zidane 6.2.14 → 6.2.18

package/dist/tui.js

@@ -1,5 +1,5 @@
-import { $ as useMcpAuthState, $n as buildPlanSystem, $t as restoreChainFallbacks, A as runOAuthLogin, Bt as createDiscoverySlot, Ct as SETTINGS_CHOICES, D as formatPathForCwd, Dt as clampFps, Et as SettingsProvider, G as buildVisibleMcpRows, Gt as useConfig, Ht as useDiscovery, J as createFileMcpCredentialStore, Jt as buildRunModel, K as indexOfServerRow, Kt as resolveConfig, L as loadMcpToolsCache, M as buildMcpServers, Mt as resolveTheme, O as fetchOAuthRedirect, Ot as useSettings, P as discoverProjectMcps, Q as useMcpAuthDispatch, Qn as buildBuildSystem, Qt as providerKeySetChanged, R as mcpToolsCachePath, St as SETTINGS_CATEGORIES, T as suggestSafelistEntries, Tn as accentColor, Tt as SETTINGS_TOGGLES, U as useMcpToolToggleMap, Ut as useDiscoveryOptional, V as subscribeMcpToolsCache, Vn as useActiveTodos, Vt as DiscoveryProvider, Wt as ConfigProvider, Xt as chainsEqual, Yt as chainPositionOf, Z as McpAuthProvider, Zt as filterChainFallbacks, _ as useSafeModeQueue, _n as discoverAgentsMd, _r as toolCallPreview, _t as buildHints, a as useSurfaces, an as bootTick, at as buildResumedToolResultsTurn, b as getSafelist, br as usageByModel, bt as useEnabledToggleSet, c as useStreamBuffer, cr as lastContextSizeFromTurns, ct as makeRequestInteraction, d as discoverProjectSkills, dr as marginTopFor, dt as useInteractionsActions, er as envSection, et as getMcpAuthStatus, ft as useInteractionsQueue, g as useSafeModeActions, gn as chatAutoCompactBehavior, gt as truncateTrailing, h as SafeModeProvider, hr as sumRunCosts, ht as hintsLength, i as useSelectStyle, ir as compactSummaryEvent, it as PRESENT_PLAN_TOOL, j as supportsOAuth, jn as TODO_STATUS_GLYPHS, jt as resolveChipColor, k as oauthUsesManualCodePaste, l as buildSkillsConfig, lr as listSessionMeta, lt as pendingInteractionsFromTurns, m as writeSessionExport, mr as stripSpawnTokensLine, mt as clipHintsToWidth, n as ThemeProvider, nn as useCompletion, nr as createChatTurnsReadTool, nt as ASK_USER_TOOL, on as buildUpdateHint, or as deriveSessionTitle, ot as createInteractionTools, pr as serverToolResultSummary, pt as EMPTY_HINTS, q as parentServerName, qt as resolveStoragePaths, r as useColors, rn as tryOpenBrowser, rt as InteractionsProvider, s as useTheme, sn as useUpdateCheck, sr as eventsFromTurns, t as computeTurnAnchors, tn as toggleChainEntry, tr as chatReferenceTokensForPrompt, u as defaultSkillScanPaths, ur as loadState, vr as toolResultText, wt as SETTINGS_INPUTS, x as isOnSafelist, xt as DEFAULT_SETTINGS, y as addToSafelist, yr as updateToolEventOutcomes, yt as listProjectFiles, z as refreshMcpToolsCatalog } from "./transcript-anchors-DE6D0dNo.js";
-import { $ as composeExtensionPreset, B as ExtensionInstallError, Bt as ensureKeybindingsFile, Et as createModelSearchTool, H as installExtensionFromSpec, Ht as groupBindings, J as createExtensionHud, K as removeInstalledExtension, P as summaryToTurn, St as tailTruncate, Ut as keybindingsPath, Vt as formatBindingForDisplay, Wt as matchesBinding, X as discoverAndBuildExtensionRegistry, Y as registerExtensionHostModules, Yt as resolveExtensionKeybindings, _ as buildPostCompactAttachments, c as applyCompactSummaryCutoff, dn as sanitizeExtensionConfigActionPatch, en as inlineLoadedExtension, et as disposeExtensionRegistry, f as cleanupPersistedSession, g as resolveTasksDir, h as resolvePersistDir, hn as effectiveContextWindow, ht as isSpawnTool, it as createExtensionHostRuntimeBridge, lt as basic_default, m as resolveMcpWarningsDir, mn as OUTPUT_RESERVE_TOKENS, nn as parseExtensionScanPathEnv, on as coerceExtensionConfigInput, q as updateInstalledExtension, rn as scanExtensionDirectories, rt as partitionExtensionCatalog, t as createAgent, tt as filterExtensionRegistry, un as resolveExtensionConfigValue, wt as looksBinary, x as compactConversation, y as selectFilesFromSession, z as createExtensionPromptBridge, zt as KEYBINDING_KEY_COL_WIDTH } from "./agent-DoEx_WD3.js";
+import { $ as useMcpAuthDispatch, $n as buildBuildSystem, $t as providerKeySetChanged, A as runOAuthLogin, B as refreshMcpToolsCatalog, Ct as SETTINGS_CATEGORIES, D as formatPathForCwd, Dt as SettingsProvider, En as accentColor, Et as SETTINGS_TOGGLES, F as parseJsonTolerant, Gt as ConfigProvider, H as subscribeMcpToolsCache, Hn as useActiveTodos, Ht as DiscoveryProvider, J as parentServerName, Jt as resolveStoragePaths, K as buildVisibleMcpRows, Kt as useConfig, M as buildMcpServers, Mn as TODO_STATUS_GLYPHS, Mt as resolveChipColor, Nt as resolveTheme, O as fetchOAuthRedirect, Ot as clampFps, P as discoverProjectMcps, Q as McpAuthProvider, Qt as filterChainFallbacks, R as loadMcpToolsCache, St as DEFAULT_SETTINGS, T as suggestSafelistEntries, Tt as SETTINGS_INPUTS, Ut as useDiscovery, Vt as createDiscoverySlot, W as useMcpToolToggleMap, Wt as useDiscoveryOptional, Xt as chainPositionOf, Y as createFileMcpCredentialStore, Yt as buildRunModel, Zt as chainsEqual, _ as useSafeModeQueue, _n as chatAutoCompactBehavior, _t as truncateTrailing, a as useSurfaces, ar as compactSummaryEvent, at as PRESENT_PLAN_TOOL, b as getSafelist, br as updateToolEventOutcomes, bt as listProjectFiles, c as useStreamBuffer, cn as useUpdateCheck, cr as eventsFromTurns, d as discoverProjectSkills, dr as loadState, en as restoreChainFallbacks, er as buildPlanSystem, et as useMcpAuthState, fr as marginTopFor, ft as useInteractionsActions, g as useSafeModeActions, gr as sumRunCosts, gt as hintsLength, h as SafeModeProvider, hr as stripSpawnTokensLine, ht as clipHintsToWidth, i as useSelectStyle, in as tryOpenBrowser, it as InteractionsProvider, j as supportsOAuth, k as oauthUsesManualCodePaste, kt as useSettings, l as buildSkillsConfig, lr as lastContextSizeFromTurns, lt as makeRequestInteraction, m as writeSessionExport, mr as serverToolResultSummary, mt as EMPTY_HINTS, n as ThemeProvider, nn as toggleChainEntry, nr as chatReferenceTokensForPrompt, on as bootTick, ot as buildResumedToolResultsTurn, pt as useInteractionsQueue, q as indexOfServerRow, qt as resolveConfig, r as useColors, rn as useCompletion, rr as createChatTurnsReadTool, rt as ASK_USER_TOOL, s as useTheme, sn as buildUpdateHint, sr as deriveSessionTitle, st as createInteractionTools, t as computeTurnAnchors, tr as envSection, tt as getMcpAuthStatus, u as defaultSkillScanPaths, ur as listSessionMeta, ut as pendingInteractionsFromTurns, vn as discoverAgentsMd, vr as toolCallPreview, vt as buildHints, wt as SETTINGS_CHOICES, x as isOnSafelist, xr as usageByModel, xt as useEnabledToggleSet, y as addToSafelist, yr as toolResultText, z as mcpToolsCachePath } from "./transcript-anchors-DUusSVpZ.js";
+import { $ as composeExtensionPreset, B as ExtensionInstallError, Bt as ensureKeybindingsFile, Et as createModelSearchTool, H as installExtensionFromSpec, Ht as groupBindings, J as createExtensionHud, K as removeInstalledExtension, P as summaryToTurn, St as tailTruncate, Ut as keybindingsPath, Vt as formatBindingForDisplay, Wt as matchesBinding, X as discoverAndBuildExtensionRegistry, Y as registerExtensionHostModules, Yt as resolveExtensionKeybindings, _ as buildPostCompactAttachments, c as applyCompactSummaryCutoff, dn as sanitizeExtensionConfigActionPatch, en as inlineLoadedExtension, et as disposeExtensionRegistry, f as cleanupPersistedSession, g as resolveTasksDir, h as resolvePersistDir, hn as effectiveContextWindow, ht as isSpawnTool, it as createExtensionHostRuntimeBridge, lt as basic_default, m as resolveMcpWarningsDir, mn as OUTPUT_RESERVE_TOKENS, nn as parseExtensionScanPathEnv, on as coerceExtensionConfigInput, q as updateInstalledExtension, rn as scanExtensionDirectories, rt as partitionExtensionCatalog, t as createAgent, tt as filterExtensionRegistry, un as resolveExtensionConfigValue, wt as looksBinary, x as compactConversation, y as selectFilesFromSession, z as createExtensionPromptBridge, zt as KEYBINDING_KEY_COL_WIDTH } from "./agent-DBfHPAgz.js";
 import { a as formatDuration, c as previewLine, i as fmtTokens, l as shortId, n as compactPath, o as formatTaskStatus, r as fmtCost, s as formatTaskSummary, t as ageString } from "./format-BF745pLL.js";
 import { n as appendCapped } from "./output-cap-kBUHBlnq.js";
 import { i as killProcessGroup, n as SUPPORTS_PROCESS_GROUPS, r as createProcessContext } from "./contexts-A4ep-iJs.js";
@@ -7,16 +7,16 @@ import { l as errorMessage } from "./errors-DJUxZg9b.js";
 import { M as findGitRoot, j as projectUserPaths } from "./resolve-HtxmBWs9.js";
 import { a as createRingBufferSink, i as createLoggingHooks, l as logFileTimestamp, n as createFileSink, o as fanoutSink, r as createLogger, s as formatLogLine, t as consoleSink } from "./logger-DBX9uYOw.js";
 import { i as sniffImageMediaType } from "./media-sniff-Bn76JxAu.js";
+import { d as McpOAuthProvider, n as connectMcpServers, p as hasAuthorizationHeader } from "./mcp-H6bqyM94.js";
 import { n as flattenTurns, r as formatTokenUsage, t as effectiveInputFromTurn } from "./stats-DAKBEKjc.js";
 import { replaceDynamicSection } from "./prompt.js";
 import { a as getExtensionSessionState, i as demoteStaleRunningStatus, o as loadSession, s as setExtensionSessionState, t as createSession } from "./session-DzrXKLw-.js";
 import { o as withTimeout } from "./timeout-BDetbuN6.js";
-import { n as connectMcpServers, u as McpOAuthProvider } from "./mcp-BCaN_Gyg.js";
 import { a as generateStructuredData, c as shouldAutoGenerateTitle, f as commandBlockToEvent, g as parseCommandInvocation, h as executeCommand, n as patchInlineGhost, p as commandBlocksToContent, r as resolveInlineSuggestion, s as generateSessionTitle, t as createPathAutocompleteProvider } from "./inline-autocomplete-BAwBcZtD.js";
 import { s as resolveCompletionSubmit } from "./completion-core-BRo86R_L.js";
 import { i as installSkillFromSpec, r as SkillInstallError } from "./skills-DKWqoaYH.js";
-import { i as ZIDANE_EXTENSION_SKILL_NAME, l as withZidaneExtensionSkill, o as extensionDirForCwd, r as EXTENSION_EDIT_METADATA_KEY, s as extensionScaffold, t as loginMcpServer } from "./login-Clf-R27F.js";
-import { C as restoreModelOptions, S as piIdOf, _ as modelOptionsFor, m as getContextWindow, p as enabledModelOptions, s as setProviderCredential, t as detectAuth, v as modelSupportsReasoning } from "./auth-Bb479DFB.js";
+import { i as ZIDANE_EXTENSION_SKILL_NAME, l as withZidaneExtensionSkill, o as extensionDirForCwd, r as EXTENSION_EDIT_METADATA_KEY, s as extensionScaffold, t as loginMcpServer } from "./login-DreurRAq.js";
+import { C as restoreModelOptions, S as piIdOf, _ as modelOptionsFor, m as getContextWindow, p as enabledModelOptions, s as setProviderCredential, t as detectAuth, v as modelSupportsReasoning } from "./auth-CpdQebUy.js";
 import { createDockerContext } from "./contexts/docker.js";
 import { createTuiStore } from "./session/sqlite.js";
 import { $ as extractEditPayload, B as isVisible, C as chunkMarkdownForRender, E as stripHtmlCommentsOutsideCode, F as BASH_CALL_ID_PREFIX, G as streamEventSearchText, H as promptHistoryFromEvents, I as EDIT_TOOL_NAMES, J as buildContextualDiff, K as turnSelectionOwnership, L as isEditErrorResult, N as blendHsl, O as createSkillsCompletionProvider, P as buildLinearRamp, R as isTurnHighlighted, T as splitMarkdownCodeBlocks, U as selectableTurnIds, V as isVisibleDuringSearch, W as selectionAfterTurnRemoval, X as clipDiffForRender, Y as buildUnifiedDiff, _ as turnContextSize, a as TOOL_DISPLAY, at as buildEditOutcomesAnnotation, b as filterModelCatalog, ct as parseEditOutcomesFromResult, d as finalizeStreamingMarkdown, dt as stripEditOutcomesAnnotation, et as filetypeFromPath, f as finalizeStreamingMarkdownForOwner, ft as summarizeOutcomes, g as revealEarlierTranscriptEvents, h as replaceTranscriptTurnEvents, ht as createChatsCompletionProvider, i as turnAsText, j as createFilesCompletionProvider, k as uniqueSkillNamesFromReferences, lt as resolveApprovalForPayload, n as deleteTurnSafely, o as displayNameFor, p as hiddenEarlierTranscriptCount, r as truncateTurnsAt, rt as summarizeEditPayload, s as formatToolCall, st as mergeApprovalAndBodyOutcomes, tt as previewEditPayload, u as capTranscriptEvents, ut as rewriteMultiEditHeader, v as splitPromptSegments, w as normalizeMarkdownCodeFences, y as buildModelCatalog, z as isUserBashEvent } from "./turn-operations-CokV32wf.js";
@@ -153,7 +153,7 @@ function upsertMcpServer(filePath, entry) {
 			action: "added"
 		};
 	}
-	const raw = JSON.parse(readFileSync(filePath, "utf8"));
+	const raw = parseJsonTolerant(readFileSync(filePath, "utf8"));
 	if (Array.isArray(raw)) {
 		const idx = raw.findIndex((e) => isRecord(e) && e.name === entry.name);
 		const next = [...raw];
@@ -196,6 +196,41 @@ function upsertMcpServer(filePath, entry) {
 	}
 	throw new Error(`${filePath} is not a recognized mcps.json shape (array, map, or {"mcpServers": …}).`);
 }
+/**
+* Remove the entry named `name` from the mcps config at `filePath`,
+* preserving the file's shape and everything else in it — the removal
+* counterpart of {@link upsertMcpServer}. Throws when the file is
+* missing, malformed, an unrecognized shape, or has no entry of that
+* name (the caller shows the message on the settings op line; silently
+* "succeeding" on a no-op would lie about what happened).
+*/
+function removeMcpServer(filePath, name) {
+	if (!existsSync(filePath)) throw new Error(`${filePath} does not exist.`);
+	const raw = parseJsonTolerant(readFileSync(filePath, "utf8"));
+	if (Array.isArray(raw)) {
+		const next = raw.filter((e) => !(isRecord(e) && e.name === name));
+		if (next.length === raw.length) throw new Error(`no entry named "${name}" in ${filePath}.`);
+		writeFileSync(filePath, `${JSON.stringify(next, null, 2)}\n`);
+		return { path: filePath };
+	}
+	if (isRecord(raw)) {
+		if (isRecord(raw.mcpServers)) {
+			if (!(name in raw.mcpServers)) throw new Error(`no entry named "${name}" in ${filePath}.`);
+			const { [name]: _dropped, ...rest } = raw.mcpServers;
+			const next = {
+				...raw,
+				mcpServers: rest
+			};
+			writeFileSync(filePath, `${JSON.stringify(next, null, 2)}\n`);
+			return { path: filePath };
+		}
+		if (!(name in raw)) throw new Error(`no entry named "${name}" in ${filePath}.`);
+		const { [name]: _dropped, ...next } = raw;
+		writeFileSync(filePath, `${JSON.stringify(next, null, 2)}\n`);
+		return { path: filePath };
+	}
+	throw new Error(`${filePath} is not a recognized mcps.json shape (array, map, or {"mcpServers": …}).`);
+}
 /** Map-shaped files key entries by name — the inner object must not repeat it. */
 function stripName(entry) {
 	const { name: _name, ...rest } = entry;
@@ -4915,6 +4950,39 @@ function DiscoveryShell({ children }) {
 	const [mcpsErrors, setMcpsErrors] = useState([]);
 	const [filesCatalog, setFilesCatalog] = useState([]);
 	const [mcpToolsByServer, setMcpToolsByServer] = useState(() => readToolsByServer(dataDir));
+	/**
+	* Seed MCP auth badges from the on-disk credential store so rows show
+	* their auth state IMMEDIATELY (first paint, discovery refresh) instead
+	* of waiting a bootstrap round-trip:
+	*   - `auth: 'oauth'` entries — `✓ authed` when tokens exist, else
+	*     `! needs login` (the flag says OAuth is required either way).
+	*   - flagless entries — `✓ authed` only when stored tokens exist
+	*     (tokens are proof the server is OAuth: the same rule the bootstrap
+	*     uses to attach the provider). No tokens → stay `idle`; most
+	*     flagless servers are plain stdio/http and "needs login" would lie.
+	*   - static-Authorization entries — untouched (the user owns auth).
+	* The badge is a PREDICTION from disk state; bootstrap events
+	* (connect / auth-required / auth-error) overwrite it with ground truth.
+	*/
+	const seedMcpAuthBadges = useCallback((servers) => {
+		for (const entry of servers) {
+			const explicitOauth = entry.config.auth === "oauth";
+			if (!explicitOauth && hasAuthorizationHeader(entry.config.headers)) continue;
+			const hasTokens = !!mcpCredentialStore.load(entry.config.name)?.tokens;
+			if (explicitOauth) dispatchAuthRef.current(hasTokens ? {
+				type: "auth-success",
+				name: entry.config.name
+			} : {
+				type: "auth-required",
+				name: entry.config.name,
+				reason: "no-tokens"
+			});
+			else if (hasTokens) dispatchAuthRef.current({
+				type: "auth-success",
+				name: entry.config.name
+			});
+		}
+	}, [mcpCredentialStore]);
 	const filesSlotRef = useRef(null);
 	const skillsSlotRef = useRef(null);
 	/** Last-published MCP discovery result — see the value-compare in `refreshMcps`. */
@@ -4967,18 +5035,7 @@ function DiscoveryShell({ children }) {
 			setMcpsCatalog(servers);
 			setMcpsErrors(errors);
 			bootTick(`discovery:mcps (${servers.length} servers, ${errors.length} parse errors)`);
-			for (const entry of servers) {
-				if (entry.config.auth !== "oauth") continue;
-				const hasTokens = !!mcpCredentialStore.load(entry.config.name)?.tokens;
-				dispatchAuthRef.current(hasTokens ? {
-					type: "auth-success",
-					name: entry.config.name
-				} : {
-					type: "auth-required",
-					name: entry.config.name,
-					reason: "no-tokens"
-				});
-			}
+			seedMcpAuthBadges(servers);
 		} catch (err) {
 			debugLog$1("discoverProjectMcps failed", err);
 		}
@@ -4989,7 +5046,7 @@ function DiscoveryShell({ children }) {
 	}, [
 		projectDir,
 		config.prefix,
-		mcpCredentialStore,
+		seedMcpAuthBadges,
 		foreignAgents
 	]);
 	const ensureFiles = useCallback(() => filesSlotRef.current?.ensure() ?? Promise.resolve([]), []);
@@ -5007,30 +5064,20 @@ function DiscoveryShell({ children }) {
 				servers,
 				errors
 			});
-			if (fingerprint === mcpsFingerprintRef.current) return Promise.resolve();
+			if (fingerprint === mcpsFingerprintRef.current) return Promise.resolve(false);
 			mcpsFingerprintRef.current = fingerprint;
 			setMcpsCatalog(servers);
 			setMcpsErrors(errors);
-			for (const entry of servers) {
-				if (entry.config.auth !== "oauth") continue;
-				const hasTokens = !!mcpCredentialStore.load(entry.config.name)?.tokens;
-				dispatchAuthRef.current(hasTokens ? {
-					type: "auth-success",
-					name: entry.config.name
-				} : {
-					type: "auth-required",
-					name: entry.config.name,
-					reason: "no-tokens"
-				});
-			}
+			seedMcpAuthBadges(servers);
 		} catch (err) {
 			debugLog$1("refreshMcps failed", err);
+			return Promise.resolve(false);
 		}
-		return Promise.resolve();
+		return Promise.resolve(true);
 	}, [
 		projectDir,
 		config.prefix,
-		mcpCredentialStore,
+		seedMcpAuthBadges,
 		foreignAgents
 	]);
 	useEffect(() => {
@@ -13370,6 +13417,8 @@ function SettingsModal({ skillsCatalog: skillsCatalogProp, mcpsCatalog: mcpsCata
 	const [skillOp, setSkillOp] = useState(null);
 	const [mcpAdd, setMcpAdd] = useState(false);
 	const [mcpOp, setMcpOp] = useState(null);
+	const [skillRemoveArmed, setSkillRemoveArmed] = useState(null);
+	const [mcpRemoveArmed, setMcpRemoveArmed] = useState(null);
 	const [cursorByTab, setCursorByTab] = useState(() => Object.fromEntries(tabOrder.map((id) => [id, 0])));
 	const [query, setQuery] = useState("");
 	const [logsMinLevel, setLogsMinLevel] = useState("debug");
@@ -13792,6 +13841,13 @@ function SettingsModal({ skillsCatalog: skillsCatalogProp, mcpsCatalog: mcpsCata
 	useEffect(() => {
 		setRemoveArmed(null);
 	}, [focusedExtension?.name, activeTab]);
+	const focusedSkill = activeTab === "skills" ? filteredSkills[cursor] : void 0;
+	useEffect(() => {
+		setSkillRemoveArmed(null);
+	}, [focusedSkill?.name, activeTab]);
+	useEffect(() => {
+		setMcpRemoveArmed(null);
+	}, [focusedMcp?.config.name, activeTab]);
 	const oauthPasteActive = activeTab === "mcps" && focusedMcpStatus?.kind === "authorizing" && !!focusedMcpStatus.url;
 	useEffect(() => {
 		if (!oauthPasteActive && !editingInputKey) inputRef.current?.focus();
@@ -13999,15 +14055,69 @@ function SettingsModal({ skillsCatalog: skillsCatalogProp, mcpsCatalog: mcpsCata
 		if (key.ctrl && key.name === "g" && activeTab === "skills" && actions?.onInstallSkill) {
 			key.preventDefault();
 			if (skillOp?.kind === "busy") return;
+			setSkillRemoveArmed(null);
 			setSkillInstallOpen(true);
 			return;
 		}
+		if (key.ctrl && key.name === "x" && activeTab === "skills" && actions?.onRemoveSkill) {
+			key.preventDefault();
+			const skill = focusedSkill;
+			if (!skill || skillOp?.kind === "busy") return;
+			if (skillRemoveArmed !== skill.name) {
+				setSkillRemoveArmed(skill.name);
+				setSkillOp({
+					kind: "notice",
+					text: `delete "${skill.name}" from disk? press ctrl+x again to confirm.`
+				});
+				return;
+			}
+			setSkillRemoveArmed(null);
+			setSkillOp({
+				kind: "busy",
+				text: `deleting "${skill.name}"…`
+			});
+			actions.onRemoveSkill(skill).then((message) => setSkillOp({
+				kind: "notice",
+				text: message
+			})).catch((err) => setSkillOp({
+				kind: "error",
+				text: errorMessage(err)
+			}));
+			return;
+		}
 		if (key.ctrl && key.name === "g" && activeTab === "mcps" && actions?.onAddMcp) {
 			key.preventDefault();
 			if (mcpOp?.kind === "busy") return;
+			setMcpRemoveArmed(null);
 			setMcpAdd(true);
 			return;
 		}
+		if (key.ctrl && key.name === "x" && activeTab === "mcps" && actions?.onRemoveMcp) {
+			key.preventDefault();
+			if (focusedMcpRow?.kind !== "server" || !focusedMcp || mcpOp?.kind === "busy") return;
+			const name = focusedMcp.config.name;
+			if (mcpRemoveArmed !== name) {
+				setMcpRemoveArmed(name);
+				setMcpOp({
+					kind: "notice",
+					text: `remove "${name}" from ${displayPath$1(focusedMcp.path, homedir())}? press ctrl+x again to confirm.`
+				});
+				return;
+			}
+			setMcpRemoveArmed(null);
+			setMcpOp({
+				kind: "busy",
+				text: `removing "${name}"…`
+			});
+			actions.onRemoveMcp(focusedMcp).then((message) => setMcpOp({
+				kind: "notice",
+				text: message
+			})).catch((err) => setMcpOp({
+				kind: "error",
+				text: errorMessage(err)
+			}));
+			return;
+		}
 		if (key.ctrl && key.name === "r") {
 			if (activeTab === "skills" && actions?.onRefreshSkills) {
 				actions.onRefreshSkills();
@@ -14271,6 +14381,8 @@ function SettingsModal({ skillsCatalog: skillsCatalogProp, mcpsCatalog: mcpsCata
 					canInstallExtension: !!actions?.onInstallExtension,
 					canInstallSkill: !!actions?.onInstallSkill,
 					canAddMcp: !!actions?.onAddMcp,
+					canRemoveSkill: !!actions?.onRemoveSkill,
+					canRemoveMcp: !!actions?.onRemoveMcp,
 					focusedExtensionExpandable: activeTab === "extensions" && extensionVisibleRows[cursor] !== void 0 && (() => {
 						const row = extensionVisibleRows[cursor];
 						return row.kind === "config" || row.kind === "extension" && row.hasConfig;
@@ -14934,6 +15046,7 @@ function SkillsList({ items, enabledSet, totalCount, cursor, highlightBg, query,
 			const bg = focused ? highlightBg : void 0;
 			const enabled = enabledSet.has(entry.name);
 			const description = truncateToCols(entry.description ?? "", descCols);
+			const origin = skillOriginLabel(entry);
 			return /* @__PURE__ */ jsxs("box", {
 				id: anchorIdFor(i),
 				style: {
@@ -14957,6 +15070,10 @@ function SkillsList({ items, enabledSet, totalCount, cursor, highlightBg, query,
 						/* @__PURE__ */ jsx$1("span", {
 							fg: focused ? COLOR.brand : COLOR.dim,
 							children: entry.name
+						}),
+						origin && /* @__PURE__ */ jsxs("span", {
+							fg: COLOR.mute,
+							children: [" · ", origin]
 						})
 					]
 				}), /* @__PURE__ */ jsx$1("text", {
@@ -15642,7 +15759,7 @@ function renderMcpErrors(errors, home, warnColor) {
 		}, err.path))
 	});
 }
-function Hints({ activeTab, focusedMcp, focusedMcpRow, focusedMcpStatus, canRefreshSkills, canRefreshMcps, canEditExtension, canCreateExtension, canUpdateExtension, canRemoveExtension, canInstallExtension, canInstallSkill, canAddMcp, focusedExtensionExpandable }) {
+function Hints({ activeTab, focusedMcp, focusedMcpRow, focusedMcpStatus, canRefreshSkills, canRefreshMcps, canEditExtension, canCreateExtension, canUpdateExtension, canRemoveExtension, canInstallExtension, canInstallSkill, canAddMcp, canRemoveSkill, canRemoveMcp, focusedExtensionExpandable }) {
 	const COLOR = useColors();
 	const onServerRow = focusedMcpRow?.kind === "server";
 	const showLogin = activeTab === "mcps" && onServerRow && !!focusedMcp && !!focusedMcpStatus && canLogin$1(focusedMcp, focusedMcpStatus);
@@ -15733,6 +15850,14 @@ function Hints({ activeTab, focusedMcp, focusedMcpRow, focusedMcpStatus, canRefr
 				}),
 				" install"
 			] }),
+			activeTab === "skills" && canRemoveSkill && /* @__PURE__ */ jsxs("span", { children: [
+				" · ",
+				/* @__PURE__ */ jsx$1("span", {
+					fg: COLOR.warn,
+					children: "ctrl+x"
+				}),
+				" delete"
+			] }),
 			activeTab === "mcps" && canAddMcp && /* @__PURE__ */ jsxs("span", { children: [
 				" · ",
 				/* @__PURE__ */ jsx$1("span", {
@@ -15741,6 +15866,14 @@ function Hints({ activeTab, focusedMcp, focusedMcpRow, focusedMcpStatus, canRefr
 				}),
 				" add server"
 			] }),
+			activeTab === "mcps" && canRemoveMcp && onServerRow && /* @__PURE__ */ jsxs("span", { children: [
+				" · ",
+				/* @__PURE__ */ jsx$1("span", {
+					fg: COLOR.warn,
+					children: "ctrl+x"
+				}),
+				" remove"
+			] }),
 			showLogin && /* @__PURE__ */ jsxs("span", { children: [
 				" · ",
 				/* @__PURE__ */ jsx$1("span", {
@@ -15789,7 +15922,22 @@ function generalCorpus(item) {
 	return parts.join(" ").toLowerCase();
 }
 function skillCorpus(s) {
-	return `${s.name} ${s.description ?? ""}`.toLowerCase();
+	return `${s.name} ${s.description ?? ""} ${skillOriginLabel(s)}`.toLowerCase();
+}
+/**
+* Short provenance chip for a skill row. Standard scan roots
+* (`.agents/skills`, `.{prefix}/skills` — project or user) are fully
+* described by the scope tag; a skill from a custom `skillsScanPaths`
+* entry shows the tilde-collapsed path itself so the user can tell
+* WHICH extra root contributed it. Inline / builtin skills (no
+* directory on disk) show their source tag.
+*/
+function skillOriginLabel(skill) {
+	const dir = skill.baseDir ?? (skill.location ? dirname(skill.location) : void 0);
+	if (!dir) return skill.source ?? "inline";
+	const root = dirname(dir);
+	if (/\/\.[^/]+\/skills$/.test(root)) return skill.source ?? "project";
+	return truncateToCols(displayPath$1(root, homedir()), 36);
 }
 function extensionCorpus(e) {
 	return [
@@ -17082,6 +17230,8 @@ function AppShell() {
 	const dispatchAuth = useMcpAuthDispatch();
 	const dispatchAuthRef = useRef(dispatchAuth);
 	dispatchAuthRef.current = dispatchAuth;
+	const pendingAutoLoginMcpRef = useRef(null);
+	const onLoginMcpRef = useRef(null);
 	const skillsCatalogRef = useRef(skillsCatalog);
 	skillsCatalogRef.current = skillsCatalog;
 	const enabledSkillsRef = useRef(settings.enabledSkills);
@@ -18232,6 +18382,13 @@ function AppShell() {
 				name,
 				reason
 			});
+			if (pendingAutoLoginMcpRef.current === name) {
+				pendingAutoLoginMcpRef.current = null;
+				onLoginMcpRef.current?.(name);
+			}
+		});
+		agent.hooks.hook("mcp:bootstrap:settled", () => {
+			pendingAutoLoginMcpRef.current = null;
 		});
 		agent.hooks.hook("mcp:bootstrap:end", (ctx) => {
 			if (ctx.ok) return;
@@ -18275,6 +18432,7 @@ function AppShell() {
 				type: "connected",
 				name
 			});
+			if (pendingAutoLoginMcpRef.current === name) pendingAutoLoginMcpRef.current = null;
 		});
 		agent.hooks.hook("stream:thinking", ({ delta, turnId }) => stream.queueStreamDelta("thinking", delta, { turnId }));
 		agent.hooks.hook("stream:text", ({ delta, turnId }) => stream.queueStreamDelta("markdown", delta, { turnId }));
@@ -19243,9 +19401,73 @@ function AppShell() {
 			cwd: cwdRef.current,
 			prefix: config.prefix
 		}), entry);
-		await onRefreshMcps();
+		pendingAutoLoginMcpRef.current = entry.name;
+		if (!await onRefreshMcps() && pendingAutoLoginMcpRef.current === entry.name) pendingAutoLoginMcpRef.current = null;
 		return `${result.action} "${entry.name}" → ${compactPath(result.path, 64)}`;
 	}, [config.prefix, onRefreshMcps]);
+	/**
+	* Delete a discovered skill's directory (Settings → Skills → ctrl+x,
+	* two-press confirm in the modal). Only skills that live on disk in a
+	* root we can safely mutate qualify; the SKILL.md existence check
+	* guards against ever recursively deleting a directory that isn't a
+	* skill (e.g. a stale catalog entry pointing at a reused path).
+	*
+	* `.agents/skills/` entries ARE deletable — deliberately asymmetric
+	* with `onRemoveMcp`'s ownership gate. An MCP removal edits a shared
+	* multi-entry FILE other tools author (clobber risk); a skill is a
+	* self-contained directory that is itself the install/uninstall unit,
+	* and cross-tool installers (skills.sh, `ctrl+g` here) drop skills
+	* into `.agents/skills/` expecting exactly this kind of removal.
+	*/
+	const onRemoveSkill = useCallback(async (skill) => {
+		const dir = skill.baseDir ?? (skill.location ? dirname(skill.location) : void 0);
+		if (!dir || skill.source === "inline" || skill.source === "builtin") throw new Error(`"${skill.name}" is ${skill.source ?? "inline"} — nothing on disk to delete.`);
+		if (!existsSync(join(dir, "SKILL.md"))) throw new Error(`${compactPath(dir)} has no SKILL.md — refusing to delete.`);
+		rmSync(dir, {
+			recursive: true,
+			force: true
+		});
+		const allow = enabledSkillsRef.current;
+		if (allow?.includes(skill.name)) {
+			const next = allow.filter((n) => n !== skill.name);
+			enabledSkillsRef.current = next;
+			setSetting("enabledSkills", next);
+		}
+		await onRefreshSkills();
+		return `deleted "${skill.name}" (${compactPath(dir)})`;
+	}, [setSetting, onRefreshSkills]);
+	/**
+	* Remove an MCP server from the config file that declared it
+	* (Settings → MCPs → ctrl+x, two-press confirm in the modal).
+	* Ownership-gated: only entries in a `.{prefix}/` file are removable —
+	* `.agents/` siblings and imported foreign configs (Claude / Cursor /
+	* VS Code) are cross-tool files we read but never rewrite, so the
+	* error points the user at the declaring file instead.
+	*/
+	const onRemoveMcp = useCallback(async (entry) => {
+		const name = entry.config.name;
+		const prefix = (config.prefix ?? ".zidane").replace(/^\./, "");
+		if (!entry.path.includes(`/.${prefix}/`)) throw new Error(`"${name}" is defined in ${compactPath(entry.path, 64)} — zidane doesn't edit that file; remove the entry there.`);
+		removeMcpServer(entry.path, name);
+		const enabled = enabledMcpsRef.current;
+		if (enabled?.includes(name)) {
+			const next = enabled.filter((n) => n !== name);
+			enabledMcpsRef.current = next;
+			setSetting("enabledMcps", next);
+		}
+		const deny = disabledMcpToolsRef.current;
+		if (deny && name in deny) {
+			const { [name]: _dropped, ...rest } = deny;
+			disabledMcpToolsRef.current = rest;
+			setSetting("disabledMcpTools", rest);
+		}
+		await onRefreshMcps();
+		return `removed "${name}" from ${compactPath(entry.path, 64)}`;
+	}, [
+		config.prefix,
+		setSetting,
+		onRefreshMcps
+	]);
 	const popupOpenRef = useRef(false);
 	const onPopupOpenChange = useCallback((open) => {
 		popupOpenRef.current = open;
@@ -19706,7 +19928,7 @@ function AppShell() {
 	* user runs comes from that same gate; each `runAgent` awaits its
 	* `agent.run` so the single-flight agent is never re-entered.
 	*/
-	const runCommand = useCallback(async (invocation) => {
+	const runCommand = useCallback(async (invocation, attachments = []) => {
 		const session = sessionRef.current;
 		const agent = agentRef.current;
 		if (!session) return;
@@ -19766,6 +19988,11 @@ function AppShell() {
 		const ctx = {
 			args: invocation.args,
 			argv: invocation.argv,
+			...attachments.length > 0 ? { attachments: attachments.map((a) => ({
+				name: a.name,
+				mediaType: a.mediaType,
+				data: a.content.toString("base64")
+			})) } : {},
 			data: {},
 			emit: emitBlock,
 			runAgent: async (agentPrompt, agentOpts) => {
@@ -20142,7 +20369,7 @@ function AppShell() {
 		if (!opts?.wake) {
 			const invocation = parseCommandInvocation(prompt, commandsRef.current);
 			if (invocation) {
-				await runCommand(invocation);
+				await runCommand(invocation, attachments);
 				return;
 			}
 			const bashCommand = parseBashInvocation(prompt);
@@ -20518,6 +20745,7 @@ function AppShell() {
 		mcpCredentialStore,
 		rebuildActiveAgent
 	]);
+	onLoginMcpRef.current = onLoginMcp;
 	const onLogoutMcp = useCallback((name) => {
 		mcpCredentialStore.delete(name);
 		const entry = mcpsCatalogRef.current.find((d) => d.config.name === name);
@@ -21199,6 +21427,8 @@ function AppShell() {
 					}),
 					onInstallSkill,
 					onAddMcp,
+					onRemoveSkill,
+					onRemoveMcp,
 					onPickCompactionModel
 				}
 			}));