shortcutxl 0.3.50 → 0.3.51

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## [0.3.51]
+
+- **TUI rendering and text selection** - Improved TUI rendering, scrolling. Fixed text highlighting and selection for copy pastes.
+- **Agentic MCP setup** - Agents can now help set up MCP servers through `shortcut mcp add/list/get/login/logout/remove`, with clearer login, logs, and OAuth settings.
+- **User-requested session settings** - When asked, agents can inspect available models and thinking levels or apply your requested session change.
+- **Skill sync clarity** - Skill sync now shows startup differences plus per-file upload/download changes, source, and visibility.
+- **Fast mode toggle** - Fast Mode now shows in the footer and can be toggled with `alt+f` or `/fast`, with clearer availability warnings.
+- **Scrollable approvals** - Large approval and permission dialogs now scroll properly, including spreadsheet change tables in small terminals.
+
 ## [0.3.50]
 
 - **MCP-enabled task agents** - General task agents can now use connected MCP servers, giving delegated work access to the same external tools and resources as the main CLI.

package/dist/app/agent-session.d.ts

@@ -261,6 +261,10 @@ export declare class AgentSession {
     get model(): Model<any> | undefined;
     /** Current thinking level */
     get thinkingLevel(): ThinkingLevel;
+    get isFastModeEnabled(): boolean;
+    get isFastModeAvailable(): boolean;
+    setFastModeEnabled(enabled: boolean): void;
+    toggleFastMode(): boolean;
     /** Whether agent is currently streaming a response */
     get isStreaming(): boolean;
     /** Current effective system prompt (includes any per-turn extension modifications) */

package/dist/app/agent-session.js

@@ -16,6 +16,7 @@ import { isContextOverflow } from '@mariozechner/pi-ai';
 import { SessionState } from '../core/session-state.js';
 import { createCompactionActions, createErrorRecoveryActions, triggerCompactionIfNeeded } from '../core/session/compaction-bridge.js';
 import { SessionCompaction } from '../core/session/session-compaction.js';
+import { isShortcutFastModeModel } from '../model-ids.js';
 import { formatFileUploadsContext, mergeFileUploads } from './file-uploads.js';
 import { expandPromptTemplate } from './resources/prompt-template-expansion.js';
 import { parseSkillBlock } from './resources/skill-block.js';
@@ -26,6 +27,7 @@ import { emitExtensionEvent } from './session/extension-emitter.js';
 import { ExtensionLifecycle } from './session/extension-lifecycle.js';
 import { ModelManager } from './session/model-manager.js';
 import { resolvePendingRefreshOverride } from './session/pending-refresh-overrides.js';
+import { formatRuntimePermissionBypassContext } from './session/permission-context.js';
 import { PersistenceHandler } from './session/persistence-handler.js';
 import { assertNotExtensionCommand, buildMessageContent, normalizeUserContent, tryExtensionCommand } from './session/prompt-pipeline.js';
 import { QueueTracker } from './session/queue-tracker.js';
@@ -582,6 +584,24 @@ export class AgentSession {
     get thinkingLevel() {
         return this.agent.state.thinkingLevel;
     }
+    get isFastModeEnabled() {
+        return this.isFastModeAvailable && this.agent.speed === 'fast';
+    }
+    get isFastModeAvailable() {
+        return isShortcutFastModeModel(this.model);
+    }
+    setFastModeEnabled(enabled) {
+        this.agent.speed = enabled && this.isFastModeAvailable ? 'fast' : undefined;
+    }
+    toggleFastMode() {
+        if (!this.isFastModeAvailable) {
+            this.agent.speed = undefined;
+            return false;
+        }
+        const enabled = !this.isFastModeEnabled;
+        this.setFastModeEnabled(enabled);
+        return enabled;
+    }
     /** Whether agent is currently streaming a response */
     get isStreaming() {
         return this.agent.state.isStreaming;
@@ -792,18 +812,30 @@ export class AgentSession {
             timestamp: Date.now()
         });
         this.lastPrePromptDetails = undefined;
+        const prePromptContextParts = [formatRuntimePermissionBypassContext(this.permissionPolicy)];
+        let prePromptDetails;
         if (this._prePromptContext) {
             const ctx = await this._prePromptContext();
             if (ctx) {
                 this.lastPrePromptDetails = ctx.details;
-                messages.push({
-                    role: 'custom',
-                    customType: 'prePromptContext',
-                    content: ctx.text,
-                    display: false,
-                    details: ctx.details,
-                    timestamp: Date.now()
-                });
+                prePromptDetails = ctx.details;
+                prePromptContextParts.unshift(ctx.text);
+            }
+        }
+        messages.push({
+            role: 'custom',
+            customType: 'prePromptContext',
+            content: prePromptContextParts.join('\n\n'),
+            display: false,
+            details: prePromptDetails,
+            timestamp: Date.now()
+        });
+        for (const message of messages) {
+            if (message.role === 'custom') {
+                this.sessionManager.appendCustomMessageEntry(message.customType, message.content, message.display, message.details);
+            }
+            else if (message.role === 'user') {
+                this.sessionManager.appendMessage(message);
             }
         }
         // Inject any pending "nextTurn" messages as context alongside the user message
@@ -1149,11 +1181,16 @@ export class AgentSession {
     // =========================================================================
     /** Switch the session's active LLM to `model`, persisting the change. */
     async setModel(model) {
-        return this._models.setModel(model);
+        await this._models.setModel(model);
+        if (!this.isFastModeAvailable)
+            this.setFastModeEnabled(false);
     }
     /** Cycle to the next configured model and report the switch result. */
     async cycleModel(direction = 'forward') {
-        return this._models.cycleModel(direction);
+        const result = await this._models.cycleModel(direction);
+        if (!this.isFastModeAvailable)
+            this.setFastModeEnabled(false);
+        return result;
     }
     /** Set the model's reasoning/thinking level for subsequent turns. */
     setThinkingLevel(level) {

package/dist/app/approvals/types.d.ts

@@ -66,4 +66,9 @@ export interface TaskSpawnApprovalData {
     /** Launch mode requested by the tool call before user approval overrides. */
     requestedRunInBackground: boolean;
 }
+export interface SwitchModeApprovalData {
+    currentMode: string;
+    targetMode: string;
+    reason?: string;
+}
 //# sourceMappingURL=types.d.ts.map

package/dist/app/auth/auth-storage.js

@@ -10,12 +10,7 @@ import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'f
 import { dirname, join } from 'path';
 import lockfile from 'proper-lockfile';
 import { getAgentDir } from '../../config.js';
-/**
- * Shared lock options so sync and async locks always use the same lock path.
- * realpath: false ensures both create the same .lock directory on Windows,
- * where fs.realpath can normalize paths differently.
- */
-const LOCK_BASE_OPTIONS = { realpath: false };
+import { LOCK_BASE_OPTIONS, lockSyncWithRetries } from '../../shared/files/lock-utils.js';
 export class FileAuthStorageBackend {
     authPath;
     constructor(authPath = join(getAgentDir(), 'auth.json')) {
@@ -38,7 +33,7 @@ export class FileAuthStorageBackend {
         this.ensureFileExists();
         let release;
         try {
-            release = lockfile.lockSync(this.authPath, LOCK_BASE_OPTIONS);
+            release = lockSyncWithRetries(this.authPath);
             const current = existsSync(this.authPath) ? readFileSync(this.authPath, 'utf-8') : undefined;
             const { result, next } = fn(current);
             if (next !== undefined) {

package/dist/app/extensions/slash-commands.js

@@ -15,6 +15,7 @@ const ALL_BUILTIN_SLASH_COMMANDS = [
     // Model
     { name: 'model', description: 'Select model' },
     { name: 'thinking', description: 'Select thinking level' },
+    { name: 'fast', description: 'Toggle fast mode for subsequent turns' },
     { name: 'hide-thinking', description: 'Toggle visibility of thinking blocks' },
     // Checkpointing
     { name: 'resume', description: 'Resume a different session' },

package/dist/app/index.d.ts

@@ -48,6 +48,8 @@ export { readSkillProposalReviewSnapshot, type SkillProposalReviewSnapshot } fro
 export type { StartupInfoEntry } from './startup-info.js';
 export { downloadSkillsWithApproval } from './sync/skills-download.js';
 export type { SkillDownloadApprovalHandler, SkillDownloadApprovalRequest, SkillsDownloadResult } from './sync/skills-download.js';
+export { checkSkillsSyncStatus } from './sync/skills-status.js';
+export type { SkillSyncStatusItem, SkillsSyncStatus } from './sync/skills-status.js';
 export { uploadSkills } from './sync/skills-upload.js';
 export type { SkillUploadApprovalRequest, SkillsUploadResult } from './sync/skills-upload.js';
 export * from './tools/index.js';

package/dist/app/index.js

@@ -37,6 +37,7 @@ export { default as skillProposalsExtension } from './skill-proposals/extension.
 export { getSkillProposalRoots } from './skill-proposals/proposal-fs.js';
 export { readSkillProposalReviewSnapshot } from './skill-proposals/review.js';
 export { downloadSkillsWithApproval } from './sync/skills-download.js';
+export { checkSkillsSyncStatus } from './sync/skills-status.js';
 export { uploadSkills } from './sync/skills-upload.js';
 export * from './tools/index.js';
 export { buildWorkbookPromptContext, fetchWorkbookConnectionState, formatWorkbookScopePromptContext } from './workbook-context/workbook-summary.js';

package/dist/app/local/tools/execute-code/observability.d.ts

@@ -0,0 +1,4 @@
+import type { ShortcutClientLogger } from '../../../observability/index.js';
+import type { ExcelExecApprovalObservability } from './executor.js';
+export declare function createExecuteCodeApprovalObservability(clientLogger: ShortcutClientLogger): ExcelExecApprovalObservability;
+//# sourceMappingURL=observability.d.ts.map

package/dist/app/local/tools/execute-code/observability.js

@@ -0,0 +1,57 @@
+const TOOL_NAME = 'execute_code';
+export function createExecuteCodeApprovalObservability(clientLogger) {
+    return {
+        onRequested: (request) => {
+            clientLogger.info({
+                module: 'tool',
+                event: 'tool_approval_requested',
+                data: {
+                    tool_name: TOOL_NAME,
+                    approval_kind: request.payload.kind
+                }
+            });
+        },
+        onAccepted: (request, choice) => {
+            clientLogger.info({
+                module: 'tool',
+                event: 'tool_approval_accepted',
+                data: {
+                    tool_name: TOOL_NAME,
+                    approval_kind: request.payload.kind,
+                    accept_all: choice === 'Accept All'
+                }
+            });
+        },
+        onRejected: (request) => {
+            clientLogger.warn({
+                module: 'tool',
+                event: 'tool_approval_rejected',
+                data: {
+                    tool_name: TOOL_NAME,
+                    approval_kind: request.payload.kind
+                }
+            });
+        },
+        onReverted: (request) => {
+            clientLogger.info({
+                module: 'tool',
+                event: 'tool_approval_reverted',
+                data: {
+                    tool_name: TOOL_NAME,
+                    approval_kind: request.payload.kind
+                }
+            });
+        },
+        onRevertFailed: (request) => {
+            clientLogger.error({
+                module: 'tool',
+                event: 'tool_approval_revert_failed',
+                data: {
+                    tool_name: TOOL_NAME,
+                    approval_kind: request.payload.kind
+                }
+            });
+        }
+    };
+}
+//# sourceMappingURL=observability.js.map

package/dist/app/mcp/auth-status.d.ts

@@ -1,4 +1,12 @@
 import type { AuthStorage } from '../auth/auth-storage.js';
+import type { McpOAuthStore } from './oauth-state-store.js';
 import { type McpAuthStatus, type McpServerConfig } from './types.js';
-export declare function getMcpAuthStatus(serverName: string, config: McpServerConfig, authStorage?: AuthStorage): Promise<McpAuthStatus>;
+export type McpAuthDiscoveryMode = 'never' | 'cached' | 'network';
+export interface ResolveMcpAuthStatusOptions {
+    authStorage?: AuthStorage;
+    mcpOAuthStore?: McpOAuthStore;
+    discovery?: McpAuthDiscoveryMode;
+}
+export declare function resolveMcpAuthStatus(serverName: string, config: McpServerConfig, options?: ResolveMcpAuthStatusOptions): Promise<McpAuthStatus>;
+export declare function getMcpAuthStatus(serverName: string, config: McpServerConfig, authStorage?: AuthStorage, mcpOAuthStore?: McpOAuthStore): Promise<McpAuthStatus>;
 //# sourceMappingURL=auth-status.d.ts.map

package/dist/app/mcp/auth-status.js

@@ -1,33 +1,44 @@
 import { getSecret } from '../connectors/secret-store.js';
 import { getHostedMcpOAuthProviderId } from './hosted-oauth-id.js';
+import { resolveHostedMcpOAuthTimeoutMs, supportsHostedMcpOAuth } from './oauth-discovery.js';
 import { isHostedServerConfig, isStdioServerConfig } from './types.js';
 function hasConfiguredHeaders(headers) {
     return !!headers && Object.keys(headers).length > 0;
 }
-export async function getMcpAuthStatus(serverName, config, authStorage) {
+export async function resolveMcpAuthStatus(serverName, config, options = {}) {
     if (isStdioServerConfig(config)) {
         return 'unsupported';
     }
     const staticHeaders = { ...(config.headers ?? {}) };
     const secretHeaders = config.connection ? getSecret(config.connection) : undefined;
-    if (isHostedServerConfig(config) && config.oauth) {
-        if (!authStorage) {
-            return hasConfiguredHeaders(staticHeaders) || hasConfiguredHeaders(secretHeaders)
-                ? 'configured'
-                : 'not_logged_in';
-        }
-        const credential = authStorage.get(getHostedMcpOAuthProviderId(serverName, config));
-        if (credential?.type === 'oauth') {
+    if (hasConfiguredHeaders(staticHeaders) || hasConfiguredHeaders(secretHeaders)) {
+        return 'configured';
+    }
+    if (isHostedServerConfig(config)) {
+        const discovery = options.discovery ?? 'cached';
+        const providerId = getHostedMcpOAuthProviderId(serverName, config);
+        if (options.authStorage?.get(providerId)?.type === 'oauth') {
             return 'oauth';
         }
-        return hasConfiguredHeaders(staticHeaders) || hasConfiguredHeaders(secretHeaders)
-            ? 'configured'
-            : 'not_logged_in';
-    }
-    if (Object.keys(staticHeaders).length > 0 ||
-        (secretHeaders && Object.keys(secretHeaders).length > 0)) {
-        return 'configured';
+        if (config.oauth ||
+            (discovery !== 'never' && options.mcpOAuthStore?.getDiscoveryState(providerId))) {
+            return 'not_logged_in';
+        }
+        if (discovery === 'network' &&
+            (await supportsHostedMcpOAuth(serverName, config, options.mcpOAuthStore, {
+                timeoutMs: resolveHostedMcpOAuthTimeoutMs(config)
+            }).catch(() => false))) {
+            return 'not_logged_in';
+        }
+        return 'unsupported';
     }
     return 'unsupported';
 }
+export async function getMcpAuthStatus(serverName, config, authStorage, mcpOAuthStore) {
+    return resolveMcpAuthStatus(serverName, config, {
+        authStorage,
+        mcpOAuthStore,
+        discovery: 'cached'
+    });
+}
 //# sourceMappingURL=auth-status.js.map

package/dist/app/mcp/catalog.d.ts

@@ -7,7 +7,7 @@
  *
  * Use mcp_describe(server) to get full tool details.
  */
-import type { McpAuthStatus, McpConnection, McpServerStatus } from './types.js';
+import type { McpAuthStatus, McpConnection, McpFailureKind, McpServerStatus } from './types.js';
 /**
  * Build a compact tool catalog — just server names and tool names.
  * Detailed descriptions are available via mcp_describe.
@@ -21,6 +21,7 @@ export declare function buildStatusLine(entries: Array<{
     name: string;
     connected?: McpConnection;
     failure?: string;
+    failureKind?: McpFailureKind;
     authStatus: McpAuthStatus;
     transport: McpServerStatus['transport'];
 }>): string;

package/dist/app/mcp/catalog.js

@@ -7,6 +7,7 @@
  *
  * Use mcp_describe(server) to get full tool details.
  */
+import { getAgentLogPath } from '../../shared/logging/agent-log.js';
 /**
  * Build a compact tool catalog — just server names and tool names.
  * Detailed descriptions are available via mcp_describe.
@@ -41,7 +42,7 @@ function formatAuthSuffix(authStatus) {
         case 'oauth':
             return 'oauth';
         case 'not_logged_in':
-            return 'login required';
+            return 'needs login';
         case 'unsupported':
         default:
             return 'no auth';
@@ -49,6 +50,7 @@ function formatAuthSuffix(authStatus) {
 }
 export function buildStatusLine(entries) {
     const parts = [];
+    let hasFailure = false;
     for (const entry of entries) {
         const authSuffix = entry.transport === 'streamable_http' && entry.authStatus !== 'unsupported'
             ? `, ${formatAuthSuffix(entry.authStatus)}`
@@ -57,12 +59,22 @@ export function buildStatusLine(entries) {
             parts.push(`${entry.name} (${entry.connected.tools.length} tools${authSuffix})`);
         }
         else if (entry.failure) {
-            parts.push(`${entry.name} (failed${authSuffix})`);
+            hasFailure = true;
+            if (entry.failureKind === 'auth_required') {
+                parts.push(`${entry.name} (needs login - run /login -> MCP: ${entry.name})`);
+            }
+            else {
+                parts.push(`${entry.name} (failed)`);
+            }
         }
         else {
             parts.push(`${entry.name} (${formatAuthSuffix(entry.authStatus)})`);
         }
     }
-    return parts.length > 0 ? `[MCP] ${parts.join(', ')}` : '';
+    if (parts.length === 0) {
+        return '';
+    }
+    const logSuffix = hasFailure ? `; logs: ${getAgentLogPath()}` : '';
+    return `[MCP] ${parts.join(', ')}${logSuffix}`;
 }
 //# sourceMappingURL=catalog.js.map

package/dist/app/mcp/config.d.ts

@@ -1,20 +1,25 @@
 /**
- * Load and merge MCP server configs from global + project paths.
+ * Load MCP server config from the global agent directory.
  *
- * Global:  ~/.shortcut/agent/mcp.json
- * Project: .shortcut/mcp.json (in cwd)
- *
- * Project servers override global servers with the same name.
+ * MCPs are user-level integrations for ShortcutXL spreadsheet sessions, not
+ * project-local coding config.
  */
-import { type McpServerConfig } from './types.js';
+import { type McpConfig, type McpServerConfig } from './types.js';
+export declare function getMcpConfigPath(globalConfigDir: string): string;
+export declare function readMcpConfigFile(path: string): McpConfig;
+export declare function writeMcpConfigFile(path: string, config: McpConfig): void;
+export declare function upsertMcpServerConfig(path: string, name: string, config: McpServerConfig, options?: {
+    force?: boolean;
+}): void;
+export declare function removeMcpServerConfig(path: string, name: string): boolean;
+export declare function validateServerConfig(name: string, cfg: unknown): cfg is McpServerConfig;
+export declare function normalizeServerConfig(name: string, cfg: McpServerConfig): McpServerConfig;
 interface LoadConfigOptions {
     cwd: string;
     globalConfigDir: string;
 }
 /**
- * Load and merge MCP server configs from global and project paths.
- * Project-local servers override global servers with the same name.
- * Warns on secrets found in project-local config.
+ * Load MCP server configs from the global agent path only.
  */
 export declare function loadMcpConfig(options: LoadConfigOptions): Record<string, McpServerConfig>;
 export {};

package/dist/app/mcp/config.js

@@ -1,40 +1,61 @@
 /**
- * Load and merge MCP server configs from global + project paths.
+ * Load MCP server config from the global agent directory.
  *
- * Global:  ~/.shortcut/agent/mcp.json
- * Project: .shortcut/mcp.json (in cwd)
- *
- * Project servers override global servers with the same name.
+ * MCPs are user-level integrations for ShortcutXL spreadsheet sessions, not
+ * project-local coding config.
  */
-import { existsSync, readFileSync } from 'fs';
-import { join } from 'path';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { dirname, join } from 'path';
 import { log } from '../../shared/logging/agent-log.js';
 const TAG = 'mcp';
 const MCP_CONFIG_FILENAME = 'mcp.json';
-/** Patterns that look like secrets — warn if found in project-local config. */
-const SECRET_PATTERNS = [/^ghp_/, /^sk-/, /^xoxb-/, /^xoxp-/, /^gho_/, /^github_pat_/];
-function looksLikeSecret(value) {
-    return SECRET_PATTERNS.some((p) => p.test(value));
+export function getMcpConfigPath(globalConfigDir) {
+    return join(globalConfigDir, MCP_CONFIG_FILENAME);
 }
-function parseConfigFile(path) {
+export function readMcpConfigFile(path) {
     if (!existsSync(path))
-        return null;
+        return { mcpServers: {} };
     try {
         const raw = readFileSync(path, 'utf-8');
         const parsed = JSON.parse(raw);
         if (!parsed || typeof parsed !== 'object' || !parsed.mcpServers) {
             log.warn(TAG, `MCP config at ${path} missing "mcpServers" key — skipping.`);
-            return null;
+            return { mcpServers: {} };
+        }
+        if (typeof parsed.mcpServers !== 'object' || Array.isArray(parsed.mcpServers)) {
+            log.warn(TAG, `MCP config at ${path} has invalid "mcpServers" shape — skipping.`);
+            return { mcpServers: {} };
         }
-        return parsed;
+        return { mcpServers: parsed.mcpServers };
     }
     catch (err) {
         const msg = err instanceof SyntaxError ? err.message : String(err);
         log.warn(TAG, `Failed to parse ${path}: ${msg}`);
-        return null;
+        return { mcpServers: {} };
+    }
+}
+export function writeMcpConfigFile(path, config) {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(config, null, 2) + '\n', 'utf-8');
+}
+export function upsertMcpServerConfig(path, name, config, options = {}) {
+    const existing = readMcpConfigFile(path);
+    if (!options.force && Object.prototype.hasOwnProperty.call(existing.mcpServers, name)) {
+        throw new Error(`MCP server '${name}' already exists in ${path}. Choose a different name or rerun with --force to replace it.`);
+    }
+    existing.mcpServers[name] = config;
+    writeMcpConfigFile(path, existing);
+}
+export function removeMcpServerConfig(path, name) {
+    const config = readMcpConfigFile(path);
+    if (!Object.prototype.hasOwnProperty.call(config.mcpServers, name)) {
+        return false;
     }
+    delete config.mcpServers[name];
+    writeMcpConfigFile(path, config);
+    return true;
 }
-function validateServerConfig(name, cfg) {
+export function validateServerConfig(name, cfg) {
     if (!cfg || typeof cfg !== 'object') {
         log.warn(TAG, `MCP server '${name}': config must be an object — skipping.`);
         return false;
@@ -67,7 +88,7 @@ function normalizeBoolean(serverName, fieldName, value) {
     }
     return value;
 }
-function normalizeServerConfig(name, cfg) {
+export function normalizeServerConfig(name, cfg) {
     const { timeout: legacyTimeout, startupTimeoutMs: rawStartupTimeoutMs, toolCallTimeoutMs: rawToolCallTimeoutMs, resetToolCallTimeoutOnProgress: rawResetToolCallTimeoutOnProgress, maxToolCallTotalTimeoutMs: rawMaxToolCallTotalTimeoutMs, ...rest } = cfg;
     const startupTimeoutMs = normalizePositiveInt(name, 'startupTimeoutMs', rawStartupTimeoutMs) ??
         normalizePositiveInt(name, 'timeout', legacyTimeout);
@@ -84,53 +105,18 @@ function normalizeServerConfig(name, cfg) {
     };
     return normalized;
 }
-function warnOnSecrets(path, config) {
-    for (const [name, server] of Object.entries(config.mcpServers)) {
-        const entries = [];
-        if ('env' in server) {
-            entries.push(...Object.entries(server.env ?? {}));
-        }
-        if ('headers' in server) {
-            entries.push(...Object.entries(server.headers ?? {}));
-        }
-        for (const [key, value] of entries) {
-            if (typeof value === 'string' && looksLikeSecret(value)) {
-                log.warn(TAG, `MCP server '${name}': value '${key}' in ${path} looks like a secret. ` +
-                    `Consider moving it to the global config (~/.shortcut/agent/mcp.json) or using shell environment variables.`);
-                return; // One warning per load is enough.
-            }
-        }
-    }
-}
 /**
- * Load and merge MCP server configs from global and project paths.
- * Project-local servers override global servers with the same name.
- * Warns on secrets found in project-local config.
+ * Load MCP server configs from the global agent path only.
  */
 export function loadMcpConfig(options) {
-    const globalPath = join(options.globalConfigDir, MCP_CONFIG_FILENAME);
-    const projectPath = join(options.cwd, '.shortcut', MCP_CONFIG_FILENAME);
-    const globalConfig = parseConfigFile(globalPath);
-    const projectConfig = parseConfigFile(projectPath);
-    if (projectConfig) {
-        warnOnSecrets(projectPath, projectConfig);
-    }
-    // Merge: project overrides global.
-    const merged = {};
-    if (globalConfig) {
-        for (const [name, cfg] of Object.entries(globalConfig.mcpServers)) {
-            if (validateServerConfig(name, cfg)) {
-                merged[name] = normalizeServerConfig(name, cfg);
-            }
-        }
-    }
-    if (projectConfig) {
-        for (const [name, cfg] of Object.entries(projectConfig.mcpServers)) {
-            if (validateServerConfig(name, cfg)) {
-                merged[name] = normalizeServerConfig(name, cfg); // Override global
-            }
+    const globalPath = getMcpConfigPath(options.globalConfigDir);
+    const globalConfig = readMcpConfigFile(globalPath);
+    const servers = {};
+    for (const [name, cfg] of Object.entries(globalConfig.mcpServers)) {
+        if (validateServerConfig(name, cfg)) {
+            servers[name] = normalizeServerConfig(name, cfg);
         }
     }
-    return merged;
+    return servers;
 }
 //# sourceMappingURL=config.js.map

package/dist/app/mcp/connection.d.ts

@@ -10,6 +10,7 @@ export declare class McpConnectionError extends Error {
 }
 export declare function resolveStartupTimeoutMs(config: McpServerConfig): number;
 export declare function buildRequestPolicy(config: McpServerConfig): McpRequestPolicy;
+export declare function createHostedMcpLoggingFetch(serverName: string, fetchImpl?: typeof fetch): typeof fetch;
 /**
  * Connect a server, list tools, and return a live MCP connection.
  */