shortcutxl 0.3.90 → 0.3.91

package/BINARY-INVENTORY.json

@@ -1,17 +1,17 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-09-02T05:35:16.912Z",
+  "generatedAt": "2026-09-10T05:20:31.240Z",
   "package": "shortcutxl",
   "build": {
     "builder": "github-actions",
     "repository": "lyfegame/shortcut",
-    "sourceRef": "refs/heads/codex/excel-preexecution-approval",
-    "sourceCommit": "2520273120cc4b4024d877790eacf6f41fefdd7c",
-    "workflowRef": "lyfegame/shortcut/.github/workflows/release-shortcut-cli-npm-package.yml@refs/heads/codex/excel-preexecution-approval",
-    "runId": "33595155271",
+    "sourceRef": "refs/heads/mcp-startup-budget",
+    "sourceCommit": "0905764a93d06c695b77bf413eaa2003d6bbd83f",
+    "workflowRef": "lyfegame/shortcut/.github/workflows/release-shortcut-cli-npm-package.yml@refs/heads/mcp-startup-budget",
+    "runId": "34440542822",
     "runnerOs": "Windows",
     "runnerImage": "win25-vs2026",
-    "runnerImageVersion": "20260824.214.3"
+    "runnerImageVersion": "20260907.229.1"
   },
   "binaryExtensions": [
     ".dll",
@@ -550,7 +550,7 @@
     },
     {
       "path": "xll/python/Scripts/httpx.exe",
-      "sha256": "a7f8d80085b1d17fdf993cd7246d55f05726e3eb624859a8ba3b69b76368bd4c",
+      "sha256": "a022dc159b79a3312afeed6f1733da09a8e85523163566f0df9da427319a0040",
       "source": "httpx console launcher installed into embedded Python",
       "version": "see packaged httpx distribution",
       "builtBy": "third-party",
@@ -558,7 +558,7 @@
     },
     {
       "path": "xll/python/Scripts/idna.exe",
-      "sha256": "75e2f1c65f561084f603823794d6ad5877ef0a5b1ef0b1fffff096603479642a",
+      "sha256": "8cd6a6078a64ae8e4c826fde0c179ee719401389df7d73832baf0dd3c582ab38",
       "source": "Python package console launcher installed into embedded Python",
       "version": "see owning Python package metadata in site-packages",
       "builtBy": "third-party",
@@ -566,7 +566,7 @@
     },
     {
       "path": "xll/python/Scripts/pip.exe",
-      "sha256": "f68ea8e144f74e0f9748750a5fc21b73e11d63486c905730aa474e28f3bab8e7",
+      "sha256": "4a130513690433dd5e1e502566a7fd2084fc629eb85d08f66b0aad591a012c23",
       "source": "pip console launcher installed into embedded Python",
       "version": "see packaged pip distribution",
       "builtBy": "third-party",
@@ -574,7 +574,7 @@
     },
     {
       "path": "xll/python/Scripts/pip3.13.exe",
-      "sha256": "f68ea8e144f74e0f9748750a5fc21b73e11d63486c905730aa474e28f3bab8e7",
+      "sha256": "4a130513690433dd5e1e502566a7fd2084fc629eb85d08f66b0aad591a012c23",
       "source": "pip console launcher installed into embedded Python",
       "version": "see packaged pip distribution",
       "builtBy": "third-party",
@@ -582,7 +582,7 @@
     },
     {
       "path": "xll/python/Scripts/pip3.exe",
-      "sha256": "f68ea8e144f74e0f9748750a5fc21b73e11d63486c905730aa474e28f3bab8e7",
+      "sha256": "4a130513690433dd5e1e502566a7fd2084fc629eb85d08f66b0aad591a012c23",
       "source": "pip console launcher installed into embedded Python",
       "version": "see packaged pip distribution",
       "builtBy": "third-party",
@@ -590,7 +590,7 @@
     },
     {
       "path": "xll/python/Scripts/pywin32_postinstall.exe",
-      "sha256": "3d5142d3d301b5b22ec9f9ba2d29c9f8a4a73bad069389a73dafbd61e2b37696",
+      "sha256": "1e121893a273808b93c23160b171d2055aa4ec72ddb72c92a3d7ebb274115f1d",
       "source": "Python package console launcher installed into embedded Python",
       "version": "see owning Python package metadata in site-packages",
       "builtBy": "third-party",
@@ -598,7 +598,7 @@
     },
     {
       "path": "xll/python/Scripts/pywin32_testall.exe",
-      "sha256": "494be3de764340437d1fb12aaaefaf8f47c5a482f14834da3a17b080c71d6e16",
+      "sha256": "d92feb62593764e35c01fa841192e2cbab59bd51b4d33f88f14197527c48ffa2",
       "source": "Python package console launcher installed into embedded Python",
       "version": "see owning Python package metadata in site-packages",
       "builtBy": "third-party",

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## [0.3.91]
+
+- **GPT-6 Astra** - GPT-6 Astra is now available in the model selector.
+- **Faster, more reliable MCP startup** - Shortcut now starts MCP integrations faster, retries temporary connection failures, and clearly reports servers that take too long to start.
+
 ## [0.3.90]
 
 - **Skill Forge** - A recursive self-improvement loop for skills. Create or improve personal skills by giving Skill Forge tasks and a grading bar to train, evaluate, and refine against.

package/dist/ai/types.d.ts

@@ -296,6 +296,8 @@ export interface Model<TApi extends Api> {
         cacheWrite: number;
     };
     contextWindow: number;
+    /** Optional auto-compaction threshold. Defaults to the runtime-wide threshold policy. */
+    compactionThresholdTokens?: number;
     maxTokens: number;
     capabilities?: ModelCapabilities;
     headers?: Record<string, string>;

package/dist/app/connectors/secret-store.d.ts

@@ -12,12 +12,20 @@
 export declare function setSecret(name: string, payload: Record<string, string>): void;
 /** Retrieve a secret payload for a connection. Returns undefined if not found. */
 export declare function getSecret(name: string): Record<string, string> | undefined;
+/**
+ * Retrieve several connection secrets without serially blocking the Node event loop.
+ * Windows uses one PowerShell process for the whole batch so the P/Invoke helper is
+ * compiled once. Other platforms perform their native lookups concurrently.
+ */
+export declare function getSecrets(names: readonly string[], timeoutMs?: number): Promise<Map<string, Record<string, string> | undefined>>;
 /** Remove a secret for a connection. Returns true if it existed. */
 export declare function removeSecret(name: string): boolean;
 /** Store a JSON payload in the OS keychain under a custom service namespace. */
 export declare function setNamespacedSecret(service: string, name: string, payload: object): void;
 /** Retrieve a JSON payload from the OS keychain for a custom service namespace. */
 export declare function getNamespacedSecret<T extends object>(service: string, name: string): T | undefined;
+/** Retrieve several secrets through a single asynchronous batch operation where possible. */
+export declare function getNamespacedSecrets<T extends object>(service: string, names: readonly string[], timeoutMs?: number): Promise<Map<string, T | undefined>>;
 /** Remove a JSON payload from the OS keychain for a custom service namespace. */
 export declare function removeNamespacedSecret(service: string, name: string): boolean;
 /**

package/dist/app/connectors/secret-store.js

@@ -8,7 +8,7 @@
  *
  * Imports: none from internal layers. Pure shell-out utility.
  */
-import { execFileSync } from 'child_process';
+import { execFile, execFileSync } from 'child_process';
 const CONNECTION_SERVICE = 'shortcut.connection';
 // =============================================================================
 // Public API
@@ -21,6 +21,14 @@ export function setSecret(name, payload) {
 export function getSecret(name) {
     return getNamespacedSecret(CONNECTION_SERVICE, name);
 }
+/**
+ * Retrieve several connection secrets without serially blocking the Node event loop.
+ * Windows uses one PowerShell process for the whole batch so the P/Invoke helper is
+ * compiled once. Other platforms perform their native lookups concurrently.
+ */
+export function getSecrets(names, timeoutMs = 10_000) {
+    return getNamespacedSecrets(CONNECTION_SERVICE, names, timeoutMs);
+}
 /** Remove a secret for a connection. Returns true if it existed. */
 export function removeSecret(name) {
     return removeNamespacedSecret(CONNECTION_SERVICE, name);
@@ -61,6 +69,45 @@ export function getNamespacedSecret(service, name) {
     }
     return undefined;
 }
+/** Retrieve several secrets through a single asynchronous batch operation where possible. */
+export async function getNamespacedSecrets(service, names, timeoutMs = 10_000) {
+    const uniqueNames = [...new Set(names)];
+    const result = new Map();
+    if (uniqueNames.length === 0)
+        return result;
+    if (process.platform === 'win32') {
+        const targets = uniqueNames.map((name) => `${service}/${name}`);
+        const psTargets = targets.map((target) => `'${psEsc(target)}'`).join(', ');
+        const ps = `${WIN_CRED_PREAMBLE}
+$result = @{}
+foreach ($target in @(${psTargets})) {
+  $value = [CredManager]::Read($target)
+  if ($null -ne $value) { $result[$target] = $value }
+}
+$result | ConvertTo-Json -Compress`;
+        const raw = await execFileUtf8('powershell', ['-NoProfile', '-EncodedCommand', psEncode(ps)], timeoutMs);
+        const values = raw.trim() ? JSON.parse(raw) : {};
+        for (const [index, name] of uniqueNames.entries()) {
+            result.set(name, parseSecretJson(values[targets[index]]));
+        }
+        return result;
+    }
+    if (process.platform === 'darwin') {
+        await Promise.all(uniqueNames.map(async (name) => {
+            try {
+                const raw = await execFileUtf8('security', ['find-generic-password', '-a', name, '-s', service, '-w'], timeoutMs);
+                result.set(name, parseSecretJson(raw));
+            }
+            catch {
+                result.set(name, undefined);
+            }
+        }));
+        return result;
+    }
+    for (const name of uniqueNames)
+        result.set(name, undefined);
+    return result;
+}
 /** Remove a JSON payload from the OS keychain for a custom service namespace. */
 export function removeNamespacedSecret(service, name) {
     try {
@@ -115,7 +162,11 @@ export function buildConnectionEnv(connectionNames) {
  * PowerShell script that uses P/Invoke to call CredRead/CredWrite/CredDelete
  * from advapi32.dll. Works on every Windows version. No external modules needed.
  */
+// Secrets are read back as .NET strings but serialized to stdout with the
+// console's OEM codepage, which varies per machine and locale. Force BOM-less
+// UTF-8 so Node decodes non-ASCII values correctly on every host.
 const WIN_CRED_PREAMBLE = `
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding $false
 Add-Type -TypeDefinition @"
 using System;
 using System.Runtime.InteropServices;
@@ -161,6 +212,27 @@ public class CredManager {
 function psEncode(script) {
     return Buffer.from(script, 'utf16le').toString('base64');
 }
+function execFileUtf8(command, args, timeout) {
+    return new Promise((resolve, reject) => {
+        execFile(command, args, { encoding: 'utf-8', timeout, windowsHide: true }, (error, stdout) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve(stdout);
+        });
+    });
+}
+function parseSecretJson(raw) {
+    if (!raw)
+        return undefined;
+    try {
+        return JSON.parse(raw.trim());
+    }
+    catch {
+        return undefined;
+    }
+}
 function winCredWrite(target, secret) {
     const ps = `${WIN_CRED_PREAMBLE}\n[CredManager]::Write('${psEsc(target)}', '${psEsc(secret)}')`;
     execFileSync('powershell', ['-NoProfile', '-EncodedCommand', psEncode(ps)], {

package/dist/app/mcp/auth-status.d.ts

@@ -6,6 +6,8 @@ export interface ResolveMcpAuthStatusOptions {
     authStorage?: AuthStorage;
     mcpOAuthStore?: McpOAuthStore;
     discovery?: McpAuthDiscoveryMode;
+    /** Pre-fetched connection secrets by name; when absent the keychain is read directly. */
+    connectionSecrets?: ReadonlyMap<string, Record<string, string> | undefined>;
 }
 export declare function resolveMcpAuthStatus(serverName: string, config: McpServerConfig, options?: ResolveMcpAuthStatusOptions): Promise<McpAuthStatus>;
 export declare function getMcpAuthStatus(serverName: string, config: McpServerConfig, authStorage?: AuthStorage, mcpOAuthStore?: McpOAuthStore): Promise<McpAuthStatus>;

package/dist/app/mcp/auth-status.js

@@ -10,7 +10,11 @@ export async function resolveMcpAuthStatus(serverName, config, options = {}) {
         return 'unsupported';
     }
     const staticHeaders = { ...(config.headers ?? {}) };
-    const secretHeaders = config.connection ? getSecret(config.connection) : undefined;
+    const secretHeaders = !config.connection
+        ? undefined
+        : options.connectionSecrets
+            ? options.connectionSecrets.get(config.connection)
+            : getSecret(config.connection);
     if (hasConfiguredHeaders(staticHeaders) || hasConfiguredHeaders(secretHeaders)) {
         return 'configured';
     }

package/dist/app/mcp/connection.d.ts

@@ -4,17 +4,47 @@
 import type { AuthStorage } from '../auth/auth-storage.js';
 import type { McpOAuthStore } from './oauth-state-store.js';
 import { type McpConnection, type McpFailureKind, type McpRequestPolicy, type McpServerConfig } from './types.js';
+/** Abort signal plus absolute deadline that bounds one server's whole startup. */
+export interface McpStartupBudget {
+    signal: AbortSignal;
+    deadlineAt: number;
+}
+export interface McpConnectOptions {
+    /**
+     * Connection secrets already read from the keychain, keyed by connection
+     * name. When absent, the server reads its own secret synchronously.
+     */
+    connectionSecrets?: ReadonlyMap<string, Record<string, string> | undefined>;
+    /** Budget shared across the whole startup. Direct callers get one from the config's startup timeout. */
+    budget?: McpStartupBudget;
+}
 export declare class McpConnectionError extends Error {
     readonly failureKind: McpFailureKind;
     constructor(failureKind: McpFailureKind, message: string);
 }
 export declare function resolveStartupTimeoutMs(config: McpServerConfig): number;
 export declare function buildRequestPolicy(config: McpServerConfig): McpRequestPolicy;
+/**
+ * Run one server's startup under a single deadline. The budget's signal is
+ * threaded into every SDK request so a stalled initialize or tools/list is
+ * cancelled, and the race guarantees the deadline even for steps that cannot
+ * observe the signal (process spawn, keychain reads).
+ */
+export declare function withStartupBudget<T>(name: string, timeoutMs: number, operation: (budget: McpStartupBudget) => Promise<T>): Promise<T>;
+/** SDK request options for initialize and tools/list under a startup budget. */
+export declare function requestOptions(budget: McpStartupBudget): {
+    signal: AbortSignal;
+    timeout: number;
+};
+/** Whether a failed hosted startup is safe to repeat with a fresh MCP session. */
+export declare function isTransientHostedStartupError(error: unknown): boolean;
 export declare function createHostedMcpLoggingFetch(serverName: string, fetchImpl?: typeof fetch): typeof fetch;
 /**
- * Connect a server, list tools, and return a live MCP connection.
+ * Connect a server, list tools, and return a live MCP connection. The whole
+ * sequence runs under `options.budget`, or under a fresh budget from the
+ * config's startup timeout when the caller did not supply one.
  */
-export declare function connectServer(name: string, config: McpServerConfig, defaultCwd: string, authStorage?: AuthStorage, mcpOAuthStore?: McpOAuthStore): Promise<McpConnection>;
+export declare function connectServer(name: string, config: McpServerConfig, defaultCwd: string, authStorage?: AuthStorage, mcpOAuthStore?: McpOAuthStore, options?: McpConnectOptions): Promise<McpConnection>;
 /**
  * Call a tool on a connected server. Returns the result text or throws.
  */

package/dist/app/mcp/connection.js

@@ -10,16 +10,40 @@ import { mkdir, writeFile } from 'fs/promises';
 import { basename, extname, join } from 'path';
 import { getAgentTempDir } from '../../config.js';
 import { log } from '../../shared/logging/agent-log.js';
+import { sleep } from '../../utils/sleep.js';
 import { getSecret } from '../connectors/secret-store.js';
 import { getHostedMcpOAuthProviderId } from './hosted-oauth-id.js';
 import { createHostedMcpRuntimeAuthProvider } from './hosted-oauth-provider.js';
 import { resolveHostedMcpOAuthTimeoutMs, supportsHostedMcpOAuth } from './oauth-discovery.js';
 import { withHostedMcpProxyFetchOptions } from './proxy-fetch.js';
 import { isHostedServerConfig } from './types.js';
-const DEFAULT_STARTUP_TIMEOUT_MS = 30_000;
+/**
+ * Default budget for one server's whole startup: credential lookup, connect and
+ * initialize, OAuth refresh, and tool discovery. Managed Windows fleets behind
+ * proxies and EDR routinely take 60-90s here, so the budget is generous while
+ * still sitting under the 180s RPC readiness budget in `rpc-client.ts`.
+ */
+const DEFAULT_STARTUP_TIMEOUT_MS = 120_000;
 const DEFAULT_TOOL_CALL_TIMEOUT_MS = 600_000;
 const DEFAULT_RESET_TIMEOUT_ON_PROGRESS = true;
 const MCP_OUTPUT_DIR_NAME = 'mcp';
+const HOSTED_STARTUP_RETRY_DELAY_MS = 250;
+const TRANSIENT_NETWORK_ERROR_CODES = new Set([
+    'EAI_AGAIN',
+    'ECONNABORTED',
+    'ECONNREFUSED',
+    'ECONNRESET',
+    'EHOSTUNREACH',
+    'ENETUNREACH',
+    'ENOTFOUND',
+    'EPIPE',
+    'ETIMEDOUT',
+    'UND_ERR_BODY_TIMEOUT',
+    'UND_ERR_CONNECT_TIMEOUT',
+    'UND_ERR_HEADERS_TIMEOUT',
+    'UND_ERR_SOCKET'
+]);
+const TRANSIENT_HTTP_STATUS_CODES = new Set([408, 425, 429, 500, 502, 503, 504]);
 function isRecord(value) {
     return typeof value === 'object' && value !== null;
 }
@@ -231,14 +255,68 @@ export function buildRequestPolicy(config) {
             : {})
     };
 }
-async function buildHostedHeaders(name, config) {
+/**
+ * Run one server's startup under a single deadline. The budget's signal is
+ * threaded into every SDK request so a stalled initialize or tools/list is
+ * cancelled, and the race guarantees the deadline even for steps that cannot
+ * observe the signal (process spawn, keychain reads).
+ */
+export async function withStartupBudget(name, timeoutMs, operation) {
+    const controller = new AbortController();
+    const timeoutError = new McpConnectionError('startup_timeout', `MCP server '${name}' did not finish connection and tool discovery within ${timeoutMs / 1000}s.`);
+    const expired = new Promise((_, reject) => {
+        controller.signal.addEventListener('abort', () => reject(timeoutError), { once: true });
+    });
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    if (typeof timer === 'object' && 'unref' in timer)
+        timer.unref();
+    try {
+        return await Promise.race([
+            operation({ signal: controller.signal, deadlineAt: Date.now() + timeoutMs }),
+            expired
+        ]);
+    }
+    catch (error) {
+        // The SDK surfaces our abort as its own error; report the budget instead.
+        throw controller.signal.aborted ? timeoutError : error;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * The SDK arms its own per-request timer (60s when none is given), so it cannot
+ * be the budget's timekeeper: two timers set to the same instant race, and the
+ * SDK's raw "Request timed out" would sometimes win. The budget's abort signal
+ * is the single source of truth; the SDK timeout only sits above it so the
+ * default 60s never cuts a longer budget short.
+ */
+const SDK_TIMEOUT_SLACK_MS = 1_000;
+/** SDK request options for initialize and tools/list under a startup budget. */
+export function requestOptions(budget) {
+    return {
+        signal: budget.signal,
+        timeout: Math.max(1, budget.deadlineAt - Date.now()) + SDK_TIMEOUT_SLACK_MS
+    };
+}
+/** Secret for `config.connection`, from the pre-fetched map when the manager supplied one. */
+function resolveConnectionSecret(name, connection, options) {
+    const secret = options.connectionSecrets
+        ? options.connectionSecrets.get(connection)
+        : getSecret(connection);
+    if (!secret) {
+        throw new Error(`MCP server '${name}' references connection '${connection}' but no credentials found in keychain. Run /connect to set it up.`);
+    }
+    return secret;
+}
+/** Best-effort teardown after a failed startup; a stdio close waits on the child, so never block on it. */
+function discardClient(client) {
+    void client.close().catch(() => { });
+}
+function buildHostedHeaders(name, config, options) {
     const headers = { ...(config.headers ?? {}) };
     if (config.connection) {
-        const secrets = getSecret(config.connection);
-        if (!secrets) {
-            throw new Error(`MCP server '${name}' references connection '${config.connection}' but no credentials found in keychain. Run /connect to set it up.`);
-        }
-        Object.assign(headers, secrets);
+        Object.assign(headers, resolveConnectionSecret(name, config.connection, options));
     }
     return headers;
 }
@@ -354,6 +432,32 @@ function summarizeErrorForLog(error, depth = 0) {
     }
     return details;
 }
+/** Whether a failed hosted startup is safe to repeat with a fresh MCP session. */
+export function isTransientHostedStartupError(error) {
+    if (error instanceof UnauthorizedError || error instanceof McpConnectionError) {
+        return false;
+    }
+    if (error instanceof StreamableHTTPError &&
+        typeof error.code === 'number' &&
+        TRANSIENT_HTTP_STATUS_CODES.has(error.code)) {
+        return true;
+    }
+    let current = error;
+    for (let depth = 0; depth < 4; depth += 1) {
+        if (current === null || (typeof current !== 'object' && typeof current !== 'function')) {
+            return false;
+        }
+        const record = current;
+        if (record.name === 'AbortError')
+            return false;
+        if (typeof record.code === 'string' &&
+            TRANSIENT_NETWORK_ERROR_CODES.has(record.code.toUpperCase())) {
+            return true;
+        }
+        current = record.cause;
+    }
+    return false;
+}
 async function readResponseSnippet(response) {
     try {
         const text = await response.clone().text();
@@ -383,10 +487,33 @@ export function createHostedMcpLoggingFetch(serverName, fetchImpl = fetch) {
         return response;
     };
 }
-async function connectHostedServer(name, config, authStorage, mcpOAuthStore, retriedAfterOAuthRefresh = false) {
-    const startupTimeoutMs = resolveStartupTimeoutMs(config);
+/** Discover the server's tools inside the budget, releasing the client if discovery fails. */
+async function discoverTools(name, client, budget) {
+    let toolsResult;
+    try {
+        budget.signal.throwIfAborted();
+        toolsResult = await client.listTools(undefined, requestOptions(budget));
+    }
+    catch (error) {
+        discardClient(client);
+        throw error;
+    }
+    const tools = (toolsResult.tools ?? []).map((t) => ({
+        name: t.name,
+        description: t.description,
+        parameterNames: t.inputSchema?.properties
+            ? Object.keys(t.inputSchema.properties)
+            : [],
+        inputSchema: (t.inputSchema ?? {})
+    }));
+    if (tools.length === 0) {
+        log.info('mcp', `MCP server '${name}' connected but exposed 0 tools.`);
+    }
+    return tools;
+}
+async function connectHostedServerAttempt(name, config, authStorage, mcpOAuthStore, options, budget, retriedAfterOAuthRefresh = false) {
     const requestPolicy = buildRequestPolicy(config);
-    const headers = await buildHostedHeaders(name, config);
+    const headers = buildHostedHeaders(name, config, options);
     const authProvider = authStorage &&
         mcpOAuthStore &&
         !hasAuthorizationHeader(headers) &&
@@ -399,25 +526,12 @@ async function connectHostedServer(name, config, authStorage, mcpOAuthStore, ret
         authProvider
     });
     const client = new Client({ name: 'shortcut-agent', version: '1.0.0' }, { capabilities: {} });
-    let timer;
-    const connectPromise = client.connect(transport);
-    const timeoutPromise = new Promise((_, reject) => {
-        timer = setTimeout(() => reject(new Error(`did not respond within ${startupTimeoutMs / 1000}s`)), startupTimeoutMs);
-        if (typeof timer === 'object' && 'unref' in timer)
-            timer.unref();
-    });
     try {
-        await Promise.race([connectPromise, timeoutPromise]);
-        if (timer)
-            clearTimeout(timer);
+        await client.connect(transport, requestOptions(budget));
     }
     catch (err) {
-        try {
-            await client.close();
-        }
-        catch {
-            // Ignore close errors during cleanup.
-        }
+        discardClient(client);
+        budget.signal.throwIfAborted();
         if (err instanceof UnauthorizedError ||
             (err instanceof StreamableHTTPError && err.code === 401)) {
             const providerId = getHostedMcpOAuthProviderId(name, config);
@@ -426,12 +540,13 @@ async function connectHostedServer(name, config, authStorage, mcpOAuthStore, ret
                 !retriedAfterOAuthRefresh &&
                 authStorage.get(providerId)?.type === 'oauth') {
                 const refreshedToken = await authStorage.getApiKey(providerId, { forceRefresh: true });
+                budget.signal.throwIfAborted();
                 if (refreshedToken) {
-                    return connectHostedServer(name, config, authStorage, mcpOAuthStore, true);
+                    return connectHostedServerAttempt(name, config, authStorage, mcpOAuthStore, options, budget, true);
                 }
             }
             const supportsOAuth = await supportsHostedMcpOAuth(name, config, mcpOAuthStore, {
-                timeoutMs: resolveHostedMcpOAuthTimeoutMs(config)
+                timeoutMs: Math.min(resolveHostedMcpOAuthTimeoutMs(config), requestOptions(budget).timeout)
             }).catch(() => !!config.oauth);
             const providerName = config.oauth?.providerName ?? `MCP: ${name}`;
             throw new McpConnectionError('auth_required', supportsOAuth
@@ -440,31 +555,32 @@ async function connectHostedServer(name, config, authStorage, mcpOAuthStore, ret
         }
         throw err;
     }
-    const toolsResult = await client.listTools();
-    const tools = (toolsResult.tools ?? []).map((t) => ({
-        name: t.name,
-        description: t.description,
-        parameterNames: t.inputSchema?.properties
-            ? Object.keys(t.inputSchema.properties)
-            : [],
-        inputSchema: (t.inputSchema ?? {})
-    }));
-    if (tools.length === 0) {
-        log.info('mcp', `Hosted MCP server '${name}' connected but exposed 0 tools.`);
-    }
+    const tools = await discoverTools(name, client, budget);
     return { name, client, transport, tools, requestPolicy };
 }
-async function connectStdioServer(name, config, defaultCwd) {
-    const startupTimeoutMs = resolveStartupTimeoutMs(config);
-    const requestPolicy = buildRequestPolicy(config);
-    let serverEnv = { ...process.env, ...(config.env ?? {}) };
-    if (config.connection) {
-        const secrets = getSecret(config.connection);
-        if (!secrets) {
-            throw new Error(`MCP server '${name}' references connection '${config.connection}' but no credentials found in keychain. Run /connect to set it up.`);
+/** Retry transient hosted startup failures with a fresh client and transport each time. */
+async function connectHostedServer(name, config, authStorage, mcpOAuthStore, options, budget) {
+    try {
+        return await connectHostedServerAttempt(name, config, authStorage, mcpOAuthStore, options, budget);
+    }
+    catch (error) {
+        budget.signal.throwIfAborted();
+        if (!isTransientHostedStartupError(error) ||
+            Date.now() + HOSTED_STARTUP_RETRY_DELAY_MS >= budget.deadlineAt) {
+            throw error;
         }
-        serverEnv = { ...serverEnv, ...secrets };
+        log.warn('mcp', `MCP server '${name}' had a transient startup failure; retrying once with a fresh session. error=${JSON.stringify(summarizeErrorForLog(error))}`);
+        await sleep(HOSTED_STARTUP_RETRY_DELAY_MS, budget.signal);
+        return connectHostedServerAttempt(name, config, authStorage, mcpOAuthStore, options, budget);
     }
+}
+async function connectStdioServer(name, config, defaultCwd, options, budget) {
+    const requestPolicy = buildRequestPolicy(config);
+    const serverEnv = {
+        ...process.env,
+        ...(config.env ?? {}),
+        ...(config.connection ? resolveConnectionSecret(name, config.connection, options) : {})
+    };
     const transport = new StdioClientTransport({
         command: config.command,
         args: config.args,
@@ -480,52 +596,32 @@ async function connectStdioServer(name, config, defaultCwd) {
         }
     });
     const client = new Client({ name: 'shortcut-agent', version: '1.0.0' }, { capabilities: {} });
-    const connectPromise = client.connect(transport);
-    let timer;
-    const timeoutPromise = new Promise((_, reject) => {
-        timer = setTimeout(() => reject(new Error(`did not respond within ${startupTimeoutMs / 1000}s`)), startupTimeoutMs);
-        if (typeof timer === 'object' && 'unref' in timer)
-            timer.unref();
-    });
     try {
-        await Promise.race([connectPromise, timeoutPromise]);
-        if (timer)
-            clearTimeout(timer);
+        await client.connect(transport, requestOptions(budget));
     }
     catch (err) {
-        try {
-            await client.close();
-        }
-        catch {
-            // Ignore close errors during cleanup.
-        }
+        discardClient(client);
+        budget.signal.throwIfAborted();
         const stderr = stderrBuf.trim();
         const base = err instanceof Error ? err.message : String(err);
         const detail = stderr ? `${base}\nServer stderr: ${stderr}` : base;
         throw new McpConnectionError('connect_failed', detail);
     }
-    const toolsResult = await client.listTools();
-    const tools = (toolsResult.tools ?? []).map((t) => ({
-        name: t.name,
-        description: t.description,
-        parameterNames: t.inputSchema?.properties
-            ? Object.keys(t.inputSchema.properties)
-            : [],
-        inputSchema: (t.inputSchema ?? {})
-    }));
-    if (tools.length === 0) {
-        log.info('mcp', `MCP server '${name}' connected but exposed 0 tools.`);
-    }
+    const tools = await discoverTools(name, client, budget);
     return { name, client, transport, tools, requestPolicy };
 }
 /**
- * Connect a server, list tools, and return a live MCP connection.
+ * Connect a server, list tools, and return a live MCP connection. The whole
+ * sequence runs under `options.budget`, or under a fresh budget from the
+ * config's startup timeout when the caller did not supply one.
  */
-export async function connectServer(name, config, defaultCwd, authStorage, mcpOAuthStore) {
-    if (isHostedServerConfig(config)) {
-        return connectHostedServer(name, config, authStorage, mcpOAuthStore);
-    }
-    return connectStdioServer(name, config, defaultCwd);
+export async function connectServer(name, config, defaultCwd, authStorage, mcpOAuthStore, options = {}) {
+    const connect = (budget) => isHostedServerConfig(config)
+        ? connectHostedServer(name, config, authStorage, mcpOAuthStore, options, budget)
+        : connectStdioServer(name, config, defaultCwd, options, budget);
+    return options.budget
+        ? connect(options.budget)
+        : withStartupBudget(name, resolveStartupTimeoutMs(config), connect);
 }
 /**
  * Call a tool on a connected server. Returns the result text or throws.