Merge pull request #21 from Dark-Alex-17/feat/mcp-tool-whitelist

feat(mcp): per-server MCP tool allowlists with glob support

.gitignore

@@ -5,4 +5,7 @@
 .idea/
 /coyote.iml
 /.idea/
-.coyote
+.coyote/**
+.sisyphus/**
+.coyote-project.json
+.coyote/memory/

CREDITS.md

@@ -1,5 +1,16 @@
 # Credits
 
+## Matt Pocock's Skills
+
+The bundled `diagnosing-bugs`, `codebase-design`, and `grilling` skills, the
+`architecture-reviewer` agent, and the code smell baseline in the bundled
+`code-review` skill are adapted from
+[mattpocock/skills](https://github.com/mattpocock/skills) by Matt Pocock,
+licensed under the MIT License. The smell definitions trace back to Martin
+Fowler's *Refactoring* (ch. 3); the deep-module vocabulary builds on John
+Ousterhout's *A Philosophy of Software Design* and Michael Feathers'
+*Working Effectively with Legacy Code*.
+
 ## AIChat
 Coyote originally started as a fork of the fantastic
 [AIChat CLI](https://github.com/sigoden/aichat). The initial goal was simply

Cargo.lock

@@ -1685,6 +1685,7 @@ dependencies = [
  "colored",
  "comfy-table",
  "crossterm 0.29.0",
+ "ctor",
  "dirs",
  "duckdb",
  "duct",
@@ -1703,6 +1704,7 @@ dependencies = [
  "inquire",
  "is-terminal",
  "json-patch",
+ "libc",
  "log",
  "log4rs",
  "nu-ansi-term",
@@ -1906,6 +1908,16 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "ctor"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "914a755b7c2d4af2bdcff7ce1739e2db9a1b81a9b07123d8015786ae03c0980d"
+dependencies = [
+ "link-section",
+ "linktime-proc-macro",
+]
+
 [[package]]
 name = "ctutils"
 version = "0.4.2"
@@ -1962,6 +1974,16 @@ dependencies = [
  "darling_macro 0.23.0",
 ]
 
+[[package]]
+name = "darling"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88490bf1b990d87eaaa7ac8aa887f629a08e7359765b4911faf63c3763347d23"
+dependencies = [
+ "darling_core 0.24.0",
+ "darling_macro 0.24.0",
+]
+
 [[package]]
 name = "darling_core"
 version = "0.20.11"
@@ -1989,6 +2011,19 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "darling_core"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "084e274f91c482280130e1e34e0b8d6e66776a060d7b6de7b84289ca778868c4"
+dependencies = [
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "darling_macro"
 version = "0.20.11"
@@ -2011,6 +2046,17 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "darling_macro"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68f5792fa0d41cd2325ce0ffa64f0a340eaebd4971a3a0c5e1ffd2cc488a355e"
+dependencies = [
+ "darling_core 0.24.0",
+ "quote",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "defmt"
 version = "1.1.1"
@@ -3798,6 +3844,18 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "link-section"
+version = "0.19.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39c29a617ce3df32c08497bdc1ab6e2376e0b17948ac166a2fbe5977c5954cd9"
+
+[[package]]
+name = "linktime-proc-macro"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e57c38c1e860fd37c604281cdfb1dd2216977fd76a50f85ba2f388ef3219616"
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.4.15"
@@ -5303,12 +5361,12 @@ dependencies = [
 
 [[package]]
 name = "rmcp"
-version = "1.8.0"
+version = "3.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d1f571c72940a19d9532fe52dbea8bc9912bf1d766c2970bb824056b86f3f59"
+checksum = "c8dddc5b1924b9a59fba420166160ca2c4663a4e01803e52eda33070f56d63c8"
 dependencies = [
- "async-trait",
+ "base64 0.23.1",
- "base64 0.22.1",
+ "bytes",
  "chrono",
  "futures",
  "http 1.5.0",
@@ -5326,19 +5384,20 @@ dependencies = [
  "tokio-stream",
  "tokio-util",
  "tracing",
+ "uuid",
 ]
 
 [[package]]
 name = "rmcp-macros"
-version = "1.8.0"
+version = "3.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1aad0035b69380782d78ea95b508327e6deaa2235909053e596eea8f27b5e1d5"
+checksum = "6898e24cd16342b59bfa8a53c2c04b9cf62fc8a2cfea57b9c038b09984bfc521"
 dependencies = [
- "darling 0.23.0",
+ "darling 0.24.0",
  "proc-macro2",
  "quote",
  "serde_json",
- "syn 2.0.119",
+ "syn 3.0.3",
 ]
 
 [[package]]

Cargo.toml

@@ -3,7 +3,7 @@ name = "coyote-ai"
 version = "0.8.3"
 edition = "2024"
 authors = ["Alex Clarke <alex.j.tusa@gmail.com>"]
-description = "An all-in-one, batteries included LLM CLI Tool"
+description = "The batteries-included runtime for LLMs"
 keywords = ["chatgpt", "llm", "cli", "ai", "repl"]
 homepage = "https://github.com/Dark-Alex-17/coyote"
 repository = "https://github.com/Dark-Alex-17/coyote"
@@ -51,7 +51,13 @@ textwrap = "0.16.0"
 ansi_colours = "1.2.2"
 eventsource-stream = "0.2.3"
 log = "0.4.28"
-log4rs = { version = "1.4.0", features = ["file_appender", "rolling_file_appender", "compound_policy", "fixed_window_roller", "size_trigger"] }
+log4rs = { version = "1.4.0", features = [
+  "file_appender",
+  "rolling_file_appender",
+  "compound_policy",
+  "fixed_window_roller",
+  "size_trigger",
+] }
 shell-words = "1.1.0"
 sha2 = "0.10.8"
 unicode-width = "0.2.0"
@@ -84,7 +90,7 @@ duct = "1.0.0"
 argc = "1.23.0"
 strum_macros = "0.27.2"
 indoc = "2.0.6"
-rmcp = { version = "1.5.0", features = [
+rmcp = { version = "3.1.2", features = [
   "client",
   "transport-child-process",
   "transport-streamable-http-client-reqwest",
@@ -113,14 +119,7 @@ qrcode = "0.14"
 
 [dependencies.reqwest]
 version = "0.13.3"
-features = [
+features = ["json", "multipart", "stream", "form", "socks", "rustls"]
-  "json",
-  "multipart",
-  "stream",
-  "form",
-  "socks",
-  "rustls",
-]
 default-features = false
 
 [dependencies.syntect]
@@ -139,8 +138,13 @@ arboard = { version = "3.3.0", default-features = false, features = [
 [target.'cfg(not(any(target_os = "linux", target_os = "android", target_os = "emscripten")))'.dependencies]
 arboard = { version = "3.3.0", default-features = false }
 
+[target.'cfg(unix)'.dependencies]
+libc = "0.2"
+
 [dev-dependencies]
+ctor = "1.0.13"
 pretty_assertions = "1.4.0"
+rmcp = { version = "3.1.2", features = ["server"] }
 serial_test = "3"
 
 [[bin]]

Dockerfile

@@ -99,7 +99,7 @@ LABEL com.docker.sandboxes="templates" \
       com.docker.sandboxes.flavor="shell-docker" \
       com.docker.sandboxes.start-docker="true" \
       org.opencontainers.image.title="coyote" \
-      org.opencontainers.image.description="An all-in-one, batteries-included LLM CLI tool: Shell Assistant, CLI & REPL mode, RAG, AI tools & agents, MCP servers, skills, and macros." \
+      org.opencontainers.image.description="The batteries-included runtime for LLMs: Shell Assistant, CLI & REPL mode, RAG, AI tools & agents, MCP servers, skills, and macros." \
       org.opencontainers.image.source="https://github.com/Dark-Alex-17/coyote" \
       org.opencontainers.image.version="${COYOTE_VERSION}"
 

README.md

@@ -1,4 +1,4 @@
-# Coyote: All-in-one, batteries-included LLM CLI Tool
+# Coyote: The batteries-included runtime for LLMs
 
 ![Test](https://github.com/Dark-Alex-17/coyote/actions/workflows/ci.yaml/badge.svg)
 [![crates.io link](https://img.shields.io/crates/v/coyote-ai.svg)](https://crates.io/crates/coyote-ai)
@@ -6,14 +6,18 @@
 ![Crate.io downloads](https://img.shields.io/crates/d/coyote-ai?label=Crate%20downloads)
 [![GitHub Downloads](https://img.shields.io/github/downloads/Dark-Alex-17/coyote/total.svg?label=GitHub%20downloads)](https://github.com/Dark-Alex-17/coyote/releases)
 ![Docker pulls](https://img.shields.io/docker/pulls/darkalex17/coyote?label=Docker%20downloads)
-[![License: AGPL v3](https://img.shields.io/badge/License-AGPL_v3-blue.svg)](./LICENSE)
+[![License: AGPL v3](https://img.shields.io/badge/License-AGPL_v3-blue.svg)](https://github.com/Dark-Alex-17/coyote/blob/main/LICENSE)
 
-Coyote is an all-in-one, batteries-included, LLM CLI tool featuring Shell Assistant, CLI & REPL Mode, RAG, AI Tools & 
+Coyote is an **all-in-one, batteries-included LLM runtime** for building, running, and interacting with AI from your terminal.
-Agents, and More.
+It brings together a Shell Assistant, CLI & REPL modes, RAG, tools, agents, MCP, skills, sandboxes, multi-agent workflows, and
+more in a single runtime.
+
+Coyote comes ready to use with built-in agents, roles, macros, and tools, so you can get started without assembling an AI
+stack from scratch. When you want to extend it, entire bundles of agents, roles, macros, tools, MCP servers, and other
+configurations can be installed directly from any Git repository.
+
+See [Bundles](https://github.com/Dark-Alex-17/coyote/wiki/Bundles) to learn how to create, install, and share Coyote bundles.
 
-It is designed to include a number of useful agents, roles, macros, and more so users can get up and running with Coyote 
-in as little time as possible. You can also install entire bundles of agents, roles, macros, tools, and MCP servers from 
-any git repository. See [Sharing Configurations](https://github.com/Dark-Alex-17/coyote/wiki/Sharing-Configurations) for more information.
 
 ![Agent example](https://raw.githubusercontent.com/wiki/Dark-Alex-17/coyote/images/agents/sql.gif)
 
@@ -23,7 +27,7 @@ Coming from [AIChat](https://github.com/sigoden/aichat)? Follow the [migration g
 * [AIChat Migration Guide](https://github.com/Dark-Alex-17/coyote/wiki/AIChat-Migration): Coming from AIChat? Follow the migration guide to get started.
 * [Installation](#install): Install Coyote
 * [Getting Started](#getting-started): Get started with Coyote by doing first-run setup steps.
-* [Sharing Configurations](https://github.com/Dark-Alex-17/coyote/wiki/Sharing-Configurations): Install bundles of agents, roles, macros, tools, and MCP servers from any git repo, and share your own.
+* [Sharing Configurations](https://github.com/Dark-Alex-17/coyote/wiki/Sharing-Configurations): Install bundles of agents, roles, skills, macros, tools, and MCP servers from any git repo, and share your own. Bundles are Coyote's equivalent of plugins in other CLI agents.
 * [REPL](https://github.com/Dark-Alex-17/coyote/wiki/REPL): Interactive Read-Eval-Print Loop for conversational interactions with LLMs and Coyote.
   * [Custom REPL Prompt](https://github.com/Dark-Alex-17/coyote/wiki/REPL-Prompt): Customize the REPL prompt to provide useful contextual information.
 * [Vault](https://github.com/Dark-Alex-17/coyote/wiki/Vault): Securely store and manage sensitive information such as API keys and credentials.
@@ -35,8 +39,14 @@ Coming from [AIChat](https://github.com/sigoden/aichat)? Follow the [migration g
         * [Create Custom TypeScript Tools](https://github.com/Dark-Alex-17/coyote/wiki/Custom-Tools#custom-typescript-based-tools)
         * [Create Custom Bash Tools](https://github.com/Dark-Alex-17/coyote/wiki/Custom-Bash-Tools)
             * [Bash Prompt Utilities](https://github.com/Dark-Alex-17/coyote/wiki/Bash-Prompt-Helpers)
-* [First-Class MCP Server Support](https://github.com/Dark-Alex-17/coyote/wiki/MCP-Servers): Easily connect and interact with MCP servers for advanced functionality.
+* [First-Class MCP Server Support](https://github.com/Dark-Alex-17/coyote/wiki/MCP-Servers): Easily connect and interact with MCP servers for advanced functionality. Coyote supports all three MCP capabilities: tools, resources, and prompts.
-* [Macros](https://github.com/Dark-Alex-17/coyote/wiki/Macros): Automate repetitive tasks and workflows with Coyote "scripts" (macros).
+    * Models interact with each server through a compact set of capability-gated meta-tools: `mcp_search`/`mcp_describe` for discovery across tools, resources, and prompts, `mcp_invoke` for tool calls, `mcp_read` for paged and regex-filterable resource reads, and `mcp_prompt` for server-defined prompts. Binary content is spilled to disk instead of inlined, and oversized tool results are bounded before they reach the model.
+    * Invoke server prompts yourself with `.prompt <server> <name> [key=value ...]` in the REPL, with live staged tab-completion (servers, then prompt names, then `key=` arguments), and discover them with `.list prompts`.
+* [Macros](https://github.com/Dark-Alex-17/coyote/wiki/Macros): Automate repetitive tasks and workflows with Coyote "scripts" (macros). Macros are Coyote's custom commands: invoke any macro directly by name (e.g. `.review main`), with tab-completion, right alongside the built-in REPL commands.
+    * Give a macro a `description` (shown in `.list macros` and completions) and set `isolated: false` to run its steps on the live session, exactly as if you typed them. Note that non-isolated steps are recorded in the session, and mutating steps (`.role`, `.model`, ...) persist after the macro ends — by design. Steps are fail-fast: an error aborts the remaining steps, but completed steps' effects remain. A non-isolated macro step cannot invoke another macro, and a `.exit` step never exits the REPL.
+    * Commit project-specific macros to `.coyote/macros/` in your repo — they shadow same-named global macros (opt out with `--no-workspace-macros`).
+    * Pass variables positionally or by name: leading `name=value` args set declared variables directly (letting earlier variables keep their defaults), and remaining args fill the rest in order. Tab completion after a macro name lists each variable with its description and default.
+    * Scope which macros are invocable with `enabled_macros` in the global config, a role, an agent, or a session (most specific wins; an empty list disables all macros), and toggle at runtime with `.macro enable|disable <name>`.
 * [RAG](https://github.com/Dark-Alex-17/coyote/wiki/RAG): Retrieval-Augmented Generation for enhanced information retrieval and generation.
 * [Sessions](https://github.com/Dark-Alex-17/coyote/wiki/Sessions): Manage and persist conversational contexts and settings across multiple interactions.
 * [Memory](https://github.com/Dark-Alex-17/coyote/wiki/Memory): Persistent file-based memory that survives across sessions. Bootstrap with `coyote --init-memory [global|workspace]`.
@@ -45,6 +55,7 @@ Coming from [AIChat](https://github.com/sigoden/aichat)? Follow the [migration g
 * [Skills](https://github.com/Dark-Alex-17/coyote/wiki/Skills): Modular knowledge or capability packs the LLM can load and unload mid-conversation. Multiple skills compose; instructions stack, tools and MCPs union.
 * [Agents](https://github.com/Dark-Alex-17/coyote/wiki/Agents): Leverage AI agents to perform complex tasks and workflows, including sub-agent spawning, teammate messaging, and user interaction tools.
     * [Graph Agents](https://github.com/Dark-Alex-17/coyote/wiki/Graph-Agents): Define an agent as a declarative, YAML-driven workflow. A directed graph of typed nodes (LLM calls, scripts, approvals, user input, RAG retrieval, sub-agent spawns).
+* [Background Jobs](https://github.com/Dark-Alex-17/coyote/wiki/Background-Jobs): Run long tool calls (builds, test suites, slow MCP calls) in the background with the `job__*` tools while the model keeps working, and completion arrives as a push notification.
 * [Todo System](https://github.com/Dark-Alex-17/coyote/wiki/TODO-System): Built-in task tracking for improved LLM reliability with smaller models.
 * [Environment Variables](https://github.com/Dark-Alex-17/coyote/wiki/Environment-Variables): Override and customize your Coyote configuration at runtime with environment variables.
 * [Client Configurations](https://github.com/Dark-Alex-17/coyote/wiki/Clients): Configuration instructions for various LLM providers.
@@ -256,7 +267,7 @@ coyote | Out-String | Invoke-Expression
 
 ### Shell Integration
 You can integrate Coyote's Shell Assistant into your shell for enhanced command-line assistance. Add the code in the
-corresponding [shell integration script](./scripts/shell-integration) to your shell. Then, you can invoke Coyote to convert natural language to 
+corresponding [shell integration script](https://github.com/Dark-Alex-17/coyote/tree/main/scripts/shell-integration) to your shell. Then, you can invoke Coyote to convert natural language to 
 shell commands by pressing `Alt-e`. For example:
 
 ```shell
@@ -274,7 +285,7 @@ coyote --info | grep 'config_file' | awk '{print $2}'
 ```
 
 The configuration file consists of a number of settings. To see a full example configuration file with every setting
-defined, refer to the [example configuration file](./config.example.yaml).
+defined, refer to the [example configuration file](https://github.com/Dark-Alex-17/coyote/blob/main/config.example.yaml).
 
 ### Default LLM
 The following settings are available to configure the default LLM that is used when you start Coyote, and its
@@ -328,7 +339,7 @@ The appearance of Coyote can be modified using the following settings:
 
 Coyote began as a fork of [AIChat CLI](https://github.com/sigoden/aichat) and has since evolved into an independent project.
 
-See [CREDITS.md](./CREDITS.md) for full attribution and background.
+See [CREDITS.md](https://github.com/Dark-Alex-17/coyote/blob/main/CREDITS.md) for full attribution and background.
 
 ---
 
@@ -339,11 +350,11 @@ See [CREDITS.md](./CREDITS.md) for full attribution and background.
 
 ## License
 
-Coyote is licensed under the [GNU Affero General Public License v3.0](./LICENSE)
+Coyote is licensed under the [GNU Affero General Public License v3.0](https://github.com/Dark-Alex-17/coyote/blob/main/LICENSE)
 (AGPL-3.0-only).
 
 Coyote began as a fork of [AIChat](https://github.com/sigoden/aichat)
 (Copyright (c) sigoden), which is licensed under the MIT License. Substantial
 portions of Coyote are derived from AIChat and remain available under the MIT
-License, preserved in [LICENSE-MIT](./LICENSE-MIT). See [NOTICE](./NOTICE) and
+License, preserved in [LICENSE-MIT](https://github.com/Dark-Alex-17/coyote/blob/main/LICENSE-MIT). See [NOTICE](https://github.com/Dark-Alex-17/coyote/blob/main/NOTICE) and
-[CREDITS.md](./CREDITS.md) for details.
+[CREDITS.md](https://github.com/Dark-Alex-17/coyote/blob/main/CREDITS.md) for details.

assets/agents/architect/config.yaml

@@ -3,9 +3,10 @@ description: |
   Design-doc orchestrator for any project. Consumes a high-level design doc, decomposes it into a
   gated plan (gatekeeper self-containedness + oracle plan-review) and ~1-engineer-day task files,
   spawns one Sisyphus per task on a single run branch, verifies each with an adversarial
-  plan-conformance check, and finishes with ONE draft PR (CI checks watched to green) plus tracked
+  plan-conformance check (plus a black-box usage-pattern probe for consumer-facing surface), and
-  follow-up tasks. Task state lives on disk in a plans directory, so runs survive context compression.
+  finishes with ONE draft PR (CI checks watched to green) plus tracked follow-up tasks. Task state
-version: 2.0.0
+  lives on disk in a plans directory, so runs survive context compression.
+version: 2.1.0
 agent_session: temp
 auto_continue: true
 max_auto_continues: 100
@@ -18,6 +19,7 @@ spawnable_agents:
   - explore
   - librarian
   - adversary
+  - probe
   - gatekeeper
 max_concurrent_agents: 10
 max_agent_depth: 10
@@ -27,6 +29,7 @@ summarization_threshold: 100000
 skills_enabled: true
 enabled_skills:
   - design-session
+  - grilling
   - task-tracking
   - plan-authoring
   - delegation-protocol
@@ -126,7 +129,10 @@ instructions: |
 
   ### Phase B — Design decomposition
 
-  Load and follow the `design-session` skill against the design doc. This produces
+  Load and follow the `design-session` skill against the design doc. When running
+  interactively, also load `grilling` and put the open design decisions to the user as
+  frontier rounds (numbered questions, each with a recommended answer) instead of ad-hoc
+  one-at-a-time questions. This produces
   `{{plans_dir}}/PLAN-<slug>.md` with Problem, Scope, Approach, Alternatives, Constraints/risks,
   Open questions, and a **Task breakdown** where **each task is sized to ~1 engineer-day** (decompose
   anything bigger NOW).
@@ -145,7 +151,8 @@ instructions: |
 
   **Gate 1 — Self-containedness (`gatekeeper`).** The plan must pass the "docker container" test:
   every question a context-free implementer will hit is answered inline or delegated via a verified
-  pointer to code/docs (where infra code goes, DB tech/target, layout to mirror, test commands, ...).
+  pointer to code/docs (where infra code goes, DB tech/target, layout to mirror, test commands,
+  local-run recipe for any consumer-facing surface the plan creates, ...).
 
   > `agent__spawn --agent gatekeeper --prompt "Audit this plan for self-containedness. Return
   > SEALED/LEAKY. Plan: {{plans_dir}}/PLAN-<slug>.md. Target project: {{project_dir}}."`
@@ -257,7 +264,7 @@ instructions: |
 
   3. **Wait for Sisyphus.** Do not poll `agent__collect` on a running agent — do non-overlapping work
      (e.g. prep the next task's context) or end your response and wait for the completion
-     notification, then `agent__collect`.
+     notification (a `system_notifications` entry on your next tool result), then `agent__collect`.
 
   4. **Verify against the plan (divergence check).** When Sisyphus returns, do NOT trust its
      self-report — get an INDEPENDENT conformance verdict:
@@ -282,6 +289,39 @@ instructions: |
        escalate — do not silently change scope.
      - **`ADVERSARIAL_REVIEW: CONFORMS`** → conformance satisfied. Also confirm the stated test
        commands pass (run them if feasible) before closing.
+     - **Usage-pattern probe (consumer-facing tasks).** If the task added or changed consumer-facing
+       surface (endpoints/RPCs/CLI commands, request/response shapes, contract semantics like
+       patch-vs-replace, idempotency, auth on routes), ALSO spawn `probe` for an independent
+       black-box behavioral verdict — it boots the code locally from a clean state, runs existing
+       usage suites for regressions, and spec-first-tests the changed surface with the repo's
+       existing suite tooling or whatever is available (e.g. Hurl/curl, grpcurl, direct CLI
+       invocation). Skip it (one-line note) for tasks with no consumer-visible surface.
+
+       ```
+       agent__spawn --agent probe --prompt "Probe TASK-NNN's changed surface from the consumer's
+       perspective. Return PASS/FAIL/INCONCLUSIVE.
+
+       CHANGE: run get_diff --base <the task's BASE SHA recorded at claim time> in {{project_dir}}.
+
+       SPEC — expected behavior to verify against:
+       <paste the task's acceptance criteria + relevant API contract sections VERBATIM>
+
+       LOCAL-RUN RECIPE: <paste the plan's local-run recipe verbatim — Gate 1 requires one for
+       consumer-facing tasks>
+
+       EXISTING SUITES: <paths + run commands from the plan, or 'discover them'>"
+       ```
+
+       Set the probe's `project_dir` to {{project_dir}}. Verdict handling:
+       - **`USAGE_PROBE: FAIL`** → blocker, same loop as DIVERGES: resume the SAME Sisyphus session
+         with the behavioral findings (including repros) verbatim; re-run `probe` ONCE (resume ITS
+         session so it reuses its environment and tests); still FAILing on the same findings →
+         STOP and escalate.
+       - **`USAGE_PROBE: PASS`** → have Sisyphus adopt probe's new test files (paths are in its
+         report) as a commit on the run branch so they ship as permanent regression coverage.
+       - **`USAGE_PROBE: INCONCLUSIVE`** → the local-run recipe is missing or broken — a PLAN gap,
+         not a code failure. Fix the recipe (amend the plan) or escalate, re-run once; NEVER count
+         INCONCLUSIVE as PASS or FAIL.
      - If Sisyphus reports failure after its own recovery, surface the evidence and consult `oracle`
        for diagnosis before deciding whether to retry, re-scope, or escalate.
 
@@ -324,8 +364,8 @@ instructions: |
     ({{project_dir}}/.worktrees/task-NNN) and the branch with the task branch. Sisyphus commits and
     pushes the TASK branch. All other prompt sections unchanged — still no PRs, still no
     creating/switching branches (the worktree arrives already on its branch).
-  - Run the adversary check in the worktree: `get_diff --base <BASE SHA>` — identical semantics to
+  - Run the adversary check (and, for consumer-facing tasks, the probe check) in the worktree:
-    sequential mode.
+    `get_diff --base <BASE SHA>` — identical semantics to sequential mode.
 
   **Integration (architect is the integrator; merges are ALWAYS one at a time):**
   1. When a task's Sisyphus finishes AND its adversary check CONFORMS, merge in the PRIMARY checkout:
@@ -400,6 +440,7 @@ instructions: |
   | `oracle` | Plan review (`plan-review`), and diagnosis when a task fails after Sisyphus recovery. |
   | `gatekeeper` | Plan self-containedness gate (Phase C Gate 1): audits the PLAN for the "docker container" standard, returns SEALED/LEAKY with the missing implementer questions. |
   | `adversary` | Post-implementation plan-conformance verdict per task (CONFORMS/DIVERGES). |
+  | `probe` | Black-box behavioral verdict on a task's consumer-facing surface: boots the code locally from clean state, runs existing usage suites + spec-first tests. Returns USAGE_PROBE PASS/FAIL/INCONCLUSIVE. |
 
   ## Escalation handling
 
@@ -420,6 +461,8 @@ instructions: |
   - Materializing tasks from a plan the gatekeeper marked LEAKY (or never audited), or that Oracle
     rejected (or never reviewed).
   - Marking a task complete without the adversary's CONFORMS verdict and verified acceptance criteria.
+  - Closing a consumer-facing task without a `probe` verdict, or treating `INCONCLUSIVE` as PASS —
+    an unprobeable consumer-facing change is a plan gap to fix, not a checkbox to skip.
   - Code comments referencing the plan/design doc/phases/steps/TASK numbers → docs drift, comments
     rot; plan references live in commit messages only.
   - A `.env` file landing in any repo → only `.env.example` with placeholder keys is committable;

assets/agents/architecture-reviewer/README.md

@@ -0,0 +1,67 @@
+# Architecture Reviewer
+
+An **on-demand architecture improvement scout**. It scans a codebase for **deepening
+opportunities** — refactors that turn shallow modules into deep ones — presents them as a visual
+report, then refines the candidate you pick into a concrete, implementation-ready interface
+proposal.
+
+Two things it is deliberately **not**:
+
+1. **Not a completion gate.** The review stack ([`code-reviewer`](../code-reviewer/README.md),
+   [`adversary`](../adversary/README.md), [`security-reviewer`](../security-reviewer/README.md))
+   judges *changes* before a task finishes. This agent is invoked on demand, when you want the
+   codebase itself made deeper, more testable, and easier to navigate. A "cleanup gate" would
+   produce noisy, opinionated churn on every diff; a cleanup *tool* produces focused proposals
+   when you ask for them.
+2. **Not an implementer.** It proposes; you (or a `coder` you delegate to) implement. Its only
+   write is the report file in the OS temp directory — repository files are never touched.
+
+## How it works
+
+Driven by the [`codebase-design`](../../skills/codebase-design/SKILL.md) skill — the shared
+deep-module vocabulary (**module**, **interface**, **depth**, **seam**, **adapter**, **leverage**,
+**locality**) and its principles (the deletion test, "the interface is the test surface", "one
+adapter = hypothetical seam, two = real").
+
+1. **Scope by git history (YAGNI).** Deepening pays off where code keeps changing, so hot spots
+   from the commit log rank first — unless you name a direction.
+2. **Explore for friction.** Fans out `explore` agents hunting shallow modules, leaked seams,
+   concept-bouncing, and code that's hard to test through its current interface; every suspect
+   gets the deletion test.
+3. **Report candidates.** 3-6 cards (problem / solution / leverage-and-locality benefits /
+   before-after visual / `Strong`-`Worth exploring`-`Speculative` badge), as a self-contained
+   Tailwind+Mermaid HTML file in your temp dir (default) or inline markdown
+   (`report_format: markdown`). Ends with a top recommendation, then stops and asks which
+   candidate to pursue.
+4. **Refine via design-it-twice.** For the chosen candidate: frame the constraints and dependency
+   categories, produce 2-3 radically different interface designs (optionally spawning `oracle`
+   for an independent alternative), compare on depth/locality/seam placement, and hand off ONE
+   opinionated, implementation-ready proposal including the testing strategy ("replace, don't
+   layer").
+
+## Usage
+
+```sh
+# Scan the current repo, HTML report
+coyote -a architecture-reviewer "Find deepening opportunities"
+
+# Aim it at a pain point, inline report
+coyote -a architecture-reviewer --agent-variable report_format markdown \
+  "The billing/entitlements code is painful to test - what should be deepened?"
+```
+
+Also spawnable from `sisyphus` when a request is explicitly architecture-scale ("improve the
+architecture of X", "make this module easier to test").
+
+## Related
+
+- [`codebase-design`](../../skills/codebase-design/SKILL.md) — the vocabulary and principles it runs on.
+- [`oracle`](../oracle/README.md) — advisory design review; also loads `codebase-design` for the shared vocabulary.
+- [`explore`](../explore/README.md) — the codebase walkers it fans out.
+
+## Credits
+
+Adapted from the `codebase-design` and `improve-codebase-architecture` skills in
+[mattpocock/skills](https://github.com/mattpocock/skills) (MIT), which build on ideas from John
+Ousterhout's *A Philosophy of Software Design* and Michael Feathers' *Working Effectively with
+Legacy Code*.

assets/agents/architecture-reviewer/config.yaml

@@ -0,0 +1,158 @@
+name: architecture-reviewer
+description: On-demand architecture improvement scout - scans a codebase for deepening opportunities (shallow modules, leaked seams, missing locality) weighted by git-history hot spots, presents candidates as a visual report, then refines the chosen candidate into a concrete interface proposal via design-it-twice. Proposes, never implements. NOT a completion gate - invoke it when you want the codebase made deeper, more testable, and easier to navigate.
+version: 1.1.0
+
+agent_session: temp
+auto_continue: true
+max_auto_continues: 20
+inject_todo_instructions: true
+
+can_spawn_agents: true
+spawnable_agents:
+  - explore
+  - oracle
+max_concurrent_agents: 4
+max_agent_depth: 2
+inject_spawn_instructions: true
+
+skills_enabled: true
+enabled_skills:
+  - codebase-design
+  - delegation-protocol
+  - grilling
+  - parallel-research
+
+variables:
+  - name: project_dir
+    description: Project directory to scan
+    default: '.'
+  - name: report_format
+    description: Candidate report format - 'html' (self-contained file in the OS temp dir, opened for the user) or 'markdown' (inline in chat)
+    default: html
+  - name: auto_confirm
+    description: Auto-confirm command execution
+    default: '1'
+
+global_tools:
+  - ast_grep.sh
+  - fs_read.sh
+  - fs_cat.sh
+  - fs_grep.sh
+  - fs_glob.sh
+  - fs_ls.sh
+  - fs_write.sh
+  - execute_command.sh
+
+instructions: |
+  You are an architecture improvement scout. You surface **deepening opportunities** — refactors
+  that turn shallow modules into deep ones — and refine the one the user picks into a concrete
+  interface proposal. The aim is testability, locality, and AI-navigability.
+
+  Two things you are NOT:
+  1. **Not a completion gate.** The review stack (`code-reviewer`/`adversary`/`security-reviewer`)
+     judges changes; you are invoked on demand to improve what already exists.
+  2. **Not an implementer.** You produce candidates and interface proposals; the user (or a coder
+     they delegate to) owns the code change. You never modify repository files — your only writes
+     are the report file in the OS temp directory.
+
+  ## Step 0: Load the skill
+
+  Before anything else, `skill__load` `codebase-design`. It is your source of truth for the
+  vocabulary (**module**, **interface**, **depth**, **seam**, **adapter**, **leverage**,
+  **locality**), the principles (the deletion test, "the interface is the test surface", "one
+  adapter = hypothetical seam, two = real"), the dependency categories for safe deepening, and the
+  design-it-twice pattern. Use those terms EXACTLY in every finding — no "component", "service",
+  or "boundary". Load `delegation-protocol` and `parallel-research` before spawning sub-agents.
+
+  ## Phase 1: Scope, then explore
+
+  **Scope before you scan — YAGNI.** Deepening pays off where code keeps changing:
+
+  - If the user named a direction (a module, subsystem, or pain point), take it and skip inference.
+  - Otherwise mine the history for hot spots:
+    `execute_command --command "git -C {{project_dir}} log --oneline --name-only -100"` (or
+    similar) and let the files that keep recurring pull your attention. Scattered changes with no
+    hot spot → widen the net.
+
+  Read the workspace instructions (`COYOTE.md`/`AGENTS.md`) if present — documented conventions and
+  recorded decisions are constraints, not candidates; don't re-litigate them.
+
+  Then spawn 1-3 `explore` agents (per `delegation-protocol`, in parallel per `parallel-research`)
+  to walk the scoped area. Brief them to report friction, not metrics:
+
+  - Where does understanding one concept require bouncing between many small modules?
+  - Where are modules shallow — an interface nearly as complex as the implementation?
+  - Where were pure functions extracted "for testability" while the real bugs hide in how they're
+    called (no locality)?
+  - Where do tightly-coupled modules leak across their seams?
+  - What is untested, or hard to test through its current interface?
+
+  Apply the **deletion test** yourself to every suspect the explorers return: would deleting it
+  concentrate complexity (real candidate) or just move it (pass-through)?
+
+  ## Phase 2: Present candidates
+
+  Produce 3-6 candidates, each with:
+
+  - **Files**: the modules involved
+  - **Problem**: the friction the current shape causes, in skill vocabulary
+  - **Solution**: plain-English description of the deepening (no interface design yet)
+  - **Benefits**: stated as leverage and locality gains, and how tests improve
+  - **Recommendation strength**: `Strong` / `Worth exploring` / `Speculative`
+  - **Before/after sketch**: for `html`, a visual per candidate; for `markdown`, a compact
+    ASCII/mermaid sketch
+
+  **Report delivery** (per `report_format`, currently: {{report_format}}):
+
+  - `html` — write ONE self-contained file to the OS temp dir (`$TMPDIR`, falling back to `/tmp`)
+    named `architecture-review-<timestamp>.html`. Use Tailwind via CDN for layout and Mermaid via
+    CDN for graph-shaped structure (call graphs, dependencies); hand-built divs/SVG for editorial
+    visuals (mass diagrams, collapse animations). One card per candidate with a side-by-side
+    before/after diagram. Open it for the user (`open` on macOS, `xdg-open` on Linux, `start` on
+    Windows) and print the absolute path. Nothing lands in the repo.
+  - `markdown` — render the same cards inline in your response.
+
+  End the report with a **Top recommendation**: which candidate you'd tackle first and why.
+
+  Then STOP and ask which candidate to explore. Do NOT propose interfaces yet.
+
+  ## Phase 3: Refine the chosen candidate
+
+  1. **Frame the problem space**: the constraints any new interface must satisfy, the dependencies
+     and their category (in-process / local-substitutable / remote-but-owned / true external, per
+     the skill), and a rough illustrative sketch to make the constraints concrete. Show the user.
+     When the candidate carries open decisions (what sits behind the seam, which callers to
+     optimise for, what tests must survive), load `grilling` and walk them as frontier rounds —
+     recommended answer per question, facts fetched by you, decisions made by the user.
+  2. **Design it twice**: produce 2-3 radically different interface designs per the skill's
+     pattern (different constraint each: minimal interface / maximal flexibility / optimise the
+     common caller). For a candidate worth the budget, spawn `oracle` to independently design or
+     critique one alternative. Each design: interface (with invariants, ordering, error modes),
+     caller example, what hides behind the seam, adapter strategy, trade-offs.
+  3. **Compare and recommend**: contrast on depth, locality, and seam placement; give ONE
+     opinionated recommendation or a justified hybrid.
+  4. **Hand off**: summarize the chosen design as an implementation-ready proposal — files to
+     change, the target interface, the testing strategy ("replace, don't layer": new tests at the
+     deepened interface, old shallow-module tests deleted). Note that implementation belongs to
+     the caller, not you.
+
+  ## Rules
+
+  1. **Never modify repository files.** The temp-dir report is your only write.
+  2. **Skill vocabulary, exactly.** Findings that say "service" or "boundary" get rewritten.
+  3. **Friction over dogma.** A shallow module that never changes and confuses no one is not a
+     candidate. Recent-change hot spots rank first.
+  4. **Candidates are judgment calls.** Frame every problem as observed friction with evidence
+     (file:line, test absence, change-history churn), not as rule violations.
+  5. **Respect recorded decisions.** If a candidate contradicts a documented convention or
+     decision, surface it only when the friction justifies revisiting — and mark the conflict
+     clearly in the card.
+
+  ## Context
+  - Project: {{project_dir}}
+  - Report format: {{report_format}}
+  - CWD: {{__cwd__}}
+  - Shell: {{__shell__}}
+
+  ## Available Tools
+  {{__tools__}}

assets/agents/code-reviewer/README.md

@@ -12,6 +12,31 @@ agents while handling coordination and final reporting.
 - 🔄 **Cross-File Context**: Broadcasts sibling rosters so reviewers can alert each other about cross-cutting changes.
 - 📊 **Unified Reporting**: Synthesizes findings into a structured, easy-to-read summary with severity levels.
 - ⚡ **Parallel Execution**: Runs reviews concurrently for maximum speed.
+- 🚨 **Operational History (optional)**: Checks the change against past production incidents via the [`incident-prior-art`](../../skills/incident-prior-art/SKILL.md) skill.
+
+## Operational History Lane
+
+Code review answers "is this code good?" — this lane answers "did we already get burned by this?"
+When the diff touches operationally-relevant surface (error handling, retries, timeouts, alerting,
+config controlling any of these), the orchestrator:
+
+1. **Git archaeology** (always available): blames the lines the diff deletes or weakens. A guard
+   that originated in an incident-fix commit and is being removed is a 🔴 CRITICAL finding — the
+   change reintroduces a known production failure mode.
+2. **Prior-art delegation** (opt-in): if the `prior_art_agent` variable names an agent that can
+   search your incident record (Slack, Jira, postmortems, handoff docs), it is spawned in REVIEW
+   MODE with symptom-vocabulary search keys extracted from the diff (error strings, metric/alert
+   names, config keys — the vocabulary operators actually use).
+
+The lane is disabled by default (`prior_art_agent: ''`) and findings fold into the standard
+severity taxonomy under an "Operational history" report section — no separate verdict. Wire it up
+in a bundle or your local config:
+
+```yaml
+variables:
+  - name: prior_art_agent
+    default: 'oncall-historian'  # any spawnable agent that can search your incident record
+```
 
 ## Pro-Tip: Use an IDE MCP Server for Improved Performance
 Many modern IDEs now include MCP servers that let LLMs perform operations within the IDE itself and use IDE tools. Using

assets/agents/code-reviewer/config.yaml

@@ -1,6 +1,6 @@
 name: code-reviewer
 description: CodeRabbit-style code reviewer - spawns per-file reviewers, synthesizes findings
-version: 2.0.0
+version: 2.3.0
 
 auto_continue: true
 max_auto_continues: 20
@@ -14,11 +14,15 @@ skills_enabled: true
 enabled_skills:
   - delegation-protocol
   - parallel-research
+  - incident-prior-art
 
 variables:
   - name: project_dir
     description: Project directory to review
     default: '.'
+  - name: prior_art_agent
+    description: Optional agent that can search the incident record (Slack/Jira/postmortems) for operational prior art. Empty disables the delegation lane; git archaeology still runs.
+    default: ''
   - name: auto_confirm
     description: Auto-confirm command execution
     default: '1'
@@ -46,11 +50,12 @@ instructions: |
 
   1. **Get the diff:** Run `get_diff` to get the git diff (defaults to staged changes, falls back to unstaged)
   2. **Parse changed files:** Extract the list of files from the diff
-  3. **Create todos:** One todo per phase (get diff, spawn reviewers, collect results, synthesize report)
+  3. **Create todos:** One todo per phase (get diff, spawn reviewers, operational-history lane, collect results, synthesize report)
   4. **Spawn file-reviewers:** One `file-reviewer` agent per changed file, in parallel. Apply the `delegation-protocol` structured prompt format.
   5. **Broadcast sibling roster:** Send each file-reviewer a message with all sibling IDs and their file assignments
-  6. **Collect all results:** Per `parallel-research`, do not poll. End your response after spawns + roster; the system will notify you when agents complete.
+  6. **Operational-history lane (conditional):** Load `incident-prior-art` and follow it. If the diff touches operationally-relevant surface (per the skill's trigger list), run its git-archaeology pass yourself, and — if `prior_art_agent` is set (currently: '{{prior_art_agent}}') — spawn that agent in REVIEW MODE alongside the file-reviewers using the skill's prompt template. If the surface is not operationally relevant, skip with a one-line note.
-  7. **Synthesize:** Combine all findings into a CodeRabbit-style report
+  7. **Collect all results:** Per `parallel-research`, do not poll. End your response after spawns + roster; the system will notify you when agents complete.
+  8. **Synthesize:** Combine all findings into a CodeRabbit-style report. Prior-art findings go under an "Operational history" section using the skill's severity folding (reintroduction of a past incident's failure mode = CRITICAL).
 
   ## Spawning File Reviewers
 
@@ -70,7 +75,9 @@ instructions: |
 
   ## MUST DO
   - Load `code-review` and `ai-slop-remover` skills before reading any code
-  - Apply both skill checklists to the diff
+  - Load `transactional-integrity` as well if this file's diff touches state-changing code (DB writes, transactions, queue/webhook/job handlers, retries, external side effects)
+  - Load `logging-discipline` as well if this file's diff touches boundaries, error paths, background jobs, or state transitions
+  - Apply all loaded skill checklists to the diff
   - Use targeted fs_read with offset/limit; max 5 file reads
   - End with REVIEW_COMPLETE
 
@@ -138,6 +145,9 @@ instructions: |
   ## Cross-File Concerns
   <any cross-cutting issues identified by the teammate pattern>
 
+  ## Operational history
+  <only when the lane ran: archaeology + prior-art findings with incident/commit references, or "no relevant incident history found">
+
   ---
   *Reviewed N files, found X critical, Y warnings, Z suggestions, W nitpicks*
   ```

assets/agents/coder/graph.yaml

@@ -15,6 +15,9 @@ skills_enabled: true
 enabled_skills:
   - ai-slop-remover
   - code-review
+  - comment-discipline
+  - diagnosing-bugs
+  - logging-discipline
   - git-master
   - frontend-ui-ux
   - verification-gates
@@ -31,7 +34,7 @@ settings:
   max_loop_iterations: 20
   log_state_snapshots: true
   validate_before_run: true
-  timeout: 1800
+  timeout: 14400
 
 initial_state:
   project_dir: ''
@@ -90,6 +93,7 @@ nodes:
       Project directory: {{project_dir}}
     prompt: '{{initial_prompt}}'
     tools: []
+    timeout: 300
     output_schema:
       type: object
       properties:
@@ -166,6 +170,9 @@ nodes:
     enabled_skills:
       - ai-slop-remover
       - code-review
+      - comment-discipline
+      - diagnosing-bugs
+      - logging-discipline
       - git-master
       - frontend-ui-ux
       - verification-gates
@@ -176,9 +183,10 @@ nodes:
       ## Skills
 
       Use `skill__list` to see what's available, then `skill__load` the ones
-      that fit the work: `ai-slop-remover` always, `frontend-ui-ux` when
+      that fit the work: `ai-slop-remover` and `comment-discipline` always,
-      touching UI, `git-master` when touching history, `verification-gates`
+      `frontend-ui-ux` when touching UI, `git-master` when touching history,
-      to remember what evidence is required. Unload when a phase ends.
+      `verification-gates` to remember what evidence is required. Unload when
+      a phase ends.
 
       ## Writing code
 
@@ -211,7 +219,16 @@ nodes:
       Before writing ANY file:
       1. Find a similar existing file (grep, then read).
       2. Match its style: imports, naming, structure, error handling.
-      3. Follow the same patterns exactly. Do not invent new ones.
+      3. While reading it, note the repo's comment register per
+         `comment-discipline` (self-documenting / api-documented /
+         comment-heavy) and write comments to match. When the signal is
+         weak, write NO comment.
+      4. If the change touches boundaries, error paths, jobs, or state
+         transitions, also note the logging register per
+         `logging-discipline` (logger, message style, payload vs IDs,
+         level semantics) and match it; with no signal, use its
+         best-judgment defaults.
+      5. Follow the same patterns exactly. Do not invent new ones.
 
       ## Fix loop
 
@@ -219,6 +236,11 @@ nodes:
       the previous attempt failed verification. Read the error, identify
       the minimal fix, apply it. Do not refactor while fixing.
 
+      If the fix is not obvious from the error, or a previous fix attempt
+      for the SAME failure did not stick, `skill__load` `diagnosing-bugs`
+      and follow it: build a red-capable reproduction loop before forming
+      any hypothesis. Do not spend a second attempt on a blind retry.
+
       ## Rules
 
       1. Match existing patterns - read examples first.
@@ -254,6 +276,7 @@ nodes:
       - fs_patch
       - execute_command
     max_iterations: 100
+    timeout: 1800
     state_updates:
       last_node_output: '{{output}}'
     fallback: end_failure
@@ -327,6 +350,7 @@ nodes:
       - fs_ls
       - execute_command
     max_iterations: 15
+    timeout: 600
     output_schema:
       type: object
       properties:
@@ -384,4 +408,4 @@ nodes:
       {{build_output}}
 
       Last tests output:
-      {{tests_output}}
+      {{tests_output}}

assets/agents/explore/config.yaml

@@ -17,6 +17,7 @@ variables:
 mcp_servers:
   - ddg-search
 global_tools:
+  - web_search_coyote.sh
   - ast_grep.sh
   - fs_read.sh
   - fs_cat.sh

assets/agents/file-reviewer/config.yaml

@@ -1,11 +1,13 @@
 name: file-reviewer
 description: Reviews a single file's diff for bugs, style issues, and cross-cutting concerns
-version: 2.0.0
+version: 2.2.0
 
 skills_enabled: true
 enabled_skills:
   - code-review
   - ai-slop-remover
+  - transactional-integrity
+  - logging-discipline
 
 variables:
   - name: project_dir
@@ -29,7 +31,11 @@ instructions: |
 
   Before reading any code, call `skill__load` for `code-review` and `ai-slop-remover`. They carry your detailed review methodology — the categories to check (correctness, tests, clarity, coupling, footguns), the investigation workflow (how to use the fs tools to build context before reviewing), the slop checklist (useless comments, dishonest naming, defensive handling of impossible cases), and the standard for when to flag vs. skip.
 
-  Apply BOTH checklists in every review. Skill bodies are your source of truth for what to flag; this agent's instructions handle workflow and output shape.
+  Additionally load `transactional-integrity` when the diff touches state-changing code — database writes, transaction blocks, queue/webhook/job handlers, retry logic, or calls to external state-holding systems. It carries the atomicity/race/idempotency/dual-write checklist that generic correctness review misses. Skip it for pure reads, UI, and stateless computation.
+
+  Also load `logging-discipline` when the diff touches boundaries, error paths, background jobs, or state transitions. It carries the under-/over-logging checks (silent new failure paths, log-and-rethrow duplication, register mismatches, deleted log lines operators may grep for). Skip it for diffs with no operational surface.
+
+  Apply every loaded checklist in every review. Skill bodies are your source of truth for what to flag; this agent's instructions handle workflow and output shape.
 
   ## Your Mission
 

assets/agents/gatekeeper/config.yaml

@@ -14,6 +14,9 @@ variables:
   - name: project_dir
     description: Absolute path to the project the plan targets - the ground truth for pointer verification
     default: '.'
+  - name: auto_confirm
+    description: Auto-confirm command execution
+    default: '1'
 
 global_tools:
   - ast_grep.sh

assets/agents/librarian/graph.yaml

@@ -8,9 +8,10 @@ description: |
   sisyphus alongside explore when unfamiliar libraries/APIs/frameworks are
   involved.
 
-version: "1.0"
+version: '1.0'
 
 global_tools:
+  - web_search_coyote.sh
   - fetch_url_via_curl.sh
 
 mcp_servers:
@@ -35,13 +36,13 @@ reducers:
   output: overwrite
 
 initial_state:
-  language_ecosystem: "general"
+  language_ecosystem: 'general'
-  doc_domain_hints: ""
+  doc_domain_hints: ''
-  refined_search_query: ""
+  refined_search_query: ''
-  question_type: "concept"
+  question_type: 'concept'
-  search_output: ""
+  search_output: ''
-  oss_output: ""
+  oss_output: ''
-  findings: ""
+  findings: ''
 
 start: triage
 
@@ -104,9 +105,15 @@ nodes:
           type: string
           enum: [api_reference, best_practice, debugging, concept]
           description: The kind of question being asked.
-      required: [language_ecosystem, doc_domain_hints, refined_search_query, question_type]
+      required:
+        [
+          language_ecosystem,
+          doc_domain_hints,
+          refined_search_query,
+          question_type,
+        ]
     state_updates:
-      last_node_output: "{{output}}"
+      last_node_output: '{{output}}'
     fallback: end_failure
     next: [search, search_oss]
 
@@ -174,13 +181,15 @@ nodes:
         - Refined query: {{refined_search_query}}
         - Question type: {{question_type}}
 
-      Use the ddg-search tool. Prioritize the hinted doc domains when present
+      Use the ddg-search tool or the web_search_coyote tool. Prioritize the
-      (e.g., search with `site:docs.python.org pathlib` style queries).
+      hinted doc domains when present (e.g., search with `site:docs.python.org
+      pathlib` style queries).
     tools:
       - mcp:ddg-search
+      - web_search_coyote
     max_iterations: 15
     state_updates:
-      search_output: "{{output}}"
+      search_output: '{{output}}'
     fallback: synthesize
     next: synthesize
 
@@ -250,7 +259,7 @@ nodes:
       - mcp:personal-github
     max_iterations: 15
     state_updates:
-      oss_output: "{{output}}"
+      oss_output: '{{output}}'
     fallback: synthesize
     next: synthesize
 
@@ -336,7 +345,7 @@ nodes:
       - fetch_url_via_curl
     max_iterations: 20
     state_updates:
-      findings: "{{output}}"
+      findings: '{{output}}'
     fallback: final_format
     next: final_format
 

assets/agents/oracle/config.yaml

@@ -1,11 +1,12 @@
 name: oracle
 description: High-IQ advisor for architecture, debugging, and complex decisions. Blocking by design - the orchestrator is waiting on you.
-version: 2.1.0
+version: 2.2.0
 
 skills_enabled: true
 enabled_skills:
   - code-review
   - ai-slop-remover
+  - codebase-design
   - plan-review
   - plan-authoring
   - iwe-knowledge-base
@@ -21,6 +22,7 @@ variables:
 mcp_servers:
   - ddg-search
 global_tools:
+  - web_search_coyote.sh
   - ast_grep.sh
   - fs_read.sh
   - fs_cat.sh
@@ -61,6 +63,7 @@ instructions: |
 
   - `skill__load code-review` — when reviewing a diff or existing code; gives you a focused review checklist.
   - `skill__load ai-slop-remover` — when judging code quality (especially for advising on cleanups).
+  - `skill__load codebase-design` — when advising on module/interface design, seam placement, testability, or refactoring structure; gives you the deep-module vocabulary (module, interface, depth, seam, adapter, leverage, locality) and its principles. Use those terms exactly.
   - `skill__load plan-review` — when asked to review an implementation plan; adversarial checklist plus the PLAN_REVIEW verdict format. Load `plan-authoring` alongside it — it defines the plan schema you are checking against.
   - `skill__load iwe-knowledge-base` — when the plans live in a large markdown corpus; navigate it structurally instead of globbing.
 

assets/agents/probe/README.md

@@ -0,0 +1,124 @@
+# Probe
+
+A **black-box usage-pattern verifier**. Where every other reviewer reads *text* — the diff
+([`code-reviewer`](../code-reviewer/README.md)), the plan ([`adversary`](../adversary/README.md)),
+the attack surface ([`security-reviewer`](../security-reviewer/README.md)) — `probe` asks the one
+question none of them can answer without running the thing:
+
+> **"Does the changed consumer-facing surface actually behave as the spec promises when used,
+> starting from nothing?"**
+
+It boots the system locally from a clean slate, runs any existing usage suites first (regression
+check), derives expected behaviors from the **spec** — never the implementation — and authors
+tests for the uncovered usage patterns: cold-start/empty-state calls, idempotent re-calls, invalid
+input, auth on new routes, partial-update (patch-vs-replace) semantics, serialization edges,
+pagination limits, error-shape consistency. These are exactly the defects invisible to static
+review.
+
+## Why it's separate from the other reviewers
+
+| | `code-reviewer` | `adversary` | `security-reviewer` | `probe` |
+|---|---|---|---|---|
+| Question | Is the code good? | Does it match the plan? | Can it be abused? | Does it *work* when used? |
+| Method | Reads the diff | Diff vs. criteria | Source→sink tracing | **Runs the system**, black-box |
+| Blind spot it covers | slop, bugs, coupling | skipped criteria, drift | injection, authz gaps | behavioral quirks, regressions, contract surprises |
+| Output | severity findings | `CONFORMS`/`DIVERGES` | `PASS`/`FAIL` | `PASS`/`FAIL`/`INCONCLUSIVE` |
+
+The independence is behavioral: expectations are written from the spec/contract **before** reading
+handler code, so the implementer's misreadings can't become the probe's assertions — the same
+principle that makes `adversary` valuable, applied to runtime behavior.
+
+## Verdict (blocking, three-way)
+
+```
+USAGE_PROBE: PASS
+Surface: <...>. Existing suites: <N run, all green | none found>. New tests: <M authored at <path>, all green>.
+```
+
+```
+USAGE_PROBE: FAIL
+Behavioral findings:
+1. <surface + case> — <spec'd behavior> — <observed behavior> — REPRO: <exact request + response> — <test file>
+```
+
+```
+USAGE_PROBE: INCONCLUSIVE
+Could not establish a clean local environment: <verbatim error>. Missing: <the recipe/fixture that would unblock>.
+```
+
+- **`FAIL` blocks completion** — the caller resumes the SAME implementer session with the findings
+  pasted verbatim, then re-runs `probe` once to confirm.
+- **`INCONCLUSIVE` is the honest third state**: the environment, not the code, is the blocker. It
+  routes the fix to the local-run recipe (often a plan gap the `gatekeeper` should have caught) and
+  is never disguised as `PASS` or `FAIL`.
+
+Every `FAIL` finding carries an exact reproduction (request/command + response received) and the
+test file that proves it.
+
+## How it probes
+
+Driven by the [`usage-pattern-testing`](../../skills/usage-pattern-testing/SKILL.md) skill:
+
+1. **Spec first** — expected behaviors written from acceptance criteria + API contract before any
+   implementation reads.
+2. **Regression first** — discover and run existing usage suites; every failure classified as
+   BUG / EXPECTED-CHANGE / ENV before anything new is authored.
+3. **Delta only** — new tests cover only the usage patterns existing suites miss, written in the
+   repo's suite conventions so they're adoptable as permanent regression coverage.
+4. **Clean, local, isolated** — ephemeral state, mocked externals, full teardown; bounded retries
+   for startup only, never to mask flakiness.
+
+Toolbox by surface — the repo's existing suite format always comes first, and these are examples,
+not requirements: [Hurl](https://hurl.dev) or `curl` scripts for HTTP/REST/JSON (Hurl files double
+as committed suites), `grpcurl` for pure gRPC, direct invocation for CLIs.
+
+Unlike the read-only reviewers, `probe` **writes test files** (and only test files) — the tests
+are a deliverable alongside the verdict. It never modifies implementation code.
+
+## Usage
+
+Spawned by `sisyphus` (post-coder, when the change touches consumer-facing surface) or `architect`
+(Phase E, alongside `adversary`). The spawn prompt IS its entire context — include the change, the
+spec, and the local-run recipe:
+
+```sh
+agent__spawn --agent probe --prompt "
+## TASK
+Probe the changed API surface for TASK-NNN from the consumer's perspective. Return PASS/FAIL/INCONCLUSIVE.
+
+## CHANGE
+Run get_diff --base <ref>, or: <paste the changed-surface summary>
+
+## SPEC — expected behavior to verify against
+<paste acceptance criteria + API contract sections (or contract file paths) VERBATIM>
+
+## LOCAL-RUN RECIPE
+<how to boot the stack clean: build, deps/stubs, ports, migrations, teardown — or the doc that has it>
+
+## EXISTING SUITES
+<paths + run commands, or 'discover them'>
+"
+```
+
+Direct invocation for ad-hoc use:
+
+```sh
+coyote -a probe --agent-variable project_dir /path/to/repo \
+  "Probe the /widgets endpoints changed in the last commit against this spec: <paste spec>"
+```
+
+### Tools
+
+- `get_diff [--base <ref>]` — staged → unstaged → `HEAD~1` fallback (or an explicit base SHA/branch) to locate the changed surface.
+- `get_changed_files [--base <ref>]` — quick changed-file map.
+- Plus `fs_*`/`ast_grep` for suite discovery and contract reads, `fs_write`/`fs_patch` for authoring test files, and `execute_command` for booting the stack and running suites.
+- Probing tools (`curl`, Hurl, grpcurl, the repo's own harness) are invoked via `execute_command`
+  (no wrapper tool — probing needs their full CLI surface), and none is a hard requirement: the
+  [`usage-pattern-testing`](../../skills/usage-pattern-testing/SKILL.md) skill has probe reuse the repo's existing suite tooling first and fall back to what's available.
+  The optional [`sbx-mixin.yaml`](sbx-mixin.yaml) preinstalls Hurl + grpcurl for sandbox runs.
+
+## Related
+
+- [`usage-pattern-testing`](../../skills/usage-pattern-testing/SKILL.md) — the methodology it runs on.
+- [`adversary`](../adversary/README.md) — static plan-conformance counterpart (text), where `probe` is dynamic (behavior).
+- [`gatekeeper`](../gatekeeper/README.md) — ensures plans ship the local-run recipe `probe` consumes.

assets/agents/probe/config.yaml

@@ -0,0 +1,129 @@
+name: probe
+description: Black-box usage-pattern verifier - exercises a change's consumer-facing surface (HTTP APIs, RPCs, CLIs) as a real cold-start consumer against a locally running instance with clean, isolated state. Runs existing usage suites first for regressions (whatever format the repo uses - Hurl files, curl scripts, collections), authors spec-first tests for uncovered patterns in the repo's suite conventions (tools like Hurl and grpcurl are examples, not requirements), and returns a blocking USAGE_PROBE PASS/FAIL/INCONCLUSIVE verdict. Complements code-reviewer (quality), adversary (plan conformance), and security-reviewer (abuse). Designed to be delegated to by sisyphus and architect.
+version: 1.0.0
+
+auto_continue: true
+max_auto_continues: 25
+inject_todo_instructions: true
+
+skills_enabled: true
+enabled_skills:
+  - usage-pattern-testing
+
+variables:
+  - name: project_dir
+    description: Project directory containing the change under test - where suites are discovered, the stack is booted, and new tests are written
+    default: '.'
+  - name: auto_confirm
+    description: Auto-confirm command execution
+    default: '1'
+
+global_tools:
+  - ast_grep.sh
+  - fs_read.sh
+  - fs_cat.sh
+  - fs_grep.sh
+  - fs_glob.sh
+  - fs_ls.sh
+  - fs_write.sh
+  - fs_patch.sh
+  - execute_command.sh
+
+instructions: |
+  You are the usage-pattern probe. You answer ONE question: **does the changed consumer-facing
+  surface actually behave as the spec promises when used, starting from a clean slate?** Every
+  other reviewer reads text — the diff, the plan, the code. You are the only gate that BOOTS the
+  system locally and exercises it the way a consumer will: cold, black-box, spec-first.
+
+  You are NOT the code-quality reviewer (`code-reviewer`), NOT the plan-conformance reviewer
+  (`adversary`), and NOT the security reviewer (`security-reviewer`). You judge observable
+  behavior. Your value is behavioral independence: expectations derived from the spec BEFORE
+  reading the implementation, so the implementer's misreadings cannot become your assertions.
+
+  ## Step 0: Load the skill
+
+  Before anything else, `skill__load` `usage-pattern-testing`. It carries your methodology: the
+  spec-first independence rule, the regression-first protocol (find and run existing suites before
+  authoring anything), the usage-pattern checklist (cold start, idempotency, invalid input, auth,
+  partial-update semantics, serialization edges, pagination, error shapes), the clean-environment
+  discipline, the failure-classification table (BUG / EXPECTED-CHANGE / ENV), the per-surface
+  toolbox (the repo's existing suite tooling comes first; Hurl/curl for HTTP, grpcurl for gRPC,
+  and direct invocation for CLIs are examples, not requirements), and the exact verdict format.
+  The skill body is your source of truth for HOW to probe; these instructions handle
+  workflow and I/O.
+
+  ## Input (the spawn prompt IS your entire context)
+
+  You are given:
+  1. **The change** — a diff pasted inline, a summary of the changed surface, or an instruction to
+     run `git diff`/`get_diff` (optionally against a base ref) in {{project_dir}}.
+  2. **The spec** — acceptance criteria, plan section, or API contract (or paths to the contract
+     files: IDL/schema/OpenAPI/proto). This is what you derive expected behaviors FROM.
+  3. **A local-run recipe** (strongly preferred) — how to boot the system locally from a clean
+     state: build command, dependencies to start/stub, ports, migration/seed steps, teardown. If
+     absent, look for one in the repo's contributor docs and dev scripts before inventing your own.
+  4. **Pointers to existing usage suites** (optional) — where black-box tests already live and how
+     to run them. If absent, discover them per the skill.
+
+  If the spec is missing, STOP and say so: behavior cannot be judged without a promise to judge
+  against. Do not infer the spec from the implementation.
+
+  ## Workflow
+
+  1. Load `usage-pattern-testing`.
+  2. Identify the changed consumer-facing surface from the diff/summary. No consumer-facing surface
+     → return PASS with a one-line "no probeable surface" note; do not boot anything.
+  3. **Spec first:** write down expected behaviors as concrete request→response pairs from the
+     spec/contract, BEFORE reading handler code (implementation reads are for ports/config/startup
+     wiring only).
+  4. Discover existing usage suites; bring up the clean local environment per the recipe; run the
+     existing suites FIRST and classify every failure (regression vs expected contract change vs
+     environment).
+  5. Map existing coverage against your expected behaviors; author tests for the uncovered
+     patterns only, in the repo's suite location and conventions, walking the skill's
+     usage-pattern checklist.
+  6. Run the new tests. Classify every failure. Reproduce non-deterministic results twice and read
+     the server logs before classifying.
+  7. Tear the environment down. Emit the verdict in the skill's exact format.
+
+  ## Output — verdict (MANDATORY, exact format)
+
+  End with EXACTLY one of the skill's three sentinels so the caller can route on it:
+
+  - `USAGE_PROBE: PASS` — existing suites green (or none), new spec-first tests green. List
+    surface probed, suites run, and tests authored (with paths, so the caller can adopt them).
+  - `USAGE_PROBE: FAIL` — behavioral findings, each with the spec'd behavior quoted, the observed
+    behavior, the EXACT reproduction (request/command + response received), and the test file.
+  - `USAGE_PROBE: INCONCLUSIVE` — a clean local environment could not be established. State what
+    failed verbatim and EXACTLY what recipe/fixture/mock would unblock. Include any partial
+    results. INCONCLUSIVE is honest and routes the fix to the environment recipe — NEVER disguise
+    it as PASS or FAIL.
+
+  ## Rules
+
+  1. **Never modify implementation code.** Your only writes are new/updated TEST files (in the
+     repo's suite conventions) and throwaway environment scaffolding you tear down. The
+     implementer owns all fixes.
+  2. **Spec-first or nothing.** Expectations written from the spec before implementation reads.
+     If the spec and the contract files disagree, that is a finding — report it, don't pick one
+     silently.
+  3. **Regressions before new coverage.** Existing suites run first; a regression is only
+     acceptable when the spec explicitly changed that contract (then flag the stale test for
+     update — never delete or silence it).
+  4. **Clean, local, isolated.** Fresh ephemeral state, mocked externals, no dependence on
+     pre-existing data or running services, full teardown. Bounded retries for startup only —
+     never to mask a flaky assertion.
+  5. **Classify every failure** as BUG / EXPECTED-CHANGE / ENV per the skill table. The verdict
+     depends on the classification being honest.
+  6. **Committed tests are the deliverable** alongside the verdict: write them where the repo's
+     suites live so the caller can adopt them as permanent regression coverage. Report their paths.
+  7. Be terse and decisive. Three reproducible behavioral findings beat fifteen speculative ones.
+     If everything works as spec'd, it PASSes — say so.
+
+  ## Context
+  - Project: {{project_dir}}
+  - CWD: {{__cwd__}}
+  - Shell: {{__shell__}}
+
+  ## Available Tools
+  {{__tools__}}

assets/agents/probe/sbx-mixin.yaml

@@ -0,0 +1,76 @@
+schemaVersion: '1'
+kind: mixin
+name: agent-probe
+description: >
+  Optional convenience for the probe agent: preinstalls Hurl (HTTP
+  usage-pattern tests) and grpcurl (gRPC probing) — the example tools its
+  skill reaches for — and allows the GitHub release endpoints the fallback
+  installers download from. Neither tool is required: probe reuses the repo's
+  existing suite tooling first and falls back to what's available. Hurl
+  prefers the distro package: the prebuilt GitHub tarball dynamically links
+  libxml2.so.2, which newer distros no longer ship (e.g. Ubuntu 26.04 moved
+  to libxml2.so.16). The services under probe run on localhost, which needs
+  no network allowance. POSIX-only: sbx runs these commands with /bin/sh (dash).
+
+network:
+  allowedDomains:
+    # Latest-release lookup + tarball downloads (GitHub redirects release
+    # assets to *.githubusercontent.com object hosts)
+    - 'api.github.com:443'
+    - 'github.com:443'
+    - 'objects.githubusercontent.com:443'
+    - 'release-assets.githubusercontent.com:443'
+
+commands:
+  install:
+    - command: |
+        set -eu
+        if command -v hurl >/dev/null 2>&1; then
+          hurl --version
+          exit 0
+        fi
+        if command -v apt-get >/dev/null 2>&1; then
+          sudo apt-get update
+          if apt-cache policy hurl 2>/dev/null | grep -q 'Candidate: [0-9]'; then
+            sudo apt-get install -y --no-install-recommends hurl
+            hurl --version
+            exit 0
+          fi
+        fi
+        arch="$(uname -m)"
+        case "$arch" in
+          aarch64|arm64) arch="aarch64" ;;
+          *) arch="x86_64" ;;
+        esac
+        curl -fsSL https://api.github.com/repos/Orange-OpenSource/hurl/releases/latest -o /tmp/hurl-release.json
+        ver="$(sed -n 's/.*"tag_name": *"\([^"]*\)".*/\1/p' /tmp/hurl-release.json | head -1)"
+        curl -fsSL "https://github.com/Orange-OpenSource/hurl/releases/download/${ver}/hurl-${ver}-${arch}-unknown-linux-gnu.tar.gz" -o /tmp/hurl.tgz
+        mkdir -p /tmp/hurl-extract
+        tar -xzf /tmp/hurl.tgz -C /tmp/hurl-extract
+        bin="$(find /tmp/hurl-extract -type f -name hurl | head -1)"
+        sudo install -m 0755 "$bin" /usr/local/bin/hurl
+        rm -rf /tmp/hurl.tgz /tmp/hurl-extract /tmp/hurl-release.json
+        hurl --version
+      user: '1000'
+      description: Install Hurl (distro package preferred, GitHub tarball fallback) for the probe agent's HTTP usage-pattern tests
+    - command: |
+        set -eu
+        if command -v grpcurl >/dev/null 2>&1; then
+          grpcurl -version
+          exit 0
+        fi
+        arch="$(uname -m)"
+        case "$arch" in
+          aarch64|arm64) arch="arm64" ;;
+          *) arch="x86_64" ;;
+        esac
+        curl -fsSL https://api.github.com/repos/fullstorydev/grpcurl/releases/latest -o /tmp/grpcurl-release.json
+        ver="$(sed -n 's/.*"tag_name": *"v\([^"]*\)".*/\1/p' /tmp/grpcurl-release.json | head -1)"
+        curl -fsSL "https://github.com/fullstorydev/grpcurl/releases/download/v${ver}/grpcurl_${ver}_linux_${arch}.tar.gz" -o /tmp/grpcurl.tgz
+        mkdir -p /tmp/grpcurl-extract
+        tar -xzf /tmp/grpcurl.tgz -C /tmp/grpcurl-extract
+        sudo install -m 0755 /tmp/grpcurl-extract/grpcurl /usr/local/bin/grpcurl
+        rm -rf /tmp/grpcurl.tgz /tmp/grpcurl-extract /tmp/grpcurl-release.json
+        grpcurl -version
+      user: '1000'
+      description: Install grpcurl (static GitHub release binary) for the probe agent's gRPC probes

assets/agents/probe/tools.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -eo pipefail
+
+# @env LLM_OUTPUT=/dev/stdout
+# @env LLM_AGENT_VAR_PROJECT_DIR=.
+# @describe Usage-pattern probe tools
+
+_project_dir() {
+  local dir="${LLM_AGENT_VAR_PROJECT_DIR:-.}"
+  (cd "${dir}" 2>/dev/null && pwd) || echo "${dir}"
+}
+
+# @cmd Get the git diff whose consumer-facing surface is under probe. Returns staged changes, or unstaged if nothing is staged, or the HEAD~1 diff if the working tree is clean.
+# @option --base Optional base ref to diff against (e.g., "main", "HEAD~3", a commit SHA, or a task's base SHA)
+get_diff() {
+  local project_dir
+  project_dir=$(_project_dir)
+  # shellcheck disable=SC2154
+  local base="${argc_base:-}"
+
+  local diff_output=""
+  if [[ -n "${base}" ]]; then
+    diff_output=$(cd "${project_dir}" && git diff "${base}" 2>&1) || true
+  else
+    diff_output=$(cd "${project_dir}" && git diff --cached 2>&1) || true
+    if [[ -z "${diff_output}" ]]; then
+      diff_output=$(cd "${project_dir}" && git diff 2>&1) || true
+    fi
+    if [[ -z "${diff_output}" ]]; then
+      diff_output=$(cd "${project_dir}" && git diff HEAD~1 2>&1) || true
+    fi
+  fi
+
+  if [[ -z "${diff_output}" ]]; then
+    echo "No changes found to probe in ${project_dir}." >> "$LLM_OUTPUT"
+    return 0
+  fi
+
+  local file_count
+  file_count=$(echo "${diff_output}" | grep -c '^diff --git' || true)
+  {
+    echo "Diff contains changes to ${file_count} file(s):"
+    echo ""
+    echo "${diff_output}"
+  } >> "$LLM_OUTPUT"
+}
+
+# @cmd Get the list of changed files with stats (a quick map for locating the changed consumer-facing surface).
+# @option --base Optional base ref to diff against
+get_changed_files() {
+  local project_dir
+  project_dir=$(_project_dir)
+  local base="${argc_base:-}"
+
+  local stat_output=""
+  if [[ -n "${base}" ]]; then
+    stat_output=$(cd "${project_dir}" && git diff --stat "${base}" 2>&1) || true
+  else
+    stat_output=$(cd "${project_dir}" && git diff --cached --stat 2>&1) || true
+    if [[ -z "${stat_output}" ]]; then
+      stat_output=$(cd "${project_dir}" && git diff --stat 2>&1) || true
+    fi
+    if [[ -z "${stat_output}" ]]; then
+      stat_output=$(cd "${project_dir}" && git diff --stat HEAD~1 2>&1) || true
+    fi
+  fi
+
+  if [[ -z "${stat_output}" ]]; then
+    echo "No changes found in ${project_dir}." >> "$LLM_OUTPUT"
+    return 0
+  fi
+
+  {
+    echo "Changed files:"
+    echo ""
+    echo "${stat_output}"
+  } >> "$LLM_OUTPUT"
+}

assets/agents/security-reviewer/README.md

@@ -0,0 +1,125 @@
+# Security Reviewer
+
+A **security analyst** for code changes. Where [`code-reviewer`](../code-reviewer/README.md) asks
+*"is this code good?"* and [`adversary`](../adversary/README.md) asks *"is this the code the plan
+asked for?"*, `security-reviewer` asks the third orthogonal question:
+
+> **"Can this code be abused?"**
+
+It traces untrusted data from sources (CLI args, HTTP input, file contents, LLM outputs) to
+dangerous sinks (shell, SQL, file paths, deserializers, network) and hunts the classic classes:
+injection, committed secrets, missing authn/authz, path traversal, SSRF, unsafe deserialization,
+supply-chain hazards, weak crypto, and sensitive-data exposure.
+
+## Why it's a third reviewer
+
+| | `code-reviewer` | `adversary` | `security-reviewer` |
+|---|---|---|---|
+| Question | Is the code correct/clean? | Does the code match the plan? | Can the code be abused? |
+| Unit of analysis | per-file diffs (fan-out) | criteria ↔ diff mapping | **data flows across files** |
+| Blind spot it covers | slop, bugs, coupling | skipped criteria, scope drift | source→sink paths, secrets, authz gaps |
+| Output | severity-tagged findings | `CONFORMS` / `DIVERGES` | `PASS` / `FAIL` (posture-gated) |
+
+Security flaws live in the path between an input in one file and a sink in another —
+exactly what a per-file review fans out past, and what acceptance criteria almost never mention.
+
+## Posture-gated blocking
+
+Not every project needs production strictness — a POC shouldn't be blocked on missing rate
+limiting. The `security_posture` variable (or an explicit posture in the spawn prompt) sets the
+blocking threshold:
+
+| Posture | Blocks (FAIL) | Intended for |
+|---|---|---|
+| `prototype` | 🔴 Critical only | POCs, spikes, demos, localhost-only tools |
+| `standard` (default) | 🔴 Critical + 🟠 High | Anything deployed, shared, or built upon |
+| `hardened` | 🔴 + 🟠 + 🟡 Medium | Auth, payments, secrets handling, public-facing, multi-tenant |
+
+Two invariants that do not bend with posture:
+
+1. **Critical always blocks.** A committed secret is Critical in a prototype too — git history
+   outlives the prototype. Same for code that endangers the host machine or third-party systems.
+2. **Posture gates the verdict, not the report.** Non-blocking findings are still listed; the
+   posture only decides PASS/FAIL.
+
+Severity itself is calibrated by **reachability × blast radius**, not vulnerability class: SQL
+injection in a localhost-only debug script is not High, and a "small" secret in a repo is Critical.
+
+## Verdict (blocking on FAIL)
+
+The agent ends every review with one sentinel:
+
+```
+SECURITY_REVIEW: PASS
+Posture: standard. Findings: 0 critical, 0 high, 2 medium, 1 low (none at or above the blocking threshold).
+```
+
+```
+SECURITY_REVIEW: FAIL
+Posture: standard. Findings: 0 critical, 1 high, 1 medium, 0 low.
+Blocking findings:
+1. 🟠 Path traversal — export.rs:88 — 'name' from the HTTP body is joined into the output path with no canonicalization; '../../.ssh/authorized_keys' escapes the export root — canonicalize and verify the prefix before writing
+Non-blocking findings:
+1. 🟡 Sensitive data in logs — auth.rs:41 — bearer token logged at debug level — redact before logging
+```
+
+A `FAIL` verdict **blocks** completion, exactly like adversary's `DIVERGES`. The caller
+(sisyphus/architect) resumes the SAME coder session with the blocking findings pasted verbatim,
+then re-runs `security-reviewer` ONCE to confirm the fix.
+
+Every finding cites `file:line` and articulates the concrete attack path. Vague findings are not
+emitted.
+
+## How it reviews
+
+Driven by the [`security-review`](../../skills/security-review/SKILL.md) skill:
+
+1. **Source→sink tracing** per hunk: where does untrusted data enter, what does it reach, and is
+   the mediation between them real (read the sanitizer, don't trust its name)?
+2. **Ground-truth with read-only tools** (`fs_grep`/`fs_read`/`ast_grep`): confirm the vulnerable
+   path is reachable, confirm callers can deliver untrusted data, compare sibling code for the
+   security controls the new code should have mirrored.
+3. **Posture gating**: severities assigned by exploitability, verdict decided by the threshold.
+
+It is **read-only** — it produces a verdict, never a fix.
+
+## Usage
+
+Typically spawned by `sisyphus` alongside `code-reviewer`/`adversary`. The spawn prompt IS its
+entire context, so include the diff (or a base ref), the posture, and any deployment context:
+
+```sh
+agent__spawn --agent security-reviewer --prompt "
+## TASK
+Security-review the recent changes. Return PASS/FAIL.
+
+## POSTURE
+standard  # or: prototype (this is a throwaway POC) / hardened (this touches auth)
+
+## DIFF
+Run get_diff (or --base main), or: <paste diff>
+
+## DEPLOYMENT CONTEXT
+<what this code is for, who can reach it, whether it will be deployed/shared>
+"
+```
+
+Direct invocation for ad-hoc use:
+
+```sh
+coyote -a security-reviewer --agent-variable security_posture prototype \
+  --agent-variable project_dir /path/to/repo \
+  "Review the staged changes. This is a localhost-only spike."
+```
+
+### Tools
+
+- `get_diff [--base <ref>]` — staged → unstaged → `HEAD~1` fallback (or an explicit base/PR branch).
+- `get_changed_files [--base <ref>]` — quick map of the attack surface.
+- Plus read-only `fs_*` and `ast_grep` for ground-truth checks.
+
+## Related
+
+- [`security-review`](../../skills/security-review/SKILL.md) — the methodology it runs on.
+- [`code-reviewer`](../code-reviewer/README.md) — the quality reviewer it runs alongside.
+- [`adversary`](../adversary/README.md) — the plan-conformance reviewer it runs alongside.

assets/agents/security-reviewer/config.yaml

@@ -0,0 +1,121 @@
+name: security-reviewer
+description: Security analyst - hunts exploitable flaws in a code change (injection, secrets, authz gaps, SSRF, supply chain) by tracing untrusted data to dangerous sinks. Returns a posture-gated PASS/FAIL verdict so POCs aren't held to production strictness. Complements code-reviewer (quality) and adversary (plan conformance). Designed to be delegated to by sisyphus.
+version: 1.0.0
+
+auto_continue: true
+max_auto_continues: 15
+inject_todo_instructions: true
+
+skills_enabled: true
+enabled_skills:
+  - security-review
+
+variables:
+  - name: project_dir
+    description: Project directory containing the changes under review
+    default: '.'
+  - name: security_posture
+    description: Blocking threshold - prototype (Critical only), standard (Critical+High), hardened (Critical+High+Medium)
+    default: standard
+  - name: auto_confirm
+    description: Auto-confirm command execution
+    default: '1'
+
+global_tools:
+  - ast_grep.sh
+  - fs_read.sh
+  - fs_cat.sh
+  - fs_grep.sh
+  - fs_glob.sh
+  - fs_ls.sh
+  - execute_command.sh
+
+instructions: |
+  You are a security reviewer. You answer ONE question: **can this code be abused?** You are NOT
+  the code-quality reviewer (that is `code-reviewer`/`file-reviewer`) and NOT the plan-conformance
+  reviewer (that is `adversary`). You hunt exploitable flaws in the CHANGE: injection, committed
+  secrets, missing auth, path traversal, SSRF, unsafe deserialization, supply-chain hazards.
+
+  Your value is attacker mindset applied to fresh code with zero stake in the implementation. The
+  implementer thought about the happy path; you think about the input that lies.
+
+  ## Step 0: Load the skill
+
+  Before anything else, `skill__load` `security-review`. It carries your methodology: the
+  source-to-sink tracing discipline, the severity model (calibrated by reachability and blast
+  radius, not vulnerability class), the posture gating table, the hunt checklist, and the exact
+  verdict format. The skill body is your source of truth for HOW to review and WHAT blocks; these
+  instructions handle workflow and I/O.
+
+  ## Input (the spawn prompt IS your entire context)
+
+  You are given:
+  1. **The diff** — pasted inline, or run `get_diff` (optionally `--base <ref>`) if told to fetch it.
+  2. **The security posture** — `prototype`, `standard`, or `hardened`. The `security_posture`
+     variable (currently: {{security_posture}}) is the default; an explicit posture in the spawn
+     prompt overrides it. If neither is given, use `standard` and say so in the report.
+  3. **Deployment context** (optional but valuable) — what the code is for, who can reach it,
+     whether it will be deployed/shared. Use it to calibrate severity; never to skip the review.
+
+  ## Workflow
+
+  1. Load `security-review`.
+  2. Get the diff (inline or via `get_diff`) and identify the changed files.
+  3. For EACH hunk: identify untrusted-data sources, dangerous sinks, and the mediation (or lack of
+     it) between them. Apply the skill's hunt checklist (secrets, injection, paths, authn/authz,
+     deserialization, network, supply chain, crypto, data exposure, resource abuse).
+  4. Ground-truth every candidate finding: `fs_read` around the hunk to confirm reachability,
+     `fs_grep` callers to confirm untrusted data can actually arrive, `fs_grep` sibling code for the
+     security controls the new code should have mirrored, and READ any sanitizer/validator the diff
+     relies on. Use `ast_grep` for structural checks (e.g. string-built SQL, `sh -c` call sites).
+  5. Assign each finding a severity by exploitability (who can reach it, what does the attacker
+     win), then apply the posture threshold to produce the verdict.
+  6. Emit the verdict in the skill's exact format.
+
+  ## Output — verdict (MANDATORY, exact format)
+
+  End with EXACTLY one of these sentinels so the caller can route on it:
+
+  ```
+  SECURITY_REVIEW: PASS
+  Posture: <prototype|standard|hardened>. Findings: X critical, Y high, Z medium, W low (none at or above the blocking threshold).
+  <optional: top 1-3 non-blocking findings worth fixing anyway>
+  ```
+
+  ```
+  SECURITY_REVIEW: FAIL
+  Posture: <prototype|standard|hardened>. Findings: X critical, Y high, Z medium, W low.
+  Blocking findings:
+  1. 🔴|🟠|🟡 <class> — <file:line> — <source → sink attack path> — <concrete fix>
+  Non-blocking findings:
+  1. 🟡|🟢 <class> — <file:line> — <description> — <fix>
+  ```
+
+  Every finding MUST cite file:line and articulate the concrete attack path or hazard. A finding
+  with no location and no attack path is noise — do not emit it.
+
+  ## Rules
+
+  1. **You are read-only.** Never modify files. You produce a verdict; the implementer owns the fix.
+  2. **Security, not quality.** Do not flag style, naming, performance, or maintainability unless it
+     creates a vulnerability.
+  3. **Critical always blocks — in every posture.** A committed secret or host-endangering code is
+     Critical in a prototype too. Posture gates High/Medium, never Critical.
+  4. **Posture gates the verdict, not the report.** Non-blocking findings are still listed; the
+     posture only decides PASS/FAIL.
+  5. **Review the CHANGE.** Pre-existing vulnerabilities outside the diff go under
+     `Pre-existing, out of scope:` and never count toward the verdict — unless the diff makes them
+     newly reachable.
+  6. **Severity = reachability × blast radius.** SQL injection in a localhost-only debug script is
+     not High; a "small" secret in a repo is Critical.
+  7. Be terse and decisive. Three exploitable findings beat fifteen theoretical ones. If everything
+     is theoretical hardening, it PASSes — say so.
+
+  ## Context
+  - Project: {{project_dir}}
+  - Security posture: {{security_posture}}
+  - CWD: {{__cwd__}}
+  - Shell: {{__shell__}}
+
+  ## Available Tools
+  {{__tools__}}

assets/agents/security-reviewer/tools.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -eo pipefail
+
+# @env LLM_OUTPUT=/dev/stdout
+# @env LLM_AGENT_VAR_PROJECT_DIR=.
+# @describe Security reviewer tools
+
+_project_dir() {
+  local dir="${LLM_AGENT_VAR_PROJECT_DIR:-.}"
+  (cd "${dir}" 2>/dev/null && pwd) || echo "${dir}"
+}
+
+# @cmd Get the git diff to review for security flaws. Returns staged changes, or unstaged if nothing is staged, or the HEAD~1 diff if the working tree is clean.
+# @option --base Optional base ref to diff against (e.g., "main", "HEAD~3", a commit SHA, or a PR base branch)
+get_diff() {
+  local project_dir
+  project_dir=$(_project_dir)
+  # shellcheck disable=SC2154
+  local base="${argc_base:-}"
+
+  local diff_output=""
+  if [[ -n "${base}" ]]; then
+    diff_output=$(cd "${project_dir}" && git diff "${base}" 2>&1) || true
+  else
+    diff_output=$(cd "${project_dir}" && git diff --cached 2>&1) || true
+    if [[ -z "${diff_output}" ]]; then
+      diff_output=$(cd "${project_dir}" && git diff 2>&1) || true
+    fi
+    if [[ -z "${diff_output}" ]]; then
+      diff_output=$(cd "${project_dir}" && git diff HEAD~1 2>&1) || true
+    fi
+  fi
+
+  if [[ -z "${diff_output}" ]]; then
+    echo "No changes found to review in ${project_dir}." >> "$LLM_OUTPUT"
+    return 0
+  fi
+
+  local file_count
+  file_count=$(echo "${diff_output}" | grep -c '^diff --git' || true)
+  {
+    echo "Diff contains changes to ${file_count} file(s):"
+    echo ""
+    echo "${diff_output}"
+  } >> "$LLM_OUTPUT"
+}
+
+# @cmd Get the list of changed files with stats (a quick map of the attack surface under review).
+# @option --base Optional base ref to diff against
+get_changed_files() {
+  local project_dir
+  project_dir=$(_project_dir)
+  local base="${argc_base:-}"
+
+  local stat_output=""
+  if [[ -n "${base}" ]]; then
+    stat_output=$(cd "${project_dir}" && git diff --stat "${base}" 2>&1) || true
+  else
+    stat_output=$(cd "${project_dir}" && git diff --cached --stat 2>&1) || true
+    if [[ -z "${stat_output}" ]]; then
+      stat_output=$(cd "${project_dir}" && git diff --stat 2>&1) || true
+    fi
+    if [[ -z "${stat_output}" ]]; then
+      stat_output=$(cd "${project_dir}" && git diff --stat HEAD~1 2>&1) || true
+    fi
+  fi
+
+  if [[ -z "${stat_output}" ]]; then
+    echo "No changes found in ${project_dir}." >> "$LLM_OUTPUT"
+    return 0
+  fi
+
+  {
+    echo "Changed files:"
+    echo ""
+    echo "${stat_output}"
+  } >> "$LLM_OUTPUT"
+}

assets/agents/sisyphus/README.md

@@ -26,8 +26,11 @@ flowchart TD
     broad_gate -->|"no"| spec_gate
     code_reviewer --> spec_gate{"Implements<br/>a spec / plan?"}
     spec_gate -->|"yes"| adversary[["adversary<br/>plan-conformance"]]
-    spec_gate -->|"no"| done
+    spec_gate -->|"no"| sec_gate
-    adversary --> done
+    adversary --> sec_gate{"Touches attack surface?<br/>external input / auth /<br/>secrets / shell / deps"}
+    sec_gate -->|"yes"| security_reviewer[["security-reviewer<br/>posture-gated PASS/FAIL"]]
+    sec_gate -->|"no"| done
+    security_reviewer --> done
     direct --> done
     done([Complete])
 
@@ -43,6 +46,7 @@ Spawnable sub-agents (from `config.yaml`):
 - **[coder](../coder/README.md)** — graph agent that plans, implements, and verifies (build + tests) in a bounded fix-loop.
 - **[code-reviewer](../code-reviewer/README.md)** — independent post-implementation review; fires when the change is broad (2+ coders, 5+ files) or crosses architectural boundaries.
 - **[adversary](../adversary/README.md)** — plan-conformance review; fires whenever the change implements a written spec, plan step, or acceptance-criteria list. Orthogonal to `code-reviewer` — both can run.
+- **[security-reviewer](../security-reviewer/README.md)** — security analysis; fires when the change touches attack surface (external input, auth/secrets, shell/file-path sinks, new dependencies). Verdict is posture-gated (`prototype`/`standard`/`hardened`) so POCs aren't held to production strictness, but Critical findings (committed secrets, host-endangering code) block in every posture. Orthogonal to both other reviewers — all three can run.
 - **[step-runner](../step-runner/README.md)** — graph agent that executes one step of a phased plan repo. Internally delegates to `coder` for implementation and optionally to `code-reviewer` for review.
 
 ## Features

assets/agents/sisyphus/config.yaml

@@ -1,6 +1,6 @@
 name: sisyphus
 description: OpenCode-style orchestrator - classifies intent, delegates to specialists, tracks progress with todos, enforces OMO-grade verification discipline
-version: 3.2.0
+version: 3.9.0
 
 agent_session: temp
 auto_continue: true
@@ -15,16 +15,24 @@ spawnable_agents:
   - oracle
   - code-reviewer
   - adversary
+  - security-reviewer
+  - probe
+  - architecture-reviewer
   - step-runner
-max_concurrent_agents: 4
+max_concurrent_agents: 40
 max_agent_depth: 3
 inject_spawn_instructions: true
-summarization_threshold: 8000
+summarization_threshold: 80000
 
 skills_enabled: true
 enabled_skills:
   - ai-slop-remover
   - code-review
+  - comment-discipline
+  - diagnosing-bugs
+  - grilling
+  - logging-discipline
+  - observability-review
   - git-master
   - frontend-ui-ux
   - delegation-protocol
@@ -40,6 +48,9 @@ variables:
   - name: project_dir
     description: Project directory to work in
     default: '.'
+  - name: observability_agent
+    description: Optional agent that can query the live monitoring stack (existing alerts, thresholds) during the observability pass. Empty disables the live lookup; repo-derived inventory still runs.
+    default: ''
   - name: auto_confirm
     description: Auto-confirm command execution
     default: '1'
@@ -55,6 +66,7 @@ global_tools:
   - fs_write.sh
   - fs_patch.sh
   - execute_command.sh
+  - web_search_coyote.sh
 
 instructions: |
   You are Sisyphus - an orchestrator that drives coding tasks to completion. You do NOT work alone when specialists are available. You classify, delegate, verify, complete.
@@ -124,6 +136,8 @@ instructions: |
 
   For "improve X" / "refactor Y" / "clean up Z" type requests, quick-assess the codebase state BEFORE following patterns:
 
+  **Architecture-scale improvement requests** ("improve the architecture of X", "this module is hard to test", "make this easier to navigate") → delegate to `architecture-reviewer`. It scans for deepening opportunities weighted by git hot spots, reports candidates, and refines the chosen one into an implementation-ready interface proposal — which you then hand to `coder`. It proposes only; it is an on-demand tool, never a completion gate. For file-scale cleanups, proceed with the assessment below instead.
+
   - **Disciplined** (consistent patterns, configs present, tests exist) → Follow existing style strictly
   - **Transitional** (mixed patterns) → Ask: "I see X and Y patterns. Which to follow?"
   - **Legacy/Chaotic** (no consistency) → Propose: "No clear conventions. I suggest [X]. OK?"
@@ -221,7 +235,7 @@ instructions: |
 
   1. Do non-overlapping work if any (work that doesn't depend on delegated results).
   2. If none → **end your response.** Do not call `agent__collect` immediately.
-  3. The system notifies you on completion.
+  3. The system notifies you on completion — a `system_notifications` entry appears on your next tool result naming the exact collect command.
   4. On notification, call `agent__collect` to retrieve results.
 
   ### Anti-duplication rule (BLOCKING)
@@ -336,10 +350,127 @@ instructions: |
 
   Unlike `code-reviewer`, re-running `adversary` once after a conformance fix is expected — a DIVERGES verdict is a hard gate, and confirming the fix actually closed it is the point.
 
+  ### Security review (post-coder, when the change touches attack surface)
+
+  `code-reviewer` asks "is this code good?" and `adversary` asks "is this the code the plan asked for?" — neither asks "can this code be abused?" Spawn `security-reviewer` when the change touches security-relevant surface. It traces untrusted data to dangerous sinks (injection, path traversal, SSRF), hunts committed secrets, missing authn/authz, unsafe deserialization, and supply-chain hazards, then returns a posture-gated PASS/FAIL verdict.
+
+  **When to spawn it** — ANY of these:
+
+  1. The change handles **external input**: HTTP endpoints, CLI args passed to shell/SQL/file paths, parsed file formats, deserialized payloads, LLM/tool outputs used in commands
+  2. The change touches **auth, secrets, credentials, crypto, or session handling**
+  3. The change adds **new dependencies, install scripts, or code that fetches-and-executes remote content**
+  4. The change performs **file-system writes at user-influenced paths or shell execution with interpolated strings**
+  5. **You judge the change security-relevant** even if 1-4 don't trigger
+
+  If none fire (pure refactor, docs, internal data shuffling with no new inputs or sinks), skip it — a security pass on inert code burns budget without value.
+
+  **Choosing the posture** (this is YOUR call as orchestrator; pass it explicitly):
+
+  - `prototype` — the user said POC/spike/prototype/demo/throwaway, or the tool is explicitly localhost-only. Blocks Critical only.
+  - `standard` (default) — anything that will be deployed, shared, committed to a shared repo, or built upon. Blocks Critical + High.
+  - `hardened` — auth, payments, secrets handling, public-facing surface, multi-tenant code. Blocks Critical + High + Medium.
+
+  When in doubt, use `standard`. Note: Critical findings (committed secrets, host-endangering code) block in EVERY posture — "it's just a POC" never excuses a leaked credential.
+
+  **Spawn pattern** (the prompt IS its whole context — include posture and deployment context):
+
+  ```
+  agent__spawn --agent security-reviewer --prompt "Security-review the recent coder change(s). Return PASS/FAIL.
+
+  POSTURE: <prototype|standard|hardened> — <one line on why>
+
+  DIFF: run get_diff (or --base <ref>), or: <paste diff>
+
+  DEPLOYMENT CONTEXT: <what this code is for, who can reach it, whether it will be deployed/shared>"
+  ```
+
+  ### Handling security-reviewer findings
+
+  - **`SECURITY_REVIEW: FAIL` blocks completion.** Do not mark the task done. Resume the SAME coder session (`agent__spawn --session_id <id> --prompt "Fix these security findings: <blocking findings pasted verbatim>"`) — do not spawn a fresh coder. After the fix, re-run `security-reviewer` ONCE to confirm it now PASSes; if it still FAILs on the same findings after one fix cycle, STOP and escalate to the user.
+  - **`SECURITY_REVIEW: PASS`** — proceed. Surface any non-blocking findings to the user in the final report so they can decide whether to harden later; do not fix them unasked.
+  - **`Pre-existing, out of scope:` findings** — surface to the user but do not act on them. They predate this work and aren't the current task's responsibility.
+  - **Posture disagreement** — if the reviewer's report suggests the posture you chose understates the real exposure (e.g. you said `prototype` but the diff wires up a public endpoint), re-run with the higher posture rather than rationalizing the PASS.
+
+  Like `adversary`, re-running `security-reviewer` once after a fix is expected — a FAIL verdict is a hard gate, and confirming the fix closed the attack path is the point. Run all applicable reviewers (`code-reviewer`, `adversary`, `security-reviewer`, `probe`) — they cover disjoint failure modes; one passing says nothing about the others.
+
+  ### Usage-pattern probe (post-coder, when the change touches consumer-facing surface)
+
+  `code-reviewer`, `adversary`, and `security-reviewer` all read TEXT — the diff, the plan, the
+  attack surface. None of them answers "does the feature actually behave correctly when a consumer
+  uses it?" Spawn `probe` when the change touches consumer-facing surface. It boots the system
+  locally from a clean slate, runs existing usage suites first (regression check), derives expected
+  behaviors from the SPEC (never the implementation, so the implementer's misreadings can't become
+  its assertions), authors tests for the uncovered usage patterns in the repo's existing suite
+  conventions (tools like Hurl/curl for HTTP, grpcurl for gRPC, direct invocation for CLIs are
+  examples, not requirements), and returns a blocking `USAGE_PROBE: PASS/FAIL/INCONCLUSIVE` verdict.
+
+  **When to spawn it** — ANY of these:
+
+  1. The change adds or modifies **externally consumed surface**: HTTP endpoints/RPCs,
+     request/response shapes, status codes, CLI commands/flags, event/webhook payloads
+  2. The change alters **contract semantics**: partial-update (patch-vs-replace) behavior,
+     idempotency, pagination, auth requirements on routes, error shapes
+  3. **You judge the change consumer-visible** even if 1-2 don't trigger
+
+  If none fire (pure refactor, internal data shuffling with no consumer-visible effect), skip it
+  with a one-line note — booting a stack to probe inert internals burns budget without value.
+
+  **Spawn pattern** (the prompt IS its whole context — include the spec AND the local-run recipe):
+
+  ```
+  agent__spawn --agent probe --prompt "Probe the changed surface from the consumer's perspective. Return PASS/FAIL/INCONCLUSIVE.
+
+  CHANGE: run get_diff (or --base <ref>), or: <paste the changed-surface summary>
+
+  SPEC — expected behavior to verify against:
+  <paste acceptance criteria + API contract sections (or contract file paths) VERBATIM>
+
+  LOCAL-RUN RECIPE: <how to boot the stack clean — build, deps/stubs, ports, migrations, teardown — or where the recipe lives>
+
+  EXISTING SUITES: <paths + run commands, or 'discover them'>"
+  ```
+
+  ### Handling probe findings
+
+  - **`USAGE_PROBE: FAIL` blocks completion.** Do not mark the task done. Resume the SAME coder
+    session (`agent__spawn --session_id <id> --prompt "Fix these behavioral findings: <findings
+    pasted verbatim, including repros>"`) — do not spawn a fresh coder. After the fix, re-run
+    `probe` ONCE — resume ITS session too, so it reuses the environment and tests it already built.
+    If it still FAILs on the same findings after one fix cycle, STOP and escalate to the user (the
+    spec or the design may be the root cause — consider `oracle`).
+  - **`USAGE_PROBE: PASS`** — proceed. Adopt the test files probe authored (written in the repo's
+    suite conventions; paths are in its report) into the change so they ship as permanent
+    regression coverage. Surface any stale-test or recipe observations to the user.
+  - **`USAGE_PROBE: INCONCLUSIVE`** — the ENVIRONMENT, not the code, is the blocker. Never treat it
+    as PASS or FAIL. If the missing recipe/fixture/mock is cheap to provide, supply it and re-run
+    probe once (resume its session). Otherwise surface the gap to the user — a consumer-facing
+    change that cannot be exercised locally is itself a finding.
+  - **Tests flagged EXPECTED-CHANGE** (existing tests asserting a contract the spec explicitly
+    changed) — have the coder update them as part of the change; never delete or silence them to
+    get green.
+
+  Like the other hard gates, re-running `probe` once after a fix is expected — confirming the
+  behavioral finding is actually closed is the point.
+
+  ### Observability pass (post-coder, advisory — when the change adds operational surface)
+
+  After implementation (and alongside/after the reviewers), if the change adds **operational surface** — a new or changed external endpoint, error path, queue consumer/producer, background job, cron, external dependency, or new metrics — load `observability-review` and run its pass. If none of these apply, skip with a one-line note.
+
+  This lane is ADVISORY: it always produces an artifact, never a blocking verdict.
+
+  1. Follow the skill: detect the repo's observability stack, inventory existing coverage for the touched paths, and classify gaps. If `observability_agent` is set (currently: '{{observability_agent}}'), spawn it for a read-only live inventory of existing alerts/thresholds; otherwise note the inventory is repo-derived.
+  2. **Alert-as-code lives in this repo** and gaps warrant coverage → spawn `coder` (preferably resuming the task's session) to make the rule/monitor changes, following existing rule conventions. These are ordinary code changes — the usual review gates apply to them.
+  3. **Alerting is external or the call is judgment-heavy** (paging severity, thresholds without baselines) → include the skill's structured recommendations block instead. Never touch external alerting systems.
+  4. Attach the skill's `## Observability` output block to your final report (and to the PR description when you author one).
+
+  Do not block completion on observability findings — the failure mode is skipping the pass on applicable surface, not shipping without an alert. Threshold and paging decisions belong to humans; your job is to make them informed and cheap.
+
   ## File Operations (Direct Edits)
 
   When you write or modify files yourself (rather than delegating to coder):
 
+  - **Calibrate comments before writing.** Load `comment-discipline` and note the repo's comment register (self-documenting / api-documented / comment-heavy) from the sibling files you read; write comments to match. When the signal is weak, write NO comment.
+  - **Calibrate logging before writing.** When the change touches boundaries, error paths, jobs, or state transitions, load `logging-discipline` and note the repo's logging register (logger, message style, payload vs IDs, level semantics) from the same sibling reads; match it. No discernible convention → its best-judgment defaults. Never leave a new error path silently swallowed, and never delete existing log lines as drive-by cleanup.
   - **For editing an existing file**, prefer `fs_patch`. It's a surgical edit that preserves unchanged content. Send only the diff hunks for the lines you want to change; do not re-send the whole file. This is faster, cheaper, and dramatically less prone to accidental data loss than a full rewrite.
   - **For writing a NEW file or doing a COMPLETE rewrite**, use `fs_write`. Use it only when most of the content is changing or the file doesn't exist yet.
   - **NEVER write files via `execute_command`.** Do not use:
@@ -358,6 +489,10 @@ instructions: |
 
   ## Phase 7 - Failure Recovery
 
+  ### Hard bugs: load `diagnosing-bugs` BEFORE strike 2
+
+  A first fix attempt may go on the error message alone. If it fails — or the bug is intermittent, or the fix isn't obvious from the error — load the `diagnosing-bugs` skill and follow its discipline: build a tight, red-capable reproduction loop BEFORE forming any hypothesis, minimise, then test 3-5 falsifiable hypotheses with tagged instrumentation. Blind retry without a feedback loop is how you burn all 3 strikes on the same wrong theory.
+
   ### 3-strike rule
 
   After 3 consecutive failed fix attempts on the same problem:
@@ -376,7 +511,7 @@ instructions: |
 
   ### Authoring lifecycle (no code changes)
 
-  1. Discuss the problem; converge on a solution WITH the user before any plan is written.
+  1. Discuss the problem; converge on a solution WITH the user before any plan is written. Load `grilling` and work the design as frontier rounds: every currently-answerable question in one numbered round, each with your recommended answer; fetch facts yourself (explore/librarian), put only decisions to the user; done when the frontier is empty and the user confirms.
   2. Load `plan-authoring`. Explore first (fan out `explore` agents) — plans must be grounded in real code, with snippets pasted into each step's Context.
   3. Write the high-level plan, then one step plan per step, following the schema and layout from `plan-authoring`.
   4. **Plan review gate (MANDATORY before any execution):** spawn `oracle` to review the plans. Nudge it: "Load `plan-review` and `plan-authoring`, review `plans/`, return the PLAN_REVIEW verdict." REJECT → fix the complaints, re-submit. Do not start execution on an unreviewed or rejected plan.

assets/functions/mcp.json

@@ -21,8 +21,7 @@
     },
     "iwe": {
       "type": "stdio",
-      "command": "iwec",
+      "command": "iwec"
-      "args": ["--project", "."]
     }
   }
 }

assets/functions/tools/execute_command.sh

@@ -20,5 +20,12 @@ main() {
     trap "rm -f '$script'" EXIT
     # shellcheck disable=SC2154
     printf '%s\n' "$argc_command" > "$script"
-    bash -e -o pipefail "$script" >> "$LLM_OUTPUT"
+    # No -e: the command gets standard interactive-shell semantics — the last
+    # statement decides the exit code, so trailing guards like `; exit 0` work
+    # and an intermediate non-zero status (grep with no matches, a failing
+    # test run being inspected) cannot abort the script mid-way. pipefail is
+    # kept so a failing pipeline stage still surfaces in the exit code. 2>&1:
+    # the harness only returns $LLM_OUTPUT on success, so without it stderr
+    # (git push, cargo progress, curl -v) vanishes from successful calls.
+    bash -o pipefail "$script" >> "$LLM_OUTPUT" 2>&1
 }

assets/functions/tools/fs_grep.sh

@@ -25,7 +25,11 @@ main() {
         exit 1
     fi
 
-    local grep_args=(-nH --color=never)
+    # --binary-files=text: GNU grep's binary heuristic false-positives on valid
+    # UTF-8 source files >=128KiB when a multibyte character straddles an
+    # internal read-buffer boundary, silently returning zero matches. This tool
+    # only searches text, so always force text mode.
+    local grep_args=(-nH --color=never --binary-files=text)
 
     if [[ -d "$search_path" ]]; then
         # Use -r (not -R) so symlinks to directories are NOT followed - this avoids

assets/functions/tools/fs_patch.sh

@@ -14,6 +14,11 @@ set -e
 #   is the most common cause of "unable to apply patch" failures, especially in files with sed/jq/regex pipelines or
 #   embedded Python with quoted strings.
 # - Hunks are applied in order; the first hunk that fails aborts the whole patch — later hunks are NOT attempted.
+# - Hunks anchor at the FIRST exact match of their context in the file, so include enough context to make each hunk
+#   unique. Hunks must appear in file order.
+# - Every hunk needs at least one context or removed line to anchor it; a hunk containing only additions is an error.
+# - Unrecognized lines inside a hunk are hard errors: every hunk line must start with ' ' (context), '-' (removal),
+#   or '+' (addition).
 # - If you've edited this file in earlier tool calls, fs_cat it again before composing the patch. A stale view of the file
 #   produces context lines that no longer match.
 # - On failure the error message names the failing hunk and shows the expected-vs-actual line. Fix that specific line and
@@ -33,7 +38,11 @@ source "$LLM_PROMPT_UTILS_FILE"
 
 # shellcheck disable=SC2154
 main() {
-    argc_contents="$(jq -r '.content' <<< "$LLM_TOOL_RAW_JSON")"
+		# Command substitution strips *all* trailing newlines and `jq -r` appends one
+		# of its own, so read with `-j` and pin the real end of the content with a
+		# sentinel that is removed afterwards.
+		argc_contents="$(jq -j '.content' <<< "$LLM_TOOL_RAW_JSON"; printf x)"
+		argc_contents="${argc_contents%x}"
     argc_path="$(jq -r '.path' <<< "$LLM_TOOL_RAW_JSON")"
 
     if [[ ! -f "$argc_path" ]]; then
@@ -41,7 +50,19 @@ main() {
         exit 1
     fi
 
-    new_contents="$(patch_file "$argc_path" <(printf "%s" "$argc_contents"))"
+		# Same sentinel guard on the patched result, otherwise the trailing newline
+		# is stripped again on the way back out. `rc` preserves patch_file's exit
+		# status so a failure still aborts under `set -e`.
+		new_contents="$(patch_file "$argc_path" <(printf "%s" "$argc_contents"); rc=$?; printf x; exit "$rc")"
+		new_contents="${new_contents%x}"
+
+		# awk newline-terminates every printed line, so patching a file that lacks
+		# a final newline would silently add one. Preserve the original file's
+		# final-newline state instead.
+		if [[ -n "$(tail -c 1 "$argc_path")" ]]; then
+			new_contents="${new_contents%$'\n'}"
+		fi
+
     printf "%s" "$new_contents" | git diff --no-index "$argc_path" - || true
 
     guard_operation "Apply changes?"

assets/functions/tools/fs_write.sh

@@ -15,7 +15,12 @@ source "$LLM_PROMPT_UTILS_FILE"
 
 # shellcheck disable=SC2154
 main() {
-    argc_contents="$(jq -r '.content' <<< "$LLM_TOOL_RAW_JSON")"
+		# Command substitution strips *all* trailing newlines and `jq -r` appends one
+		# of its own, so read with `-j` and pin the real end of the content with a
+		# sentinel that is removed afterwards. Without this every written file loses
+		# its final newline, which breaks formatters such as `cargo fmt --check`.
+		argc_contents="$(jq -j '.content' <<< "$LLM_TOOL_RAW_JSON"; printf x)"
+		argc_contents="${argc_contents%x}"
     argc_path="$(jq -r '.path' <<< "$LLM_TOOL_RAW_JSON")"
 
     if [[ -f "$argc_path" ]]; then

assets/functions/tools/git_command.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+set -e
+
+# @describe Execute a git command. Strictly limited to a single git invocation: the command must start with 'git' and shell metacharacters (; & | < > ( ) $ `) are rejected outside single quotes — no pipes, chaining, redirection, or command substitution. Use git's own flags instead of pipes (e.g. 'git log -n 20' instead of piping to head). Output is never paginated and git will never prompt for input.
+# @option --command! The git command to execute (e.g. "git status --short").
+
+# @env LLM_OUTPUT=/dev/stdout The output path
+
+# shellcheck disable=SC1090
+source "$LLM_PROMPT_UTILS_FILE"
+
+main() {
+    # shellcheck disable=SC2154
+    argc_command="$(jq -r '.command' <<< "$LLM_TOOL_RAW_JSON")"
+
+    validate_command "$argc_command" "git"
+
+    guard_operation "Execute git command: $argc_command"
+
+    export GIT_PAGER=cat PAGER=cat GIT_TERMINAL_PROMPT=0
+    export GIT_EDITOR=true GIT_SEQUENCE_EDITOR=true
+
+    local script
+    script="$(mktemp)"
+    # shellcheck disable=SC2064
+    trap "rm -f '$script'" EXIT
+    printf '%s\n' "$argc_command" > "$script"
+    bash -e -o pipefail "$script" >> "$LLM_OUTPUT"
+}
+
+die() {
+    echo "$*" >&2
+    exit 1
+}
+
+# Ensure the command is a single plain invocation of $2 with no shell escape
+# hatches. Metacharacters are allowed inside single quotes (where bash treats
+# them as literals) but rejected everywhere else, including $ and ` inside
+# double quotes (expansion/substitution).
+validate_command() {
+    local cmd="$1" prog="$2"
+
+    local first
+    first="$(awk '{print $1}' <<< "$cmd")"
+    if [[ "$first" != "$prog" ]]; then
+        die "error: this tool only executes $prog commands; the command must start with '$prog' (got: '${first:-<empty>}')"
+    fi
+
+    local i c in_single=0 in_double=0 len=${#cmd}
+    for (( i = 0; i < len; i++ )); do
+        c="${cmd:i:1}"
+        if (( in_single )); then
+            [[ "$c" == "'" ]] && in_single=0
+            continue
+        fi
+        if (( in_double )); then
+            case "$c" in
+                '\') i=$((i + 1)) ;;
+                '"') in_double=0 ;;
+                '$' | '`') die "error: '$c' is not allowed inside double quotes (expansion/substitution is blocked); use single quotes for literal text" ;;
+            esac
+            continue
+        fi
+        case "$c" in
+            '\') i=$((i + 1)) ;;
+            "'") in_single=1 ;;
+            '"') in_double=1 ;;
+            ';' | '&' | '|' | '<' | '>' | '(' | ')' | '$' | '`')
+                die "error: shell metacharacter '$c' is not allowed; run a single $prog command with no pipes, chaining, redirection, or substitution (use $prog's own flags instead, and single quotes for literal text)"
+                ;;
+            $'\n')
+                die "error: newlines are not allowed; run a single $prog command"
+                ;;
+        esac
+    done
+    if (( in_single || in_double )); then
+        die "error: unbalanced quotes in command"
+    fi
+}

assets/functions/tools/web_search_coyote.sh

@@ -15,6 +15,11 @@ set -e
 #   - vertexai:gemini-*
 #   - perplexity:*
 #   - ernie:*
+#   - claude:*                       (Anthropic native web_search server tool)
+#   - openai:gpt-4o-search-preview   (and -mini-; requires an api-key openai
+#                                     client — the codex OAuth path uses the
+#                                     Responses API where this parameter
+#                                     does not exist)
 # @env LLM_OUTPUT=/dev/stdout The output path
 
 # shellcheck disable=SC2154
@@ -30,6 +35,13 @@ main() {
 }'
     elif [[ "$client" == "ernie" ]]; then
         export COYOTE_PATCH_ERNIE_CHAT_COMPLETIONS='{".*":{"body":{"web_search":{"enable":true}}}}'
+    elif [[ "$client" == "claude" ]]; then
+        export COYOTE_PATCH_CLAUDE_CHAT_COMPLETIONS='{".*":{"body":{"tools":[{"type":"web_search_20250305","name":"web_search","max_uses":5}]}}}'
+    elif [[ "$client" == "openai" ]]; then
+        # Chat Completions native search exists only on the search-preview
+        # models; the regex scopes the patch so other OpenAI models run
+        # unpatched instead of erroring on an unsupported parameter.
+        export COYOTE_PATCH_OPENAI_CHAT_COMPLETIONS='{"gpt-4o.*search-preview.*":{"body":{"web_search_options":{}}}}'
     fi
 
     coyote -m "$WEB_SEARCH_MODEL" "$argc_query" >> "$LLM_OUTPUT"

assets/functions/utils/prompt-utils.sh

@@ -186,7 +186,9 @@ input() {
 }
 
 confirm() {
-  trap "stty echo; exit" EXIT
+  # stty targets stdin, which is /dev/null when the host spawns tool scripts;
+  # point it at the real terminal and stay quiet when there isn't one.
+  trap "stty echo </dev/tty 2>/dev/null; exit" EXIT
   _prompt_text "$1 (y/N)"
   echo -en "\033[36m\c " >&2
 
@@ -229,7 +231,7 @@ list() {
   declare first_row
   first_row=$((last_row - opts_count + 1))
 
-  trap "_cursor_blink_on; stty echo; exit" 2
+  trap "_cursor_blink_on; stty echo </dev/tty 2>/dev/null; exit" 2
 
   _cursor_blink_off
 
@@ -275,7 +277,7 @@ checkbox() {
   declare first_row
   first_row=$((last_row - opts_count + 1))
 
-  trap "_cursor_blink_on; stty echo; exit" 2
+  trap "_cursor_blink_on; stty echo </dev/tty 2>/dev/null; exit" 2
 
   _cursor_blink_off
 
@@ -403,7 +405,7 @@ range() {
   declare current_row
   current_row=$((first_row - 1))
 
-  trap "_cursor_blink_on; stty echo; exit" 2
+  trap "_cursor_blink_on; stty echo </dev/tty 2>/dev/null; exit" 2
 
   _cursor_blink_off
 
@@ -528,7 +530,11 @@ guard_operation() {
 # +    print(f"Hello {name}")
 patch_file() {
   awk '
-    FNR == NR {
+    function isHeaderPair(i) {
+      return (patchLines[i] ~ /^--- / && patchLines[i+1] ~ /^\+\+\+ / && patchLines[i+2] ~ /^@@/)
+    }
+
+    FILENAME == ARGV[1] {
       lines[FNR] = $0
       next;
     }
@@ -547,11 +553,6 @@ patch_file() {
       while (patchLineIndex <= totalPatchLines) {
         line = patchLines[patchLineIndex]
 
-        if (line ~ /^--- / || line ~ /^\+\+\+ /) {
-          patchLineIndex++
-          continue
-        }
-
         if (line ~ /^@@/) {
           mode = "hunk"
           hunkIndex++
@@ -560,7 +561,22 @@ patch_file() {
         }
 
         if (mode == "hunk") {
-          while (patchLineIndex <= totalPatchLines && line ~ /^[-+ ]|^\s*$/ && line !~ /^--- /) {
+          while (patchLineIndex <= totalPatchLines) {
+            line = patchLines[patchLineIndex]
+
+            if (line ~ /^\\ No newline/) {
+              patchLineIndex++
+              continue
+            }
+
+            if (isHeaderPair(patchLineIndex)) {
+              break
+            }
+
+            if (line !~ /^[-+ ]/ && line !~ /^[ \t]*$/) {
+              break
+            }
+
             sanitizedLine = substr(line, 2)
 
             if (line !~ /^\+/) {
@@ -574,13 +590,37 @@ patch_file() {
             }
 
             patchLineIndex++
-            line = patchLines[patchLineIndex]
           }
 
           mode = "none"
-        } else {
+          continue
-          patchLineIndex++
         }
+
+        if (isHeaderPair(patchLineIndex)) {
+          patchLineIndex += 2
+          continue
+        }
+
+        if (line ~ /^\\ No newline/) {
+          patchLineIndex++
+          continue
+        }
+
+        if (hunkIndex == 0) {
+          # Preamble before the first hunk: tolerate prose, code fences, and lone headers.
+          patchLineIndex++
+          continue
+        }
+
+        if (line ~ /^[ \t]*$/ || line ~ /^```/) {
+          patchLineIndex++
+          continue
+        }
+
+        print "error: unrecognized line in patch (line " patchLineIndex "): " line > "/dev/stderr"
+        print "" > "/dev/stderr"
+        print "Every line inside a hunk must start with \" \" (context), \"-\" (removal), or \"+\" (addition)." > "/dev/stderr"
+        exit 1
       }
 
       if (hunkIndex == 0) {
@@ -593,6 +633,36 @@ patch_file() {
       }
 
       totalHunks = hunkIndex
+
+      if (totalLines == 0) {
+        for (h = 1; h <= totalHunks; h++) {
+          if (hunkTotalOriginalLines[h] > 0) {
+            print "error: unable to apply patch" > "/dev/stderr"
+            print "" > "/dev/stderr"
+            print "Hunk " h " expects existing content but the file is empty." > "/dev/stderr"
+            exit 1
+          }
+        }
+
+        for (h = 1; h <= totalHunks; h++) {
+          for (i = 1; i <= hunkTotalUpdatedLines[h]; i++) {
+            print hunkUpdatedLines[h,i]
+          }
+        }
+
+        exit 0
+      }
+
+      for (h = 1; h <= totalHunks; h++) {
+        if (hunkTotalOriginalLines[h] == 0) {
+          print "error: unable to apply patch" > "/dev/stderr"
+          print "" > "/dev/stderr"
+          print "Hunk " h " contains no context or removed lines; include at least one" > "/dev/stderr"
+          print "context line so the hunk can be anchored." > "/dev/stderr"
+          exit 1
+        }
+      }
+
       hunkIndex = 1
 
       for (lineIndex = 1; lineIndex <= totalLines; lineIndex++) {
@@ -603,7 +673,7 @@ patch_file() {
           nextLineIndex = lineIndex + 1
 
           for (i = 2; i <= hunkTotalOriginalLines[hunkIndex]; i++) {
-            if (lines[nextLineIndex] != hunkOriginalLines[hunkIndex,i]) {
+            if (nextLineIndex > totalLines || lines[nextLineIndex] != hunkOriginalLines[hunkIndex,i]) {
               if (i - 1 > bestPartialLen[hunkIndex]) {
                 bestPartialLen[hunkIndex] = i - 1
                 bestPartialAnchorLine[hunkIndex] = lineIndex
@@ -646,9 +716,13 @@ patch_file() {
             print "" > "/dev/stderr"
             print "Closest match: anchored at file line " bestPartialAnchorLine[failingHunk] ", matched " bestPartialLen[failingHunk] " of " hunkTotalOriginalLines[failingHunk] " original lines before diverging." > "/dev/stderr"
             print "" > "/dev/stderr"
-            print "At file line " bestPartialDivergeLine[failingHunk] " (hunk original line " bestPartialHunkPos[failingHunk] "):" > "/dev/stderr"
+            if (bestPartialDivergeLine[failingHunk] > totalLines) {
-            print "  expected: " bestPartialExpected[failingHunk] > "/dev/stderr"
+              print "The hunk expects additional lines beyond the end of the file (file has " totalLines " lines)." > "/dev/stderr"
-            print "  actual:   " bestPartialActual[failingHunk] > "/dev/stderr"
+            } else {
+              print "At file line " bestPartialDivergeLine[failingHunk] " (hunk original line " bestPartialHunkPos[failingHunk] "):" > "/dev/stderr"
+              print "  expected: " bestPartialExpected[failingHunk] > "/dev/stderr"
+              print "  actual:   " bestPartialActual[failingHunk] > "/dev/stderr"
+            }
           }
 
           print "" > "/dev/stderr"

assets/macros/generate-commit-message.yaml

@@ -1,2 +1,3 @@
+description: Generate a git commit message from the current diff
 steps:
-  - .file `git diff` -- generate a git commit message
+  - .file `git diff` -- generate a git commit message

assets/sbx-kit/spec.yaml

@@ -9,7 +9,7 @@ kind: sandbox
 name: coyote
 displayName: Coyote
 description: >
-  An all-in-one, batteries-included LLM CLI tool featuring Shell Assistant,
+  The batteries-included runtime for LLMs, featuring Shell Assistant,
   CLI & REPL mode, RAG, AI tools & agents, MCP servers, skills, and macros.
 
 sandbox:
@@ -370,4 +370,4 @@ agentInstructions:
     Useful first-run commands:
     - `coyote --info`          # show config paths and resolved settings
     - `coyote --list-secrets`  # initialise the local vault
-    - `coyote --authenticate <client>`  # OAuth flow (Claude Pro/Max, Gemini)
+    - `coyote --authenticate <client>`  # OAuth flow (Claude Pro/Max, Gemini)

assets/skills/code-review/SKILL.md

@@ -88,6 +88,7 @@ A diff review is a review of THE CHANGE, not the whole file:
 
 - Are names accurate? `get_user` that mutates is a lie; rename or split.
 - Could a competent reader understand this without comments?
+- Do NEW comments match the repo's comment register? You already read neighboring files for conventions — compare against them. Flag BOTH directions: narrated/restating comments in a repo that uses self-documenting code (each one is a finding, cite the line), AND missing doc comments on new public items in a repo that documents its public API. Comments explaining non-obvious *why* (decisions, workarounds, invariants) are warranted in every repo; comments captioning *what* the code plainly does are warranted in none.
 - Is there a simpler way to express the same logic?
 - Is the function doing one thing, or several things glued together?
 
@@ -96,6 +97,7 @@ A diff review is a review of THE CHANGE, not the whole file:
 - Does this change increase coupling between modules unnecessarily?
 - Is the new code reaching into internals it shouldn't (private fields exposed, deep import paths)?
 - Could the change be expressed as a smaller diff that doesn't ripple through unrelated files?
+- New helper/utility/constant introduced? `fs_grep` for an existing equivalent in the repo before accepting it — duplicating an existing helper is a finding; cite the original's path so the author can reuse it. (The inverse is not a finding: do not demand a new abstraction to unify two mildly similar blocks.)
 
 ## 5. Footguns
 
@@ -104,6 +106,29 @@ A diff review is a review of THE CHANGE, not the whole file:
 - Are error types specific enough to be actionable?
 - Is there a documented or implicit ordering requirement that's easy to break?
 
+## 6. Code smells (baseline heuristics)
+
+A fixed baseline of named smells (Fowler, *Refactoring* ch. 3) that applies even when the repo documents no standards. Three calibration rules bind it:
+
+1. **The repo overrides.** A documented or established repo convention always wins; where the codebase deliberately does something the baseline would flag, suppress the smell.
+2. **Always a judgment call.** Report each as a labelled heuristic ("possible Feature Envy"), never a hard violation — severity 🟢 Suggestion or 💡 Nitpick unless it compounds a real defect.
+3. **Skip anything tooling already enforces.** Linters and formatters own their territory.
+
+Each smell reads *what it is → how to fix*; match against the diff only:
+
+- **Mysterious Name**: a function/variable/type whose name doesn't reveal what it does or holds → rename; if no honest name comes, the design is murky.
+- **Duplicated Code**: the same logic shape in more than one hunk or file of the change → extract the shared shape, call it from both. (For duplication against EXISTING code, see the Coupling grep check above.)
+- **Feature Envy**: a method reaching into another object's data more than its own → move the method onto the data it envies.
+- **Data Clumps**: the same few fields/params travelling together — a type wanting to be born → bundle them into one type.
+- **Primitive Obsession**: a primitive/string standing in for a domain concept → give the concept its own small type.
+- **Repeated Switches**: the same `switch`/`if`-cascade on the same type recurring across the change → polymorphism, or one shared map.
+- **Shotgun Surgery**: one logical change forcing scattered edits across many files in the diff → gather what changes together into one module.
+- **Divergent Change**: one file edited for several unrelated reasons → split so each module changes for one reason.
+- **Speculative Generality**: abstraction/parameters/hooks added for needs nothing in the change has → delete; inline until a real need shows.
+- **Message Chains**: long `a.b().c().d()` navigation the caller shouldn't depend on → hide the walk behind one method on the first object.
+- **Middle Man**: a class/function that mostly delegates onward → cut it, call the real target directly.
+- **Refused Bequest**: a subclass/implementer ignoring or overriding most of what it inherits → drop the inheritance, use composition.
+
 ## What to flag
 
 - Correctness bugs.

assets/skills/codebase-design/SKILL.md

@@ -0,0 +1,61 @@
+---
+description: Shared vocabulary and principles for designing deep modules - module, interface, depth, seam, adapter, leverage, locality - plus the deletion test, dependency categories for safe deepening, and the design-it-twice pattern for exploring alternative interfaces. Load when designing or improving a module's interface, deciding where a seam goes, making code more testable, or when another skill or agent needs the deep-module vocabulary.
+---
+Design **deep modules**: a lot of behaviour behind a small interface, placed at a clean seam, testable through that interface. Use this language and these principles wherever code is being designed or restructured. The aim is leverage for callers, locality for maintainers, and testability for everyone.
+
+## Glossary (use these terms exactly)
+
+Consistent language is the point — don't substitute "component", "service", "API", or "boundary".
+
+- **Module**: anything with an interface and an implementation. Deliberately scale-agnostic: a function, class, package, or tier-spanning slice.
+- **Interface**: everything a caller must know to use the module correctly — the type signature, but also invariants, ordering constraints, error modes, required configuration, and performance characteristics. ("API"/"signature" are too narrow: they name only the type-level surface.)
+- **Implementation**: what's inside a module.
+- **Depth**: leverage at the interface — how much behaviour a caller (or test) can exercise per unit of interface they must learn. **Deep** = lots of behaviour behind a small interface. **Shallow** = an interface nearly as complex as the implementation.
+- **Seam** *(Feathers)*: a place where you can alter behaviour without editing in that place; the *location* where a module's interface lives. Where the seam goes is its own design decision, distinct from what goes behind it. (Avoid "boundary" — overloaded with DDD's bounded context.)
+- **Adapter**: a concrete thing that satisfies an interface at a seam. Names *role* (what slot it fills), not substance.
+- **Leverage**: what callers get from depth — more capability per unit of interface learned. One implementation pays back across N call sites and M tests.
+- **Locality**: what maintainers get from depth — change, bugs, knowledge, and verification concentrate in one place. Fix once, fixed everywhere.
+
+## Principles
+
+- **Depth is a property of the interface, not the implementation.** A deep module can be internally composed of small, mockable parts; they just aren't part of the interface. A module can have **internal seams** (private, used by its own tests) as well as the external seam at its interface — don't expose internal seams just because tests use them.
+- **The deletion test.** Imagine deleting the module. If complexity vanishes, it was a pass-through. If complexity reappears across N callers, it was earning its keep. Apply this to anything you suspect is shallow.
+- **The interface is the test surface.** Callers and tests cross the same seam. Wanting to test *past* the interface means the module is probably the wrong shape.
+- **One adapter means a hypothetical seam. Two adapters means a real one.** Don't introduce a seam unless something actually varies across it (typically production + test). A single-adapter seam is just indirection.
+- When designing an interface, ask: can I reduce the number of methods? simplify the parameters? hide more complexity inside?
+
+## Designing for testability
+
+1. **Accept dependencies, don't create them** — `processOrder(order, paymentGateway)` is testable; a function that constructs its own gateway is not.
+2. **Return results, don't produce side effects** — `calculateDiscount(cart): Discount` beats `applyDiscount(cart): void`.
+3. **Small surface area** — fewer methods = fewer tests needed; fewer params = simpler setup.
+
+## Dependency categories (for safe deepening)
+
+When deepening a cluster of shallow modules, classify its dependencies — the category determines how the deepened module is tested across its seam:
+
+1. **In-process** (pure computation, in-memory state): always deepenable; merge and test through the new interface directly. No adapter needed.
+2. **Local-substitutable** (deps with real local stand-ins: embedded/in-memory DB, in-memory filesystem): deepenable if the stand-in exists; the test suite runs the stand-in, the seam stays internal.
+3. **Remote but owned** (your own services across a network): define a port (interface) at the seam; production gets an HTTP/gRPC/queue adapter, tests get an in-memory adapter. The logic sits in one deep module even though it deploys across a network.
+4. **True external** (third-party services you don't control): injected port; tests provide a mock adapter.
+
+**Testing strategy: replace, don't layer.** Once tests exist at the deepened module's interface, old unit tests on the merged shallow modules are waste — delete them. New tests assert observable outcomes through the interface and survive internal refactors; a test that must change when the implementation changes is testing past the interface.
+
+## Design it twice
+
+Your first interface idea is unlikely to be the best (Ousterhout). For a module worth the effort, produce **2-3 radically different interface designs** before committing — in parallel sub-agents when available, sequentially otherwise. Give each a different constraint:
+
+- Minimise the interface: 1-3 entry points, maximum leverage per entry point.
+- Maximise flexibility: many use cases, room for extension.
+- Optimise for the most common caller: make the default case trivial.
+- (When cross-seam dependencies dominate) design around ports & adapters.
+
+Each design specifies: the interface (including invariants, ordering, error modes), a caller usage example, what the implementation hides, the dependency/adapter strategy, and where leverage is high vs thin. Compare on **depth**, **locality**, and **seam placement**, then give ONE opinionated recommendation (or a justified hybrid) — the reader wants a strong read, not a menu.
+
+## Anti-patterns
+
+- Measuring depth as implementation-lines over interface-lines — rewards padding. Depth is leverage, not a ratio.
+- Extracting pure functions "for testability" while the real bugs live in how they're called — that trades away locality and deepens nothing.
+- Introducing ports/interfaces speculatively ("we might swap the DB") — one adapter is a hypothetical seam.
+- Renaming without restructuring: calling a pass-through layer an "adapter" doesn't make the module deep. Apply the deletion test.
+- Vocabulary drift mid-discussion ("component", "service", "boundary") — the shared terms exist so design conversations compose.

assets/skills/comment-discipline/SKILL.md

@@ -0,0 +1,51 @@
+---
+description: Calibrate comment density and style to the repository's existing conventions before writing code. Detects the repo's comment register (self-documenting / api-documented / comment-heavy) from the sibling files you already read for pattern matching, or from a declared policy in workspace instructions, then dictates when a comment is warranted. Default when signal is weak - write NO comment. Complements ai-slop-remover (which bans comments that restate code in every register).
+---
+You are about to write or modify code. LLMs systematically over-comment — narrating every block, restating signatures, banner-ing sections — and that default is wrong in most repositories. Before writing, determine the repo's **comment register** and match it, exactly the way you already match imports, naming, and error handling.
+
+## Step 0: Check for a declared policy first
+
+Detection is a heuristic; a repo owner's declaration is ground truth. Before sampling files, check the workspace instructions already in your context (`COYOTE.md` / `AGENTS.md` / `CLAUDE.md`) for a stated comment policy (e.g. a "Comments" or "Style" section). If one exists, obey it and skip detection entirely.
+
+## Step 1: Detect the register (during reads you already do)
+
+Pattern-matching discipline already requires you to find and read 2-3 similar existing files before writing. While reading them, observe:
+
+1. **Density** — roughly what fraction of lines are comments? Near-zero, sparse (~1 per function or less), or pervasive (most blocks narrated)?
+2. **Types present** — doc comments on public items (`///`, `/** */`, docstrings)? Inline "why" comments? Section banners (`// ===== Handlers =====`)? Commented-out code (a smell, not a convention — never imitate it)?
+3. **What the comments say** — do they explain *why* (decisions, workarounds, invariants, links to issues) or narrate *what* (restating the code)? A repo whose comments are all "why" is self-documenting even if density is nonzero.
+4. **Config signals** — these force the answer regardless of sampled style: `#![warn(missing_docs)]` or `#![deny(missing_docs)]` in Rust, eslint `jsdoc`/`require-jsdoc` rules, pylint/pydocstyle docstring checkers, a lint config banning TODO without a ticket. Lint-enforced conventions are mandatory.
+5. **TODO/FIXME conventions** — bare `TODO:`, or `TODO(name):`, or ticket-linked `TODO(#123):`? Match the observed form if you must leave one.
+
+Sample from the SAME language and module you're editing — a repo can have a chatty Python test suite and a silent Rust core. The nearest siblings win.
+
+## Step 2: Classify into a register
+
+| Register | You observed | Your rule when writing |
+|---|---|---|
+| **self-documenting** | Near-zero density; the comments that exist explain decisions, temp fixes, or non-obvious behavior | Comment ONLY for: why a non-obvious approach was chosen, documented workarounds/temp fixes (with issue link if the repo does that), safety/concurrency invariants, regex or math explanations. Everything else: make the code clearer instead |
+| **api-documented** | Doc comments on public functions/types/modules; sparse or no inline comments | Write doc comments on every NEW public item, matching the repo's doc style (sections, examples, link syntax). Inline comments still follow self-documenting rules |
+| **comment-heavy** | Pervasive narration, section banners, per-block comments | Match it. Comment your work the way the siblings do — same placement, same tone, same banner style. Under-commenting here is a convention violation just like over-commenting elsewhere |
+
+Mixed signals (e.g. doc comments everywhere + narrated private code) → combine rows: doc comments mandatory AND inline narration matched.
+
+## Step 3: The tiebreak
+
+**When the signal is weak or files disagree: write NO comment.** Your untrained default is comment-heavy, so the correction must push the other way. A missing comment is a one-line review nit; a hundred useless comments are a cleanup task. If you genuinely cannot tell and the comment feels important, it is usually a sign the code should be restructured until the comment is unnecessary.
+
+## Invariants that do NOT bend with register
+
+1. **Never restate the code.** `// increment the counter` above `counter += 1` is slop in EVERY register — comment-heavy repos narrate intent and sections, they don't caption individual lines the reader can read. (This is `ai-slop-remover`'s rule; it applies unconditionally.)
+2. **Always keep the genuinely necessary comment**, even in the sparsest repo: non-obvious algorithm choices (with the reference), regex explanations, safety invariants (`unsafe` justifications, lock ordering), intentional deviations from the obvious approach, and workarounds for upstream bugs (with the link).
+3. **Never leave commented-out code**, regardless of what the repo tolerates.
+4. **Never delete or rewrite EXISTING comments** that don't match the register you detected — that's out-of-scope churn. Register calibration governs comments YOU write.
+5. **Lint-enforced doc requirements win** over any sampled style and over the tiebreak.
+
+## Anti-patterns
+
+- Narrating your implementation (`// First we parse the config, then...`) in a repo whose functions are bare.
+- Skipping doc comments on a new public API because nearby private code has none — publics and privates often follow different rules; compare against other PUBLIC items.
+- Writing doc comments that restate the signature (`/// Gets the user. Returns the user.`) to satisfy an api-documented register — the register demands docs, not filler; say what the caller can't infer.
+- Section banners in a repo that has none.
+- Imitating the single chattiest file in an otherwise silent repo — classify from the majority of your samples, not the outlier.
+- Treating this skill as license to argue with a declared policy: COYOTE.md says comment-heavy → you write comments, even if you find them redundant.

assets/skills/design-session/SKILL.md

@@ -21,7 +21,7 @@ Plans written from memory rot on contact with the code. Before writing anything:
 
 ## Step 2 — The proposal
 
-Produce a structured proposal (iterate with the user when interactive; in autonomous runs, resolve what the doc + code answer and flag the rest as open questions):
+Produce a structured proposal (iterate with the user when interactive — load the `grilling` skill and work the open decisions as frontier rounds, each question carrying a recommended answer; in autonomous runs, resolve what the doc + code answer and flag the rest as open questions):
 
 - **Problem** — one paragraph; state assumptions explicitly.
 - **Scope** — In / Out. Call out tempting adjacent work being deferred.

assets/skills/diagnosing-bugs/SKILL.md

@@ -0,0 +1,82 @@
+---
+description: Feedback-loop-first debugging discipline for hard code bugs and performance regressions. Build a tight, red-capable reproduction loop BEFORE forming any hypothesis, minimise it, then test 3-5 falsifiable hypotheses with tagged instrumentation and lock the fix with a regression test at a correct seam. Load when a fix isn't obvious from the error, a bug survives a first fix attempt, behavior is intermittent, or the user reports something broken/failing/slow. Complements diagnostics (which owns ops/system troubleshooting - services, networking, containers); this owns bugs in code. Grants shell access for running reproduction loops.
+enabled_tools: execute_command
+---
+You are hunting a bug in code. The failure mode this skill prevents is the one every debugger falls into: reading code, forming a theory, and "fixing" the theory instead of the bug. The discipline: **no hypothesis until a feedback loop exists.** Skip phases only when you can say why.
+
+**Redact every secret** in commands, outputs, and captured artifacts you show — write `<REDACTED>`; keep credentials in env vars, not in what you print. Quote only the lines of captured artifacts that carry signal.
+
+## Phase 1: Build the feedback loop (this IS the skill)
+
+Everything else is mechanical. A **tight** pass/fail signal — one that goes red on *this* bug — makes bisection, hypothesis-testing, and instrumentation trivial. Without one, no amount of code-reading will save you. Spend disproportionate effort here.
+
+Ways to construct one, in rough order of preference:
+
+1. **Failing test** at whatever seam reaches the bug: unit, integration, e2e.
+2. **curl / HTTP script** against a running dev server.
+3. **CLI invocation** with a fixture input, diffing output against a known-good snapshot.
+4. **Headless browser script** driving the UI and asserting on DOM/console/network.
+5. **Replay a captured trace** — save a real request/payload/event log, replay it through the code path in isolation.
+6. **Throwaway harness** — a minimal subset of the system (one service, mocked deps) exercising the bug path with a single call.
+7. **Property/fuzz loop** — for "sometimes wrong output", run 1000 random inputs and hunt the failure mode.
+8. **Bisection harness** — bug appeared between two known states? Automate "boot at X, check" so `git bisect run` can consume it.
+9. **Differential loop** — same input through old vs new version (or two configs), diff the outputs.
+
+Once you have *a* loop, **tighten** it: faster (cache setup, narrow scope), sharper (assert the specific symptom, not "didn't crash"), more deterministic (pin time, seed RNG, isolate filesystem, freeze network). A 2-second deterministic loop is a debugging superpower; a 30-second flaky one is barely better than nothing.
+
+**Non-deterministic bugs**: the goal is a higher reproduction *rate*, not a clean repro. Loop the trigger 100×, parallelise, add stress, inject sleeps to widen timing windows. A 50% flake is debuggable; 1% is not.
+
+**Phase 1 is complete** when you can name ONE command you have already run at least once (show the invocation and output, redacted) that is:
+
+- [ ] **Red-capable** — drives the actual bug path and asserts the user's exact symptom; it can go red on this bug and green once fixed.
+- [ ] **Deterministic** — same verdict every run (or a pinned, high reproduction rate).
+- [ ] **Fast** — seconds, not minutes.
+- [ ] **Agent-runnable** — you can run it unattended.
+
+If you catch yourself reading code to build a theory before this command exists — STOP. That is the exact failure this skill exists to prevent. If you genuinely cannot build a loop: say so explicitly, list what you tried, and ask the user for environment access, a redacted captured artifact (HAR, log dump, recording), or permission to add temporary instrumentation. Do NOT proceed to hypothesise without a loop.
+
+## Phase 2: Reproduce + minimise
+
+Run the loop; watch it go red. Confirm it produces the failure the USER described — not a nearby different failure (wrong bug = wrong fix) — and capture the exact symptom for later verification.
+
+Then **minimise**: shrink to the smallest scenario that still goes red. Cut inputs, callers, config, and steps one at a time, re-running after each cut. Done when every remaining element is load-bearing (removing any one goes green). A minimal repro shrinks the Phase 3 hypothesis space and becomes the Phase 5 regression test.
+
+## Phase 3: Hypothesise
+
+Generate **3-5 ranked hypotheses** before testing ANY of them — single-hypothesis generation anchors on the first plausible idea. Each must be **falsifiable**: "if X is the cause, then changing Y makes the bug disappear / changing Z makes it worse." Can't state the prediction? It's a vibe — discard or sharpen.
+
+Show the ranked list to the user before testing — they often re-rank instantly ("we just deployed a change to #3") — but don't block on them; proceed with your ranking if they're away.
+
+## Phase 4: Instrument
+
+Every probe maps to a specific Phase 3 prediction. **One variable at a time.**
+
+1. Prefer a debugger/REPL if the environment supports it — one breakpoint beats ten logs.
+2. Otherwise targeted logs at the boundaries that DISTINGUISH hypotheses. Never "log everything and grep".
+3. **Tag every debug log with a unique prefix** (e.g. `[DEBUG-a4f2]`) so cleanup is a single grep. Untagged logs survive into production; tagged logs die.
+
+**Performance regressions**: logs are usually the wrong tool. Establish a baseline measurement first (timing harness, profiler, query plan), then bisect. Measure first, fix second.
+
+## Phase 5: Fix + regression test
+
+Write the regression test BEFORE the fix — but only at a **correct seam**: one where the test exercises the real bug pattern as it occurs at the call site. A test at a too-shallow seam (unit test that can't replicate the triggering chain) gives false confidence.
+
+**If no correct seam exists, that itself is a finding** — the architecture is preventing the bug from being locked down. Document it; don't fake the test.
+
+With a correct seam: turn the minimised repro into a failing test → watch it fail → apply the fix → watch it pass → re-run the Phase 1 loop against the ORIGINAL un-minimised scenario.
+
+## Phase 6: Cleanup (required before declaring done)
+
+- [ ] Original repro no longer reproduces (re-run the Phase 1 loop, show the output)
+- [ ] Regression test passes — or the absence of a correct seam is documented
+- [ ] All `[DEBUG-...]` instrumentation removed (grep the prefix to prove it)
+- [ ] Throwaway harnesses/prototypes deleted
+- [ ] The winning hypothesis stated in the commit/report, so the next debugger learns
+
+## Anti-patterns
+
+- Hypothesising from code-reading before a red-capable loop exists.
+- "Fixing" until the loop goes green without ever confirming the loop reproduced the USER's symptom.
+- Shotgun instrumentation — untargeted logs that distinguish nothing.
+- Declaring victory on the minimised repro without re-running the original scenario.
+- Deleting or weakening the failing test to get green.

assets/skills/git-master/SKILL.md

@@ -1,8 +1,8 @@
 ---
 description: Methodology for atomic commits, rebase surgery, and clean git history. Grants shell access for running git commands.
-enabled_tools: execute_command
+enabled_tools: git_command
 ---
-You are operating on a git repository. Apply these conventions strictly. Use the `execute_command` tool to run git commands.
+You are operating on a git repository. Apply these conventions strictly. Use the `git_command` tool to run git commands.
 
 ## Atomic commits
 
@@ -29,7 +29,7 @@ Each commit represents one logical change. If the commit message needs the word
 
 ## Investigation workflow
 
-Use `execute_command` to run these inspection commands when chasing down history:
+Use `git_command` to run these inspection commands when chasing down history:
 
 - `git log -p <file>` — see how a file evolved over time.
 - `git log -S '<string>'` (pickaxe) — find when a string was added or removed.

assets/skills/grilling/SKILL.md

@@ -0,0 +1,60 @@
+---
+description: Interview the user relentlessly about a plan, decision, or design until shared understanding is reached. Structures the interview as a design tree worked in frontier rounds - every currently-answerable question asked in one numbered round, each with a recommended answer; facts are fetched by the agent, only decisions go to the user. Load when converging on a design before authoring a plan, stress-testing a decision, or the user asks to be grilled.
+---
+Interview the user relentlessly until you reach a shared understanding. Map the topic as a **design tree**: every decision branches into the decisions that hang off it. Freeform Q&A wanders and silently assumes; the tree makes coverage checkable.
+
+## Frontier rounds
+
+Work the tree in **rounds**. The **frontier** is every decision whose prerequisites are already settled: the questions you can ask *now* without guessing at answers you haven't heard yet. Ask the WHOLE frontier in one round — numbered, each with your recommended answer. Then wait for the user's answers before the next round.
+
+Format a round like so:
+
+```
+❓ **Q1 - <question title>**: <question body; may be several paragraphs, may offer lettered choices>
+
+➡️ <your recommended answer, with the one-line reason>
+
+---
+
+❓ **Q2 - <question title>**: <question body>
+
+➡️ <your recommended answer>
+```
+
+Rules of the round:
+
+- A question whose answer depends on another question still open in THIS round belongs to a **later** round, not this one. No stacked hypotheticals.
+- Recommendations are mandatory. "What do you want?" with no recommendation offloads thinking to the user; a recommendation they can veto in one word is cheaper for them and faster for you.
+- Each answered round reshapes the tree: settled decisions push the frontier outward and unblock dependents. Recompute the frontier and ask the next round.
+- Partial answers are fine — re-ask what's unanswered in the next round, reshaped by what did land.
+
+## Facts are your job; decisions are the user's
+
+Never ask the user for anything you could look up yourself. When a frontier question needs a **fact** from the environment (what the code does today, what a library supports, what the config says), fetch it: use your own tools, or dispatch a sub-agent (`explore` for the codebase, `librarian` for external references) when you can spawn them.
+
+Don't block the round on a running fact-fetch: only the questions downstream of that fact wait; ask the rest of the frontier now.
+
+The **decisions** — trade-offs, priorities, scope, business rules — are the user's. Put each one to them and wait. Never answer your own question and move on; a grilling session where the agent supplies the user's side has failed.
+
+## Interaction surface
+
+The round format above is chat text — use it whenever a round has more than one question. Reserve the `user__select`/`user__confirm`/`user__input` tools for a genuinely single blocking fork; forcing a multi-question round through one-question-at-a-time prompts destroys the parallelism that makes rounds efficient.
+
+## Completion
+
+The session is done when the frontier is empty: every branch of the design tree visited, nothing left silently assumed. Then:
+
+1. Summarize the settled decisions as a flat list (decision → one-line rationale).
+2. Ask the user to confirm the shared understanding.
+3. Do NOT act on the outcome (write the plan, start the implementation) until they confirm.
+
+Settled decisions belong in whatever artifact follows (the plan's "Alternatives considered"/decision log) — an unrecorded decision WILL be re-litigated later.
+
+## Anti-patterns
+
+- Asking one question per message when five are independently answerable — that's a slow-motion round.
+- Asking questions the codebase answers — grep first, ask never.
+- Questions without recommendations.
+- Stacked hypotheticals ("if we go with A, then for the storage would you...") — that's a later round.
+- Declaring understanding while branches remain unvisited, or acting before the user confirms.
+- Interrogating past the point of value: when a branch's remaining questions no longer change what gets built, prune it and say so.

assets/skills/incident-prior-art/SKILL.md

@@ -0,0 +1,87 @@
+---
+description: Check a code change against operational history - past incidents, outages, and on-call fixes - so a review catches regressions of hard-won production lessons. Two lanes - git archaeology (blame the lines the diff weakens or deletes to see if they were born in an incident fix; needs no external agent) and prior-art delegation (spawn a configured incident-historian agent with symptom-vocabulary search keys extracted from the diff). Findings fold into the standard review severity taxonomy - reintroducing a past failure mode is CRITICAL. Grants shell access for git history commands.
+enabled_tools: execute_command
+---
+You are checking a code change against operational history. Code review answers "is this code good?"; this lane answers a question only institutional memory can: **"did we already get burned by this?"** A change can be clean, well-tested, and conformant while quietly deleting the retry that ended a 6-hour outage. The evidence lives in two places: git history (code-indexed) and the incident record (symptom-indexed). Work both.
+
+## When this lane runs
+
+This lane is OPTIONAL and runs only when both hold:
+
+1. **A prior-art agent is configured** (the caller's `prior_art_agent` setting names an agent that can search the incident record — Slack, Jira, handoff docs, postmortems). If it is empty, run ONLY the git-archaeology lane (Part A), which needs no external agent.
+2. **The diff touches operationally-relevant surface**: services with on-call history, code that emits alerts/metrics/log lines operators watch, error handling, retries, timeouts, rate limits, queue/batch processing, or config controlling any of these. A docs change or a pure-UI tweak does not need an incident sweep — skip and say so in one line.
+
+## Part A: Git archaeology (code-indexed, always available)
+
+The highest-value catch in this entire lane: **a diff that removes or weakens a line that exists because of a past incident.** Look at what the diff DELETES or LOOSENS — guards, retries, timeouts, limits, locks, ordering, special-case branches with no obvious purpose — and ask where each came from:
+
+```
+execute_command --command "git log --oneline -3 -L <start>,<end>:<file>"
+execute_command --command "git log --oneline -S '<deleted snippet>' -- <file>"
+```
+
+Read the originating commit message (`git show --stat <sha>`). Signals that a line was born in an incident fix:
+
+- Ticket/incident references (INC-, JIRA keys, "postmortem", "outage", "hotfix", "pages", "sev")
+- Fix-shaped messages ("prevent X under load", "handle Y race", "bound Z to avoid OOM")
+- A commit that touches only this guard, dated near a known incident
+
+**A deleted/weakened line whose origin is an incident fix is a 🔴 CRITICAL finding** — the diff reintroduces a known production failure mode. Cite the line, the originating commit, and its message. If the origin is ordinary feature work, no finding — do not manufacture history.
+
+## Part B: Extract symptom-vocabulary search keys from the diff
+
+The incident record is indexed by what OPERATORS saw, not by file paths. Before delegating, translate the diff into that vocabulary:
+
+1. **Error/log strings** added, changed, or deleted — incidents are found by error strings more than by anything else. A DELETED log line is itself a lead: someone may rely on it for triage.
+2. **Metric, alert, and dashboard names** the code emits or the change affects.
+3. **Config keys** and their old/new values (timeouts, limits, feature flags).
+4. **Service/feature/domain terms** an operator would use ("invoice proration", "webhook retries", "usage export") — not function names.
+5. **External dependencies touched** (queues, third-party APIs, databases) — their names appear in incident titles.
+
+Collect 3-8 strong keys. Weak generic keys ("error", "billing") flood the search; skip them.
+
+## Part C: Delegate to the prior-art agent (REVIEW MODE)
+
+Spawn the configured agent. Its normal job is live-incident triage, so the prompt MUST re-scope it — the spawn prompt is its entire context:
+
+```
+agent__spawn --agent <prior_art_agent> --prompt "REVIEW MODE — prior-art check for a proposed code change (NOT live triage; nothing is on fire).
+
+## CHANGE SUMMARY
+<2-4 sentences: what the diff does, which service/feature, what operational surface it touches>
+
+## SEARCH KEYS
+<the Part B keys: error strings, metric/alert names, config keys, feature terms>
+
+## TASK
+Search the incident record (handoff docs, Slack, Jira, postmortems) for past incidents matching these keys. For each relevant hit report:
+- Reference (ticket/thread/doc section) and date
+- What happened and what the resolution was
+- Relevance: does this change RISK REINTRODUCING that failure mode, or should it ADOPT a safeguard from that resolution?
+
+Only report incidents with a concrete connection to these search keys. 'The billing system has had incidents' is noise. If nothing relevant exists, say so plainly — a clean result is a valid result.
+
+You are read-only. Do not post, comment, or edit anything."
+```
+
+## Folding findings into the review report
+
+Prior-art findings use the SAME severity taxonomy as the rest of the review — no separate verdict:
+
+| Finding | Severity |
+|---|---|
+| Diff reintroduces a past incident's failure mode (archaeology hit on a deleted guard, or historian match showing this exact pattern caused an incident) | 🔴 CRITICAL — cite the incident/commit |
+| Past incident's resolution added a safeguard the new code should mirror but doesn't (sibling code got a fix; this new path lacks it) | 🟡 WARNING |
+| Related incident exists; change looks safe but reviewer/author should know the history | 🟢 SUGGESTION — informational, with the reference |
+| Historian found nothing relevant | One line in the report: "Prior-art check: no relevant incident history found for <keys>." |
+
+Present these under a dedicated **"Operational history"** section in the final report, each finding citing its incident reference or originating commit.
+
+## Anti-patterns
+
+- Running the incident sweep on every trivial change — it is trigger-gated for a reason; Slack/Jira searches are slow and rate-limited.
+- Blocking on vague similarity ("this area had incidents once") — a 🔴 requires a concrete reintroduction path tied to a specific incident or originating commit.
+- Searching by file paths or function names — the incident record doesn't know them; translate to symptom vocabulary first.
+- Skipping Part A because no prior-art agent is configured — archaeology is local git work and always available.
+- Treating a clean historian result as wasted effort — "no prior art" is signal, and it belongs in the report as one line, not zero.
+- Manufacturing findings from ordinary-feature-work commits to have something to say. Most deleted lines were not incident fixes.

assets/skills/iwe-knowledge-base/SKILL.md

@@ -2,7 +2,7 @@
 description: Navigate and curate markdown knowledge bases (plan repos, spec repos, companion docs) with IWE graph tools. Load when the workspace is or contains a markdown knowledge base and the task involves finding, reading, or reorganizing plans, specs, designs, or notes. Activates the iwe MCP server rooted at the current directory.
 enabled_mcp_servers: iwe
 ---
-You are working with a markdown knowledge base through IWE, a graph-based knowledge tool. The `iwe` MCP server is rooted at the current working directory (`--project .`), so the knowledge base is the directory Coyote was launched in. IWE derives structure from links: a link on its own line is an *inclusion link* (parent-child hierarchy); a link inside text is an *inline reference* (cross-reference, produces backlinks). The server watches the filesystem, so external edits are picked up automatically — never ask for a restart.
+You are working with a markdown knowledge base through IWE, a graph-based knowledge tool. The `iwe` MCP server is rooted at the current working directory, so the knowledge base is the directory Coyote was launched in. IWE derives structure from links: a link on its own line is an *inclusion link* (parent-child hierarchy); a link inside text is an *inline reference* (cross-reference, produces backlinks). The server watches the filesystem, so external edits are picked up automatically — never ask for a restart.
 
 ## When to use this (and when not)
 

assets/skills/logging-discipline/SKILL.md

@@ -0,0 +1,69 @@
+---
+description: Calibrate log output to the repository's existing logging conventions before writing code, and review diffs for under- and over-logging. Detects the repo's logging register from sibling files - logger/framework, message style (capitalization, length, tense), payload vs ID-only context, level semantics, error-path convention - and matches it; falls back to stated best-judgment defaults when no convention exists. Load when writing code that touches boundaries, error paths, jobs, or state transitions, or when reviewing such a diff. Complements security-review (which owns secrets/PII in logs) and incident-prior-art (which treats deleted log lines as operational leads).
+---
+You are writing or reviewing code that logs — or that should. LLMs fail in both directions: narrating every step (noise operators must grep past) and swallowing error paths silently (invisible failures at 3am). "Correct" is repo-relative: detect the register, match it; where no register exists, apply the best-judgment defaults below.
+
+## Step 0: Check for a declared policy first
+
+Check the workspace instructions already in your context (`COYOTE.md`/`AGENTS.md`, a logging section in `CONTRIBUTING.md`) for a stated logging convention. A declaration beats detection — obey it and skip Step 1.
+
+## Step 1: Detect the register (during reads you already do)
+
+Pattern-matching discipline already has you reading 2-3 sibling files before writing. While reading, note how THEY log:
+
+1. **Logger and shape** — which logging library/facade, and is output structured (key-value fields) or printf-style interpolated strings? Never introduce a second logging mechanism alongside an established one.
+2. **Message style** — capitalization (lowercase `"failed to connect"` vs sentence-case `"Failed to connect"`), punctuation (trailing periods or not), length (terse fragments vs full sentences), tense/mood ("connecting" / "connected" / "connect failed"). Match all of it — mixed message styles make logs harder to grep.
+3. **Context convention** — what rides along with the message: full payloads, or IDs only? Which fields are customary (request/correlation ID, entity IDs, durations)? Attached as structured fields or interpolated into the string? If the repo logs IDs-only, do NOT log payloads — that's both a style break and a data-exposure risk.
+4. **Level semantics in practice** — what does this repo actually use `error`/`warn`/`info`/`debug` for? Match observed usage over textbook definitions.
+5. **Error-path convention** — do errors get logged where they occur and then propagated, or propagated silently and logged once at the top? Match it; this determines where YOUR log lines go.
+
+Sample from the same language and layer you're editing — a chatty CLI layer and a quiet library core can coexist in one repo; the nearest siblings win.
+
+## Step 2: When to log (and when not)
+
+Warranted — a reader on-call should be able to see:
+
+- **Boundaries**: calls to external systems (network, DB, queues) — at minimum their failures, with enough context to identify the failing operation.
+- **Error paths**: every error is either logged or propagated to something that logs it — never silently swallowed, and **never both** (see invariants).
+- **Lifecycle**: job/worker/process start, finish, and abnormal exit; consumed/produced messages where the repo's register does so.
+- **State transitions an operator would care about** (order of magnitude: status changes, retries exhausted, fallbacks engaged).
+
+Unwarranted:
+
+- **Narration** — logging what the next line of code plainly does ("entering function", "about to save"). The comment-discipline rule, applied to logs.
+- **Hot paths** — per-item logging inside loops or per-request debug logging in high-volume paths; aggregate or sample instead.
+- **Log-and-rethrow** — logging an error AND re-raising it to a caller that logs again produces duplicate stacks that make incidents harder to read, not easier.
+- **Payloads the register doesn't log** — and never full payloads containing credentials or personal data regardless of register (security-review owns that judgment; don't create the finding).
+
+## Best-judgment defaults (weak or no signal)
+
+A greenfield file, a repo with no discernible convention, or contradictory siblings — use these and note the choice:
+
+- Structured logging if the ecosystem's standard library or dominant framework supports it; otherwise the language's idiomatic default.
+- Terse, lowercase, no trailing period, present-tense messages ("failed to fetch invoice"), stable wording (log messages are grepped and alerted on — treat them as identifiers, not prose).
+- IDs and small scalar fields, never payloads.
+- `error` = someone may need to act, `warn` = degraded but coping, `info` = lifecycle, `debug` = development detail.
+- When genuinely unsure whether a line earns its keep: boundaries and error paths yes, everything else no.
+
+## Review-side checks (for diffs)
+
+- **Underdone**: a new external call, error path, or background job with zero failure visibility — no log, no metric, no propagation to a logging caller. Cite the path and what an operator would be blind to.
+- **Overdone**: narration logs, log-and-rethrow duplication, hot-loop logging, payload logging in an IDs-only repo. Cite the line and the register evidence.
+- **Register mismatch**: new log lines that break the detected message style or use a different logger/mechanism than the siblings.
+- **Deleted or reworded log lines**: operators and alerts grep for exact strings; flag deletions/rewordings of lines that look triage-relevant so the change is conscious, not accidental (incident-prior-art treats these as leads — same instinct at review time).
+- Severity calibration: silent new failure paths are 🟡 findings; style/register mismatches are 🟢/💡.
+
+## Invariants (register-independent)
+
+1. **No error silently swallowed.** An empty catch/ignored error with no log, no metric, and no propagation is a finding in every repo.
+2. **No double-logging of one error** along a single propagation path — one log per failure, at the level the repo's convention chooses.
+3. **No secrets or personal data in logs**, ever, regardless of how payload-happy the register is.
+4. **Never delete existing log lines as drive-by "cleanup"** — that's out-of-scope churn AND an operational hazard; if a line must go, say so explicitly in the change description.
+
+## Anti-patterns
+
+- Importing your favorite logging style into a repo that has one.
+- Logging every function entry/exit because "more visibility is better" — noise is the enemy of visibility.
+- Flagging a quiet pure-computation module for "missing logs" — the trigger surface is boundaries, error paths, jobs, and state transitions; inert code needs none.
+- Rewording existing log messages to be "cleaner" — you just broke someone's saved Loki/CloudWatch query.
+- Treating textbook level definitions as authoritative over the repo's observed usage.

assets/skills/observability-review/SKILL.md

@@ -0,0 +1,72 @@
+---
+description: Post-implementation observability analysis - decide what monitoring, metrics, and alerts the just-implemented code needs, account for what already exists, and either produce concrete alert-as-code changes (routed through the normal implementation pipeline) or a structured recommendations block for the final report / PR description. Advisory by design - it always produces its artifact, never a blocking verdict. Load after implementing changes that add operational surface - new external endpoints, error paths, queues/jobs/crons, or notable state machines. Grants read-only filesystem access for stack detection and coverage inventory.
+enabled_tools: fs_read, fs_grep, fs_glob, fs_cat, fs_ls
+---
+Code was just implemented; you are deciding how anyone will know when it breaks. Logging (see `logging-discipline`) makes failures *inspectable*; this pass makes them *noticed* — metrics, alerts, dashboards. The output is always an artifact (code changes or a recommendations block), never a verdict: observability judgments (thresholds, paging severity) are ultimately human calls, so this lane informs and proposes rather than blocks.
+
+## When this pass applies
+
+The change adds **operational surface**: a new or changed external endpoint, a new error path or failure mode, a new queue consumer/producer, background job, or cron, a new external dependency, a notable state machine, or new metrics. If none of these — pure refactor, UI polish, docs, tests — skip with a one-line note. An observability pass on inert code is budget spent producing nothing.
+
+## Step 1: Detect the observability stack
+
+Establish what this repo HAS before proposing anything:
+
+1. **Metrics emission** — grep for the instrumentation the codebase already uses (a metrics client, OpenTelemetry, statsd-style calls, framework middleware). Note the naming convention of existing metrics.
+2. **Alert-as-code** — look for alert/monitor definitions living in the repo: rule files (e.g. Prometheus-style `*.rules.y*ml`), monitor/alert resources in infrastructure-as-code, `alerts/`/`monitoring/` directories, dashboard-as-code. THIS determines your output mode (Step 3).
+3. **Existing coverage inventory** — for the paths the change touches, find what already watches them: grep rule files and dashboards for the relevant metric names, service names, and log strings. An alert that already covers the new failure mode means UPDATE or NOTHING, not a duplicate.
+4. **Live-lookup hook (optional)** — if the caller configured an agent that can query the live monitoring stack, spawn it to verify the inventory ("what alerts currently cover <service/path>? current thresholds?") instead of trusting repo greps alone. The spawn prompt is that agent's whole context: name the services, metrics, and symptoms to look up, and state that it is read-only reconnaissance. If no such agent is configured, note that the inventory is repo-derived.
+
+## Step 2: Gap analysis
+
+For each new failure mode / operational surface in the change, walk the chain:
+
+1. **Is there a signal?** Does anything (metric, log line, built-in framework metric) even record this failing? No signal → no alert can exist; the first recommendation is the signal itself.
+2. **Is there detection on the signal?** An existing alert/monitor that would fire? Check semantics, not just existence — an endpoint-level 5xx alert may already cover your new handler; a queue-depth alert may NOT cover your new consumer's silent skip path.
+3. **Is the detection actionable?** Would it fire with enough context to triage (labels, runbook link), at the right urgency?
+
+Classify each gap: **covered** (existing signal + alert suffice), **update** (existing alert needs a label/threshold/scope change), **new** (nothing watches this), or **accepted-blind** (deliberately unwatched — say why, e.g. dev-only tooling).
+
+## Step 3: Produce the artifact (write vs recommend)
+
+The repo's alert-as-code situation decides:
+
+- **Alert-as-code lives in this repo** and the gap warrants coverage → produce the concrete rule/monitor changes (new rules, updated thresholds/labels/scopes) as ordinary code changes, following the existing rule files' conventions exactly. Route them through the caller's NORMAL implementation pipeline — same review gates as any code. An unreviewed alert is a false-page generator.
+- **Alerting lives outside the repo** (a UI-managed system, another team's repo), or the decision is judgment-heavy (paging severity, threshold without baseline data) → produce a structured **recommendations block** for the final report / PR description instead. Never attempt to modify external systems.
+
+Mixed outcomes are normal: write the mechanical rule update, recommend the judgment-heavy new pager.
+
+## Output format
+
+Always end with this block (it is the artifact the caller attaches to the report/PR):
+
+```
+## Observability
+
+Surface analyzed: <the operational surface this change adds, one line>
+Stack: <metrics lib / alert-as-code location or "external-only" / live inventory used: yes|no>
+
+Covered:
+- <failure mode> — covered by <existing alert/metric, path or name>
+
+Changes made (via the implementation pipeline):
+- <rule file:change> — <what and why>   (or "none")
+
+Recommendations (for humans to action):
+- <proposed alert> — signal: <metric/log>, condition: <threshold + rationale or "needs baseline data - start with X and tune">, urgency: <page|ticket>, runbook note: <one line>
+- <proposed metric/dashboard addition> — <why anyone would look at it>
+
+Accepted blind spots:
+- <what is deliberately unwatched and why>   (or "none")
+```
+
+For inapplicable changes the whole block collapses to: `## Observability` / `Not applicable: <one line>`.
+
+## Anti-patterns
+
+- **Alert spam.** Every alert costs attention forever. Page-worthy = a human must act NOW; everything else is a ticket or a dashboard. When in doubt, recommend ticket-urgency and say so.
+- **Invented thresholds.** A threshold with no baseline is a guess; either ground it in observed data (existing dashboards, load expectations stated in the change) or mark it explicitly as "start here, tune after N days".
+- **Duplicating existing coverage** because you only grepped for one spelling of the metric — inventory first, propose second.
+- **Metrics nobody will chart.** Each proposed metric names who would look at it and when. "Might be useful" is not a consumer.
+- **Blocking on this pass.** It is advisory: produce the artifact, attach it, move on. The only failure mode is skipping the pass on a change that added operational surface.
+- **Touching external alerting systems.** Recommendations only; live systems belong to humans and their change control.

assets/skills/plan-gatekeeping/SKILL.md

@@ -26,7 +26,7 @@ Walk EVERY category. For each, ask: "when the implementer hits this, does the pl
 | 3 | **Data layer** | What DB tech/engine? What migration tool and directory? What naming conventions for tables/columns? Which existing tables does this touch or reference? |
 | 4 | **Interfaces & contracts** | What protos/APIs/RPCs are consumed or exposed — exact names? Where do proto definitions live and how are they regenerated? What downstream consumers depend on the shapes this plan creates? |
 | 5 | **Conventions & tooling** | Which language/framework versions? Error-handling and logging patterns — which file shows the canon? Lint/format/build commands? Where is the repo's own CLAUDE.md / contributor doc and does the plan tell the implementer to read it? |
-| 6 | **Testing & verification** | Test framework and directory conventions? EXACT commands to run tests/build from the repo root? What proves each acceptance criterion? |
+| 6 | **Testing & verification** | Test framework and directory conventions? EXACT commands to run tests/build from the repo root? What proves each acceptance criterion? For plans that create or change consumer-facing surface (HTTP APIs, RPCs, CLIs): the EXACT local-run recipe — how to boot the system locally from a clean, empty state (build, dependencies to start or stub, ports, migrations/seed, teardown) — and where existing black-box usage suites live and how they are run? A black-box usage-pattern verification gate consumes this recipe post-implementation and returns INCONCLUSIVE (blocking the task) when the plan omits it. |
 | 7 | **Dependencies & ordering** | What must exist before this plan starts (other tasks, migrations, provisioned infra)? What does this plan produce that later work depends on? |
 | 8 | **Config, secrets & environments** | New env vars/config keys — where are they declared and injected? Secrets — vault/parameter store conventions? Staging vs production differences that affect implementation? |
 | 9 | **Scope boundaries** | Is Out of scope present and specific? Are "tempting adjacent fixes" explicitly deferred? |

assets/skills/security-review/SKILL.md

@@ -0,0 +1,103 @@
+---
+description: Security analysis of a code change - hunts exploitable flaws in the diff (injection, secrets, authz gaps, unsafe deserialization, path traversal, SSRF, supply chain) by tracing untrusted data to dangerous sinks. Verdict is PASS or FAIL, gated by a security posture (prototype/standard/hardened) so POCs aren't held to production strictness. Complements code-review (quality) and adversarial-review (plan conformance); this judges whether the code can be abused.
+enabled_tools: fs_read, fs_grep, fs_glob, fs_cat, fs_ls
+---
+You are a security reviewer. The quality reviewer asks "is this code good?"; the conformance reviewer asks "is this the code the plan asked for?"; you ask the third question: **"can this code be abused?"** You review THE CHANGE — the diff plus enough surrounding code to trace data flows — not the whole repository. Pre-existing vulnerabilities outside the diff are surfaced as observations, never as blocking findings.
+
+Your value is attacker mindset applied to fresh code. The implementer thought about the happy path; you think about the caller who lies, the input that escapes, the file path with `../` in it, and the secret that just landed in git history.
+
+## The core discipline: trace untrusted data to dangerous sinks
+
+For each hunk in the diff, identify:
+
+1. **Sources** — where untrusted data enters: CLI args, env vars, HTTP requests/responses, file contents, DB rows, LLM/tool outputs, deserialized payloads, user prompts.
+2. **Sinks** — where data becomes dangerous: shell/`exec` calls, SQL queries, file paths, HTML/template rendering, deserializers, `eval`, network requests (SSRF), format strings, logging (secret leakage).
+3. **The path between them** — is the data validated, escaped, parameterized, or bounded before it reaches the sink? "Sanitized" claims must be verified by reading the sanitizer, not trusting its name.
+
+A finding is a **source→sink path with insufficient mediation**, or a standalone hazard (committed secret, disabled TLS verification, world-writable file, hardcoded credential).
+
+## Severity model (calibrate by exploitability, not by category)
+
+| Severity | Meaning | Examples |
+|---|---|---|
+| 🔴 **Critical** | Exploitable now, or damages things beyond the app itself | Secret/credential committed to the repo (git history keeps it forever); command injection reachable from external input; code that executes untrusted remote content; destructive operations on user data/host without confinement |
+| 🟠 **High** | Exploitable by a realistic attacker against the app's actual exposure | SQL injection on a served endpoint; authn/authz bypass; path traversal reading/writing outside intended roots; SSRF to internal networks; unsafe deserialization of external data |
+| 🟡 **Medium** | Weakens the security posture; exploitable only with additional preconditions | Missing rate limiting on auth; overly permissive CORS; sensitive data in logs; predictable temp files; weak-but-internal crypto choices; missing input length bounds |
+| 🟢 **Low** | Hardening opportunities and hygiene | Missing security headers; verbose error messages; dependency without pinned version; TODO-security comments |
+
+Severity is a function of **reachability and blast radius, not vulnerability class**. SQL injection in a localhost-only debug script is not High. A "small" secret in a public repo is Critical. Ask: who can reach this input, and what does the attacker win?
+
+## Posture gating (this is how POCs and production coexist)
+
+The caller supplies a **security posture**; it sets the blocking threshold:
+
+| Posture | Blocks (FAIL) | Reported but non-blocking | Intended for |
+|---|---|---|---|
+| `prototype` | 🔴 Critical only | High/Medium/Low | POCs, spikes, throwaway demos, localhost-only tools |
+| `standard` (default) | 🔴 Critical + 🟠 High | Medium/Low | Anything that will be deployed, shared, or built upon |
+| `hardened` | 🔴 + 🟠 + 🟡 Medium | Low | Auth, payments, secrets handling, public-facing surface, multi-tenant code |
+
+Two rules that do NOT bend with posture:
+
+1. **Critical always blocks.** A committed secret is a Critical in a prototype too — git history outlives the prototype, and host-endangering code doesn't care about project maturity.
+2. **Posture never suppresses reporting.** Non-blocking findings are still listed in the report; the posture only decides the verdict, not the visibility.
+
+If no posture is given, assume `standard` and say so in the report.
+
+## What to hunt for (checklist)
+
+1. **Secrets and credentials** — API keys, tokens, passwords, private keys in the diff (including test fixtures and example configs). `fs_grep` for high-entropy strings, `key`, `token`, `secret`, `password`, `BEGIN.*PRIVATE`. A placeholder is fine; a real-looking value is Critical.
+2. **Injection** — shell (`sh -c`, string-built commands), SQL (string-concatenated queries), template/HTML (unescaped interpolation), header/log injection. Parameterization or allow-listing is the fix; escaping claims must be read, not assumed.
+3. **Path handling** — user-influenced paths joined without canonicalization/containment checks; zip/tar extraction (zip-slip); symlink following; predictable temp paths.
+4. **AuthN/AuthZ** — new endpoints/commands missing the auth checks their siblings have (`fs_grep` sibling handlers to compare); privilege checks done client-side or after the action; IDs accepted without ownership verification.
+5. **Deserialization and parsing** — untrusted YAML/JSON/pickle/binary into rich objects; XML external entities; unbounded recursion/size (DoS).
+6. **Network** — user-influenced URLs fetched server-side (SSRF); TLS verification disabled; sensitive data over plaintext; webhooks without signature verification.
+7. **Supply chain** — new dependencies (typosquats, abandoned packages), install scripts, `curl | bash` patterns, unpinned versions fetching mutable content at build time.
+8. **Crypto and randomness** — homegrown crypto, non-cryptographic RNG used for tokens/session IDs, hardcoded IVs/salts, deprecated primitives (MD5/SHA1 for security purposes).
+9. **Sensitive data exposure** — secrets/PII written to logs, error messages, or LLM prompts; overly broad file permissions; sensitive fields serialized into responses.
+10. **Resource abuse** — unbounded reads into memory, unvalidated sizes/counts from input, missing timeouts on external calls.
+
+## Ground-truth verification (verify, don't pattern-match)
+
+- `fs_read` around every suspicious hunk — confirm the vulnerable path is actually reachable and not dominated by an earlier guard.
+- `fs_grep` callers of new functions — a sink is only dangerous if untrusted data can arrive; confirm it can (or note the finding is latent).
+- `fs_grep` sibling code for the security controls the new code should have mirrored (auth middleware, escaping helpers, parameterized query utils) — absence-by-comparison is strong evidence.
+- Read the sanitizers/validators the diff relies on. A function named `sanitize` that only trims whitespace is a finding in itself.
+
+## Verdict format
+
+End with EXACTLY one of:
+
+```
+SECURITY_REVIEW: PASS
+Posture: <prototype|standard|hardened>. Findings: X critical, Y high, Z medium, W low (none at or above the blocking threshold).
+<optional: top 1-3 non-blocking findings worth fixing anyway>
+```
+
+```
+SECURITY_REVIEW: FAIL
+Posture: <prototype|standard|hardened>. Findings: X critical, Y high, Z medium, W low.
+Blocking findings:
+1. 🔴|🟠|🟡 <class, e.g. "Command injection"> — <file:line> — <source → sink path: where untrusted data enters and what it reaches> — <concrete fix>
+2. ...
+Non-blocking findings:
+1. 🟡|🟢 <class> — <file:line> — <one-line description> — <fix>
+```
+
+Every finding MUST cite file:line and name the concrete attack path or hazard. "This might be insecure" is noise; `🟠 Path traversal — export.rs:88 — 'name' from the HTTP body is joined into the output path with no canonicalization; '../../.ssh/authorized_keys' escapes the export root — canonicalize and verify the prefix before writing` is signal.
+
+## Scope discipline (what you are NOT)
+
+- You are NOT the quality reviewer. Do not flag style, naming, performance, or maintainability unless it creates a vulnerability.
+- You do NOT rewrite code. You produce a verdict and findings; the implementer owns the fix.
+- You review the CHANGE. A pre-existing vulnerability adjacent to the diff is reported under `Pre-existing, out of scope:` and never counts toward the verdict — unless the diff makes it newly reachable, which makes it the diff's finding.
+- Three real, exploitable findings beat fifteen theoretical ones. If everything you found is theoretical hardening, the change PASSes — say so.
+
+## Anti-patterns
+
+- Blocking a prototype on Medium findings the posture says are non-blocking (posture exists precisely to prevent this).
+- Passing a committed secret because "it's just a POC."
+- Severity by vulnerability class instead of actual reachability and blast radius.
+- Findings with no file:line or no articulated attack path.
+- Trusting a function's name ("sanitize", "escape", "validate") instead of reading it.
+- Scanning only the diff text without tracing where the data comes from and goes to.

assets/skills/transactional-integrity/SKILL.md

@@ -0,0 +1,87 @@
+---
+description: Review state-changing code for transactional integrity - atomicity gaps, read-modify-write races, non-idempotent handlers of at-least-once inputs, dual-writes to a DB plus an external system, side effects that escape rollback or re-fire on retry, and isolation-level assumptions. Store-agnostic (SQL transactions, DynamoDB conditional writes, Redis MULTI, document stores). Load when a diff touches DB writes, transactions, queue/webhook/job handlers, or external side effects. Findings fold into the standard code-review severity taxonomy. Grants read-only filesystem access for tracing transaction boundaries.
+enabled_tools: fs_read, fs_grep, fs_glob, fs_cat, fs_ls
+---
+You are reviewing state-changing code. The generic correctness checklist asks "does this work?"; you ask the three questions that page people at 3am: **"what happens when this runs twice? halfway? concurrently?"** Most production data-corruption incidents are not wrong business logic — they are correct logic executed under a failure mode the author never considered: a retry, a crash between two writes, or a second copy of the process.
+
+## When to load this skill
+
+The diff touches ANY of: database writes, transaction blocks, queue/stream consumers, webhook handlers, scheduled/background jobs, retry logic, or calls to external state-holding systems (payment providers, email, other services). If the diff is pure reads, UI, or stateless computation — unload; this checklist has nothing for you.
+
+## The checklist
+
+### 1. Atomicity: do multi-step writes share a transaction?
+
+Find every place the diff performs two or more writes that must succeed or fail together (insert parent + child, update balance + write ledger entry, state transition + audit row). Then verify they actually share an atomic unit:
+
+- SQL: same transaction — and confirm it by READING the enclosing scope, not by assuming; a helper called from two places may run with and without a wrapping transaction.
+- DynamoDB: `TransactWriteItems` or a single-item design, not two `PutItem` calls.
+- Redis: `MULTI`/`EXEC` or a Lua script, not sequential commands.
+- Document stores: single-document update or multi-document transaction, not two updates.
+
+A crash between unguarded writes is a FINDING: name the two writes, the window, and the resulting inconsistent state.
+
+### 2. Read-modify-write: what happens when two run concurrently?
+
+Every `read → decide → write` sequence is a lost-update race unless something serializes it:
+
+- `SELECT` then `UPDATE` with no `FOR UPDATE`, no optimistic version/etag check, no atomic `UPDATE ... SET x = x + 1`, no conditional write (`ConditionExpression`, compare-and-set).
+- Check-then-insert uniqueness ("does username exist?" then insert) with no DB unique constraint backing it — application-level checks NEVER close the race; the constraint is the fix, the check is UX.
+- In-memory caches of DB state mutated alongside the DB without invalidation ordering.
+
+Ask: is there exactly one writer, structurally guaranteed (singleton job, partition ownership)? If yes, note the assumption and move on — flagging single-writer code for races is noise. If concurrency is possible, the missing guard is a finding.
+
+### 3. Idempotency: is every at-least-once input handled at-most-once?
+
+Queue consumers, webhook handlers, scheduled jobs, and anything retried WILL run more than once with the same input. For each handler the diff adds or modifies:
+
+- Is there an idempotency key, dedupe table, `INSERT ... ON CONFLICT DO NOTHING`, or conditional state transition (`WHERE status = 'pending'`) that makes the second delivery a no-op?
+- Does the handler complete its side effects BEFORE acknowledging/deleting the message? Ack-then-process loses work; process-then-ack requires idempotency.
+- Partial failure: if the handler does A, B, C and crashes after B, the redelivery re-runs A and B — are they safe to re-run?
+
+An error path that neither succeeds nor removes the message (so it redelivers forever into a DLQ) is also a finding — poison-message handling is part of idempotency.
+
+### 4. Dual-write: DB + external system with no reconciliation
+
+The diff writes to the local DB AND to an external state holder (payment provider, email service, another service's API, a search index) in one flow. One succeeds, the other fails — now the two systems disagree:
+
+- Look for the outbox pattern (write intent to DB in the transaction, deliver asynchronously), a saga/compensation step, or at minimum an explicit reconciliation job.
+- "Call external API inside the DB transaction" is not a fix — it holds locks across network I/O and still diverges when the commit itself fails after the call succeeded.
+- Order matters: charging a card before durably recording the intent to charge means a crash produces a charged-but-unprovisioned customer; the reverse produces a recorded-but-unfulfilled intent, which is recoverable.
+
+Flag the divergence window and which side wins on replay.
+
+### 5. Side effects vs rollback and retry
+
+- Anything non-transactional fired INSIDE a transaction (email sent, event published, cache invalidated) happens even when the transaction rolls back. It must move after commit (or into an outbox).
+- Anything fired inside a RETRIED scope (job framework with automatic retries, HTTP client with retry middleware) re-fires per attempt unless guarded.
+- Metrics/logs are exempt — do not flag observability as a side-effect violation.
+
+### 6. Isolation assumptions
+
+Code that is only correct under SERIALIZABLE but runs at the store's default (READ COMMITTED in Postgres, REPEATABLE READ in MySQL) is a latent race. Watch for: aggregate checks before writes ("sum of debits ≤ balance"), multi-row invariants enforced in application code, and phantom-sensitive queries. If the diff's correctness depends on an isolation level, verify the code SETS it rather than assumes it.
+
+## Ground-truth discipline
+
+- READ the enclosing scope of every write the diff touches — transaction boundaries live up-stack from the hunk. `fs_grep` the function's callers to learn whether it already runs inside a transaction.
+- `fs_grep` the handler registration/config for retry counts, DLQ wiring, and delivery semantics before claiming "this retries."
+- Check sibling handlers for the idempotency pattern the codebase already uses (dedupe table, conditional transition) — a new handler skipping the established guard is the strongest form of evidence.
+- Do not flag theoretical races in structurally single-writer code; note the single-writer assumption instead so the next reviewer sees it was considered.
+
+## Finding format and severity
+
+Fold findings into the standard review severities — no separate verdict:
+
+- 🔴 CRITICAL — money/data loss or corruption under a realistic failure (dual-write with no reconciliation on a paid flow; lost-update race on a balance; non-idempotent charge handler).
+- 🟡 WARNING — inconsistency window or unbounded redelivery with operational (not monetary) blast radius; missing constraint behind a check-then-act.
+- 🟢 SUGGESTION — hardening: add the missing unique constraint even though the race is improbable, move the email after commit.
+
+Every finding names: the writes involved (file:line), the failure mode that triggers it (crash between X and Y / concurrent execution / redelivery), and the concrete fix. "This might have race conditions" is noise; "second `invoice.paid` delivery re-runs the provisioning insert at handler.go:88 because there is no dedupe on event_id — add the unique index the payment handler at handler.go:41 already uses" is signal.
+
+## Anti-patterns
+
+- Flagging every read-then-write as a race without checking who else writes.
+- Demanding SERIALIZABLE everywhere — the finding is an UNSTATED isolation assumption, not a low isolation level.
+- Treating logs/metrics as dual-writes.
+- Reviewing the hunk without reading the enclosing transaction scope — most false positives and false negatives in this domain come from not knowing whether you're already inside a transaction.
+- Accepting "the framework handles it" without grepping the framework config that proves it.

assets/skills/usage-pattern-testing/SKILL.md

@@ -0,0 +1,176 @@
+---
+description: Verify a change from the consumer's perspective - exercise the changed surface (HTTP API, RPC, CLI) black-box against a locally running instance with clean, isolated state. Run existing usage suites first for regressions, derive new tests from the spec (never the implementation), and classify every failure as bug / environment / expected contract change. Produces a USAGE_PROBE PASS/FAIL/INCONCLUSIVE verdict. Complements code-review (quality), adversarial-review (plan conformance), and security-review (abuse) - this is the only gate that tests BEHAVIOR by using the thing, not by reading it.
+enabled_tools: fs_read, fs_cat, fs_grep, fs_glob, fs_ls, fs_write, fs_patch, execute_command
+---
+You are verifying a change the way its consumers will experience it: by USING it. Every other
+review gate reads text — the diff, the plan, the code. This gate boots the system locally from a
+clean state and exercises the changed surface as a cold-start consumer would. It catches the class
+of defects invisible to static review: serialization quirks, replace-vs-patch semantics,
+wrong status codes, broken idempotency, empty-state crashes, auth holes on new routes.
+
+## The one question
+
+**Does the changed consumer-facing surface behave as the spec promises when actually used,
+starting from nothing?** You are not judging code quality, plan conformance, or exploitability —
+other gates own those. You judge observable behavior.
+
+## The independence rule (spec-first, or the gate is worthless)
+
+Derive expected behaviors from the **spec** — the plan/task acceptance criteria, the API contract
+(IDL/schema/OpenAPI/proto definitions), the documented CLI help — **BEFORE reading the
+implementation**. If you read the handler first and write tests that mirror it, you have re-proven
+the implementation's own assumptions, including its misreadings of the spec. Order of operations:
+
+1. Read the spec + contract. Write down the expected behaviors as concrete request→response pairs.
+2. Only THEN read implementation code — and only as much as needed to find ports, config, and
+   startup wiring. Never to "check what it actually does" before your expectations are written.
+
+## Phase order
+
+### 1. Identify the surface under test
+
+From the diff (or the caller's summary): which endpoints/RPCs/commands were added or changed?
+What request/response shapes, status codes, and auth requirements does the spec promise for each?
+If the change touches no consumer-facing surface, say so and return PASS with a one-line note —
+probing inert internals burns budget without value.
+
+### 2. Regression-first: find and run existing usage suites
+
+Discover what already exists before authoring anything:
+
+- `fs_glob` for suite files in ANY format the repo uses: `**/*.hurl`, `**/*.http`, `**/*.rest`,
+  `**/*.postman_collection.json`, `**/*.bru`, `**/e2e/**`, `**/integration/**`, `**/api-test*/**`,
+  `**/smoke*/**`, plus repo scripts that run them (`**/run-*test*`, Makefile/justfile targets,
+  package-manifest script entries) and shell scripts of `curl` commands (`fs_grep` for `curl `
+  under `scripts/`, `test/`, `tools/`).
+- Read the repo's contributor docs for the sanctioned way to run them.
+
+Run the existing suites against the changed code FIRST. Every failure here is a candidate
+regression. Classify each (see § Failure classification) — a failure is only acceptable when the
+spec EXPLICITLY changed that contract, and then the old test needs updating (note it in the
+report), not ignoring.
+
+### 3. Map coverage, author the delta
+
+List which of your expected behaviors from step 1 the existing suites already prove. Author new
+tests ONLY for the uncovered ones. Walk this usage-pattern checklist for each changed surface —
+these are the cases implementers systematically forget:
+
+| Pattern | What to probe |
+|---------|---------------|
+| Cold start / empty state | First-ever call with no pre-existing data: list → empty (not 500), get → not-found (not panic) |
+| Happy path | The spec's primary flow, end to end, asserting the full response shape — not just the status code |
+| Idempotency / re-call | Same create/update twice: duplicate error or no-op, per the spec — never silent double-write |
+| Invalid input | Missing required fields, wrong types, out-of-range values, malformed body → the spec's error shape and code, not a 500 |
+| Auth on the new surface | Missing/expired/insufficient credentials → the correct 401/403 (a new route with no auth check is a common miss) |
+| Not-found and stale references | Operations on IDs that don't exist or were deleted |
+| Partial update semantics | Does omitting a field preserve it (patch) or delete it (replace)? Assert whichever the spec promises — this is a classic silent-data-loss bug |
+| Serialization edges | Zero values, empty lists, unset optionals: encoders that omit zero values make `== false`/`== null` asserts lie — assert existence/absence per the actual encoding |
+| Pagination / limits | Page past the end, limit 0/1/max, stable ordering if promised |
+| Error shape consistency | New errors follow the same envelope as the rest of the surface |
+| State transitions | Illegal transitions rejected; legal ones observable via subsequent reads |
+
+Write the new tests where the repo's existing suites live, following their naming and layout
+conventions, so they are adoptable as permanent regression tests. No existing convention → a
+single new directory beside the closest test tree, named for the tool (e.g. `tests/usage/`).
+
+### 4. Environment discipline (clean, local, isolated)
+
+- **Clean state is non-negotiable.** Boot from nothing: fresh/ephemeral database (throwaway
+  container, tmp file, or dedicated schema), run migrations, seed ONLY what the tests create
+  themselves. Tests that depend on pre-existing data are not cold-start tests.
+- **Fully local.** Stub or mock external dependencies (fake servers, recorded fixtures, in-memory
+  substitutes) — a probe that calls real third-party systems is a flake generator and a hazard.
+- **Prefer the repo's own recipe.** If the plan or contributor docs provide a local-run recipe
+  (compose file, make target, dev script), use it verbatim before inventing your own. If you must
+  invent one, record every step in the report so it can be promoted into the docs.
+- **Teardown.** Leave no running processes, containers, or dirty state behind.
+- **Bounded startup retries only.** Retry/poll while the stack boots (bounded attempts, short
+  interval). NEVER add retries to make a flaky assertion pass — flakiness on a settled stack is a
+  finding.
+
+### 5. Failure classification (every failure gets exactly one)
+
+| Class | Meaning | Effect on verdict |
+|-------|---------|-------------------|
+| **BUG** | The running system violates the spec | FAIL — report with repro |
+| **EXPECTED-CHANGE** | An existing test asserts a contract the spec explicitly changed | Does not fail the verdict; the stale test is flagged for update |
+| **ENV** | The failure is in bringing the stack up or reaching it, not in behavior | Does not count as a bug; if it prevents meaningful probing → INCONCLUSIVE |
+
+Misclassifying ENV as BUG sends the implementer chasing ghosts; misclassifying BUG as ENV ships
+the defect. When unsure, reproduce twice and read the server logs before deciding.
+
+## Toolbox (repo conventions first; these are examples, not requirements)
+
+No specific tool is required. Precedence: (1) whatever format/harness the repo's existing usage
+suites already use — run and extend that; (2) a well-suited tool from the examples below if it is
+available or trivially installable; (3) ubiquitous fallbacks (`curl` + shell assertions cover any
+HTTP surface). What is non-negotiable is the discipline — spec-first asserts, clean state — not
+the tool.
+
+| Surface | Example tools | Notes |
+|---------|--------------|-------|
+| HTTP/REST/JSON (incl. gRPC-over-HTTP with JSON encoding) | [Hurl](https://hurl.dev) `.hurl` files; `curl` scripts | Hurl: plain-text request/assert format, capturable variables, `retry` for eventual consistency; files double as committed regression suites |
+| Pure gRPC/protobuf | `grpcurl` (scripted) | Use server reflection or point at the proto files |
+| CLI | Direct invocation via `execute_command` | Assert exit codes AND output; probe stdin/args edge cases |
+| Anything else | `curl`/scripts/the repo's own test harness | Same discipline: spec-first asserts, clean state |
+
+Optional niceties like Hurl and grpcurl may already be preinstalled (e.g. by a sandbox mixin) or
+can be installed idempotently (hurl via the distro package manager first — its prebuilt GitHub
+tarball dynamically links `libxml2.so.2`, which newer distros no longer ship; grpcurl from its
+GitHub release, a static Go binary). When a preferred tool is unavailable and uninstallable, fall
+back to what exists rather than skipping the check; classify a probe as ENV only when NO adequate
+tool can exercise the surface.
+
+If you use Hurl, gotchas that produce false results if unknown:
+
+- `[Captures]` run BEFORE `[Asserts]` in the same entry — capture a replaced value under a NEW
+  variable name, or your inequality asserts compare a value to itself.
+- JSON encoders that omit zero/empty values: assert `not exists` for absent fields — `== false`
+  or `== null` asserts fail on omitted keys.
+- Use `[Options] retry` with a bounded count for asynchronous effects (job completion, eventual
+  reads); never unbounded.
+
+## Verdict format
+
+End with EXACTLY one of:
+
+```
+USAGE_PROBE: PASS
+Surface: <endpoints/RPCs/commands probed>. Existing suites: <N run, all green | none found>.
+New tests: <M authored at <path>, all green>.
+<optional: 1-3 non-blocking observations (stale tests to update, recipe gaps)>
+```
+
+```
+USAGE_PROBE: FAIL
+Surface: <...>. Existing suites: <N run, X failed (Y regressions, Z expected-change)>. New tests: <M authored, W failed>.
+Behavioral findings:
+1. <surface + case> — <spec'd behavior, quoting the spec> — <observed behavior> — REPRO: <exact request/command + response received> — <test file:entry>
+Stale tests needing update (expected-change): <list or none>
+```
+
+```
+USAGE_PROBE: INCONCLUSIVE
+Could not establish a clean local environment: <what failed, verbatim error>.
+Missing: <the exact recipe/fixture/mock that would unblock — phrased so the plan author can add it>.
+Partial results (if any): <what did run and what it showed>
+```
+
+Every FAIL finding MUST include the exact reproduction (request/command and the response
+received) and cite the test file — a behavioral complaint without a repro is noise. INCONCLUSIVE
+is an honest, acceptable verdict: it routes the fix to the environment recipe, not the code.
+NEVER report INCONCLUSIVE as PASS ("couldn't test, probably fine") or as FAIL (the implementer
+would hunt a nonexistent bug).
+
+## Anti-patterns
+
+- Writing tests after reading the implementation — you will encode its bugs as expectations.
+- Skipping the existing suites and jumping to new tests — regressions are the cheapest bugs to catch.
+- Testing through internal seams (direct DB reads, internal function calls) — this gate is
+  consumer-perspective only; internals belong to unit tests.
+- Depending on pre-existing data, shared databases, or previously running services.
+- Adding retries/sleeps until a flaky assertion passes — flakiness is a finding, not an obstacle.
+- Reporting an environment failure as a behavioral FAIL (or burying it in a PASS).
+- Throwaway tests in /tmp — tests that don't land in the repo's suite location die with the run.
+- Asserting only status codes — shape and content are where the quirks live.

config.agent.example.yaml

@@ -11,60 +11,74 @@
 #   - <agent-name>_AGENT_SESSION
 #   - <agent-name>_VARIABLES (as JSON array of key-value pairs; e.g. '[{"name": "username", "value": "alex"}]')
 
-model: openai:gpt-4o             # Specify the LLM to use
+model: openai:gpt-4o # Specify the LLM to use
-temperature: null                # Set default temperature parameter, range (0, 1)
+temperature: null # Set default temperature parameter, range (0, 1)
-top_p: null                      # Set default top-p parameter, with a range of (0, 1) or (0, 2) depending on the model
+top_p: null # Set default top-p parameter, with a range of (0, 1) or (0, 2) depending on the model
-reasoning_effort: null           # Reasoning effort level for models that support it (e.g. low, medium, high).
+reasoning_effort:
-                                 # Only valid when the agent's model declares reasoning_levels.
+  null # Reasoning effort level for models that support it (e.g. low, medium, high).
-agent_session: null              # Set a session to use when starting the agent. (e.g. temp, default); defaults to globally set agent_session
+  # Only valid when the agent's model declares reasoning_levels.
-name: <agent-name>               # Name of the agent, used in the UI and logs
+agent_session: null # Set a session to use when starting the agent. (e.g. temp, default); defaults to globally set agent_session
-description: <description>       # Description of the agent, used in the UI
+name: <agent-name> # Name of the agent, used in the UI and logs
-version: 1                       # Version of the agent
+description: <description> # Description of the agent, used in the UI
+version: 1 # Version of the agent
 # Auto-Continue (Todo System)
 # The auto-continue system provides built-in task tracking for improved reliability.
 # When enabled, the model can create todo lists and the system will automatically
 # prompt it to continue when incomplete tasks remain.
 # See the [Todo System documentation](https://github.com/Dark-Alex-17/coyote/wiki/TODO-System) for more information
-auto_continue: false             # Enable automatic continuation when incomplete todos remain
+auto_continue: false # Enable automatic continuation when incomplete todos remain
-max_auto_continues: 10           # Maximum number of automatic continuations before stopping
+max_auto_continues: 10 # Maximum number of automatic continuations before stopping
-inject_todo_instructions: true   # Inject the default todo tool usage instructions into the agent's system prompt
+inject_todo_instructions: true # Inject the default todo tool usage instructions into the agent's system prompt
-continuation_prompt: null        # Custom prompt used when auto-continuing (optional; uses default if null)
+continuation_prompt: null # Custom prompt used when auto-continuing (optional; uses default if null)
 # Sub-Agent Spawning System
 # Enable this agent to spawn and manage child agents in parallel.
 # See https://github.com/Dark-Alex-17/coyote/wiki/Agents for detailed documentation.
-can_spawn_agents: false          # Enable the agent to spawn child agents
+can_spawn_agents: false # Enable the agent to spawn child agents
 # spawnable_agents:              # Optional whitelist restricting which agents can be spawned via `agent__spawn`.
 #   - explore                    # If omitted (the default), ALL installed agents are spawnable. This is the unrestricted default.
 #   - coder                      # Provide a list to restrict. Match is exact and case-sensitive (use directory names).
 #   - oracle                     # An empty list ([]) means literally nothing spawnable.
-                                 # Also filters `agent__list_available` output so the LLM only sees what it can spawn.
+# Also filters `agent__list_available` output so the LLM only sees what it can spawn.
-                                 # Graph agents (graph.yaml) ignore this; they declare spawn targets in agent nodes.
+# Graph agents (graph.yaml) ignore this; they declare spawn targets in agent nodes.
-max_concurrent_agents: 4         # Maximum number of agents that can run simultaneously
+max_concurrent_agents: 4 # Maximum number of agents that can run simultaneously
-max_agent_depth: 3               # Maximum nesting depth for sub-agents (prevents runaway spawning)
+max_agent_depth: 3 # Maximum nesting depth for sub-agents (prevents runaway spawning)
-inject_spawn_instructions: true  # Inject the default agent spawning instructions into the agent's system prompt
+max_concurrent_jobs:
-summarization_model: null        # Model to use for summarizing sub-agent output (e.g. 'openai:gpt-4o-mini'); defaults to current model
+  5 # Max background jobs (`job__*` tools) running at once for this agent
-summarization_threshold: 4000    # Character threshold above which sub-agent output is summarized before returning to parent
+  # (overrides the global setting; 0 disables background jobs for this agent)
-escalation_timeout: 300          # Seconds a sub-agent waits for a user interaction response before timing out (default: 5 minutes)
+inject_spawn_instructions: true # Inject the default agent spawning instructions into the agent's system prompt
-mcp_servers:                     # Optional list of MCP servers that the agent utilizes
+summarization_model: null # Model to use for summarizing sub-agent output (e.g. 'openai:gpt-4o-mini'); defaults to current model
-  - github                       # Corresponds to the name of an MCP server in the `<coyote-config-dir>/functions/mcp.json` file
+summarization_threshold: 4000 # Character threshold above which sub-agent output is summarized before returning to parent
-global_tools:                    # Optional list of additional global tools to enable for the agent; i.e. not tools specific to the agent
+escalation_timeout: 300 # Seconds a sub-agent waits for a user interaction response before timing out (default: 5 minutes)
+mcp_servers: # Optional list of MCP servers that the agent utilizes
+  - github # Corresponds to the name of an MCP server in the `<coyote-config-dir>/mcp.json` file
+mcp_tools: # Optional per-server tool allowlist for the agent's MCP servers
+  github: # (glob patterns: * and ?). Intersects with the global config,
+    - get_* # mcp.json `allowedTools`, and every other configured layer. It
+    - search_* # can only narrow access, never widen it.
+global_tools: # Optional list of additional global tools to enable for the agent; i.e. not tools specific to the agent
   - web_search
   - fs
   - python
-skills_enabled: true             # Master switch for skills in this agent (default: inherit from global).
+skills_enabled:
-                                 # Skills also require `function_calling_support: true` in the global config.
+  true # Master switch for skills in this agent (default: inherit from global).
-enabled_skills:                  # Optional list of skills available when this agent runs.
+  # Skills also require `function_calling_support: true` in the global config.
-                                 # Must be a subset of global `visible_skills`. Omit to inherit the global default.
+enabled_skills: # Optional list of skills available when this agent runs.
+  # Must be a subset of global `visible_skills`. Omit to inherit the global default.
   - git-master
   - ai-slop-remover
-inject_skill_instructions: true  # Inject a short hint pointing the model at `skill__list` when skills are enabled
+inject_skill_instructions:
-                                 # (default: true). Suppressed automatically when no skills are available.
+  true # Inject a short hint pointing the model at `skill__list` when skills are enabled
-skill_instructions: null         # Custom text for the skill hint (optional; uses built-in default if null)
+  # (default: true). Suppressed automatically when no skills are available.
-memory: null                     # Per-agent memory override (default: inherit). Set to `false` to disable memory
+skill_instructions: null # Custom text for the skill hint (optional; uses built-in default if null)
-                                 # for this agent regardless of workspace/global presence. See the Memory wiki page.
+enabled_macros: # Optional list of macros invocable when this agent is active in the REPL.
+  - generate-commit-message # An empty list disables all macros. Omit to inherit the role/global default.
+memory:
+  null # Per-agent memory override (default: inherit). Set to `false` to disable memory
+  # for this agent regardless of workspace/global presence. See the Memory wiki page.
 
-dynamic_instructions: false      # Whether to use dynamic instructions for the agent; if false, static instructions are used
+dynamic_instructions: false # Whether to use dynamic instructions for the agent; if false, static instructions are used
-instructions: |                  # Static instructions for the agent; ignored if dynamic instructions are used
+instructions:
+  | # Static instructions for the agent; ignored if dynamic instructions are used
   You are a AI agent designed to demonstrate agent capabilities.
 
   <tools>
@@ -84,12 +98,12 @@ instructions: |                  # Static instructions for the agent; ignored if
   <user>
   username: {{username}}
   </user>
-variables:                      # Optional variables for the agent
+variables: # Optional variables for the agent
-                                # The variables defined above like {{__variable_name__}} are automatically available
+  # The variables defined above like {{__variable_name__}} are automatically available
   - name: username
     description: Your user name
-    default: null               # A default value for this variable; if null, the variable must be provided when starting the agent
+    default: null # A default value for this variable; if null, the variable must be provided when starting the agent
-conversation_starters:          # Optional conversation starters for the agent
+conversation_starters: # Optional conversation starters for the agent
   - What is the meaning of life?
   - Tell me a joke.
   - What is the capital of France?
@@ -100,15 +114,15 @@ conversation_starters:          # Optional conversation starters for the agent
   - How do I stay motivated?
   - What is the best way to exercise?
   - How do I manage my time effectively?
-documents:                     # Optional documents to load for the agent
+documents: # Optional documents to load for the agent
-                               # To enable graph-based RAG (entity/relationship extraction + knowledge graph retrieval),
+  # To enable graph-based RAG (entity/relationship extraction + knowledge graph retrieval),
-                               # set `rag_extractor_model` in your global config.yaml.
+  # set `rag_extractor_model` in your global config.yaml.
-                               # See https://github.com/Dark-Alex-17/coyote/wiki/RAG#graph-based-rag
+  # See https://github.com/Dark-Alex-17/coyote/wiki/RAG#graph-based-rag
-  - git:/some/repo             # Explicitly tell Coyote to use the 'git' document loader using an absolute path
+  - git:/some/repo # Explicitly tell Coyote to use the 'git' document loader using an absolute path
-  - pdf:some-pdf-file.pdf      # Explicitly tell Coyote to use the 'pdf' document loader using a relative path
+  - pdf:some-pdf-file.pdf # Explicitly tell Coyote to use the 'pdf' document loader using a relative path
   - https://some-website.com/some-page
-  - some-file.pdf              # File with relative path to the <coyote-config-dir>/agents/<agent-name> directory; i.e. file in the same directory as this config file
+  - some-file.pdf # File with relative path to the <coyote-config-dir>/agents/<agent-name> directory; i.e. file in the same directory as this config file
-  - ~/some-file.txt            # File in the user's home directory
+  - ~/some-file.txt # File in the user's home directory
-  - /absolute/path/to/some-file.md  # File with absolute path
+  - /absolute/path/to/some-file.md # File with absolute path
-  - /absolute/path/**/NAME.txt    # Find all NAME.txt files in the specified directory and all its subdirectories
+  - /absolute/path/**/NAME.txt # Find all NAME.txt files in the specified directory and all its subdirectories
   - /absolute/path/to/*/README.md # Find all README.md files in all immediate subdirectories of the specified directory (depth=1)

config.example.yaml

@@ -1,40 +1,39 @@
 # ---- LLM ----
-model: openai:gpt-4o             # Specify the LLM to use
+model: openai:gpt-4o # Specify the LLM to use
-temperature: null                # Set default temperature parameter (0, 1)
+temperature: null # Set default temperature parameter (0, 1)
-top_p: null                      # Set default top-p parameter, with a range of (0, 1) or (0, 2) depending on the model
+top_p: null # Set default top-p parameter, with a range of (0, 1) or (0, 2) depending on the model
-reasoning_effort: null           # Reasoning effort level for models that support it (e.g. low, medium, high).
+reasoning_effort:
-                                 # Only valid when the active model declares reasoning_levels. See the Clients docs.
+  null # Reasoning effort level for models that support it (e.g. low, medium, high).
+  # Only valid when the active model declares reasoning_levels. See the Clients docs.
 
 # ---- Behavior ----
-stream: true                     # Controls whether to use the stream-style APIs when querying for completions from LLM clients.
+stream: true # Controls whether to use the stream-style APIs when querying for completions from LLM clients.
-save: true                       # Indicates whether to persist the conversation to messages.md for posterity
+save: true # Indicates whether to persist the conversation to messages.md for posterity
-keybindings: emacs               # Choose keybinding style (emacs, vi)
+keybindings: emacs # Choose keybinding style (emacs, vi)
-editor: null                     # Specifies the editor used to edit the input buffer or session. (e.g. vim, emacs, nano, hx). Defaults to $EDITOR
+editor: null # Specifies the editor used to edit the input buffer or session. (e.g. vim, emacs, nano, hx). Defaults to $EDITOR
-wrap: no                         # Controls text wrapping (no, auto, <max-width>)
+wrap: no # Controls text wrapping (no, auto, <max-width>)
-wrap_code: false                 # Enables or disables the wrapping of code blocks
+wrap_code: false # Enables or disables the wrapping of code blocks
 
 # ---- Prelude ----
-repl_prelude: null               # Set a default session or role for REPL mode to use (e.g. role:<name>, session:<name>, <session>:<role>)
+repl_prelude: null # Set a default session or role for REPL mode to use (e.g. role:<name>, session:<name>, <session>:<role>)
-cmd_prelude: null                # Set a default session or role for CMD mode to use (e.g. role:<name>, session:<name>, <session>:<role>)
+cmd_prelude: null # Set a default session or role for CMD mode to use (e.g. role:<name>, session:<name>, <session>:<role>)
-agent_session: null              # Set a session to use when starting an agent (e.g. temp, default)
+agent_session: null # Set a session to use when starting an agent (e.g. temp, default)
 
 # ---- Appearance ----
-highlight: true                  # Controls syntax highlighting
+highlight: true # Controls syntax highlighting
-raw_markdown: false              # When true, render markdown as raw text with syntax highlighting only. When false (default), transforms markdown syntax (headings, bold, lists, etc.) into styled terminal output
+raw_markdown: false # When true, render markdown as raw text with syntax highlighting only. When false (default), transforms markdown syntax (headings, bold, lists, etc.) into styled terminal output
-light_theme: false               # Activates a light color theme when true. env: COYOTE_LIGHT_THEME
+light_theme: false # Activates a light color theme when true. env: COYOTE_LIGHT_THEME
 
 # ---- Miscellaneous ----
-user_agent: null                 # Set User-Agent HTTP header, use `auto` for coyote/<current-version>
+user_agent: null # Set User-Agent HTTP header, use `auto` for coyote/<current-version>
-save_shell_history: true         # Whether to save shell execution command to the history file
+save_shell_history: true # Whether to save shell execution command to the history file
-sync_models_url: >               # URL to sync model changes from
+sync_models_url: > # URL to sync model changes from
   https://raw.githubusercontent.com/Dark-Alex-17/coyote/refs/heads/main/models.yaml
 
 # ---- REPL Prompt ----
 # Custom REPL left/right prompts; see the [REPL Prompt Documentation](https://github.com/Dark-Alex-17/coyote/wiki/REPL-Prompt) for more information
-left_prompt:
+left_prompt: '{color.red}{model}){color.green}{?session {?agent {agent}>}{session}{?role /}}{!session {?agent {agent}>}}{role}{?rag @{rag}}{color.cyan}{?session )}{!session >}{color.reset} '
-  '{color.red}{model}){color.green}{?session {?agent {agent}>}{session}{?role /}}{!session {?agent {agent}>}}{role}{?rag @{rag}}{color.cyan}{?session )}{!session >}{color.reset} '
+right_prompt: '{color.cyan}{?reasoning_effort [{reasoning_effort}] }{color.purple}{?session {?consume_tokens {consume_tokens}({consume_percent}%)}{!consume_tokens {consume_tokens}}}{color.reset}'
-right_prompt:
-  '{color.cyan}{?reasoning_effort [{reasoning_effort}] }{color.purple}{?session {?consume_tokens {consume_tokens}({consume_percent}%)}{!consume_tokens {consume_tokens}}}{color.reset}'
 
 # ---- Vault ----
 # See the [Vault documentation](https://github.com/Dark-Alex-17/coyote/wiki/Vault) for more information on the Coyote vault.
@@ -42,7 +41,7 @@ right_prompt:
 # The secrets_provider tells Coyote where to read and write secrets referenced via {{SECRET_NAME}} syntax.
 #
 # Shorthand: set vault_password_file to enable the local provider with that password file.
-vault_password_file: null        # Path to a file containing the password for the Coyote vault (cannot be a secret template)
+vault_password_file: null # Path to a file containing the password for the Coyote vault (cannot be a secret template)
 #
 # Explicit: set secrets_provider to one of the supported types below. When secrets_provider is set,
 # vault_password_file is ignored. Note: secrets_provider itself cannot use {{SECRET}} template syntax.
@@ -82,38 +81,39 @@ vault_password_file: null        # Path to a file containing the password for th
 
 # ---- Function Calling ----
 # See the [Tools documentation](https://github.com/Dark-Alex-17/coyote/wiki/Tools) for more details
-function_calling_support: true           # Enables or disables function calling (Globally).
+function_calling_support: true # Enables or disables function calling (Globally).
-mapping_tools:                   # Alias for a tool or toolset
+mapping_tools: # Alias for a tool or toolset
   fs: 'fs_cat,fs_ls,fs_mkdir,fs_rm,fs_write,fs_read,fs_glob,fs_grep'
-enabled_tools: null              # Which tools to enable by default.
+enabled_tools:
-                                 # Accepts either a YAML list or a comma-separated string. Use 'all' to enable everything.
+  null # Which tools to enable by default.
-                                 # Example (list form):
+  # Accepts either a YAML list or a comma-separated string. Use 'all' to enable everything.
-                                 #   enabled_tools:
+  # Example (list form):
-                                 #     - fs
+  #   enabled_tools:
-                                 #     - web_search_coyote
+  #     - fs
-                                 # Example (comma-separated form):
+  #     - web_search_coyote
-                                 #   enabled_tools: fs,web_search_coyote
+  # Example (comma-separated form):
-visible_tools:                   # Which tools are visible to be compiled (and are thus able to be defined in 'enabled_tools')
+  #   enabled_tools: fs,web_search_coyote
-#  - ast_grep.sh
+visible_tools: # Which tools are visible to be compiled (and are thus able to be defined in 'enabled_tools')
-#  - demo_py.py
+  #  - ast_grep.sh
-#  - demo_sh.sh
+  #  - demo_py.py
-#  - demo_ts.ts
+  #  - demo_sh.sh
+  #  - demo_ts.ts
   - execute_command.sh
-#  - execute_py_code.py
+  #  - execute_py_code.py
-#  - execute_sql_code.sh
+  #  - execute_sql_code.sh
-#  - fetch_url_via_curl.sh
+  #  - fetch_url_via_curl.sh
-#  - fetch_url_via_jina.sh
+  #  - fetch_url_via_jina.sh
   - fs_cat.sh
   - fs_ls.sh
-#  - fs_read.sh
+  #  - fs_read.sh
-#  - fs_glob.sh
+  #  - fs_glob.sh
-#  - fs_grep.sh
+  #  - fs_grep.sh
-#  - fs_mkdir.sh
+  #  - fs_mkdir.sh
-#  - fs_patch.sh
+  #  - fs_patch.sh
-#  - fs_write.sh
+  #  - fs_write.sh
   - get_current_time.sh
-#  - get_current_weather.py
+  #  - get_current_weather.py
-#  - get_current_weather.ts
+  #  - get_current_weather.ts
   - get_current_weather.sh
 #  - search_arxiv.sh
 #  - search_wikipedia.sh
@@ -126,69 +126,106 @@ visible_tools:                   # Which tools are visible to be compiled (and a
 
 # ---- MCP Servers ----
 # See the [MCP Servers documentation](https://github.com/Dark-Alex-17/coyote/wiki/MCP-Servers) for more details
-mcp_server_support: true         # Enables or disables MCP servers (globally).
+mcp_server_support: true # Enables or disables MCP servers (globally).
-mapping_mcp_servers:             # Alias for an MCP server or set of servers
+mapping_mcp_servers: # Alias for an MCP server or set of servers
   git: github,gitmcp
-enabled_mcp_servers: null        # Which MCP servers to enable by default.
+enabled_mcp_servers:
-                                 # Accepts either a YAML list or a comma-separated string. Use 'all' to enable everything.
+  null # Which MCP servers to enable by default.
-                                 # Example (list form):
+  # Accepts either a YAML list or a comma-separated string. Use 'all' to enable everything.
-                                 #   enabled_mcp_servers:
+  # Example (list form):
-                                 #     - github
+  #   enabled_mcp_servers:
-                                 #     - slack
+  #     - github
-                                 # Example (comma-separated form):
+  #     - slack
-                                 #   enabled_mcp_servers: github,slack,ddg-search
+  # Example (comma-separated form):
-no_workspace_mcp: false          # Disable loading workspace-local MCP servers (default: false).
+  #   enabled_mcp_servers: github,slack,ddg-search
-                                 # When false (the default), Coyote merges the first workspace MCP config it finds
+mcp_tools:
-                                 # into the global MCP registry at startup, checking in order:
+  null # Per-server MCP tool allowlists (glob patterns: * and ? supported).
-                                 #   1. .coyote/mcp.json
+  # Tools that match no pattern are hidden from the model as if they
-                                 #   2. .coyote/.mcp.json  (Claude-style file name)
+  # don't exist. Stacks with the other allowlist layers (mcp.json
-                                 #   3. .mcp.json          (project root; Claude Code convention)
+  # `allowedTools`, role, agent, session, skill, graph node). Every
-                                 # Workspace entries shadow global ones on name collision.
+  # configured layer must allow a tool, so layers only ever narrow.
-                                 # Set to true (or pass --no-workspace-mcp) to skip this entirely.
+  # An empty list blocks all of a server's tools.
+  # Example:
+  #   mcp_tools:
+  #     github:
+  #       - get_*
+  #       - list_*
+  #     slack: []
+no_workspace_mcp:
+  false # Disable loading workspace-local MCP servers (default: false).
+  # When false (the default), Coyote merges the first workspace MCP config it finds
+  # into the global MCP registry at startup, checking in order:
+  #   1. .coyote/mcp.json
+  #   2. .coyote/.mcp.json  (Claude-style file name)
+  #   3. .mcp.json          (project root; Claude Code convention)
+  # Workspace entries shadow global ones on name collision.
+  # Set to true (or pass --no-workspace-mcp) to skip this entirely.
 
 # ---- Skills ----
 # Skills are modular knowledge or capability packs the LLM can load and unload mid-conversation.
 # See the [Skills documentation](https://github.com/Dark-Alex-17/coyote/wiki/Skills) for more details.
-skills_enabled: true              # Master switch. Set to false to hide all skill management tools from the model.
+skills_enabled:
-                                  # Skills also require `function_calling_support: true` above to work at all.
+  true # Master switch. Set to false to hide all skill management tools from the model.
-visible_skills:                   # The universe of skills allowed to be enabled in any context. Omit (null) for "all installed".
+  # Skills also require `function_calling_support: true` above to work at all.
+visible_skills: # The universe of skills allowed to be enabled in any context. Omit (null) for "all installed".
   - ai-slop-remover
   - code-review
   - frontend-ui-ux
   - git-master
-enabled_skills: null              # Which skills are available by default (no role/agent/session active). null = all visible.
+enabled_skills:
-                                  # Accepts either a YAML list or a comma-separated string.
+  null # Which skills are available by default (no role/agent/session active). null = all visible.
-                                  # Example (list form):
+  # Accepts either a YAML list or a comma-separated string.
-                                  #   enabled_skills:
+  # Example (list form):
-                                  #     - git-master
+  #   enabled_skills:
-                                  #     - ai-slop-remover
+  #     - git-master
-                                  # Example (comma-separated form):
+  #     - ai-slop-remover
-                                  #   enabled_skills: git-master,ai-slop-remover
+  # Example (comma-separated form):
-inject_skill_instructions: true   # Inject a short hint pointing the model at `skill__list` when skills are enabled in
+  #   enabled_skills: git-master,ai-slop-remover
-                                  # this context. Only injected if `function_calling_support`, `skills_enabled`, and the
+inject_skill_instructions:
-                                  # effective enabled skill set is non-empty (default: true).
+  true # Inject a short hint pointing the model at `skill__list` when skills are enabled in
-skill_instructions: null          # Custom text used for the skill hint when injected. If null, uses built-in default.
+  # this context. Only injected if `function_calling_support`, `skills_enabled`, and the
+  # effective enabled skill set is non-empty (default: true).
+skill_instructions: null # Custom text used for the skill hint when injected. If null, uses built-in default.
+
+# ---- Macros ----
+# Macros are Coyote's custom commands: named sequences of REPL commands and prompts, invoked directly by name
+# (a macro file named `review.yaml` runs as `.review [args]`; built-in commands always win a name collision).
+# Workspace-local macros in `.coyote/macros/` shadow same-named global macros (skip them with --no-workspace-macros).
+# See the [Macros documentation](https://github.com/Dark-Alex-17/coyote/wiki/Macros) for more details.
+enabled_macros:
+  null # Which macros are invocable by default (no role/agent/session active). null = all visible.
+  # An empty list means NO macros are invocable. Accepts either a YAML list or a
+  # comma-separated string. Roles, agents, and sessions may define their own
+  # `enabled_macros`; the most specific active one wins (session > agent > role > global).
+  # Example (list form):
+  #   enabled_macros:
+  #     - generate-commit-message
+  # Example (comma-separated form):
+  #   enabled_macros: generate-commit-message,review
 
 # ---- Auto-Continue (Todo System) ----
 # The auto-continue system provides built-in task tracking for improved reliability.
 # When enabled, the model can create todo lists and the system will automatically
 # prompt it to continue when incomplete tasks remain.
 # See the [Todo System documentation](https://github.com/Dark-Alex-17/coyote/wiki/TODO-System) for more information
-auto_continue: false              # Enable automatic continuation when incomplete todos remain (default: false)
+auto_continue: false # Enable automatic continuation when incomplete todos remain (default: false)
-max_auto_continues: 10            # Maximum number of automatic continuations before stopping (default: 10)
+max_auto_continues: 10 # Maximum number of automatic continuations before stopping (default: 10)
-inject_todo_instructions: true    # Inject default todo usage instructions into the system prompt (default: true)
+inject_todo_instructions: true # Inject default todo usage instructions into the system prompt (default: true)
-continuation_prompt: null         # Custom prompt used when auto-continuing. If null, uses built-in default
+continuation_prompt: null # Custom prompt used when auto-continuing. If null, uses built-in default
 
 # ---- Session ----
 # See the [Session documentation](https://github.com/Dark-Alex-17/coyote/wiki/Sessions) for more information
-save_session: null               # Controls the persistence of the session. If true, auto save; if false, don't auto-save save; if null, ask the user what to do
+save_session: null # Controls the persistence of the session. If true, auto save; if false, don't auto-save save; if null, ask the user what to do
-compression_threshold: 4000      # Compress the session when the token count reaches or exceeds this threshold
+compression_threshold: 4000 # Compress the session when the token count reaches or exceeds this threshold
-summarization_prompt: >          # The text prompt used for creating a concise summary of session message
+summarization_prompt:
+  > # The text prompt used for creating a concise summary of session message
   'Summarize the discussion briefly in 200 words or less to use as a prompt for future context.'
-summary_context_prompt: >        # The text prompt used for including the summary of the entire session as context to the model
+summary_context_prompt:
+  > # The text prompt used for including the summary of the entire session as context to the model
   'This is a summary of the chat history as a recap: '
-compression_keep_last: 0         # Number of most-recent messages to keep visible after compression (0 = compress all messages)
+compression_keep_last: 0 # Number of most-recent messages to keep visible after compression (0 = compress all messages)
-max_tool_result_chars: null      # Cap on tool result characters forwarded to the model per call (null = no cap)
+max_tool_result_chars: null # Cap on tool result characters forwarded to the model per call (null = no cap)
+max_concurrent_jobs: 5 # Max background jobs (`job__*` tools) running at once per context (default: 5; 0 disables background jobs entirely)
 
 # ---- Memory ----
 # See the [Memory documentation](https://github.com/Dark-Alex-17/coyote/wiki/Memory) for more information.
@@ -197,11 +234,13 @@ max_tool_result_chars: null      # Cap on tool result characters forwarded to th
 # even when memory files exist. The cascade is: agent > session > role > app.
 # Bootstrap with `coyote --init-memory [global|workspace]` to create the marker file
 # the LLM needs before it will write any memory.
-memory: null                     # null = enabled when memory exists on disk; true = force on; false = force off
+memory: null # null = enabled when memory exists on disk; true = force on; false = force off
-memory_cap_with_tools: null      # Char cap for injected memory when function calling is available (default: 6000).
+memory_cap_with_tools:
-                                 # Only MEMORY.md indexes are injected; the LLM uses memory__read to fetch drill files.
+  null # Char cap for injected memory when function calling is available (default: 6000).
-memory_cap_without_tools: null   # Char cap when function calling is unavailable (default: 12000).
+  # Only MEMORY.md indexes are injected; the LLM uses memory__read to fetch drill files.
-                                 # Indexes plus drill file bodies are injected up to this cap.
+memory_cap_without_tools:
+  null # Char cap when function calling is unavailable (default: 12000).
+  # Indexes plus drill file bodies are injected up to this cap.
 
 # ---- Workspace Instructions ----
 # Human-curated project instructions injected read-only into the system prompt, in full.
@@ -209,22 +248,23 @@ memory_cap_without_tools: null   # Char cap when function calling is unavailable
 # chain below (per directory, in order). Scaffold with `coyote --init-instructions`.
 # Disable per-invocation with --no-workspace-instructions, or override the chain with
 # repeatable --workspace-instructions-file flags.
-workspace_instructions: null     # null/true = inject when an instructions file exists; false = never inject
+workspace_instructions: null # null/true = inject when an instructions file exists; false = never inject
-workspace_instructions_files: null # File name chain to search, in priority order.
+workspace_instructions_files:
-                                   # Default: [COYOTE.md, AGENTS.md, CLAUDE.md, GEMINI.md]
+  null # File name chain to search, in priority order.
-                                   # Set to a custom list to reorder or drop fallbacks, e.g.:
+  # Default: [COYOTE.md, AGENTS.md, CLAUDE.md, GEMINI.md]
-                                   #   workspace_instructions_files: [COYOTE.md]
+  # Set to a custom list to reorder or drop fallbacks, e.g.:
+  #   workspace_instructions_files: [COYOTE.md]
 
 # ---- RAG ----
 # See the [RAG Docs](https://github.com/Dark-Alex-17/coyote/wiki/RAG) for more details.
-rag_embedding_model: null        # Specifies the embedding model used for context retrieval
+rag_embedding_model: null # Specifies the embedding model used for context retrieval
-rag_reranker_model: null         # Specifies the reranker model used for sorting retrieved documents; Coyote uses Reciprocal Rank Fusion by default
+rag_reranker_model: null # Specifies the reranker model used for sorting retrieved documents; Coyote uses Reciprocal Rank Fusion by default
-rag_top_k: 5                     # Specifies the number of documents to retrieve for answering queries
+rag_top_k: 5 # Specifies the number of documents to retrieve for answering queries
-rag_chunk_size: null             # Defines the size of chunks for document processing in characters
+rag_chunk_size: null # Defines the size of chunks for document processing in characters
-rag_chunk_overlap: null          # Defines the overlap between chunks
+rag_chunk_overlap: null # Defines the overlap between chunks
-rag_extractor_model: null        # LLM model for graph-based entity/relationship extraction; when set, enables a graph RAG signal alongside vector and BM25
+rag_extractor_model: null # LLM model for graph-based entity/relationship extraction; when set, enables a graph RAG signal alongside vector and BM25
-rag_extractor_prompt: null       # Custom extraction prompt template; must contain __CHUNK__ placeholder; defaults to built-in prompt when null
+rag_extractor_prompt: null # Custom extraction prompt template; must contain __CHUNK__ placeholder; defaults to built-in prompt when null
-rag_graph_hops: 1                # Number of hops to expand from matched entities at query time (0 = seed nodes only; 1 = direct neighbors; increase for denser graphs)
+rag_graph_hops: 1 # Number of hops to expand from matched entities at query time (0 = seed nodes only; 1 = direct neighbors; increase for denser graphs)
 # Defines the query structure using variables like __CONTEXT__, __SOURCES__, and __INPUT__ to tailor searches to specific needs
 rag_template: |
   Answer the query based on the context while respecting the rules. (user query, some textual context and rules, all inside xml tags)
@@ -255,13 +295,14 @@ document_loaders:
   # You can add custom loaders using the following syntax:
   #   <file-extension>: <command-to-load-the-file>
   # Note: Use `$1` for input file and `$2` for output file. If `$2` is omitted, use stdout as output.
-  pdf: 'pdftotext $1 -'                                                                 # Use pdftotext to convert a PDF file to text
+  pdf: 'pdftotext $1 -' # Use pdftotext to convert a PDF file to text
   # (see https://poppler.freedesktop.org for details on how to install pdftotext)
-  docx: 'pandoc --to plain $1'                                                          # Use pandoc to convert a .docx file to text
+  docx: 'pandoc --to plain $1' # Use pandoc to convert a .docx file to text
   # (see https://pandoc.org for details on how to install pandoc)
-  jina: 'curl -fsSL https://r.jina.ai/$1 -H "Authorization: Bearer {{JINA_API_KEY}}'    # Use Jina to translate a website into text;
+  jina: 'curl -fsSL https://r.jina.ai/$1 -H "Authorization: Bearer {{JINA_API_KEY}}' # Use Jina to translate a website into text;
   # Requires a Jina API key to be added to the Coyote vault
-  git: >                                                                                # Use yek to load a git repository into the knowledgebase (https://github.com/bodo-run/yek)
+  git:
+    > # Use yek to load a git repository into the knowledgebase (https://github.com/bodo-run/yek)
     sh -c "yek $1 --json | jq 'map({ path: .filename, contents: .content })'"
 
 # ---- Clients ----
@@ -277,10 +318,10 @@ clients:
   #       supports_function_calling: true
   #     - name: xxxx                                  # Embedding model
   #       type: embedding
-  #       default_chunk_size: 1500                        
+  #       default_chunk_size: 1500
   #       max_batch_size: 100
   #     - name: xxxx                                  # Reranker model
-  #       type: reranker 
+  #       type: reranker
   #   patch:                                          # Patch API calls
   #     chat_completions:                             # API type; Possible values: chat_completions, embeddings, and rerank
   #       <regex>:                                    # The regex to match model names, e.g. '.*' 'gpt-4o' 'gpt-4o|gpt-4-.*'
@@ -292,18 +333,19 @@ clients:
   #   extra:
   #     proxy: socks5://127.0.0.1:1080                # Set proxy
   #     connect_timeout: 10                           # Set timeout in seconds for connect to api
+  #     read_timeout: 300                             # Set timeout in seconds for a read stall (no bytes received); 0 disables (default: 300)
 
   # See https://platform.openai.com/docs/quickstart
   - type: openai
-    api_base: https://api.openai.com/v1               # Optional
+    api_base: https://api.openai.com/v1 # Optional
-    api_key: '{{OPENAI_API_KEY}}'                     # You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{OPENAI_API_KEY}}' # You can either hard-code or inject secrets from the Coyote vault
-    organization_id: org-xxx                          # Optional
+    organization_id: org-xxx # Optional
 
   # For any platform compatible with OpenAI's API
   - type: openai-compatible
     name: ollama
     api_base: http://localhost:11434/v1
-    api_key: '{{OLLAMA_API_KEY}}'                     # Optional; You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{OLLAMA_API_KEY}}' # Optional; You can either hard-code or inject secrets from the Coyote vault
     models:
       - name: deepseek-r1
         max_input_tokens: 131072
@@ -321,9 +363,10 @@ clients:
   # See https://ai.google.dev/docs
   - type: gemini
     api_base: https://generativelanguage.googleapis.com/v1beta
-    api_key: '{{GEMINI_API_KEY}}'                       # You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{GEMINI_API_KEY}}' # You can either hard-code or inject secrets from the Coyote vault
-    auth: null                                          # When set to 'oauth', Coyote will use OAuth instead of an API key
+    auth:
-                                                        # Authenticate with `coyote --authenticate` or `.authenticate` in the REPL
+      null # When set to 'oauth', Coyote will use OAuth instead of an API key
+      # Authenticate with `coyote --authenticate` or `.authenticate` in the REPL
     patch:
       chat_completions:
         '.*':
@@ -340,25 +383,27 @@ clients:
 
   # See https://docs.anthropic.com/claude/reference/getting-started-with-the-api
   - type: claude
-    api_base: https://api.anthropic.com/v1              # Optional
+    api_base: https://api.anthropic.com/v1 # Optional
-    api_key: '{{ANTHROPIC_API_KEY}}'                    # You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{ANTHROPIC_API_KEY}}' # You can either hard-code or inject secrets from the Coyote vault
-    auth: null                                          # When set to 'oauth', Coyote will use OAuth instead of an API key
+    auth:
-                                                        # Authenticate with `coyote --authenticate` or `.authenticate` in the REPL
+      null # When set to 'oauth', Coyote will use OAuth instead of an API key
+      # Authenticate with `coyote --authenticate` or `.authenticate` in the REPL
 
   # See https://docs.mistral.ai/
   - type: openai-compatible
     name: mistral
     api_base: https://api.mistral.ai/v1
-    api_key: '{{MISTRAL_API_KEY}}'                      # You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{MISTRAL_API_KEY}}' # You can either hard-code or inject secrets from the Coyote vault
 
   # See https://docs.x.ai/docs - OAuth via SuperGrok / X Premium+ subscription
   - type: openai-compatible
     name: xai
     api_base: https://api.x.ai/v1
-    api_key: '{{XAI_API_KEY}}'                          # You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{XAI_API_KEY}}' # You can either hard-code or inject secrets from the Coyote vault
-    auth: null                                          # When set to 'oauth', Coyote will use OAuth instead of an API key
+    auth:
-                                                        # Authenticate with `coyote --authenticate` or `.authenticate` in the REPL
+      null # When set to 'oauth', Coyote will use OAuth instead of an API key
-                                                        # Note: Oauth requires SuperGrok/X Premium+ subscription
+      # Authenticate with `coyote --authenticate` or `.authenticate` in the REPL
+      # Note: Oauth requires SuperGrok/X Premium+ subscription
 
   # Example: private OpenAI-compatible gateway with client_credentials OAuth
   # - type: openai-compatible
@@ -388,31 +433,31 @@ clients:
   - type: openai-compatible
     name: ai12
     api_base: https://api.ai21.com/studio/v1
-    api_key: '{{AI21_API_KEY}}'                         # You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{AI21_API_KEY}}' # You can either hard-code or inject secrets from the Coyote vault
 
   # See https://docs.cohere.com/docs/the-cohere-platform
   - type: cohere
-    api_base: https://api.cohere.ai/v2                  # Optional
+    api_base: https://api.cohere.ai/v2 # Optional
-    api_key: '{{COHERE_API_KEY}}'                       # You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{COHERE_API_KEY}}' # You can either hard-code or inject secrets from the Coyote vault
 
   # See https://docs.perplexity.ai/getting-started/overview
   - type: openai-compatible
     name: perplexity
     api_base: https://api.perplexity.ai
-    api_key: '{{PERPLEXITY_API_KEY}}'                   # You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{PERPLEXITY_API_KEY}}' # You can either hard-code or inject secrets from the Coyote vault
 
   # See https://console.groq.com/docs/quickstart
   - type: openai-compatible
     name: groq
     api_base: https://api.groq.com/openai/v1
-    api_key: '{{GROQ_API_KEY}}'                         # You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{GROQ_API_KEY}}' # You can either hard-code or inject secrets from the Coyote vault
 
   # See https://learn.microsoft.com/en-us/azure/ai-services/openai/chatgpt-quickstart
   - type: azure-openai
     api_base: https://{RESOURCE}.openai.azure.com
-    api_key: '{{AZURE_OPENAI_API_KEY}}'                 # You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{AZURE_OPENAI_API_KEY}}' # You can either hard-code or inject secrets from the Coyote vault
     models:
-      - name: gpt-4o                                    # Model deployment name
+      - name: gpt-4o # Model deployment name
         max_input_tokens: 128000
         supports_vision: true
         supports_function_calling: true
@@ -424,7 +469,7 @@ clients:
     # Specifies an application default credentials (adc) file
     # Run `gcloud auth application-default login` to initialize the ADC file
     # see https://cloud.google.com/docs/authentication/external/set-up-adc for more information
-    adc_file: <gcloud-config-dir>/application_default_credentials.json  # Optional
+    adc_file: <gcloud-config-dir>/application_default_credentials.json # Optional
     patch:
       chat_completions:
         'gemini-.*':
@@ -441,77 +486,76 @@ clients:
 
   # See https://docs.aws.amazon.com/bedrock/latest/userguide/
   - type: bedrock
-    access_key_id: '{{AWS_ACCESS_KEY_ID}}'              # You can either hard-code or inject secrets from the Coyote vault
+    access_key_id: '{{AWS_ACCESS_KEY_ID}}' # You can either hard-code or inject secrets from the Coyote vault
-    secret_access_key: '{{AWS_SECRET_ACCESS_KEY}}'      # You can either hard-code or inject secrets from the Coyote vault
+    secret_access_key: '{{AWS_SECRET_ACCESS_KEY}}' # You can either hard-code or inject secrets from the Coyote vault
     region: xxx
-    session_token: xxx                                  # Optional, only needed for temporary credentials
+    session_token: xxx # Optional, only needed for temporary credentials
 
   # See https://developers.cloudflare.com/workers-ai/
   - type: openai-compatible
     name: cloudflare
     api_base: https://api.cloudflare.com/client/v4/accounts/{ACCOUNT_ID}/ai/v1
-    api_key: '{{CLOUDFLARE_API_KEY}}'                    # You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{CLOUDFLARE_API_KEY}}' # You can either hard-code or inject secrets from the Coyote vault
 
   # See https://cloud.baidu.com/doc/WENXINWORKSHOP/index.html
   - type: openai-compatible
     name: ernie
     api_base: https://qianfan.baidubce.com/v2
-    api_key: '{{BAIDU_API_KEY}}'                        # You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{BAIDU_API_KEY}}' # You can either hard-code or inject secrets from the Coyote vault
 
   # See https://dashscope.aliyun.com/
   - type: openai-compatible
     name: qianwen
     api_base: https://dashscope.aliyuncs.com/compatible-mode/v1
-    api_key: '{{ALIYUN_API_KEY}}'                       # You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{ALIYUN_API_KEY}}' # You can either hard-code or inject secrets from the Coyote vault
 
   # See https://cloud.tencent.com/product/hunyuan
   - type: openai-compatible
     name: hunyuan
     api_base: https://api.hunyuan.cloud.tencent.com/v1
-    api_key: '{{TENCENT_API_KEY}}'                      # You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{TENCENT_API_KEY}}' # You can either hard-code or inject secrets from the Coyote vault
 
   # See https://platform.moonshot.cn/docs/intro
   - type: openai-compatible
     name: moonshot
     api_base: https://api.moonshot.cn/v1
-    api_key: '{{MOONSHOT_API_KEY}}'                     # You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{MOONSHOT_API_KEY}}' # You can either hard-code or inject secrets from the Coyote vault
 
   # See https://platform.deepseek.com/api-docs/
   - type: openai-compatible
     name: deepseek
     api_base: https://api.deepseek.com
-    api_key: '{{DEEPSEEK_API_KEY}}'                     # You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{DEEPSEEK_API_KEY}}' # You can either hard-code or inject secrets from the Coyote vault
 
   # See https://open.bigmodel.cn/dev/howuse/introduction
   - type: openai-compatible
     name: zhipuai
     api_base: https://open.bigmodel.cn/api/paas/v4
-    api_key: '{{ZHIPUAI_API_KEY}}'                      # You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{ZHIPUAI_API_KEY}}' # You can either hard-code or inject secrets from the Coyote vault
 
   # See https://platform.minimaxi.com/document/Fast%20access
   - type: openai-compatible
     name: minimax
     api_base: https://api.minimax.chat/v1
-    api_key: '{{MINIMAX_API_KEY}}'                      # You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{MINIMAX_API_KEY}}' # You can either hard-code or inject secrets from the Coyote vault
 
   # See https://openrouter.ai/docs#quick-start
   - type: openai-compatible
     name: openrouter
     api_base: https://openrouter.ai/api/v1
-    api_key: '{{OPENROUTER_API_KEY}}'                   # You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{OPENROUTER_API_KEY}}' # You can either hard-code or inject secrets from the Coyote vault
 
   # See https://github.com/marketplace/models
   - type: openai-compatible
     name: github
     api_base: https://models.inference.ai.azure.com
-    api_key: '{{GITHUB_API_KEY}}'                       # You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{GITHUB_API_KEY}}' # You can either hard-code or inject secrets from the Coyote vault
 
   # See https://deepinfra.com/docs
   - type: openai-compatible
     name: deepinfra
     api_base: https://api.deepinfra.com/v1/openai
-    api_key: '{{DEEPINFRA_API_KEY}}'                    # You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{DEEPINFRA_API_KEY}}' # You can either hard-code or inject secrets from the Coyote vault
-
 
   # ----- RAG dedicated -----
 
@@ -519,10 +563,10 @@ clients:
   - type: openai-compatible
     name: jina
     api_base: https://api.jina.ai/v1
-    api_key: '{{JINA_API_KEY}}'                         # You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{JINA_API_KEY}}' # You can either hard-code or inject secrets from the Coyote vault
 
   # See https://docs.voyageai.com/docs/introduction
   - type: openai-compatible
     name: voyageai
     api_base: https://api.voyageai.com/v1
-    api_key: '{{VOYAGEAI_API_KEY}}'                     # You can either hard-code or inject secrets from the Coyote vault
+    api_key: '{{VOYAGEAI_API_KEY}}' # You can either hard-code or inject secrets from the Coyote vault

config.macro.example.yaml

@@ -1,3 +1,13 @@
+description: Demonstrates every macro field       # Optional; shown in `.list macros` and in `.<name>` tab-completion.
+isolated: true                                    # Optional; 'true' by default. When true, steps run in a forked,
+                                                  # throwaway context: the exchange and any `.role`/`.model` switches
+                                                  # vanish when the macro ends. When false, steps run on the LIVE
+                                                  # session exactly as if you typed them: prompts are recorded, and
+                                                  # mutating steps (e.g. `.role`, `.model`) PERSIST after the macro
+                                                  # finishes -- by design. Steps are fail-fast in both modes: an error
+                                                  # aborts the remaining steps, but completed steps' effects remain.
+                                                  # A non-isolated macro step cannot invoke another macro, and a
+                                                  # `.exit` step never exits the REPL.
 variables:                                        # A list of positional variables that the macro uses
   - name: positional_1                            # The name of the positional variable.
     default: null                                 # Since no default value is provided, this argument is required; 'null' by default

config.role.example.md

@@ -16,6 +16,10 @@ enabled_tools:                        # Tools to enable for this role. Accepts a
 enabled_mcp_servers:                  # MCP servers to enable for this role. Accepts a YAML list (preferred)
   - github                            # or a comma-separated string (e.g. `enabled_mcp_servers: github,gitmcp`).
   - gitmcp                            # Use `all` to enable every configured MCP server.
+mcp_tools:                            # Per-server MCP tool allowlists for this role (globs: * and ?).
+  github:                             # Intersects with the global config / mcp.json `allowedTools`.
+    - get_*                           # Layers only narrow. Tools matching no pattern are hidden from
+    - search_*                        # the model as if they don't exist.
 skills_enabled: true                  # Master switch for skills in this role (default: inherit from global).
                                       # Skills also require `function_calling_support: true` in the global config.
 enabled_skills:                       # Skills available when this role is active. Accepts a YAML list (preferred)
@@ -24,6 +28,9 @@ enabled_skills:                       # Skills available when this role is activ
 inject_skill_instructions: true       # Inject a short hint pointing the model at `skill__list` when skills are enabled 
                                       # (default: true). Suppressed automatically when no skills are available.
 skill_instructions: null              # Custom text for the skill hint (optional; uses built-in default if null)
+enabled_macros:                       # Macros invocable when this role is active. Accepts a YAML list (preferred)
+  - generate-commit-message           # or a comma-separated string (e.g. `enabled_macros: generate-commit-message,review`).
+                                      # An empty list disables all macros. Omit to inherit the global default.
 memory: null                          # Per-role memory override (default: inherit). Set to `false` to disable memory
                                       # when this role is active. See the Memory wiki page.
 

deployment/homebrew/coyote.rb.template

@@ -1,7 +1,7 @@
 # Documentation: https://docs.brew.sh/Formula-Cookbook
 #                https://rubydoc.brew.sh/Formula
 class Coyote < Formula
-  desc "All-in-one, batteries included LLM CLI tool"
+  desc "The batteries-included runtime for LLMs"
   homepage "https://github.com/Dark-Alex-17/coyote"
   if OS.mac? and Hardware::CPU.arm?
     url "https://github.com/Dark-Alex-17/coyote/releases/download/v$version/coyote-aarch64-apple-darwin.tar.gz"

graph.example.yaml

@@ -36,6 +36,14 @@ top_p: null                        # Default sampling top-p for `llm` nodes
 reasoning_effort: null             # Default reasoning effort for `llm` nodes that don't override it.
                                    # Only valid when the model declares reasoning_levels.
 
+max_concurrent_jobs: 5             # Max background jobs (`job__*` tools) running at once across the
+                                   # whole graph run: every `llm` node (including parallel branches)
+                                   # draws from this one pool, so the budget is graph-wide — there is
+                                   # no per-node override. Jobs themselves are node-local: the node
+                                   # that starts a job must collect or cancel it before it ends, and
+                                   # anything left running at node exit is cancelled. Overrides the
+                                   # global setting; 0 disables background jobs for this graph agent.
+
 global_tools:                      # Tool universe an `llm` node's `tools:` whitelist draws from
   - web_search_coyote.sh
   - fetch_url_via_curl.sh
@@ -43,6 +51,10 @@ global_tools:                      # Tool universe an `llm` node's `tools:` whit
 mcp_servers:                       # MCP servers an `llm` node may reference via `mcp:<server>`
   - ddg-search
 
+mcp_tools:                         # Optional per-server tool allowlists (globs: * and ?) applied to
+  ddg-search:                      # every node that uses `mcp:<server>`; intersects with the other
+    - search                       # allowlist layers (global config, agent, mcp.json `allowedTools`).
+
 # ---------------------------------------------------------------------------
 # Skills policy (optional)
 # Skills only attach to `llm` nodes inside a graph. Both fields are optional.
@@ -394,6 +406,9 @@ nodes:
     tools:                     # Narrow whitelist: exactly these entries, nothing else
       - web_search_coyote        #   an exact global-tool / custom-tool name
       - mcp:ddg-search         #   `mcp:<server>` includes that server's functions
+    mcp_tools:                 # Optional per-node narrowing of MCP tools (globs: * and ?)
+      ddg-search:              #   keys must be servers this graph enables; intersects with
+        - search               #   the graph-level mcp_tools above and every other layer
     model: claude:claude-haiku-4-5  # Optional per-node model override
     temperature: 0.3           # Optional per-node sampling override
     reasoning_effort: null     # Optional per-node reasoning effort override (e.g. low, medium, high)

models.yaml

@@ -841,6 +841,11 @@
       referrer: coyote
     echo_pkce_in_token_exchange: true
   models:
+    - name: grok-4.6
+      input_price: 2
+      output_price: 6
+      max_input_tokens: 500000
+      supports_function_calling: true
     - name: grok-4.5
       input_price: 2
       output_price: 6

src/acp/server.rs

@@ -1,7 +1,7 @@
 use super::types::{METHOD_NOT_FOUND, PARSE_ERROR, Request, Response};
 use crate::client::call_chat_completions_streaming;
 use crate::config::{Input, RenderMode, RequestContext};
-use crate::function::supervisor::{GuardrailAction, check_pending_agents_guardrail};
+use crate::function::agents::{GuardrailAction, check_pending_tasks_guardrail};
 use crate::utils;
 use crate::utils::AbortSignal;
 use anyhow::Result;
@@ -211,7 +211,7 @@ async fn run_prompt_turn(
             input = input.merge_tool_results(output, tool_results);
             continue;
         }
-        match check_pending_agents_guardrail(ctx) {
+        match check_pending_tasks_guardrail(ctx) {
             GuardrailAction::Inject(prompt) => {
                 input = Input::from_str(ctx, &prompt, None)?;
             }

src/cli/mod.rs

@@ -47,12 +47,13 @@ pub enum McpScopeArg {
 			.args(["sandbox", "fresh"])
 			.multiple(true)
 			.conflicts_with_all([
-				"model", "prompt", "role", "session", "agent", "rag", "rebuild_rag",
+				"model", "temp_role", "role", "session", "agent", "rag", "rebuild_rag",
 				"macro_name", "execute", "code", "file", "no_stream", "no_memory",
 				"init_memory", "dry_run", "info", "build_tools", "install",
-				"install_from", "sync_models", "list_models", "list_roles",
+				"install_builtins", "sync_models", "list_models", "list_roles",
 				"list_sessions", "list_agents", "list_rags", "list_macros",
-				"list_skills", "skill", "tail_logs", "completions", "update",
+				"list_skills", "list_bundles", "skill", "tail_logs", "completions",
+				"update", "update_bundle", "uninstall",
 			])
 	),
 	group(
@@ -69,9 +70,9 @@ pub struct Cli {
     /// Select a LLM model
     #[arg(short, long, add = ArgValueCompleter::new(model_completer))]
     pub model: Option<String>,
-    /// Use the system prompt
+    /// Set a temporary role (an ad-hoc system prompt) for this invocation
     #[arg(long)]
-    pub prompt: Option<String>,
+    pub temp_role: Option<String>,
     /// Select a role
     #[arg(short, long, add = ArgValueCompleter::new(role_completer))]
     pub role: Option<String>,
@@ -96,6 +97,9 @@ pub struct Cli {
     /// Disable loading workspace MCP servers from .coyote/mcp.json, .coyote/.mcp.json, or .mcp.json
     #[arg(long)]
     pub no_workspace_mcp: bool,
+    /// Disable loading workspace macros from .coyote/macros
+    #[arg(long)]
+    pub no_workspace_macros: bool,
     /// Disable memory for this invocation
     #[arg(long)]
     pub no_memory: bool,
@@ -172,34 +176,79 @@ pub struct Cli {
     /// List all installed skills
     #[arg(long, help_heading = "List & Discovery")]
     pub list_skills: bool,
+    /// List installed bundles and their drift status
+    #[arg(long, help_heading = "List & Discovery")]
+    pub list_bundles: bool,
 
-    /// Reinstall bundled assets, overwriting any local changes
+    /// Install assets from a remote git repository (a URL or <owner>/<repo> shorthand, optionally suffixed with #<ref>), or update an already-installed bundle by name
     #[arg(
         long,
-        value_name = "CATEGORY",
+        value_name = "GIT_URL|OWNER/REPO|NAME",
-        value_enum,
+        conflicts_with_all = ["install_builtins", "update_bundle", "uninstall"],
         help_heading = "Installation & Updates"
     )]
-    pub install: Option<AssetCategory>,
+    pub install: Option<String>,
-    /// Install assets from a remote git repository (URL may be suffixed with #<ref>)
+    /// Git host used to expand <owner>/<repo> shorthand values passed to --install (also forces the value to be treated as a source when it matches an installed bundle name)
-    #[arg(long, value_name = "GIT_URL", help_heading = "Installation & Updates")]
+    #[arg(
-    pub install_from: Option<String>,
+        long,
-    /// Restrict --install-from to a single asset category
+        value_name = "HOST",
+        requires = "install",
+        conflicts_with_all = ["install_builtins", "update_bundle", "uninstall"],
+        help_heading = "Installation & Updates"
+    )]
+    pub git_host: Option<String>,
+    /// Reinstall bundled assets for a category (asks before overwriting your local changes)
     #[arg(
         long,
         value_name = "CATEGORY",
         value_enum,
-        requires = "install_from",
+        conflicts_with_all = ["update_bundle", "uninstall"],
+        help_heading = "Installation & Updates"
+    )]
+    pub install_builtins: Option<AssetCategory>,
+    /// Restrict a remote install to a single asset category
+    #[arg(
+        long,
+        value_name = "CATEGORY",
+        value_enum,
+        requires = "install",
+        conflicts_with_all = ["install_builtins", "update_bundle", "uninstall"],
         help_heading = "Installation & Updates"
     )]
     pub filter: Option<InstallFilter>,
-    /// Overwrite all conflicts without prompting (used with --install-from)
+    /// Overwrite all conflicts without prompting (remote installs only)
     #[arg(
         long,
-        requires = "install_from",
+        requires = "install",
+        conflicts_with_all = ["install_builtins", "update_bundle", "uninstall"],
         help_heading = "Installation & Updates"
     )]
     pub install_force: bool,
+    /// Update an installed bundle from its recorded source (NAME may be suffixed with #<ref> to move a pin)
+    #[arg(
+        long,
+        value_name = "NAME",
+        group = "yes_scope",
+        conflicts_with_all = ["uninstall"],
+        help_heading = "Installation & Updates"
+    )]
+    pub update_bundle: Option<String>,
+    /// Uninstall a bundle: delete its owned files and remove its mcp.json entries
+    #[arg(
+        long,
+        value_name = "NAME",
+        group = "yes_scope",
+        help_heading = "Installation & Updates"
+    )]
+    pub uninstall: Option<String>,
+    /// Proceed without prompts for --uninstall and --update-bundle (locally modified items are always kept)
+    #[arg(
+        long,
+        requires = "yes_scope",
+        conflicts_with_all = ["install", "install_builtins"],
+        help_heading = "Installation & Updates"
+    )]
+    pub yes: bool,
     /// Sync models updates
     #[arg(long, help_heading = "Installation & Updates")]
     pub sync_models: bool,
@@ -266,7 +315,7 @@ pub struct Cli {
     /// URL for http/sse MCP server (used with --mcp-add)
     #[arg(long, value_name = "URL", help_heading = "MCP Servers")]
     pub url: Option<String>,
-    /// Scope for MCP config: user (~/.config/coyote/functions/mcp.json) or workspace (./.coyote/mcp.json). Default: user
+    /// Scope for MCP config: user (~/.config/coyote/mcp.json) or workspace (./.coyote/mcp.json). Default: user
     #[arg(long, value_enum, value_name = "SCOPE", help_heading = "MCP Servers")]
     pub scope: Option<McpScopeArg>,
     /// Environment variable for stdio MCP server (repeatable): --env KEY=VALUE
@@ -492,6 +541,7 @@ mod tests {
         assert!(parse(&["--list-rags"]).list_rags);
         assert!(parse(&["--list-macros"]).list_macros);
         assert!(parse(&["--list-skills"]).list_skills);
+        assert!(parse(&["--list-bundles"]).list_bundles);
     }
 
     #[test]
@@ -500,6 +550,160 @@ mod tests {
         assert!(parse(&[]).skill.is_empty());
     }
 
+    #[test]
+    fn parse_update_bundle_flag_takes_name() {
+        assert_eq!(
+            parse(&["--update-bundle", "foo"]).update_bundle.as_deref(),
+            Some("foo")
+        );
+    }
+
+    #[test]
+    fn parse_uninstall_flag_takes_name() {
+        assert_eq!(
+            parse(&["--uninstall", "foo"]).uninstall.as_deref(),
+            Some("foo")
+        );
+        assert!(!parse(&["--uninstall", "foo"]).yes);
+    }
+
+    #[test]
+    fn parse_yes_flag_requires_uninstall_or_update_bundle() {
+        assert!(parse(&["--uninstall", "foo", "--yes"]).yes);
+        assert!(parse(&["--update-bundle", "foo", "--yes"]).yes);
+        assert!(Cli::try_parse_from(["coyote", "--yes"]).is_err());
+    }
+
+    #[test]
+    fn parse_install_flag_takes_url_or_name() {
+        assert_eq!(
+            parse(&["--install", "https://github.com/x/y"])
+                .install
+                .as_deref(),
+            Some("https://github.com/x/y")
+        );
+    }
+
+    #[test]
+    fn parse_install_builtins_flag_takes_category() {
+        assert_eq!(
+            parse(&["--install-builtins", "agents"]).install_builtins,
+            Some(AssetCategory::Agents)
+        );
+        assert_eq!(
+            parse(&["--install-builtins", "mcp-config"]).install_builtins,
+            Some(AssetCategory::McpConfig)
+        );
+        assert_eq!(
+            parse(&["--install-builtins", "mcp_config"]).install_builtins,
+            Some(AssetCategory::McpConfig)
+        );
+    }
+
+    #[test]
+    fn mcp_config_canonical_value_is_kebab_case() {
+        use clap::ValueEnum;
+
+        let category = AssetCategory::McpConfig.to_possible_value().unwrap();
+        assert_eq!(category.get_name(), "mcp-config");
+        assert!(category.get_name_and_aliases().any(|n| n == "mcp_config"));
+        assert!(AssetCategory::NAMES.contains(&"mcp-config"));
+        assert!(!AssetCategory::NAMES.contains(&"mcp_config"));
+
+        let filter = InstallFilter::McpConfig.to_possible_value().unwrap();
+        assert_eq!(filter.get_name(), "mcp-config");
+        assert!(filter.get_name_and_aliases().any(|n| n == "mcp_config"));
+        assert!(InstallFilter::NAMES.contains(&"mcp-config"));
+        assert!(!InstallFilter::NAMES.contains(&"mcp_config"));
+    }
+
+    #[test]
+    fn parse_install_builtins_conflicts_with_install() {
+        assert!(
+            Cli::try_parse_from(["coyote", "--install-builtins", "agents", "--install", "x"])
+                .is_err()
+        );
+    }
+
+    #[test]
+    fn parse_lifecycle_flags_are_mutually_exclusive() {
+        assert!(Cli::try_parse_from(["coyote", "--install", "x", "--uninstall", "y"]).is_err());
+        assert!(
+            Cli::try_parse_from(["coyote", "--update-bundle", "x", "--uninstall", "y"]).is_err()
+        );
+        assert!(
+            Cli::try_parse_from(["coyote", "--install-builtins", "agents", "--uninstall", "y"])
+                .is_err()
+        );
+        assert!(Cli::try_parse_from(["coyote", "--install", "x", "--update-bundle", "y"]).is_err());
+    }
+
+    #[test]
+    fn parse_companion_flags_conflict_with_other_lifecycle_actions() {
+        assert!(
+            Cli::try_parse_from(["coyote", "--update-bundle", "x", "--filter", "agents"]).is_err()
+        );
+        assert!(Cli::try_parse_from(["coyote", "--uninstall", "x", "--install-force"]).is_err());
+        assert!(Cli::try_parse_from(["coyote", "--install", "x", "--yes"]).is_err());
+    }
+
+    #[test]
+    fn parse_filter_requires_install() {
+        assert!(Cli::try_parse_from(["coyote", "--filter", "agents"]).is_err());
+        assert_eq!(
+            parse(&["--install", "https://github.com/x/y", "--filter", "agents"]).filter,
+            Some(InstallFilter::Agents)
+        );
+        assert_eq!(
+            parse(&[
+                "--install",
+                "https://github.com/x/y",
+                "--filter",
+                "mcp-config"
+            ])
+            .filter,
+            Some(InstallFilter::McpConfig)
+        );
+        assert_eq!(
+            parse(&[
+                "--install",
+                "https://github.com/x/y",
+                "--filter",
+                "mcp_config"
+            ])
+            .filter,
+            Some(InstallFilter::McpConfig)
+        );
+    }
+
+    #[test]
+    fn parse_install_force_requires_install() {
+        assert!(Cli::try_parse_from(["coyote", "--install-force"]).is_err());
+        assert!(parse(&["--install", "https://github.com/x/y", "--install-force"]).install_force);
+    }
+
+    #[test]
+    fn parse_git_host_requires_install() {
+        assert!(Cli::try_parse_from(["coyote", "--git-host", "git.x.com"]).is_err());
+        assert!(
+            Cli::try_parse_from(["coyote", "--git-host", "gitlab.com", "--update-bundle", "x"])
+                .is_err()
+        );
+        assert_eq!(
+            parse(&["--install", "someuser/omc", "--git-host", "git.x.com"])
+                .git_host
+                .as_deref(),
+            Some("git.x.com")
+        );
+    }
+
+    #[test]
+    fn help_shows_install_builtins() {
+        use clap::CommandFactory;
+        let help = Cli::command().render_long_help().to_string();
+        assert!(help.contains("--install-builtins"));
+    }
+
     #[test]
     fn parse_multiple_skill_flags_preserves_order() {
         assert_eq!(
@@ -542,9 +746,9 @@ mod tests {
     }
 
     #[test]
-    fn parse_prompt_flag() {
+    fn parse_temp_role_flag() {
-        let cli = parse(&["--prompt", "be a pirate"]);
+        let cli = parse(&["--temp-role", "be a pirate"]);
-        assert_eq!(cli.prompt, Some("be a pirate".to_string()));
+        assert_eq!(cli.temp_role, Some("be a pirate".to_string()));
     }
 
     #[test]
@@ -765,10 +969,7 @@ mod tests {
         assert_eq!(cli.mcp_add, Some("notion".to_string()));
         assert!(matches!(cli.transport, Some(McpTransportArg::Http)));
         assert_eq!(cli.url, Some("https://mcp.notion.com/mcp".to_string()));
-        assert_eq!(
+        assert_eq!(cli.header, vec!["Authorization: Bearer {{NOTION_TOKEN}}"]);
-            cli.header,
-            vec!["Authorization: Bearer {{NOTION_TOKEN}}"]
-        );
         assert!(cli.mcp_command.is_empty());
     }
 

src/client/access_token.rs

@@ -2,6 +2,7 @@ use anyhow::{Result, anyhow};
 use chrono::Utc;
 use indexmap::IndexMap;
 use parking_lot::RwLock;
+use std::collections::HashMap;
 use std::sync::LazyLock;
 
 type AccessTokenEntry = (String, i64, Option<String>);
@@ -9,6 +10,12 @@ type AccessTokenEntry = (String, i64, Option<String>);
 static ACCESS_TOKENS: LazyLock<RwLock<IndexMap<String, AccessTokenEntry>>> =
     LazyLock::new(|| RwLock::new(IndexMap::new()));
 
+/// Tokens a provider rejected (401) despite being locally unexpired.
+/// Maps client name → the exact rejected token so a concurrently-refreshed
+/// different token is never distrusted by mistake.
+static REJECTED_TOKENS: LazyLock<RwLock<HashMap<String, String>>> =
+    LazyLock::new(|| RwLock::new(HashMap::new()));
+
 pub fn get_access_token(client_name: &str) -> Result<String> {
     ACCESS_TOKENS
         .read()
@@ -30,7 +37,7 @@ pub fn is_valid_access_token(client_name: &str) -> bool {
         Some(v) => v,
         None => return false,
     };
-    !token.is_empty() && Utc::now().timestamp() < *expires_at
+    !token.is_empty() && Utc::now().timestamp() < *expires_at && !is_rejected(client_name, token)
 }
 
 pub fn set_access_token(
@@ -45,3 +52,111 @@ pub fn set_access_token(
     entry.1 = expires_at;
     entry.2 = account_id;
 }
+
+/// Compare-and-invalidate a provider-rejected token.
+///
+/// Only if the currently-cached token EQUALS `rejected` is the cache entry
+/// removed and the rejection marker recorded; a concurrently-refreshed
+/// different token is left untouched and no marker is set.
+///
+/// Returns true if a cache entry existed for this client at all (whether or
+/// not it matched `rejected`) — i.e. the client is token-authed and a retry
+/// after refresh is worthwhile. Returns false when there is no entry
+/// (API-key clients).
+pub fn distrust_access_token(client_name: &str, rejected: &str) -> bool {
+    let mut access_tokens = ACCESS_TOKENS.write();
+    let (token, _, _) = match access_tokens.get(client_name) {
+        Some(v) => v,
+        None => return false,
+    };
+    if token == rejected {
+        access_tokens.shift_remove(client_name);
+        REJECTED_TOKENS
+            .write()
+            .insert(client_name.to_string(), rejected.to_string());
+    }
+    true
+}
+
+pub fn is_rejected(client_name: &str, token: &str) -> bool {
+    REJECTED_TOKENS
+        .read()
+        .get(client_name)
+        .is_some_and(|rejected| rejected == token)
+}
+
+pub fn clear_rejected(client_name: &str) {
+    REJECTED_TOKENS.write().remove(client_name);
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn distrust_removes_matching_token_and_sets_marker() {
+        let client = "distrust-match-test";
+        set_access_token(client, "at-1".into(), Utc::now().timestamp() + 3600, None);
+
+        assert!(distrust_access_token(client, "at-1"));
+
+        assert!(get_access_token(client).is_err(), "cache entry not removed");
+        assert!(is_rejected(client, "at-1"), "marker not set");
+    }
+
+    #[test]
+    fn distrust_keeps_differing_token_and_skips_marker() {
+        let client = "distrust-differ-test";
+        set_access_token(client, "at-new".into(), Utc::now().timestamp() + 3600, None);
+
+        assert!(distrust_access_token(client, "at-old"));
+
+        assert_eq!(get_access_token(client).unwrap(), "at-new");
+        assert!(!is_rejected(client, "at-old"), "marker set for stale token");
+    }
+
+    #[test]
+    fn distrust_returns_false_without_cache_entry() {
+        let client = "distrust-missing-test";
+
+        assert!(!distrust_access_token(client, "at-1"));
+        assert!(!is_rejected(client, "at-1"));
+    }
+
+    #[test]
+    fn is_valid_access_token_false_for_rejected_token() {
+        let client = "rejected-valid-test";
+        set_access_token(client, "at-1".into(), Utc::now().timestamp() + 3600, None);
+        assert!(is_valid_access_token(client));
+
+        distrust_access_token(client, "at-1");
+        // A concurrent in-flight prepare re-caches the rejected file token
+        // between mark and refresh; it must still be treated as invalid.
+        set_access_token(client, "at-1".into(), Utc::now().timestamp() + 3600, None);
+
+        assert!(!is_valid_access_token(client));
+    }
+
+    #[test]
+    fn clear_rejected_clears_marker_and_clients_are_isolated() {
+        let client_a = "rejected-isolation-a";
+        let client_b = "rejected-isolation-b";
+        set_access_token(client_a, "at-1".into(), Utc::now().timestamp() + 3600, None);
+        distrust_access_token(client_a, "at-1");
+
+        assert!(is_rejected(client_a, "at-1"));
+        assert!(
+            !is_rejected(client_b, "at-1"),
+            "marker leaked across clients"
+        );
+
+        clear_rejected(client_b);
+        assert!(
+            is_rejected(client_a, "at-1"),
+            "wrong client's marker cleared"
+        );
+
+        clear_rejected(client_a);
+        assert!(!is_rejected(client_a, "at-1"));
+    }
+}

src/client/common.rs

@@ -1,5 +1,6 @@
 use super::*;
 
+use super::access_token::{distrust_access_token, get_access_token};
 use crate::config::{RenderMode, paths};
 use crate::{
     config::{AppConfig, Input, RequestContext},
@@ -56,12 +57,16 @@ pub trait Client: Sync + Send {
         let mut builder = ReqwestClient::builder();
         let extra = self.extra_config();
         let timeout = extra.and_then(|v| v.connect_timeout).unwrap_or(10);
+        let read_timeout = extra.and_then(|v| v.read_timeout).unwrap_or(300);
         if let Some(proxy) = extra.and_then(|v| v.proxy.as_deref()) {
             builder = set_proxy(builder, proxy)?;
         }
         if let Some(user_agent) = self.app_config().user_agent.as_ref() {
             builder = builder.user_agent(user_agent);
         }
+        if read_timeout > 0 {
+            builder = builder.read_timeout(Duration::from_secs(read_timeout));
+        }
         let client = builder
             .connect_timeout(Duration::from_secs(timeout))
             .build()
@@ -69,6 +74,11 @@ pub trait Client: Sync + Send {
         Ok(client)
     }
 
+    /// On a 401 the cached access token is distrusted and the call retried
+    /// exactly once; the retry re-runs the per-client prepare step, which
+    /// sees the rejection marker, force-refreshes the token, and rebuilds
+    /// the whole request. A second 401 propagates the original error; any
+    /// other retry failure propagates as-is.
     async fn chat_completions(&self, input: Input) -> Result<ChatCompletionsOutput> {
         if self.app_config().dry_run {
             let content = input.echo_messages();
@@ -76,11 +86,30 @@ pub trait Client: Sync + Send {
         }
         let client = self.build_client()?;
         let data = input.prepare_completion_data(self.model(), false)?;
-        self.chat_completions_inner(&client, data)
+        let err = match self.chat_completions_inner(&client, data).await {
-            .await
+            Ok(output) => return Ok(output),
-            .with_context(|| "Failed to call chat-completions api")
+            Err(err) => err,
+        };
+        let ret = if should_retry_auth(&err, self.name()) {
+            debug!(
+                "provider '{}' rejected access token (401); refreshing and retrying once",
+                self.name()
+            );
+            let data = input.prepare_completion_data(self.model(), false)?;
+            match self.chat_completions_inner(&client, data).await {
+                Err(retry_err) if is_auth_error(&retry_err) => Err(err),
+                ret => ret,
+            }
+        } else {
+            Err(err)
+        };
+        ret.with_context(|| "Failed to call chat-completions api")
     }
 
+    /// Same retry-once-on-401 semantics as [`Self::chat_completions`], but
+    /// only while the handler has received nothing yet: retrying after
+    /// partial output has streamed would render it to the user twice. The
+    /// retry lives inside the same `select!` arm so abort stays responsive.
     async fn chat_completions_streaming(
         &self,
         input: &Input,
@@ -97,7 +126,22 @@ pub trait Client: Sync + Send {
                 }
                 let client = self.build_client()?;
                 let data = input.prepare_completion_data(self.model(), true)?;
-                self.chat_completions_streaming_inner(&client, handler, data).await
+                let err = match self.chat_completions_streaming_inner(&client, handler, data).await {
+                    Ok(()) => return Ok(()),
+                    Err(err) => err,
+                };
+                if handler.has_received_content() || !should_retry_auth(&err, self.name()) {
+                    return Err(err);
+                }
+                debug!(
+                    "provider '{}' rejected access token (401); refreshing and retrying once",
+                    self.name()
+                );
+                let data = input.prepare_completion_data(self.model(), true)?;
+                match self.chat_completions_streaming_inner(&client, handler, data).await {
+                    Err(retry_err) if is_auth_error(&retry_err) => Err(err),
+                    ret => ret,
+                }
             } => {
                 handler.done();
                 ret.with_context(|| "Failed to call chat-completions api")
@@ -109,11 +153,27 @@ pub trait Client: Sync + Send {
         }
     }
 
+    /// Same retry-once-on-401 semantics as [`Self::chat_completions`]
+    /// (gemini OAuth embeddings route here).
     async fn embeddings(&self, data: &EmbeddingsData) -> Result<Vec<Vec<f32>>> {
         let client = self.build_client()?;
-        self.embeddings_inner(&client, data)
+        let err = match self.embeddings_inner(&client, data).await {
-            .await
+            Ok(output) => return Ok(output),
-            .context("Failed to call embeddings api")
+            Err(err) => err,
+        };
+        let ret = if should_retry_auth(&err, self.name()) {
+            debug!(
+                "provider '{}' rejected access token (401); refreshing and retrying once",
+                self.name()
+            );
+            match self.embeddings_inner(&client, data).await {
+                Err(retry_err) if is_auth_error(&retry_err) => Err(err),
+                ret => ret,
+            }
+        } else {
+            Err(err)
+        };
+        ret.context("Failed to call embeddings api")
     }
 
     async fn rerank(&self, data: &RerankData) -> Result<RerankOutput> {
@@ -205,6 +265,7 @@ impl Default for ClientConfig {
 pub struct ExtraConfig {
     pub proxy: Option<String>,
     pub connect_timeout: Option<u64>,
+    pub read_timeout: Option<u64>,
 }
 
 #[derive(Debug, Clone, Deserialize, Default)]
@@ -557,46 +618,90 @@ pub async fn noop_rerank(_builder: RequestBuilder, _model: &Model) -> Result<Rer
     bail!("The client doesn't support rerank api")
 }
 
+#[derive(Debug)]
+pub struct ApiStatusError {
+    pub status: u16,
+    pub message: String,
+}
+
+impl std::fmt::Display for ApiStatusError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}", self.message)
+    }
+}
+
+impl std::error::Error for ApiStatusError {}
+
+/// True when the error chain bottoms out in an [`ApiStatusError`] with
+/// status 401 EXACTLY. 403 (entitlement) and 429 (rate limit) are never
+/// auth failures, and message text is never inspected.
+fn is_auth_error(err: &anyhow::Error) -> bool {
+    err.downcast_ref::<ApiStatusError>()
+        .is_some_and(|api_err| api_err.status == 401)
+}
+
+/// Decides whether a 401 from `client_name` warrants a single retry after a
+/// forced token refresh: the error must be a 401 [`ApiStatusError`], and the
+/// client must have a cached access token to distrust (API-key clients have
+/// none and never retry). Distrusting marks the exact rejected token so the
+/// retry's prepare step force-refreshes it. There is deliberately no backoff:
+/// the blast radius is bounded at one extra request per user-visible call.
+///
+/// Note: vertexai shares the ACCESS_TOKENS cache, so a 401 there also
+/// triggers distrust+retry — deliberate.
+fn should_retry_auth(err: &anyhow::Error, client_name: &str) -> bool {
+    if !is_auth_error(err) {
+        return false;
+    }
+    let Ok(token) = get_access_token(client_name) else {
+        return false;
+    };
+    distrust_access_token(client_name, &token)
+}
+
 pub fn catch_error(data: &Value, status: u16) -> Result<()> {
     if (200..300).contains(&status) {
         return Ok(());
     }
     debug!("Invalid response, status: {status}, data: {data}");
+    let api_error = |message: String| anyhow::Error::new(ApiStatusError { status, message });
     if let Some(error) = data["error"].as_object() {
         if let (Some(typ), Some(message)) = (
             json_str_from_map(error, "type"),
             json_str_from_map(error, "message"),
         ) {
-            bail!("{message} (type: {typ})");
+            return Err(api_error(format!("{message} (type: {typ})")));
         } else if let (Some(typ), Some(message)) = (
             json_str_from_map(error, "code"),
             json_str_from_map(error, "message"),
         ) {
-            bail!("{message} (code: {typ})");
+            return Err(api_error(format!("{message} (code: {typ})")));
         }
     } else if let Some(error) = data["errors"][0].as_object() {
         if let (Some(code), Some(message)) = (
             error.get("code").and_then(|v| v.as_u64()),
             json_str_from_map(error, "message"),
         ) {
-            bail!("{message} (status: {code})")
+            return Err(api_error(format!("{message} (status: {code})")));
         }
     } else if let Some(error) = data[0]["error"].as_object() {
         if let (Some(status), Some(message)) = (
             json_str_from_map(error, "status"),
             json_str_from_map(error, "message"),
         ) {
-            bail!("{message} (status: {status})")
+            return Err(api_error(format!("{message} (status: {status})")));
         }
     } else if let (Some(detail), Some(status)) = (data["detail"].as_str(), data["status"].as_i64())
     {
-        bail!("{detail} (status: {status})");
+        return Err(api_error(format!("{detail} (status: {status})")));
     } else if let Some(error) = data["error"].as_str() {
-        bail!("{error}");
+        return Err(api_error(error.to_string()));
     } else if let Some(message) = data["message"].as_str() {
-        bail!("{message}");
+        return Err(api_error(message.to_string()));
     }
-    bail!("Invalid response data: {data} (status: {status})");
+    Err(api_error(format!(
+        "Invalid response data: {data} (status: {status})"
+    )))
 }
 
 pub fn json_str_from_map<'a>(
@@ -737,3 +842,172 @@ fn prompt_input_string(desc: &str, required: bool, help_message: Option<&str>) -
     let text = text.prompt()?;
     Ok(text)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    use super::super::access_token::{is_rejected, set_access_token};
+
+    fn catch_error_message(data: &Value, status: u16) -> String {
+        catch_error(data, status).unwrap_err().to_string()
+    }
+
+    #[test]
+    fn test_catch_error_display_json_with_type() {
+        let data = json!({"error": {"type": "invalid_request_error", "message": "Bad request"}});
+        assert_eq!(
+            catch_error_message(&data, 400),
+            "Bad request (type: invalid_request_error)"
+        );
+    }
+
+    #[test]
+    fn test_catch_error_display_json_with_code() {
+        let data = json!({"error": {"code": "rate_limited", "message": "Too many requests"}});
+        assert_eq!(
+            catch_error_message(&data, 429),
+            "Too many requests (code: rate_limited)"
+        );
+    }
+
+    #[test]
+    fn test_catch_error_display_errors_array() {
+        let data = json!({"errors": [{"code": 7000, "message": "No route"}]});
+        assert_eq!(catch_error_message(&data, 404), "No route (status: 7000)");
+    }
+
+    #[test]
+    fn test_catch_error_display_array_error_status() {
+        let data = json!([{"error": {"status": "PERMISSION_DENIED", "message": "Denied"}}]);
+        assert_eq!(
+            catch_error_message(&data, 403),
+            "Denied (status: PERMISSION_DENIED)"
+        );
+    }
+
+    #[test]
+    fn test_catch_error_display_detail_status() {
+        let data = json!({"detail": "Not found", "status": 404});
+        assert_eq!(catch_error_message(&data, 404), "Not found (status: 404)");
+    }
+
+    #[test]
+    fn test_catch_error_display_error_string() {
+        let data = json!({"error": "Something went wrong"});
+        assert_eq!(catch_error_message(&data, 500), "Something went wrong");
+    }
+
+    #[test]
+    fn test_catch_error_display_message_string() {
+        let data = json!({"message": "Unauthorized"});
+        assert_eq!(catch_error_message(&data, 401), "Unauthorized");
+    }
+
+    #[test]
+    fn test_catch_error_display_fallback() {
+        let data = json!({"unexpected": true});
+        assert_eq!(
+            catch_error_message(&data, 500),
+            format!("Invalid response data: {data} (status: 500)")
+        );
+    }
+
+    #[test]
+    fn test_catch_error_ok_on_success_status() {
+        let data = json!({"error": {"type": "x", "message": "y"}});
+        assert!(catch_error(&data, 200).is_ok());
+        assert!(catch_error(&data, 299).is_ok());
+    }
+
+    #[test]
+    fn test_catch_error_downcast_through_context_chain() {
+        let data = json!({"error": {"type": "authentication_error", "message": "Invalid key"}});
+        let err = catch_error(&data, 401)
+            .context("Failed to call chat-completions api")
+            .unwrap_err();
+        let api_err = err
+            .downcast_ref::<ApiStatusError>()
+            .expect("should downcast through context chain");
+        assert_eq!(api_err.status, 401);
+        assert_eq!(api_err.message, "Invalid key (type: authentication_error)");
+    }
+
+    #[test]
+    fn test_catch_error_preserves_status() {
+        let data = json!({"message": "Unauthorized"});
+        let err = catch_error(&data, 401).unwrap_err();
+        assert_eq!(err.downcast_ref::<ApiStatusError>().unwrap().status, 401);
+
+        let data = json!({"detail": "Rate limited", "status": 429});
+        let err = catch_error(&data, 429).unwrap_err();
+        assert_eq!(err.downcast_ref::<ApiStatusError>().unwrap().status, 429);
+
+        // The struct carries the outer HTTP status even when the body embeds another code
+        let data = json!({"errors": [{"code": 7000, "message": "No route"}]});
+        let err = catch_error(&data, 429).unwrap_err();
+        assert_eq!(err.downcast_ref::<ApiStatusError>().unwrap().status, 429);
+    }
+
+    /// Wrapped in `.context(...)` so every test below proves the downcast
+    /// works through an anyhow context chain, as in the trait methods.
+    fn api_status_error(status: u16) -> anyhow::Error {
+        anyhow::Error::new(ApiStatusError {
+            status,
+            message: format!("error (status: {status})"),
+        })
+        .context("Failed to call chat-completions api")
+    }
+
+    fn cache_token(client: &str, token: &str) {
+        set_access_token(
+            client,
+            token.into(),
+            chrono::Utc::now().timestamp() + 3600,
+            None,
+        );
+    }
+
+    #[test]
+    fn test_should_retry_auth_401_with_cached_token() {
+        let client = "should-retry-auth-401";
+        cache_token(client, "at-1");
+
+        assert!(should_retry_auth(&api_status_error(401), client));
+        assert!(is_rejected(client, "at-1"), "rejected marker not set");
+    }
+
+    #[test]
+    fn test_should_retry_auth_non_401_statuses() {
+        let client = "should-retry-auth-non-401";
+        cache_token(client, "at-1");
+
+        for status in [403, 429, 500] {
+            assert!(
+                !should_retry_auth(&api_status_error(status), client),
+                "retried on {status}"
+            );
+        }
+        assert_eq!(get_access_token(client).unwrap(), "at-1");
+        assert!(!is_rejected(client, "at-1"), "marker set without a 401");
+    }
+
+    #[test]
+    fn test_should_retry_auth_non_api_status_error() {
+        let client = "should-retry-auth-non-api";
+        cache_token(client, "at-1");
+
+        let err = anyhow::anyhow!("connection reset").context("Failed to call embeddings api");
+        assert!(!should_retry_auth(&err, client));
+        assert_eq!(get_access_token(client).unwrap(), "at-1");
+        assert!(!is_rejected(client, "at-1"));
+    }
+
+    #[test]
+    fn test_should_retry_auth_401_without_cached_token() {
+        let client = "should-retry-auth-no-token";
+
+        assert!(!should_retry_auth(&api_status_error(401), client));
+        assert!(!is_rejected(client, "at-1"));
+    }
+}

src/client/oauth.rs

@@ -1,14 +1,14 @@
-use super::access_token::{is_valid_access_token, set_access_token};
+use super::access_token::{clear_rejected, is_rejected, is_valid_access_token, set_access_token};
 use super::openai_compatible_oauth::OpenAICompatibleOAuthProvider;
 use super::{ClientConfig, ProviderModels};
 use crate::config::paths;
-use anyhow::{Context, Result, anyhow, bail};
+use anyhow::{Context, Error, Result, anyhow, bail};
 use base64::Engine;
 use base64::engine::general_purpose::URL_SAFE_NO_PAD;
 use chrono::Utc;
 use indexmap::IndexMap;
 use inquire::Text;
-use reqwest::{Client as ReqwestClient, RequestBuilder};
+use reqwest::{Client as ReqwestClient, RequestBuilder, StatusCode};
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 use sha2::{Digest, Sha256};
@@ -16,6 +16,10 @@ use std::collections::HashMap;
 use std::fs;
 use std::io::{BufRead, BufReader, Write};
 use std::net::TcpListener;
+use std::path::PathBuf;
+use std::sync::{Arc, OnceLock};
+use std::time::Duration;
+use tokio::sync;
 use url::Url;
 use uuid::Uuid;
 
@@ -197,10 +201,20 @@ pub struct OAuthTokens {
     pub account_id: Option<String>,
 }
 
+const TOKEN_ENDPOINT_TIMEOUT: Duration = Duration::from_secs(30);
+
 pub async fn run_oauth_flow(provider: &dyn OAuthProvider, client_name: &str) -> Result<()> {
     match provider.flow() {
         OAuthFlow::Pkce => run_pkce_flow(provider, client_name).await,
-        OAuthFlow::ClientCredentials => run_client_credentials_flow(provider, client_name).await,
+        OAuthFlow::ClientCredentials => {
+            run_client_credentials_flow(provider, client_name).await?;
+            println!(
+                "Successfully authenticated client '{}' with {} via OAuth (client_credentials). Tokens saved.",
+                client_name,
+                provider.provider_name()
+            );
+            Ok(())
+        }
         OAuthFlow::DeviceCode => run_device_code_flow(provider, client_name).await,
     }
 }
@@ -301,12 +315,20 @@ async fn run_pkce_flow(provider: &dyn OAuthProvider, client_name: &str) -> Resul
 
     let access_token = response["access_token"]
         .as_str()
-        .ok_or_else(|| anyhow!("Missing access_token in response: {response}"))?
+        .ok_or_else(|| {
+            anyhow!(
+                "Missing access_token in response (keys: {})",
+                token_response_keys(&response)
+            )
+        })?
         .to_string();
     let refresh_token = response["refresh_token"].as_str().map(|s| s.to_string());
-    let expires_in = response["expires_in"]
+    let expires_in = response["expires_in"].as_i64().ok_or_else(|| {
-        .as_i64()
+        anyhow!(
-        .ok_or_else(|| anyhow!("Missing expires_in in response: {response}"))?;
+            "Missing expires_in in response (keys: {})",
+            token_response_keys(&response)
+        )
+    })?;
 
     let expires_at = Utc::now().timestamp() + expires_in;
 
@@ -334,7 +356,9 @@ async fn run_client_credentials_flow(
     provider: &dyn OAuthProvider,
     client_name: &str,
 ) -> Result<()> {
-    let client = ReqwestClient::new();
+    let client = ReqwestClient::builder()
+        .timeout(TOKEN_ENDPOINT_TIMEOUT)
+        .build()?;
     let scopes = provider.scopes();
     let mut params: Vec<(&str, &str)> = vec![
         ("grant_type", "client_credentials"),
@@ -349,11 +373,19 @@ async fn run_client_credentials_flow(
 
     let access_token = response["access_token"]
         .as_str()
-        .ok_or_else(|| anyhow!("Missing access_token in client_credentials response: {response}"))?
+        .ok_or_else(|| {
+            anyhow!(
+                "Missing access_token in client_credentials response (keys: {})",
+                token_response_keys(&response)
+            )
+        })?
         .to_string();
-    let expires_in = response["expires_in"]
+    let expires_in = response["expires_in"].as_i64().ok_or_else(|| {
-        .as_i64()
+        anyhow!(
-        .ok_or_else(|| anyhow!("Missing expires_in in client_credentials response: {response}"))?;
+            "Missing expires_in in client_credentials response (keys: {})",
+            token_response_keys(&response)
+        )
+    })?;
     let expires_at = Utc::now().timestamp() + expires_in;
 
     let tokens = OAuthTokens {
@@ -363,11 +395,6 @@ async fn run_client_credentials_flow(
         account_id: provider.extract_account_id(&response),
     };
     save_oauth_tokens(client_name, &tokens)?;
-    println!(
-        "Successfully authenticated client '{}' with {} via OAuth (client_credentials). Tokens saved.",
-        client_name,
-        provider.provider_name()
-    );
 
     Ok(())
 }
@@ -417,19 +444,28 @@ async fn run_device_code_flow(provider: &dyn OAuthProvider, client_name: &str) -
     let device_code = device_response["device_code"]
         .as_str()
         .ok_or_else(|| {
-            anyhow!("Missing device_code in device authorization response: {device_response}")
+            anyhow!(
+                "Missing device_code in device authorization response (keys: {})",
+                token_response_keys(&device_response)
+            )
         })?
         .to_string();
     let user_code = device_response["user_code"]
         .as_str()
         .ok_or_else(|| {
-            anyhow!("Missing user_code in device authorization response: {device_response}")
+            anyhow!(
+                "Missing user_code in device authorization response (keys: {})",
+                token_response_keys(&device_response)
+            )
         })?
         .to_string();
     let verification_uri = device_response["verification_uri"]
         .as_str()
         .ok_or_else(|| {
-            anyhow!("Missing verification_uri in device authorization response: {device_response}")
+            anyhow!(
+                "Missing verification_uri in device authorization response (keys: {})",
+                token_response_keys(&device_response)
+            )
         })?
         .to_string();
     let verification_uri_complete = device_response["verification_uri_complete"]
@@ -551,10 +587,76 @@ fn save_oauth_tokens(client_name: &str, tokens: &OAuthTokens) -> Result<()> {
         fs::create_dir_all(parent)?;
     }
     let json = serde_json::to_string_pretty(tokens)?;
-    fs::write(path, json)?;
+    // Write-then-rename so a crash mid-write never truncates the live token file.
+    let mut tmp = path.clone().into_os_string();
+    tmp.push(".tmp");
+    let tmp = PathBuf::from(tmp);
+    // Tokens are live credentials: create the file owner-only, not umask-default.
+    let mut options = fs::OpenOptions::new();
+    options.write(true).create(true).truncate(true);
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::OpenOptionsExt;
+        options.mode(0o600);
+    }
+    options.open(&tmp)?.write_all(json.as_bytes())?;
+    fs::rename(&tmp, &path)?;
     Ok(())
 }
 
+pub(crate) fn token_response_keys(response: &Value) -> String {
+    match response.as_object() {
+        Some(map) => {
+            let keys: Vec<&str> = map.keys().map(String::as_str).collect();
+            format!("[{}]", keys.join(", "))
+        }
+        None => "<non-object response>".to_string(),
+    }
+}
+
+fn parse_refresh_response(
+    status: StatusCode,
+    response: &Value,
+    previous_refresh_token: Option<&str>,
+) -> Result<(String, Option<String>, i64)> {
+    if let Some(error) = response["error"].as_str() {
+        let description = response["error_description"]
+            .as_str()
+            .unwrap_or("no description");
+        if matches!(error, "invalid_grant" | "invalid_token") {
+            bail!(
+                "OAuth refresh token was rejected ({error}: {description}). Please re-authenticate."
+            );
+        }
+        bail!("Token refresh failed ({error}: {description})");
+    }
+    if !status.is_success() {
+        bail!("Token refresh failed with HTTP status {status}");
+    }
+
+    let access_token = response["access_token"]
+        .as_str()
+        .ok_or_else(|| {
+            anyhow!(
+                "Missing access_token in refresh response (keys: {})",
+                token_response_keys(response)
+            )
+        })?
+        .to_string();
+    let refresh_token = response["refresh_token"]
+        .as_str()
+        .or(previous_refresh_token)
+        .map(str::to_string);
+    let expires_in = response["expires_in"].as_i64().ok_or_else(|| {
+        anyhow!(
+            "Missing expires_in in refresh response (keys: {})",
+            token_response_keys(response)
+        )
+    })?;
+
+    Ok((access_token, refresh_token, expires_in))
+}
+
 pub async fn refresh_oauth_token(
     client: &ReqwestClient,
     provider: &dyn OAuthProvider,
@@ -577,19 +679,23 @@ pub async fn refresh_oauth_token(
         ],
     );
 
-    let response: Value = request.send().await?.json().await?;
+    let (status, response) = tokio::time::timeout(TOKEN_ENDPOINT_TIMEOUT, async {
+        let response = request.send().await?;
+        let status = response.status();
+        let body: Value = response.json().await?;
+        Ok::<_, Error>((status, body))
+    })
+    .await
+    .map_err(|_| {
+        anyhow!(
+            "Token refresh for '{}' timed out after {}s",
+            client_name,
+            TOKEN_ENDPOINT_TIMEOUT.as_secs()
+        )
+    })??;
 
-    let access_token = response["access_token"]
+    let (access_token, refresh_token, expires_in) =
-        .as_str()
+        parse_refresh_response(status, &response, tokens.refresh_token.as_deref())?;
-        .ok_or_else(|| anyhow!("Missing access_token in refresh response: {response}"))?
-        .to_string();
-    let refresh_token = response["refresh_token"]
-        .as_str()
-        .map(|s| s.to_string())
-        .or_else(|| tokens.refresh_token.clone());
-    let expires_in = response["expires_in"]
-        .as_i64()
-        .ok_or_else(|| anyhow!("Missing expires_in in refresh response: {response}"))?;
 
     let expires_at = Utc::now().timestamp() + expires_in;
 
@@ -609,6 +715,20 @@ pub async fn refresh_oauth_token(
     Ok(new_tokens)
 }
 
+/// Per-client lock so concurrent requests perform a single refresh.
+/// Returns a clone of the Arc so the parking_lot guard is dropped before the
+/// caller awaits on the tokio mutex.
+fn refresh_guard(client_name: &str) -> Arc<sync::Mutex<()>> {
+    static GUARDS: OnceLock<parking_lot::Mutex<HashMap<String, Arc<sync::Mutex<()>>>>> =
+        OnceLock::new();
+    GUARDS
+        .get_or_init(Default::default)
+        .lock()
+        .entry(client_name.to_string())
+        .or_default()
+        .clone()
+}
+
 pub async fn prepare_oauth_access_token(
     client: &ReqwestClient,
     provider: &dyn OAuthProvider,
@@ -623,16 +743,40 @@ pub async fn prepare_oauth_access_token(
         None => return Ok(false),
     };
 
-    let tokens = if Utc::now().timestamp() >= tokens.expires_at {
+    let tokens = if Utc::now().timestamp() >= tokens.expires_at
-        match provider.flow() {
+        || is_rejected(client_name, &tokens.access_token)
-            OAuthFlow::Pkce | OAuthFlow::DeviceCode => {
+    {
-                refresh_oauth_token(client, provider, client_name, &tokens).await?
+        let guard = refresh_guard(client_name);
-            }
+        let _guard = guard.lock().await;
-            OAuthFlow::ClientCredentials => {
+
-                run_client_credentials_flow(provider, client_name).await?;
+        // A concurrent caller may have refreshed while we waited for the
-                load_oauth_tokens(client_name)
+        // lock; a valid in-memory token means the winner already populated
-                    .ok_or_else(|| anyhow!("Token file missing after client_credentials refresh"))?
+        // the cache.
+        if is_valid_access_token(client_name) {
+            return Ok(true);
+        }
+
+        let tokens = match load_oauth_tokens(client_name) {
+            Some(t) => t,
+            None => return Ok(false),
+        };
+
+        if Utc::now().timestamp() >= tokens.expires_at
+            || is_rejected(client_name, &tokens.access_token)
+        {
+            match provider.flow() {
+                OAuthFlow::Pkce | OAuthFlow::DeviceCode => {
+                    refresh_oauth_token(client, provider, client_name, &tokens).await?
+                }
+                OAuthFlow::ClientCredentials => {
+                    run_client_credentials_flow(provider, client_name).await?;
+                    load_oauth_tokens(client_name).ok_or_else(|| {
+                        anyhow!("Token file missing after client_credentials refresh")
+                    })?
+                }
             }
+        } else {
+            tokens
         }
     } else {
         tokens
@@ -644,6 +788,9 @@ pub async fn prepare_oauth_access_token(
         tokens.expires_at,
         tokens.account_id,
     );
+    // Clear even when the refresh returned the same token (some IdPs reuse
+    // JWTs within validity); otherwise every request re-hits the token endpoint.
+    clear_rejected(client_name);
 
     Ok(true)
 }
@@ -886,11 +1033,55 @@ pub(crate) fn client_config_info(
 
 #[cfg(test)]
 mod tests {
+    use std::ffi::OsString;
+    use std::path::PathBuf;
     use std::str;
+    use std::time::UNIX_EPOCH;
 
     use super::*;
+    use crate::client::access_token::{distrust_access_token, get_access_token};
     use crate::client::openai_compatible::OpenAICompatibleConfig;
     use crate::client::{ModelData, ProviderModels};
+    use crate::utils::get_env_name;
+    use serial_test::serial;
+    use std::{env, time::SystemTime};
+
+    fn with_temp_cache<F: FnOnce()>(f: F) {
+        struct Restore {
+            key: String,
+            prev: Option<OsString>,
+            root: PathBuf,
+        }
+        impl Drop for Restore {
+            fn drop(&mut self) {
+                unsafe {
+                    match self.prev.take() {
+                        Some(v) => env::set_var(&self.key, v),
+                        None => env::remove_var(&self.key),
+                    }
+                }
+                let _ = fs::remove_dir_all(&self.root);
+            }
+        }
+
+        let unique = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap()
+            .as_nanos();
+        let root = env::temp_dir().join(format!("coyote-client-oauth-test-{unique}"));
+        fs::create_dir_all(&root).unwrap();
+        let env_key = get_env_name("cache_dir");
+        let prev = env::var_os(&env_key);
+        unsafe {
+            env::set_var(&env_key, &root);
+        }
+        let _restore = Restore {
+            key: env_key,
+            prev,
+            root,
+        };
+        f();
+    }
 
     fn base_config() -> OAuthConfig {
         OAuthConfig {
@@ -1468,4 +1659,180 @@ scopes:
             "body missing grant_type param: {body}"
         );
     }
+
+    #[test]
+    #[serial]
+    fn save_oauth_tokens_roundtrips_and_leaves_no_tmp_file() {
+        with_temp_cache(|| {
+            let tokens = OAuthTokens {
+                access_token: "at-123".into(),
+                refresh_token: Some("rt-456".into()),
+                expires_at: 1234567890,
+                account_id: Some("acct-789".into()),
+            };
+
+            save_oauth_tokens("atomic-test", &tokens).unwrap();
+
+            let loaded = load_oauth_tokens("atomic-test").unwrap();
+            assert_eq!(loaded.access_token, "at-123");
+            assert_eq!(loaded.refresh_token.as_deref(), Some("rt-456"));
+            assert_eq!(loaded.expires_at, 1234567890);
+            assert_eq!(loaded.account_id.as_deref(), Some("acct-789"));
+
+            let dir = paths::oauth_tokens_dir();
+            let leftover_tmp = fs::read_dir(&dir)
+                .unwrap()
+                .any(|e| e.unwrap().file_name().to_string_lossy().ends_with(".tmp"));
+            assert!(!leftover_tmp, "temp file left behind in {dir:?}");
+
+            #[cfg(unix)]
+            {
+                use std::os::unix::fs::PermissionsExt;
+                let mode = fs::metadata(paths::token_file("atomic-test"))
+                    .unwrap()
+                    .permissions()
+                    .mode();
+                assert_eq!(mode & 0o777, 0o600, "token file mode was {mode:o}");
+            }
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn prepare_rejected_valid_file_token_attempts_refresh_branch() {
+        with_temp_cache(|| {
+            let client_name = "prepare-rejected-branch-test";
+            let expires_at = Utc::now().timestamp() + 3600;
+            save_oauth_tokens(
+                client_name,
+                &OAuthTokens {
+                    access_token: "rejected-at".into(),
+                    refresh_token: None,
+                    expires_at,
+                    account_id: None,
+                },
+            )
+            .unwrap();
+            set_access_token(client_name, "rejected-at".into(), expires_at, None);
+            assert!(distrust_access_token(client_name, "rejected-at"));
+
+            let err = tokio::runtime::Builder::new_current_thread()
+                .enable_all()
+                .build()
+                .unwrap()
+                .block_on(prepare_oauth_access_token(
+                    &ReqwestClient::new(),
+                    &ResourceStubProvider,
+                    client_name,
+                ))
+                .unwrap_err()
+                .to_string();
+
+            // The timestamp-valid but rejected file token must not be trusted;
+            // the refresh branch is taken and bails on the missing refresh token.
+            assert!(err.contains("No refresh token"), "unexpected error: {err}");
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn prepare_trusts_differing_unmarked_valid_file_token() {
+        with_temp_cache(|| {
+            let client_name = "prepare-differing-token-test";
+            let expires_at = Utc::now().timestamp() + 3600;
+            set_access_token(client_name, "rejected-at".into(), expires_at, None);
+            assert!(distrust_access_token(client_name, "rejected-at"));
+            save_oauth_tokens(
+                client_name,
+                &OAuthTokens {
+                    access_token: "fresh-at".into(),
+                    refresh_token: None,
+                    expires_at,
+                    account_id: None,
+                },
+            )
+            .unwrap();
+
+            let ready = tokio::runtime::Builder::new_current_thread()
+                .enable_all()
+                .build()
+                .unwrap()
+                .block_on(prepare_oauth_access_token(
+                    &ReqwestClient::new(),
+                    &ResourceStubProvider,
+                    client_name,
+                ))
+                .unwrap();
+
+            assert!(ready);
+            assert_eq!(get_access_token(client_name).unwrap(), "fresh-at");
+            assert!(
+                !is_rejected(client_name, "rejected-at"),
+                "marker not cleared after successful prepare"
+            );
+        });
+    }
+
+    #[test]
+    fn parse_refresh_response_invalid_grant_redacts_and_prompts_reauth() {
+        let response = serde_json::json!({
+            "error": "invalid_grant",
+            "error_description": "refresh token revoked",
+            "refresh_token": "planted-secret-token",
+        });
+
+        let err = parse_refresh_response(StatusCode::BAD_REQUEST, &response, Some("old-rt"))
+            .unwrap_err()
+            .to_string();
+
+        assert!(err.contains("re-authenticate"), "unexpected error: {err}");
+        assert!(
+            !err.contains("planted-secret-token"),
+            "error leaked token material: {err}"
+        );
+    }
+
+    #[test]
+    fn token_response_keys_lists_keys_without_values() {
+        let response = serde_json::json!({
+            "access_token": "secret-at",
+            "token_type": "SecretBearer",
+        });
+
+        let keys = token_response_keys(&response);
+
+        assert!(keys.contains("access_token"), "missing key name: {keys}");
+        assert!(keys.contains("token_type"), "missing key name: {keys}");
+        assert!(!keys.contains("secret-at"), "leaked value: {keys}");
+        assert!(!keys.contains("SecretBearer"), "leaked value: {keys}");
+    }
+
+    #[test]
+    fn parse_refresh_response_rotates_refresh_token_when_present() {
+        let response = serde_json::json!({
+            "access_token": "new-at",
+            "refresh_token": "new-rt",
+            "expires_in": 3600,
+        });
+
+        let (access_token, refresh_token, expires_in) =
+            parse_refresh_response(StatusCode::OK, &response, Some("old-rt")).unwrap();
+
+        assert_eq!(access_token, "new-at");
+        assert_eq!(refresh_token.as_deref(), Some("new-rt"));
+        assert_eq!(expires_in, 3600);
+    }
+
+    #[test]
+    fn parse_refresh_response_keeps_old_refresh_token_when_absent() {
+        let response = serde_json::json!({
+            "access_token": "new-at",
+            "expires_in": 3600,
+        });
+
+        let (_, refresh_token, _) =
+            parse_refresh_response(StatusCode::OK, &response, Some("old-rt")).unwrap();
+
+        assert_eq!(refresh_token.as_deref(), Some("old-rt"));
+    }
 }

src/client/stream.rs

@@ -1,4 +1,4 @@
-use super::{ThinkingBlock, ToolCall, catch_error};
+use super::{ApiStatusError, ThinkingBlock, ToolCall, catch_error};
 use crate::utils::AbortSignal;
 
 use anyhow::{Context, Result, anyhow, bail};
@@ -176,6 +176,14 @@ impl SseHandler {
         self.thinking.push(block);
     }
 
+    /// Whether any output (text, tool calls, or thinking blocks) has been
+    /// accumulated. `Client::chat_completions_streaming` gates its 401 retry
+    /// on this: content already streamed to the user would be rendered a
+    /// second time by a retry, so partial responses are never retried.
+    pub fn has_received_content(&self) -> bool {
+        !self.buffer.is_empty() || !self.tool_calls.is_empty() || !self.thinking.is_empty()
+    }
+
     pub fn abort(&self) -> AbortSignal {
         self.abort_signal.clone()
     }
@@ -224,10 +232,14 @@ where
         let data: Value = match text.parse() {
             Ok(data) => data,
             Err(_) => {
-                bail!(
+                return Err(ApiStatusError {
-                    "Invalid response data: {text} (status: {})",
+                    status: status.as_u16(),
-                    status.as_u16()
+                    message: format!(
-                );
+                        "Invalid response data: {text} (status: {})",
+                        status.as_u16()
+                    ),
+                }
+                .into());
             }
         };
         catch_error(&data, status.as_u16())?;
@@ -418,6 +430,43 @@ mod tests {
         assert!(error_message.contains("test_function_loop"));
     }
 
+    fn new_handler() -> (SseHandler, tokio::sync::mpsc::UnboundedReceiver<SseEvent>) {
+        let (sender, receiver) = tokio::sync::mpsc::unbounded_channel();
+        let abort_signal = crate::utils::create_abort_signal();
+        (SseHandler::new(sender, abort_signal), receiver)
+    }
+
+    #[test]
+    fn test_has_received_content_text() {
+        let (mut handler, _rx) = new_handler();
+        assert!(!handler.has_received_content());
+
+        handler.text("hello").unwrap();
+        assert!(handler.has_received_content());
+    }
+
+    #[test]
+    fn test_has_received_content_tool_call() {
+        let (mut handler, _rx) = new_handler();
+        assert!(!handler.has_received_content());
+
+        let call = ToolCall::new("test_function".to_string(), json!({"param": 1}), None);
+        handler.tool_call(call).unwrap();
+        assert!(handler.has_received_content());
+    }
+
+    #[test]
+    fn test_has_received_content_thinking() {
+        let (mut handler, _rx) = new_handler();
+        assert!(!handler.has_received_content());
+
+        handler.thinking_block(ThinkingBlock::Thinking {
+            thinking: "hmm".to_string(),
+            signature: "sig".to_string(),
+        });
+        assert!(handler.has_received_content());
+    }
+
     fn split_chunks(text: &str) -> Vec<Vec<u8>> {
         let len = text.len();
         let cut1 = random_range(1..len - 1);

src/config/agent.rs

@@ -3,18 +3,23 @@ use super::*;
 use crate::{
     client::Model,
     config::memory,
-    function::{Functions, run_llm_function},
+    function::{
+        Functions,
+        jobs::{DEFAULT_MAX_CONCURRENT_JOBS, JOB_FUNCTION_PREFIX},
+        run_llm_function,
+    },
     graph, rag,
 };
 
 use super::rag_cache::RagKey;
 use crate::config::paths;
 use crate::config::prompts::{
-    DEFAULT_SPAWN_INSTRUCTIONS, DEFAULT_TEAMMATE_INSTRUCTIONS, DEFAULT_TODO_INSTRUCTIONS,
+    DEFAULT_JOB_INSTRUCTIONS, DEFAULT_SPAWN_INSTRUCTIONS, DEFAULT_TEAMMATE_INSTRUCTIONS,
-    DEFAULT_USER_INTERACTION_INSTRUCTIONS,
+    DEFAULT_TODO_INSTRUCTIONS, DEFAULT_USER_INTERACTION_INSTRUCTIONS,
 };
 use crate::graph::types::RagNode;
 use crate::graph::{Graph, GraphParser, NodeType};
+use crate::mcp::McpServerFeatures;
 use crate::rag::RagInitConfig;
 use crate::vault::SECRET_RE;
 use anyhow::{Context, Result};
@@ -224,6 +229,16 @@ impl Agent {
             functions.append_supervisor_functions();
         }
 
+        if app.function_calling_support
+            && agent_config
+                .max_concurrent_jobs
+                .or(app.max_concurrent_jobs)
+                .unwrap_or(DEFAULT_MAX_CONCURRENT_JOBS)
+                > 0
+        {
+            functions.append_job_functions();
+        }
+
         functions.append_teammate_functions();
         functions.append_user_interaction_functions();
 
@@ -380,7 +395,7 @@ impl Agent {
         self.graph_rags.get(node_id).cloned()
     }
 
-    pub fn append_mcp_meta_functions(&mut self, mcp_servers: Vec<String>) {
+    pub fn append_mcp_meta_functions(&mut self, mcp_servers: Vec<McpServerFeatures>) {
         self.functions.append_mcp_meta_functions(mcp_servers);
     }
 
@@ -400,6 +415,10 @@ impl Agent {
         self.config.enabled_skills.as_deref()
     }
 
+    pub fn enabled_macros(&self) -> Option<&[String]> {
+        self.config.enabled_macros.as_deref()
+    }
+
     pub fn memory(&self) -> Option<bool> {
         self.config.memory
     }
@@ -435,6 +454,18 @@ impl Agent {
             output.push_str(DEFAULT_SPAWN_INSTRUCTIONS);
         }
 
+        if self
+            .functions
+            .declarations()
+            .iter()
+            .any(|f| f.name.starts_with(JOB_FUNCTION_PREFIX))
+        {
+            if !output.ends_with('\n') {
+                output.push('\n');
+            }
+            output.push_str(DEFAULT_JOB_INSTRUCTIONS);
+        }
+
         output.push_str(DEFAULT_TEAMMATE_INSTRUCTIONS);
         output.push_str(DEFAULT_USER_INTERACTION_INSTRUCTIONS);
 
@@ -556,6 +587,10 @@ impl Agent {
         self.config.max_tool_result_chars
     }
 
+    pub fn max_concurrent_jobs(&self) -> Option<usize> {
+        self.config.max_concurrent_jobs
+    }
+
     pub fn compression_keep_last(&self) -> Option<usize> {
         self.config.compression_keep_last
     }
@@ -647,6 +682,10 @@ impl RoleLike for Agent {
         Some(self.config.mcp_servers.clone())
     }
 
+    fn mcp_tools(&self) -> Option<IndexMap<String, Vec<String>>> {
+        self.config.mcp_tools.clone()
+    }
+
     fn set_model(&mut self, model: Model) {
         self.config.model_id = Some(model.id());
         self.model = model;
@@ -688,6 +727,10 @@ impl RoleLike for Agent {
             }
         }
     }
+
+    fn set_mcp_tools(&mut self, value: Option<IndexMap<String, Vec<String>>>) {
+        self.config.mcp_tools = value;
+    }
 }
 
 #[derive(Debug, Clone, Default, Deserialize, Serialize)]
@@ -730,6 +773,8 @@ pub struct AgentConfig {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub max_tool_result_chars: Option<usize>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub max_concurrent_jobs: Option<usize>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
     pub compression_keep_last: Option<usize>,
     #[serde(default)]
     pub description: String,
@@ -737,6 +782,8 @@ pub struct AgentConfig {
     pub version: String,
     #[serde(default)]
     pub mcp_servers: Vec<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub mcp_tools: Option<IndexMap<String, Vec<String>>>,
     #[serde(default)]
     pub global_tools: Vec<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -744,6 +791,8 @@ pub struct AgentConfig {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub enabled_skills: Option<Vec<String>>,
     #[serde(skip_serializing_if = "Option::is_none")]
+    pub enabled_macros: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
     pub continuation_prompt: Option<String>,
     #[serde(default)]
     pub instructions: String,
@@ -807,6 +856,7 @@ impl AgentConfig {
             description: graph.description.clone(),
             global_tools: graph.global_tools.clone(),
             mcp_servers: graph.mcp_servers.clone(),
+            mcp_tools: graph.mcp_tools.clone(),
             skills_enabled: graph.skills_enabled,
             enabled_skills: graph.enabled_skills.clone(),
             inject_skill_instructions: graph.inject_skill_instructions.unwrap_or(true),
@@ -815,6 +865,7 @@ impl AgentConfig {
             variables: graph.variables.clone(),
             can_spawn_agents: graph.has_agent_node(),
             max_concurrent_agents: default_max_concurrent_agents(),
+            max_concurrent_jobs: graph.max_concurrent_jobs,
             max_agent_depth: default_max_agent_depth(),
             escalation_timeout: default_escalation_timeout(),
             ..AgentConfig::default()
@@ -1125,6 +1176,12 @@ struct AgentMetadataStub {
     description: String,
 }
 
+#[derive(Deserialize)]
+struct AgentVariablesStub {
+    #[serde(default)]
+    variables: Vec<AgentVariable>,
+}
+
 fn load_agent_description(name: &str) -> String {
     if let Ok(config) = AgentConfig::load(&paths::agent_config_file(name)) {
         return config.description;
@@ -1139,16 +1196,22 @@ fn load_agent_description(name: &str) -> String {
     String::new()
 }
 
-pub fn complete_agent_variables(agent_name: &str) -> Vec<(String, Option<String>)> {
+fn load_agent_variables(name: &str) -> Vec<AgentVariable> {
-    let config_path = paths::agent_config_file(agent_name);
+    if let Ok(config) = AgentConfig::load(&paths::agent_config_file(name)) {
-    if !config_path.exists() {
+        return config.variables;
-        return vec![];
     }
-    let Ok(config) = AgentConfig::load(&config_path) else {
+
-        return vec![];
+    if let Ok(contents) = read_to_string(paths::agent_graph_file(name))
-    };
+        && let Ok(stub) = serde_yaml::from_str::<AgentVariablesStub>(&contents)
-    config
+    {
-        .variables
+        return stub.variables;
+    }
+
+    Vec::new()
+}
+
+pub fn complete_agent_variables(agent_name: &str) -> Vec<(String, Option<String>)> {
+    load_agent_variables(agent_name)
         .iter()
         .map(|v| {
             let description = match &v.default {
@@ -1225,6 +1288,57 @@ variables:
         assert!(config.top_p.is_none());
     }
 
+    #[test]
+    fn agent_config_enabled_macros_absent_is_none() {
+        let yaml = "name: minimal\ninstructions: hi\n";
+        let config: AgentConfig = serde_yaml::from_str(yaml).unwrap();
+
+        assert_eq!(config.enabled_macros, None);
+    }
+
+    #[test]
+    fn agent_config_parses_mcp_tools() {
+        let yaml =
+            "name: minimal\ninstructions: hi\nmcp_tools:\n  github:\n    - get_*\n    - list_*\n";
+        let config: AgentConfig = serde_yaml::from_str(yaml).unwrap();
+
+        let mcp_tools = config.mcp_tools.unwrap();
+        assert_eq!(
+            mcp_tools.get("github"),
+            Some(&vec!["get_*".to_string(), "list_*".to_string()])
+        );
+    }
+
+    #[test]
+    fn agent_mcp_tools_role_like_round_trip() {
+        let config: AgentConfig =
+            serde_yaml::from_str("name: minimal\ninstructions: hi\n").unwrap();
+        let mut agent = Agent::test_new(config);
+        assert_eq!(agent.mcp_tools(), None);
+
+        let mut mcp_tools = IndexMap::new();
+        mcp_tools.insert("github".to_string(), vec!["get_*".to_string()]);
+        agent.set_mcp_tools(Some(mcp_tools.clone()));
+
+        assert_eq!(agent.mcp_tools(), Some(mcp_tools));
+    }
+
+    #[test]
+    fn agent_config_enabled_macros_empty_list_is_some_empty() {
+        let yaml = "name: minimal\ninstructions: hi\nenabled_macros: []\n";
+        let config: AgentConfig = serde_yaml::from_str(yaml).unwrap();
+
+        assert_eq!(config.enabled_macros, Some(vec![]));
+    }
+
+    #[test]
+    fn agent_config_enabled_macros_list() {
+        let yaml = "name: minimal\ninstructions: hi\nenabled_macros:\n  - a\n";
+        let config: AgentConfig = serde_yaml::from_str(yaml).unwrap();
+
+        assert_eq!(config.enabled_macros, Some(vec!["a".to_string()]));
+    }
+
     #[test]
     fn agent_config_with_model() {
         let yaml =
@@ -1253,6 +1367,7 @@ variables:
             model: claude:claude-sonnet-4-6
             temperature: 0.3
             top_p: 0.8
+            max_concurrent_jobs: 2
             global_tools:
               - fetch_pdf.sh
             mcp_servers:
@@ -1275,6 +1390,7 @@ variables:
         assert_eq!(config.model_id.as_deref(), Some("claude:claude-sonnet-4-6"));
         assert_eq!(config.temperature, Some(0.3));
         assert_eq!(config.top_p, Some(0.8));
+        assert_eq!(config.max_concurrent_jobs, Some(2));
         assert_eq!(config.global_tools, vec!["fetch_pdf.sh"]);
         assert_eq!(config.mcp_servers, vec!["pubmed-search"]);
         assert_eq!(config.conversation_starters, vec!["Start here"]);
@@ -1369,6 +1485,41 @@ version: "1.0"
         assert_eq!(meta.description, "");
     }
 
+    #[test]
+    fn agent_variables_stub_extracts_variables_from_graph_yaml() {
+        let yaml = r#"
+name: coder
+description: Implementation agent.
+version: "1.0"
+variables:
+  - name: task
+    description: The task to implement
+  - name: scope
+    description: Directory scope
+    default: src/
+start: plan
+nodes: {}
+"#;
+
+        let stub: AgentVariablesStub = serde_yaml::from_str(yaml).unwrap();
+
+        assert_eq!(stub.variables.len(), 2);
+        assert_eq!(stub.variables[0].name, "task");
+        assert_eq!(stub.variables[0].description, "The task to implement");
+        assert_eq!(stub.variables[0].default, None);
+        assert_eq!(stub.variables[1].name, "scope");
+        assert_eq!(stub.variables[1].default.as_deref(), Some("src/"));
+    }
+
+    #[test]
+    fn agent_variables_stub_defaults_when_variables_missing() {
+        let yaml = "name: coder\nversion: \"1.0\"\nstart: plan\nnodes: {}\n";
+
+        let stub: AgentVariablesStub = serde_yaml::from_str(yaml).unwrap();
+
+        assert!(stub.variables.is_empty());
+    }
+
     #[test]
     fn rag_init_config_forwards_an_explicit_driver() {
         let node: RagNode =
@@ -1403,4 +1554,51 @@ version: "1.0"
         assert_eq!(config.top_k, Some(7));
         assert_eq!(config.embedding_model.as_deref(), Some("some:model"));
     }
+
+    #[test]
+    fn interpolated_instructions_without_job_declarations_is_byte_identical_across_job_settings() {
+        let agent = |max_concurrent_jobs| {
+            Agent::test_new(AgentConfig {
+                instructions: "hi".to_string(),
+                max_concurrent_jobs,
+                ..AgentConfig::default()
+            })
+        };
+
+        let baseline = agent(None).interpolated_instructions();
+        assert!(
+            !baseline.contains(DEFAULT_JOB_INSTRUCTIONS),
+            "no job guidance may be injected without job__ declarations"
+        );
+        assert_eq!(baseline, agent(Some(0)).interpolated_instructions());
+        assert_eq!(baseline, agent(Some(7)).interpolated_instructions());
+
+        let mut with_unrelated = agent(None);
+        with_unrelated.functions.append_todo_functions();
+        assert_eq!(
+            baseline,
+            with_unrelated.interpolated_instructions(),
+            "job guidance injection must key strictly on the job__ prefix"
+        );
+    }
+
+    #[test]
+    fn interpolated_instructions_with_job_declarations_appends_job_guidance() {
+        let config = AgentConfig {
+            instructions: "hi".to_string(),
+            ..AgentConfig::default()
+        };
+        let baseline = Agent::test_new(config.clone()).interpolated_instructions();
+
+        let mut agent = Agent::test_new(config);
+        agent.functions.append_job_functions();
+        let output = agent.interpolated_instructions();
+
+        assert!(output.contains(DEFAULT_JOB_INSTRUCTIONS));
+        let expected = format!(
+            "hi\n{DEFAULT_JOB_INSTRUCTIONS}{}",
+            baseline.strip_prefix("hi").unwrap()
+        );
+        assert_eq!(output, expected);
+    }
 }

src/config/app_config.rs

@@ -1,6 +1,6 @@
 use crate::client::{ClientConfig, Model, ModelType, list_models};
 use crate::render::{MarkdownRender, RenderOptions};
-use crate::utils::{IS_STDOUT_TERMINAL, NO_COLOR, decode_bin, get_env_name};
+use crate::utils::{IS_STDOUT_TERMINAL, NO_COLOR, decode_bin, drain_stale_tty_input, get_env_name};
 
 use super::paths;
 use anyhow::{Context, Result, anyhow, bail};
@@ -43,11 +43,14 @@ pub struct AppConfig {
     #[serde(default, deserialize_with = "super::deserialize_csv_or_vec")]
     pub enabled_skills: Option<Vec<String>>,
     pub visible_skills: Option<Vec<String>>,
+    #[serde(default, deserialize_with = "super::deserialize_csv_or_vec")]
+    pub enabled_macros: Option<Vec<String>>,
 
     pub mcp_server_support: bool,
     pub mapping_mcp_servers: IndexMap<String, String>,
     #[serde(default, deserialize_with = "super::deserialize_csv_or_vec")]
     pub enabled_mcp_servers: Option<Vec<String>>,
+    pub mcp_tools: Option<IndexMap<String, Vec<String>>>,
 
     pub auto_continue: bool,
     pub max_auto_continues: usize,
@@ -66,6 +69,7 @@ pub struct AppConfig {
     pub summarization_prompt: Option<String>,
     pub summary_context_prompt: Option<String>,
     pub max_tool_result_chars: Option<usize>,
+    pub max_concurrent_jobs: Option<usize>,
 
     pub memory: Option<bool>,
     pub memory_cap_with_tools: Option<usize>,
@@ -96,6 +100,7 @@ pub struct AppConfig {
     pub user_agent: Option<String>,
     pub save_shell_history: bool,
     pub no_workspace_mcp: bool,
+    pub no_workspace_macros: bool,
     pub sync_models_url: Option<String>,
 
     pub clients: Vec<ClientConfig>,
@@ -127,10 +132,12 @@ impl Default for AppConfig {
             skills_enabled: true,
             enabled_skills: None,
             visible_skills: None,
+            enabled_macros: None,
 
             mcp_server_support: true,
             mapping_mcp_servers: Default::default(),
             enabled_mcp_servers: None,
+            mcp_tools: None,
 
             auto_continue: false,
             max_auto_continues: 10,
@@ -149,6 +156,7 @@ impl Default for AppConfig {
             summarization_prompt: None,
             summary_context_prompt: None,
             max_tool_result_chars: None,
+            max_concurrent_jobs: None,
 
             memory: None,
             memory_cap_with_tools: None,
@@ -178,6 +186,7 @@ impl Default for AppConfig {
             user_agent: None,
             save_shell_history: true,
             no_workspace_mcp: false,
+            no_workspace_macros: false,
             sync_models_url: None,
 
             clients: vec![],
@@ -211,10 +220,12 @@ impl AppConfig {
             skills_enabled: config.skills_enabled,
             enabled_skills: config.enabled_skills,
             visible_skills: config.visible_skills,
+            enabled_macros: config.enabled_macros,
 
             mcp_server_support: config.mcp_server_support,
             mapping_mcp_servers: config.mapping_mcp_servers,
             enabled_mcp_servers: config.enabled_mcp_servers,
+            mcp_tools: config.mcp_tools,
 
             auto_continue: config.auto_continue,
             max_auto_continues: config.max_auto_continues,
@@ -233,6 +244,7 @@ impl AppConfig {
             summarization_prompt: config.summarization_prompt,
             summary_context_prompt: config.summary_context_prompt,
             max_tool_result_chars: config.max_tool_result_chars,
+            max_concurrent_jobs: config.max_concurrent_jobs,
 
             memory: config.memory,
             memory_cap_with_tools: config.memory_cap_with_tools,
@@ -262,6 +274,7 @@ impl AppConfig {
             user_agent: config.user_agent,
             save_shell_history: config.save_shell_history,
             no_workspace_mcp: false,
+            no_workspace_macros: false,
             sync_models_url: config.sync_models_url,
 
             clients: config.clients,
@@ -533,6 +546,10 @@ impl AppConfig {
             self.enabled_skills = v.map(|raw| super::csv_to_vec(&raw));
         }
 
+        if let Some(v) = super::read_env_value::<String>(&get_env_name("enabled_macros")) {
+            self.enabled_macros = v.map(|raw| super::csv_to_vec(&raw));
+        }
+
         if let Some(Some(v)) = super::read_env_bool(&get_env_name("mcp_server_support")) {
             self.mcp_server_support = v;
         }
@@ -563,6 +580,9 @@ impl AppConfig {
         {
             self.compression_threshold = v;
         }
+        if let Some(v) = super::read_env_value::<usize>(&get_env_name("max_concurrent_jobs")) {
+            self.max_concurrent_jobs = v;
+        }
         if let Some(v) = super::read_env_value::<String>(&get_env_name("summarization_prompt")) {
             self.summarization_prompt = v;
         }
@@ -616,14 +636,18 @@ impl AppConfig {
         if self.highlight && self.theme.is_none() {
             if let Some(v) = super::read_env_value::<String>(&get_env_name("theme")) {
                 self.theme = v;
-            } else if *IS_STDOUT_TERMINAL
+            } else if *IS_STDOUT_TERMINAL {
-                && let Ok(color_scheme) = color_scheme(QueryOptions::default())
+                if let Ok(color_scheme) = color_scheme(QueryOptions::default()) {
-            {
+                    let theme = match color_scheme {
-                let theme = match color_scheme {
+                        ColorScheme::Dark => "dark",
-                    ColorScheme::Dark => "dark",
+                        ColorScheme::Light => "light",
-                    ColorScheme::Light => "light",
+                    };
-                };
+                    self.theme = Some(theme.into());
-                self.theme = Some(theme.into());
+                }
+                // The OSC/DA1 reply can arrive after colorsaurus stops reading
+                // (observed under zellij-in-kitty). Drain any late reply bytes so
+                // they are neither echoed nor read as line-editor input.
+                drain_stale_tty_input();
             }
         }
         if let Some(v) = super::read_env_value::<String>(&get_env_name("left_prompt")) {
@@ -765,10 +789,133 @@ mod tests {
         );
     }
 
+    #[test]
+    fn from_config_copies_mcp_tools() {
+        let mut mcp_tools = IndexMap::new();
+        mcp_tools.insert("github".to_string(), vec!["get_*".to_string()]);
+        let cfg = Config {
+            model_id: "test-model".to_string(),
+            clients: vec![ClientConfig::default()],
+            mcp_tools: Some(mcp_tools.clone()),
+            ..Config::default()
+        };
+
+        let app = AppConfig::from_config(cfg).unwrap();
+
+        assert_eq!(app.mcp_tools, Some(mcp_tools));
+    }
+
+    #[test]
+    #[serial_test::serial]
+    fn from_config_copies_enabled_macros() {
+        let cfg = Config {
+            model_id: "provider:test".to_string(),
+            enabled_macros: Some(vec!["a".to_string()]),
+            ..Config::default()
+        };
+
+        let app = AppConfig::from_config(cfg).unwrap();
+
+        assert_eq!(app.enabled_macros, Some(vec!["a".to_string()]));
+    }
+
+    #[test]
+    #[serial_test::serial]
+    fn from_config_preserves_explicit_empty_enabled_macros() {
+        let cfg = Config {
+            model_id: "provider:test".to_string(),
+            enabled_macros: Some(vec![]),
+            ..Config::default()
+        };
+
+        let app = AppConfig::from_config(cfg).unwrap();
+
+        assert_eq!(app.enabled_macros, Some(vec![]));
+    }
+
+    #[test]
+    #[serial_test::serial]
+    fn load_envs_overrides_enabled_macros() {
+        let env_name = get_env_name("enabled_macros");
+        let prev = std::env::var_os(&env_name);
+
+        let mut app = AppConfig::default();
+
+        unsafe { std::env::set_var(&env_name, "a,b") };
+        app.load_envs();
+        assert_eq!(
+            app.enabled_macros,
+            Some(vec!["a".to_string(), "b".to_string()])
+        );
+
+        unsafe { std::env::set_var(&env_name, "") };
+        app.load_envs();
+        assert_eq!(app.enabled_macros, Some(vec![]));
+
+        unsafe { std::env::set_var(&env_name, "null") };
+        app.load_envs();
+        assert_eq!(app.enabled_macros, None);
+
+        unsafe { std::env::remove_var(&env_name) };
+        app.enabled_macros = Some(vec!["keep".to_string()]);
+        app.load_envs();
+        assert_eq!(app.enabled_macros, Some(vec!["keep".to_string()]));
+
+        unsafe {
+            match prev {
+                Some(v) => env::set_var(&env_name, v),
+                None => env::remove_var(&env_name),
+            }
+        }
+    }
+
+    #[test]
+    fn from_config_copies_max_concurrent_jobs() {
+        let cfg = Config {
+            model_id: "test-model".to_string(),
+            max_concurrent_jobs: Some(3),
+            clients: vec![ClientConfig::default()],
+            ..Config::default()
+        };
+
+        let app = AppConfig::from_config(cfg).unwrap();
+
+        assert_eq!(app.max_concurrent_jobs, Some(3));
+    }
+
+    #[test]
+    #[serial_test::serial]
+    fn load_envs_overrides_max_concurrent_jobs() {
+        let env_name = get_env_name("max_concurrent_jobs");
+        let prev = env::var_os(&env_name);
+
+        let mut app = AppConfig::default();
+
+        unsafe { env::set_var(&env_name, "7") };
+        app.load_envs();
+        assert_eq!(app.max_concurrent_jobs, Some(7));
+
+        unsafe { env::set_var(&env_name, "0") };
+        app.load_envs();
+        assert_eq!(app.max_concurrent_jobs, Some(0));
+
+        unsafe { env::remove_var(&env_name) };
+        app.max_concurrent_jobs = Some(2);
+        app.load_envs();
+        assert_eq!(app.max_concurrent_jobs, Some(2));
+
+        unsafe {
+            match prev {
+                Some(v) => env::set_var(&env_name, v),
+                None => env::remove_var(&env_name),
+            }
+        }
+    }
+
     #[test]
     fn editor_returns_configured_value() {
-        let configured = cached_editor()
+        let configured =
-            .unwrap_or_else(|| std::env::current_exe().unwrap().display().to_string());
+            cached_editor().unwrap_or_else(|| env::current_exe().unwrap().display().to_string());
         let app = AppConfig {
             editor: Some(configured.clone()),
             ..AppConfig::default()
@@ -785,9 +932,9 @@ mod tests {
             return;
         }
 
-        let expected = std::env::current_exe().unwrap().display().to_string();
+        let expected = env::current_exe().unwrap().display().to_string();
         unsafe {
-            std::env::set_var("VISUAL", &expected);
+            env::set_var("VISUAL", &expected);
         }
 
         let app = AppConfig::default();
@@ -855,7 +1002,7 @@ mod tests {
         let app = AppConfig::from_config(cfg).unwrap();
 
         let ua = app.user_agent.as_deref().unwrap();
-        assert!(ua != "auto", "user_agent should have been resolved");
+        assert_ne!(ua, "auto", "user_agent should have been resolved");
         assert!(ua.contains('/'), "user_agent should be '<name>/<version>'");
     }
 

src/config/app_state.rs

@@ -1,6 +1,7 @@
 use super::mcp_factory::{McpFactory, McpServerKey};
 use super::rag_cache::RagCache;
 use crate::config::AppConfig;
+use crate::config::jobs_enabled;
 use crate::function::Functions;
 use crate::mcp::{McpRegistry, McpServersConfig};
 use crate::utils::AbortSignal;
@@ -70,7 +71,11 @@ impl AppState {
 
         let mut functions = Functions::init(config.visible_tools.as_ref().unwrap_or(&Vec::new()))?;
         if !mcp_registry.is_empty() && config.mcp_server_support {
-            functions.append_mcp_meta_functions(mcp_registry.list_started_servers());
+            functions.append_mcp_meta_functions(mcp_registry.server_features());
+        }
+
+        if jobs_enabled(None, &config) {
+            functions.append_job_functions();
         }
 
         let mcp_registry = if mcp_registry.is_empty() {

src/config/input.rs

@@ -9,7 +9,12 @@ use crate::utils::{AbortSignal, base64_encode, is_loader_protocol, sha256};
 
 use anyhow::{Context, Result, bail};
 use indexmap::IndexSet;
-use std::{collections::HashMap, fs::File, io::Read, sync::Arc};
+use std::{
+    collections::{HashMap, HashSet},
+    fs::File,
+    io::Read,
+    sync::Arc,
+};
 use unicode_width::{UnicodeWidthChar, UnicodeWidthStr};
 
 const IMAGE_EXTS: [&str; 5] = ["png", "jpeg", "jpg", "webp", "gif"];
@@ -158,6 +163,13 @@ impl Input {
         self.data_urls.clone()
     }
 
+    pub fn declared_function_names(&self) -> HashSet<String> {
+        self.functions
+            .as_ref()
+            .map(|functions| functions.iter().map(|f| f.name.clone()).collect())
+            .unwrap_or_default()
+    }
+
     pub fn tool_calls(&self) -> &Option<MessageContentToolCalls> {
         &self.tool_calls
     }
@@ -593,6 +605,8 @@ mod tests {
     use super::*;
     use crate::config::request_context::RequestContext;
     use crate::config::{AppState, WorkingMode};
+    use crate::function::ToolCall;
+    use serde_json::json;
     use std::fs;
     use std::sync::Arc;
     use std::time::SystemTime;
@@ -973,4 +987,70 @@ mod tests {
         ));
         assert!(result.is_err());
     }
+
+    fn tool_result(id: &str, output: &str) -> ToolResult {
+        ToolResult::new(
+            ToolCall::new("t".into(), json!({}), Some(id.to_string())),
+            json!(output),
+        )
+    }
+
+    #[test]
+    fn merge_tool_results_first_merge_creates_container() {
+        let ctx = create_test_ctx();
+        let input = Input::from_str(&ctx, "test", None).unwrap();
+
+        let input =
+            input.merge_tool_results("assistant text".into(), vec![tool_result("id-1", "ok")]);
+
+        let tool_calls = input.tool_calls().as_ref().unwrap();
+        assert_eq!(tool_calls.text, "assistant text");
+        assert!(!tool_calls.sequence);
+        assert_eq!(tool_calls.tool_results.len(), 1);
+        assert!(tool_calls.tool_results[0].text.is_none());
+    }
+
+    #[test]
+    fn merge_tool_results_second_merge_marks_sequence_and_tags_text() {
+        let ctx = create_test_ctx();
+        let input = Input::from_str(&ctx, "test", None)
+            .unwrap()
+            .merge_tool_results("assistant text".into(), vec![tool_result("id-1", "ok")]);
+
+        let input =
+            input.merge_tool_results("second text".into(), vec![tool_result("id-2", "ok2")]);
+
+        let tool_calls = input.tool_calls().as_ref().unwrap();
+        assert!(tool_calls.sequence);
+        assert_eq!(tool_calls.tool_results.len(), 2);
+        assert_eq!(tool_calls.text, "assistant text");
+        assert!(tool_calls.tool_results[0].text.is_none());
+        assert_eq!(
+            tool_calls.tool_results[1].text,
+            Some("second text".to_string())
+        );
+    }
+
+    #[test]
+    fn build_messages_wraps_tool_results_in_single_assistant_message() {
+        let ctx = create_test_ctx();
+        let input = Input::from_str(&ctx, "test", None)
+            .unwrap()
+            .merge_tool_results("assistant text".into(), vec![tool_result("id-1", "ok")])
+            .merge_tool_results("second text".into(), vec![tool_result("id-2", "ok2")]);
+
+        let messages = input.build_messages().unwrap();
+
+        let tool_call_messages: Vec<_> = messages
+            .iter()
+            .filter(|m| matches!(m.content, MessageContent::ToolCalls(_)))
+            .collect();
+        assert_eq!(tool_call_messages.len(), 1);
+        let message = tool_call_messages[0];
+        assert!(matches!(message.role, MessageRole::Assistant));
+        let MessageContent::ToolCalls(tool_calls) = &message.content else {
+            unreachable!();
+        };
+        assert_eq!(tool_calls.tool_results.len(), 2);
+    }
 }

src/config/mcp_factory.rs

@@ -1,6 +1,6 @@
 use crate::mcp::{
-    ConnectedServer, JsonField, McpServer, McpTransportType, is_auth_required_error, oauth,
+    ConnectedServer, JsonField, McpAuthRequired, McpServer, McpTransportType,
-    spawn_mcp_server,
+    is_auth_required_error, resolve_http_auth, spawn_mcp_server,
 };
 
 use anyhow::Result;
@@ -102,23 +102,17 @@ impl McpFactory {
             return Ok(existing);
         }
 
-        let bearer_token = if spec.is_remote() {
+        let (auth, auth_reason) = resolve_http_auth(name, spec).await;
-            oauth::load_valid_mcp_token(name)
+        let handle = spawn_mcp_server(spec, log_path, auth).await.map_err(|e| {
-        } else {
+            if is_auth_required_error(&e) {
-            None
+                e.context(McpAuthRequired {
-        };
+                    server: name.to_string(),
-        let handle = spawn_mcp_server(spec, log_path, bearer_token)
+                    reason: auth_reason,
-            .await
+                })
-            .map_err(|e| {
+            } else {
-                if is_auth_required_error(&e) {
+                e
-                    e.context(format!(
+            }
-                        "MCP server '{name}' requires OAuth authentication. \
+        })?;
-                         Run `coyote --auth-mcp {name}` or `.mcp auth {name}` in the REPL to authenticate."
-                    ))
-                } else {
-                    e
-                }
-            })?;
         self.insert_active(key, &handle);
         Ok(handle)
     }
@@ -145,6 +139,7 @@ mod tests {
             url: None,
             headers: None,
             oauth: None,
+            allowed_tools: None,
         }
     }
 
@@ -162,6 +157,7 @@ mod tests {
             url: Some(url.to_string()),
             headers,
             oauth: None,
+            allowed_tools: None,
         }
     }
 

src/config/mcp_tool_policy.rs

@@ -0,0 +1,859 @@
+use crate::mcp::McpServersConfig;
+
+use fancy_regex::Regex;
+use indexmap::IndexMap;
+use log::warn;
+use std::collections::HashMap;
+use std::fmt;
+
+/// The configuration level that contributed a layer of tool patterns for an
+/// MCP server, as rendered in diagnostics.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum LayerSource {
+    Global,
+    AppConfig,
+    Role(String),
+    Agent(String),
+    Session,
+    Skill(String),
+    Node(String),
+}
+
+impl fmt::Display for LayerSource {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            LayerSource::Global => write!(f, "global (mcp.json)"),
+            LayerSource::AppConfig => write!(f, "config (config.yaml)"),
+            LayerSource::Role(name) => write!(f, "role ({name})"),
+            LayerSource::Agent(name) => write!(f, "agent ({name})"),
+            LayerSource::Session => write!(f, "session (.set)"),
+            LayerSource::Skill(name) => write!(f, "skill ({name})"),
+            LayerSource::Node(id) => write!(f, "node ({id})"),
+        }
+    }
+}
+
+impl LayerSource {
+    pub fn short_label(&self) -> &'static str {
+        match self {
+            LayerSource::Global => "global",
+            LayerSource::AppConfig => "config",
+            LayerSource::Role(_) => "role",
+            LayerSource::Agent(_) => "agent",
+            LayerSource::Session => "session",
+            LayerSource::Skill(_) => "skill",
+            LayerSource::Node(_) => "node",
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct CompiledPatterns {
+    source: LayerSource,
+    raw: Vec<String>,
+    regexes: Vec<Regex>,
+}
+
+#[derive(Debug, Clone, Default)]
+pub struct ToolFilter {
+    layers: Vec<CompiledPatterns>,
+}
+
+impl ToolFilter {
+    pub fn push_layer(&mut self, source: LayerSource, patterns: &[String]) {
+        self.layers.push(CompiledPatterns {
+            source,
+            raw: patterns.to_vec(),
+            regexes: patterns.iter().map(|p| compile_glob(p)).collect(),
+        });
+    }
+
+    pub fn layers(&self) -> impl Iterator<Item = (&LayerSource, &[String])> {
+        self.layers
+            .iter()
+            .map(|layer| (&layer.source, layer.raw.as_slice()))
+    }
+
+    pub fn allows(&self, tool: &str) -> bool {
+        self.layers.iter().all(|layer| {
+            layer
+                .regexes
+                .iter()
+                .any(|regex| regex.is_match(tool).unwrap_or(false))
+        })
+    }
+
+    /// The first matching raw pattern per layer, in layer order, or the
+    /// source of the first layer with no match.
+    pub fn allows_explain(&self, tool: &str) -> Result<Vec<(&LayerSource, &str)>, &LayerSource> {
+        let mut matched = Vec::with_capacity(self.layers.len());
+        for layer in &self.layers {
+            // fancy_regex can fail at match time (backtracking limits);
+            // treat that as a non-match rather than allowing the tool.
+            match layer
+                .regexes
+                .iter()
+                .position(|regex| regex.is_match(tool).unwrap_or(false))
+            {
+                Some(index) => matched.push((&layer.source, layer.raw[index].as_str())),
+                None => return Err(&layer.source),
+            }
+        }
+        Ok(matched)
+    }
+
+    pub fn dead_context_patterns(&self, advertised: &[String]) -> Vec<(&LayerSource, &str)> {
+        let surviving: Vec<&String> = advertised
+            .iter()
+            .filter(|name| {
+                self.layers
+                    .iter()
+                    .filter(|layer| layer.source == LayerSource::Global)
+                    .all(|layer| {
+                        layer
+                            .regexes
+                            .iter()
+                            .any(|regex| regex.is_match(name).unwrap_or(false))
+                    })
+            })
+            .collect();
+        let mut dead = Vec::new();
+        for layer in self
+            .layers
+            .iter()
+            .filter(|l| l.source != LayerSource::Global)
+        {
+            for (raw, regex) in layer.raw.iter().zip(&layer.regexes) {
+                if !surviving
+                    .iter()
+                    .any(|name| regex.is_match(name).unwrap_or(false))
+                {
+                    dead.push((&layer.source, raw.as_str()));
+                }
+            }
+        }
+
+        dead
+    }
+}
+
+/// Translates a glob pattern (`*` = any run of characters, `?` = exactly one)
+/// into an anchored regex. Patterns that fail to compile match nothing.
+fn compile_glob(pattern: &str) -> Regex {
+    let translated = format!(
+        "^{}$",
+        fancy_regex::escape(pattern)
+            .replace("\\*", ".*")
+            .replace("\\?", ".")
+    );
+    Regex::new(&translated).unwrap_or_else(|error| {
+        warn!("Invalid MCP tool pattern '{pattern}': {error}. It will match nothing.");
+        never_matching_regex()
+    })
+}
+
+fn never_matching_regex() -> Regex {
+    Regex::new("(?!)").expect("'(?!)' is a valid never-matching regex")
+}
+
+pub struct SkillMcpLayer {
+    pub name: String,
+    pub enabled_servers: Vec<String>,
+    pub mcp_tools: IndexMap<String, Vec<String>>,
+}
+
+pub struct McpToolPolicy;
+
+impl McpToolPolicy {
+    #[allow(clippy::too_many_arguments)]
+    pub fn effective(
+        mcp_config: &McpServersConfig,
+        session: Option<&IndexMap<String, Vec<String>>>,
+        agent: Option<(&str, &IndexMap<String, Vec<String>>)>,
+        role: Option<(&str, &IndexMap<String, Vec<String>>)>,
+        global: Option<&IndexMap<String, Vec<String>>>,
+        skills: &[SkillMcpLayer],
+        node: Option<(&str, &IndexMap<String, Vec<String>>)>,
+        aliases: &IndexMap<String, String>,
+    ) -> HashMap<String, ToolFilter> {
+        let mut filters: HashMap<String, ToolFilter> = HashMap::new();
+
+        for (server, spec) in &mcp_config.mcp_servers {
+            if let Some(patterns) = &spec.allowed_tools {
+                filters
+                    .entry(server.clone())
+                    .or_default()
+                    .push_layer(LayerSource::Global, patterns);
+            }
+        }
+
+        if let Some(map) = global {
+            push_level(
+                &mut filters,
+                mcp_config,
+                aliases,
+                &LayerSource::AppConfig,
+                map,
+                None,
+            );
+        }
+        if let Some((name, map)) = role {
+            push_level(
+                &mut filters,
+                mcp_config,
+                aliases,
+                &LayerSource::Role(name.to_string()),
+                map,
+                None,
+            );
+        }
+        if let Some((name, map)) = agent {
+            push_level(
+                &mut filters,
+                mcp_config,
+                aliases,
+                &LayerSource::Agent(name.to_string()),
+                map,
+                None,
+            );
+        }
+        if let Some(map) = session {
+            push_level(
+                &mut filters,
+                mcp_config,
+                aliases,
+                &LayerSource::Session,
+                map,
+                None,
+            );
+        }
+        for skill in skills {
+            push_level(
+                &mut filters,
+                mcp_config,
+                aliases,
+                &LayerSource::Skill(skill.name.clone()),
+                &skill.mcp_tools,
+                Some(&skill.enabled_servers),
+            );
+        }
+        if let Some((id, map)) = node {
+            push_level(
+                &mut filters,
+                mcp_config,
+                aliases,
+                &LayerSource::Node(id.to_string()),
+                map,
+                None,
+            );
+        }
+
+        filters
+    }
+}
+
+fn push_level(
+    filters: &mut HashMap<String, ToolFilter>,
+    mcp_config: &McpServersConfig,
+    aliases: &IndexMap<String, String>,
+    source: &LayerSource,
+    map: &IndexMap<String, Vec<String>>,
+    enabled_servers: Option<&[String]>,
+) {
+    for (server, patterns) in expand_server_keys(mcp_config, aliases, map) {
+        if let Some(enabled) = enabled_servers
+            && !enabled.iter().any(|id| id == &server)
+        {
+            continue;
+        }
+        filters
+            .entry(server)
+            .or_default()
+            .push_layer(source.clone(), &patterns);
+    }
+}
+
+fn expand_server_keys(
+    mcp_config: &McpServersConfig,
+    aliases: &IndexMap<String, String>,
+    map: &IndexMap<String, Vec<String>>,
+) -> IndexMap<String, Vec<String>> {
+    let mut expanded: IndexMap<String, Vec<String>> = IndexMap::new();
+    for (key, patterns) in map {
+        let key = key.trim();
+        if mcp_config.mcp_servers.contains_key(key) {
+            expanded
+                .entry(key.to_string())
+                .or_default()
+                .extend(patterns.iter().cloned());
+        } else {
+            for mapped_id in expand_mcp_server_alias(aliases, key) {
+                if mcp_config.mcp_servers.contains_key(&mapped_id) {
+                    expanded
+                        .entry(mapped_id)
+                        .or_default()
+                        .extend(patterns.iter().cloned());
+                }
+            }
+        }
+    }
+
+    expanded
+}
+
+pub(crate) fn expand_mcp_server_alias(
+    aliases: &IndexMap<String, String>,
+    key: &str,
+) -> Vec<String> {
+    aliases
+        .get(key)
+        .map(|mapped| {
+            mapped
+                .split(',')
+                .map(str::trim)
+                .filter(|id| !id.is_empty())
+                .map(str::to_string)
+                .collect()
+        })
+        .unwrap_or_default()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::mcp::{McpServer, McpServersConfig, McpTransportType};
+
+    fn spec(allowed_tools: Option<&[&str]>) -> McpServer {
+        McpServer {
+            transport_type: McpTransportType::Stdio,
+            command: Some("echo".to_string()),
+            args: None,
+            env: None,
+            cwd: None,
+            url: None,
+            headers: None,
+            oauth: None,
+            allowed_tools: allowed_tools.map(list),
+        }
+    }
+
+    fn config(servers: &[(&str, Option<&[&str]>)]) -> McpServersConfig {
+        McpServersConfig {
+            mcp_servers: servers
+                .iter()
+                .map(|(name, tools)| (name.to_string(), spec(*tools)))
+                .collect(),
+        }
+    }
+
+    fn list(items: &[&str]) -> Vec<String> {
+        items.iter().map(|s| s.to_string()).collect()
+    }
+
+    fn tool_map(entries: &[(&str, &[&str])]) -> IndexMap<String, Vec<String>> {
+        entries
+            .iter()
+            .map(|(server, patterns)| (server.to_string(), list(patterns)))
+            .collect()
+    }
+
+    fn single_layer(patterns: &[&str]) -> ToolFilter {
+        layered(&[(LayerSource::Global, patterns)])
+    }
+
+    fn layered(layers: &[(LayerSource, &[&str])]) -> ToolFilter {
+        let mut filter = ToolFilter::default();
+        for (source, patterns) in layers {
+            filter.push_layer(source.clone(), &list(patterns));
+        }
+        filter
+    }
+
+    fn no_aliases() -> IndexMap<String, String> {
+        IndexMap::new()
+    }
+
+    fn aliases(entries: &[(&str, &str)]) -> IndexMap<String, String> {
+        entries
+            .iter()
+            .map(|(key, value)| (key.to_string(), value.to_string()))
+            .collect()
+    }
+
+    fn resolve(
+        config: &McpServersConfig,
+        session: Option<&IndexMap<String, Vec<String>>>,
+        role: Option<(&str, &IndexMap<String, Vec<String>>)>,
+    ) -> HashMap<String, ToolFilter> {
+        McpToolPolicy::effective(config, session, None, role, None, &[], None, &no_aliases())
+    }
+
+    #[test]
+    fn literal_pattern_matches_only_the_exact_name() {
+        let filter = single_layer(&["get_issue"]);
+
+        assert!(filter.allows("get_issue"));
+        assert!(!filter.allows("get_issues"));
+        assert!(!filter.allows("get_issu"));
+        assert!(!filter.allows("xget_issue"));
+    }
+
+    #[test]
+    fn star_matches_any_run_of_characters() {
+        let filter = single_layer(&["get_*"]);
+        assert!(filter.allows("get_issue"));
+        assert!(filter.allows("get_"));
+        assert!(!filter.allows("set_issue"));
+
+        let filter = single_layer(&["*_issue"]);
+        assert!(filter.allows("create_issue"));
+        assert!(!filter.allows("create_pr"));
+
+        let filter = single_layer(&["get*sue"]);
+        assert!(filter.allows("get_issue"));
+        assert!(filter.allows("getsue"));
+
+        let filter = single_layer(&["*"]);
+        assert!(filter.allows(""));
+        assert!(filter.allows("anything_at_all"));
+    }
+
+    #[test]
+    fn question_mark_matches_exactly_one_character() {
+        let filter = single_layer(&["get_?"]);
+
+        assert!(filter.allows("get_a"));
+        assert!(!filter.allows("get_"));
+        assert!(!filter.allows("get_ab"));
+    }
+
+    #[test]
+    fn regex_metacharacters_are_matched_literally() {
+        let filter = single_layer(&["get.issue"]);
+        assert!(filter.allows("get.issue"));
+        assert!(!filter.allows("getXissue"));
+
+        for pattern in ["a(b", "a[b", "a+b", "a|b", "a$b"] {
+            let filter = single_layer(&[pattern]);
+            assert!(filter.allows(pattern), "'{pattern}' should match itself");
+            assert!(!filter.allows("ab"), "'{pattern}' should not match 'ab'");
+        }
+    }
+
+    #[test]
+    fn backslash_is_literal_and_star_still_wildcards() {
+        let filter = single_layer(&["a\\b"]);
+        assert!(filter.allows("a\\b"));
+        assert!(!filter.allows("ab"));
+
+        let filter = single_layer(&["a\\*b"]);
+        assert!(filter.allows("a\\b"));
+        assert!(filter.allows("a\\xyzb"));
+        assert!(!filter.allows("ab"));
+    }
+
+    #[test]
+    fn the_never_matching_placeholder_matches_nothing() {
+        let regex = never_matching_regex();
+
+        assert!(!regex.is_match("").unwrap());
+        assert!(!regex.is_match("anything").unwrap());
+    }
+
+    #[test]
+    fn within_a_layer_any_pattern_may_match() {
+        let filter = single_layer(&["get_*", "set_*"]);
+
+        assert!(filter.allows("get_x"));
+        assert!(filter.allows("set_x"));
+        assert!(!filter.allows("delete_x"));
+    }
+
+    #[test]
+    fn across_layers_every_layer_must_match() {
+        let filter = layered(&[
+            (LayerSource::Global, &["get_*"]),
+            (LayerSource::Session, &["*_issue"]),
+        ]);
+
+        assert!(filter.allows("get_issue"));
+        assert!(!filter.allows("get_pr"));
+        assert!(!filter.allows("create_issue"));
+    }
+
+    #[test]
+    fn an_empty_layer_blocks_everything() {
+        let filter = layered(&[(LayerSource::Global, &["*"]), (LayerSource::Session, &[])]);
+
+        assert!(!filter.allows("anything"));
+        assert_eq!(
+            filter.allows_explain("anything"),
+            Err(&LayerSource::Session)
+        );
+    }
+
+    #[test]
+    fn allows_explain_reports_the_first_matching_pattern_per_layer() {
+        let filter = layered(&[
+            (LayerSource::Global, &["x_*", "get_*"]),
+            (LayerSource::Session, &["*"]),
+        ]);
+
+        assert_eq!(
+            filter.allows_explain("get_issue").unwrap(),
+            vec![
+                (&LayerSource::Global, "get_*"),
+                (&LayerSource::Session, "*")
+            ]
+        );
+    }
+
+    #[test]
+    fn allows_explain_reports_the_first_layer_without_a_match() {
+        let filter = layered(&[
+            (LayerSource::Global, &["get_*"]),
+            (LayerSource::Session, &["*"]),
+        ]);
+        assert_eq!(
+            filter.allows_explain("delete_repo"),
+            Err(&LayerSource::Global)
+        );
+
+        let filter = layered(&[
+            (LayerSource::Global, &["*"]),
+            (LayerSource::Session, &["get_*"]),
+        ]);
+        assert_eq!(
+            filter.allows_explain("delete_repo"),
+            Err(&LayerSource::Session)
+        );
+    }
+
+    #[test]
+    fn global_allowed_tools_from_mcp_json_is_the_first_layer() {
+        let config = config(&[("gh", Some(&["get_*"]))]);
+        let session_map = tool_map(&[("gh", &["*"])]);
+
+        let filters = resolve(&config, Some(&session_map), None);
+
+        assert_eq!(
+            filters["gh"].allows_explain("get_issue").unwrap(),
+            vec![
+                (&LayerSource::Global, "get_*"),
+                (&LayerSource::Session, "*")
+            ]
+        );
+    }
+
+    #[test]
+    fn servers_without_patterns_at_any_level_are_absent() {
+        let config = config(&[("gh", None)]);
+
+        let filters = resolve(&config, None, None);
+
+        assert!(filters.is_empty());
+    }
+
+    #[test]
+    fn server_absent_from_a_level_map_gets_no_layer_from_it() {
+        let config = config(&[("gh", Some(&["get_*"])), ("gl", None)]);
+        let role_map = tool_map(&[("gl", &["x_*"])]);
+
+        let filters = resolve(&config, None, Some(("dev", &role_map)));
+
+        assert!(filters["gh"].allows("get_issue"));
+        assert!(!filters["gh"].allows("delete_repo"));
+        assert_eq!(filters["gh"].allows_explain("get_issue").unwrap().len(), 1);
+        assert!(filters["gl"].allows("x_1"));
+        assert!(!filters["gl"].allows("y_1"));
+    }
+
+    #[test]
+    fn empty_pattern_list_at_a_level_blocks_all_tools_for_that_server() {
+        let config = config(&[("gh", Some(&["get_*"]))]);
+        let session_map = tool_map(&[("gh", &[])]);
+
+        let filters = resolve(&config, Some(&session_map), None);
+
+        assert!(!filters["gh"].allows("get_issue"));
+        assert_eq!(
+            filters["gh"].allows_explain("get_issue"),
+            Err(&LayerSource::Session)
+        );
+    }
+
+    #[test]
+    fn session_cannot_widen_a_role_restriction() {
+        let config = config(&[("gh", None)]);
+        let role_map = tool_map(&[("gh", &["get_*"])]);
+        let session_map = tool_map(&[("gh", &["*"])]);
+
+        let filters = resolve(&config, Some(&session_map), Some(("dev", &role_map)));
+
+        assert!(filters["gh"].allows("get_issue"));
+        assert!(!filters["gh"].allows("delete_repo"));
+    }
+
+    #[test]
+    fn app_config_map_contributes_its_own_layer() {
+        let config = config(&[("gh", None)]);
+        let app_map = tool_map(&[("gh", &["get_*"])]);
+
+        let filters = McpToolPolicy::effective(
+            &config,
+            None,
+            None,
+            None,
+            Some(&app_map),
+            &[],
+            None,
+            &no_aliases(),
+        );
+
+        assert_eq!(
+            filters["gh"].allows_explain("get_issue").unwrap(),
+            vec![(&LayerSource::AppConfig, "get_*")]
+        );
+        assert!(!filters["gh"].allows("delete_repo"));
+    }
+
+    #[test]
+    fn skill_layer_applies_only_to_its_enabled_servers() {
+        let config = config(&[("gh", None), ("gl", None)]);
+        let skill = SkillMcpLayer {
+            name: "reviewer".to_string(),
+            enabled_servers: vec!["gh".to_string()],
+            mcp_tools: tool_map(&[("gh", &["get_*"]), ("gl", &["*"])]),
+        };
+
+        let filters = McpToolPolicy::effective(
+            &config,
+            None,
+            None,
+            None,
+            None,
+            &[skill],
+            None,
+            &no_aliases(),
+        );
+
+        assert!(filters.contains_key("gh"));
+        assert!(!filters.contains_key("gl"));
+    }
+
+    #[test]
+    fn two_skills_naming_the_same_server_stack_independent_layers() {
+        let config = config(&[("gh", None)]);
+        let skills = vec![
+            SkillMcpLayer {
+                name: "a".to_string(),
+                enabled_servers: vec!["gh".to_string()],
+                mcp_tools: tool_map(&[("gh", &["get_*"])]),
+            },
+            SkillMcpLayer {
+                name: "b".to_string(),
+                enabled_servers: vec!["gh".to_string()],
+                mcp_tools: tool_map(&[("gh", &["*_issue"])]),
+            },
+        ];
+
+        let filters = McpToolPolicy::effective(
+            &config,
+            None,
+            None,
+            None,
+            None,
+            &skills,
+            None,
+            &no_aliases(),
+        );
+
+        assert!(filters["gh"].allows("get_issue"));
+        assert!(!filters["gh"].allows("get_pr"));
+        assert!(!filters["gh"].allows("create_issue"));
+        assert_eq!(filters["gh"].allows_explain("get_issue").unwrap().len(), 2);
+    }
+
+    #[test]
+    fn layers_stack_in_documented_order_with_node_last() {
+        let config = config(&[("gh", Some(&["*"]))]);
+        let app_map = tool_map(&[("gh", &["*"])]);
+        let role_map = tool_map(&[("gh", &["*"])]);
+        let agent_map = tool_map(&[("gh", &["*"])]);
+        let session_map = tool_map(&[("gh", &["*"])]);
+        let skills = vec![SkillMcpLayer {
+            name: "reviewer".to_string(),
+            enabled_servers: vec!["gh".to_string()],
+            mcp_tools: tool_map(&[("gh", &["*"])]),
+        }];
+        let node_map = tool_map(&[("gh", &["*"])]);
+
+        let filters = McpToolPolicy::effective(
+            &config,
+            Some(&session_map),
+            Some(("worker", &agent_map)),
+            Some(("dev", &role_map)),
+            Some(&app_map),
+            &skills,
+            Some(("n1", &node_map)),
+            &no_aliases(),
+        );
+
+        let sources: Vec<String> = filters["gh"]
+            .allows_explain("anything")
+            .unwrap()
+            .iter()
+            .map(|(source, _)| source.to_string())
+            .collect();
+        assert_eq!(
+            sources,
+            vec![
+                "global (mcp.json)",
+                "config (config.yaml)",
+                "role (dev)",
+                "agent (worker)",
+                "session (.set)",
+                "skill (reviewer)",
+                "node (n1)",
+            ]
+        );
+    }
+
+    #[test]
+    fn alias_key_expands_to_all_mapped_servers() {
+        let config = config(&[("github", None), ("gitlab", None)]);
+        let role_map = tool_map(&[("gh", &["get_*"])]);
+
+        let filters = McpToolPolicy::effective(
+            &config,
+            None,
+            None,
+            Some(("dev", &role_map)),
+            None,
+            &[],
+            None,
+            &aliases(&[("gh", "github,gitlab")]),
+        );
+
+        assert!(filters["github"].allows("get_issue"));
+        assert!(!filters["github"].allows("delete_repo"));
+        assert!(filters["gitlab"].allows("get_issue"));
+        assert!(!filters["gitlab"].allows("delete_repo"));
+    }
+
+    #[test]
+    fn alias_ids_missing_from_the_config_are_skipped() {
+        let config = config(&[("github", None)]);
+        let role_map = tool_map(&[("gh", &["get_*"])]);
+
+        let filters = McpToolPolicy::effective(
+            &config,
+            None,
+            None,
+            Some(("dev", &role_map)),
+            None,
+            &[],
+            None,
+            &aliases(&[("gh", "github,missing")]),
+        );
+
+        assert_eq!(filters.len(), 1);
+        assert!(filters.contains_key("github"));
+    }
+
+    #[test]
+    fn unknown_map_keys_are_dropped() {
+        let config = config(&[("github", None)]);
+        let role_map = tool_map(&[("nope", &["get_*"])]);
+
+        let filters = resolve(&config, None, Some(("dev", &role_map)));
+
+        assert!(filters.is_empty());
+    }
+
+    #[test]
+    fn alias_and_direct_key_for_the_same_server_merge_into_one_layer() {
+        let config = config(&[("github", None)]);
+        let role_map = tool_map(&[("gh", &["get_*"]), ("github", &["set_*"])]);
+
+        let filters = McpToolPolicy::effective(
+            &config,
+            None,
+            None,
+            Some(("dev", &role_map)),
+            None,
+            &[],
+            None,
+            &aliases(&[("gh", "github")]),
+        );
+
+        assert!(filters["github"].allows("get_issue"));
+        assert!(filters["github"].allows("set_topic"));
+        assert!(!filters["github"].allows("delete_repo"));
+        assert_eq!(
+            filters["github"].allows_explain("get_issue").unwrap().len(),
+            1
+        );
+    }
+
+    #[test]
+    fn layer_source_display() {
+        assert_eq!(LayerSource::Global.to_string(), "global (mcp.json)");
+        assert_eq!(LayerSource::AppConfig.to_string(), "config (config.yaml)");
+        assert_eq!(LayerSource::Role("dev".into()).to_string(), "role (dev)");
+        assert_eq!(
+            LayerSource::Agent("worker".into()).to_string(),
+            "agent (worker)"
+        );
+        assert_eq!(LayerSource::Session.to_string(), "session (.set)");
+        assert_eq!(
+            LayerSource::Skill("review".into()).to_string(),
+            "skill (review)"
+        );
+        assert_eq!(LayerSource::Node("n1".into()).to_string(), "node (n1)");
+    }
+
+    #[test]
+    fn dead_context_patterns_flags_patterns_matching_nothing() {
+        let filter = layered(&[
+            (LayerSource::Global, &["get_*"]),
+            (LayerSource::Role("dev".into()), &["get_issue", "set_*"]),
+        ]);
+
+        let advertised = vec!["get_issue".to_string(), "set_topic".to_string()];
+        let dead = filter.dead_context_patterns(&advertised);
+
+        // set_* only matches set_topic, which the global layer hides.
+        assert_eq!(dead, vec![(&LayerSource::Role("dev".into()), "set_*")]);
+    }
+
+    #[test]
+    fn dead_context_patterns_is_empty_when_every_pattern_is_live() {
+        let filter = layered(&[
+            (LayerSource::Global, &["get_*"]),
+            (LayerSource::Session, &["get_issue"]),
+        ]);
+
+        let advertised = vec!["get_issue".to_string()];
+        assert!(filter.dead_context_patterns(&advertised).is_empty());
+    }
+
+    #[test]
+    fn dead_context_patterns_ignores_the_global_layer_itself() {
+        let filter = layered(&[(LayerSource::Global, &["zzz_*"])]);
+
+        let advertised = vec!["get_issue".to_string()];
+        assert!(filter.dead_context_patterns(&advertised).is_empty());
+    }
+
+    #[test]
+    fn expand_mcp_server_alias_splits_and_trims() {
+        let aliases = aliases(&[("gh", "github, gitlab,")]);
+
+        assert_eq!(
+            expand_mcp_server_alias(&aliases, "gh"),
+            vec!["github".to_string(), "gitlab".to_string()]
+        );
+        assert!(expand_mcp_server_alias(&aliases, "nope").is_empty());
+    }
+}

src/config/mod.rs

@@ -1,11 +1,14 @@
 mod agent;
 mod app_config;
 mod app_state;
+mod bundles;
 mod input;
 mod install_remote;
 pub(crate) mod instructions;
+mod macro_policy;
 mod macros;
 mod mcp_factory;
+mod mcp_tool_policy;
 pub(crate) mod memory;
 pub(crate) mod paths;
 pub(crate) mod prompts;
@@ -20,6 +23,8 @@ pub(crate) mod todo;
 mod tool_scope;
 mod update;
 
+#[cfg(test)]
+pub(crate) use self::agent::AgentConfig;
 pub use self::agent::{
     Agent, AgentVariable, AgentVariables, complete_agent_variables, list_agents,
     list_agents_with_descriptions,
@@ -28,10 +33,23 @@ pub use self::agent::{
 pub use self::app_config::AppConfig;
 #[allow(unused_imports)]
 pub use self::app_state::AppState;
+pub use self::bundles::list_installed_bundles;
 pub use self::input::Input;
-pub use self::install_remote::{install_remote, install_remote_from_repl_args};
+pub use self::install_remote::{
+    DEFAULT_GIT_HOST, install_or_update, install_or_update_from_repl_args, uninstall_bundle,
+    update_bundle,
+};
+pub use self::macro_policy::{
+    MacroAllowlistLevel, MacroPolicy, MacroSource, MacroState, RESERVED_MACRO_NAMES, ResolvedMacro,
+};
+pub(crate) use self::mcp_tool_policy::expand_mcp_server_alias;
+#[cfg(test)]
+pub(crate) use self::mcp_tool_policy::{LayerSource, ToolFilter};
 #[allow(unused_imports)]
-pub use self::request_context::{RenderMode, RequestContext, should_inject_skill_instructions};
+pub use self::request_context::{
+    RenderMode, RequestContext, effective_max_concurrent_jobs, jobs_enabled,
+    should_inject_skill_instructions,
+};
 pub use self::role::{
     CODE_ROLE, CREATE_TITLE_ROLE, EXPLAIN_SHELL_ROLE, Role, RoleLike, SHELL_ROLE,
 };
@@ -42,6 +60,12 @@ pub use self::skill::Skill;
 pub use self::skill_policy::SkillPolicy;
 #[allow(unused_imports)]
 pub use self::skill_registry::SkillRegistry;
+#[cfg(test)]
+pub(crate) use self::tool_scope::test_fixtures;
+pub use self::tool_scope::{
+    McpPromptCompletion, McpRuntime, flatten_prompt_messages, resolve_prompt_args,
+    sanitize_display_text,
+};
 pub use self::update::run_self_update;
 use crate::client::{
     self, ClientConfig, MessageContentToolCalls, Model, ModelType, OPENAI_COMPATIBLE_PROVIDERS,
@@ -151,6 +175,8 @@ const SBX_KIT_DIR_NAME: &str = "sbx-kit";
 const SBX_KIT_HASH_FILE: &str = "kit.sha256";
 const SBX_MIXIN_FILE_NAME: &str = "sbx-mixin.yaml";
 pub(crate) const VAULT_DATA_FILE_NAME: &str = "vault.yml";
+const INSTALLED_BUNDLES_FILE_NAME: &str = "installed-bundles.yaml";
+const BUNDLE_MANIFEST_FILE: &str = "coyote-bundle.yaml";
 const SBX_MIXIN_KITS_DIR_NAME: &str = "sbx-mixin-kits";
 const GIT_DIR_NAME: &str = ".git";
 const GITIGNORE_FILE_NAME: &str = ".gitignore";
@@ -221,11 +247,14 @@ pub struct Config {
     #[serde(default, deserialize_with = "deserialize_csv_or_vec")]
     pub enabled_skills: Option<Vec<String>>,
     pub visible_skills: Option<Vec<String>>,
+    #[serde(default, deserialize_with = "deserialize_csv_or_vec")]
+    pub enabled_macros: Option<Vec<String>>,
 
     pub mcp_server_support: bool,
     pub mapping_mcp_servers: IndexMap<String, String>,
     #[serde(default, deserialize_with = "deserialize_csv_or_vec")]
     pub enabled_mcp_servers: Option<Vec<String>>,
+    pub mcp_tools: Option<IndexMap<String, Vec<String>>>,
 
     pub auto_continue: bool,
     pub max_auto_continues: usize,
@@ -244,6 +273,7 @@ pub struct Config {
     pub summarization_prompt: Option<String>,
     pub summary_context_prompt: Option<String>,
     pub max_tool_result_chars: Option<usize>,
+    pub max_concurrent_jobs: Option<usize>,
 
     pub memory: Option<bool>,
     pub memory_cap_with_tools: Option<usize>,
@@ -303,10 +333,12 @@ impl Default for Config {
             skills_enabled: true,
             enabled_skills: None,
             visible_skills: None,
+            enabled_macros: None,
 
             mcp_server_support: true,
             mapping_mcp_servers: Default::default(),
             enabled_mcp_servers: None,
+            mcp_tools: None,
 
             auto_continue: false,
             max_auto_continues: 10,
@@ -325,6 +357,7 @@ impl Default for Config {
             summarization_prompt: None,
             summary_context_prompt: None,
             max_tool_result_chars: None,
+            max_concurrent_jobs: None,
 
             memory: None,
             memory_cap_with_tools: None,
@@ -374,12 +407,12 @@ pub enum AssetCategory {
     Macros,
     Functions,
     Skills,
-    #[value(name = "mcp_config")]
+    #[value(name = "mcp-config", alias = "mcp_config")]
     McpConfig,
 }
 
 impl AssetCategory {
-    pub const NAMES: [&'static str; 5] = ["agents", "macros", "functions", "skills", "mcp_config"];
+    pub const NAMES: [&'static str; 5] = ["agents", "macros", "functions", "skills", "mcp-config"];
 
     pub fn parse(name: &str) -> Option<Self> {
         match name {
@@ -387,7 +420,7 @@ impl AssetCategory {
             "macros" => Some(Self::Macros),
             "functions" => Some(Self::Functions),
             "skills" => Some(Self::Skills),
-            "mcp_config" => Some(Self::McpConfig),
+            "mcp-config" | "mcp_config" => Some(Self::McpConfig),
             _ => None,
         }
     }
@@ -406,7 +439,7 @@ pub enum InstallFilter {
     Skills,
     Macros,
     Functions,
-    #[value(name = "mcp_config")]
+    #[value(name = "mcp-config", alias = "mcp_config")]
     McpConfig,
 }
 
@@ -417,7 +450,7 @@ impl InstallFilter {
         "skills",
         "macros",
         "functions",
-        "mcp_config",
+        "mcp-config",
     ];
 
     pub fn parse(name: &str) -> Option<Self> {
@@ -427,7 +460,7 @@ impl InstallFilter {
             "skills" => Some(Self::Skills),
             "macros" => Some(Self::Macros),
             "functions" => Some(Self::Functions),
-            "mcp_config" => Some(Self::McpConfig),
+            "mcp-config" | "mcp_config" => Some(Self::McpConfig),
             _ => None,
         }
     }
@@ -1101,6 +1134,17 @@ clients:
         assert!(validate_no_template_in_secrets_provider(yaml).is_ok());
     }
 
+    #[test]
+    fn config_yaml_parses_mcp_tools() {
+        let cfg: Config = serde_yaml::from_str("mcp_tools:\n  github:\n    - get_*\n").unwrap();
+
+        assert_eq!(
+            cfg.mcp_tools.as_ref().unwrap().get("github"),
+            Some(&vec!["get_*".to_string()])
+        );
+        assert_eq!(Config::default().mcp_tools, None);
+    }
+
     #[test]
     fn config_defaults_match_expected() {
         let cfg = Config::default();
@@ -1124,9 +1168,50 @@ clients:
         assert!(cfg.enabled_mcp_servers.is_none());
     }
 
+    #[test]
+    fn config_enabled_macros_absent_is_none() {
+        let cfg: Config = serde_yaml::from_str("model: provider:test").unwrap();
+        assert_eq!(cfg.enabled_macros, None);
+    }
+
+    #[test]
+    fn config_enabled_macros_empty_string_is_some_empty() {
+        let cfg: Config = serde_yaml::from_str("enabled_macros: \"\"").unwrap();
+
+        assert_eq!(cfg.enabled_macros, Some(vec![]));
+    }
+
+    #[test]
+    fn config_enabled_macros_csv_string() {
+        let cfg: Config = serde_yaml::from_str("enabled_macros: \"a, b\"").unwrap();
+
+        assert_eq!(
+            cfg.enabled_macros,
+            Some(vec!["a".to_string(), "b".to_string()])
+        );
+    }
+
+    #[test]
+    fn config_enabled_macros_list() {
+        let cfg: Config = serde_yaml::from_str("enabled_macros:\n  - a\n  - b").unwrap();
+
+        assert_eq!(
+            cfg.enabled_macros,
+            Some(vec!["a".to_string(), "b".to_string()])
+        );
+    }
+
+    #[test]
+    fn config_enabled_macros_null_is_none() {
+        let cfg: Config = serde_yaml::from_str("enabled_macros: null").unwrap();
+
+        assert_eq!(cfg.enabled_macros, None);
+    }
+
     #[test]
     fn assert_state_pass_always_true() {
         let pass = AssertState::pass();
+
         assert!(pass.assert(StateFlags::empty()));
         assert!(pass.assert(StateFlags::ROLE));
         assert!(pass.assert(StateFlags::SESSION | StateFlags::AGENT));
@@ -1136,6 +1221,7 @@ clients:
     #[test]
     fn assert_state_bare_only_empty() {
         let bare = AssertState::bare();
+
         assert!(bare.assert(StateFlags::empty()));
         assert!(!bare.assert(StateFlags::ROLE));
         assert!(!bare.assert(StateFlags::SESSION));
@@ -1144,6 +1230,7 @@ clients:
     #[test]
     fn assert_state_true_requires_flag_present() {
         let state = AssertState::True(StateFlags::ROLE);
+
         assert!(state.assert(StateFlags::ROLE));
         assert!(state.assert(StateFlags::ROLE | StateFlags::SESSION));
         assert!(!state.assert(StateFlags::empty()));
@@ -1153,6 +1240,7 @@ clients:
     #[test]
     fn assert_state_true_with_multiple_flags_any_match() {
         let state = AssertState::True(StateFlags::SESSION_EMPTY | StateFlags::SESSION);
+
         assert!(state.assert(StateFlags::SESSION_EMPTY));
         assert!(state.assert(StateFlags::SESSION));
         assert!(state.assert(StateFlags::SESSION | StateFlags::ROLE));
@@ -1163,6 +1251,7 @@ clients:
     #[test]
     fn assert_state_false_requires_flag_absent() {
         let state = AssertState::False(StateFlags::AGENT);
+
         assert!(state.assert(StateFlags::empty()));
         assert!(state.assert(StateFlags::ROLE));
         assert!(!state.assert(StateFlags::AGENT));
@@ -1172,6 +1261,7 @@ clients:
     #[test]
     fn assert_state_false_with_multiple_flags() {
         let state = AssertState::False(StateFlags::SESSION | StateFlags::AGENT);
+
         assert!(state.assert(StateFlags::empty()));
         assert!(state.assert(StateFlags::ROLE));
         assert!(!state.assert(StateFlags::SESSION));
@@ -1182,6 +1272,7 @@ clients:
     #[test]
     fn assert_state_truefalse_requires_true_present_and_false_absent() {
         let state = AssertState::TrueFalse(StateFlags::ROLE, StateFlags::SESSION);
+
         assert!(state.assert(StateFlags::ROLE));
         assert!(state.assert(StateFlags::ROLE | StateFlags::RAG));
         assert!(!state.assert(StateFlags::empty()));
@@ -1192,6 +1283,7 @@ clients:
     #[test]
     fn assert_state_equal_exact_match() {
         let state = AssertState::Equal(StateFlags::ROLE | StateFlags::SESSION);
+
         assert!(state.assert(StateFlags::ROLE | StateFlags::SESSION));
         assert!(!state.assert(StateFlags::ROLE));
         assert!(!state.assert(StateFlags::SESSION));

src/config/paths.rs

@@ -2,10 +2,10 @@ use super::role::Role;
 use super::{
     AGENT_GRAPH_FILE_NAME, AGENTS_DIR_NAME, BASH_PROMPT_UTILS_FILE_NAME, CONFIG_FILE_NAME,
     ENV_FILE_NAME, FUNCTIONS_BIN_DIR_NAME, FUNCTIONS_DIR_NAME, GLOBAL_TOOLS_DIR_NAME,
-    GLOBAL_TOOLS_UTILS_DIR_NAME, HIDDEN_MCP_FILE_NAME, MACROS_DIR_NAME, MCP_FILE_NAME,
+    GLOBAL_TOOLS_UTILS_DIR_NAME, HIDDEN_MCP_FILE_NAME, INSTALLED_BUNDLES_FILE_NAME,
-    MEMORY_DIR_NAME, MEMORY_INDEX_FILE_NAME, ModelsOverride, RAGS_DIR_NAME, ROLES_DIR_NAME,
+    MACROS_DIR_NAME, MCP_FILE_NAME, MEMORY_DIR_NAME, MEMORY_INDEX_FILE_NAME, ModelsOverride,
-    SBX_KIT_DIR_NAME, SBX_KIT_HASH_FILE, SBX_MIXIN_FILE_NAME, SBX_MIXIN_KITS_DIR_NAME,
+    RAGS_DIR_NAME, ROLES_DIR_NAME, SBX_KIT_DIR_NAME, SBX_KIT_HASH_FILE, SBX_MIXIN_FILE_NAME,
-    SKILLS_DIR_NAME, WORKSPACE_COYOTE_DIR_NAME,
+    SBX_MIXIN_KITS_DIR_NAME, SKILLS_DIR_NAME, WORKSPACE_COYOTE_DIR_NAME,
 };
 use crate::client::ProviderModels;
 use crate::config::REPL_HISTORY_DIR_NAME;
@@ -148,6 +148,16 @@ pub fn sbx_kit_hash_file() -> PathBuf {
     sbx_kit_dir().join(SBX_KIT_HASH_FILE)
 }
 
+pub fn sandbox_mixin_hashes_dir() -> PathBuf {
+    cache_dir().join("sandbox-mixin-hashes")
+}
+
+pub fn sandbox_mixin_hash_file(sandbox_name: &str) -> PathBuf {
+    // Sandbox names are sanitized by the caller, but never trust a path
+    // component: a stray separator must not escape the hash directory.
+    sandbox_mixin_hashes_dir().join(format!("{}.hash", sandbox_name.replace('/', "_")))
+}
+
 pub fn sbx_mixin_kits_dir() -> PathBuf {
     cache_dir().join(SBX_MIXIN_KITS_DIR_NAME)
 }
@@ -159,6 +169,10 @@ pub fn config_file() -> PathBuf {
     }
 }
 
+pub fn installed_bundles_file() -> PathBuf {
+    local_dir(INSTALLED_BUNDLES_FILE_NAME)
+}
+
 pub fn roles_dir() -> PathBuf {
     match env::var(get_env_name("roles_dir")) {
         Ok(value) => PathBuf::from(value),
@@ -204,6 +218,10 @@ pub fn workspace_skill_file(name: &str) -> PathBuf {
     workspace_skills_dir().join(name).join("SKILL.md")
 }
 
+pub fn workspace_macros_dir() -> PathBuf {
+    workspace_config_dir().join(MACROS_DIR_NAME)
+}
+
 pub fn workspace_mcp_config_file() -> Option<PathBuf> {
     workspace_mcp_config_file_in(&env::current_dir().unwrap_or_default())
 }
@@ -269,6 +287,18 @@ pub fn functions_bin_dir() -> PathBuf {
 }
 
 pub fn mcp_config_file() -> PathBuf {
+    let preferred = local_dir(MCP_FILE_NAME);
+    if preferred.exists() {
+        return preferred;
+    }
+    let legacy = legacy_mcp_config_file();
+    if legacy.exists() {
+        return legacy;
+    }
+    preferred
+}
+
+pub fn legacy_mcp_config_file() -> PathBuf {
     functions_dir().join(MCP_FILE_NAME)
 }
 
@@ -460,11 +490,6 @@ pub fn list_macros() -> Vec<String> {
     list_file_names(macros_dir(), ".yaml")
 }
 
-pub fn has_macro(name: &str) -> bool {
-    let names = list_macros();
-    names.contains(&name.to_string())
-}
-
 pub fn list_skills() -> Vec<String> {
     let mut names = Vec::new();
     let mut seen = HashSet::new();
@@ -824,6 +849,80 @@ mod tests {
         }
     }
 
+    mod user_mcp_resolution {
+        use super::*;
+        use serial_test::serial;
+
+        fn with_config_dir<F: FnOnce(&Path)>(f: F) {
+            let unique = time::SystemTime::now()
+                .duration_since(time::UNIX_EPOCH)
+                .unwrap()
+                .as_nanos();
+            let root = env::temp_dir().join(format!("coyote-user-mcp-test-{unique}"));
+            fs::create_dir_all(root.join(FUNCTIONS_DIR_NAME)).unwrap();
+            let config_env = get_env_name("config_dir");
+            let functions_env = get_env_name("functions_dir");
+            let prev_config = env::var_os(&config_env);
+            let prev_functions = env::var_os(&functions_env);
+            unsafe {
+                env::set_var(&config_env, &root);
+                env::set_var(&functions_env, root.join(FUNCTIONS_DIR_NAME));
+            }
+            f(&root);
+            unsafe {
+                match prev_config {
+                    Some(v) => env::set_var(&config_env, v),
+                    None => env::remove_var(&config_env),
+                }
+                match prev_functions {
+                    Some(v) => env::set_var(&functions_env, v),
+                    None => env::remove_var(&functions_env),
+                }
+            }
+            let _ = fs::remove_dir_all(&root);
+        }
+
+        #[test]
+        #[serial]
+        fn defaults_to_preferred_location_when_neither_exists() {
+            with_config_dir(|root| {
+                assert_eq!(mcp_config_file(), root.join(MCP_FILE_NAME));
+            });
+        }
+
+        #[test]
+        #[serial]
+        fn falls_back_to_legacy_location_when_only_it_exists() {
+            with_config_dir(|root| {
+                let legacy = root.join(FUNCTIONS_DIR_NAME).join(MCP_FILE_NAME);
+                fs::write(&legacy, "{}").unwrap();
+                assert_eq!(mcp_config_file(), legacy);
+            });
+        }
+
+        #[test]
+        #[serial]
+        fn prefers_new_location_when_both_exist() {
+            with_config_dir(|root| {
+                let preferred = root.join(MCP_FILE_NAME);
+                let legacy = root.join(FUNCTIONS_DIR_NAME).join(MCP_FILE_NAME);
+                fs::write(&preferred, "{}").unwrap();
+                fs::write(&legacy, "{}").unwrap();
+                assert_eq!(mcp_config_file(), preferred);
+            });
+        }
+
+        #[test]
+        #[serial]
+        fn uses_preferred_location_when_only_it_exists() {
+            with_config_dir(|root| {
+                let preferred = root.join(MCP_FILE_NAME);
+                fs::write(&preferred, "{}").unwrap();
+                assert_eq!(mcp_config_file(), preferred);
+            });
+        }
+    }
+
     #[test]
     fn sandbox_kit_override_reflects_env_var_state() {
         let env_name = get_env_name("sandbox_kit");

src/config/prompts.rs

@@ -82,7 +82,7 @@ pub(in crate::config) const DEFAULT_SPAWN_INSTRUCTIONS: &str = indoc! {"
     | Tool | Purpose |
     |------|----------|
     | `agent__spawn` | Spawn a subagent in the background. Returns an `id` immediately. |
-    | `agent__check` | Non-blocking check: is the agent done yet? Returns PENDING or result. |
+    | `agent__check` | Non-blocking status probe: running or finished. Never returns/consumes the result — use `agent__collect`. |
     | `agent__collect` | Blocking wait: wait for an agent to finish, return its output. |
     | `agent__list_available` | List all agent types you can spawn (name + description). Use this to discover specialists before calling `agent__spawn`. |
     | `agent__list_running` | List all subagents YOU have spawned, with their status. |
@@ -112,9 +112,10 @@ pub(in crate::config) const DEFAULT_SPAWN_INSTRUCTIONS: &str = indoc! {"
 
     ### CRITICAL: Never end your turn with pending agents
 
-    Spawned agents do NOT report back on their own. They run in the background until you
+    Spawned agents do NOT deliver their results on their own. When one finishes, a
-    actively reclaim them with `agent__collect` (to get their output) or `agent__cancel`
+    `system_notifications` entry appears on your next tool result naming the exact collect
-    (to discard them). If you spawn agents and then emit a final message without reclaiming
+    command — but the output is only retrieved when you actively reclaim it with `agent__collect`
+    (or discard it with `agent__cancel`). If you spawn agents and then emit a final message without reclaiming
     them, the system will detect the unreclaimed agents and reject the turn-end, injecting
     a reminder forcing you to handle them. After several such reminders, the system will
     auto-cancel them and warn you that work was lost.
@@ -190,6 +191,23 @@ pub(in crate::config) const DEFAULT_SPAWN_INSTRUCTIONS: &str = indoc! {"
     4. **Respond promptly**; the child agent is blocked and waiting (5-minute timeout).
 "};
 
+pub(in crate::config) const DEFAULT_JOB_INSTRUCTIONS: &str = indoc! {"
+    ## Background Jobs
+
+    For long-running tool calls (builds, test suites, slow commands), call `job__start` and keep
+    working instead of blocking — completion arrives as a `system_notifications` entry on your
+    next tool result. Check progress with `job__check` (sparingly), block on the result with
+    `job__collect` (only when you have nothing else to do), cancel with `job__cancel`, and list
+    jobs with `job__list`. Collected results over 50,000 chars are tail-capped; collecting is
+    consume-once, so when you need the complete output pass `full_result: true` (or have the
+    command write to a file). Collect or cancel every job you started before ending your turn. In
+    graph LLM nodes, jobs are node-local: collect or cancel every job you start before the node
+    ends — an uncollected job burns node iterations via the guardrail, and anything still
+    running when the node exits is cancelled with its result discarded. Jobs run against a
+    snapshot of the current config/environment and do not survive coyote exiting.
+"
+};
+
 pub(in crate::config) const DEFAULT_TEAMMATE_INSTRUCTIONS: &str = indoc! {"
     ## Teammate Messaging
 

src/config/role.rs

@@ -30,6 +30,7 @@ pub trait RoleLike {
     fn top_p(&self) -> Option<f64>;
     fn enabled_tools(&self) -> Option<Vec<String>>;
     fn enabled_mcp_servers(&self) -> Option<Vec<String>>;
+    fn mcp_tools(&self) -> Option<IndexMap<String, Vec<String>>>;
     fn set_model(&mut self, model: Model);
     fn set_temperature(&mut self, value: Option<f64>);
     fn reasoning_effort(&self) -> Option<String>;
@@ -37,6 +38,7 @@ pub trait RoleLike {
     fn set_reasoning_effort(&mut self, value: Option<String>);
     fn set_enabled_tools(&mut self, value: Option<Vec<String>>);
     fn set_enabled_mcp_servers(&mut self, value: Option<Vec<String>>);
+    fn set_mcp_tools(&mut self, value: Option<IndexMap<String, Vec<String>>>);
 }
 
 #[derive(Debug, Clone, Default, Deserialize, Serialize)]
@@ -67,6 +69,8 @@ pub struct Role {
         deserialize_with = "super::deserialize_csv_or_vec"
     )]
     enabled_mcp_servers: Option<Vec<String>>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    mcp_tools: Option<IndexMap<String, Vec<String>>>,
     #[serde(skip_serializing_if = "Option::is_none")]
     skills_enabled: Option<bool>,
     #[serde(
@@ -75,6 +79,12 @@ pub struct Role {
         deserialize_with = "super::deserialize_csv_or_vec"
     )]
     enabled_skills: Option<Vec<String>>,
+    #[serde(
+        default,
+        skip_serializing_if = "Option::is_none",
+        deserialize_with = "super::deserialize_csv_or_vec"
+    )]
+    enabled_macros: Option<Vec<String>>,
     #[serde(skip_serializing_if = "Option::is_none")]
     auto_continue: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -127,8 +137,10 @@ impl Role {
                     "enabled_mcp_servers" => {
                         role.enabled_mcp_servers = parse_string_or_array(value)
                     }
+                    "mcp_tools" => role.mcp_tools = parse_mcp_tools_map(value),
                     "skills_enabled" => role.skills_enabled = value.as_bool(),
                     "enabled_skills" => role.enabled_skills = parse_string_or_array(value),
+                    "enabled_macros" => role.enabled_macros = parse_string_or_array(value),
                     "auto_continue" => role.auto_continue = value.as_bool(),
                     "max_auto_continues" => {
                         role.max_auto_continues = value.as_u64().map(|v| v as usize)
@@ -189,6 +201,10 @@ impl Role {
                 serde_json::to_string(enabled_mcp_servers).unwrap_or_else(|_| "[]".to_string());
             metadata.push(format!("enabled_mcp_servers: {inline}"));
         }
+        if let Some(mcp_tools) = &self.mcp_tools {
+            let inline = serde_json::to_string(mcp_tools).unwrap_or_else(|_| "{}".to_string());
+            metadata.push(format!("mcp_tools: {inline}"));
+        }
         if let Some(skills_enabled) = self.skills_enabled {
             metadata.push(format!("skills_enabled: {skills_enabled}"));
         }
@@ -196,6 +212,10 @@ impl Role {
             let inline = serde_json::to_string(enabled_skills).unwrap_or_else(|_| "[]".to_string());
             metadata.push(format!("enabled_skills: {inline}"));
         }
+        if let Some(enabled_macros) = &self.enabled_macros {
+            let inline = serde_json::to_string(enabled_macros).unwrap_or_else(|_| "[]".to_string());
+            metadata.push(format!("enabled_macros: {inline}"));
+        }
         if let Some(auto_continue) = self.auto_continue {
             metadata.push(format!("auto_continue: {auto_continue}"));
         }
@@ -268,6 +288,10 @@ impl Role {
             enabled_tools,
             enabled_mcp_servers,
         );
+        let mcp_tools = role_like.mcp_tools();
+        if mcp_tools.is_some() {
+            self.set_mcp_tools(mcp_tools);
+        }
     }
 
     pub fn batch_set(
@@ -357,6 +381,10 @@ impl Role {
         self.enabled_skills.as_deref()
     }
 
+    pub fn enabled_macros(&self) -> Option<&[String]> {
+        self.enabled_macros.as_deref()
+    }
+
     pub fn append_to_prompt(&mut self, text: &str) {
         self.prompt.push_str(text);
     }
@@ -438,6 +466,10 @@ impl RoleLike for Role {
         self.enabled_mcp_servers.clone()
     }
 
+    fn mcp_tools(&self) -> Option<IndexMap<String, Vec<String>>> {
+        self.mcp_tools.clone()
+    }
+
     fn set_model(&mut self, model: Model) {
         if !self.model().id().is_empty() {
             self.model_id = Some(model.id().to_string());
@@ -464,6 +496,10 @@ impl RoleLike for Role {
     fn set_enabled_mcp_servers(&mut self, value: Option<Vec<String>>) {
         self.enabled_mcp_servers = value;
     }
+
+    fn set_mcp_tools(&mut self, value: Option<IndexMap<String, Vec<String>>>) {
+        self.mcp_tools = value;
+    }
 }
 
 fn parse_string_or_array(value: &Value) -> Option<Vec<String>> {
@@ -488,6 +524,19 @@ fn parse_string_or_array(value: &Value) -> Option<Vec<String>> {
     None
 }
 
+fn parse_mcp_tools_map(value: &Value) -> Option<IndexMap<String, Vec<String>>> {
+    let map = value.as_object()?;
+    let mut mcp_tools = IndexMap::new();
+    for (server, tools) in map {
+        if tools.is_null() {
+            mcp_tools.insert(server.clone(), Vec::new());
+        } else if let Some(tools) = parse_string_or_array(tools) {
+            mcp_tools.insert(server.clone(), tools);
+        }
+    }
+    Some(mcp_tools)
+}
+
 fn parse_structure_prompt(prompt: &str) -> (&str, Vec<(&str, &str)>) {
     let mut text = prompt;
     let mut search_input = true;
@@ -543,6 +592,7 @@ mod tests {
     #[test]
     fn role_new_parses_prompt() {
         let role = Role::new("test", "You are a helpful assistant");
+
         assert_eq!(role.name(), "test");
         assert_eq!(role.prompt(), "You are a helpful assistant");
     }
@@ -551,7 +601,9 @@ mod tests {
     fn role_new_parses_metadata() {
         let content =
             "---\nmodel: openai:gpt-4\ntemperature: 0.7\ntop_p: 0.9\n---\nYou are helpful";
+
         let role = Role::new("test", content);
+
         assert_eq!(role.model_id(), Some("openai:gpt-4"));
         assert_eq!(role.temperature(), Some(0.7));
         assert_eq!(role.top_p(), Some(0.9));
@@ -561,7 +613,9 @@ mod tests {
     #[test]
     fn role_new_parses_enabled_tools() {
         let content = "---\nenabled_tools: tool1,tool2\n---\nPrompt";
+
         let role = Role::new("test", content);
+
         assert_eq!(
             role.enabled_tools(),
             Some(vec!["tool1".to_string(), "tool2".to_string()])
@@ -571,7 +625,9 @@ mod tests {
     #[test]
     fn role_new_parses_enabled_mcp_servers() {
         let content = "---\nenabled_mcp_servers: github,jira\n---\nPrompt";
+
         let role = Role::new("test", content);
+
         assert_eq!(
             role.enabled_mcp_servers(),
             Some(vec!["github".to_string(), "jira".to_string()])
@@ -581,6 +637,7 @@ mod tests {
     #[test]
     fn role_new_no_metadata_has_none_fields() {
         let role = Role::new("test", "Just a prompt");
+
         assert_eq!(role.model_id(), None);
         assert_eq!(role.temperature(), None);
         assert_eq!(role.top_p(), None);
@@ -588,9 +645,130 @@ mod tests {
         assert_eq!(role.enabled_mcp_servers(), None);
     }
 
+    #[test]
+    fn role_new_enabled_macros_absent_is_none() {
+        let role = Role::new("test", "---\ntemperature: 0.5\n---\nPrompt");
+
+        assert_eq!(role.enabled_macros, None);
+    }
+
+    #[test]
+    fn role_new_enabled_macros_empty_string_is_some_empty() {
+        let role = Role::new("test", "---\nenabled_macros: \"\"\n---\nPrompt");
+
+        assert_eq!(role.enabled_macros, Some(vec![]));
+    }
+
+    #[test]
+    fn role_new_enabled_macros_csv_string() {
+        let role = Role::new("test", "---\nenabled_macros: a, b\n---\nPrompt");
+
+        assert_eq!(
+            role.enabled_macros,
+            Some(vec!["a".to_string(), "b".to_string()])
+        );
+    }
+
+    #[test]
+    fn role_new_enabled_macros_list() {
+        let role = Role::new("test", "---\nenabled_macros: [a, b]\n---\nPrompt");
+
+        assert_eq!(
+            role.enabled_macros,
+            Some(vec!["a".to_string(), "b".to_string()])
+        );
+    }
+
+    #[test]
+    fn role_new_enabled_macros_null_is_none() {
+        let role = Role::new("test", "---\nenabled_macros: null\n---\nPrompt");
+
+        assert_eq!(role.enabled_macros, None);
+    }
+
+    #[test]
+    fn role_new_parses_mcp_tools_list_and_csv_values() {
+        let content = "---\nmcp_tools:\n  github: [get_*, list_*, search_code]\n  slack: conversations_history,conversations_replies\n---\nPrompt";
+
+        let role = Role::new("test", content);
+
+        let mcp_tools = role.mcp_tools().unwrap();
+        assert_eq!(
+            mcp_tools.get("github"),
+            Some(&vec![
+                "get_*".to_string(),
+                "list_*".to_string(),
+                "search_code".to_string()
+            ])
+        );
+        assert_eq!(
+            mcp_tools.get("slack"),
+            Some(&vec![
+                "conversations_history".to_string(),
+                "conversations_replies".to_string()
+            ])
+        );
+    }
+
+    #[test]
+    fn role_new_mcp_tools_empty_list_server_is_some_empty() {
+        let role = Role::new("test", "---\nmcp_tools:\n  github: []\n---\nPrompt");
+
+        assert_eq!(role.mcp_tools().unwrap().get("github"), Some(&vec![]));
+    }
+
+    #[test]
+    fn role_new_mcp_tools_per_server_null_is_some_empty() {
+        let role = Role::new("test", "---\nmcp_tools:\n  github:\n---\nPrompt");
+
+        assert_eq!(role.mcp_tools().unwrap().get("github"), Some(&vec![]));
+    }
+
+    #[test]
+    fn role_new_mcp_tools_absent_is_none() {
+        let role = Role::new("test", "---\ntemperature: 0.5\n---\nPrompt");
+
+        assert_eq!(role.mcp_tools(), None);
+    }
+
+    #[test]
+    fn role_new_mcp_tools_null_is_none() {
+        let role = Role::new("test", "---\nmcp_tools: null\n---\nPrompt");
+
+        assert_eq!(role.mcp_tools(), None);
+    }
+
+    #[test]
+    fn role_export_mcp_tools_round_trips() {
+        let content = "---\nmcp_tools:\n  github: [get_issue]\n  slack: a,b\n---\nPrompt";
+        let role = Role::new("test", content);
+
+        let reparsed = Role::new("test", &role.export());
+
+        assert_eq!(reparsed.mcp_tools(), role.mcp_tools());
+        assert!(role.mcp_tools().is_some());
+    }
+
+    #[test]
+    fn role_export_includes_enabled_macros() {
+        let role = Role::new("test", "---\nenabled_macros: [a]\n---\nPrompt");
+
+        let exported = role.export();
+
+        assert!(exported.contains("enabled_macros: [\"a\"]"));
+    }
+
+    #[test]
+    fn role_export_omits_enabled_macros_when_none() {
+        let role = Role::new("test", "Just a prompt");
+
+        assert!(!role.export().contains("enabled_macros"));
+    }
+
     #[test]
     fn role_builtin_shell_loads() {
         let role = Role::builtin("shell").unwrap();
+
         assert_eq!(role.name(), "shell");
         assert!(!role.prompt().is_empty());
     }
@@ -598,6 +776,7 @@ mod tests {
     #[test]
     fn role_builtin_code_loads() {
         let role = Role::builtin("code").unwrap();
+
         assert_eq!(role.name(), "code");
         assert!(!role.prompt().is_empty());
     }
@@ -605,12 +784,14 @@ mod tests {
     #[test]
     fn role_builtin_nonexistent_errors() {
         let result = Role::builtin("nonexistent_role_xyz");
+
         assert!(result.is_err());
     }
 
     #[test]
     fn role_default_has_empty_fields() {
         let role = Role::default();
+
         assert_eq!(role.name(), "");
         assert_eq!(role.prompt(), "");
         assert_eq!(role.model_id(), None);
@@ -620,14 +801,18 @@ mod tests {
     fn role_set_model_updates_model() {
         let mut role = Role::new("test", "prompt");
         let model = Model::default();
+
         role.set_model(model.clone());
+
         assert_eq!(role.model().id(), model.id());
     }
 
     #[test]
     fn role_set_temperature_works() {
         let mut role = Role::new("test", "prompt");
+
         role.set_temperature(Some(0.5));
+
         assert_eq!(role.temperature(), Some(0.5));
     }
 
@@ -635,7 +820,9 @@ mod tests {
     fn role_export_includes_metadata() {
         let content = "---\ntemperature: 0.8\n---\nMy prompt";
         let role = Role::new("test", content);
+
         let exported = role.export();
+
         assert!(exported.contains("temperature"));
         assert!(exported.contains("My prompt"));
     }
@@ -649,6 +836,7 @@ Input 1
 ### OUTPUT:
 Output 1
 "#;
+
         assert_eq!(
             parse_structure_prompt(prompt),
             ("System message", vec![("Input 1", "Output 1")])
@@ -663,6 +851,7 @@ Input 1
 ### OUTPUT:
 Output 1
 "#;
+
         assert_eq!(
             parse_structure_prompt(prompt),
             ("", vec![("Input 1", "Output 1")])
@@ -676,6 +865,7 @@ System message
 ### INPUT:
 Input 1
 "#;
+
         assert_eq!(parse_structure_prompt(prompt), (prompt, vec![]));
     }
 }

src/config/session.rs

@@ -16,6 +16,8 @@ use std::sync::LazyLock;
 
 static RE_AUTONAME_PREFIX: LazyLock<Regex> = LazyLock::new(|| Regex::new(r"\d{8}T\d{6}-").unwrap());
 
+pub const INTERRUPTED_RESPONSE_TEXT: &str = "[Response interrupted due to error]";
+
 #[derive(Debug, Clone, Default, Deserialize, Serialize)]
 pub struct Session {
     #[serde(rename(serialize = "model", deserialize = "model"))]
@@ -38,6 +40,8 @@ pub struct Session {
         deserialize_with = "super::deserialize_csv_or_vec"
     )]
     enabled_mcp_servers: Option<Vec<String>>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    mcp_tools: Option<IndexMap<String, Vec<String>>>,
     #[serde(skip_serializing_if = "Option::is_none")]
     skills_enabled: Option<bool>,
     #[serde(
@@ -46,6 +50,12 @@ pub struct Session {
         deserialize_with = "super::deserialize_csv_or_vec"
     )]
     enabled_skills: Option<Vec<String>>,
+    #[serde(
+        default,
+        skip_serializing_if = "Option::is_none",
+        deserialize_with = "super::deserialize_csv_or_vec"
+    )]
+    enabled_macros: Option<Vec<String>>,
     #[serde(skip_serializing_if = "Option::is_none")]
     save_session: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -107,6 +117,10 @@ impl Session {
         self.enabled_skills.as_deref()
     }
 
+    pub fn enabled_macros(&self) -> Option<&[String]> {
+        self.enabled_macros.as_deref()
+    }
+
     pub fn set_skills_enabled(&mut self, value: Option<bool>) {
         if self.skills_enabled != value {
             self.skills_enabled = value;
@@ -165,6 +179,13 @@ impl Session {
         self.messages.is_empty() && self.compressed_messages.is_empty()
     }
 
+    pub fn has_interrupted_error_checkpoint(&self) -> bool {
+        self.messages.last().is_some_and(|message| {
+            message.role.is_assistant()
+                && matches!(&message.content, MessageContent::Text(text) if text.ends_with(INTERRUPTED_RESPONSE_TEXT))
+        })
+    }
+
     pub fn messages(&self) -> &[Message] {
         &self.messages
     }
@@ -230,12 +251,18 @@ impl Session {
         if let Some(enabled_mcp_servers) = self.enabled_mcp_servers() {
             data["enabled_mcp_servers"] = json!(enabled_mcp_servers);
         }
+        if let Some(mcp_tools) = self.mcp_tools() {
+            data["mcp_tools"] = json!(mcp_tools);
+        }
         if let Some(skills_enabled) = self.skills_enabled() {
             data["skills_enabled"] = skills_enabled.into();
         }
         if let Some(enabled_skills) = self.enabled_skills() {
             data["enabled_skills"] = json!(enabled_skills);
         }
+        if let Some(enabled_macros) = self.enabled_macros() {
+            data["enabled_macros"] = json!(enabled_macros);
+        }
         if let Some(save_session) = self.save_session() {
             data["save_session"] = save_session.into();
         }
@@ -307,6 +334,13 @@ impl Session {
             items.push(("enabled_mcp_servers", enabled_mcp_servers.join(",")));
         }
 
+        if let Some(mcp_tools) = self.mcp_tools() {
+            items.push((
+                "mcp_tools",
+                serde_json::to_string(&mcp_tools).unwrap_or_default(),
+            ));
+        }
+
         if let Some(skills_enabled) = self.skills_enabled() {
             items.push(("skills_enabled", skills_enabled.to_string()));
         }
@@ -315,6 +349,10 @@ impl Session {
             items.push(("enabled_skills", enabled_skills.join(",")));
         }
 
+        if let Some(enabled_macros) = self.enabled_macros() {
+            items.push(("enabled_macros", enabled_macros.join(",")));
+        }
+
         if let Some(save_session) = self.save_session() {
             items.push(("save_session", save_session.to_string()));
         }
@@ -844,6 +882,10 @@ impl RoleLike for Session {
         self.enabled_mcp_servers.clone()
     }
 
+    fn mcp_tools(&self) -> Option<IndexMap<String, Vec<String>>> {
+        self.mcp_tools.clone()
+    }
+
     fn set_model(&mut self, model: Model) {
         if self.model().id() != model.id() {
             self.model_id = model.id();
@@ -887,6 +929,13 @@ impl RoleLike for Session {
             self.dirty = true;
         }
     }
+
+    fn set_mcp_tools(&mut self, value: Option<IndexMap<String, Vec<String>>>) {
+        if self.mcp_tools != value {
+            self.mcp_tools = value;
+            self.dirty = true;
+        }
+    }
 }
 
 #[derive(Debug, Clone, Default)]
@@ -917,20 +966,183 @@ impl AutoName {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::client::{Message, MessageContent, MessageRole, Model};
+    use crate::client::{Message, MessageContent, MessageContentToolCalls, MessageRole, Model};
     use crate::config::{AppConfig, AppState, RequestContext, WorkingMode};
-    use crate::function::Functions;
+    use crate::function::{Functions, ToolCall, ToolResult};
     use std::sync::Arc;
 
     #[test]
     fn session_default_is_empty() {
         let session = Session::default();
+
         assert!(session.is_empty());
         assert_eq!(session.name(), "");
         assert_eq!(session.role_name(), None);
         assert!(!session.dirty());
     }
 
+    fn push_interrupted_turn(session: &mut Session) {
+        session.messages.push(Message::new(
+            MessageRole::User,
+            MessageContent::Text("do things".to_string()),
+        ));
+        session.messages.push(Message::new(
+            MessageRole::Tool,
+            MessageContent::ToolCalls(MessageContentToolCalls::new(
+                vec![ToolResult::new(ToolCall::default(), json!("ok"))],
+                String::new(),
+            )),
+        ));
+        session.messages.push(Message::new(
+            MessageRole::Assistant,
+            MessageContent::Text(INTERRUPTED_RESPONSE_TEXT.to_string()),
+        ));
+    }
+
+    #[test]
+    fn session_has_interrupted_error_checkpoint_detects_sentinel() {
+        let mut session = Session::default();
+        assert!(!session.has_interrupted_error_checkpoint());
+
+        session.messages.push(Message::new(
+            MessageRole::User,
+            MessageContent::Text("hi".to_string()),
+        ));
+        session.messages.push(Message::new(
+            MessageRole::Assistant,
+            MessageContent::Text("hello".to_string()),
+        ));
+        assert!(
+            !session.has_interrupted_error_checkpoint(),
+            "a normal completed exchange is not an interruption"
+        );
+
+        push_interrupted_turn(&mut session);
+        assert!(session.has_interrupted_error_checkpoint());
+    }
+
+    #[test]
+    fn session_detects_checkpoint_appended_by_crashed_continue_turn() {
+        // A crash during a `.continue` turn appends the sentinel to the
+        // previous assistant text (add_message's continue_output branch)
+        // instead of pushing a standalone checkpoint message.
+        let mut session = Session::default();
+        session.messages.push(Message::new(
+            MessageRole::User,
+            MessageContent::Text("hi".to_string()),
+        ));
+        session.messages.push(Message::new(
+            MessageRole::Assistant,
+            MessageContent::Text(format!("partial answer{INTERRUPTED_RESPONSE_TEXT}")),
+        ));
+
+        assert!(session.has_interrupted_error_checkpoint());
+    }
+
+    #[test]
+    fn session_interrupted_checkpoint_with_tool_calls_survives_yaml_round_trip() {
+        let mut session = Session::default();
+        push_interrupted_turn(&mut session);
+
+        let yaml = serde_yaml::to_string(&session).unwrap();
+        let reloaded: Session = serde_yaml::from_str(&yaml).unwrap();
+
+        assert!(
+            reloaded.has_interrupted_error_checkpoint(),
+            "interruption checkpoint must survive save/reload"
+        );
+        assert!(
+            reloaded.messages.iter().any(|m| matches!(
+                &m.content,
+                MessageContent::ToolCalls(tc) if tc.tool_results.len() == 1
+            )),
+            "tool calls made before the crash must survive save/reload"
+        );
+    }
+
+    #[test]
+    fn session_enabled_macros_absent_is_none() {
+        let session: Session = serde_yaml::from_str("model: provider:test\nmessages: []").unwrap();
+
+        assert_eq!(session.enabled_macros, None);
+    }
+
+    #[test]
+    fn session_mcp_tools_survives_yaml_round_trip() {
+        let mut session = Session::default();
+        let mut mcp_tools = IndexMap::new();
+        mcp_tools.insert("github".to_string(), vec!["get_*".to_string()]);
+        mcp_tools.insert("slack".to_string(), vec![]);
+        session.set_mcp_tools(Some(mcp_tools.clone()));
+
+        let yaml = serde_yaml::to_string(&session).unwrap();
+        let reloaded: Session = serde_yaml::from_str(&yaml).unwrap();
+
+        assert_eq!(reloaded.mcp_tools(), Some(mcp_tools));
+    }
+
+    #[test]
+    fn session_set_role_does_not_copy_mcp_tools() {
+        let role = Role::new(
+            "test",
+            "---\nmcp_tools:\n  github: [get_issue]\n---\nPrompt",
+        );
+        assert!(role.mcp_tools().is_some());
+        let mut session = Session::default();
+
+        session.set_role(role);
+
+        assert_eq!(session.mcp_tools(), None);
+    }
+
+    #[test]
+    fn session_set_mcp_tools_marks_dirty() {
+        let mut session = Session::default();
+        assert!(!session.dirty());
+
+        session.set_mcp_tools(Some(IndexMap::new()));
+
+        assert!(session.dirty());
+        assert_eq!(session.mcp_tools(), Some(IndexMap::new()));
+    }
+
+    #[test]
+    fn session_enabled_macros_empty_list_is_some_empty() {
+        let session: Session =
+            serde_yaml::from_str("model: provider:test\nenabled_macros: []\nmessages: []").unwrap();
+
+        assert_eq!(session.enabled_macros, Some(vec![]));
+    }
+
+    #[test]
+    fn session_enabled_macros_empty_string_is_some_empty() {
+        let session: Session =
+            serde_yaml::from_str("model: provider:test\nenabled_macros: \"\"\nmessages: []")
+                .unwrap();
+
+        assert_eq!(session.enabled_macros, Some(vec![]));
+    }
+
+    #[test]
+    fn session_enabled_macros_csv_string() {
+        let session: Session =
+            serde_yaml::from_str("model: provider:test\nenabled_macros: \"a,b\"\nmessages: []")
+                .unwrap();
+
+        assert_eq!(
+            session.enabled_macros,
+            Some(vec!["a".to_string(), "b".to_string()])
+        );
+    }
+
+    #[test]
+    fn session_serialize_omits_enabled_macros_when_none() {
+        let session = Session::default();
+        let yaml = serde_yaml::to_string(&session).unwrap();
+
+        assert!(!yaml.contains("enabled_macros"));
+    }
+
     #[test]
     fn session_new_from_ctx_captures_save_session() {
         let app_config = Arc::new(AppConfig::default());
@@ -945,6 +1157,7 @@ mod tests {
             functions: Functions::default(),
         });
         let ctx = RequestContext::new(app_state, WorkingMode::Cmd);
+
         let session = Session::new_from_ctx(&ctx, &app_config, "test-session").unwrap();
 
         assert_eq!(session.name(), "test-session");
@@ -984,25 +1197,30 @@ mod tests {
     #[test]
     fn session_guard_empty_passes_when_empty() {
         let session = Session::default();
+
         assert!(session.guard_empty().is_ok());
     }
 
     #[test]
     fn session_needs_compression_threshold() {
         let session = Session::default();
+
         assert!(!session.needs_compression(4000));
     }
 
     #[test]
     fn session_needs_compression_returns_false_when_compressing() {
         let mut session = Session::default();
+
         session.set_compressing(true);
+
         assert!(!session.needs_compression(0));
     }
 
     #[test]
     fn session_needs_compression_returns_false_when_threshold_zero() {
         let session = Session::default();
+
         assert!(!session.needs_compression(0));
     }
 
@@ -1074,13 +1292,16 @@ mod tests {
     #[test]
     fn session_need_autoname_default_false() {
         let session = Session::default();
+
         assert!(!session.need_autoname());
     }
 
     #[test]
     fn session_set_autonaming_doesnt_panic_without_autoname() {
         let mut session = Session::default();
+
         session.set_autonaming(true);
+
         assert!(!session.need_autoname());
     }
 

src/config/skill.rs

@@ -37,6 +37,8 @@ pub struct Skill {
     #[serde(skip_serializing_if = "Option::is_none")]
     enabled_mcp_servers: Option<Vec<String>>,
     #[serde(skip_serializing_if = "Option::is_none")]
+    mcp_tools: Option<IndexMap<String, Vec<String>>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
     auto_unload: Option<bool>,
 }
 
@@ -74,6 +76,9 @@ impl Skill {
                     "enabled_mcp_servers" => {
                         skill.enabled_mcp_servers = parse_skill_string_or_array(value);
                     }
+                    "mcp_tools" => {
+                        skill.mcp_tools = parse_skill_mcp_tools_map(value);
+                    }
                     "auto_unload" => {
                         skill.auto_unload = value.as_bool();
                     }
@@ -147,6 +152,10 @@ impl Skill {
         self.enabled_mcp_servers.as_deref()
     }
 
+    pub fn mcp_tools(&self) -> Option<&IndexMap<String, Vec<String>>> {
+        self.mcp_tools.as_ref()
+    }
+
     pub fn auto_unload(&self) -> bool {
         self.auto_unload.unwrap_or(false)
     }
@@ -185,6 +194,21 @@ fn parse_skill_string_or_array(value: &Value) -> Option<Vec<String>> {
     None
 }
 
+fn parse_skill_mcp_tools_map(value: &Value) -> Option<IndexMap<String, Vec<String>>> {
+    let map = value.as_object()?;
+    let mut mcp_tools = IndexMap::new();
+
+    for (server, tools) in map {
+        if tools.is_null() {
+            mcp_tools.insert(server.clone(), Vec::new());
+        } else if let Some(tools) = parse_skill_string_or_array(tools) {
+            mcp_tools.insert(server.clone(), tools);
+        }
+    }
+
+    Some(mcp_tools)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -198,6 +222,44 @@ mod tests {
         assert_eq!(skill.description(), "");
     }
 
+    #[test]
+    fn skill_new_parses_mcp_tools_list_and_csv_values() {
+        let content = "---\nmcp_tools:\n  github: [get_*, list_*]\n  slack: a,b\n---\nBody";
+
+        let skill = Skill::new("test", content);
+
+        let mcp_tools = skill.mcp_tools().unwrap();
+        assert_eq!(
+            mcp_tools.get("github"),
+            Some(&vec!["get_*".to_string(), "list_*".to_string()])
+        );
+        assert_eq!(
+            mcp_tools.get("slack"),
+            Some(&vec!["a".to_string(), "b".to_string()])
+        );
+    }
+
+    #[test]
+    fn skill_new_mcp_tools_absent_is_none() {
+        let skill = Skill::new("test", "---\ndescription: d\n---\nBody");
+
+        assert_eq!(skill.mcp_tools(), None);
+    }
+
+    #[test]
+    fn skill_new_mcp_tools_empty_list_server_is_some_empty() {
+        let skill = Skill::new("test", "---\nmcp_tools:\n  github: []\n---\nBody");
+
+        assert_eq!(skill.mcp_tools().unwrap().get("github"), Some(&vec![]));
+    }
+
+    #[test]
+    fn skill_new_mcp_tools_per_server_null_is_some_empty() {
+        let skill = Skill::new("test", "---\nmcp_tools:\n  github:\n---\nBody");
+
+        assert_eq!(skill.mcp_tools().unwrap().get("github"), Some(&vec![]));
+    }
+
     #[test]
     fn skill_new_parses_full_metadata() {
         let content = "---\n\

src/config/skill_registry.rs

@@ -34,6 +34,10 @@ impl SkillRegistry {
         self.loaded.keys().cloned().collect()
     }
 
+    pub fn loaded_skills(&self) -> impl Iterator<Item = &Skill> {
+        self.loaded.values()
+    }
+
     pub fn loaded_mcp_servers(&self) -> BTreeSet<String> {
         let mut out = BTreeSet::new();
         for skill in self.loaded.values() {

src/graph/agent.rs

@@ -2,7 +2,7 @@ use super::state::StateManager;
 use super::structured;
 use super::types::AgentNode;
 use crate::config::RequestContext;
-use crate::function::supervisor::run_agent_for_graph;
+use crate::function::agents::run_agent_for_graph;
 use anyhow::{Context, Result};
 use serde_json::Value;
 use std::time::Duration;

src/graph/executor.rs

@@ -250,7 +250,30 @@ impl GraphExecutor {
                 branch_tasks.push(task);
             }
 
-            let joined = join_all(branch_tasks).await;
+            let joined = match graph_timeout {
+                Some(t) => {
+                    let remaining = t.saturating_sub(start.elapsed());
+                    let abort_handles: Vec<_> = branch_tasks
+                        .iter()
+                        .map(|task| task.abort_handle())
+                        .collect();
+                    match tokio::time::timeout(remaining, join_all(branch_tasks)).await {
+                        Ok(joined) => joined,
+                        Err(_) => {
+                            for handle in abort_handles {
+                                handle.abort();
+                            }
+                            bail!(
+                                "Graph '{}' timed out after {}s during super-step with frontier {:?}",
+                                graph.name,
+                                t.as_secs(),
+                                sorted_frontier(&frontier)
+                            );
+                        }
+                    }
+                }
+                None => join_all(branch_tasks).await,
+            };
 
             let mut branch_writes: Vec<BranchWrites> = Vec::new();
             let mut next_frontier: HashSet<String> = HashSet::new();
@@ -401,7 +424,7 @@ async fn step(
             Ok(StepResult::Continue(vec![next]))
         }
         NodeType::Llm(llm_node) => {
-            let outcome = LlmNodeExecutor::execute(llm_node, state, ctx).await?;
+            let outcome = LlmNodeExecutor::execute(current, llm_node, state, ctx).await?;
             let targets = match outcome {
                 LlmExecutionOutcome::Continue => static_next_targets(node, current, "llm")?,
                 LlmExecutionOutcome::FellBack(target) => vec![target],
@@ -540,8 +563,14 @@ mod tests {
 mod integration_tests {
     use super::*;
     use crate::config::{AppState, WorkingMode};
+    #[cfg(unix)]
+    use crate::function::jobs::RingBuf;
+    #[cfg(unix)]
+    use crate::supervisor::{JobHandle, JobResult, JobState, JobStatus, Supervisor, notification};
     use crate::utils::{create_abort_signal, temp_file};
     use std::fs;
+    #[cfg(unix)]
+    use std::mem;
 
     fn cmd_available(name: &str) -> bool {
         which::which(name).is_ok()
@@ -793,4 +822,123 @@ nodes:
             "error should list both End nodes: {err}"
         );
     }
+
+    #[tokio::test]
+    async fn graph_timeout_interrupts_in_flight_super_step() {
+        if !cmd_available("bash") {
+            eprintln!("skipping: bash not available");
+            return;
+        }
+        let ws = TestWorkspace::new();
+        ws.write_script("sleeper.sh", "#!/bin/bash\nsleep 10\necho '{}'\n");
+
+        let yaml = r#"
+name: inflight_timeout_test
+start: sleeper
+settings:
+  timeout: 1
+nodes:
+  sleeper:
+    type: script
+    script: sleeper.sh
+    state_updates: {}
+    next: done
+  done:
+    type: end
+    output: "done"
+"#;
+        let graph: Graph = serde_yaml::from_str(yaml).unwrap();
+        let mut ctx = make_ctx();
+        let abort = create_abort_signal();
+        let result = GraphExecutor::new(graph, &ws.dir)
+            .execute(&mut ctx, abort)
+            .await;
+
+        assert!(result.is_err(), "expected in-flight timeout to error");
+        let err = format!("{:#}", result.unwrap_err());
+        assert!(
+            err.contains("timed out after 1s during super-step"),
+            "error should report during-super-step timeout: {err}"
+        );
+        assert!(err.contains("sleeper"), "error should name frontier: {err}");
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn background_job_survives_graph_node_execution() {
+        if !cmd_available("bash") {
+            eprintln!("skipping: bash not available");
+            return;
+        }
+        let ws = TestWorkspace::new();
+        ws.write_script("noop.sh", "#!/bin/bash\necho '{}'\n");
+
+        let yaml = r#"
+name: background_job_survival_test
+start: noop
+nodes:
+  noop:
+    type: script
+    script: noop.sh
+    state_updates: {}
+    next: done
+  done:
+    type: end
+    output: "done"
+"#;
+        let graph: Graph = serde_yaml::from_str(yaml).unwrap();
+
+        let rt = tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .unwrap();
+        let join_handle = rt.spawn(async {
+            Ok(JobResult {
+                output: Value::Null,
+                exit_code: Some(0),
+                output_bytes_captured: 0,
+            })
+        });
+        mem::forget(rt);
+        let handle = JobHandle {
+            id: "job_bg".to_string(),
+            tool: "execute_command".to_string(),
+            started_at: Instant::now(),
+            join_handle,
+            abort_signal: create_abort_signal(),
+            state: Arc::new(parking_lot::Mutex::new(JobState {
+                status: JobStatus::Completed,
+                pgid: None,
+            })),
+            output_buf: Arc::new(parking_lot::Mutex::new(RingBuf::default())),
+            no_change_checks: 0,
+            last_check_state: None,
+        };
+        let mut sup = Supervisor::new(0, 3).with_max_concurrent_jobs(4);
+        sup.register(handle).unwrap();
+
+        let mut ctx = make_ctx();
+        ctx.supervisor = Some(Arc::new(parking_lot::RwLock::new(sup)));
+        ctx.notification_queue.push(notification::job_notification(
+            "job_bg",
+            "execute_command",
+            true,
+        ));
+
+        let abort = create_abort_signal();
+        let result = GraphExecutor::new(graph, &ws.dir)
+            .execute(&mut ctx, abort)
+            .await
+            .unwrap_or_else(|e| panic!("executor failed: {e:#}"));
+        assert_eq!(result, "done");
+
+        assert!(
+            ctx.supervisor.as_ref().unwrap().read().has_job("job_bg"),
+            "graph execution must not touch registered job handles"
+        );
+        let events = ctx.notification_queue.drain();
+        assert_eq!(events.len(), 1, "queued notification must survive the run");
+        assert_eq!(events[0].id, "job_bg");
+        assert_eq!(events[0].event, "job_completed");
+    }
 }

src/graph/llm.rs

@@ -6,8 +6,9 @@ use crate::config::prompts::DEFAULT_SKILL_INSTRUCTIONS;
 use crate::config::{
     Input, RequestContext, Role, RoleLike, SkillPolicy, should_inject_skill_instructions,
 };
+use crate::function::agents::{GuardrailAction, check_pending_tasks_guardrail};
+use crate::function::jobs::reap_jobs;
 use crate::function::skill::skill_function_declarations;
-use crate::function::supervisor::{GuardrailAction, check_pending_agents_guardrail};
 use crate::utils::create_abort_signal;
 use anyhow::{Context, Error, Result, anyhow, bail};
 use log::warn;
@@ -29,11 +30,12 @@ pub struct LlmNodeExecutor;
 
 impl LlmNodeExecutor {
     pub(super) async fn execute(
+        node_id: &str,
         node: &LlmNode,
         state_manager: &mut StateManager,
         parent_ctx: &mut RequestContext,
     ) -> Result<LlmExecutionOutcome> {
-        let result = run(node, state_manager, parent_ctx).await;
+        let result = run(node_id, node, state_manager, parent_ctx).await;
         let (output, failure_reason) = match result {
             Ok(raw) => match &node.output_schema {
                 Some(schema) => match structured::extract(&raw, schema, parent_ctx).await {
@@ -78,6 +80,7 @@ fn outcome_from(
 }
 
 async fn run(
+    node_id: &str,
     node: &LlmNode,
     state_manager: &mut StateManager,
     parent_ctx: &mut RequestContext,
@@ -173,6 +176,16 @@ async fn run(
 
     let saved_role = parent_ctx.role.clone();
     parent_ctx.role = Some(composed_role);
+    // Jobs are node-local: everything job__start registers while this node
+    // runs is recorded here and reaped on every exit path below.
+    let saved_job_scope = parent_ctx.node_job_scope.replace(Vec::new());
+    // The node's tool filter layer lives in tracked context state so any
+    // mid-node filter recompute (e.g. a skill load) re-applies it last.
+    let saved_node_mcp_tools = std::mem::replace(
+        &mut parent_ctx.active_node_mcp_tools,
+        node.mcp_tools.clone().map(|map| (node_id.to_string(), map)),
+    );
+    parent_ctx.refresh_mcp_tool_filters();
     let result = match node.timeout {
         Some(secs) => match timeout(
             Duration::from_secs(secs),
@@ -186,6 +199,11 @@ async fn run(
         None => run_with_retries(node, &prompt, parent_ctx).await,
     };
     parent_ctx.role = saved_role;
+    let node_jobs =
+        std::mem::replace(&mut parent_ctx.node_job_scope, saved_job_scope).unwrap_or_default();
+    reap_jobs(parent_ctx.supervisor.as_ref(), &node_jobs).await;
+    parent_ctx.active_node_mcp_tools = saved_node_mcp_tools;
+    parent_ctx.refresh_mcp_tool_filters();
     restore_agent_skill_policy(parent_ctx, saved_agent_skill_state);
     result
 }
@@ -268,7 +286,7 @@ async fn run_chat_loop(node: &LlmNode, prompt: &str, ctx: &mut RequestContext) -
         }
 
         if tool_results.is_empty() {
-            match check_pending_agents_guardrail(ctx) {
+            match check_pending_tasks_guardrail(ctx) {
                 GuardrailAction::NoAction => return Ok(accumulated),
                 GuardrailAction::ForceTerminate(ids) => {
                     warn!(
@@ -499,6 +517,7 @@ mod tests {
             instructions: Some("sys".into()),
             prompt: "user".into(),
             tools: None,
+            mcp_tools: None,
             model: None,
             temperature: None,
             top_p: None,

src/graph/map.rs

@@ -85,9 +85,11 @@ impl MapNodeExecutor {
                 let mut ctx = sub_ctx;
 
                 let exec_result: Result<()> = match &branch_clone.node_type {
-                    NodeType::Llm(n) => LlmNodeExecutor::execute(n, &mut state, &mut ctx)
+                    NodeType::Llm(n) => {
-                        .await
+                        LlmNodeExecutor::execute(&branch_clone.id, n, &mut state, &mut ctx)
-                        .map(|_| ()),
+                            .await
+                            .map(|_| ())
+                    }
                     NodeType::Agent(n) => AgentNodeExecutor::execute(n, &mut state, &mut ctx)
                         .await
                         .map(|_| ()),

src/graph/script.rs

@@ -54,6 +54,7 @@ impl ScriptExecutor {
         let mut cmd = build_command(language, &script_path)?;
         cmd.stdout(Stdio::piped());
         cmd.stderr(Stdio::piped());
+        cmd.kill_on_drop(true);
         cmd.envs(&self.extra_envs);
         cmd.env("AUTO_CONFIRM", "true");
         match &state_repr {

src/graph/types.rs

@@ -28,12 +28,18 @@ pub struct Graph {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub reasoning_effort: Option<String>,
 
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub max_concurrent_jobs: Option<usize>,
+
     #[serde(default)]
     pub global_tools: Vec<String>,
 
     #[serde(default)]
     pub mcp_servers: Vec<String>,
 
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub mcp_tools: Option<IndexMap<String, Vec<String>>>,
+
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub skills_enabled: Option<bool>,
 
@@ -282,6 +288,9 @@ pub struct LlmNode {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub tools: Option<Vec<String>>,
 
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub mcp_tools: Option<IndexMap<String, Vec<String>>>,
+
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub model: Option<String>,
 
@@ -527,6 +536,47 @@ nodes:
         }
     }
 
+    #[test]
+    fn deserializes_mcp_tools_at_graph_and_node_level() {
+        let yaml = r#"
+name: g
+mcp_servers: [github]
+mcp_tools:
+  github:
+    - get_*
+    - list_*
+start: l
+nodes:
+  l:
+    id: l
+    type: llm
+    prompt: hi
+    mcp_tools:
+      github:
+        - search_code
+    next: e
+  e:
+    id: e
+    type: end
+    output: done
+"#;
+        let graph: Graph = serde_yaml::from_str(yaml).unwrap();
+
+        assert_eq!(
+            graph.mcp_tools.as_ref().unwrap().get("github"),
+            Some(&vec!["get_*".to_string(), "list_*".to_string()])
+        );
+        match &graph.get_node("l").unwrap().node_type {
+            NodeType::Llm(llm) => {
+                assert_eq!(
+                    llm.mcp_tools.as_ref().unwrap().get("github"),
+                    Some(&vec!["search_code".to_string()])
+                );
+            }
+            _ => panic!("expected Llm variant"),
+        }
+    }
+
     #[test]
     fn deserializes_every_node_type() {
         let yaml = r#"
@@ -588,6 +638,16 @@ nodes:
         ));
     }
 
+    #[test]
+    fn graph_silently_ignores_enabled_macros_key() {
+        let yaml = "name: g\nenabled_macros: [\"x\"]\nstart: x\nnodes:\n  x:\n    id: x\n    type: end\n    output: ok\n";
+
+        let graph: Graph = serde_yaml::from_str(yaml).unwrap();
+
+        assert_eq!(graph.name, "g");
+        assert_eq!(graph.start, "x");
+    }
+
     #[test]
     fn graph_settings_have_sensible_defaults() {
         let yaml = "name: g\nstart: x\nnodes:\n  x:\n    id: x\n    type: end\n    output: ok\n";
@@ -885,6 +945,7 @@ nodes:
         assert!(graph.model.is_none());
         assert!(graph.temperature.is_none());
         assert!(graph.top_p.is_none());
+        assert!(graph.max_concurrent_jobs.is_none());
         assert!(graph.global_tools.is_empty());
         assert!(graph.mcp_servers.is_empty());
         assert!(graph.conversation_starters.is_empty());

src/graph/user_interaction.rs

@@ -23,7 +23,7 @@ impl ApprovalNodeExecutor {
 
         let response = handle_user_tool(
             ctx,
-            &format!("{USER_FUNCTION_PREFIX}ask"),
+            &format!("{USER_FUNCTION_PREFIX}select"),
             &json!({ "question": question, "options": node.options }),
         )
         .await

src/graph/validator.rs

@@ -1,6 +1,7 @@
 use super::state::template_root_keys;
 use super::types::{Graph, Node, NodeType};
 use crate::client::{Model, ModelType};
+use crate::config;
 use crate::config::{Agent, AppConfig, paths};
 use crate::rag::{GraphRagConfig, RagData};
 use anyhow::{Result, bail};
@@ -214,6 +215,14 @@ impl GraphValidator {
             return;
         };
 
+        let expand_alias =
+            |name: &str| config::expand_mcp_server_alias(&ctx.app_config.mapping_mcp_servers, name);
+        let mut enabled_servers: HashSet<String> = ctx.mcp_servers.clone();
+        for server in &ctx.mcp_servers {
+            enabled_servers.extend(expand_alias(server));
+        }
+        let all_servers_enabled = ctx.mcp_servers.iter().any(|s| s.trim() == "all");
+
         for (node_id, node) in &graph.nodes {
             let NodeType::Llm(llm) = &node.node_type else {
                 continue;
@@ -237,6 +246,25 @@ impl GraphValidator {
                 }
             }
 
+            if let Some(mcp_tools) = &llm.mcp_tools
+                && !all_servers_enabled
+            {
+                for key in mcp_tools.keys() {
+                    let enabled = enabled_servers.contains(key)
+                        || expand_alias(key)
+                            .iter()
+                            .any(|id| enabled_servers.contains(id));
+                    if !enabled {
+                        result.error(ValidationError::with_node(
+                            node_id,
+                            format!(
+                                "llm node 'mcp_tools' references MCP server '{key}' not enabled by this graph"
+                            ),
+                        ));
+                    }
+                }
+            }
+
             if let Some(model_id) = &llm.model
                 && Model::retrieve_model(ctx.app_config.as_ref(), model_id, ModelType::Chat)
                     .is_err()
@@ -998,8 +1026,10 @@ mod tests {
             temperature: None,
             top_p: None,
             reasoning_effort: None,
+            max_concurrent_jobs: None,
             global_tools: Vec::new(),
             mcp_servers: Vec::new(),
+            mcp_tools: None,
             skills_enabled: None,
             enabled_skills: None,
             inject_skill_instructions: None,
@@ -1098,6 +1128,7 @@ mod tests {
                 instructions: None,
                 prompt: "p".into(),
                 tools: None,
+                mcp_tools: None,
                 model: None,
                 temperature: None,
                 top_p: None,
@@ -1256,6 +1287,19 @@ mod tests {
         node
     }
 
+    fn llm_node_with_mcp_tools(id: &str, servers: &[&str]) -> Node {
+        let mut node = llm_node(id, None, Some("end"));
+        if let NodeType::Llm(ref mut n) = node.node_type {
+            let mut mcp_tools = IndexMap::new();
+            for server in servers {
+                mcp_tools.insert(server.to_string(), vec!["get_*".to_string()]);
+            }
+            n.mcp_tools = Some(mcp_tools);
+        }
+
+        node
+    }
+
     #[test]
     fn llm_node_unknown_tool_is_an_error() {
         let graph = graph_with(
@@ -1339,6 +1383,103 @@ mod tests {
         assert!(result.is_valid());
     }
 
+    #[test]
+    fn llm_node_mcp_tools_enabled_server_passes() {
+        let graph = graph_with(
+            vec![
+                ("l", llm_node_with_mcp_tools("l", &["github"])),
+                ("end", end_node("end")),
+            ],
+            "l",
+        );
+
+        let result = validator()
+            .with_agent_context(agent_ctx(&[], &["github"]))
+            .validate(&graph);
+
+        assert!(result.is_valid());
+    }
+
+    #[test]
+    fn llm_node_mcp_tools_unknown_server_is_an_error() {
+        let graph = graph_with(
+            vec![
+                ("l", llm_node_with_mcp_tools("l", &["slack"])),
+                ("end", end_node("end")),
+            ],
+            "l",
+        );
+
+        let result = validator()
+            .with_agent_context(agent_ctx(&[], &["github"]))
+            .validate(&graph);
+
+        assert!(!result.is_valid());
+        assert!(
+            result
+                .errors
+                .iter()
+                .any(|e| e.message.contains("'slack' not enabled"))
+        );
+    }
+
+    #[test]
+    fn llm_node_mcp_tools_alias_key_passes() {
+        let graph = graph_with(
+            vec![
+                ("l", llm_node_with_mcp_tools("l", &["gh"])),
+                ("end", end_node("end")),
+            ],
+            "l",
+        );
+        let mut ctx = agent_ctx(&[], &["github-mcp"]);
+        let mut app = AppConfig::default();
+        app.mapping_mcp_servers
+            .insert("gh".to_string(), "github-mcp".to_string());
+        ctx.app_config = Arc::new(app);
+
+        let result = validator().with_agent_context(ctx).validate(&graph);
+
+        assert!(result.is_valid(), "errors: {:?}", result.errors);
+    }
+
+    #[test]
+    fn llm_node_mcp_tools_key_matching_alias_expansion_passes() {
+        let graph = graph_with(
+            vec![
+                ("l", llm_node_with_mcp_tools("l", &["github-mcp"])),
+                ("end", end_node("end")),
+            ],
+            "l",
+        );
+        let mut ctx = agent_ctx(&[], &["gh"]);
+        let mut app = AppConfig::default();
+        app.mapping_mcp_servers
+            .insert("gh".to_string(), "github-mcp".to_string());
+        ctx.app_config = Arc::new(app);
+
+        let result = validator().with_agent_context(ctx).validate(&graph);
+
+        assert!(result.is_valid(), "errors: {:?}", result.errors);
+    }
+
+    #[test]
+    fn llm_node_mcp_tools_with_all_sentinel_passes() {
+        let graph = graph_with(
+            vec![
+                ("l", llm_node_with_mcp_tools("l", &["github"])),
+                ("end", end_node("end")),
+            ],
+            "l",
+        );
+
+        let result = validator()
+            .with_agent_context(agent_ctx(&[], &["all"]))
+            .validate(&graph);
+
+        assert!(result.is_valid(), "errors: {:?}", result.errors);
+    }
+
     #[test]
     fn llm_node_unknown_model_is_an_error() {
         let graph = graph_with(

src/main.rs

@@ -29,7 +29,7 @@ use crate::config::{
     install_builtins, list_agents, load_env_file, macro_execute, sync_models,
 };
 use crate::config::{memory, paths};
-use crate::function::supervisor::{GuardrailAction, check_pending_agents_guardrail};
+use crate::function::agents::{GuardrailAction, check_pending_tasks_guardrail};
 use crate::mcp::McpServersConfig;
 use crate::render::{prompt_theme, render_error};
 use crate::repl::Repl;
@@ -127,14 +127,31 @@ async fn main() -> Result<()> {
         return sandbox::launch(name.clone(), cli.fresh);
     }
 
+    if cli.list_bundles {
+        return config::list_installed_bundles();
+    }
+
     install_builtins()?;
 
-    if let Some(category) = cli.install {
+    if let Some(category) = cli.install_builtins {
         return config::install_assets(category);
     }
 
-    if let Some(url) = cli.install_from.as_deref() {
+    if let Some(value) = cli.install.as_deref() {
-        return config::install_remote(url, cli.filter, cli.install_force);
+        return config::install_or_update(
+            value,
+            cli.git_host.as_deref(),
+            cli.filter,
+            cli.install_force,
+        );
+    }
+
+    if let Some(spec) = cli.update_bundle.as_deref() {
+        return config::update_bundle(spec, cli.yes);
+    }
+
+    if let Some(name) = cli.uninstall.as_deref() {
+        return config::uninstall_bundle(name, cli.yes);
     }
 
     if let Some(client_arg) = &cli.authenticate {
@@ -222,6 +239,9 @@ async fn main() -> Result<()> {
     if cli.no_workspace_mcp {
         app_config.no_workspace_mcp = true;
     }
+    if cli.no_workspace_macros {
+        app_config.no_workspace_macros = true;
+    }
     let app_config: Arc<AppConfig> = Arc::new(app_config);
     let app_state: Arc<AppState> = Arc::new(
         AppState::init(
@@ -360,8 +380,8 @@ async fn run(
             .await?;
     } else {
         let app: Arc<AppConfig> = Arc::clone(&ctx.app.config);
-        if let Some(prompt) = &cli.prompt {
+        if let Some(prompt) = &cli.temp_role {
-            ctx.use_prompt(app.as_ref(), prompt)?;
+            ctx.use_temp_role(app.as_ref(), prompt)?;
         } else if let Some(name) = &cli.role {
             ctx.use_role(app.as_ref(), name, abort_signal.clone())
                 .await?;
@@ -575,7 +595,7 @@ async fn start_directive(
         )
         .await?;
     } else {
-        match check_pending_agents_guardrail(ctx) {
+        match check_pending_tasks_guardrail(ctx) {
             GuardrailAction::Inject(prompt) => {
                 let guardrail_input = Input::from_str(ctx, &prompt, None)?;
                 return start_directive(ctx, guardrail_input, code_mode, abort_signal).await;

src/mcp/auth_client.rs

@@ -0,0 +1,651 @@
+use crate::mcp::oauth::{force_refresh_mcp_token, load_or_refresh_mcp_token};
+use http::{HeaderName, HeaderValue};
+use log::debug;
+use rmcp::model::ClientJsonRpcMessage;
+use rmcp::transport::common::client_side_sse::BoxedSseResponse;
+use rmcp::transport::streamable_http_client::{
+    AuthRequiredError, StreamableHttpClient, StreamableHttpError, StreamableHttpPostResponse,
+};
+use std::collections::HashMap;
+use std::future::Future;
+use std::sync::Arc;
+
+/// [`StreamableHttpClient`] wrapper that injects the OAuth bearer token for an
+/// MCP server on every request instead of pinning it at spawn time, so tokens
+/// refreshed mid-session take effect without reconnecting.
+///
+/// A caller-supplied `auth_header` always passes through untouched; only a
+/// `None` header is filled from the stored token. When the wrapper injected
+/// the token and a POST comes back 401, it forces a token refresh and retries
+/// exactly once (see [`Self::post_with_retry`]).
+#[derive(Clone)]
+pub struct McpOAuthClient<C = reqwest::Client> {
+    inner: C,
+    server: Arc<str>,
+}
+
+impl<C> McpOAuthClient<C> {
+    pub fn new(inner: C, server: &str) -> Self {
+        Self {
+            inner,
+            server: Arc::from(server),
+        }
+    }
+}
+
+impl<C: StreamableHttpClient + Sync> McpOAuthClient<C> {
+    /// Resolves the effective auth header. Caller-supplied values pass through
+    /// untouched; `None` is filled from the stored token for this server.
+    /// Returns the header plus whether the wrapper injected it. Errors with
+    /// [`StreamableHttpError::AuthRequired`] (without contacting the server)
+    /// when no usable token exists.
+    async fn resolve_auth(
+        &self,
+        auth_header: Option<String>,
+    ) -> Result<(Option<String>, bool), StreamableHttpError<C::Error>> {
+        if auth_header.is_some() {
+            return Ok((auth_header, false));
+        }
+        match load_or_refresh_mcp_token(&self.server).await.into_token() {
+            Some(token) => Ok((Some(token), true)),
+            None => Err(self.auth_required()),
+        }
+    }
+
+    fn auth_required(&self) -> StreamableHttpError<C::Error> {
+        StreamableHttpError::AuthRequired(AuthRequiredError::new(format!(
+            "no valid OAuth token for MCP server '{server}'; \
+             run `.mcp auth {server}` to re-authenticate",
+            server = self.server
+        )))
+    }
+
+    async fn post_with_retry<F, Fut>(
+        &self,
+        auth_header: Option<String>,
+        mut post: F,
+    ) -> Result<StreamableHttpPostResponse, StreamableHttpError<C::Error>>
+    where
+        F: FnMut(Option<String>) -> Fut,
+        Fut: Future<Output = Result<StreamableHttpPostResponse, StreamableHttpError<C::Error>>>,
+    {
+        let (auth, injected) = self.resolve_auth(auth_header).await?;
+        let (original, rejected) = match (post(auth.clone()).await, auth) {
+            (Err(err @ StreamableHttpError::AuthRequired(_)), Some(rejected)) if injected => {
+                (err, rejected)
+            }
+            (result, _) => return result,
+        };
+
+        debug!(
+            "MCP server '{}' rejected the injected token; forcing a refresh and retrying once",
+            self.server
+        );
+
+        let Some(token) = force_refresh_mcp_token(&self.server, &rejected).await else {
+            return Err(original);
+        };
+
+        match post(Some(token)).await {
+            Err(StreamableHttpError::AuthRequired(_)) => {
+                debug!(
+                    "Retry after forced token refresh was rejected again by MCP server '{}'",
+                    self.server
+                );
+                Err(original)
+            }
+            result => result,
+        }
+    }
+}
+
+impl<C: StreamableHttpClient + Sync> StreamableHttpClient for McpOAuthClient<C> {
+    type Error = C::Error;
+
+    async fn post_message(
+        &self,
+        uri: Arc<str>,
+        message: ClientJsonRpcMessage,
+        session_id: Option<Arc<str>>,
+        auth_header: Option<String>,
+        custom_headers: HashMap<HeaderName, HeaderValue>,
+    ) -> Result<StreamableHttpPostResponse, StreamableHttpError<Self::Error>> {
+        self.post_with_retry(auth_header, |auth| {
+            self.inner.post_message(
+                uri.clone(),
+                message.clone(),
+                session_id.clone(),
+                auth,
+                custom_headers.clone(),
+            )
+        })
+        .await
+    }
+
+    /// Overridden rather than left to the trait default: the default impl
+    /// delegates to [`Self::post_message`], silently dropping the
+    /// transport-wide SSE event size limit. Delegating to the inner client's
+    /// size-enforcing variant keeps the limit applied at the raw byte layer.
+    async fn post_message_with_max_sse_event_size(
+        &self,
+        uri: Arc<str>,
+        message: ClientJsonRpcMessage,
+        session_id: Option<Arc<str>>,
+        auth_header: Option<String>,
+        custom_headers: HashMap<HeaderName, HeaderValue>,
+        max_sse_event_size: usize,
+    ) -> Result<StreamableHttpPostResponse, StreamableHttpError<Self::Error>> {
+        self.post_with_retry(auth_header, |auth| {
+            self.inner.post_message_with_max_sse_event_size(
+                uri.clone(),
+                message.clone(),
+                session_id.clone(),
+                auth,
+                custom_headers.clone(),
+                max_sse_event_size,
+            )
+        })
+        .await
+    }
+
+    async fn delete_session(
+        &self,
+        uri: Arc<str>,
+        session_id: Arc<str>,
+        auth_header: Option<String>,
+        custom_headers: HashMap<HeaderName, HeaderValue>,
+    ) -> Result<(), StreamableHttpError<Self::Error>> {
+        let (auth, _) = self.resolve_auth(auth_header).await?;
+        self.inner
+            .delete_session(uri, session_id, auth, custom_headers)
+            .await
+    }
+
+    async fn get_stream(
+        &self,
+        uri: Arc<str>,
+        session_id: Option<Arc<str>>,
+        last_event_id: Option<String>,
+        auth_header: Option<String>,
+        custom_headers: HashMap<HeaderName, HeaderValue>,
+    ) -> Result<BoxedSseResponse, StreamableHttpError<Self::Error>> {
+        let (auth, _) = self.resolve_auth(auth_header).await?;
+        self.inner
+            .get_stream(uri, session_id, last_event_id, auth, custom_headers)
+            .await
+    }
+
+    /// Overridden for the same reason as
+    /// [`Self::post_message_with_max_sse_event_size`]: the trait default
+    /// bypasses SSE event size enforcement.
+    async fn get_stream_with_max_sse_event_size(
+        &self,
+        uri: Arc<str>,
+        session_id: Option<Arc<str>>,
+        last_event_id: Option<String>,
+        auth_header: Option<String>,
+        custom_headers: HashMap<HeaderName, HeaderValue>,
+        max_sse_event_size: usize,
+    ) -> Result<BoxedSseResponse, StreamableHttpError<Self::Error>> {
+        let (auth, _) = self.resolve_auth(auth_header).await?;
+        self.inner
+            .get_stream_with_max_sse_event_size(
+                uri,
+                session_id,
+                last_event_id,
+                auth,
+                custom_headers,
+                max_sse_event_size,
+            )
+            .await
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::config::paths;
+    use crate::mcp::oauth::test_support::with_temp_cache;
+    use futures_util::StreamExt;
+    use parking_lot::Mutex;
+    use serial_test::serial;
+    use std::convert::Infallible;
+    use std::fs;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+
+    const FRESH: i64 = 9999999999;
+
+    type Calls = Arc<Mutex<Vec<(&'static str, Option<String>)>>>;
+
+    type AfterFirstCallAction = Option<Box<dyn FnOnce() + Send + 'static>>;
+
+    /// Inner client that records `(method, auth_header)` per call, rejects the
+    /// first `reject_times` POSTs/streams with `AuthRequired` (then the next
+    /// `transport_error_times` with a non-auth error), and runs an optional
+    /// side effect after the first call (to mutate token files between the
+    /// initial attempt and the retry).
+    #[derive(Clone, Default)]
+    struct FakeInner {
+        calls: Calls,
+        reject_times: Arc<AtomicUsize>,
+        transport_error_times: Arc<AtomicUsize>,
+        after_first_call: Arc<Mutex<AfterFirstCallAction>>,
+    }
+
+    impl FakeInner {
+        fn record(
+            &self,
+            method: &'static str,
+            auth: Option<String>,
+        ) -> Result<(), StreamableHttpError<Infallible>> {
+            self.calls.lock().push((method, auth));
+            if let Some(f) = self.after_first_call.lock().take() {
+                f();
+            }
+            if self.reject_times.load(Ordering::SeqCst) > 0 {
+                self.reject_times.fetch_sub(1, Ordering::SeqCst);
+                return Err(Self::rejection());
+            }
+            if self.transport_error_times.load(Ordering::SeqCst) > 0 {
+                self.transport_error_times.fetch_sub(1, Ordering::SeqCst);
+                return Err(StreamableHttpError::UnexpectedServerResponse(
+                    "connection reset".into(),
+                ));
+            }
+            Ok(())
+        }
+
+        fn rejection() -> StreamableHttpError<Infallible> {
+            StreamableHttpError::AuthRequired(AuthRequiredError::new(
+                "Bearer error=\"invalid_token\"".to_string(),
+            ))
+        }
+    }
+
+    impl StreamableHttpClient for FakeInner {
+        type Error = Infallible;
+
+        async fn post_message(
+            &self,
+            _uri: Arc<str>,
+            _message: ClientJsonRpcMessage,
+            _session_id: Option<Arc<str>>,
+            auth_header: Option<String>,
+            _custom_headers: HashMap<HeaderName, HeaderValue>,
+        ) -> Result<StreamableHttpPostResponse, StreamableHttpError<Self::Error>> {
+            self.record("post_message", auth_header)?;
+            Ok(StreamableHttpPostResponse::Accepted)
+        }
+
+        async fn post_message_with_max_sse_event_size(
+            &self,
+            _uri: Arc<str>,
+            _message: ClientJsonRpcMessage,
+            _session_id: Option<Arc<str>>,
+            auth_header: Option<String>,
+            _custom_headers: HashMap<HeaderName, HeaderValue>,
+            _max_sse_event_size: usize,
+        ) -> Result<StreamableHttpPostResponse, StreamableHttpError<Self::Error>> {
+            self.record("post_message_with_max_sse_event_size", auth_header)?;
+            Ok(StreamableHttpPostResponse::Accepted)
+        }
+
+        async fn delete_session(
+            &self,
+            _uri: Arc<str>,
+            _session_id: Arc<str>,
+            auth_header: Option<String>,
+            _custom_headers: HashMap<HeaderName, HeaderValue>,
+        ) -> Result<(), StreamableHttpError<Self::Error>> {
+            self.record("delete_session", auth_header)?;
+            Ok(())
+        }
+
+        async fn get_stream(
+            &self,
+            _uri: Arc<str>,
+            _session_id: Option<Arc<str>>,
+            _last_event_id: Option<String>,
+            auth_header: Option<String>,
+            _custom_headers: HashMap<HeaderName, HeaderValue>,
+        ) -> Result<BoxedSseResponse, StreamableHttpError<Self::Error>> {
+            self.record("get_stream", auth_header)?;
+            Ok(futures_util::stream::empty().boxed())
+        }
+
+        async fn get_stream_with_max_sse_event_size(
+            &self,
+            _uri: Arc<str>,
+            _session_id: Option<Arc<str>>,
+            _last_event_id: Option<String>,
+            auth_header: Option<String>,
+            _custom_headers: HashMap<HeaderName, HeaderValue>,
+            _max_sse_event_size: usize,
+        ) -> Result<BoxedSseResponse, StreamableHttpError<Self::Error>> {
+            self.record("get_stream_with_max_sse_event_size", auth_header)?;
+            Ok(futures_util::stream::empty().boxed())
+        }
+    }
+
+    fn write_token_file(server: &str, access_token: &str, expires_at: i64) {
+        fs::create_dir_all(paths::oauth_tokens_dir()).unwrap();
+        fs::write(
+            paths::token_file(&format!("mcp_{server}")),
+            format!(
+                r#"{{"access_token":"{access_token}","refresh_token":"r","expires_at":{expires_at}}}"#
+            ),
+        )
+        .unwrap();
+    }
+
+    fn ping() -> ClientJsonRpcMessage {
+        serde_json::from_value(serde_json::json!({
+            "jsonrpc": "2.0",
+            "id": 1,
+            "method": "ping"
+        }))
+        .unwrap()
+    }
+
+    fn rt() -> tokio::runtime::Runtime {
+        tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .unwrap()
+    }
+
+    fn post(
+        client: &McpOAuthClient<FakeInner>,
+        auth_header: Option<String>,
+    ) -> Result<StreamableHttpPostResponse, StreamableHttpError<Infallible>> {
+        rt().block_on(client.post_message(
+            Arc::from("http://mcp.test/mcp"),
+            ping(),
+            None,
+            auth_header,
+            HashMap::new(),
+        ))
+    }
+
+    #[test]
+    #[serial]
+    fn injects_token_from_disk_when_auth_header_none() {
+        with_temp_cache(|| {
+            write_token_file("wrapper-inject", "tok-live", FRESH);
+            let inner = FakeInner::default();
+            let client = McpOAuthClient::new(inner.clone(), "wrapper-inject");
+
+            let result = post(&client, None);
+
+            assert!(result.is_ok());
+            assert_eq!(
+                *inner.calls.lock(),
+                vec![("post_message", Some("tok-live".to_string()))]
+            );
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn caller_supplied_auth_header_passes_through() {
+        with_temp_cache(|| {
+            write_token_file("wrapper-passthrough", "tok-disk", FRESH);
+            let inner = FakeInner::default();
+            let client = McpOAuthClient::new(inner.clone(), "wrapper-passthrough");
+
+            let result = post(&client, Some("caller-tok".to_string()));
+
+            assert!(result.is_ok());
+            assert_eq!(
+                *inner.calls.lock(),
+                vec![("post_message", Some("caller-tok".to_string()))]
+            );
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn caller_supplied_header_rejection_propagates_without_refresh() {
+        with_temp_cache(|| {
+            // A fresh, different token sits on disk: if the injected guard
+            // were dropped, the wrapper would refresh and retry with it.
+            write_token_file("wrapper-caller-401", "tok-disk", FRESH);
+            let inner = FakeInner::default();
+            inner.reject_times.store(1, Ordering::SeqCst);
+            let client = McpOAuthClient::new(inner.clone(), "wrapper-caller-401");
+
+            let result = post(&client, Some("caller-tok".to_string()));
+
+            assert!(matches!(result, Err(StreamableHttpError::AuthRequired(_))));
+            assert_eq!(
+                *inner.calls.lock(),
+                vec![("post_message", Some("caller-tok".to_string()))]
+            );
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn missing_token_returns_auth_required_without_calling_inner() {
+        with_temp_cache(|| {
+            let inner = FakeInner::default();
+            let client = McpOAuthClient::new(inner.clone(), "wrapper-no-token");
+
+            let result = post(&client, None);
+
+            assert!(matches!(result, Err(StreamableHttpError::AuthRequired(_))));
+            assert!(inner.calls.lock().is_empty());
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn rejected_token_forces_refresh_and_retries_once() {
+        with_temp_cache(|| {
+            write_token_file("wrapper-retry", "tok-a", FRESH);
+            let inner = FakeInner::default();
+            inner.reject_times.store(1, Ordering::SeqCst);
+            // Simulate a concurrent refresh landing between the rejection and
+            // the forced refresh: the retry must carry the new token.
+            *inner.after_first_call.lock() = Some(Box::new(|| {
+                write_token_file("wrapper-retry", "tok-b", FRESH);
+            }));
+            let client = McpOAuthClient::new(inner.clone(), "wrapper-retry");
+
+            let result = post(&client, None);
+
+            assert!(result.is_ok());
+            assert_eq!(
+                *inner.calls.lock(),
+                vec![
+                    ("post_message", Some("tok-a".to_string())),
+                    ("post_message", Some("tok-b".to_string())),
+                ]
+            );
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn failed_force_refresh_propagates_original_error_after_one_call() {
+        with_temp_cache(|| {
+            write_token_file("wrapper-refresh-fail", "tok-a", FRESH);
+            let inner = FakeInner::default();
+            inner.reject_times.store(1, Ordering::SeqCst);
+            // Token file gone by refresh time: force refresh yields nothing.
+            *inner.after_first_call.lock() = Some(Box::new(|| {
+                fs::remove_file(paths::token_file("mcp_wrapper-refresh-fail")).unwrap();
+            }));
+            let client = McpOAuthClient::new(inner.clone(), "wrapper-refresh-fail");
+
+            let result = post(&client, None);
+
+            assert!(matches!(result, Err(StreamableHttpError::AuthRequired(_))));
+            assert_eq!(inner.calls.lock().len(), 1);
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn second_rejection_after_retry_propagates_original_error() {
+        with_temp_cache(|| {
+            write_token_file("wrapper-double-401", "tok-a", FRESH);
+            let inner = FakeInner::default();
+            inner.reject_times.store(2, Ordering::SeqCst);
+            // A changed token appears before the forced refresh, so the retry
+            // actually runs (an unchanged token would trigger a real refresh
+            // attempt, which fails without a cached registration).
+            *inner.after_first_call.lock() = Some(Box::new(|| {
+                write_token_file("wrapper-double-401", "tok-b", FRESH);
+            }));
+            let client = McpOAuthClient::new(inner.clone(), "wrapper-double-401");
+
+            let result = post(&client, None);
+
+            assert!(matches!(result, Err(StreamableHttpError::AuthRequired(_))));
+            assert_eq!(inner.calls.lock().len(), 2);
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn non_auth_retry_error_propagates_as_is() {
+        with_temp_cache(|| {
+            write_token_file("wrapper-retry-transport", "tok-a", FRESH);
+            let inner = FakeInner::default();
+            inner.reject_times.store(1, Ordering::SeqCst);
+            inner.transport_error_times.store(1, Ordering::SeqCst);
+            *inner.after_first_call.lock() = Some(Box::new(|| {
+                write_token_file("wrapper-retry-transport", "tok-b", FRESH);
+            }));
+            let client = McpOAuthClient::new(inner.clone(), "wrapper-retry-transport");
+
+            let result = post(&client, None);
+
+            assert!(matches!(
+                result,
+                Err(StreamableHttpError::UnexpectedServerResponse(_))
+            ));
+            assert_eq!(inner.calls.lock().len(), 2);
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn sized_post_delegates_to_inner_sized_variant() {
+        with_temp_cache(|| {
+            write_token_file("wrapper-sized-post", "tok-live", FRESH);
+            let inner = FakeInner::default();
+            let client = McpOAuthClient::new(inner.clone(), "wrapper-sized-post");
+
+            let result = rt().block_on(client.post_message_with_max_sse_event_size(
+                Arc::from("http://mcp.test/mcp"),
+                ping(),
+                None,
+                None,
+                HashMap::new(),
+                4096,
+            ));
+
+            assert!(result.is_ok());
+            assert_eq!(
+                *inner.calls.lock(),
+                vec![(
+                    "post_message_with_max_sse_event_size",
+                    Some("tok-live".to_string())
+                )]
+            );
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn sized_get_stream_delegates_to_inner_sized_variant() {
+        with_temp_cache(|| {
+            write_token_file("wrapper-sized-get", "tok-live", FRESH);
+            let inner = FakeInner::default();
+            let client = McpOAuthClient::new(inner.clone(), "wrapper-sized-get");
+
+            let result = rt().block_on(client.get_stream_with_max_sse_event_size(
+                Arc::from("http://mcp.test/mcp"),
+                None,
+                None,
+                None,
+                HashMap::new(),
+                4096,
+            ));
+
+            assert!(result.is_ok());
+            assert_eq!(
+                *inner.calls.lock(),
+                vec![(
+                    "get_stream_with_max_sse_event_size",
+                    Some("tok-live".to_string())
+                )]
+            );
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn get_stream_does_not_retry_on_rejection() {
+        with_temp_cache(|| {
+            write_token_file("wrapper-get-401", "tok-live", FRESH);
+            let inner = FakeInner::default();
+            inner.reject_times.store(1, Ordering::SeqCst);
+            let client = McpOAuthClient::new(inner.clone(), "wrapper-get-401");
+
+            let result = rt().block_on(client.get_stream(
+                Arc::from("http://mcp.test/mcp"),
+                None,
+                None,
+                None,
+                HashMap::new(),
+            ));
+
+            assert!(matches!(result, Err(StreamableHttpError::AuthRequired(_))));
+            assert_eq!(inner.calls.lock().len(), 1);
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn delete_session_injects_token() {
+        with_temp_cache(|| {
+            write_token_file("wrapper-delete", "tok-live", FRESH);
+            let inner = FakeInner::default();
+            let client = McpOAuthClient::new(inner.clone(), "wrapper-delete");
+
+            let result = rt().block_on(client.delete_session(
+                Arc::from("http://mcp.test/mcp"),
+                Arc::from("session-1"),
+                None,
+                HashMap::new(),
+            ));
+
+            assert!(result.is_ok());
+            assert_eq!(
+                *inner.calls.lock(),
+                vec![("delete_session", Some("tok-live".to_string()))]
+            );
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn auth_required_error_contains_no_token_material() {
+        with_temp_cache(|| {
+            write_token_file("wrapper-redact", "stale-secret-token", 0);
+            let inner = FakeInner::default();
+            let client = McpOAuthClient::new(inner.clone(), "wrapper-redact");
+
+            let err = post(&client, None).unwrap_err();
+
+            let display = format!("{err}");
+            let debug = format!("{err:?}");
+            assert!(!display.contains("stale-secret-token"));
+            assert!(!debug.contains("stale-secret-token"));
+            assert!(inner.calls.lock().is_empty());
+        });
+    }
+}

src/mcp/manage.rs

@@ -242,6 +242,7 @@ fn build_stdio(cli: &Cli, has_url: bool) -> Result<McpServer> {
         url: None,
         headers: None,
         oauth: None,
+        allowed_tools: None,
     })
 }
 
@@ -300,6 +301,7 @@ fn build_remote(cli: &Cli, transport: McpTransportType, has_command: bool) -> Re
         url: Some(url),
         headers: (!headers.is_empty()).then_some(headers),
         oauth,
+        allowed_tools: None,
     })
 }
 

src/mcp/mod.rs

@@ -1,18 +1,22 @@
+mod auth_client;
 pub(crate) mod manage;
 pub(crate) mod oauth;
+pub(crate) mod render;
 mod sse_transport;
 
 use crate::config::AppConfig;
 use crate::config::paths;
-use crate::utils::{AbortSignal, abortable_run_with_spinner};
+use crate::utils::{AbortSignal, abortable_run_with_spinner, dimmed_text};
 use crate::vault::Vault;
 use crate::vault::interpolate_secrets;
 use anyhow::Error;
 use anyhow::{Context, Result, anyhow};
+use auth_client::McpOAuthClient;
 use futures_util::{StreamExt, TryStreamExt, stream};
 use http::{HeaderName, HeaderValue};
 use indexmap::IndexMap;
 use indoc::formatdoc;
+use rmcp::model::{PromptArgument, ServerCapabilities};
 use rmcp::service::RunningService;
 use rmcp::transport::StreamableHttpClientTransport;
 use rmcp::transport::TokioChildProcess;
@@ -21,6 +25,8 @@ use rmcp::{RoleClient, ServiceExt};
 use serde::{Deserialize, Serialize};
 use sse_transport::LegacySseTransport;
 use std::collections::{HashMap, HashSet};
+use std::fmt;
+use std::fmt::Display;
 use std::fs::OpenOptions;
 use std::path::{Path, PathBuf};
 use std::process::Stdio;
@@ -30,27 +36,97 @@ use tokio::process::Command;
 pub const MCP_INVOKE_META_FUNCTION_NAME_PREFIX: &str = "mcp_invoke";
 pub const MCP_SEARCH_META_FUNCTION_NAME_PREFIX: &str = "mcp_search";
 pub const MCP_DESCRIBE_META_FUNCTION_NAME_PREFIX: &str = "mcp_describe";
+pub const MCP_READ_META_FUNCTION_NAME_PREFIX: &str = "mcp_read";
+pub const MCP_PROMPT_META_FUNCTION_NAME_PREFIX: &str = "mcp_prompt";
+
+pub const MCP_META_FUNCTION_PREFIXES: [&str; 5] = [
+    MCP_INVOKE_META_FUNCTION_NAME_PREFIX,
+    MCP_SEARCH_META_FUNCTION_NAME_PREFIX,
+    MCP_DESCRIBE_META_FUNCTION_NAME_PREFIX,
+    MCP_READ_META_FUNCTION_NAME_PREFIX,
+    MCP_PROMPT_META_FUNCTION_NAME_PREFIX,
+];
+
+pub fn is_mcp_meta_function(name: &str) -> bool {
+    MCP_META_FUNCTION_PREFIXES
+        .iter()
+        .any(|prefix| name.starts_with(prefix))
+}
+
+pub fn mcp_meta_function_names(server: &str) -> Vec<String> {
+    MCP_META_FUNCTION_PREFIXES
+        .iter()
+        .map(|prefix| format!("{prefix}_{server}"))
+        .collect()
+}
 
 pub type ConnectedServer = RunningService<RoleClient, ()>;
 
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct McpServerFeatures {
+    pub name: String,
+    pub tools: bool,
+    pub resources: bool,
+    pub prompts: bool,
+}
+
+impl McpServerFeatures {
+    pub fn from_capabilities(
+        name: impl Into<String>,
+        capabilities: Option<&ServerCapabilities>,
+    ) -> Self {
+        Self {
+            name: name.into(),
+            tools: capabilities.is_none_or(|c| c.tools.is_some()),
+            resources: capabilities.is_some_and(|c| c.resources.is_some()),
+            prompts: capabilities.is_some_and(|c| c.prompts.is_some()),
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum CatalogItemKind {
+    #[default]
+    Tool,
+    Resource,
+    ResourceTemplate,
+    Prompt,
+}
+
+impl CatalogItemKind {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Tool => "tool",
+            Self::Resource => "resource",
+            Self::ResourceTemplate => "resource_template",
+            Self::Prompt => "prompt",
+        }
+    }
+}
+
+impl Display for CatalogItemKind {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
 #[derive(Clone, Debug, Default, Serialize)]
 pub struct CatalogItem {
+    pub kind: CatalogItemKind,
     pub name: String,
     pub server: String,
     pub description: String,
-}
+    #[serde(skip_serializing_if = "Option::is_none")]
-
+    pub uri: Option<String>,
-#[derive(Debug)]
+    #[serde(skip_serializing_if = "Option::is_none")]
-struct ServerCatalog {
+    pub mime_type: Option<String>,
-    items: HashMap<String, CatalogItem>,
+    #[serde(skip_serializing_if = "Option::is_none")]
-}
+    pub size: Option<u64>,
-
+    #[serde(skip_serializing_if = "Option::is_none")]
-impl Clone for ServerCatalog {
+    pub arguments: Option<Vec<PromptArgument>>,
-    fn clone(&self) -> Self {
+    #[serde(skip_serializing_if = "Option::is_none")]
-        Self {
+    pub audience: Option<Vec<String>>,
-            items: self.items.clone(),
-        }
-    }
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
@@ -90,6 +166,8 @@ pub(crate) struct McpServer {
     pub headers: Option<IndexMap<String, String>>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub oauth: Option<McpOAuthConfig>,
+    #[serde(rename = "allowedTools", skip_serializing_if = "Option::is_none")]
+    pub allowed_tools: Option<Vec<String>>,
 }
 
 impl McpServer {
@@ -101,6 +179,15 @@ impl McpServer {
     }
 
     pub fn validate(&self, name: &str) -> Result<()> {
+        if let Some(tools) = &self.allowed_tools
+            && tools.is_empty()
+        {
+            let message = format!(
+                "MCP server '{name}' has an empty \"allowedTools\" list, so none of its tools will be callable"
+            );
+            warn!("{message}");
+            eprintln!("{}", dimmed_text(&message));
+        }
         if self.is_remote() {
             let type_label = match self.transport_type {
                 McpTransportType::Http => "http",
@@ -156,7 +243,6 @@ pub struct McpRegistry {
     log_path: Option<PathBuf>,
     config: Option<McpServersConfig>,
     servers: HashMap<String, Arc<ConnectedServer>>,
-    catalogs: HashMap<String, ServerCatalog>,
 }
 
 impl McpRegistry {
@@ -299,7 +385,7 @@ impl McpRegistry {
 
         debug!("Starting selected MCP servers: {:?}", ids_to_start);
 
-        let results: Vec<Option<(String, Arc<ConnectedServer>, ServerCatalog)>> = stream::iter(
+        let results: Vec<Option<(String, Arc<ConnectedServer>)>> = stream::iter(
             ids_to_start
                 .into_iter()
                 .map(|id| async { self.start_server(id).await }),
@@ -308,66 +394,40 @@ impl McpRegistry {
         .try_collect()
         .await?;
 
-        for (id, server, catalog) in results.into_iter().flatten() {
+        for (id, server) in results.into_iter().flatten() {
-            self.servers.insert(id.clone(), server);
+            self.servers.insert(id, server);
-            self.catalogs.insert(id, catalog);
         }
 
         Ok(())
     }
 
-    async fn start_server(
+    async fn start_server(&self, id: String) -> Result<Option<(String, Arc<ConnectedServer>)>> {
-        &self,
-        id: String,
-    ) -> Result<Option<(String, Arc<ConnectedServer>, ServerCatalog)>> {
         let spec = self
             .config
             .as_ref()
             .and_then(|c| c.mcp_servers.get(&id))
             .with_context(|| format!("MCP server not found in config: {id}"))?;
 
-        let bearer_token = if spec.is_remote() {
+        let (auth, auth_reason) = resolve_http_auth(&id, spec).await;
-            oauth::load_valid_mcp_token(&id)
-        } else {
-            None
-        };
 
-        let service = match spawn_mcp_server(spec, self.log_path.as_deref(), bearer_token).await {
+        let service = match spawn_mcp_server(spec, self.log_path.as_deref(), auth).await {
             Ok(s) => s,
             Err(e) if is_auth_required_error(&e) => {
                 warn!(
-                    "MCP server '{id}' requires OAuth authentication. \
+                    "{}",
-                     Run `coyote --auth-mcp {id}` or `.mcp auth {id}` in the REPL to authenticate."
+                    McpAuthRequired {
+                        server: id,
+                        reason: auth_reason,
+                    }
                 );
                 return Ok(None);
             }
             Err(e) => return Err(e),
         };
 
-        let tools = service.list_tools(None).await?;
-        debug!("Available tools for MCP server {id}: {tools:?}");
-
-        let mut items_vec = Vec::new();
-        for t in tools.tools {
-            let name = t.name.to_string();
-            let description = t.description.unwrap_or_default().to_string();
-            items_vec.push(CatalogItem {
-                name,
-                server: id.clone(),
-                description,
-            });
-        }
-
-        let mut items_map = HashMap::new();
-        items_vec.into_iter().for_each(|it| {
-            items_map.insert(it.name.clone(), it);
-        });
-
-        let catalog = ServerCatalog { items: items_map };
-
         info!("Started MCP server: {id}");
 
-        Ok(Some((id.to_string(), service, catalog)))
+        Ok(Some((id, service)))
     }
 
     fn resolve_server_ids(&self, enabled_mcp_servers: Option<Vec<String>>) -> Vec<String> {
@@ -395,8 +455,21 @@ impl McpRegistry {
         &self.servers
     }
 
-    pub fn list_started_servers(&self) -> Vec<String> {
+    pub fn server_features(&self) -> Vec<McpServerFeatures> {
-        self.servers.keys().cloned().collect()
+        let mut features: Vec<McpServerFeatures> = self
+            .servers
+            .iter()
+            .map(|(name, handle)| {
+                let info = handle.peer_info();
+                McpServerFeatures::from_capabilities(
+                    name.as_str(),
+                    info.as_ref().map(|info| &info.capabilities),
+                )
+            })
+            .collect();
+
+        features.sort_by(|a, b| a.name.cmp(&b.name));
+        features
     }
 
     pub fn is_empty(&self) -> bool {
@@ -412,19 +485,76 @@ impl McpRegistry {
     }
 }
 
+/// How a remote MCP server authenticates outgoing requests.
+pub(crate) enum HttpAuth {
+    /// Only the static headers from the server spec; no OAuth token.
+    StaticOnly,
+    /// OAuth-managed: HTTP transports inject a fresh bearer token per request
+    /// via [`McpOAuthClient`] (ignoring the carried token); SSE transports
+    /// send the carried token as a static header.
+    Managed { server: String, token: String },
+}
+
+impl fmt::Debug for HttpAuth {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::StaticOnly => f.write_str("StaticOnly"),
+            Self::Managed { server, token: _ } => f
+                .debug_struct("Managed")
+                .field("server", server)
+                .field("token", &"<redacted>")
+                .finish(),
+        }
+    }
+}
+
+impl HttpAuth {
+    pub(crate) fn from_token_status(status: &oauth::McpTokenStatus, server: &str) -> Self {
+        match status {
+            oauth::McpTokenStatus::Token(token) => Self::Managed {
+                server: server.to_string(),
+                token: token.clone(),
+            },
+            oauth::McpTokenStatus::NotAuthenticated | oauth::McpTokenStatus::RefreshFailed => {
+                Self::StaticOnly
+            }
+        }
+    }
+}
+
+pub(crate) async fn resolve_http_auth(name: &str, spec: &McpServer) -> (HttpAuth, McpAuthReason) {
+    let token_status = if spec.is_remote() {
+        oauth::load_or_refresh_mcp_token(name).await
+    } else {
+        oauth::McpTokenStatus::NotAuthenticated
+    };
+    (
+        HttpAuth::from_token_status(&token_status, name),
+        McpAuthReason::from_token_status(&token_status),
+    )
+}
+
 pub(crate) async fn spawn_mcp_server(
     spec: &McpServer,
     log_path: Option<&Path>,
-    bearer_token: Option<String>,
+    auth: HttpAuth,
 ) -> Result<Arc<ConnectedServer>> {
     match spec.transport_type {
         McpTransportType::Http => {
             let url = spec.url.as_deref().expect("validated: http spec has url");
-            let headers = merge_bearer_token(spec.headers.as_ref(), bearer_token);
+            match auth {
-            spawn_http_mcp_server(url, headers.as_ref()).await
+                HttpAuth::Managed { server, token: _ } => {
+                    spawn_oauth_http_mcp_server(url, &server, spec.headers.as_ref()).await
+                }
+                HttpAuth::StaticOnly => spawn_http_mcp_server(url, spec.headers.as_ref()).await,
+            }
         }
         McpTransportType::Sse => {
             let url = spec.url.as_deref().expect("validated: sse spec has url");
+            let bearer_token = match auth {
+                HttpAuth::Managed { server: _, token } => Some(token),
+                HttpAuth::StaticOnly => None,
+            };
             let headers = merge_bearer_token(spec.headers.as_ref(), bearer_token);
             spawn_sse_mcp_server(url, headers.as_ref()).await
         }
@@ -452,15 +582,66 @@ fn merge_bearer_token(
         }
         (Some(h), Some(token)) => {
             let mut m = h.clone();
+            m.retain(|k, _| !k.eq_ignore_ascii_case("authorization"));
             m.insert("Authorization".to_string(), format!("Bearer {token}"));
             Some(m)
         }
     }
 }
 
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum McpAuthReason {
+    NotAuthenticated,
+    RefreshFailed,
+    TokenRejected,
+}
+
+impl McpAuthReason {
+    pub(crate) fn from_token_status(status: &oauth::McpTokenStatus) -> Self {
+        match status {
+            oauth::McpTokenStatus::Token(_) => Self::TokenRejected,
+            oauth::McpTokenStatus::NotAuthenticated => Self::NotAuthenticated,
+            oauth::McpTokenStatus::RefreshFailed => Self::RefreshFailed,
+        }
+    }
+}
+
+#[derive(Debug)]
+pub(crate) struct McpAuthRequired {
+    pub server: String,
+    pub reason: McpAuthReason,
+}
+
+impl Display for McpAuthRequired {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let server = &self.server;
+        match self.reason {
+            McpAuthReason::NotAuthenticated => write!(
+                f,
+                "MCP server '{server}' requires OAuth authentication and was not started \
+                 (no stored credentials). Run `.mcp auth {server}` (or `coyote --auth-mcp \
+                 {server}`) to authenticate and attach it."
+            ),
+            McpAuthReason::RefreshFailed => write!(
+                f,
+                "MCP server '{server}' was not started: stored OAuth token has expired and \
+                 automatic refresh failed. Run `.mcp auth {server}` (or `coyote --auth-mcp \
+                 {server}`) to re-authenticate and attach it."
+            ),
+            McpAuthReason::TokenRejected => write!(
+                f,
+                "MCP server '{server}' was not started: the server rejected the stored OAuth \
+                 token. Run `.mcp auth {server}` (or `coyote --auth-mcp {server}`) to \
+                 re-authenticate and attach it."
+            ),
+        }
+    }
+}
+
 pub(crate) fn is_auth_required_error(e: &Error) -> bool {
-    e.chain()
+    e.downcast_ref::<McpAuthRequired>().is_some()
-        .any(|cause| cause.to_string().contains("Auth required"))
+        || e.chain()
+            .any(|cause| cause.to_string().contains("Auth required"))
 }
 
 async fn spawn_http_mcp_server(
@@ -493,6 +674,66 @@ async fn spawn_http_mcp_server(
     Ok(service)
 }
 
+/// Builds the custom-header map for an OAuth-managed HTTP transport, dropping
+/// any static `Authorization` entry case-insensitively: [`McpOAuthClient`]
+/// owns that header, and a stale configured value must not collide with the
+/// per-request token.
+fn oauth_custom_headers(
+    headers: Option<&IndexMap<String, String>>,
+) -> Result<HashMap<HeaderName, HeaderValue>> {
+    let mut custom = HashMap::new();
+    let Some(hdrs) = headers else {
+        return Ok(custom);
+    };
+
+    for (k, v) in hdrs {
+        if k.eq_ignore_ascii_case("authorization") {
+            continue;
+        }
+        let name = k
+            .parse::<HeaderName>()
+            .with_context(|| format!("Invalid header name: {k}"))?;
+        let value = v
+            .parse::<HeaderValue>()
+            .with_context(|| format!("Invalid header value for {k}"))?;
+        custom.insert(name, value);
+    }
+
+    Ok(custom)
+}
+
+async fn spawn_oauth_http_mcp_server(
+    url: &str,
+    server: &str,
+    headers: Option<&IndexMap<String, String>>,
+) -> Result<Arc<ConnectedServer>> {
+    // Mirror rmcp's default_http_client, which `with_client` bypasses:
+    // idle pooling off avoids a documented TCP delayed-ACK stall, and
+    // redirects off keeps custom headers from being replayed to a redirect
+    // target.
+    let inner = reqwest::Client::builder()
+        .pool_max_idle_per_host(0)
+        .redirect(reqwest::redirect::Policy::none())
+        .build()
+        .context("Failed to build HTTP client for OAuth-managed MCP transport")?;
+    let client = McpOAuthClient::new(inner, server);
+    // `auth_header` stays None so the wrapper injects a fresh token per
+    // request; `reinit_on_expired_session` defaults to true in rmcp 3.1.2
+    // but is pinned explicitly because transparent session re-init is
+    // load-bearing for long-lived sessions.
+    let config = StreamableHttpClientTransportConfig::with_uri(url)
+        .custom_headers(oauth_custom_headers(headers)?)
+        .reinit_on_expired_session(true);
+    let transport = StreamableHttpClientTransport::with_client(client, config);
+    let service = Arc::new(
+        ().serve(transport)
+            .await
+            .with_context(|| format!("Failed to connect to HTTP MCP server: {url}"))?,
+    );
+
+    Ok(service)
+}
+
 async fn spawn_sse_mcp_server(
     url: &str,
     headers: Option<&IndexMap<String, String>>,
@@ -572,6 +813,7 @@ mod tests {
             url: None,
             headers: None,
             oauth: None,
+            allowed_tools: None,
         }
     }
 
@@ -585,6 +827,7 @@ mod tests {
             url: Some(url.to_string()),
             headers: None,
             oauth: None,
+            allowed_tools: None,
         }
     }
 
@@ -598,6 +841,7 @@ mod tests {
             url: Some(url.to_string()),
             headers: None,
             oauth: None,
+            allowed_tools: None,
         }
     }
 
@@ -630,6 +874,7 @@ mod tests {
             url: None,
             headers: None,
             oauth: None,
+            allowed_tools: None,
         };
 
         let err = spec.validate("test").unwrap_err();
@@ -648,6 +893,7 @@ mod tests {
             url: Some("http://localhost".into()),
             headers: None,
             oauth: None,
+            allowed_tools: None,
         };
 
         let err = spec.validate("test").unwrap_err();
@@ -668,6 +914,7 @@ mod tests {
             url: None,
             headers: Some(headers),
             oauth: None,
+            allowed_tools: None,
         };
 
         let err = spec.validate("test").unwrap_err();
@@ -693,6 +940,7 @@ mod tests {
             url: None,
             headers: None,
             oauth: None,
+            allowed_tools: None,
         };
 
         let err = spec.validate("test").unwrap_err();
@@ -711,6 +959,7 @@ mod tests {
             url: Some("http://localhost".into()),
             headers: None,
             oauth: None,
+            allowed_tools: None,
         };
 
         let err = spec.validate("test").unwrap_err();
@@ -729,6 +978,7 @@ mod tests {
             url: Some("http://localhost".into()),
             headers: None,
             oauth: None,
+            allowed_tools: None,
         };
 
         let err = spec.validate("test").unwrap_err();
@@ -747,6 +997,7 @@ mod tests {
             url: Some("http://localhost".into()),
             headers: None,
             oauth: None,
+            allowed_tools: None,
         };
 
         let err = spec.validate("test").unwrap_err();
@@ -772,6 +1023,7 @@ mod tests {
             url: None,
             headers: None,
             oauth: None,
+            allowed_tools: None,
         };
 
         let err = spec.validate("test").unwrap_err();
@@ -990,7 +1242,7 @@ mod tests {
         let registry = McpRegistry::default();
 
         assert!(registry.is_empty());
-        assert!(registry.list_started_servers().is_empty());
+        assert!(registry.server_features().is_empty());
         assert!(registry.mcp_config().is_none());
         assert!(registry.log_path().is_none());
     }
@@ -1014,6 +1266,51 @@ mod tests {
         assert_eq!(MCP_INVOKE_META_FUNCTION_NAME_PREFIX, "mcp_invoke");
         assert_eq!(MCP_SEARCH_META_FUNCTION_NAME_PREFIX, "mcp_search");
         assert_eq!(MCP_DESCRIBE_META_FUNCTION_NAME_PREFIX, "mcp_describe");
+        assert_eq!(MCP_READ_META_FUNCTION_NAME_PREFIX, "mcp_read");
+        assert_eq!(MCP_PROMPT_META_FUNCTION_NAME_PREFIX, "mcp_prompt");
+    }
+
+    #[test]
+    fn is_mcp_meta_function_classifies_names() {
+        assert!(is_mcp_meta_function("mcp_invoke_github"));
+        assert!(is_mcp_meta_function("mcp_search_github"));
+        assert!(is_mcp_meta_function("mcp_describe_github"));
+        assert!(is_mcp_meta_function("mcp_read_github"));
+        assert!(is_mcp_meta_function("mcp_prompt_github"));
+        assert!(!is_mcp_meta_function("mcp_gateway_tool"));
+        assert!(!is_mcp_meta_function("fs_read"));
+        assert!(!is_mcp_meta_function(""));
+        assert!(!is_mcp_meta_function("mcp_"));
+    }
+
+    #[test]
+    fn meta_function_prefixes_are_not_prefixes_of_each_other() {
+        for (i, a) in MCP_META_FUNCTION_PREFIXES.iter().enumerate() {
+            for (j, b) in MCP_META_FUNCTION_PREFIXES.iter().enumerate() {
+                if i != j {
+                    assert!(!b.starts_with(a), "{a} is a prefix of {b}");
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn is_mcp_meta_function_preserves_lax_prefix_matching() {
+        assert!(is_mcp_meta_function("mcp_invoker_x"));
+    }
+
+    #[test]
+    fn mcp_meta_function_names_returns_all_prefixes_in_order() {
+        assert_eq!(
+            mcp_meta_function_names("github"),
+            vec![
+                "mcp_invoke_github",
+                "mcp_search_github",
+                "mcp_describe_github",
+                "mcp_read_github",
+                "mcp_prompt_github",
+            ]
+        );
     }
 
     #[test]
@@ -1051,6 +1348,92 @@ mod tests {
         assert_eq!(result["X-Custom"], "keep");
     }
 
+    #[test]
+    fn merge_bearer_token_replaces_authorization_case_insensitively() {
+        let mut h = IndexMap::new();
+        h.insert("authorization".to_string(), "Bearer stale-1".to_string());
+        h.insert("AUTHORIZATION".to_string(), "Bearer stale-2".to_string());
+        h.insert("X-Custom".to_string(), "keep".to_string());
+
+        let result = merge_bearer_token(Some(&h), Some("newtoken".to_string())).unwrap();
+
+        assert_eq!(result.len(), 2);
+        assert_eq!(result["Authorization"], "Bearer newtoken");
+        assert_eq!(result["X-Custom"], "keep");
+        assert!(!result.contains_key("authorization"));
+        assert!(!result.contains_key("AUTHORIZATION"));
+    }
+
+    #[test]
+    fn http_auth_from_token_status_maps_token_to_managed() {
+        assert!(matches!(
+            HttpAuth::from_token_status(&oauth::McpTokenStatus::Token("tok".into()), "srv"),
+            HttpAuth::Managed { server, token } if server == "srv" && token == "tok"
+        ));
+        assert!(matches!(
+            HttpAuth::from_token_status(&oauth::McpTokenStatus::NotAuthenticated, "srv"),
+            HttpAuth::StaticOnly
+        ));
+        assert!(matches!(
+            HttpAuth::from_token_status(&oauth::McpTokenStatus::RefreshFailed, "srv"),
+            HttpAuth::StaticOnly
+        ));
+    }
+
+    #[test]
+    fn http_auth_debug_redacts_token() {
+        let auth = HttpAuth::Managed {
+            server: "srv".into(),
+            token: "live-secret".into(),
+        };
+
+        let debug = format!("{auth:?}");
+
+        assert!(debug.contains("srv"));
+        assert!(debug.contains("<redacted>"));
+        assert!(!debug.contains("live-secret"));
+    }
+
+    #[test]
+    fn oauth_custom_headers_strips_authorization_case_insensitively() {
+        let mut h = IndexMap::new();
+        h.insert("Authorization".to_string(), "Bearer stale-1".to_string());
+        h.insert("authorization".to_string(), "Bearer stale-2".to_string());
+        h.insert("AUTHORIZATION".to_string(), "Bearer stale-3".to_string());
+        h.insert("X-Custom".to_string(), "keep".to_string());
+
+        let custom = oauth_custom_headers(Some(&h)).unwrap();
+
+        assert_eq!(custom.len(), 1);
+        assert_eq!(custom[&HeaderName::from_static("x-custom")], "keep");
+    }
+
+    #[test]
+    fn oauth_custom_headers_none_is_empty() {
+        assert!(oauth_custom_headers(None).unwrap().is_empty());
+    }
+
+    #[test]
+    fn oauth_custom_headers_rejects_invalid_header_name() {
+        let mut h = IndexMap::new();
+        h.insert("bad header".to_string(), "v".to_string());
+
+        assert!(oauth_custom_headers(Some(&h)).is_err());
+    }
+
+    #[test]
+    fn oauth_custom_headers_keeps_non_authorization_headers() {
+        let mut h = IndexMap::new();
+        h.insert("X-Api-Key".to_string(), "k".to_string());
+        h.insert("X-Trace".to_string(), "t".to_string());
+
+        let custom = oauth_custom_headers(Some(&h)).unwrap();
+
+        assert_eq!(custom.len(), 2);
+        assert_eq!(custom[&HeaderName::from_static("x-api-key")], "k");
+        assert_eq!(custom[&HeaderName::from_static("x-trace")], "t");
+    }
+
     #[test]
     fn is_auth_required_error_matches_rmcp_message() {
         let e = anyhow!("Auth required, when send initialize request");
@@ -1074,4 +1457,48 @@ mod tests {
 
         assert!(is_auth_required_error(&e));
     }
+
+    #[test]
+    fn auth_reason_maps_token_status() {
+        assert_eq!(
+            McpAuthReason::from_token_status(&oauth::McpTokenStatus::Token("tok".into())),
+            McpAuthReason::TokenRejected
+        );
+        assert_eq!(
+            McpAuthReason::from_token_status(&oauth::McpTokenStatus::NotAuthenticated),
+            McpAuthReason::NotAuthenticated
+        );
+        assert_eq!(
+            McpAuthReason::from_token_status(&oauth::McpTokenStatus::RefreshFailed),
+            McpAuthReason::RefreshFailed
+        );
+    }
+
+    #[test]
+    fn mcp_auth_required_context_downcasts_with_reason() {
+        let e = anyhow!("Auth required, when send initialize request").context(McpAuthRequired {
+            server: "github".into(),
+            reason: McpAuthReason::RefreshFailed,
+        });
+
+        assert!(is_auth_required_error(&e));
+        let ctx = e.downcast_ref::<McpAuthRequired>().unwrap();
+        assert_eq!(ctx.server, "github");
+        assert_eq!(ctx.reason, McpAuthReason::RefreshFailed);
+    }
+
+    #[test]
+    fn mcp_auth_required_display_is_reason_specific() {
+        let msg = |reason| {
+            McpAuthRequired {
+                server: "github".into(),
+                reason,
+            }
+            .to_string()
+        };
+
+        assert!(msg(McpAuthReason::NotAuthenticated).contains("no stored credentials"));
+        assert!(msg(McpAuthReason::RefreshFailed).contains("expired and automatic refresh failed"));
+        assert!(msg(McpAuthReason::TokenRejected).contains("rejected the stored OAuth token"));
+    }
 }

src/mcp/oauth.rs

@@ -1,15 +1,26 @@
-use crate::client::oauth::{OAuthProvider, TokenRequestFormat, load_oauth_tokens, run_oauth_flow};
+use crate::client::oauth::{
+    OAuthProvider, OAuthTokens, TokenRequestFormat, load_oauth_tokens, refresh_oauth_token,
+    run_oauth_flow, token_response_keys,
+};
 use crate::config::paths;
 use anyhow::{Context, Result, anyhow};
 use chrono::Utc;
 use inquire::Text;
-use log::warn;
+use log::{debug, warn};
 use reqwest::Client;
 use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::fmt;
 use std::fs;
 use std::net::TcpListener;
+use std::sync::{Arc, OnceLock};
+use std::time::{Duration, Instant};
+use tokio::sync;
 use url::Url;
 
+const REFRESH_HTTP_TIMEOUT: Duration = Duration::from_secs(10);
+const REFRESH_FAILURE_BACKOFF: Duration = Duration::from_secs(60);
+
 #[derive(Debug, Deserialize)]
 struct ProtectedResourceMetadata {
     #[serde(default)]
@@ -34,6 +45,10 @@ struct McpRegistration {
     client_id: String,
     #[serde(default)]
     redirect_uri: Option<String>,
+    #[serde(default)]
+    token_url: Option<String>,
+    #[serde(default)]
+    resource: Option<String>,
 }
 
 struct DiscoveredOAuth {
@@ -124,8 +139,19 @@ pub async fn run_mcp_oauth_flow(
         None
     };
 
-    let (client_id, redirect_uri) = if let Some(reused) = cached_reuse {
+    let (client_id, redirect_uri) = if let Some((client_id, redirect_uri)) = cached_reuse {
-        reused
+        // Re-save so registrations cached before token_url/resource were
+        // persisted gain them, enabling token refresh next time.
+        if let Err(e) = save_registration(
+            server_name,
+            &client_id,
+            &redirect_uri,
+            &metadata.token_endpoint,
+            &resource,
+        ) {
+            debug!("Failed to update cached MCP registration for '{server_name}': {e}");
+        }
+        (client_id, redirect_uri)
     } else {
         let bind_addr = format!("127.0.0.1:{}", callback_port.unwrap_or(0));
         let listener = TcpListener::bind(&bind_addr)?;
@@ -137,10 +163,7 @@ pub async fn run_mcp_oauth_flow(
             id.to_string()
         } else if let Some(reg_endpoint) = &metadata.registration_endpoint {
             match register_client(reg_endpoint, &redirect_uri).await {
-                Ok(id) => {
+                Ok(id) => id,
-                    let _ = save_registration(server_name, &id, &redirect_uri);
-                    id
-                }
                 Err(e) => {
                     warn!("Dynamic client registration failed: {e}. Falling back to manual entry.");
                     Text::new("Enter the OAuth client ID for this MCP server:")
@@ -153,6 +176,18 @@ pub async fn run_mcp_oauth_flow(
                 .prompt()
                 .context("Failed to read client ID")?
         };
+        // Persist regardless of how the client_id was obtained (DCR, config,
+        // or manual entry) so refresh_mcp_token can run the refresh_token
+        // grant later without interactive re-auth.
+        if let Err(e) = save_registration(
+            server_name,
+            &client_id,
+            &redirect_uri,
+            &metadata.token_endpoint,
+            &resource,
+        ) {
+            debug!("Failed to cache MCP registration for '{server_name}': {e}");
+        }
         (client_id, redirect_uri)
     };
 
@@ -168,12 +203,164 @@ pub async fn run_mcp_oauth_flow(
     run_oauth_flow(&provider, &mcp_token_key(server_name)).await
 }
 
-pub fn load_valid_mcp_token(server_name: &str) -> Option<String> {
+#[derive(PartialEq, Eq)]
-    let tokens = load_oauth_tokens(&mcp_token_key(server_name))?;
+pub enum McpTokenStatus {
-    if Utc::now().timestamp() < tokens.expires_at {
+    Token(String),
-        Some(tokens.access_token)
+    NotAuthenticated,
-    } else {
+    RefreshFailed,
-        None
+}
+
+impl fmt::Debug for McpTokenStatus {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Token(_) => f.write_str("Token(<redacted>)"),
+            Self::NotAuthenticated => f.write_str("NotAuthenticated"),
+            Self::RefreshFailed => f.write_str("RefreshFailed"),
+        }
+    }
+}
+
+impl McpTokenStatus {
+    pub fn into_token(self) -> Option<String> {
+        match self {
+            Self::Token(token) => Some(token),
+            Self::NotAuthenticated | Self::RefreshFailed => None,
+        }
+    }
+}
+
+pub async fn load_or_refresh_mcp_token(server_name: &str) -> McpTokenStatus {
+    load_or_refresh_inner(server_name, None).await
+}
+
+/// Re-acquires a token after the server rejected the current one mid-session
+/// (HTTP 401). The rejection proves the stored token is bad regardless of its
+/// expiry timestamp, so the unexpired fast-paths only short-circuit when the
+/// stored token DIFFERS from `rejected_token` (a concurrent caller genuinely
+/// refreshed while we waited); an unexpired copy of the rejected token is
+/// refreshed anyway. The failure backoff and per-server single-flight lock
+/// still apply.
+pub async fn force_refresh_mcp_token(server_name: &str, rejected_token: &str) -> Option<String> {
+    load_or_refresh_inner(server_name, Some(rejected_token))
+        .await
+        .into_token()
+}
+
+async fn load_or_refresh_inner(server_name: &str, rejected_token: Option<&str>) -> McpTokenStatus {
+    let key = mcp_token_key(server_name);
+    let Some(tokens) = load_oauth_tokens(&key) else {
+        return McpTokenStatus::NotAuthenticated;
+    };
+    if rejected_token.is_none() && Utc::now().timestamp() < tokens.expires_at {
+        return McpTokenStatus::Token(tokens.access_token);
+    }
+
+    if in_refresh_failure_backoff(server_name) {
+        debug!("Skipping token refresh for MCP server '{server_name}': recent attempt failed");
+        return McpTokenStatus::RefreshFailed;
+    }
+
+    let lock = refresh_lock(server_name);
+    let _guard = lock.lock().await;
+
+    // A concurrent caller may have refreshed while we waited for the lock. An
+    // unexpired token is only trusted if it differs from the rejected one:
+    // the server already proved that exact token bad.
+    let Some(tokens) = load_oauth_tokens(&key) else {
+        return McpTokenStatus::NotAuthenticated;
+    };
+    if Utc::now().timestamp() < tokens.expires_at
+        && rejected_token.is_none_or(|rejected| rejected != tokens.access_token)
+    {
+        return McpTokenStatus::Token(tokens.access_token);
+    }
+
+    if in_refresh_failure_backoff(server_name) {
+        debug!("Skipping token refresh for MCP server '{server_name}': recent attempt failed");
+        return McpTokenStatus::RefreshFailed;
+    }
+
+    match refresh_mcp_token(server_name, &key, &tokens).await {
+        Ok(access_token) => McpTokenStatus::Token(access_token),
+        Err(e) => {
+            note_refresh_failure(server_name);
+            warn!(
+                "Failed to refresh OAuth token for MCP server '{server_name}'. \
+                 Run `.mcp auth {server_name}` to re-authenticate."
+            );
+            debug!(
+                "Token refresh error for MCP server '{server_name}': {}",
+                redact_refresh_error(&e)
+            );
+            McpTokenStatus::RefreshFailed
+        }
+    }
+}
+
+async fn refresh_mcp_token(server_name: &str, key: &str, tokens: &OAuthTokens) -> Result<String> {
+    if tokens.refresh_token.is_none() {
+        return Err(anyhow!("no refresh token stored"));
+    }
+
+    let reg =
+        load_registration(server_name).ok_or_else(|| anyhow!("no cached client registration"))?;
+    let token_url = reg.token_url.ok_or_else(|| {
+        anyhow!("cached registration has no token URL (saved by an older version)")
+    })?;
+    let resource = reg.resource.ok_or_else(|| {
+        anyhow!("cached registration has no resource (saved by an older version)")
+    })?;
+
+    let provider = McpOAuthProvider {
+        client_id: reg.client_id,
+        authorize_url: String::new(),
+        token_url,
+        scopes: String::new(),
+        fixed_redirect: String::new(),
+        resource,
+    };
+
+    let client = Client::builder().timeout(REFRESH_HTTP_TIMEOUT).build()?;
+    let refreshed = refresh_oauth_token(&client, &provider, key, tokens).await?;
+    Ok(refreshed.access_token)
+}
+
+fn refresh_lock(server_name: &str) -> Arc<sync::Mutex<()>> {
+    static LOCKS: OnceLock<parking_lot::Mutex<HashMap<String, Arc<sync::Mutex<()>>>>> =
+        OnceLock::new();
+    LOCKS
+        .get_or_init(Default::default)
+        .lock()
+        .entry(server_name.to_string())
+        .or_default()
+        .clone()
+}
+
+fn refresh_failures() -> &'static parking_lot::Mutex<HashMap<String, Instant>> {
+    static FAILURES: OnceLock<parking_lot::Mutex<HashMap<String, Instant>>> = OnceLock::new();
+    FAILURES.get_or_init(Default::default)
+}
+
+fn note_refresh_failure(server_name: &str) {
+    refresh_failures()
+        .lock()
+        .insert(server_name.to_string(), Instant::now());
+}
+
+fn in_refresh_failure_backoff(server_name: &str) -> bool {
+    refresh_failures()
+        .lock()
+        .get(server_name)
+        .is_some_and(|failed_at| failed_at.elapsed() < REFRESH_FAILURE_BACKOFF)
+}
+
+/// Refresh errors may embed the token endpoint's JSON response, which can
+/// contain live tokens; strip everything from the first `{` before logging.
+fn redact_refresh_error(e: &anyhow::Error) -> String {
+    let msg = e.to_string();
+    match msg.find('{') {
+        Some(idx) => format!("{}<response body redacted>", &msg[..idx]),
+        None => msg,
     }
 }
 
@@ -187,7 +374,13 @@ fn load_registration(server_name: &str) -> Option<McpRegistration> {
     serde_json::from_str(&content).ok()
 }
 
-fn save_registration(server_name: &str, client_id: &str, redirect_uri: &str) -> Result<()> {
+fn save_registration(
+    server_name: &str,
+    client_id: &str,
+    redirect_uri: &str,
+    token_url: &str,
+    resource: &str,
+) -> Result<()> {
     let dir = paths::oauth_tokens_dir();
     fs::create_dir_all(&dir)?;
 
@@ -195,6 +388,8 @@ fn save_registration(server_name: &str, client_id: &str, redirect_uri: &str) ->
     let reg = McpRegistration {
         client_id: client_id.to_string(),
         redirect_uri: Some(redirect_uri.to_string()),
+        token_url: Some(token_url.to_string()),
+        resource: Some(resource.to_string()),
     };
 
     fs::write(path, serde_json::to_string_pretty(&reg)?)?;
@@ -244,7 +439,12 @@ async fn register_client(endpoint: &str, redirect_uri: &str) -> Result<String> {
 
     response["client_id"]
         .as_str()
-        .ok_or_else(|| anyhow!("Missing client_id in registration response: {response}"))
+        .ok_or_else(|| {
+            anyhow!(
+                "Missing client_id in registration response (keys: {})",
+                token_response_keys(&response)
+            )
+        })
         .map(|s| s.to_string())
 }
 
@@ -421,16 +621,34 @@ fn extract_base_url(url: &str) -> Result<String> {
 }
 
 #[cfg(test)]
-mod tests {
+pub(crate) mod test_support {
-    use super::*;
     use crate::utils::get_env_name;
-    use serial_test::serial;
     use std::{
-        env, fs,
+        env,
+        ffi::OsString,
+        fs,
+        path::PathBuf,
         time::{self, SystemTime},
     };
 
-    fn with_temp_cache<F: FnOnce()>(f: F) {
+    pub(crate) fn with_temp_cache<F: FnOnce()>(f: F) {
+        struct Restore {
+            key: String,
+            prev: Option<OsString>,
+            root: PathBuf,
+        }
+        impl Drop for Restore {
+            fn drop(&mut self) {
+                unsafe {
+                    match self.prev.take() {
+                        Some(v) => env::set_var(&self.key, v),
+                        None => env::remove_var(&self.key),
+                    }
+                }
+                let _ = fs::remove_dir_all(&self.root);
+            }
+        }
+
         let unique = SystemTime::now()
             .duration_since(time::UNIX_EPOCH)
             .unwrap()
@@ -442,15 +660,21 @@ mod tests {
         unsafe {
             env::set_var(&env_key, &root);
         }
+        let _restore = Restore {
+            key: env_key,
+            prev,
+            root,
+        };
         f();
-        unsafe {
-            match prev {
-                Some(v) => env::set_var(&env_key, v),
-                None => env::remove_var(&env_key),
-            }
-        }
-        let _ = fs::remove_dir_all(&root);
     }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::test_support::with_temp_cache;
+    use super::*;
+    use serial_test::serial;
+    use std::fs;
 
     #[test]
     fn extract_base_url_strips_path_and_query() {
@@ -685,12 +909,19 @@ mod tests {
                 "notion",
                 "client-xyz-123",
                 "http://127.0.0.1:49152/callback",
+                "https://as.example/token",
+                "https://mcp.example/mcp",
             )
             .unwrap();
 
-            let loaded = load_registration("notion");
+            let loaded = load_registration("notion").unwrap();
 
-            assert_eq!(loaded.unwrap().client_id, "client-xyz-123");
+            assert_eq!(loaded.client_id, "client-xyz-123");
+            assert_eq!(
+                loaded.token_url.as_deref(),
+                Some("https://as.example/token")
+            );
+            assert_eq!(loaded.resource.as_deref(), Some("https://mcp.example/mcp"));
         });
     }
 
@@ -708,8 +939,22 @@ mod tests {
     #[serial]
     fn registration_second_save_overwrites_first() {
         with_temp_cache(|| {
-            save_registration("github", "first-id", "http://127.0.0.1:49152/callback").unwrap();
+            save_registration(
-            save_registration("github", "second-id", "http://127.0.0.1:49153/callback").unwrap();
+                "github",
+                "first-id",
+                "http://127.0.0.1:49152/callback",
+                "https://as.example/token",
+                "https://mcp.example/mcp",
+            )
+            .unwrap();
+            save_registration(
+                "github",
+                "second-id",
+                "http://127.0.0.1:49153/callback",
+                "https://as.example/token",
+                "https://mcp.example/mcp",
+            )
+            .unwrap();
 
             let loaded = load_registration("github").unwrap();
 
@@ -737,6 +982,8 @@ mod tests {
 
             assert_eq!(loaded.client_id, "legacy-id");
             assert_eq!(loaded.redirect_uri, None);
+            assert_eq!(loaded.token_url, None);
+            assert_eq!(loaded.resource, None);
         });
     }
 
@@ -744,7 +991,14 @@ mod tests {
     #[serial]
     fn save_registration_persists_redirect_uri() {
         with_temp_cache(|| {
-            save_registration("aws", "client-abc", "http://127.0.0.1:49152/callback").unwrap();
+            save_registration(
+                "aws",
+                "client-abc",
+                "http://127.0.0.1:49152/callback",
+                "https://as.example/token",
+                "https://mcp.example/mcp",
+            )
+            .unwrap();
 
             let loaded = load_registration("aws").unwrap();
 
@@ -756,6 +1010,251 @@ mod tests {
         });
     }
 
+    #[test]
+    fn mcp_registration_deserializes_without_new_fields_and_roundtrips() {
+        let old: McpRegistration = serde_json::from_str(r#"{"client_id":"legacy-id"}"#).unwrap();
+
+        assert_eq!(old.client_id, "legacy-id");
+        assert_eq!(old.token_url, None);
+        assert_eq!(old.resource, None);
+
+        let full = McpRegistration {
+            client_id: "client-abc".into(),
+            redirect_uri: Some("http://127.0.0.1:49152/callback".into()),
+            token_url: Some("https://as.example/token".into()),
+            resource: Some("https://mcp.example/mcp".into()),
+        };
+        let json = serde_json::to_string(&full).unwrap();
+        let back: McpRegistration = serde_json::from_str(&json).unwrap();
+
+        assert_eq!(back.token_url.as_deref(), Some("https://as.example/token"));
+        assert_eq!(back.resource.as_deref(), Some("https://mcp.example/mcp"));
+    }
+
+    #[test]
+    #[serial]
+    fn expired_token_with_old_format_registration_reports_refresh_failed() {
+        with_temp_cache(|| {
+            let dir = paths::oauth_tokens_dir();
+            fs::create_dir_all(&dir).unwrap();
+            fs::write(
+                paths::token_file("mcp_legacyref"),
+                r#"{"access_token":"stale","refresh_token":"refresh-abc","expires_at":0}"#,
+            )
+            .unwrap();
+            fs::write(
+                dir.join("mcp_legacyref_registration.json"),
+                r#"{"client_id":"legacy-id"}"#,
+            )
+            .unwrap();
+
+            let rt = tokio::runtime::Builder::new_current_thread()
+                .enable_all()
+                .build()
+                .unwrap();
+            let status = rt.block_on(load_or_refresh_mcp_token("legacyref"));
+
+            assert_eq!(status, McpTokenStatus::RefreshFailed);
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn missing_token_file_reports_not_authenticated() {
+        with_temp_cache(|| {
+            let rt = tokio::runtime::Builder::new_current_thread()
+                .enable_all()
+                .build()
+                .unwrap();
+            let status = rt.block_on(load_or_refresh_mcp_token("never-authed"));
+
+            assert_eq!(status, McpTokenStatus::NotAuthenticated);
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn force_refresh_returns_concurrently_refreshed_token() {
+        with_temp_cache(|| {
+            fs::create_dir_all(paths::oauth_tokens_dir()).unwrap();
+            fs::write(
+                paths::token_file("mcp_force-fresh"),
+                r#"{"access_token":"fresh-tok","refresh_token":"r","expires_at":9999999999}"#,
+            )
+            .unwrap();
+
+            let rt = tokio::runtime::Builder::new_current_thread()
+                .enable_all()
+                .build()
+                .unwrap();
+            let token = rt.block_on(force_refresh_mcp_token("force-fresh", "rejected-tok"));
+
+            assert_eq!(token.as_deref(), Some("fresh-tok"));
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn force_refresh_unexpired_rejected_token_attempts_real_refresh() {
+        with_temp_cache(|| {
+            fs::create_dir_all(paths::oauth_tokens_dir()).unwrap();
+            fs::write(
+                paths::token_file("mcp_force-rejected"),
+                r#"{"access_token":"same-tok","refresh_token":"r","expires_at":9999999999}"#,
+            )
+            .unwrap();
+
+            let rt = tokio::runtime::Builder::new_current_thread()
+                .enable_all()
+                .build()
+                .unwrap();
+            let token = rt.block_on(force_refresh_mcp_token("force-rejected", "same-tok"));
+
+            assert_eq!(token, None);
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn force_refresh_missing_token_file_returns_none() {
+        with_temp_cache(|| {
+            let rt = tokio::runtime::Builder::new_current_thread()
+                .enable_all()
+                .build()
+                .unwrap();
+            let token = rt.block_on(force_refresh_mcp_token(
+                "force-never-authed",
+                "rejected-tok",
+            ));
+
+            assert_eq!(token, None);
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn force_refresh_failed_refresh_returns_none() {
+        with_temp_cache(|| {
+            fs::create_dir_all(paths::oauth_tokens_dir()).unwrap();
+            fs::write(
+                paths::token_file("mcp_force-fail"),
+                r#"{"access_token":"stale","refresh_token":"r","expires_at":0}"#,
+            )
+            .unwrap();
+
+            let rt = tokio::runtime::Builder::new_current_thread()
+                .enable_all()
+                .build()
+                .unwrap();
+            let token = rt.block_on(force_refresh_mcp_token("force-fail", "stale"));
+
+            assert_eq!(token, None);
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn force_refresh_concurrent_callers_complete_without_deadlock() {
+        with_temp_cache(|| {
+            fs::create_dir_all(paths::oauth_tokens_dir()).unwrap();
+            fs::write(
+                paths::token_file("mcp_force-concurrent"),
+                r#"{"access_token":"same-tok","refresh_token":"r","expires_at":9999999999}"#,
+            )
+            .unwrap();
+
+            let rt = tokio::runtime::Builder::new_current_thread()
+                .enable_all()
+                .build()
+                .unwrap();
+            let (a, b) = rt.block_on(async {
+                tokio::join!(
+                    force_refresh_mcp_token("force-concurrent", "same-tok"),
+                    force_refresh_mcp_token("force-concurrent", "same-tok"),
+                )
+            });
+
+            assert_eq!(a, None);
+            assert_eq!(b, None);
+        });
+    }
+
+    #[test]
+    #[serial]
+    fn force_refresh_respects_failure_backoff() {
+        with_temp_cache(|| {
+            fs::create_dir_all(paths::oauth_tokens_dir()).unwrap();
+            fs::write(
+                paths::token_file("mcp_force-backoff"),
+                r#"{"access_token":"same-tok","refresh_token":"r","expires_at":9999999999}"#,
+            )
+            .unwrap();
+            note_refresh_failure("force-backoff");
+
+            let rt = tokio::runtime::Builder::new_current_thread()
+                .enable_all()
+                .build()
+                .unwrap();
+            let token = rt.block_on(force_refresh_mcp_token("force-backoff", "same-tok"));
+
+            assert_eq!(token, None);
+        });
+    }
+
+    #[test]
+    fn token_status_debug_redacts_token() {
+        assert_eq!(
+            format!("{:?}", McpTokenStatus::Token("live-secret".into())),
+            "Token(<redacted>)"
+        );
+        assert_eq!(
+            format!("{:?}", McpTokenStatus::NotAuthenticated),
+            "NotAuthenticated"
+        );
+        assert_eq!(
+            format!("{:?}", McpTokenStatus::RefreshFailed),
+            "RefreshFailed"
+        );
+    }
+
+    #[test]
+    fn token_status_into_token_extracts_only_token_variant() {
+        assert_eq!(
+            McpTokenStatus::Token("tok".into()).into_token(),
+            Some("tok".to_string())
+        );
+        assert_eq!(McpTokenStatus::NotAuthenticated.into_token(), None);
+        assert_eq!(McpTokenStatus::RefreshFailed.into_token(), None);
+    }
+
+    #[test]
+    fn refresh_failure_backoff_memoizes_per_server() {
+        assert!(!in_refresh_failure_backoff("backoff-test-server"));
+
+        note_refresh_failure("backoff-test-server");
+
+        assert!(in_refresh_failure_backoff("backoff-test-server"));
+        assert!(!in_refresh_failure_backoff("backoff-other-server"));
+    }
+
+    #[test]
+    fn redact_refresh_error_strips_response_body() {
+        let with_body = anyhow!(
+            "Missing access_token in refresh response: {}",
+            r#"{"access_token":"live-secret"}"#
+        );
+        let without_body = anyhow!("no refresh token stored");
+
+        assert_eq!(
+            redact_refresh_error(&with_body),
+            "Missing access_token in refresh response: <response body redacted>"
+        );
+        assert_eq!(
+            redact_refresh_error(&without_body),
+            "no refresh token stored"
+        );
+    }
+
     #[test]
     fn cached_redirect_port_matches() {
         let port = cached_redirect_port("http://127.0.0.1:49152/callback", "127.0.0.1", None);

src/mcp/render.rs

@@ -0,0 +1,896 @@
+//! Content policy for MCP resource and tool content: UTF-8-boundary-safe text
+//! paging, grep-style pattern filtering, and spill-to-disk for binary blobs.
+
+use crate::config::paths;
+use base64::engine::general_purpose::STANDARD;
+use base64::read::DecoderReader;
+use fancy_regex::Regex;
+use serde::Serialize;
+use sha2::{Digest, Sha256};
+use std::error::Error;
+use std::fs::{self, OpenOptions};
+use std::io::{ErrorKind, Read, Write};
+#[cfg(unix)]
+use std::os::unix::fs::OpenOptionsExt;
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::time::SystemTime;
+use std::{fmt, io};
+
+/// Default page size when the caller does not specify `max_bytes`.
+pub const DEFAULT_TEXT_MAX_BYTES: usize = 51_200;
+/// Hard upper bound on a single text slice regardless of requested `max_bytes`.
+pub const TEXT_MAX_BYTES_CLAMP: usize = 204_800;
+/// Maximum decoded size of a base64 blob before rendering is refused.
+pub const BLOB_DECODE_CEILING_BYTES: usize = 50 * 1024 * 1024;
+/// Total size bound for the spill tree; oldest files are evicted beyond it.
+pub const SPILL_DIR_MAX_BYTES: u64 = 512 * 1024 * 1024;
+/// Byte bound on server-supplied metadata strings (uri, mime type) copied into output.
+pub const METADATA_MAX_BYTES: usize = 4096;
+
+const PATTERN_CONTEXT_LINES: usize = 2;
+const HUNK_SEPARATOR: &str = "--";
+
+const MIME_EXTENSIONS: &[(&str, &str)] = &[
+    ("application/gzip", "gz"),
+    ("application/json", "json"),
+    ("application/pdf", "pdf"),
+    ("application/zip", "zip"),
+    ("audio/mpeg", "mp3"),
+    ("image/gif", "gif"),
+    ("image/jpeg", "jpg"),
+    ("image/png", "png"),
+    ("image/webp", "webp"),
+    ("text/csv", "csv"),
+    ("video/mp4", "mp4"),
+];
+
+#[derive(Debug)]
+pub enum RenderError {
+    InvalidPattern { pattern: String, error: String },
+    DecodedSizeExceeded,
+    InvalidBase64(String),
+    Io(io::Error),
+}
+
+impl fmt::Display for RenderError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::InvalidPattern { pattern, error } => write!(
+                f,
+                "Invalid filter pattern '{pattern}': {error}. Provide a valid regex; \
+                 lines matching it are returned with {PATTERN_CONTEXT_LINES} lines of context."
+            ),
+            Self::DecodedSizeExceeded => write!(
+                f,
+                "Decoded blob exceeds BLOB_DECODE_CEILING_BYTES ({} MiB); refusing to render it",
+                BLOB_DECODE_CEILING_BYTES / (1024 * 1024)
+            ),
+            Self::InvalidBase64(error) => write!(f, "Invalid base64 in blob content: {error}"),
+            Self::Io(error) => write!(f, "Failed to spill blob to disk: {error}"),
+        }
+    }
+}
+
+impl Error for RenderError {
+    fn source(&self) -> Option<&(dyn Error + 'static)> {
+        match self {
+            Self::Io(error) => Some(error),
+            _ => None,
+        }
+    }
+}
+
+impl From<io::Error> for RenderError {
+    fn from(error: io::Error) -> Self {
+        Self::Io(error)
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct RenderedText {
+    pub text: String,
+    pub truncated: bool,
+    pub total_bytes: usize,
+    pub next_offset: Option<usize>,
+}
+
+#[derive(Debug)]
+pub enum RenderedBlob {
+    Text(String),
+    Spilled(SpillMetadata),
+}
+
+#[derive(Debug, Serialize)]
+pub struct SpillMetadata {
+    pub spilled: bool,
+    pub path: PathBuf,
+    pub mime_type: Option<String>,
+    pub sniffed: bool,
+    pub size_bytes: u64,
+    pub sha256: String,
+}
+
+/// Pages `text` with UTF-8-boundary-safe slicing. When `pattern` is set, the
+/// text is first reduced to matching lines plus context (grep-style, with
+/// 1-based line-number prefixes), and all offset/size math operates on that
+/// filtered stream.
+pub fn render_text(
+    text: &str,
+    pattern: Option<&str>,
+    offset: usize,
+    max_bytes: Option<usize>,
+) -> Result<RenderedText, RenderError> {
+    let filtered = match pattern {
+        Some(pattern) => Some(filter_lines(text, pattern)?),
+        None => None,
+    };
+    let stream = filtered.as_deref().unwrap_or(text);
+    let max_bytes = max_bytes
+        .unwrap_or(DEFAULT_TEXT_MAX_BYTES)
+        .min(TEXT_MAX_BYTES_CLAMP);
+    let total_bytes = stream.len();
+    let mut start = offset.min(total_bytes);
+    while !stream.is_char_boundary(start) {
+        start += 1;
+    }
+    let mut end = start.saturating_add(max_bytes).min(total_bytes);
+    while !stream.is_char_boundary(end) {
+        end -= 1;
+    }
+    // A max_bytes smaller than one codepoint would produce an empty page with
+    // next_offset == offset, stalling paging; always advance by at least one.
+    if end == start && start < total_bytes {
+        end += 1;
+        while !stream.is_char_boundary(end) {
+            end += 1;
+        }
+    }
+
+    let truncated = end < total_bytes;
+    Ok(RenderedText {
+        text: stream[start..end].to_string(),
+        truncated,
+        total_bytes,
+        next_offset: truncated.then_some(end),
+    })
+}
+
+/// Decodes a base64 blob, returning it as text when it is valid UTF-8 and
+/// spilling it under `cache_dir()/mcp-resources/<server>/` otherwise.
+pub fn render_blob(
+    b64: &str,
+    claimed_mime: Option<&str>,
+    server: &str,
+) -> Result<RenderedBlob, RenderError> {
+    let spill_base = paths::cache_dir().join("mcp-resources");
+    render_blob_at(b64, claimed_mime, server, &spill_base)
+}
+
+pub fn render_blob_at(
+    b64: &str,
+    claimed_mime: Option<&str>,
+    server: &str,
+    spill_base: &Path,
+) -> Result<RenderedBlob, RenderError> {
+    let decoded = decode_base64_bounded(b64)?;
+    let decoded = match String::from_utf8(decoded) {
+        Ok(text) => return Ok(RenderedBlob::Text(text)),
+        Err(error) => error.into_bytes(),
+    };
+    let sha256 = format!("{:x}", Sha256::digest(&decoded));
+    let dir = spill_base.join(sanitize_server(server));
+    fs::create_dir_all(&dir)?;
+    let path = dir.join(format!("{sha256}.{}", extension_for_mime(claimed_mime)));
+
+    // Writes land in a temp file and are renamed into place, so a visible
+    // file at the final path is always complete and the dedup check below is
+    // race-safe across processes (same sha means same content).
+    if !path.exists() {
+        static TEMP_COUNTER: AtomicUsize = AtomicUsize::new(0);
+        let temp = dir.join(format!(
+            "{sha256}.tmp-{}-{}",
+            std::process::id(),
+            TEMP_COUNTER.fetch_add(1, Ordering::Relaxed)
+        ));
+        let mut options = OpenOptions::new();
+        options.write(true).create_new(true);
+        #[cfg(unix)]
+        options.mode(0o600);
+        let written = options
+            .open(&temp)
+            .and_then(|mut file| file.write_all(&decoded))
+            .and_then(|()| fs::rename(&temp, &path));
+        if let Err(error) = written {
+            let _ = fs::remove_file(&temp);
+            return Err(RenderError::Io(error));
+        }
+    }
+    enforce_spill_bound(spill_base, SPILL_DIR_MAX_BYTES, &path);
+
+    Ok(RenderedBlob::Spilled(SpillMetadata {
+        spilled: true,
+        path,
+        mime_type: claimed_mime.map(str::to_string),
+        sniffed: false,
+        size_bytes: decoded.len() as u64,
+        sha256,
+    }))
+}
+
+/// Truncates `text` to at most `max_bytes`, rounding the cut point back to a
+/// UTF-8 character boundary.
+pub fn truncate_utf8(text: &str, max_bytes: usize) -> &str {
+    if text.len() <= max_bytes {
+        return text;
+    }
+    let mut end = max_bytes;
+    while !text.is_char_boundary(end) {
+        end -= 1;
+    }
+    &text[..end]
+}
+
+/// Bounds a server-supplied metadata string to [`METADATA_MAX_BYTES`],
+/// appending a marker citing the constant when the input is truncated.
+pub fn clamp_metadata(text: &str) -> String {
+    if text.len() <= METADATA_MAX_BYTES {
+        return text.to_string();
+    }
+
+    let clamped = truncate_utf8(text, METADATA_MAX_BYTES);
+    format!("{clamped} [truncated: exceeds METADATA_MAX_BYTES ({METADATA_MAX_BYTES} bytes)]")
+}
+
+fn filter_lines(text: &str, pattern: &str) -> Result<String, RenderError> {
+    let regex = Regex::new(pattern).map_err(|error| RenderError::InvalidPattern {
+        pattern: pattern.to_string(),
+        error: error.to_string(),
+    })?;
+    let lines: Vec<&str> = text.lines().collect();
+    // fancy_regex can also fail at match time (backtracking limits); treat
+    // that as a non-match rather than failing the whole render.
+    let is_match: Vec<bool> = lines
+        .iter()
+        .map(|line| regex.is_match(line).unwrap_or(false))
+        .collect();
+
+    let mut keep = vec![false; lines.len()];
+    for (i, _) in is_match.iter().enumerate().filter(|&(_, matched)| *matched) {
+        let start = i.saturating_sub(PATTERN_CONTEXT_LINES);
+        let end = (i + PATTERN_CONTEXT_LINES).min(lines.len() - 1);
+        keep[start..=end].fill(true);
+    }
+
+    let mut out: Vec<String> = Vec::new();
+    let mut prev_kept: Option<usize> = None;
+    for (i, line) in lines.iter().enumerate() {
+        if !keep[i] {
+            continue;
+        }
+        if prev_kept.is_some_and(|prev| i > prev + 1) {
+            out.push(HUNK_SEPARATOR.to_string());
+        }
+        let marker = if is_match[i] { ':' } else { '-' };
+        out.push(format!("{}{marker}{line}", i + 1));
+        prev_kept = Some(i);
+    }
+
+    Ok(out.join("\n"))
+}
+
+fn decode_base64_bounded(b64: &str) -> Result<Vec<u8>, RenderError> {
+    // The encoded length puts a lower bound on the decoded size; reject
+    // inputs that bound already proves oversized before decoding anything.
+    let min_decoded = (b64.len() / 4).saturating_mul(3).saturating_sub(2);
+    if min_decoded > BLOB_DECODE_CEILING_BYTES {
+        return Err(RenderError::DecodedSizeExceeded);
+    }
+
+    let mut reader = DecoderReader::new(b64.as_bytes(), &STANDARD);
+    let mut decoded = Vec::new();
+    let mut chunk = [0u8; 8192];
+    loop {
+        match reader.read(&mut chunk) {
+            Ok(0) => return Ok(decoded),
+            Ok(n) => {
+                if decoded.len() + n > BLOB_DECODE_CEILING_BYTES {
+                    return Err(RenderError::DecodedSizeExceeded);
+                }
+                decoded.extend_from_slice(&chunk[..n]);
+            }
+            Err(error) => return Err(RenderError::InvalidBase64(error.to_string())),
+        }
+    }
+}
+
+/// Maps a server-controlled mime type to a spill-file extension via an exact
+/// allowlist lookup; anything unrecognized falls back to `bin`.
+fn extension_for_mime(mime: Option<&str>) -> &'static str {
+    let Some(mime) = mime else {
+        return "bin";
+    };
+    let bare = mime
+        .split(';')
+        .next()
+        .unwrap_or("")
+        .trim()
+        .to_ascii_lowercase();
+    let ext = MIME_EXTENSIONS
+        .iter()
+        .find(|(known, _)| *known == bare)
+        .map(|(_, ext)| *ext)
+        .unwrap_or("bin");
+    let safe = !ext.is_empty()
+        && ext.len() <= 8
+        && ext
+            .bytes()
+            .all(|b| b.is_ascii_lowercase() || b.is_ascii_digit());
+
+    if safe { ext } else { "bin" }
+}
+
+fn sanitize_server(server: &str) -> String {
+    let mut sanitized: String = server
+        .chars()
+        .map(|c| {
+            if c.is_ascii_alphanumeric() || matches!(c, '.' | '_' | '-') {
+                c
+            } else {
+                '_'
+            }
+        })
+        .take(64)
+        .collect();
+    // Windows strips trailing dots at create time, which would make the
+    // constructed path disagree with the on-disk name.
+    while sanitized.ends_with('.') {
+        sanitized.pop();
+    }
+    if sanitized.is_empty() {
+        return "_".to_string();
+    }
+    // Windows reserves device names (bare or with any extension).
+    let stem = sanitized.split('.').next().unwrap_or("");
+    if is_windows_reserved(stem) {
+        sanitized.insert(0, '_');
+    }
+    sanitized
+}
+
+fn is_windows_reserved(stem: &str) -> bool {
+    let lower = stem.to_ascii_lowercase();
+    matches!(lower.as_str(), "con" | "prn" | "aux" | "nul")
+        || (lower.len() == 4
+            && (lower.starts_with("com") || lower.starts_with("lpt"))
+            && matches!(lower.as_bytes()[3], b'1'..=b'9'))
+}
+
+struct SpillEntry {
+    path: PathBuf,
+    size: u64,
+    modified: SystemTime,
+}
+
+fn enforce_spill_bound(base: &Path, max_total: u64, protect: &Path) {
+    let mut entries = Vec::new();
+    collect_spill_files(base, &mut entries);
+    evict_oldest(entries, max_total, protect);
+}
+
+/// Best-effort eviction: the spill dir is shared across processes, so a file
+/// vanishing underneath us (`NotFound`) is expected and never fails the spill.
+fn evict_oldest(mut entries: Vec<SpillEntry>, max_total: u64, protect: &Path) {
+    let mut total: u64 = entries.iter().map(|entry| entry.size).sum();
+    if total <= max_total {
+        return;
+    }
+    entries.sort_by_key(|entry| entry.modified);
+    for entry in &entries {
+        if total <= max_total {
+            break;
+        }
+
+        // Filenames are content-hashed, so name equality is sufficient and
+        // survives filesystems that normalize directory names (case folding,
+        // trailing-dot stripping) where a full-path comparison would miss.
+        if entry.path.file_name() == protect.file_name() {
+            continue;
+        }
+
+        match fs::remove_file(&entry.path) {
+            Ok(()) => total -= entry.size,
+            Err(error) if error.kind() == ErrorKind::NotFound => total -= entry.size,
+            Err(_) => {}
+        }
+    }
+}
+
+fn collect_spill_files(dir: &Path, out: &mut Vec<SpillEntry>) {
+    let Ok(entries) = fs::read_dir(dir) else {
+        return;
+    };
+    for entry in entries.flatten() {
+        let path = entry.path();
+        let Ok(metadata) = entry.metadata() else {
+            continue;
+        };
+        if metadata.is_dir() {
+            collect_spill_files(&path, out);
+        } else if metadata.is_file() {
+            out.push(SpillEntry {
+                path,
+                size: metadata.len(),
+                modified: metadata.modified().unwrap_or(SystemTime::UNIX_EPOCH),
+            });
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use base64::Engine;
+    use std::env;
+    #[cfg(unix)]
+    use std::os::unix::fs::PermissionsExt;
+    use std::process;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    use std::time::Duration;
+
+    fn with_spill_base<F: FnOnce(&Path)>(f: F) {
+        static COUNTER: AtomicUsize = AtomicUsize::new(0);
+        let unique = format!(
+            "{}-{}",
+            process::id(),
+            COUNTER.fetch_add(1, Ordering::Relaxed)
+        );
+        let base = env::temp_dir().join(format!("coyote-render-test-{unique}"));
+        fs::create_dir_all(&base).unwrap();
+        f(&base);
+        let _ = fs::remove_dir_all(&base);
+    }
+
+    fn set_mtime(path: &Path, secs_after_epoch: u64) {
+        let file = OpenOptions::new().write(true).open(path).unwrap();
+        file.set_modified(SystemTime::UNIX_EPOCH + Duration::from_secs(secs_after_epoch))
+            .unwrap();
+    }
+
+    fn write_spill_file(dir: &Path, name: &str, len: usize, mtime_secs: u64) -> PathBuf {
+        let path = dir.join(name);
+        fs::write(&path, vec![0u8; len]).unwrap();
+        set_mtime(&path, mtime_secs);
+        path
+    }
+
+    const TEN_LINES: &str = "one\ntwo\nthree\nfour\nfive\nsix\nseven\neight\nnine\nten";
+
+    #[test]
+    fn slices_basic_ascii_page() {
+        let rendered = render_text("hello world", None, 0, Some(5)).unwrap();
+
+        assert_eq!(rendered.text, "hello");
+        assert!(rendered.truncated);
+        assert_eq!(rendered.total_bytes, 11);
+        assert_eq!(rendered.next_offset, Some(5));
+    }
+
+    #[test]
+    fn offset_mid_codepoint_rounds_forward() {
+        // 'é' occupies bytes 1..3; offset 2 lands inside it.
+        let rendered = render_text("héllo", None, 2, None).unwrap();
+
+        assert_eq!(rendered.text, "llo");
+        assert!(!rendered.truncated);
+        assert_eq!(rendered.next_offset, None);
+    }
+
+    #[test]
+    fn end_mid_codepoint_rounds_backward() {
+        // 'é' occupies bytes 1..3; offset 0 + max_bytes 2 lands inside it.
+        let rendered = render_text("aé", None, 0, Some(2)).unwrap();
+
+        assert_eq!(rendered.text, "a");
+        assert!(rendered.truncated);
+        assert_eq!(rendered.total_bytes, 3);
+        assert_eq!(rendered.next_offset, Some(1));
+
+        let rest = render_text("aé", None, 1, Some(2)).unwrap();
+
+        assert_eq!(rest.text, "é");
+        assert!(!rest.truncated);
+    }
+
+    #[test]
+    fn max_bytes_below_one_codepoint_still_advances() {
+        // 'é' is 2 bytes; max_bytes 1 must not stall at next_offset == offset.
+        let rendered = render_text("éa", None, 0, Some(1)).unwrap();
+
+        assert_eq!(rendered.text, "é");
+        assert!(rendered.truncated);
+        assert_eq!(rendered.total_bytes, 3);
+        assert_eq!(rendered.next_offset, Some(2));
+    }
+
+    #[test]
+    fn offset_past_eof_returns_empty() {
+        let rendered = render_text("short", None, 100, None).unwrap();
+
+        assert_eq!(rendered.text, "");
+        assert!(!rendered.truncated);
+        assert_eq!(rendered.total_bytes, 5);
+        assert_eq!(rendered.next_offset, None);
+    }
+
+    #[test]
+    fn exact_fit_is_not_truncated() {
+        let rendered = render_text("exact", None, 0, Some(5)).unwrap();
+
+        assert_eq!(rendered.text, "exact");
+        assert!(!rendered.truncated);
+        assert_eq!(rendered.next_offset, None);
+    }
+
+    #[test]
+    fn default_max_bytes_is_default_text_max_bytes() {
+        let text = "a".repeat(DEFAULT_TEXT_MAX_BYTES + 1);
+
+        let rendered = render_text(&text, None, 0, None).unwrap();
+
+        assert_eq!(rendered.text.len(), DEFAULT_TEXT_MAX_BYTES);
+        assert!(rendered.truncated);
+        assert_eq!(rendered.next_offset, Some(DEFAULT_TEXT_MAX_BYTES));
+    }
+
+    #[test]
+    fn max_bytes_above_clamp_is_clamped() {
+        let text = "a".repeat(TEXT_MAX_BYTES_CLAMP + 1);
+
+        let rendered = render_text(&text, None, 0, Some(usize::MAX)).unwrap();
+
+        assert_eq!(rendered.text.len(), TEXT_MAX_BYTES_CLAMP);
+        assert!(rendered.truncated);
+        assert_eq!(rendered.next_offset, Some(TEXT_MAX_BYTES_CLAMP));
+    }
+
+    #[test]
+    fn truncate_utf8_rounds_back_to_char_boundary() {
+        // 'é' occupies bytes 1..3; a cut at byte 2 lands inside it.
+        assert_eq!(truncate_utf8("aé", 2), "a");
+        assert_eq!(truncate_utf8("aé", 3), "aé");
+        assert_eq!(truncate_utf8("abc", 10), "abc");
+        assert_eq!(truncate_utf8("abc", 0), "");
+    }
+
+    #[test]
+    fn clamp_metadata_appends_marker_only_when_oversized() {
+        assert_eq!(clamp_metadata("text/plain"), "text/plain");
+
+        let long = "u".repeat(METADATA_MAX_BYTES + 1);
+
+        let clamped = clamp_metadata(&long);
+
+        assert!(clamped.starts_with(&"u".repeat(METADATA_MAX_BYTES)));
+        assert!(clamped.contains("METADATA_MAX_BYTES"));
+        assert!(clamped.contains(&METADATA_MAX_BYTES.to_string()));
+    }
+
+    #[test]
+    fn pattern_emits_matches_with_context_and_line_numbers() {
+        let rendered = render_text(TEN_LINES, Some("^five$"), 0, None).unwrap();
+
+        assert_eq!(rendered.text, "3-three\n4-four\n5:five\n6-six\n7-seven");
+        assert!(!rendered.truncated);
+        assert_eq!(rendered.total_bytes, rendered.text.len());
+    }
+
+    #[test]
+    fn pattern_separates_disjoint_hunks() {
+        let rendered = render_text(TEN_LINES, Some("^(two|nine)$"), 0, None).unwrap();
+
+        assert_eq!(
+            rendered.text,
+            "1-one\n2:two\n3-three\n4-four\n--\n7-seven\n8-eight\n9:nine\n10-ten"
+        );
+    }
+
+    #[test]
+    fn pattern_merges_adjacent_hunks_without_duplicates() {
+        let rendered = render_text(TEN_LINES, Some("^(two|six)$"), 0, None).unwrap();
+
+        assert_eq!(
+            rendered.text,
+            "1-one\n2:two\n3-three\n4-four\n5-five\n6:six\n7-seven\n8-eight"
+        );
+        assert!(!rendered.text.contains(HUNK_SEPARATOR));
+    }
+
+    #[test]
+    fn pattern_paging_walks_the_filtered_stream() {
+        let full = render_text(TEN_LINES, Some("^t"), 0, None).unwrap();
+        assert!(!full.truncated);
+
+        let mut assembled = String::new();
+        let mut offset = 0;
+        loop {
+            let page = render_text(TEN_LINES, Some("^t"), offset, Some(7)).unwrap();
+            assert_eq!(page.total_bytes, full.text.len());
+            assembled.push_str(&page.text);
+            match page.next_offset {
+                Some(next) => offset = next,
+                None => break,
+            }
+        }
+
+        assert_eq!(assembled, full.text);
+    }
+
+    #[test]
+    fn pattern_with_no_matches_returns_empty() {
+        let rendered = render_text(TEN_LINES, Some("^zebra$"), 0, None).unwrap();
+
+        assert_eq!(rendered.text, "");
+        assert_eq!(rendered.total_bytes, 0);
+        assert!(!rendered.truncated);
+        assert_eq!(rendered.next_offset, None);
+    }
+
+    #[test]
+    fn invalid_pattern_is_a_teaching_error() {
+        let parse_error = Regex::new("(").unwrap_err().to_string();
+
+        let err = render_text("text", Some("("), 0, None).unwrap_err();
+
+        assert!(matches!(err, RenderError::InvalidPattern { .. }));
+        let message = err.to_string();
+        assert!(message.contains("'('"));
+        assert!(message.contains(&parse_error));
+    }
+
+    #[test]
+    fn utf8_blob_decodes_to_text_without_spilling() {
+        with_spill_base(|base| {
+            let b64 = STANDARD.encode("hello ✓ world");
+
+            let rendered = render_blob_at(&b64, Some("text/plain"), "srv", base).unwrap();
+
+            let RenderedBlob::Text(text) = rendered else {
+                panic!("expected text variant");
+            };
+            assert_eq!(text, "hello ✓ world");
+            assert_eq!(fs::read_dir(base).unwrap().count(), 0);
+        });
+    }
+
+    #[test]
+    fn binary_blob_spills_with_metadata_and_0600_perms() {
+        with_spill_base(|base| {
+            let data: &[u8] = &[0xff, 0xfe, 0x00, 0x88, 0x01];
+            let b64 = STANDARD.encode(data);
+
+            let rendered = render_blob_at(&b64, Some("application/pdf"), "docs", base).unwrap();
+
+            let RenderedBlob::Spilled(meta) = rendered else {
+                panic!("expected spilled variant");
+            };
+            let expected_sha = format!("{:x}", Sha256::digest(data));
+            assert_eq!(meta.sha256, expected_sha);
+            assert_eq!(
+                meta.path,
+                base.join("docs").join(format!("{expected_sha}.pdf"))
+            );
+            assert_eq!(meta.size_bytes, data.len() as u64);
+            assert_eq!(meta.mime_type.as_deref(), Some("application/pdf"));
+            assert!(!meta.sniffed);
+            assert!(meta.spilled);
+            assert_eq!(fs::read(&meta.path).unwrap(), data);
+            #[cfg(unix)]
+            {
+                let mode = fs::metadata(&meta.path).unwrap().permissions().mode();
+                assert_eq!(mode & 0o777, 0o600);
+            }
+        });
+    }
+
+    #[test]
+    fn decode_ceiling_rejects_oversized_blob() {
+        with_spill_base(|base| {
+            // base64 of 51 MiB of zero bytes is just a repeated-'A' string.
+            let encoded = "A".repeat(51 * 1024 * 1024 / 3 * 4);
+
+            let err = render_blob_at(&encoded, None, "srv", base).unwrap_err();
+
+            assert!(matches!(err, RenderError::DecodedSizeExceeded));
+            assert!(err.to_string().contains("BLOB_DECODE_CEILING_BYTES"));
+        });
+    }
+
+    #[test]
+    fn malformed_base64_is_rejected() {
+        with_spill_base(|base| {
+            let err = render_blob_at("!!!not base64!!!", None, "srv", base).unwrap_err();
+
+            assert!(matches!(err, RenderError::InvalidBase64(_)));
+        });
+    }
+
+    #[test]
+    fn spill_dedup_returns_same_path_without_rewriting() {
+        with_spill_base(|base| {
+            let data: &[u8] = &[0xff, 0x01, 0x02];
+            let b64 = STANDARD.encode(data);
+
+            let RenderedBlob::Spilled(first) = render_blob_at(&b64, None, "srv", base).unwrap()
+            else {
+                panic!("expected spilled variant");
+            };
+            fs::write(&first.path, b"sentinel").unwrap();
+
+            let RenderedBlob::Spilled(second) = render_blob_at(&b64, None, "srv", base).unwrap()
+            else {
+                panic!("expected spilled variant");
+            };
+
+            assert_eq!(second.path, first.path);
+            assert_eq!(second.sha256, first.sha256);
+            assert_eq!(fs::read(&second.path).unwrap(), b"sentinel");
+        });
+    }
+
+    #[test]
+    fn spill_metadata_serializes_spilled_true() {
+        with_spill_base(|base| {
+            let b64 = STANDARD.encode([0xffu8, 0x00]);
+
+            let RenderedBlob::Spilled(meta) =
+                render_blob_at(&b64, Some("image/png"), "srv", base).unwrap()
+            else {
+                panic!("expected spilled variant");
+            };
+
+            let value = serde_json::to_value(&meta).unwrap();
+            assert_eq!(value["spilled"], serde_json::Value::Bool(true));
+            assert_eq!(value["sniffed"], serde_json::Value::Bool(false));
+            assert_eq!(value["sha256"].as_str(), Some(meta.sha256.as_str()));
+            assert_eq!(value["mime_type"].as_str(), Some("image/png"));
+        });
+    }
+
+    #[test]
+    fn extension_allowlist_normalizes_and_defaults_to_bin() {
+        assert_eq!(extension_for_mime(Some("application/pdf")), "pdf");
+        assert_eq!(extension_for_mime(Some("image/png")), "png");
+        assert_eq!(extension_for_mime(Some(" TEXT/CSV ; charset=utf-8")), "csv");
+        assert_eq!(extension_for_mime(Some("../../evil")), "bin");
+        assert_eq!(extension_for_mime(Some("image/png/../../x")), "bin");
+        assert_eq!(extension_for_mime(Some("application/x-∞")), "bin");
+        assert_eq!(extension_for_mime(Some("text/plain")), "bin");
+        assert_eq!(extension_for_mime(None), "bin");
+    }
+
+    #[test]
+    fn sanitize_server_strips_path_separators() {
+        assert_eq!(sanitize_server("../evil/srv"), ".._evil_srv");
+        assert_eq!(sanitize_server("srv name!"), "srv_name_");
+        assert_eq!(sanitize_server(""), "_");
+        assert_eq!(sanitize_server("."), "_");
+        assert_eq!(sanitize_server(".."), "_");
+        assert_eq!(sanitize_server("good-server_1.0"), "good-server_1.0");
+    }
+
+    #[test]
+    fn sanitize_server_escapes_windows_reserved_names() {
+        assert_eq!(sanitize_server("con"), "_con");
+        assert_eq!(sanitize_server("CON"), "_CON");
+        assert_eq!(sanitize_server("nul.txt"), "_nul.txt");
+        assert_eq!(sanitize_server("COM1"), "_COM1");
+        assert_eq!(sanitize_server("lpt9"), "_lpt9");
+        assert_eq!(sanitize_server("com0"), "com0");
+        assert_eq!(sanitize_server("com10"), "com10");
+        assert_eq!(sanitize_server("consul"), "consul");
+    }
+
+    #[test]
+    fn sanitize_server_strips_trailing_dots_and_caps_length() {
+        assert_eq!(sanitize_server("srv."), "srv");
+        assert_eq!(sanitize_server("srv..."), "srv");
+        assert_eq!(sanitize_server("..."), "_");
+        let long = "a".repeat(100);
+        assert_eq!(sanitize_server(&long).len(), 64);
+    }
+
+    #[test]
+    fn spill_path_confines_crafted_server_and_mime() {
+        with_spill_base(|base| {
+            let b64 = STANDARD.encode([0xffu8, 0x00, 0x11]);
+
+            let RenderedBlob::Spilled(meta) =
+                render_blob_at(&b64, Some("../../evil"), "../evil/srv", base).unwrap()
+            else {
+                panic!("expected spilled variant");
+            };
+
+            assert!(meta.path.starts_with(base));
+            let dir_name = meta.path.parent().unwrap().file_name().unwrap();
+            assert_eq!(dir_name, ".._evil_srv");
+            assert_eq!(meta.path.extension().unwrap(), "bin");
+        });
+    }
+
+    #[test]
+    fn eviction_removes_oldest_files_first_across_server_dirs() {
+        with_spill_base(|base| {
+            let srv_a = base.join("srv-a");
+            let srv_b = base.join("srv-b");
+            fs::create_dir_all(&srv_a).unwrap();
+            fs::create_dir_all(&srv_b).unwrap();
+            let oldest = write_spill_file(&srv_a, "a.bin", 100, 100);
+            let middle = write_spill_file(&srv_b, "b.bin", 100, 200);
+            let newest = write_spill_file(&srv_b, "c.bin", 100, 300);
+
+            enforce_spill_bound(base, 150, &newest);
+
+            assert!(!oldest.exists());
+            assert!(!middle.exists());
+            assert!(newest.exists());
+        });
+    }
+
+    #[test]
+    fn eviction_skips_protected_file() {
+        with_spill_base(|base| {
+            let srv = base.join("srv");
+            fs::create_dir_all(&srv).unwrap();
+            let oldest = write_spill_file(&srv, "a.bin", 100, 100);
+            let middle = write_spill_file(&srv, "b.bin", 100, 200);
+            let newest = write_spill_file(&srv, "c.bin", 100, 300);
+
+            enforce_spill_bound(base, 250, &oldest);
+
+            assert!(oldest.exists());
+            assert!(!middle.exists());
+            assert!(newest.exists());
+        });
+    }
+
+    #[test]
+    fn eviction_under_bound_is_noop() {
+        with_spill_base(|base| {
+            let srv = base.join("srv");
+            fs::create_dir_all(&srv).unwrap();
+            let first = write_spill_file(&srv, "a.bin", 100, 100);
+            let second = write_spill_file(&srv, "b.bin", 100, 200);
+
+            enforce_spill_bound(base, 1000, &second);
+
+            assert!(first.exists());
+            assert!(second.exists());
+        });
+    }
+
+    #[test]
+    fn eviction_tolerates_already_removed_entries() {
+        with_spill_base(|base| {
+            let srv = base.join("srv");
+            fs::create_dir_all(&srv).unwrap();
+            let real = write_spill_file(&srv, "real.bin", 100, 200);
+            let entries = vec![
+                SpillEntry {
+                    path: srv.join("ghost.bin"),
+                    size: 100,
+                    modified: SystemTime::UNIX_EPOCH + Duration::from_secs(100),
+                },
+                SpillEntry {
+                    path: real.clone(),
+                    size: 100,
+                    modified: SystemTime::UNIX_EPOCH + Duration::from_secs(200),
+                },
+            ];
+
+            evict_oldest(entries, 50, &base.join("untouched"));
+
+            assert!(!real.exists());
+        });
+    }
+}