
+          invalid = true;
         }
+        pendingMcp = {
+          alias,
+          lineNumber: index,
+          values: {},
+          commandTemplates: [],
+          envTemplates: [],
+          headerTemplates: [],
+          sawDirective: false,
+          invalid
+        };
+        continue;
+      }
+      if (/^end\s+mcp$/i.test(trimmed)) {
+        finishMcp(index);
         continue;
       }
       const agentMatch = trimmed.match(new RegExp(`^agent\\s+(${IDENTIFIER})$`, "i"));
@@ -159105,6 +159419,7 @@ end model`,
           lineNumber: index,
           endLineNumber: index,
           tools: [],
+          grantedMcpServers: [],
           callableAgents: [],
           invalid
         };
@@ -159117,7 +159432,7 @@ end model`,
       if (/^model\b/i.test(trimmed)) {
         errors.push(parseError(index, "Malformed model declaration. Expected: model <Alias>, then provider/name/apiKey directives, then end model.", "agent-model-malformed"));
       } else if (/^mcp\b/i.test(trimmed)) {
-        errors.push(parseError(index, "Malformed MCP declaration. Expected: mcp <alias>.", "agent-mcp-malformed"));
+        errors.push(parseError(index, "Malformed MCP declaration. Expected: mcp <Alias>, then transport and its directives, then end mcp.", "agent-mcp-malformed"));
       } else if (/^agent\b/i.test(trimmed)) {
         errors.push(parseError(index, "Malformed agent declaration. Expected: agent <Name>.", "agent-declaration-malformed"));
       } else {
@@ -159163,6 +159478,35 @@ end model`,
       }
       continue;
     }
+    const grantMatch = trimmed.match(/^mcp(?:\s+(.*))?$/i);
+    if (grantMatch) {
+      const rawValue = (grantMatch[1] ?? "").trim();
+      const tokens = rawValue ? rawValue.split(",").map((part) => part.trim()) : [];
+      if (tokens.length === 0 || tokens.some((token) => !new RegExp(`^${IDENTIFIER}$`).test(token))) {
+        errors.push(parseError(
+          index,
+          `Invalid MCP server grant '${trimmed}' in agent '${pending.name}'. Expected: mcp <Alias>[, <Alias>\u2026].`,
+          "agent-mcp-grant-invalid"
+        ));
+        pending.invalid = true;
+        continue;
+      }
+      const granted = new Set(pending.grantedMcpServers.map((grant) => grant.alias.toLowerCase()));
+      for (const alias of tokens) {
+        if (granted.has(alias.toLowerCase())) {
+          errors.push(parseError(
+            index,
+            `Agent '${pending.name}' grants MCP server '${alias}' more than once.`,
+            "agent-mcp-grant-duplicate"
+          ));
+          pending.invalid = true;
+          continue;
+        }
+        granted.add(alias.toLowerCase());
+        pending.grantedMcpServers.push({ alias, lineNumber: index });
+      }
+      continue;
+    }
     const toolsMatch = trimmed.match(/^tools(?:\s+(.*))?$/i);
     if (toolsMatch) {
       const parsedTools = parseToolReferences(toolsMatch[1] ?? "", index, errors);
@@ -159205,58 +159549,27 @@ end model`,
       }
       continue;
     }
-    const limitMatch = trimmed.match(/^(max_tokens|max_depth|max_invocations|contract_retries)(?:\s+(.*))?$/i);
+    const limitMatch = trimmed.match(
+      new RegExp(`^(${Object.keys(LIMIT_DIRECTIVES).join("|")})(?:\\s+(.*))?$`, "i")
+    );
     if (limitMatch) {
       const directive = limitMatch[1].toLowerCase();
+      const field = LIMIT_DIRECTIVES[directive];
       const allowZero = directive === "contract_retries";
-      const duplicateCode = `agent-${directive.replace(/_/g, "-")}-duplicate`;
-      const duplicateMessage = `Agent '${pending.name}' declares ${directive} more than once.`;
-      if (directive === "max_tokens") {
-        if (pending.maxTokens) {
-          errors.push(parseError(index, duplicateMessage, duplicateCode));
-          pending.invalid = true;
-        } else {
-          const value = parseLimitValue(directive, limitMatch[2], index, errors, allowZero);
-          if (value === void 0) {
-            pending.invalid = true;
-          } else {
-            pending.maxTokens = { value, lineNumber: index };
-          }
-        }
-      } else if (directive === "max_depth") {
-        if (pending.maxDepth) {
-          errors.push(parseError(index, duplicateMessage, duplicateCode));
-          pending.invalid = true;
-        } else {
-          const value = parseLimitValue(directive, limitMatch[2], index, errors, allowZero);
-          if (value === void 0) {
-            pending.invalid = true;
-          } else {
-            pending.maxDepth = { value, lineNumber: index };
-          }
-        }
-      } else if (directive === "max_invocations") {
-        if (pending.maxInvocations) {
-          errors.push(parseError(index, duplicateMessage, duplicateCode));
-          pending.invalid = true;
-        } else {
-          const value = parseLimitValue(directive, limitMatch[2], index, errors, allowZero);
-          if (value === void 0) {
-            pending.invalid = true;
-          } else {
-            pending.maxInvocations = { value, lineNumber: index };
-          }
-        }
-      } else if (pending.contractRetries) {
-        errors.push(parseError(index, duplicateMessage, duplicateCode));
+      if (pending[field]) {
+        errors.push(parseError(
+          index,
+          `Agent '${pending.name}' declares ${directive} more than once.`,
+          `agent-${directive.replace(/_/g, "-")}-duplicate`
+        ));
+        pending.invalid = true;
+        continue;
+      }
+      const value = parseLimitValue(directive, limitMatch[2], index, errors, allowZero);
+      if (value === void 0) {
         pending.invalid = true;
       } else {
-        const value = parseLimitValue(directive, limitMatch[2], index, errors, allowZero);
-        if (value === void 0) {
-          pending.invalid = true;
-        } else {
-          pending.contractRetries = { value, lineNumber: index };
-        }
+        pending[field] = { value, lineNumber: index };
       }
       continue;
     }
@@ -159353,7 +159666,7 @@ end model`,
       errors.push(parseError(index, 'Malformed describe block. Expected: describe "..." (multi-line allowed) or describe file <path>.', "agent-describe-malformed"));
     } else if (/^system\b/i.test(trimmed)) {
       errors.push(parseError(index, 'Malformed system prompt. Expected: system "..." (multi-line allowed) or system file <path>.', "agent-system-malformed"));
-    } else if (/^(accepts|returns|tools|agents|model|max_tokens|max_depth|max_invocations|contract_retries)\b/i.test(trimmed)) {
+    } else if (new RegExp(`^(accepts|returns|tools|agents|model|${Object.keys(LIMIT_DIRECTIVES).join("|")})\\b`, "i").test(trimmed)) {
       errors.push(parseError(index, `Malformed agent directive: '${trimmed}'.`, "agent-directive-malformed"));
     } else if (/^agent\b/i.test(trimmed)) {
       errors.push(parseError(index, `Nested agent blocks are not allowed (inside '${pending.name}').`, "agent-nested"));
@@ -159368,6 +159681,13 @@ end model`,
   if (pendingModel) {
     errors.push(parseError(pendingModel.lineNumber, `Model '${pendingModel.alias}' is missing 'end model'.`, "agent-model-end-missing"));
   }
+  if (pendingMcp) {
+    if (pendingMcp.sawDirective) {
+      errors.push(parseError(pendingMcp.lineNumber, `MCP server '${pendingMcp.alias}' is missing 'end mcp'.`, "agent-mcp-unterminated"));
+    } else {
+      reportBareMcpAlias(pendingMcp);
+    }
+  }
   if (models.size === 0) {
     errors.push(parseError(0, "A .nornagent file must declare at least one model block.", "agent-model-required"));
   }
@@ -159379,7 +159699,199 @@ end model`,
     const { sourcePath: _sourcePath, ...parseValidationError } = validationError;
     errors.push(parseValidationError);
   }
-  return { sourcePath, models, mcpAliases, agents, errors };
+  return { sourcePath, models, mcpServers, agents, errors };
+}
+
+// src/nornConfig.ts
+var fs3 = __toESM(require("fs"));
+var path3 = __toESM(require("path"));
+var NORN_CONFIG_FILENAME = "norn.config.json";
+function getSearchDirectory(startPath) {
+  if (!startPath) {
+    return process.cwd();
+  }
+  const absolute = path3.resolve(startPath);
+  try {
+    const stats = fs3.statSync(absolute);
+    return stats.isDirectory() ? absolute : path3.dirname(absolute);
+  } catch {
+    return path3.extname(absolute) ? path3.dirname(absolute) : absolute;
+  }
+}
+function findNearestConfigFile(startPath, fileName) {
+  let currentDir = getSearchDirectory(startPath);
+  while (true) {
+    const candidate = path3.join(currentDir, fileName);
+    if (fs3.existsSync(candidate)) {
+      return candidate;
+    }
+    const parentDir = path3.dirname(currentDir);
+    if (parentDir === currentDir) {
+      return void 0;
+    }
+    currentDir = parentDir;
+  }
+}
+function parseJsonFile(filePath, validator, label) {
+  let raw;
+  try {
+    raw = fs3.readFileSync(filePath, "utf-8");
+  } catch (error2) {
+    throw new Error(`Failed to read ${label}: ${error2 instanceof Error ? error2.message : String(error2)}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error2) {
+    throw new Error(`Invalid JSON in ${label}: ${error2 instanceof Error ? error2.message : String(error2)}`);
+  }
+  if (!validator(parsed)) {
+    throw new Error(`Invalid ${label} structure`);
+  }
+  return parsed;
+}
+function isObjectRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function isStringRecord(value) {
+  return isObjectRecord(value) && Object.values(value).every((entry) => typeof entry === "string");
+}
+function isKnownSection(value) {
+  return value === void 0 || isObjectRecord(value);
+}
+function isCommentField(value) {
+  return typeof value === "string" || Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function isPositiveInteger(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+function isNonNegativeInteger(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+var AGENT_LIMIT_CONFIG_KEYS = /* @__PURE__ */ new Set([
+  "_comment",
+  "max_tokens",
+  "max_depth",
+  "max_invocations",
+  "max_turns",
+  "contract_retries"
+]);
+function hasOnlyKeys(value, allowedKeys) {
+  return Object.keys(value).every((key) => allowedKeys.has(key));
+}
+function hasValidNornAgentLimits(value) {
+  return (value.max_tokens === void 0 || isPositiveInteger(value.max_tokens)) && (value.max_depth === void 0 || isPositiveInteger(value.max_depth)) && (value.max_invocations === void 0 || isPositiveInteger(value.max_invocations)) && (value.max_turns === void 0 || isPositiveInteger(value.max_turns)) && (value.contract_retries === void 0 || isNonNegativeInteger(value.contract_retries));
+}
+function isNornAgentProviderConfig(value) {
+  if (!isObjectRecord(value)) {
+    return false;
+  }
+  if (value._comment !== void 0 && !isCommentField(value._comment)) {
+    return false;
+  }
+  return hasOnlyKeys(value, AGENT_LIMIT_CONFIG_KEYS) && hasValidNornAgentLimits(value);
+}
+function isNornAgentRecordingConfig(value) {
+  if (!isObjectRecord(value)) {
+    return false;
+  }
+  if (value._comment !== void 0 && !isCommentField(value._comment)) {
+    return false;
+  }
+  return hasOnlyKeys(value, /* @__PURE__ */ new Set(["_comment", "enabled"])) && (value.enabled === void 0 || typeof value.enabled === "boolean");
+}
+var AGENT_PROVIDER_NAMES = /* @__PURE__ */ new Set(["openai", "anthropic", "google", "local"]);
+function isNornAgentsConfig(value) {
+  if (value === void 0) {
+    return true;
+  }
+  if (!isObjectRecord(value)) {
+    return false;
+  }
+  if (value._comment !== void 0 && !isCommentField(value._comment)) {
+    return false;
+  }
+  const agentConfigKeys = /* @__PURE__ */ new Set([...AGENT_LIMIT_CONFIG_KEYS, "providers", "recording"]);
+  if (!hasOnlyKeys(value, agentConfigKeys) || !hasValidNornAgentLimits(value)) {
+    return false;
+  }
+  if (!isNornAgentRecordingConfig(value.recording) && value.recording !== void 0) {
+    return false;
+  }
+  const providers = value.providers;
+  if (!isObjectRecord(providers)) {
+    return providers === void 0;
+  }
+  return Object.entries(providers).every(
+    ([provider, config2]) => AGENT_PROVIDER_NAMES.has(provider) && isNornAgentProviderConfig(config2)
+  );
+}
+function isNornHttpConfig(value) {
+  if (value === void 0) {
+    return true;
+  }
+  if (!isObjectRecord(value)) {
+    return false;
+  }
+  if (value._comment !== void 0 && typeof value._comment !== "string" && (!Array.isArray(value._comment) || !value._comment.every((item) => typeof item === "string"))) {
+    return false;
+  }
+  return value.timeoutMs === void 0 || typeof value.timeoutMs === "number" && Number.isFinite(value.timeoutMs) && value.timeoutMs > 0;
+}
+function isNornContractsConfig(value) {
+  if (value === void 0) {
+    return true;
+  }
+  if (!isObjectRecord(value)) {
+    return false;
+  }
+  return value.mode === void 0 || value.mode === "auto" || value.mode === "off";
+}
+function isNornProjectConfig(value) {
+  if (!isObjectRecord(value)) {
+    return false;
+  }
+  if (value.version !== 1) {
+    return false;
+  }
+  return isNornHttpConfig(value.http) && isKnownSection(value.sql) && isKnownSection(value.mcp) && isNornContractsConfig(value.contracts) && isNornAgentsConfig(value.agents);
+}
+function loadNornConfig(startPath) {
+  const filePath = findNearestConfigFile(startPath, NORN_CONFIG_FILENAME);
+  if (!filePath) {
+    throw new Error(`Could not find ${NORN_CONFIG_FILENAME}`);
+  }
+  return {
+    filePath,
+    config: parseJsonFile(filePath, isNornProjectConfig, NORN_CONFIG_FILENAME)
+  };
+}
+function loadNornConfigSection(startPath, sectionName, validator) {
+  const { filePath, config: config2 } = loadNornConfig(startPath);
+  const section = config2[sectionName];
+  if (section === void 0) {
+    throw new Error(`Could not find ${sectionName} section in ${NORN_CONFIG_FILENAME}`);
+  }
+  if (!validator(section)) {
+    throw new Error(`Invalid ${sectionName} section in ${NORN_CONFIG_FILENAME}`);
+  }
+  return { filePath, section };
+}
+function loadConfiguredMcpAliases(startPath) {
+  const aliases = /* @__PURE__ */ new Set();
+  try {
+    const { config: config2 } = loadNornConfig(startPath);
+    const mcp = config2.mcp;
+    if (!isObjectRecord(mcp) || !isObjectRecord(mcp.servers)) {
+      return aliases;
+    }
+    for (const alias of Object.keys(mcp.servers)) {
+      aliases.add(alias.toLowerCase());
+    }
+  } catch {
+    return aliases;
+  }
+  return aliases;
 }
 
 // src/pathAccess.ts
@@ -159705,7 +160217,11 @@ function extractImports(text) {
   }
   return imports;
 }
-async function resolveImports(text, baseDir, readFile4, alreadyImported = /* @__PURE__ */ new Set(), importStack = /* @__PURE__ */ new Set(), sourceFilePath = path3.resolve(baseDir, "__norn_root__.norn"), sqlImportedPathsBySource = /* @__PURE__ */ new Map(), sqlOperationsBySource = /* @__PURE__ */ new Map(), agentImportedPathsBySource = /* @__PURE__ */ new Map(), agentDefinitionsBySource = /* @__PURE__ */ new Map()) {
+function sameMcpServerDeclaration(left, right) {
+  const named = (entries) => (entries ?? []).map((entry) => `${entry.name}=${entry.valueTemplate}`).join("\0");
+  return left.transportTemplate === right.transportTemplate && left.commandTemplates.join("\0") === right.commandTemplates.join("\0") && left.cwdTemplate === right.cwdTemplate && left.urlTemplate === right.urlTemplate && left.timeoutMs === right.timeoutMs && left.session === right.session && named(left.envTemplates) === named(right.envTemplates) && named(left.headerTemplates) === named(right.headerTemplates);
+}
+async function resolveImports(text, baseDir, readFile4, alreadyImported = /* @__PURE__ */ new Set(), importStack = /* @__PURE__ */ new Set(), sourceFilePath = path4.resolve(baseDir, "__norn_root__.norn"), sqlImportedPathsBySource = /* @__PURE__ */ new Map(), sqlOperationsBySource = /* @__PURE__ */ new Map(), agentImportedPathsBySource = /* @__PURE__ */ new Map(), agentDefinitionsBySource = /* @__PURE__ */ new Map(), mcpServersBySource = /* @__PURE__ */ new Map()) {
   const imports = extractImports(text);
   const errors = [];
   const importedContents = [];
@@ -159725,11 +160241,14 @@ async function resolveImports(text, baseDir, readFile4, alreadyImported = /* @__
   if (!agentDefinitionsBySource.has(sourceFilePath)) {
     agentDefinitionsBySource.set(sourceFilePath, /* @__PURE__ */ new Map());
   }
+  if (!mcpServersBySource.has(sourceFilePath)) {
+    mcpServersBySource.set(sourceFilePath, /* @__PURE__ */ new Map());
+  }
   if (!agentImportedPathsBySource.has(sourceFilePath)) {
     agentImportedPathsBySource.set(sourceFilePath, /* @__PURE__ */ new Set());
   }
   for (const imp of imports) {
-    const absolutePath = path3.resolve(baseDir, imp.path);
+    const absolutePath = path4.resolve(baseDir, imp.path);
     if (imp.path.endsWith(".nornsql")) {
       const importedSqlPaths = sqlImportedPathsBySource.get(sourceFilePath);
       if (importedSqlPaths.has(absolutePath)) {
@@ -159791,6 +160310,22 @@ async function resolveImports(text, baseDir, readFile4, alreadyImported = /* @__
             blocking: true
           });
         }
+        const mcpScope = mcpServersBySource.get(sourceFilePath);
+        for (const [alias, declaration] of parsedAgents.mcpServers) {
+          const existing = mcpScope.get(alias);
+          if (!existing) {
+            mcpScope.set(alias, declaration);
+            continue;
+          }
+          if (existing.sourcePath !== declaration.sourcePath && !sameMcpServerDeclaration(existing, declaration)) {
+            errors.push({
+              path: imp.path,
+              error: `MCP alias '${declaration.alias}' is declared differently by '${existing.sourcePath}' and '${declaration.sourcePath}'. A \`run mcp\` step in this file cannot tell which one it means; rename one of them.`,
+              lineNumber: imp.lineNumber,
+              blocking: true
+            });
+          }
+        }
         const scope = agentDefinitionsBySource.get(sourceFilePath);
         for (const agent of parsedAgents.agents) {
           const lowerName = agent.name.toLowerCase();
@@ -159863,7 +160398,7 @@ async function resolveImports(text, baseDir, readFile4, alreadyImported = /* @__
         }
         continue;
       }
-      const importDir = path3.dirname(absolutePath);
+      const importDir = path4.dirname(absolutePath);
       const nestedResult = await resolveImports(
         content,
         importDir,
@@ -159874,7 +160409,8 @@ async function resolveImports(text, baseDir, readFile4, alreadyImported = /* @__
         sqlImportedPathsBySource,
         sqlOperationsBySource,
         agentImportedPathsBySource,
-        agentDefinitionsBySource
+        agentDefinitionsBySource,
+        mcpServersBySource
       );
       errors.push(...nestedResult.errors);
       resolvedPaths.push(...nestedResult.resolvedPaths);
@@ -159961,10 +160497,13 @@ end sequence`);
   }
   const directAgentScope = agentDefinitionsBySource.get(sourceFilePath);
   const directAgentImportsByPath = new Map(
-    imports.filter((imp) => imp.path.toLowerCase().endsWith(".nornagent")).map((imp) => [path3.resolve(baseDir, imp.path), imp])
+    imports.filter((imp) => imp.path.toLowerCase().endsWith(".nornagent")).map((imp) => [path4.resolve(baseDir, imp.path), imp])
   );
   for (const validationError of validateAgentScope(directAgentScope, {
-    skipSameSourceChecks: true
+    skipSameSourceChecks: true,
+    // Resolved against the importing `.norn`, because that is the file whose nearest
+    // config a run would actually consult.
+    configuredMcpAliases: loadConfiguredMcpAliases(sourceFilePath)
   })) {
     const sourceImport = directAgentImportsByPath.get(validationError.sourcePath);
     errors.push({
@@ -159982,7 +160521,8 @@ end sequence`);
     endpoints,
     sequenceSources,
     sqlOperationsBySource,
-    agentDefinitionsBySource
+    agentDefinitionsBySource,
+    mcpServersBySource
   };
 }
 function extractSequencesFromText(text) {
@@ -166150,7 +166690,7 @@ var path27 = __toESM(require("path"));
 
 // src/scriptRunner.ts
 var import_child_process = require("child_process");
-var path4 = __toESM(require("path"));
+var path5 = __toESM(require("path"));
 var pwshAvailable = null;
 function stripAnsiCodes(str2) {
   return str2.replace(/\x1B(?:\[[0-9;]*[a-zA-Z]|\][^\x07]*(?:\x07|\x1B\\)|[a-zA-Z])/g, "");
@@ -166342,7 +166882,7 @@ function isRunCommand(line2) {
 }
 async function runScript(type, scriptPath, args, workingDir, variables = {}, captureVar) {
   const startTime = Date.now();
-  const resolvedPath = path4.isAbsolute(scriptPath) ? scriptPath : path4.resolve(workingDir, scriptPath);
+  const resolvedPath = path5.isAbsolute(scriptPath) ? scriptPath : path5.resolve(workingDir, scriptPath);
   let command;
   let cmdArgs;
   switch (type) {
@@ -166939,8 +167479,8 @@ function substituteAssertionDisplayTemplates(expression, variables) {
 }
 
 // src/jsonFileReader.ts
-var fs3 = __toESM(require("fs"));
-var path5 = __toESM(require("path"));
+var fs4 = __toESM(require("fs"));
+var path6 = __toESM(require("path"));
 function isJsonCommand(line2) {
   const trimmed = line2.trim();
   return /^var\s+[a-zA-Z_][a-zA-Z0-9_]*\s*=\s*run\s+readJson\s+/i.test(trimmed);
@@ -166961,16 +167501,16 @@ function parseJsonCommand(line2) {
   };
 }
 function readJsonFile(filePath, workingDir) {
-  const resolvedPath = path5.isAbsolute(filePath) ? filePath : path5.resolve(workingDir || process.cwd(), filePath);
+  const resolvedPath = path6.isAbsolute(filePath) ? filePath : path6.resolve(workingDir || process.cwd(), filePath);
   try {
-    if (!fs3.existsSync(resolvedPath)) {
+    if (!fs4.existsSync(resolvedPath)) {
       return {
         success: false,
         error: `File not found: ${resolvedPath}`,
         filePath: resolvedPath
       };
     }
-    const content = fs3.readFileSync(resolvedPath, "utf-8");
+    const content = fs4.readFileSync(resolvedPath, "utf-8");
     const data = JSON.parse(content);
     return {
       success: true,
@@ -167278,181 +167818,6 @@ function validatePreparedRequest(parsed, context) {
 // src/sqlConfig.ts
 var path9 = __toESM(require("path"));
 
-// src/nornConfig.ts
-var fs4 = __toESM(require("fs"));
-var path6 = __toESM(require("path"));
-var NORN_CONFIG_FILENAME = "norn.config.json";
-function getSearchDirectory(startPath) {
-  if (!startPath) {
-    return process.cwd();
-  }
-  const absolute = path6.resolve(startPath);
-  try {
-    const stats = fs4.statSync(absolute);
-    return stats.isDirectory() ? absolute : path6.dirname(absolute);
-  } catch {
-    return path6.extname(absolute) ? path6.dirname(absolute) : absolute;
-  }
-}
-function findNearestConfigFile(startPath, fileName) {
-  let currentDir = getSearchDirectory(startPath);
-  while (true) {
-    const candidate = path6.join(currentDir, fileName);
-    if (fs4.existsSync(candidate)) {
-      return candidate;
-    }
-    const parentDir = path6.dirname(currentDir);
-    if (parentDir === currentDir) {
-      return void 0;
-    }
-    currentDir = parentDir;
-  }
-}
-function parseJsonFile(filePath, validator, label) {
-  let raw;
-  try {
-    raw = fs4.readFileSync(filePath, "utf-8");
-  } catch (error2) {
-    throw new Error(`Failed to read ${label}: ${error2 instanceof Error ? error2.message : String(error2)}`);
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (error2) {
-    throw new Error(`Invalid JSON in ${label}: ${error2 instanceof Error ? error2.message : String(error2)}`);
-  }
-  if (!validator(parsed)) {
-    throw new Error(`Invalid ${label} structure`);
-  }
-  return parsed;
-}
-function isObjectRecord(value) {
-  return !!value && typeof value === "object" && !Array.isArray(value);
-}
-function isStringRecord(value) {
-  return isObjectRecord(value) && Object.values(value).every((entry) => typeof entry === "string");
-}
-function isKnownSection(value) {
-  return value === void 0 || isObjectRecord(value);
-}
-function isCommentField(value) {
-  return typeof value === "string" || Array.isArray(value) && value.every((item) => typeof item === "string");
-}
-function isPositiveInteger(value) {
-  return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
-}
-function isNonNegativeInteger(value) {
-  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
-}
-var AGENT_LIMIT_CONFIG_KEYS = /* @__PURE__ */ new Set([
-  "_comment",
-  "max_tokens",
-  "max_depth",
-  "max_invocations",
-  "contract_retries"
-]);
-function hasOnlyKeys(value, allowedKeys) {
-  return Object.keys(value).every((key) => allowedKeys.has(key));
-}
-function hasValidNornAgentLimits(value) {
-  return (value.max_tokens === void 0 || isPositiveInteger(value.max_tokens)) && (value.max_depth === void 0 || isPositiveInteger(value.max_depth)) && (value.max_invocations === void 0 || isPositiveInteger(value.max_invocations)) && (value.contract_retries === void 0 || isNonNegativeInteger(value.contract_retries));
-}
-function isNornAgentProviderConfig(value) {
-  if (!isObjectRecord(value)) {
-    return false;
-  }
-  if (value._comment !== void 0 && !isCommentField(value._comment)) {
-    return false;
-  }
-  return hasOnlyKeys(value, AGENT_LIMIT_CONFIG_KEYS) && hasValidNornAgentLimits(value);
-}
-function isNornAgentRecordingConfig(value) {
-  if (!isObjectRecord(value)) {
-    return false;
-  }
-  if (value._comment !== void 0 && !isCommentField(value._comment)) {
-    return false;
-  }
-  return hasOnlyKeys(value, /* @__PURE__ */ new Set(["_comment", "enabled"])) && (value.enabled === void 0 || typeof value.enabled === "boolean");
-}
-var AGENT_PROVIDER_NAMES = /* @__PURE__ */ new Set(["openai", "anthropic", "google", "local"]);
-function isNornAgentsConfig(value) {
-  if (value === void 0) {
-    return true;
-  }
-  if (!isObjectRecord(value)) {
-    return false;
-  }
-  if (value._comment !== void 0 && !isCommentField(value._comment)) {
-    return false;
-  }
-  const agentConfigKeys = /* @__PURE__ */ new Set([...AGENT_LIMIT_CONFIG_KEYS, "providers", "recording"]);
-  if (!hasOnlyKeys(value, agentConfigKeys) || !hasValidNornAgentLimits(value)) {
-    return false;
-  }
-  if (!isNornAgentRecordingConfig(value.recording) && value.recording !== void 0) {
-    return false;
-  }
-  const providers = value.providers;
-  if (!isObjectRecord(providers)) {
-    return providers === void 0;
-  }
-  return Object.entries(providers).every(
-    ([provider, config2]) => AGENT_PROVIDER_NAMES.has(provider) && isNornAgentProviderConfig(config2)
-  );
-}
-function isNornHttpConfig(value) {
-  if (value === void 0) {
-    return true;
-  }
-  if (!isObjectRecord(value)) {
-    return false;
-  }
-  if (value._comment !== void 0 && typeof value._comment !== "string" && (!Array.isArray(value._comment) || !value._comment.every((item) => typeof item === "string"))) {
-    return false;
-  }
-  return value.timeoutMs === void 0 || typeof value.timeoutMs === "number" && Number.isFinite(value.timeoutMs) && value.timeoutMs > 0;
-}
-function isNornContractsConfig(value) {
-  if (value === void 0) {
-    return true;
-  }
-  if (!isObjectRecord(value)) {
-    return false;
-  }
-  return value.mode === void 0 || value.mode === "auto" || value.mode === "off";
-}
-function isNornProjectConfig(value) {
-  if (!isObjectRecord(value)) {
-    return false;
-  }
-  if (value.version !== 1) {
-    return false;
-  }
-  return isNornHttpConfig(value.http) && isKnownSection(value.sql) && isKnownSection(value.mcp) && isNornContractsConfig(value.contracts) && isNornAgentsConfig(value.agents);
-}
-function loadNornConfig(startPath) {
-  const filePath = findNearestConfigFile(startPath, NORN_CONFIG_FILENAME);
-  if (!filePath) {
-    throw new Error(`Could not find ${NORN_CONFIG_FILENAME}`);
-  }
-  return {
-    filePath,
-    config: parseJsonFile(filePath, isNornProjectConfig, NORN_CONFIG_FILENAME)
-  };
-}
-function loadNornConfigSection(startPath, sectionName, validator) {
-  const { filePath, config: config2 } = loadNornConfig(startPath);
-  const section = config2[sectionName];
-  if (section === void 0) {
-    throw new Error(`Could not find ${sectionName} section in ${NORN_CONFIG_FILENAME}`);
-  }
-  if (!validator(section)) {
-    throw new Error(`Invalid ${sectionName} section in ${NORN_CONFIG_FILENAME}`);
-  }
-  return { filePath, section };
-}
-
 // src/sqlBuiltInAdapters.ts
 var fs10 = __toESM(require("fs"));
 var path8 = __toESM(require("path"));
@@ -184000,6 +184365,9 @@ var StreamableHTTPClientTransport = class {
   }
 };
 
+// src/mcpServerScope.ts
+var crypto7 = __toESM(require("crypto"));
+
 // src/mcpConfig.ts
 var path10 = __toESM(require("path"));
 function isRawMcpStdioServerConfig(value) {
@@ -184055,8 +184423,8 @@ function resolveTemplateString(value, envVariables) {
   const scopedVariables = attachEnvironmentScope({}, envVariables);
   return substituteVariables(value, scopedVariables);
 }
-function resolveCommandParts2(configPath, command, envVariables) {
-  const configDir = path10.dirname(configPath);
+function resolveCommandParts2(originPath, command, envVariables) {
+  const configDir = path10.dirname(originPath);
   return command.map((part, index) => {
     const resolvedPart = resolveTemplateString(part, envVariables);
     if (!resolvedPart) {
@@ -184140,11 +184508,117 @@ function resolveMcpServer(startPath, alias, envVariables) {
   const { filePath, config: config2 } = loadResolvedNornMcpProjectConfig(startPath, envVariables);
   const server = config2.servers[alias];
   if (!server) {
-    throw new Error(`Server alias '${alias}' was not found in ${NORN_CONFIG_FILENAME} mcp.servers`);
+    throw new Error(
+      `Server alias '${alias}' was not declared by an 'mcp ${alias} ... end mcp' block in the .nornagent sidecar and was not found in ${NORN_CONFIG_FILENAME} mcp.servers`
+    );
   }
   return { filePath, server };
 }
 
+// src/mcpServerScope.ts
+function getMcpOriginPath(origin2) {
+  return origin2.kind === "sidecar" ? origin2.sourcePath : origin2.filePath;
+}
+function resolveTemplate(template, declaration, directive, envVariables) {
+  const scoped = attachEnvironmentScope({}, envVariables ?? {});
+  const resolved = substituteVariables(template, scoped).replace(/\{\{\$env\.([a-zA-Z_][a-zA-Z0-9_]*)\}\}/g, (match2, name) => {
+    const value = process.env[name];
+    return value !== void 0 && value.trim() !== "" ? value : match2;
+  }).trim();
+  const unresolved = resolved.match(/\{\{([^}]+)\}\}/);
+  if (unresolved) {
+    throw new Error(
+      `Could not resolve ${directive} for MCP server '${declaration.alias}': '${unresolved[1].trim()}' is not defined. Add it to .nornenv (select it with --env) or export it in the process environment.`
+    );
+  }
+  return resolved;
+}
+function resolveNamedTemplates(entries, declaration, directive, envVariables) {
+  if (!entries || entries.length === 0) {
+    return void 0;
+  }
+  const resolved = {};
+  for (const entry of entries) {
+    resolved[entry.name] = resolveTemplate(
+      entry.valueTemplate,
+      declaration,
+      `${directive} ${entry.name}`,
+      envVariables
+    );
+  }
+  return resolved;
+}
+function resolveMcpServerDeclaration(declaration, envVariables) {
+  const transport = resolveTemplate(declaration.transportTemplate, declaration, "transport", envVariables).toLowerCase();
+  if (transport === "stdio") {
+    const command = declaration.commandTemplates.map(
+      (part) => resolveTemplate(part, declaration, "command", envVariables)
+    );
+    return {
+      transport: "stdio",
+      // Reuse the config path's own resolution so a bare name stays a PATH lookup and a
+      // relative one resolves against the declaring file — here, the sidecar.
+      command: resolveCommandParts2(declaration.sourcePath, command),
+      cwd: resolveRelativeDirectory(
+        declaration.sourcePath,
+        declaration.cwdTemplate === void 0 ? void 0 : resolveTemplate(declaration.cwdTemplate, declaration, "cwd", envVariables)
+      ),
+      env: resolveNamedTemplates(declaration.envTemplates, declaration, "env", envVariables)
+    };
+  }
+  if (transport === "http") {
+    return {
+      transport: "http",
+      url: resolveTemplate(declaration.urlTemplate ?? "", declaration, "url", envVariables),
+      headers: resolveNamedTemplates(declaration.headerTemplates, declaration, "header", envVariables),
+      timeoutMs: declaration.timeoutMs
+    };
+  }
+  throw new Error(
+    `MCP server '${declaration.alias}' resolved transport '${transport}'. Expected stdio or http.`
+  );
+}
+function resolveScopeKey(session, options) {
+  if (session === "run") {
+    return "";
+  }
+  const invocationId = options.invocationId;
+  if (!invocationId) {
+    return "";
+  }
+  if (session === "agent") {
+    return invocationId;
+  }
+  return options.callIndex === void 0 ? invocationId : `${invocationId}#${options.callIndex}`;
+}
+function resolveMcpTarget(alias, options) {
+  const declaration = options.scope?.get(alias.toLowerCase());
+  const { server, origin: origin2, session } = declaration ? {
+    server: resolveMcpServerDeclaration(declaration, options.envVariables),
+    origin: { kind: "sidecar", sourcePath: declaration.sourcePath },
+    session: declaration.session
+  } : (() => {
+    const resolved = resolveMcpServer(options.startPath, alias, options.envVariables);
+    return {
+      server: resolved.server,
+      origin: { kind: "config", filePath: resolved.filePath },
+      // A config alias has no `session` directive, and inventing a config key for it
+      // belongs to whoever needs it, not here.
+      session: "run"
+    };
+  })();
+  const scopeKey = resolveScopeKey(session, options);
+  const configHash = crypto7.createHash("sha256").update(JSON.stringify(server)).digest("hex").slice(0, 16);
+  return {
+    alias,
+    sessionKey: `${getMcpOriginPath(origin2)}::${alias.toLowerCase()}::${configHash}::${scopeKey}`,
+    server,
+    origin: origin2,
+    session,
+    scopeKey
+  };
+}
+
 // src/mcpToolIntellisenseCache.ts
 var path12 = __toESM(require("path"));
 
@@ -184254,11 +184728,11 @@ function cloneSerializableValue(value) {
 // src/mcpToolIntellisenseCache.ts
 var CACHE_VERSION = 1;
 var CACHE_FILE = "mcp-tool-intellisense.json";
-function getCachePathForConfig(configPath) {
-  return getNornCacheFilePath(path12.dirname(configPath), CACHE_FILE);
+function getCachePathForConfig(originPath) {
+  return getNornCacheFilePath(path12.dirname(originPath), CACHE_FILE);
 }
-function ensureCacheDirForConfig(configPath) {
-  return !!ensureNornCacheDir(path12.dirname(configPath));
+function ensureCacheDirForConfig(originPath) {
+  return !!ensureNornCacheDir(path12.dirname(originPath));
 }
 function loadCacheForConfig(configPath) {
   return loadVersionedJsonCache({
@@ -184278,14 +184752,14 @@ function toCachedMcpTool(tool) {
     inputSchema: cloneSerializableValue(tool.inputSchema)
   };
 }
-function saveMcpToolsForAlias(configPath, alias, tools) {
-  const cache = loadCacheForConfig(configPath);
+function saveMcpToolsForAlias(originPath, alias, tools) {
+  const cache = loadCacheForConfig(originPath);
   cache.servers[alias.toLowerCase()] = {
     alias,
     cachedAt: (/* @__PURE__ */ new Date()).toISOString(),
     tools: tools.map((tool) => toCachedMcpTool(tool))
   };
-  saveCacheForConfig(configPath, cache);
+  saveCacheForConfig(originPath, cache);
 }
 
 // src/mcpClient.ts
@@ -184338,21 +184812,53 @@ function normalizeStructuredContent(value) {
 }
 var McpSessionManager = class {
   sessions = /* @__PURE__ */ new Map();
-  resolveSessionTarget(startPath, alias, envVariables) {
-    const { filePath, server } = resolveMcpServer(startPath, alias, envVariables);
-    return {
-      sessionKey: `${filePath}::${alias.toLowerCase()}`,
-      server
-    };
+  /**
+   * Say what could not be reached, and which of the two things it was.
+   *
+   * "fetch failed" is what the SDK gives back, and it tells the reader nothing they can act
+   * on. Norn's job here ends at connecting, so a failure to connect must at least name the
+   * target it dialled — and, for http, that Norn was never going to start it.
+   */
+  describeConnectFailure(target, error2) {
+    const reason = error2 instanceof Error ? error2.message : String(error2);
+    if (target.server.transport === "http") {
+      return new Error(
+        `Could not connect to MCP server '${target.alias}' at ${target.server.url}: ${reason}. Norn dials this endpoint; it never starts the server, so it must already be listening.`
+      );
+    }
+    return new Error(
+      `Could not start MCP server '${target.alias}' with command '${target.server.command[0]}': ${reason}.`
+    );
   }
-  async createSession(server, sessionKey) {
+  async createSession(target) {
     const client = createClient();
+    const server = target.server;
+    try {
+      await this.connect(client, server);
+    } catch (error2) {
+      await Promise.allSettled([client.close()]);
+      throw this.describeConnectFailure(target, error2);
+    }
+    const session = {
+      client,
+      config: server,
+      toolsByName: /* @__PURE__ */ new Map(),
+      scopeKey: target.scopeKey
+    };
+    this.sessions.set(target.sessionKey, session);
+    return session;
+  }
+  async connect(client, server) {
     if (server.transport === "stdio") {
       const [command, ...args] = server.command;
       const transport = new StdioClientTransport({
         command,
         args,
-        cwd: server.cwd
+        cwd: server.cwd,
+        // The SDK's `env` option *replaces* the child environment, so a declared `env`
+        // that is not merged over the default one drops PATH and the server never
+        // launches. Declared values win over the inherited ones.
+        ...server.env ? { env: { ...getDefaultEnvironment(), ...server.env } } : {}
       });
       await client.connect(transport);
     } else {
@@ -184361,24 +184867,41 @@ var McpSessionManager = class {
       });
       await client.connect(transport, server.timeoutMs ? { timeout: server.timeoutMs } : void 0);
     }
-    const session = {
-      client,
-      config: server,
-      toolsByName: /* @__PURE__ */ new Map()
-    };
-    this.sessions.set(sessionKey, session);
-    return session;
   }
-  async getSession(startPath, alias, envVariables) {
-    const target = this.resolveSessionTarget(startPath, alias, envVariables);
+  async getSession(target) {
     const existing = this.sessions.get(target.sessionKey);
     if (existing) {
       return existing;
     }
-    return this.createSession(target.server, target.sessionKey);
+    return this.createSession(target);
+  }
+  /**
+   * Run one operation against a target's session, closing it afterwards when the server
+   * declared `session call`.
+   *
+   * Every public entry point goes through this and every internal step takes the open
+   * session, so a call-scoped server opens and closes exactly once per operation rather than
+   * having its session pulled out from under the call that opened it.
+   */
+  async withSession(target, operation) {
+    const session = await this.getSession(target);
+    try {
+      return await operation(session);
+    } finally {
+      if (target.session === "call") {
+        await this.closeSession(target.sessionKey);
+      }
+    }
+  }
+  async closeSession(sessionKey) {
+    const session = this.sessions.get(sessionKey);
+    if (!session) {
+      return;
+    }
+    this.sessions.delete(sessionKey);
+    await Promise.allSettled([session.client.close()]);
   }
-  async listTools(startPath, alias, envVariables) {
-    const session = await this.getSession(startPath, alias, envVariables);
+  async listToolsForSession(target, session) {
     const tools = [];
     let cursor;
     do {
@@ -184392,44 +184915,74 @@ var McpSessionManager = class {
       }
       cursor = response.nextCursor;
     } while (cursor);
-    const { filePath } = resolveMcpServer(startPath, alias, envVariables);
-    saveMcpToolsForAlias(filePath, alias, tools);
+    saveMcpToolsForAlias(getMcpOriginPath(target.origin), target.alias, tools);
     return { tools };
   }
-  async getToolDefinition(startPath, alias, toolName2, envVariables) {
-    const session = await this.getSession(startPath, alias, envVariables);
+  async getToolDefinitionForSession(target, session, toolName2) {
     const normalizedToolName = toolName2.toLowerCase();
     const cached2 = session.toolsByName.get(normalizedToolName);
     if (cached2) {
       return cached2;
     }
-    const listed = await this.listTools(startPath, alias, envVariables);
+    const listed = await this.listToolsForSession(target, session);
     const resolved = listed.tools.find((tool) => tool.name.toLowerCase() === normalizedToolName);
     if (!resolved) {
-      throw new Error(`Tool '${toolName2}' was not found on MCP server '${alias}'.`);
+      throw new Error(`Tool '${toolName2}' was not found on MCP server '${target.alias}'.`);
     }
     return resolved;
   }
-  async callTool(startPath, alias, toolName2, args, envVariables) {
-    const session = await this.getSession(startPath, alias, envVariables);
-    await this.getToolDefinition(startPath, alias, toolName2, envVariables);
-    const result = await session.client.callTool(
-      {
-        name: toolName2,
-        arguments: args
-      },
-      void 0,
-      session.config.transport === "http" && session.config.timeoutMs ? { timeout: session.config.timeoutMs } : void 0
-    );
-    const content = result.content || [];
-    return {
-      content,
-      structuredContent: normalizeStructuredContent(result.structuredContent),
-      isError: Boolean(result.isError),
-      text: extractTextContent(content),
-      server: alias,
-      tool: toolName2
-    };
+  async listTools(target) {
+    return this.withSession(target, (session) => this.listToolsForSession(target, session));
+  }
+  async getToolDefinition(target, toolName2) {
+    return this.withSession(target, (session) => this.getToolDefinitionForSession(target, session, toolName2));
+  }
+  async callTool(target, toolName2, args) {
+    return this.withSession(target, async (session) => {
+      await this.getToolDefinitionForSession(target, session, toolName2);
+      const result = await session.client.callTool(
+        {
+          name: toolName2,
+          arguments: args
+        },
+        void 0,
+        session.config.transport === "http" && session.config.timeoutMs ? { timeout: session.config.timeoutMs } : void 0
+      );
+      const content = result.content || [];
+      return {
+        content,
+        structuredContent: normalizeStructuredContent(result.structuredContent),
+        isError: Boolean(result.isError),
+        text: extractTextContent(content),
+        server: target.alias,
+        tool: toolName2
+      };
+    });
+  }
+  /**
+   * Close every session opened at one scope boundary.
+   *
+   * This is what stops a twelve-agent run from leaving twelve browsers running: an
+   * `agent`-scoped session belongs to its hop and must die with it, including when the hop
+   * threw. Run-scoped sessions carry an empty scope key and are untouched.
+   */
+  async closeScope(scopeKey) {
+    if (!scopeKey) {
+      return;
+    }
+    const closing = [];
+    for (const [sessionKey, session] of [...this.sessions]) {
+      if (session.scopeKey !== scopeKey && !session.scopeKey.startsWith(`${scopeKey}#`)) {
+        continue;
+      }
+      this.sessions.delete(sessionKey);
+      closing.push(session.client.close());
+    }
+    await Promise.allSettled(closing);
+  }
+  /** How many sessions are open. Exposed so lifetime is provable by count, not inspection. */
+  get openSessionCount() {
+    return this.sessions.size;
   }
   async closeAll() {
     const sessions = Array.from(this.sessions.values());
@@ -185261,6 +185814,50 @@ function parseJudgeStatement(line2, lineNumber = 0, options = {}) {
   })));
 }
 
+// src/agents/mcpServerGrants.ts
+async function expandAgentMcpServerGrants(agent, listToolNames) {
+  const references = [];
+  const grants = [];
+  for (const grant of agent.grantedMcpServers ?? []) {
+    const toolNames = await listToolNames(grant.alias, grant.lineNumber);
+    if (toolNames.length === 0) {
+      throw new Error(
+        `MCP server '${grant.alias}' granted to agent '${agent.name}' advertises no tools. A whole-server grant must offer at least one tool; check the server is the one you meant, or grant named tools instead.`
+      );
+    }
+    grants.push({ alias: grant.alias, toolNames: [...toolNames] });
+    for (const toolName2 of toolNames) {
+      references.push({
+        name: `${grant.alias}.${toolName2}`,
+        mcpAlias: grant.alias,
+        toolName: toolName2,
+        lineNumber: grant.lineNumber
+      });
+    }
+  }
+  return { references, grants };
+}
+function recordedGrantToolNames(grants, alias) {
+  return grants?.find((grant) => grant.alias.toLowerCase() === alias.toLowerCase())?.toolNames;
+}
+function describeGrantToolDrift(alias, recorded, current) {
+  const before = new Set(recorded.map((name) => name.toLowerCase()));
+  const after = new Set(current.map((name) => name.toLowerCase()));
+  const added = current.filter((name) => !before.has(name.toLowerCase()));
+  const removed = recorded.filter((name) => !after.has(name.toLowerCase()));
+  if (added.length === 0 && removed.length === 0) {
+    return void 0;
+  }
+  const parts = [];
+  if (added.length > 0) {
+    parts.push(`added ${added.join(", ")}`);
+  }
+  if (removed.length > 0) {
+    parts.push(`removed ${removed.join(", ")}`);
+  }
+  return `MCP server '${alias}' ${parts.join("; ")} since this run was recorded`;
+}
+
 // src/agents/judgeContract.ts
 var JUDGE_RESULT_SCHEMA_PATH = "norn:judge-result";
 var JUDGE_INPUT_SCHEMA_PATH = "norn:judge-input";
@@ -185325,6 +185922,9 @@ function findJudgeAgentConflicts(agent) {
   if (agent.tools.length > 0) {
     conflicts.push(`declares tools (${agent.tools.map((tool) => tool.name).join(", ")})`);
   }
+  if (agent.grantedMcpServers && agent.grantedMcpServers.length > 0) {
+    conflicts.push(`grants MCP servers (${agent.grantedMcpServers.map((grant) => grant.alias).join(", ")})`);
+  }
   if (agent.callableAgents.length > 0) {
     conflicts.push(`declares agents (${agent.callableAgents.map((reference) => reference.name).join(", ")})`);
   }
@@ -185338,6 +185938,7 @@ function buildJudgeDefinition(agent) {
 
 ${JUDGE_FRAMING_PROMPT}` : JUDGE_FRAMING_PROMPT,
     tools: [],
+    grantedMcpServers: void 0,
     callableAgents: [],
     accepts: void 0,
     returns: void 0,
@@ -185430,7 +186031,16 @@ function describeUnmetExpectations(verdict) {
 var import_crypto6 = require("crypto");
 var PROVIDER_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_-]{0,63}$/;
 var PROVIDER_NAME_MAX_LENGTH = 64;
-var MAX_AGENT_PROVIDER_TURNS = 10;
+var AgentTurnLimitError = class extends Error {
+  constructor(provider, maxTurns, toolCallCount, lastToolName) {
+    super(`${provider} tool loop reached its ${maxTurns}-turn limit before the model finished.`);
+    this.provider = provider;
+    this.maxTurns = maxTurns;
+    this.toolCallCount = toolCallCount;
+    this.lastToolName = lastToolName;
+    this.name = "AgentTurnLimitError";
+  }
+};
 var AgentProviderRefusalError = class extends Error {
   constructor(message, rawText) {
     super(message);
@@ -185483,6 +186093,10 @@ function isAgentProviderMaxTokensRejection(error2) {
 function formatAgentProviderMaxTokensError(agentName, error2) {
   return `Agent '${agentName}' using provider '${error2.provider}' rejected configured max_tokens value ${error2.maxTokens}. Lower max_tokens for that agent or provider in norn.config.json. Provider response: ${error2.providerMessage}`;
 }
+function formatAgentTurnLimitError(agentName, outcome) {
+  const lastTool = outcome.lastToolName ? `, last calling '${outcome.lastToolName}'` : "";
+  return `Agent '${agentName}' reached its ${outcome.maxTurns}-turn limit after ${outcome.toolCallCount} tool call${outcome.toolCallCount === 1 ? "" : "s"}${lastTool}, and stopped before producing a final answer. Raise max_turns for this agent in ${outcome.sourcePath}:${outcome.lineNumber + 1}, or for every agent under 'agents' in norn.config.json. Each turn is a paid model call.`;
+}
 function agentInputToText(input2) {
   if (typeof input2 === "string") {
     return input2;
@@ -185712,7 +186326,7 @@ var AnthropicAgentAdapter = class {
         tool_choice: { type: "auto", disable_parallel_tool_use: true },
         output_config: outputConfig,
         thinking,
-        max_iterations: MAX_AGENT_PROVIDER_TURNS,
+        max_iterations: request.maxTurns,
         stream: false
       });
       let latest;
@@ -185742,7 +186356,12 @@ var AnthropicAgentAdapter = class {
       throw new Error(`Anthropic model reached max_tokens (${request.maxTokens}) before completing the response.`);
     }
     if (finalMessage.stop_reason === "tool_use") {
-      throw new Error(`Anthropic tool loop exceeded ${MAX_AGENT_PROVIDER_TURNS} model turns.`);
+      throw new AgentTurnLimitError(
+        this.provider,
+        request.maxTurns,
+        toolCalls.length,
+        toolCalls[toolCalls.length - 1]?.name
+      );
     }
     if (finalMessage.stop_reason === "model_context_window_exceeded") {
       throw new Error("Anthropic model exceeded its context window before completing the response.");
@@ -185961,7 +186580,7 @@ var GoogleAgentAdapter = class {
     let inputTokens = 0;
     let outputTokens = 0;
     let resolvedModelId2 = request.modelId;
-    for (let turn = 0; turn < MAX_AGENT_PROVIDER_TURNS; turn++) {
+    for (let turn = 0; turn < request.maxTurns; turn++) {
       const response = await client.models.generateContent({
         model: request.modelId,
         contents,
@@ -185993,8 +186612,13 @@ var GoogleAgentAdapter = class {
           "Google Gemini requested multiple tools in one model turn; parallel/fan-out tool calls are not supported."
         );
       }
-      if (turn === MAX_AGENT_PROVIDER_TURNS - 1) {
-        throw new Error(`Google Gemini tool loop exceeded ${MAX_AGENT_PROVIDER_TURNS} model turns.`);
+      if (turn === request.maxTurns - 1) {
+        throw new AgentTurnLimitError(
+          this.provider,
+          request.maxTurns,
+          toolCalls.length,
+          toolCalls[toolCalls.length - 1]?.name
+        );
       }
       const modelContent = getCandidate(response)?.content;
       if (!modelContent) {
@@ -186036,7 +186660,12 @@ var GoogleAgentAdapter = class {
         }]
       });
     }
-    throw new Error(`Google Gemini tool loop exceeded ${MAX_AGENT_PROVIDER_TURNS} model turns.`);
+    throw new AgentTurnLimitError(
+      this.provider,
+      request.maxTurns,
+      toolCalls.length,
+      toolCalls[toolCalls.length - 1]?.name
+    );
   }
 };
 
@@ -186060,13 +186689,13 @@ function __classPrivateFieldGet3(receiver, state, kind, f3) {
 
 // node_modules/openai/internal/utils/uuid.mjs
 var uuid43 = function() {
-  const { crypto: crypto9 } = globalThis;
-  if (crypto9?.randomUUID) {
-    uuid43 = crypto9.randomUUID.bind(crypto9);
-    return crypto9.randomUUID();
+  const { crypto: crypto10 } = globalThis;
+  if (crypto10?.randomUUID) {
+    uuid43 = crypto10.randomUUID.bind(crypto10);
+    return crypto10.randomUUID();
   }
   const u8 = new Uint8Array(1);
-  const randomByte = crypto9 ? () => crypto9.getRandomValues(u8)[0] : () => Math.random() * 255 & 255;
+  const randomByte = crypto10 ? () => crypto10.getRandomValues(u8)[0] : () => Math.random() * 255 & 255;
   return "10000000-1000-4000-8000-100000000000".replace(/[018]/g, (c) => (+c ^ randomByte() & 15 >> +c / 4).toString(16));
 };
 
@@ -197113,7 +197742,7 @@ var OpenAIAgentAdapter = class {
         parallel_tool_calls: false,
         response_format: responseFormat,
         ...tokenLimit
-      }, { maxChatCompletions: MAX_AGENT_PROVIDER_TURNS });
+      }, { maxChatCompletions: request.maxTurns });
       const [finalCompletion, usage] = await Promise.all([
         runner.finalChatCompletion(),
         runner.totalUsage()
@@ -197123,7 +197752,7 @@ var OpenAIAgentAdapter = class {
         throw new Error("OpenAI returned no completion choice.");
       }
       text = finalChoice.message.content || "";
-      this.assertCompleted(finalChoice.message, finalChoice.finish_reason, text, request.maxTokens);
+      this.assertCompleted(finalChoice.message, finalChoice.finish_reason, text, request, toolCalls);
       resolvedModelId2 = finalCompletion.model || request.modelId;
       inputTokens = usage.prompt_tokens;
       outputTokens = usage.completion_tokens;
@@ -197139,7 +197768,7 @@ var OpenAIAgentAdapter = class {
         throw new Error("OpenAI returned no assistant message.");
       }
       text = message.content || "";
-      this.assertCompleted(message, completion.choices[0]?.finish_reason, text, request.maxTokens);
+      this.assertCompleted(message, completion.choices[0]?.finish_reason, text, request, toolCalls);
       resolvedModelId2 = completion.model || request.modelId;
       inputTokens = completion.usage?.prompt_tokens ?? 0;
       outputTokens = completion.usage?.completion_tokens ?? 0;
@@ -197152,7 +197781,7 @@ var OpenAIAgentAdapter = class {
       resolvedModelId: resolvedModelId2
     };
   }
-  assertCompleted(message, finishReason, rawText, maxTokens) {
+  assertCompleted(message, finishReason, rawText, request, toolCalls) {
     if (message.refusal) {
       const refusalText = rawText || message.refusal;
       throw new AgentProviderRefusalError(`OpenAI model refused the request: ${message.refusal}`, refusalText);
@@ -197161,10 +197790,15 @@ var OpenAIAgentAdapter = class {
       throw new AgentProviderRefusalError("OpenAI blocked the response through its content filter.", rawText);
     }
     if (finishReason === "length") {
-      throw new Error(`OpenAI model reached its ${maxTokens}-token completion limit before finishing.`);
+      throw new Error(`OpenAI model reached its ${request.maxTokens}-token completion limit before finishing.`);
     }
     if (finishReason === "tool_calls" || (message.tool_calls?.length ?? 0) > 0) {
-      throw new Error(`OpenAI tool loop exceeded ${MAX_AGENT_PROVIDER_TURNS} model turns.`);
+      throw new AgentTurnLimitError(
+        this.provider,
+        request.maxTurns,
+        toolCalls.length,
+        toolCalls[toolCalls.length - 1]?.name
+      );
     }
   }
 };
@@ -197391,6 +198025,7 @@ var DEFAULT_AGENT_MAX_TOKENS = 16e3;
 var DEFAULT_LOCAL_AGENT_MAX_TOKENS = 4096;
 var DEFAULT_AGENT_MAX_DEPTH = 5;
 var DEFAULT_AGENT_MAX_INVOCATIONS = 25;
+var DEFAULT_AGENT_MAX_TURNS = 100;
 var DEFAULT_AGENT_CONTRACT_RETRIES = 2;
 
 // src/agents/agentConfig.ts
@@ -197402,6 +198037,7 @@ function resolveAgentRuntimeLimits(startPath, provider, agent) {
     maxTokens: agent.maxTokens ?? providerConfig?.max_tokens ?? loadedConfig?.max_tokens ?? defaultMaxTokens,
     maxDepth: agent.maxDepth ?? providerConfig?.max_depth ?? loadedConfig?.max_depth ?? DEFAULT_AGENT_MAX_DEPTH,
     maxInvocations: agent.maxInvocations ?? providerConfig?.max_invocations ?? loadedConfig?.max_invocations ?? DEFAULT_AGENT_MAX_INVOCATIONS,
+    maxTurns: agent.maxTurns ?? providerConfig?.max_turns ?? loadedConfig?.max_turns ?? DEFAULT_AGENT_MAX_TURNS,
     contractRetries: agent.contractRetries ?? providerConfig?.contract_retries ?? loadedConfig?.contract_retries ?? DEFAULT_AGENT_CONTRACT_RETRIES
   };
 }
@@ -197758,14 +198394,43 @@ function providerSafeToolName(index, authoredName) {
   const safe = authoredName.replace(/[^a-zA-Z0-9_-]/g, "_");
   return `norn_${index + 1}_${safe}`.slice(0, 64);
 }
+var MCP_CONTENT_PAYLOAD_FIELDS = ["data", "blob"];
+function contentBlockPayloadField(block) {
+  return MCP_CONTENT_PAYLOAD_FIELDS.find((field) => typeof block[field] === "string");
+}
+function summarizeBinaryContentBlock(block, payloadField) {
+  const payload = block[payloadField];
+  const rest = { ...block };
+  delete rest[payloadField];
+  return {
+    ...rest,
+    omitted: true,
+    // Base64 expands three bytes to four characters; enough for "how big was that".
+    approximateBytes: Math.floor(payload.length * 3 / 4)
+  };
+}
 function getMcpAgentToolOutput(result) {
   if (result.structuredContent !== void 0) {
-    return result.structuredContent;
+    return { output: result.structuredContent, warnings: [] };
   }
-  if (result.content.length > 0) {
-    return result.content;
+  if (result.content.length === 0) {
+    return { output: result.text, warnings: [] };
   }
-  return result.text;
+  const warnings = [];
+  const output2 = result.content.map((block) => {
+    const payloadField = contentBlockPayloadField(block);
+    if (!payloadField) {
+      return block;
+    }
+    const summarized = summarizeBinaryContentBlock(block, payloadField);
+    const kind = typeof block.type === "string" ? block.type : "binary";
+    const mimeType = typeof block.mimeType === "string" ? ` (${block.mimeType})` : "";
+    warnings.push(
+      `MCP tool '${result.tool}' on server '${result.server}' returned ${kind} content${mimeType} of about ${summarized.approximateBytes} bytes, omitted rather than sent to the model as base64. Configure the server not to return binary content, for example Playwright MCP's --image-responses omit.`
+    );
+    return summarized;
+  });
+  return { output: output2, warnings };
 }
 function unwrapDefaultToolInput(input2) {
   return input2.input;
@@ -197846,7 +198511,16 @@ var AgentInvocationRunner = class {
       model: resolvedModel.displayName,
       accepts: agent.builtInContracts?.accepts?.displayPath ?? agent.accepts?.authoredPath,
       returns: agent.builtInContracts?.returns?.displayPath ?? agent.returns?.authoredPath,
-      tools: agent.tools.map((tool) => tool.name),
+      // A grant is listed as the grant, not as the twenty-four tools it expands to.
+      // `Browser.*` is the authored truth and stays put when the server changes, while
+      // what was actually offered is already exact in `request.tools`, and what was
+      // actually called is already in the hop's `kind: 'mcp'` tool records. This also
+      // runs before any expansion exists, so a hop that failed early still has its
+      // definition on the trace.
+      tools: [
+        ...agent.tools.map((tool) => tool.name),
+        ...(agent.grantedMcpServers ?? []).map((grant) => `${grant.alias}.*`)
+      ],
       agents: agent.callableAgents.map((reference) => reference.name),
       sourcePath: agent.sourcePath
     });
@@ -197860,7 +198534,7 @@ var AgentInvocationRunner = class {
       }
     }
   }
-  createRequestSnapshot(request, agent) {
+  createRequestSnapshot(request, agent, mcpServerGrants) {
     const sourcePath = this.options.sourcePath ?? this.options.startPath;
     const tools = request.tools.map((tool) => ({
       name: tool.name,
@@ -197880,6 +198554,11 @@ var AgentInvocationRunner = class {
       ...request.outputSchema ? { outputSchema: cloneSnapshotValue(request.outputSchema, {}) } : {},
       ...request.outputSchemaName ? { outputSchemaName: request.outputSchemaName } : {},
       maxTokens: request.maxTokens,
+      maxTurns: request.maxTurns,
+      ...mcpServerGrants?.length ? { mcpServerGrants: mcpServerGrants.map((grant) => ({
+        alias: grant.alias,
+        toolNames: [...grant.toolNames]
+      })) } : {},
       agentSourcePath: agent.sourcePath,
       agentLineNumber: agent.lineNumber,
       ...sourcePath ? { sourcePath } : {},
@@ -198032,7 +198711,7 @@ var AgentInvocationRunner = class {
           adapted.warnings
         );
       }
-      const providerTools = await this.buildProviderTools(
+      const toolAssembly = await this.buildProviderTools(
         agent,
         hop,
         limits,
@@ -198044,6 +198723,7 @@ var AgentInvocationRunner = class {
         },
         () => fatalToolError
       );
+      const providerTools = toolAssembly.tools;
       const outputSchemaName = `${agent.name}_return`.replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 64);
       const providerRequest = {
         agent: agent.name,
@@ -198060,10 +198740,15 @@ var AgentInvocationRunner = class {
         outputSchema,
         outputSchemaName,
         maxTokens: limits.maxTokens,
+        maxTurns: limits.maxTurns,
         environment: this.options.environment,
         ...credentials ? { credentials } : {}
       };
-      hop.request = this.createRequestSnapshot(providerRequest, agent);
+      hop.request = this.createRequestSnapshot(
+        providerRequest,
+        agent,
+        toolAssembly.mcpServerGrants
+      );
       const adapter2 = this.options.providerRegistry.get(resolvedModel.provider);
       if (!adapter2) {
         throw new Error(`No provider adapter is registered for '${resolvedModel.provider}'.`);
@@ -198129,21 +198814,55 @@ var AgentInvocationRunner = class {
       const reportedError = fatalToolError ?? error2;
       if (reportedError instanceof AgentProviderMaxTokensError) {
         hop.error = formatAgentProviderMaxTokensError(agent.name, reportedError);
+      } else if (reportedError instanceof AgentTurnLimitError) {
+        hop.turnLimit = {
+          maxTurns: reportedError.maxTurns,
+          toolCallCount: reportedError.toolCallCount,
+          ...reportedError.lastToolName ? { lastToolName: reportedError.lastToolName } : {},
+          sourcePath: agent.sourcePath,
+          lineNumber: agent.lineNumber
+        };
+        hop.error = formatAgentTurnLimitError(agent.name, hop.turnLimit);
       } else {
         hop.error = reportedError instanceof Error ? reportedError.message : String(reportedError);
       }
       if (reportedError instanceof AgentProviderRefusalError) {
         hop.output.text = reportedError.rawText;
       }
+    } finally {
+      await this.options.mcpSessionManager?.closeScope(invocationId);
     }
     hop.output.model = hop.output.model || resolvedModel?.displayName || "";
     hop.output.ms = hop.output.ms || Date.now() - startedAt;
     this.options.onInvocationProgress?.({ phase: "completed", hop });
     return hop;
   }
+  /**
+   * Resolve one MCP alias for one invocation.
+   *
+   * The agent carries its own sidecar's blocks, so an alias means whatever that document says
+   * it means; anything it does not declare falls back to `norn.config.json`. The invocation id
+   * and call index only matter to a server that asked for a narrower `session` lifetime.
+   */
+  resolveMcpTargetFor(agent, alias, invocationId, callIndex) {
+    return resolveMcpTarget(alias, {
+      scope: agent.mcpServers,
+      startPath: this.options.startPath || process.cwd(),
+      envVariables: this.options.environment,
+      invocationId,
+      ...callIndex === void 0 ? {} : { callIndex }
+    });
+  }
   async buildProviderTools(agent, parentHop, callerLimits, callerModel, ancestors, requestToolsOverride, onFatal, getFatal) {
     const providerTools = [];
     const childInvocationCounts = /* @__PURE__ */ new Map();
+    const mcpCallCounts = /* @__PURE__ */ new Map();
+    const nextMcpCallIndex = (alias) => {
+      const key = alias.toLowerCase();
+      const next = mcpCallCounts.get(key) ?? 0;
+      mcpCallCounts.set(key, next + 1);
+      return next;
+    };
     const overrideKeys = /* @__PURE__ */ new Set();
     for (const tool of requestToolsOverride ?? []) {
       const key = `${tool.kind ?? ""}\0${tool.name.toLowerCase()}`;
@@ -198155,7 +198874,8 @@ var AgentInvocationRunner = class {
       overrideKeys.add(key);
     }
     let callerLimitBreaches = 0;
-    for (const reference of agent.tools) {
+    const expansion = agent.grantedMcpServers?.length ? await this.expandServerGrants(agent, parentHop) : void 0;
+    for (const reference of [...agent.tools, ...expansion?.references ?? []]) {
       const offeredOverride = requestToolsOverride?.find(
         (tool) => tool.kind === "mcp" && tool.name.toLowerCase() === reference.name.toLowerCase()
       );
@@ -198164,11 +198884,9 @@ var AgentInvocationRunner = class {
           `Agent graph changed at '${parentHop.hopPath}': current MCP tool '${reference.name}' was not offered by the recording.`
         );
       }
-      const definition = this.options.resolveMcpToolDefinition ? await this.options.resolveMcpToolDefinition(parentHop.hopPath, reference) : await this.options.mcpSessionManager.getToolDefinition(
-        this.options.startPath || process.cwd(),
-        reference.mcpAlias,
-        reference.toolName,
-        this.options.environment
+      const definition = this.options.resolveMcpToolDefinition ? await this.options.resolveMcpToolDefinition(parentHop.hopPath, reference, agent) : await this.options.mcpSessionManager.getToolDefinition(
+        this.resolveMcpTargetFor(agent, reference.mcpAlias, parentHop.invocationId),
+        reference.toolName
       );
       if (!definition) {
         throw new Error(
@@ -198196,16 +198914,25 @@ var AgentInvocationRunner = class {
           return executionOverride.output;
         }
         const result = await this.options.mcpSessionManager.callTool(
-          this.options.startPath || process.cwd(),
-          reference.mcpAlias,
+          this.resolveMcpTargetFor(
+            agent,
+            reference.mcpAlias,
+            parentHop.invocationId,
+            nextMcpCallIndex(reference.mcpAlias)
+          ),
           definition.name,
-          toolInput,
-          this.options.environment
+          toolInput
         );
         if (result.isError) {
           throw new Error(result.text || `MCP tool '${reference.name}' failed.`);
         }
-        return getMcpAgentToolOutput(result);
+        const { output: output2, warnings } = getMcpAgentToolOutput(result);
+        for (const warning of warnings) {
+          if (!parentHop.warnings.includes(warning)) {
+            parentHop.warnings.push(warning);
+          }
+        }
+        return output2;
       }));
     }
     for (const reference of agent.callableAgents) {
@@ -198432,7 +199159,27 @@ var AgentInvocationRunner = class {
         );
       }
     }
-    return providerTools;
+    return {
+      tools: providerTools,
+      ...expansion?.grants.length ? { mcpServerGrants: expansion.grants } : {}
+    };
+  }
+  /**
+   * Expand this agent's whole-server grants, live unless a caller supplied its own way.
+   *
+   * The built-in path lists the server through the same session the hop's tool calls will
+   * use, so a `session agent` server is listed inside its own session rather than a stray one.
+   */
+  async expandServerGrants(agent, parentHop) {
+    if (this.options.expandMcpServerGrants) {
+      return this.options.expandMcpServerGrants(parentHop.hopPath, agent);
+    }
+    return expandAgentMcpServerGrants(agent, async (alias) => {
+      const listed = await this.options.mcpSessionManager.listTools(
+        this.resolveMcpTargetFor(agent, alias, parentHop.invocationId)
+      );
+      return listed.tools.map((tool) => tool.name);
+    });
   }
 };
 
@@ -198446,16 +199193,16 @@ var fs22 = __toESM(require("fs"));
 var path25 = __toESM(require("path"));
 
 // src/secrets/crypto.ts
-var crypto8 = __toESM(require("crypto"));
+var crypto9 = __toESM(require("crypto"));
 var ENCRYPTED_SECRET_PREFIX = "ENC[";
 var ENCRYPTED_SECRET_SUFFIX = "]";
 var ENCRYPTED_SECRET_VERSION = "NORN_AGE_V1";
 var encryptedSecretRegex = /^ENC\[([A-Z0-9_]+):kid=([a-zA-Z0-9._-]+):([A-Za-z0-9_-]+)\]$/;
 function deriveEncryptionKey(sharedKey) {
-  return crypto8.createHash("sha256").update(sharedKey, "utf8").digest();
+  return crypto9.createHash("sha256").update(sharedKey, "utf8").digest();
 }
 function generateSharedSecretKey() {
-  return crypto8.randomBytes(32).toString("base64url");
+  return crypto9.randomBytes(32).toString("base64url");
 }
 function isEncryptedSecretValue(value) {
   return value.trim().startsWith(ENCRYPTED_SECRET_PREFIX) && value.trim().endsWith(ENCRYPTED_SECRET_SUFFIX);
@@ -198480,8 +199227,8 @@ function parseEncryptedSecretValue(value) {
 }
 function encryptSecretValue(plaintext, sharedKey, kid) {
   const key = deriveEncryptionKey(sharedKey);
-  const iv = crypto8.randomBytes(12);
-  const cipher = crypto8.createCipheriv("aes-256-gcm", key, iv);
+  const iv = crypto9.randomBytes(12);
+  const cipher = crypto9.createCipheriv("aes-256-gcm", key, iv);
   const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
   const authTag = cipher.getAuthTag();
   const payload = Buffer.concat([iv, authTag, ciphertext]).toString("base64url");
@@ -198504,7 +199251,7 @@ function decryptSecretValue(encryptedValue, sharedKey) {
   const authTag = raw.subarray(12, 28);
   const ciphertext = raw.subarray(28);
   const key = deriveEncryptionKey(sharedKey);
-  const decipher = crypto8.createDecipheriv("aes-256-gcm", key, iv);
+  const decipher = crypto9.createDecipheriv("aes-256-gcm", key, iv);
   decipher.setAuthTag(authTag);
   const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
   return decrypted.toString("utf8");
@@ -199869,6 +200616,7 @@ function loadAgentRunRecording(recordingFilePath, options = {}) {
 }
 
 // src/sequenceRunner.ts
+var MCP_PREFLIGHT_SCOPE = "norn-agent-preflight";
 function indentMultiline(value, prefix = "  ") {
   return value.split("\n").map((line2) => `${prefix}${line2}`).join("\n");
 }
@@ -201566,6 +202314,12 @@ async function runSequenceWithJar(sequenceContent, fileVariables, cookieJar, wor
     }
     return sqlOperationsBySource.get(executionContext.filePath);
   };
+  const getCurrentMcpScope = () => {
+    if (!executionContext?.filePath || !executionContext.mcpServersBySource) {
+      return void 0;
+    }
+    return executionContext.mcpServersBySource.get(executionContext.filePath);
+  };
   const getCurrentAgentScope = () => {
     if (!executionContext?.filePath || !executionContext.agentDefinitionsBySource) {
       return void 0;
@@ -201590,6 +202344,11 @@ async function runSequenceWithJar(sequenceContent, fileVariables, cookieJar, wor
     agentTrace.hops.push(...nestedTrace.hops);
   };
   const getCurrentMcpStartPath = () => executionContext?.filePath || workingDir || process.cwd();
+  const resolveDeterministicMcpTarget = (alias) => resolveMcpTarget(alias, {
+    ...getCurrentMcpScope() ? { scope: getCurrentMcpScope() } : {},
+    startPath: getCurrentMcpStartPath(),
+    envVariables: getRuntimeEnvironmentVariables(runtimeVariables)
+  });
   let requestIndex = 0;
   const ifStack = [];
   const shouldSkip = () => ifStack.length > 0 && ifStack.some((v) => !v);
@@ -201695,18 +202454,41 @@ async function runSequenceWithJar(sequenceContent, fileVariables, cookieJar, wor
   }
   try {
     const preflightedAgents = /* @__PURE__ */ new Set();
+    const agentDefinitionKey = (definition) => `${definition.sourcePath}\0${definition.name.toLowerCase()}`;
+    const mcpGrantExpansions = /* @__PURE__ */ new Map();
+    const expandMcpGrantsLive = (definition) => expandAgentMcpServerGrants(definition, async (alias) => {
+      const listed = await mcpSessionManager.listTools(resolveMcpTarget(alias, {
+        scope: definition.mcpServers,
+        startPath: getCurrentMcpStartPath(),
+        envVariables: getRuntimeEnvironmentVariables(runtimeVariables),
+        invocationId: MCP_PREFLIGHT_SCOPE
+      }));
+      return listed.tools.map((tool) => tool.name);
+    });
     const preflightAgentGraph = async (definition, scope) => {
-      const definitionKey = `${definition.sourcePath}\0${definition.name.toLowerCase()}`;
+      const definitionKey = agentDefinitionKey(definition);
       if (preflightedAgents.has(definitionKey)) {
         return;
       }
       preflightedAgents.add(definitionKey);
+      if (definition.grantedMcpServers?.length) {
+        mcpGrantExpansions.set(definitionKey, await expandMcpGrantsLive(definition));
+      }
       for (const tool of definition.tools) {
         await mcpSessionManager.getToolDefinition(
-          getCurrentMcpStartPath(),
-          tool.mcpAlias,
-          tool.toolName,
-          getRuntimeEnvironmentVariables(runtimeVariables)
+          resolveMcpTarget(tool.mcpAlias, {
+            // The agent's own sidecar wins; an alias with no block there falls
+            // back to the config nearest the running `.norn`.
+            scope: definition.mcpServers,
+            startPath: getCurrentMcpStartPath(),
+            envVariables: getRuntimeEnvironmentVariables(runtimeVariables),
+            // Preflight belongs to no invocation, so a server that asked to be
+            // isolated per agent gets a session of its own here too — closed the
+            // moment preflight ends, or the isolation it asked for would already
+            // be broken by the check that proves the tool exists.
+            invocationId: MCP_PREFLIGHT_SCOPE
+          }),
+          tool.toolName
         );
       }
       for (const reference of definition.callableAgents) {
@@ -201822,6 +202604,7 @@ async function runSequenceWithJar(sequenceContent, fileVariables, cookieJar, wor
       try {
         await preflightAgentGraph(definition, scope);
       } catch (error2) {
+        await mcpSessionManager.closeScope(MCP_PREFLIGHT_SCOPE);
         const message = `Agent '${definition.name}' tool preflight failed: ${error2 instanceof Error ? error2.message : String(error2)}`;
         errors.push(message);
         await emitFailure(message, step);
@@ -201837,6 +202620,7 @@ async function runSequenceWithJar(sequenceContent, fileVariables, cookieJar, wor
           agentTrace
         };
       }
+      await mcpSessionManager.closeScope(MCP_PREFLIGHT_SCOPE);
     }
     for (let stepIdx = 0; stepIdx < steps.length; stepIdx++) {
       const step = steps[stepIdx];
@@ -202129,6 +202913,7 @@ async function runSequenceWithJar(sequenceContent, fileVariables, cookieJar, wor
               sequenceName: executionContext?.sequenceName,
               runLineNumber: debugLocation.absoluteLine,
               rootInvocationIndex: rootInvocationIndex2,
+              expandMcpServerGrants: (_hopPath, grantedAgent) => mcpGrantExpansions.get(agentDefinitionKey(grantedAgent)) ?? expandMcpGrantsLive(grantedAgent),
               onInvocationProgress: (agentEvent) => {
                 const recordedEvent = cloneSerializableValue(agentEvent);
                 if (recordedEvent) {
@@ -202263,6 +203048,7 @@ ${describeUnmetExpectations(verdict).map((line2) => `  - ${line2}`).join("\n")}`
               sequenceName: executionContext?.sequenceName,
               runLineNumber: debugLocation.absoluteLine,
               rootInvocationIndex: rootInvocationIndex2,
+              expandMcpServerGrants: (_hopPath, grantedAgent) => mcpGrantExpansions.get(agentDefinitionKey(grantedAgent)) ?? expandMcpGrantsLive(grantedAgent),
               onInvocationProgress: (agentEvent) => {
                 const recordedEvent = cloneSerializableValue(agentEvent);
                 if (recordedEvent) {
@@ -202565,9 +203351,7 @@ ${describeUnmetExpectations(verdict).map((line2) => `  - ${line2}`).join("\n")}`
           }
           try {
             const listResult = await mcpSessionManager.listTools(
-              getCurrentMcpStartPath(),
-              parsed.serverAlias,
-              getRuntimeEnvironmentVariables(runtimeVariables)
+              resolveDeterministicMcpTarget(parsed.serverAlias)
             );
             if (parsed.variableName) {
               runtimeVariables[parsed.variableName] = listResult.tools;
@@ -202635,10 +203419,8 @@ ${describeUnmetExpectations(verdict).map((line2) => `  - ${line2}`).join("\n")}`
           let toolDefinition;
           try {
             toolDefinition = await mcpSessionManager.getToolDefinition(
-              getCurrentMcpStartPath(),
-              parsed.serverAlias,
-              parsed.toolName,
-              getRuntimeEnvironmentVariables(runtimeVariables)
+              resolveDeterministicMcpTarget(parsed.serverAlias),
+              parsed.toolName
             );
           } catch (error2) {
             const message = `MCP call failed for '${parsed.serverAlias}.${parsed.toolName}': ${error2?.message || String(error2)}`;
@@ -202671,11 +203453,9 @@ ${describeUnmetExpectations(verdict).map((line2) => `  - ${line2}`).join("\n")}`
           }
           try {
             const callResult = await mcpSessionManager.callTool(
-              getCurrentMcpStartPath(),
-              parsed.serverAlias,
+              resolveDeterministicMcpTarget(parsed.serverAlias),
               parsed.toolName,
-              boundArgs.params,
-              getRuntimeEnvironmentVariables(runtimeVariables)
+              boundArgs.params
             );
             if (parsed.variableName) {
               runtimeVariables[parsed.variableName] = callResult;
@@ -202984,6 +203764,7 @@ ${indentMultiline(userMessage)}`;
               sequenceLocationIndex: executionContext?.sequenceLocationIndex,
               mcpSessionManager,
               agentDefinitionsBySource: executionContext?.agentDefinitionsBySource,
+              mcpServersBySource: executionContext?.mcpServersBySource,
               agentProviderRegistry,
               agentWarningKeys,
               agentEventLog,
@@ -203816,6 +204597,13 @@ function redactAgentHopForJson(hop, redaction) {
     input: redactBody(hop.input, redaction),
     request: redactAgentRequestForJson(hop.request, redaction),
     error: hop.error ? redactString(hop.error, redaction) : void 0,
+    // Rides the hop like the judge verdict does, so it needs the same treatment: its strings
+    // are authored names and paths, redacted exactly as `agent` and `hopPath` are.
+    turnLimit: hop.turnLimit ? {
+      ...hop.turnLimit,
+      sourcePath: redactString(hop.turnLimit.sourcePath, redaction),
+      ...hop.turnLimit.lastToolName ? { lastToolName: redactString(hop.turnLimit.lastToolName, redaction) } : {}
+    } : void 0,
     warnings: hop.warnings.map((warning) => redactString(warning, redaction)),
     accepts: redactAgentContractForJson(hop.accepts, redaction),
     returns: redactAgentContractForJson(hop.returns, redaction),
@@ -204103,7 +204891,15 @@ function formatAgentHopAtDepth(hop, options, displayDepth) {
   for (const warning of hop.warnings) {
     lines.push(`${bodyIndent}${colors.warning(`warning: ${redactString(warning, redaction)}`)}`);
   }
-  if (hop.error) {
+  if (hop.turnLimit) {
+    const lastTool = hop.turnLimit.lastToolName ? `, last ${redactString(hop.turnLimit.lastToolName, redaction)}` : "";
+    lines.push(
+      `${bodyIndent}${colors.warning(`\u23F1 turn limit reached \u2014 ${hop.turnLimit.maxTurns} turns, ${hop.turnLimit.toolCallCount} tool calls${lastTool}`)}`
+    );
+    lines.push(
+      `${bodyIndent}    ${colors.dim(`raise max_turns in ${redactString(hop.turnLimit.sourcePath, redaction)}:${hop.turnLimit.lineNumber + 1}`)}`
+    );
+  } else if (hop.error) {
     const recoveredContractFailure = hop.retries.some(
       (retry2) => retry2.corrected && (retry2.contract === hop.accepts || retry2.contract === hop.returns)
     );
@@ -206944,6 +207740,13 @@ function deriveAgentHopPresentation(hop) {
     success: hop.success,
     depth: hop.depth,
     cycle: hop.cycle,
+    ...hop.turnLimit ? {
+      turnLimit: {
+        maxTurns: hop.turnLimit.maxTurns,
+        toolCallCount: hop.turnLimit.toolCallCount,
+        ...hop.turnLimit.lastToolName ? { lastToolName: hop.turnLimit.lastToolName } : {}
+      }
+    } : {},
     ...hop.error ? { error: hop.error } : {},
     warnings: [...hop.warnings],
     ...hop.judge ? { judge: buildAgentJudgePresentation(hop.judge) } : {},
@@ -207237,13 +208040,55 @@ var ReplayCoordinator = class {
       }))
     };
   }
-  async resolveMcpToolDefinition(hopPath, reference, startPath, environment, manager) {
+  /**
+   * Expand a whole-server grant without opening a session.
+   *
+   * Replay's contract is zero MCP side effects, so a replayed hop reads the tool names back
+   * out of its own recording. A live tail lists for real and, because it now has both
+   * numbers, is the one place that can say the server's tool set moved.
+   */
+  async expandMcpServerGrants(hopPath, agent, startPath, environment, manager, diagnostics) {
+    if (this.isLiveInvocation(hopPath)) {
+      const recorded = this.getRecordedHop(hopPath)?.request?.mcpServerGrants;
+      return expandAgentMcpServerGrants(agent, async (alias) => {
+        const listed = await manager.listTools(resolveMcpTarget(alias, {
+          scope: agent.mcpServers,
+          startPath,
+          envVariables: environment
+        }));
+        const toolNames = listed.tools.map((tool) => tool.name);
+        const before = recordedGrantToolNames(recorded, alias);
+        const drift = before && describeGrantToolDrift(alias, before, toolNames);
+        if (drift) {
+          diagnostics.push(`${drift} at '${hopPath}'; hop-path replay remains valid.`);
+        }
+        return toolNames;
+      });
+    }
+    const recordedRequest = this.getRecordedHop(hopPath)?.request;
+    return expandAgentMcpServerGrants(agent, async (alias) => {
+      const recorded = recordedGrantToolNames(recordedRequest?.mcpServerGrants, alias);
+      if (recorded) {
+        return recorded;
+      }
+      const offered = (recordedRequest?.tools ?? []).filter((tool) => tool.kind === "mcp" && tool.name.toLowerCase().startsWith(`${alias.toLowerCase()}.`)).map((tool) => tool.name.slice(alias.length + 1));
+      if (offered.length === 0) {
+        throw new Error(
+          `Agent graph changed at '${hopPath}': agent '${agent.name}' grants MCP server '${alias}', which the recording did not offer.`
+        );
+      }
+      return offered;
+    });
+  }
+  async resolveMcpToolDefinition(hopPath, reference, agent, startPath, environment, manager) {
     if (this.isLiveInvocation(hopPath)) {
       const definition = await manager.getToolDefinition(
-        startPath,
-        reference.mcpAlias,
-        reference.toolName,
-        environment
+        resolveMcpTarget(reference.mcpAlias, {
+          scope: agent.mcpServers,
+          startPath,
+          envVariables: environment
+        }),
+        reference.toolName
       );
       return {
         name: definition.name,
@@ -207441,7 +208286,7 @@ function mergeDefinition(definitions, seen, definition) {
   seen.add(key);
   definitions.push(definition);
 }
-function addPromptDiagnostics(recording, scopes, runtimeVariables, recordingFilePath, projectRoot, diagnostics) {
+function addSourceDriftDiagnostics(recording, scopes, runtimeVariables, recordingFilePath, projectRoot, diagnostics) {
   for (const hop of flattenAgentReplayHops(recording.trace.hops)) {
     if (!hop.request?.sourcePath) {
       continue;
@@ -207456,6 +208301,14 @@ function addPromptDiagnostics(recording, scopes, runtimeVariables, recordingFile
       continue;
     }
     const comparable = hop.returns?.path === JUDGE_RESULT_SCHEMA_PATH ? buildJudgeDefinition(definition) : definition;
+    const recordedAliases = (hop.request.mcpServerGrants ?? []).map((grant) => grant.alias);
+    const currentAliases = (comparable.grantedMcpServers ?? []).map((grant) => grant.alias);
+    const sameGrants = recordedAliases.length === currentAliases.length && recordedAliases.every((alias) => currentAliases.some((current2) => current2.toLowerCase() === alias.toLowerCase()));
+    if (!sameGrants) {
+      diagnostics.push(
+        `Whole-server grants changed at '${hop.hopPath || hop.agent}': recorded ${recordedAliases.join(", ") || "none"}, now ${currentAliases.join(", ") || "none"}; hop-path replay remains valid.`
+      );
+    }
     const current = substituteVariables(comparable.systemPrompt, runtimeVariables);
     if (/\{\{[^}]+\}\}/.test(current) || current === hop.request.systemPrompt) {
       continue;
@@ -207485,7 +208338,7 @@ async function replayAgentRun(options) {
     options.recording,
     options.projectRoot
   );
-  addPromptDiagnostics(
+  addSourceDriftDiagnostics(
     options.recording,
     options.agentDefinitionsBySource,
     runtimeVariables,
@@ -207521,13 +208374,22 @@ async function replayAgentRun(options) {
         runLineNumber: recordedRoot.request?.runLineNumber,
         rootInvocationIndex: rootInvocationIndex(recordedRoot),
         resolveRequestOverride: (hopPath) => coordinator.resolveRequestOverride(hopPath),
-        resolveMcpToolDefinition: (hopPath, reference) => coordinator.resolveMcpToolDefinition(
+        resolveMcpToolDefinition: (hopPath, reference, agent) => coordinator.resolveMcpToolDefinition(
           hopPath,
           reference,
+          agent,
           rootSourcePath,
           options.environment,
           manager
         ),
+        expandMcpServerGrants: (hopPath, agent) => coordinator.expandMcpServerGrants(
+          hopPath,
+          agent,
+          rootSourcePath,
+          options.environment,
+          manager,
+          diagnostics
+        ),
         executeMcpToolOverride: (hopPath, reference, input2) => coordinator.executeMcpToolOverride(hopPath, reference, input2),
         onInvocationProgress: (event) => {
           generatedEvents.push(event);
@@ -208795,7 +209657,8 @@ ${fileContent}` : fileContent;
               filePath: targetSequenceSourcePath,
               sequenceName: targetSeq.name,
               environment: envValidationContext,
-              agentDefinitionsBySource: importResult.agentDefinitionsBySource
+              agentDefinitionsBySource: importResult.agentDefinitionsBySource,
+              mcpServersBySource: importResult.mcpServersBySource
             }
           );
           caseResult.name = `${targetSeq.name}${caseLabel}`;
@@ -208819,7 +209682,8 @@ ${fileContent}` : fileContent;
             filePath: targetSequenceSourcePath,
             sequenceName: targetSeq.name,
             environment: envValidationContext,
-            agentDefinitionsBySource: importResult.agentDefinitionsBySource
+            agentDefinitionsBySource: importResult.agentDefinitionsBySource,
+            mcpServersBySource: importResult.mcpServersBySource
           }
         );
         seqResult.name = targetSeq.name;
@@ -208946,7 +209810,8 @@ ${fileContent}` : fileContent;
       {
         filePath,
         environment: envValidationContext,
-        agentDefinitionsBySource: importResult.agentDefinitionsBySource
+        agentDefinitionsBySource: importResult.agentDefinitionsBySource,
+        mcpServersBySource: importResult.mcpServersBySource
       },
       options.output === "pretty" ? (sequenceName) => createAgentProgressCallback(sequenceName, colors, redaction2, options.verbose) : void 0
     );