zidane 6.3.6 → 6.3.8

package/dist/tui.js

@@ -1,5 +1,5 @@
-import { $ as InteractionsProvider, $t as countClaudeSessionFiles, A as runOAuthLogin, Bt as ConfigProvider, Cn as discoverAgentsMd, Cr as toolCallPreview, Ct as clampFps, D as formatPathForCwd, Dt as resolveChipColor, Er as usageByModel, F as refreshMcpToolsCatalog, Gt as chainPositionOf, H as indexOfServerRow, Ht as resolveConfig, It as createDiscoverySlot, J as useMcpAuthDispatch, Jt as providerKeySetChanged, Kt as chainsEqual, L as subscribeMcpToolsCache, Ln as TODO_STATUS_GLYPHS, Lt as DiscoveryProvider, N as loadMcpToolsCache, O as fetchOAuthRedirect, Ot as resolveTheme, P as mcpToolsCachePath, Q as ASK_USER_TOOL, Qt as useCompletion, Rt as useDiscovery, Sn as chatAutoCompactBehavior, St as SettingsProvider, T as suggestSafelistEntries, Tr as updateToolEventOutcomes, U as parentServerName, Ut as resolveStoragePaths, V as buildVisibleMcpRows, Vt as useConfig, W as createFileMcpCredentialStore, Wn as pruneTodosByRun, Wt as buildRunModel, X as getMcpAuthStatus, Y as useMcpAuthState, Yt as restoreChainFallbacks, Zt as toggleChainEntry, _ as useSafeModeQueue, _r as marginTopFor, _t as DEFAULT_SETTINGS, a as useSurfaces, an as buildMcpServers, ar as buildPlanSystem, at as pendingInteractionsFromTurns, b as getSafelist, br as stripSpawnTokensLine, bt as SETTINGS_INPUTS, c as useStreamBuffer, cr as createChatTurnsReadTool, ct as useInteractionsQueue, d as discoverProjectSkills, dn as bootTick, dt as hintsLength, en as hasClaudeCodeSetup, et as PRESENT_PLAN_TOOL, fn as buildUpdateHint, fr as deriveSessionTitle, ft as truncateTrailing, g as useSafeModeActions, gr as loadState, gt as useEnabledToggleSet, h as SafeModeProvider, hr as listSessionMeta, ht as listProjectFiles, i as useSelectStyle, in as upsertMcpServer, ir as buildBuildSystem, it as makeRequestInteraction, j as supportsOAuth, jn as accentColor, k as oauthUsesManualCodePaste, l as buildSkillsConfig, ln as tryOpenBrowser, lt as EMPTY_HINTS, m as writeSessionExport, mr as lastContextSizeFromTurns, n as ThemeProvider, nn as mcpsWritePath, nt as createInteractionTools, or as envSection, pn as useUpdateCheck, pr as eventsFromTurns, pt as buildHints, q as McpAuthProvider, qn as useActiveTodos, qt as filterChainFallbacks, r as useColors, rn as removeMcpServer, s as useTheme, sn as discoverProjectMcps, sr as chatReferenceTokensForPrompt, st as useInteractionsActions, t as computeTurnAnchors, tn as importFromClaudeCode, tt as buildResumedToolResultsTurn, u as defaultSkillScanPaths, ur as compactSummaryEvent, ut as clipHintsToWidth, vt as SETTINGS_CATEGORIES, wr as toolResultText, wt as useSettings, x as isOnSafelist, xr as sumRunCosts, xt as SETTINGS_TOGGLES, y as addToSafelist, yr as serverToolResultSummary, yt as SETTINGS_CHOICES, z as useMcpToolToggleMap, zt as useDiscoveryOptional } from "./transcript-anchors-Bsmm4435.js";
-import { $ as removeInstalledExtension, At as looksBinary, C as resolveTasksDir, E as selectFilesFromSession, Gt as KEYBINDING_KEY_COL_WIDTH, Jt as groupBindings, K as createExtensionPromptBridge, Kt as ensureKeybindingsFile, Mt as createModelSearchTool, O as compactConversation, Ot as tailTruncate, S as resolveSessionDir, Sn as effectiveContextWindow, V as summaryToTurn, Xt as matchesBinding, Y as installExtensionFromSpec, Yt as keybindingsPath, _ as rehomePersistedStubs, _n as resolveExtensionConfigValue, at as composeExtensionPreset, b as resolveMcpWarningsDir, c as applyCompactSummaryCutoff, et as updateInstalledExtension, ht as basic_default, ln as parseExtensionScanPathEnv, lt as partitionExtensionCatalog, m as cleanupPersistedSession, nt as discoverAndBuildExtensionRegistry, ot as disposeExtensionRegistry, pn as coerceExtensionConfigInput, q as ExtensionInstallError, qt as formatBindingForDisplay, rn as registerExtensionHostModules, sn as inlineLoadedExtension, st as filterExtensionRegistry, t as createAgent, tn as resolveExtensionKeybindings, tt as createExtensionHud, un as scanExtensionDirectories, ut as createExtensionHostRuntimeBridge, v as resolveLegacyPersistDir, vn as sanitizeExtensionConfigActionPatch, w as buildPostCompactAttachments, x as resolvePersistDir, xn as OUTPUT_RESERVE_TOKENS, xt as isSpawnTool, y as resolveLegacySessionDir } from "./agent-xjMzFclr.js";
+import { $t as toggleChainEntry, A as redirectUriFromAuthUrl, At as resolveTheme, Bt as useDiscovery, Cr as sumRunCosts, Ct as SETTINGS_TOGGLES, D as formatPathForCwd, Dr as updateToolEventOutcomes, Er as toolResultText, Et as useSettings, F as loadMcpToolsCache, G as parentServerName, Gt as resolveStoragePaths, Ht as ConfigProvider, I as mcpToolsCachePath, Jt as chainsEqual, K as createFileMcpCredentialStore, Kn as pruneTodosByRun, Kt as buildRunModel, L as refreshMcpToolsCatalog, M as runOAuthLogin, N as supportsOAuth, Nn as accentColor, O as fetchOAuthRedirect, Or as usageByModel, Q as getMcpAuthStatus, Rt as createDiscoverySlot, Sr as stripSpawnTokensLine, St as SETTINGS_INPUTS, T as suggestSafelistEntries, Tn as discoverAgentsMd, Tr as toolCallPreview, Tt as clampFps, U as buildVisibleMcpRows, Ut as useConfig, V as useMcpToolToggleMap, Vt as useDiscoveryOptional, W as indexOfServerRow, Wt as resolveConfig, X as useMcpAuthDispatch, Xt as providerKeySetChanged, Y as McpAuthProvider, Yn as useActiveTodos, Yt as filterChainFallbacks, Z as useMcpAuthState, Zt as restoreChainFallbacks, _ as useSafeModeQueue, _r as listSessionMeta, _t as listProjectFiles, a as useSurfaces, an as removeMcpServer, b as getSafelist, bt as SETTINGS_CATEGORIES, c as useStreamBuffer, cr as envSection, d as discoverProjectSkills, dn as tryOpenBrowser, dt as EMPTY_HINTS, en as useCompletion, et as ASK_USER_TOOL, fr as compactSummaryEvent, ft as clipHintsToWidth, g as useSafeModeActions, gr as lastContextSizeFromTurns, h as SafeModeProvider, hn as useUpdateCheck, hr as eventsFromTurns, ht as buildHints, i as useSelectStyle, in as mcpsWritePath, it as createInteractionTools, j as oauthUsesManualCodePaste, kt as resolveChipColor, l as buildSkillsConfig, ln as discoverProjectMcps, lr as chatReferenceTokensForPrompt, lt as useInteractionsActions, m as writeSessionExport, mn as buildUpdateHint, mr as deriveSessionTitle, mt as truncateTrailing, n as ThemeProvider, nn as hasClaudeCodeSetup, nt as PRESENT_PLAN_TOOL, on as upsertMcpServer, or as buildBuildSystem, ot as makeRequestInteraction, pn as bootTick, pt as hintsLength, qt as chainPositionOf, r as useColors, rn as importFromClaudeCode, rt as buildResumedToolResultsTurn, s as useTheme, sn as buildMcpServers, sr as buildPlanSystem, st as pendingInteractionsFromTurns, t as computeTurnAnchors, tn as countClaudeSessionFiles, tt as InteractionsProvider, u as defaultSkillScanPaths, ur as createChatTurnsReadTool, ut as useInteractionsQueue, vr as loadState, vt as useEnabledToggleSet, wn as chatAutoCompactBehavior, wt as SettingsProvider, x as isOnSafelist, xr as serverToolResultSummary, xt as SETTINGS_CHOICES, y as addToSafelist, yr as marginTopFor, yt as DEFAULT_SETTINGS, z as subscribeMcpToolsCache, zn as TODO_STATUS_GLYPHS, zt as DiscoveryProvider } from "./transcript-anchors-DhBTqTyc.js";
+import { $ as removeInstalledExtension, At as looksBinary, C as resolveTasksDir, E as selectFilesFromSession, Gt as KEYBINDING_KEY_COL_WIDTH, Jt as groupBindings, K as createExtensionPromptBridge, Kt as ensureKeybindingsFile, Mt as createModelSearchTool, O as compactConversation, Ot as tailTruncate, S as resolveSessionDir, Sn as effectiveContextWindow, V as summaryToTurn, Xt as matchesBinding, Y as installExtensionFromSpec, Yt as keybindingsPath, _ as rehomePersistedStubs, _n as resolveExtensionConfigValue, at as composeExtensionPreset, b as resolveMcpWarningsDir, c as applyCompactSummaryCutoff, et as updateInstalledExtension, ht as basic_default, ln as parseExtensionScanPathEnv, lt as partitionExtensionCatalog, m as cleanupPersistedSession, nt as discoverAndBuildExtensionRegistry, ot as disposeExtensionRegistry, pn as coerceExtensionConfigInput, q as ExtensionInstallError, qt as formatBindingForDisplay, rn as registerExtensionHostModules, sn as inlineLoadedExtension, st as filterExtensionRegistry, t as createAgent, tn as resolveExtensionKeybindings, tt as createExtensionHud, un as scanExtensionDirectories, ut as createExtensionHostRuntimeBridge, v as resolveLegacyPersistDir, vn as sanitizeExtensionConfigActionPatch, w as buildPostCompactAttachments, x as resolvePersistDir, xn as OUTPUT_RESERVE_TOKENS, xt as isSpawnTool, y as resolveLegacySessionDir } from "./agent-Emjeo5Ad.js";
 import { a as formatDuration, c as previewLine, i as fmtTokens, l as shortId, n as compactPath, o as formatTaskStatus, r as fmtCost, s as formatTaskSummary, t as ageString } from "./format-BF745pLL.js";
 import { n as appendCapped } from "./output-cap-C9zukcCj.js";
 import { i as killProcessGroup, n as SUPPORTS_PROCESS_GROUPS, r as createProcessContext } from "./contexts-DWVt7MvF.js";
@@ -7,7 +7,7 @@ import { l as errorMessage } from "./errors-DJUxZg9b.js";
 import { M as findGitRoot } from "./resolve-BPTA1RpX.js";
 import { a as createRingBufferSink, i as createLoggingHooks, l as logFileTimestamp, n as createFileSink, o as fanoutSink, r as createLogger, s as formatLogLine, t as consoleSink } from "./logger-DBX9uYOw.js";
 import { i as sniffImageMediaType } from "./media-sniff-UKijEaiQ.js";
-import { g as hasAuthorizationHeader, m as McpOAuthProvider, n as connectMcpServers, s as nonOwningMcpView } from "./mcp-B5iXOceC.js";
+import { g as hasAuthorizationHeader, m as McpOAuthProvider, n as connectMcpServers, s as nonOwningMcpView } from "./mcp-8bEHU4WB.js";
 import { C as estimateRebilledCostUsd } from "./openai-compat-Bf9uMTMa.js";
 import { replaceDynamicSection } from "./prompt.js";
 import { a as getExtensionSessionState, c as setExtensionSessionState, i as demoteStaleRunningStatus, o as loadSession, t as createSession } from "./session-Bdk31kA5.js";
@@ -17,7 +17,7 @@ import { i as installCacheBreakLogger } from "./cache-telemetry-ehVdWsg2.js";
 import { a as generateStructuredData, c as shouldAutoGenerateTitle, f as commandBlockToEvent, g as parseCommandInvocation, h as executeCommand, n as patchInlineGhost, p as commandBlocksToContent, r as resolveInlineSuggestion, s as generateSessionTitle, t as createPathAutocompleteProvider } from "./inline-autocomplete-DC2cxprN.js";
 import { s as resolveCompletionSubmit } from "./completion-core-BRo86R_L.js";
 import { i as installSkillFromSpec, r as SkillInstallError } from "./skills-C7eIjWYm.js";
-import { a as ZIDANE_EXTENSION_SKILL_NAME, d as extensionScaffold, f as readSkillEditMarker, h as withZidaneSkillEditSkill, i as SKILL_EDIT_METADATA_KEY, l as editSessionMetadata, m as withZidaneExtensionSkill, o as ZIDANE_SKILL_EDIT_SKILL_NAME, t as loginMcpServer, u as extensionDirForCwd } from "./login-DZHMF7Gl.js";
+import { a as ZIDANE_EXTENSION_SKILL_NAME, d as extensionScaffold, f as readSkillEditMarker, h as withZidaneSkillEditSkill, i as SKILL_EDIT_METADATA_KEY, l as editSessionMetadata, m as withZidaneExtensionSkill, o as ZIDANE_SKILL_EDIT_SKILL_NAME, t as loginMcpServer, u as extensionDirForCwd } from "./login-Cvx1nSVm.js";
 import { C as restoreModelOptions, S as piIdOf, _ as modelOptionsFor, m as getContextWindow, p as enabledModelOptions, s as setProviderCredential, t as detectAuth, v as modelSupportsReasoning, w as renderDefaultCallbackPage } from "./auth-Dptb8U5J.js";
 import { createDockerContext } from "./contexts/docker.js";
 import { createTuiStore } from "./session/sqlite.js";
@@ -3475,7 +3475,7 @@ function UserPromptBlock({ text, refs, attachments, searchQuery }) {
 	});
 }
 /** Click-feedback delay before `[copied]` reverts to `[copy]`, in ms. */
-const COPY_FEEDBACK_MS = 1200;
+const COPY_FEEDBACK_MS$1 = 1200;
 /**
 * BoxRenderable subclass that hosts a `[lang]  …  [copy]` header above
 * an inner {@link CodeRenderable} body. Returned from
@@ -3583,7 +3583,7 @@ var CodeBlockWrapper = class extends BoxRenderable {
 				if (this.button.isDestroyed) return;
 				this.button.content = "[copy]";
 				this.button.fg = this.bag.colors.warn;
-			}, COPY_FEEDBACK_MS);
+			}, COPY_FEEDBACK_MS$1);
 		};
 		this.header.add(this.langLabel);
 		this.header.add(this.spacer);
@@ -9419,11 +9419,12 @@ function OptionList({ items, initialCursor, onPick }) {
 * budget — default 14 fits a typical modal; pass a smaller value for
 * less-padded containers (e.g. 6 for the auth wizard panel).
 */
-function OAuthUrlBlock({ url, fg, maxLineWidth, chromeWidth = 14 }) {
+function OAuthUrlBlock({ url, fg, bg, maxLineWidth, chromeWidth = 14 }) {
 	const { width: termWidth } = useTerminalDimensions();
 	return /* @__PURE__ */ jsx$1(Fragment, { children: chunkString(url, Math.max(20, Math.min(maxLineWidth, termWidth - chromeWidth))).map((line, i) => /* @__PURE__ */ jsx$1("text", {
 		wrapMode: "none",
 		fg,
+		...bg ? { bg } : {},
 		children: /* @__PURE__ */ jsx$1("a", {
 			href: url,
 			children: line
@@ -9441,6 +9442,65 @@ function chunkString(s, n) {
 /** Keystroke shown next to the open-browser button. */
 const OPEN_BROWSER_KEY = "ctrl+b";
 /**
+* Keystroke shown next to the copy-URL button. `ctrl+y` is the global
+* `openKeybindings` chord, but it can't collide here: every surface that
+* mounts this block is either a modal (`app.tsx` bails on `modal.isOpen`
+* before dispatching global bindings) or the auth screen (excluded by
+* `screen !== 'auth'`). It's also absent from OpenTUI's input key table,
+* so the focused paste field ignores it.
+*/
+const COPY_URL_KEY = "ctrl+y";
+/** How long a `copied` confirmation stays on screen. */
+const COPY_FEEDBACK_MS = 4e3;
+/**
+* Paste-input capacity. OpenTUI's `InputRenderable` defaults to 1000 chars
+* and silently drops the overflow — long enough to truncate a callback URL
+* carrying a fat `code` + `state` and make a correct paste look corrupt.
+*/
+const PASTE_MAX_LENGTH = 4096;
+/** After this long without an authorization URL, spell out the escape route. */
+const SLOW_START_SECONDS = 8;
+/**
+* Seconds elapsed since `active` became true, ticking once a second.
+* Frozen (and reset) when inactive so the panel doesn't repaint after the
+* URL lands.
+*/
+function useElapsedSeconds(active) {
+	const [seconds, setSeconds] = useState(0);
+	useEffect(() => {
+		if (!active) {
+			setSeconds(0);
+			return;
+		}
+		const started = Date.now();
+		const timer = setInterval(() => setSeconds(Math.floor((Date.now() - started) / 1e3)), 1e3);
+		return () => clearInterval(timer);
+	}, [active]);
+	return seconds;
+}
+/**
+* Copy-to-clipboard with a self-clearing "copied" flag. Every copy
+* affordance in this module shares it so the timers are cleaned up on
+* unmount in exactly one place.
+*/
+function useCopyFlash() {
+	const [copied, setCopied] = useState(false);
+	const timer = useRef(null);
+	const copy = useCallback((text) => {
+		if (!writeToClipboard(text)) return;
+		setCopied(true);
+		if (timer.current) clearTimeout(timer.current);
+		timer.current = setTimeout(setCopied, COPY_FEEDBACK_MS, false);
+	}, []);
+	useEffect(() => () => {
+		if (timer.current) clearTimeout(timer.current);
+	}, []);
+	return {
+		copied,
+		copy
+	};
+}
+/**
 * Device-authorization affordance (RFC 8628): the user code the user must see
 * on the consent screen, plus the verification URI they type it into.
 *
@@ -9452,19 +9512,13 @@ const OPEN_BROWSER_KEY = "ctrl+b";
 */
 function OAuthDeviceCodeBlock({ userCode, verificationUri, expiresInSeconds }) {
 	const COLOR = useColors();
-	const [copied, setCopied] = useState(false);
-	const copyTimer = useRef(null);
+	const { copied, copy } = useCopyFlash();
 	useKeyboard((key) => {
 		if (key.name === "u" && key.ctrl) {
 			key.preventDefault();
-			setCopied(writeToClipboard(userCode));
-			if (copyTimer.current) clearTimeout(copyTimer.current);
-			copyTimer.current = setTimeout(setCopied, 4e3, false);
+			copy(userCode);
 		}
 	});
-	useEffect(() => () => {
-		if (copyTimer.current) clearTimeout(copyTimer.current);
-	}, []);
 	return /* @__PURE__ */ jsxs("box", {
 		style: { flexDirection: "column" },
 		children: [
@@ -9489,23 +9543,29 @@ function OAuthDeviceCodeBlock({ userCode, verificationUri, expiresInSeconds }) {
 	});
 }
 /**
-* Unified affordance for surfacing an OAuth authorization URL in the TUI:
+* Unified affordance for surfacing an OAuth authorization URL in the TUI,
+* laid out as two numbered steps so the remote-session path reads as a
+* first-class option instead of a footnote:
 *
-*   1. A prominent OSC 8 hyperlink button — "Click here to open auth URL in
-*      browser". Honored by every terminal that supports clickable links
-*      (iTerm2, Kitty, WezTerm, Ghostty, Alacritty, …). Lands on the user's
-*      LOCAL terminal even over SSH because OSC 8 is interpreted client-side.
-*   2. The full URL rendered greyed below, chunked into per-row hyperlinks
-*      via {@link OAuthUrlBlock}. Backup channel for terminals without OSC 8,
-*      and for users who'd rather copy via drag-select than click.
-*   3. Optional paste-back input. When `paste` is provided, an `<input>`
-*      renders below the URL so the user can paste the FULL redirect URL
-*      their browser ended up at after authorizing — useful when zidane runs
-*      over SSH and the browser-side redirect to loopback can't reach the
-*      remote callback server. The caller's `onSubmit` typically pipes the
-*      pasted value through {@link fetchOAuthRedirect} so the in-process
-*      server receives the request and the OAuth promise resolves through
-*      the same happy path a real browser would have taken.
+*   **1 — get to the consent screen.** Two real buttons (mouse-clickable
+*   AND keyed): {@link OPEN_BROWSER_KEY} opens the URL via the OS handler,
+*   {@link COPY_URL_KEY} copies it to the clipboard (OSC 52 → lands on the
+*   user's LOCAL clipboard over SSH). Below them the URL itself sits in a
+*   framed panel with its own `[copy]` button, chunked into per-row OSC 8
+*   hyperlinks by {@link OAuthUrlBlock} — the backup channel for terminals
+*   without clickable links and for drag-select copying.
+*
+*   **2 — hand the redirect back.** When `paste` is provided, an `<input>`
+*   accepts whatever the browser (or consent page) produced. This is THE
+*   path for `zidane` running over SSH: the browser sits on the user's
+*   laptop and cannot reach the remote box's loopback callback server, so
+*   they copy the failed `http://127.0.0.1:<port>/callback?code=…` out of
+*   the URL bar and paste it here. Servers that render the code on the
+*   page instead of redirecting have no failed URL to copy — paste the
+*   code itself; `normalizeRedirectPaste` completes it against the
+*   authorization URL's `redirect_uri` + `state`. We name that exact
+*   address (parsed out of the authorization URL) so there's no guessing
+*   about which string to copy.
 *
 * The component owns presentation only — keyboard focus, input ref, and
 * the submit handler stay with the caller so the affordance composes
@@ -9513,31 +9573,40 @@ function OAuthDeviceCodeBlock({ userCode, verificationUri, expiresInSeconds }) {
 */
 function OAuthAuthBlock({ authUrl, maxLineWidth, chromeWidth = 14, paste }) {
 	const COLOR = useColors();
+	const callbackUri = redirectUriFromAuthUrl(authUrl);
+	const pasteRef = paste?.inputRef;
+	const pasteFocused = paste?.focused ?? false;
+	useEffect(() => {
+		if (pasteFocused) pasteRef?.current?.focus();
+	}, [pasteFocused, pasteRef]);
 	return /* @__PURE__ */ jsxs("box", {
 		style: {
 			flexDirection: "column",
 			gap: 1
 		},
 		children: [
-			/* @__PURE__ */ jsx$1(OpenBrowserButton, { authUrl }),
 			/* @__PURE__ */ jsxs("box", {
 				style: { flexDirection: "column" },
-				children: [/* @__PURE__ */ jsx$1("text", {
-					fg: COLOR.mute,
-					children: "or copy the URL manually:"
-				}), /* @__PURE__ */ jsx$1(OAuthUrlBlock, {
-					url: authUrl,
-					fg: COLOR.dim,
-					maxLineWidth,
-					chromeWidth
-				})]
+				children: [/* @__PURE__ */ jsx$1(StepHeading, {
+					step: paste ? "1" : void 0,
+					text: "open this URL in your browser to authorize"
+				}), /* @__PURE__ */ jsx$1(ActionButtons, { authUrl })]
+			}),
+			/* @__PURE__ */ jsx$1(AuthUrlPanel, {
+				url: authUrl,
+				maxLineWidth,
+				chromeWidth
 			}),
 			paste && /* @__PURE__ */ jsxs("box", {
 				style: { flexDirection: "column" },
 				children: [
+					/* @__PURE__ */ jsx$1(StepHeading, {
+						step: "2",
+						text: "no browser on this machine? (SSH, headless, firewalled)"
+					}),
 					/* @__PURE__ */ jsx$1("text", {
-						fg: COLOR.mute,
-						children: "or — if the browser couldn't reach this machine (SSH, firewall) — paste the URL it tried to redirect to:"
+						fg: COLOR.dim,
+						children: callbackUri ? `after you authorize, the browser lands on ${callbackUri} and fails — copy that whole address from its URL bar and paste it below.` : "after you authorize, copy the address the browser failed to reach (it starts with http://127.0.0.1) and paste it below."
 					}),
 					paste.hint && /* @__PURE__ */ jsx$1("text", {
 						fg: toneColor(paste.hint.tone, COLOR),
@@ -9554,7 +9623,8 @@ function OAuthAuthBlock({ authUrl, maxLineWidth, chromeWidth = 14, paste }) {
 						children: /* @__PURE__ */ jsx$1("input", {
 							ref: paste.inputRef,
 							focused: paste.focused,
-							placeholder: paste.placeholder ?? "paste redirect URL and press enter…",
+							maxLength: PASTE_MAX_LENGTH,
+							placeholder: paste.placeholder ?? "paste redirect URL (or just the code) and press enter…",
 							onSubmit: paste.onSubmit,
 							style: { flexGrow: 1 }
 						})
@@ -9565,76 +9635,181 @@ function OAuthAuthBlock({ authUrl, maxLineWidth, chromeWidth = 14, paste }) {
 	});
 }
 /**
-* Real button: a bordered, brand-colored box hosting a labeled keystroke
-* hint. Pressing `ctrl+b` (anywhere this block is mounted) calls
-* {@link tryOpenBrowser} to launch the URL via the OS handler AND
-* {@link writeToClipboard} so the URL also lands in the user's clipboard
-* (OSC 52 → works over SSH, native helper → works locally). Both fire
-* because either alone can fail silently — `open`/`xdg-open` are no-ops
-* on a headless box, and OSC 52 is disabled on some terminals — and the
-* combination covers both failure modes without prompting again.
+* Numbered step label. The numeral is dropped when the block has only one
+* step (no paste input) — "1" with no "2" reads like a truncated list.
+*/
+function StepHeading({ step, text }) {
+	const COLOR = useColors();
+	return /* @__PURE__ */ jsxs("text", { children: [step !== void 0 && /* @__PURE__ */ jsx$1("span", {
+		fg: COLOR.brand,
+		attributes: 1,
+		children: `${step}  `
+	}), /* @__PURE__ */ jsx$1("span", {
+		fg: COLOR.mute,
+		children: text
+	})] });
+}
+/**
+* The two primary buttons, side by side: open-in-browser and copy-URL.
+*
+* Both are bordered boxes with a labeled keystroke, both are clickable
+* (`onMouseDown`), and both keys work regardless of which input owns focus
+* (`preventDefault` keeps the focused field from double-handling). Splitting
+* copy out of open matters over SSH: `open`/`xdg-open` on a headless remote
+* box does nothing, and the user's real intent is "give me the URL".
 *
-* The visible label is also wrapped in an OSC 8 hyperlink so a mouse
-* click in a supporting terminal (iTerm2, Kitty, WezTerm, …) reaches the
-* same browser. The keybind is the authoritative path — it doesn't
-* depend on terminal capability — and the hyperlink is the bonus.
+* The open button's label is additionally wrapped in an OSC 8 hyperlink so
+* a click in a terminal that supports links (iTerm2, Kitty, WezTerm, …)
+* reaches the browser on the user's LOCAL machine even over SSH.
 */
-function OpenBrowserButton({ authUrl }) {
+function ActionButtons({ authUrl }) {
 	const COLOR = useColors();
-	const [feedback, setFeedback] = useState(null);
-	const feedbackTimer = useRef(null);
-	const trigger = useCallback(() => {
+	const [opened, setOpened] = useState(false);
+	const openedTimer = useRef(null);
+	const { copied, copy } = useCopyFlash();
+	const open = useCallback(() => {
 		tryOpenBrowser(authUrl);
-		const copied = writeToClipboard(authUrl);
-		setFeedback(copied ? "opened in browser · URL copied to clipboard" : "opened in browser");
-		if (feedbackTimer.current) clearTimeout(feedbackTimer.current);
-		feedbackTimer.current = setTimeout(setFeedback, 4e3, null);
+		setOpened(true);
+		if (openedTimer.current) clearTimeout(openedTimer.current);
+		openedTimer.current = setTimeout(setOpened, COPY_FEEDBACK_MS, false);
 	}, [authUrl]);
+	useEffect(() => () => {
+		if (openedTimer.current) clearTimeout(openedTimer.current);
+	}, []);
 	useKeyboard((key) => {
-		if (key.ctrl && key.name === "b") {
+		if (!key.ctrl) return;
+		if (key.name === "b") {
+			key.preventDefault();
+			open();
+			return;
+		}
+		if (key.name === "y") {
 			key.preventDefault();
-			trigger();
+			copy(authUrl);
 		}
 	});
-	useEffect(() => () => {
-		if (feedbackTimer.current) clearTimeout(feedbackTimer.current);
-	}, []);
 	return /* @__PURE__ */ jsxs("box", {
 		style: { flexDirection: "column" },
-		children: [/* @__PURE__ */ jsx$1("box", {
+		children: [/* @__PURE__ */ jsxs("box", {
+			style: {
+				flexDirection: "row",
+				gap: 2,
+				flexWrap: "wrap"
+			},
+			children: [/* @__PURE__ */ jsx$1(Button, {
+				color: COLOR.brand,
+				chord: OPEN_BROWSER_KEY,
+				onPress: open,
+				children: /* @__PURE__ */ jsx$1("a", {
+					href: authUrl,
+					fg: COLOR.brand,
+					children: "↗ Open in browser"
+				})
+			}), /* @__PURE__ */ jsx$1(Button, {
+				color: COLOR.warn,
+				chord: COPY_URL_KEY,
+				onPress: () => copy(authUrl),
+				children: /* @__PURE__ */ jsx$1("span", {
+					fg: COLOR.warn,
+					children: "⧉ Copy URL"
+				})
+			})]
+		}), (opened || copied) && /* @__PURE__ */ jsx$1("text", {
+			fg: COLOR.accent,
+			children: `✓ ${[opened ? "opened in browser" : null, copied ? "URL copied to clipboard" : null].filter(Boolean).join(" · ")}`
+		})]
+	});
+}
+/**
+* Bordered, clickable button hosting a label plus its keystroke hint.
+* The handler lives on the outer box: mouse events bubble from whatever
+* renderable was hit (label, padding, border) up through ancestors, so
+* the whole framed area is the target — not just the label text. Same
+* pattern as the settings-modal rows (`settings-modal.tsx:4006`).
+*/
+function Button({ color, chord, onPress, children }) {
+	const COLOR = useColors();
+	return /* @__PURE__ */ jsx$1("box", {
+		style: {
+			border: true,
+			borderColor: color,
+			paddingLeft: 1,
+			paddingRight: 1,
+			alignSelf: "flex-start"
+		},
+		onMouseDown: (event) => {
+			event.stopPropagation();
+			event.preventDefault();
+			onPress();
+		},
+		children: /* @__PURE__ */ jsxs("text", {
+			wrapMode: "none",
+			selectable: false,
+			children: [
+				children,
+				/* @__PURE__ */ jsx$1("span", {
+					fg: COLOR.mute,
+					children: "   "
+				}),
+				/* @__PURE__ */ jsx$1("span", {
+					fg: COLOR.warn,
+					children: chord
+				})
+			]
+		})
+	});
+}
+/**
+* The authorization URL as a framed, copy-able panel — same idea as a
+* fenced code block in the transcript (`auth url` label left, clickable
+* `[copy]` right), so "here is a literal string you need to move
+* somewhere else" reads the same everywhere in the app.
+*
+* Framed rather than background-tinted because this block renders inside
+* containers that are already painted with the elevated modal surface; a
+* border is the only contrast that survives every host.
+*/
+function AuthUrlPanel({ url, maxLineWidth, chromeWidth }) {
+	const COLOR = useColors();
+	const { copied, copy } = useCopyFlash();
+	return /* @__PURE__ */ jsx$1("box", {
+		style: { flexDirection: "column" },
+		children: /* @__PURE__ */ jsxs("box", {
 			style: {
+				flexDirection: "column",
 				border: true,
-				borderColor: COLOR.brand,
+				borderColor: COLOR.border,
 				paddingLeft: 1,
-				paddingRight: 1,
-				alignSelf: "flex-start"
+				paddingRight: 1
 			},
-			children: /* @__PURE__ */ jsxs("text", {
-				wrapMode: "none",
+			children: [/* @__PURE__ */ jsxs("box", {
+				style: { flexDirection: "row" },
 				children: [
-					/* @__PURE__ */ jsx$1("a", {
-						href: authUrl,
-						fg: COLOR.brand,
-						children: "↗ Open auth URL in browser"
-					}),
-					/* @__PURE__ */ jsx$1("span", {
+					/* @__PURE__ */ jsx$1("text", {
 						fg: COLOR.mute,
-						children: "   "
+						children: "auth url"
 					}),
-					/* @__PURE__ */ jsx$1("span", {
-						fg: COLOR.warn,
-						children: OPEN_BROWSER_KEY
-					}),
-					/* @__PURE__ */ jsx$1("span", {
-						fg: COLOR.mute,
-						children: " open · click also works"
+					/* @__PURE__ */ jsx$1("box", { style: { flexGrow: 1 } }),
+					/* @__PURE__ */ jsx$1("box", {
+						onMouseDown: (event) => {
+							event.stopPropagation();
+							event.preventDefault();
+							copy(url);
+						},
+						children: /* @__PURE__ */ jsx$1("text", {
+							selectable: false,
+							fg: copied ? COLOR.accent : COLOR.warn,
+							children: copied ? "[copied]" : "[copy]"
+						})
 					})
 				]
-			})
-		}), feedback && /* @__PURE__ */ jsx$1("text", {
-			fg: COLOR.accent,
-			children: `✓ ${feedback}`
-		})]
+			}), /* @__PURE__ */ jsx$1(OAuthUrlBlock, {
+				url,
+				fg: COLOR.dim,
+				maxLineWidth: maxLineWidth - 4,
+				chromeWidth: chromeWidth + 4
+			})]
+		})
 	});
 }
 function toneColor(tone, COLOR) {
@@ -9653,7 +9828,9 @@ function toneColor(tone, COLOR) {
 *     MCP SDK's loopback callback server resolves the OAuth promise
 *     through the same code path a real browser-redirect would have
 *     taken — works over SSH where the browser can't reach the remote
-*     callback server directly.
+*     callback server directly. `authUrl` rides along so a partial paste
+*     (bare code, query string) is completed against the callback URI
+*     the authorization request was minted with.
 *
 * `inputFocused` is forwarded as the input's `focused` prop AND read by
 * the parent picker's `useKeyboard` (via a ref) to suppress single-key
@@ -9663,7 +9840,8 @@ function McpAuthorizingPanel({ serverName, authUrl, maxLineWidth, chromeWidth, i
 	const COLOR = useColors();
 	const inputRef = useRef(null);
 	const [hint, setHint] = useState(null);
-	const status = hint && hint.tone !== "error" ? hint.text : authUrl === null ? "starting login flow…" : "complete the login in your browser — waiting for the callback…";
+	const waited = useElapsedSeconds(authUrl === null);
+	const status = hint && hint.tone !== "error" ? hint.text : authUrl === null ? `contacting ${serverName} for an authorization URL… (${waited}s)` : "complete the login in your browser — waiting for the callback…";
 	const onSubmit = useCallback(() => {
 		const value = inputRef.current?.value?.trim() ?? "";
 		if (!value) return;
@@ -9673,7 +9851,7 @@ function McpAuthorizingPanel({ serverName, authUrl, maxLineWidth, chromeWidth, i
 		});
 		(async () => {
 			try {
-				const result = await fetchOAuthRedirect(value);
+				const result = await fetchOAuthRedirect(value, { ...authUrl ? { authUrl } : {} });
 				if (result.status >= 200 && result.status < 300) setHint({
 					text: "redirect accepted — finalizing…",
 					tone: "accent"
@@ -9689,7 +9867,7 @@ function McpAuthorizingPanel({ serverName, authUrl, maxLineWidth, chromeWidth, i
 				});
 			}
 		})();
-	}, []);
+	}, [authUrl]);
 	return /* @__PURE__ */ jsxs("box", {
 		style: {
 			flexDirection: "column",
@@ -9706,15 +9884,18 @@ function McpAuthorizingPanel({ serverName, authUrl, maxLineWidth, chromeWidth, i
 			},
 			children: [
 				/* @__PURE__ */ jsx$1(Spinner, { label: status }),
+				authUrl === null && waited >= SLOW_START_SECONDS && /* @__PURE__ */ jsx$1("text", {
+					fg: COLOR.warn,
+					children: `${serverName} is slow to respond — press esc to cancel and retry, or check the server URL in this list.`
+				}),
 				authUrl !== null && /* @__PURE__ */ jsx$1(OAuthAuthBlock, {
 					authUrl,
-					maxLineWidth,
+					maxLineWidth: maxLineWidth - 4,
 					chromeWidth: (chromeWidth ?? 14) + 4,
 					paste: {
 						inputRef,
 						focused: inputFocused,
 						onSubmit,
-						placeholder: "paste redirect URL and press enter…",
 						hint: hint?.tone === "error" ? hint : void 0
 					}
 				}),
@@ -10527,7 +10708,7 @@ function OAuthRunningStep({ descriptor, dataDir, onSuccess, onError }) {
 		});
 		(async () => {
 			try {
-				const result = await fetchOAuthRedirect(value);
+				const result = await fetchOAuthRedirect(value, { ...url ? { authUrl: url } : {} });
 				if (result.status >= 200 && result.status < 300) {
 					setPasteHint({
 						text: "redirect accepted — exchanging code…",
@@ -10545,7 +10726,7 @@ function OAuthRunningStep({ descriptor, dataDir, onSuccess, onError }) {
 				});
 			}
 		})();
-	}, []);
+	}, [url]);
 	return /* @__PURE__ */ jsxs(WizardPanel, {
 		title: `configure ${descriptor.label} — OAuth`,
 		children: [
@@ -21949,11 +22130,26 @@ function AppShell() {
 				signal: ac.signal,
 				renderCallbackPage: renderDefaultCallbackPage,
 				hooks: agentRef.current?.hooks,
-				onAuthorizationUrl: (url) => tryOpenBrowser(url.toString())
+				onAuthorizationUrl: (url) => {
+					dispatchAuth({
+						type: "auth-url",
+						name,
+						url: url.toString()
+					});
+					tryOpenBrowser(url.toString());
+				}
+			});
+			dispatchAuth({
+				type: "auth-success",
+				name
 			});
 			rebuildActiveAgent().catch((err) => debugLog("mcp-login: rebuildActiveAgent failed", err));
 		} catch (err) {
-			if (!agentRef.current) dispatchAuth({
+			if (ac.signal.aborted) dispatchAuth({
+				type: "login:cancel",
+				name
+			});
+			else dispatchAuth({
 				type: "auth-error",
 				name,
 				error: errorMessage(err)
@@ -21986,8 +22182,12 @@ function AppShell() {
 		rebuildActiveAgent
 	]);
 	const onCancelLoginMcp = useCallback((name) => {
+		dispatchAuth({
+			type: "login:cancel",
+			name
+		});
 		mcpLoginAbortsRef.current.get(name)?.abort();
-	}, []);
+	}, [dispatchAuth]);
 	const onRefreshMcpTools = useCallback(async () => {
 		const agent = agentRef.current;
 		if (!agent) return;