@agentxm/extension-lifecycle 0.28.4-bootstrap.0

package/dist/src/mcps/operations/install.js

@@ -0,0 +1,566 @@
+/**
+ * Install MCP server executor — orchestrates the per-server installation pipeline.
+ *
+ * Registry-only install: fetch archive, extract to canonical path, update lockfile/settings.
+ * Simpler than skills — no agent symlinks.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as Array from "effect/Array";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+import { CodingAgentRepository, McpSharedTargetConflict, applyProjectionPlansWithResults, planSingletonProjection, inspectAgentMcpServer, sharedMcpTargetPolicyConflict, } from "@agentxm/extension-workspace";
+import { isPathSafe } from "@agentxm/workspace-state";
+import { acceptedRegistryVersionForRef, validateExactResolvedVersion, } from "@agentxm/workspace-state";
+import { appendWarningsToMessage } from "@agentxm/workspace-operations";
+import { WorkspaceMutations } from "@agentxm/workspace-state";
+import { canReuseInstalledPackage } from "@agentxm/extension-workspace";
+import { materializeRegistryPackage } from "../../registry-materialization.js";
+import { computeExtensionPathsForLayout } from "@agentxm/workspace-state";
+import { printSourceParams } from "@agentxm/extension-model/unstable/sources/printer";
+import { computeMaterializedTreeIntegrity } from "@agentxm/workspace-state";
+import { decodeVersionSync } from "@agentxm/extension-model/unstable/version-constraints";
+import { MCP_SERVER_MANIFEST_FILENAME, McpServerManifestSchema, } from "@agentxm/extension-model/unstable/mcps/manifest-schema";
+import { isMcpServerApplicableToAgent } from "@agentxm/workspace-state";
+import { agentConfigTargets, mcpServerArtifact, mcpSettingsTarget, mcpSourceTarget, } from "./artifact.js";
+import { LifecycleFailureAdapter, withAdaptedStepFailures } from "../../failure-adapter.js";
+import { ExtensionLifecycleFailed } from "../../errors.js";
+// -----------------------------------------------------------------------------
+// Lock entry builder
+// -----------------------------------------------------------------------------
+const buildLockEntry = (ref, treeIntegrity) => ({
+    type: "registry",
+    sourceType: "registry",
+    packageFormat: "agentxm",
+    endpoint: ref.source.location,
+    extensionType: "mcp-server",
+    workspaceName: ref.server.name,
+    owner: ref.owner,
+    name: ref.name,
+    resolvedVersion: decodeVersionSync(ref.version),
+    integrity: Option.getOrElse(ref.integrity, () => ""),
+    sourceName: ref.source.name,
+    publisherBindingId: ref.publisherBindingId,
+    treeIntegrity,
+});
+const MCP_SECRET_SERVICE = "axm-mcp";
+const mcpSecretAccount = (serverName, inputName) => `${serverName}:${inputName}`;
+const keyringModuleSpecifier = ["@napi-rs", "keyring"].join("/");
+const loadKeyringEntry = Effect.tryPromise({
+    try: async () => {
+        const keyring = await import(__rewriteRelativeImportExtension(keyringModuleSpecifier));
+        return keyring.Entry;
+    },
+    catch: () => undefined,
+});
+const saveMcpSecret = (serverName, inputName, value) => Effect.gen(function* () {
+    const Entry = yield* loadKeyringEntry;
+    return yield* Effect.try({
+        try: () => {
+            const entry = new Entry(MCP_SECRET_SERVICE, mcpSecretAccount(serverName, inputName));
+            entry.setPassword(value);
+            return { _tag: "saved", inputName };
+        },
+        catch: () => undefined,
+    });
+}).pipe(Effect.catch(() => Effect.succeed({ _tag: "failed", inputName })));
+const loadMcpSecret = (serverName, inputName) => Effect.gen(function* () {
+    const Entry = yield* loadKeyringEntry;
+    return yield* Effect.try({
+        try: () => {
+            const entry = new Entry(MCP_SECRET_SERVICE, mcpSecretAccount(serverName, inputName));
+            return Option.fromNullOr(entry.getPassword());
+        },
+        catch: () => undefined,
+    }).pipe(Effect.catch(() => Effect.succeed(Option.none())));
+}).pipe(Effect.catch(() => Effect.succeed(Option.none())));
+const maybeSecretInputName = (input) => {
+    if (input.isSecret !== true)
+        return undefined;
+    if ("name" in input)
+        return input.name;
+    if ("valueHint" in input)
+        return input.valueHint;
+    return undefined;
+};
+/**
+ * Named environment inputs the manifest marks required. Only key/value inputs
+ * are collected: an unnamed input has nothing a caller could pass through
+ * `--env KEY=VALUE`, so it cannot be reported as a missing name.
+ */
+const collectRequiredInputNames = (manifest) => {
+    const names = new Set();
+    const add = (input) => {
+        if (input.isRequired === true && input.value === undefined && input.default === undefined) {
+            names.add(input.name);
+        }
+    };
+    for (const pkg of manifest.server.packages ?? []) {
+        for (const input of pkg.environmentVariables ?? [])
+            add(input);
+    }
+    for (const remote of manifest.server.remotes ?? []) {
+        for (const input of remote.headers ?? [])
+            add(input);
+    }
+    return names;
+};
+const collectSecretInputNames = (manifest) => {
+    const names = new Set();
+    const add = (input) => {
+        const name = maybeSecretInputName(input);
+        if (name !== undefined)
+            names.add(name);
+    };
+    for (const pkg of manifest.server.packages ?? []) {
+        for (const input of pkg.environmentVariables ?? [])
+            add(input);
+        for (const input of pkg.runtimeArguments ?? [])
+            add(input);
+        for (const input of pkg.packageArguments ?? [])
+            add(input);
+    }
+    for (const remote of manifest.server.remotes ?? []) {
+        for (const input of remote.headers ?? [])
+            add(input);
+        for (const [name, input] of Object.entries(remote.variables ?? {})) {
+            if (input.isSecret === true)
+                names.add(name);
+        }
+    }
+    return names;
+};
+// -----------------------------------------------------------------------------
+// Registry install
+// -----------------------------------------------------------------------------
+const installFromRegistry = (ref, reuse) => Effect.gen(function* () {
+    const path = yield* Path.Path;
+    const ws = yield* WorkspaceMutations;
+    const canonicalPath = computeExtensionPathsForLayout(path.join, ws.layout, ref, "mcps", ref.name).canonicalPath;
+    if (!isPathSafe(path, ws.baseDir, canonicalPath)) {
+        return yield* new ExtensionLifecycleFailed({
+            category: "internal",
+            detail: `Path traversal detected: ${canonicalPath}`,
+        });
+    }
+    const useExisting = yield* canReuseInstalledPackage({
+        installedPath: canonicalPath,
+        force: reuse.force,
+        refVersion: ref.version,
+        hasIntegrity: Option.isSome(ref.integrity),
+        ...(reuse.lockedVersion === undefined ? {} : { lockedVersion: reuse.lockedVersion }),
+        existsFailureDetail: (target) => `Failed to check if canonical path exists: ${target}`,
+    });
+    if (!useExisting) {
+        yield* materializeRegistryPackage({
+            baseDir: ws.baseDir,
+            destinationPath: canonicalPath,
+            sourceLocation: ref.source.location,
+            owner: ref.owner,
+            type: "mcp-server",
+            name: ref.name,
+            version: ref.version,
+            integrity: ref.integrity,
+            messages: {
+                integrityMismatchDetail: `Integrity mismatch for ${ref.name}@${ref.version}`,
+            },
+        });
+    }
+    return canonicalPath;
+});
+const readManifest = (canonicalPath) => Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const manifestPath = path.join(canonicalPath, MCP_SERVER_MANIFEST_FILENAME);
+    const exists = yield* fs.exists(manifestPath).pipe(Effect.catch(() => Effect.succeed(false)));
+    if (!exists) {
+        return Option.none();
+    }
+    const manifest = yield* fs.readFileString(manifestPath).pipe(Effect.flatMap((raw) => Effect.try({
+        try: () => {
+            const parsed = JSON.parse(raw);
+            return Schema.decodeUnknownSync(McpServerManifestSchema)(parsed);
+        },
+        catch: () => undefined,
+    })), Effect.catch(() => Effect.void));
+    if (manifest === undefined) {
+        return Option.none();
+    }
+    return Option.some(manifest);
+});
+const isNothingRunnableManifest = (manifest) => Option.match(manifest, {
+    onNone: () => false,
+    onSome: (value) => (value.server.packages === undefined || value.server.packages.length === 0) &&
+        (value.server.remotes === undefined || value.server.remotes.length === 0),
+});
+const loadStoredMcpSecrets = (serverName, secretNames) => Effect.gen(function* () {
+    const entries = yield* Effect.forEach(secretNames, (name) => loadMcpSecret(serverName, name).pipe(Effect.map((value) => ({ name, value }))), { concurrency: "unbounded" });
+    const loaded = {};
+    for (const { name, value } of entries) {
+        if (Option.isSome(value))
+            loaded[name] = value.value;
+    }
+    return loaded;
+});
+const persistMcpSecrets = (serverName, secretNames, values) => Effect.forEach(secretNames, (name) => {
+    const value = values[name];
+    return value === undefined
+        ? Effect.succeed({ _tag: "skipped", inputName: name })
+        : saveMcpSecret(serverName, name, value);
+}, { concurrency: "unbounded" });
+const redactSettingsEnv = (values, secretNames) => {
+    const redacted = {};
+    for (const [name, value] of Object.entries(values)) {
+        if (!secretNames.has(name))
+            redacted[name] = value;
+    }
+    return redacted;
+};
+const preserveSecretReferences = (values, secretNames) => Object.fromEntries(Object.entries(values).map(([name, value]) => [
+    name,
+    secretNames.has(name) ? `\${${name}}` : value,
+]));
+const REQUIRED_AGENT_IDS = new Set([
+    "claude-code",
+    "opencode",
+    "github-copilot-cli",
+    "cursor",
+    "gemini-cli",
+    "codex",
+]);
+const formatAgentSyncWarning = (serverName, outcomes) => {
+    const warningMessage = outcomes
+        .map(({ agentId, outcome }) => outcome._tag === "success"
+        ? `${agentId}:success`
+        : outcome._tag === "fallback"
+            ? `${agentId}:fallback(${outcome.fallbackFrom}):${outcome.reason}`
+            : `${agentId}:${outcome.reason}`)
+        .join(", ");
+    return `MCP agent sync warnings for ${serverName}: ${warningMessage}`;
+};
+const summarizeAgentSync = (outcomes, warnings) => {
+    const degraded = outcomes.some(({ outcome }) => outcome._tag === "failed" || outcome._tag === "fallback");
+    const details = outcomes.map(({ agentId, outcome }) => outcome._tag === "success"
+        ? `${agentId}:success`
+        : outcome._tag === "fallback"
+            ? `${agentId}:fallback:${outcome.fallbackFrom}`
+            : `${agentId}:${outcome._tag}`);
+    return {
+        status: degraded ? "degraded" : "green",
+        details,
+        warnings,
+        outcomes,
+    };
+};
+const syncConfiguredAgentsOnInstall = (args) => Effect.gen(function* () {
+    const agentRepo = yield* CodingAgentRepository;
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const warnings = [];
+    const unknownConfiguredAgentIds = yield* agentRepo.getUnknownConfiguredAgentIds();
+    if (args.strict && unknownConfiguredAgentIds.length > 0) {
+        const message = `Unknown configured agents in strict mode: ${unknownConfiguredAgentIds.join(", ")}`;
+        return yield* new ExtensionLifecycleFailed({
+            category: "not_found",
+            detail: message,
+        });
+    }
+    if (unknownConfiguredAgentIds.length > 0) {
+        warnings.push(`Skipping unknown configured agents: ${unknownConfiguredAgentIds.join(", ")}`);
+    }
+    const configuredAgents = yield* agentRepo.getConfiguredAgents();
+    const sharedTargetConflict = sharedMcpTargetPolicyConflict({
+        entry: args.entry,
+        agentIds: configuredAgents.map((agent) => agent.id),
+        scope: args.scope,
+    });
+    if (sharedTargetConflict !== undefined) {
+        return yield* new ExtensionLifecycleFailed({
+            category: "conflict",
+            detail: sharedTargetConflict,
+        });
+    }
+    let outcomes;
+    if (args.nothingRunnable) {
+        outcomes = configuredAgents.map((agent) => ({
+            agentId: agent.id,
+            outcome: {
+                _tag: "nothing-runnable",
+                reason: "manifest server has no packages or remotes",
+            },
+        }));
+    }
+    else {
+        outcomes = yield* applyProjectionPlansWithResults(configuredAgents.map((agent) => planSingletonProjection({
+            unitId: "mcp-server:native-config-entry",
+            targetFile: "mcp:configured-agents",
+            contributor: args,
+            adapter: {
+                observe: () => Effect.succeed({
+                    unitId: "mcp-server:native-config-entry",
+                    path: `${agent.id}:${args.serverName}`,
+                    present: false,
+                    current: false,
+                    expectedContributors: [args.serverName],
+                    observedContributors: [],
+                }),
+                apply: () => Effect.gen(function* () {
+                    if (!isMcpServerApplicableToAgent(args.entry, agent.id)) {
+                        const inspection = yield* inspectAgentMcpServer({
+                            workspaceRoot: args.wsBaseDir,
+                            scope: args.scope,
+                            agentId: agent.id,
+                            serverName: args.serverName,
+                            entry: args.entry,
+                        });
+                        if (inspection.status === "unmanaged") {
+                            return yield* new McpSharedTargetConflict({
+                                reason: `${agent.id} has an unmanaged MCP server named ${args.serverName}; AXM will not remove it while applying the target policy`,
+                            });
+                        }
+                        const outcome = inspection.status === "drift"
+                            ? yield* agent.removeMcpServer({
+                                workspaceRoot: args.wsBaseDir,
+                                scope: args.scope,
+                                serverName: args.serverName,
+                            })
+                            : { _tag: "success", targets: [] };
+                        return { agentId: agent.id, outcome };
+                    }
+                    const outcome = yield* agent.addMcpServer({
+                        workspaceRoot: args.wsBaseDir,
+                        scope: args.scope,
+                        serverName: args.serverName,
+                        canonicalPath: args.canonicalPath,
+                        owner: args.owner,
+                        resolvedVersion: args.resolvedVersion,
+                        enabled: args.enabled,
+                        configValues: args.configValues,
+                    });
+                    return { agentId: agent.id, outcome };
+                }).pipe(Effect.provideService(FileSystem.FileSystem, fs), Effect.provideService(Path.Path, path)),
+            },
+        })));
+    }
+    const misconfigured = Array.filter(outcomes, ({ outcome }) => outcome._tag === "misconfigured");
+    if (misconfigured.length > 0) {
+        return yield* new ExtensionLifecycleFailed({
+            category: "internal",
+            detail: `MCP server ${args.serverName} could not be synced to configured agents`,
+        });
+    }
+    const failed = Array.filter(outcomes, ({ outcome }) => outcome._tag === "failed");
+    if (args.strict && failed.length > 0) {
+        return yield* new ExtensionLifecycleFailed({
+            category: "internal",
+            detail: `MCP server ${args.serverName} sync failed in strict mode`,
+        });
+    }
+    const strictDisabledFailures = Array.filter(outcomes, ({ agentId, outcome }) => (outcome._tag === "disabled" ||
+        (outcome._tag === "fallback" && outcome.fallbackFrom === "disabled")) &&
+        args.strict &&
+        REQUIRED_AGENT_IDS.has(agentId));
+    if (strictDisabledFailures.length > 0) {
+        return yield* new ExtensionLifecycleFailed({
+            category: "internal",
+            detail: `MCP server ${args.serverName} sync disabled for required configured agents`,
+        });
+    }
+    const warningOutcomes = Array.filter(outcomes, ({ outcome }) => outcome._tag === "unsupported" ||
+        outcome._tag === "disabled" ||
+        outcome._tag === "nothing-runnable" ||
+        outcome._tag === "needs-input" ||
+        outcome._tag === "failed" ||
+        outcome._tag === "fallback");
+    if (warningOutcomes.length > 0) {
+        warnings.push(formatAgentSyncWarning(args.serverName, warningOutcomes));
+    }
+    return summarizeAgentSync(outcomes, warnings);
+});
+// -----------------------------------------------------------------------------
+// Public API
+// -----------------------------------------------------------------------------
+/**
+ * Install-mcp-server operation handler.
+ *
+ * Registry-only: fetch archive, validate integrity, extract to canonical path,
+ * then update lockfile/settings.
+ */
+export const installMcpServer = (op) => Effect.gen(function* () {
+    const adapter = yield* LifecycleFailureAdapter;
+    const ws = yield* WorkspaceMutations;
+    const { ref } = op.args;
+    if (ref.refType !== "registry" && ref.refType !== "workspace") {
+        return yield* new ExtensionLifecycleFailed({
+            category: "usage",
+            detail: `MCP servers install from a registry or a workspace package, not from a ${ref.refType} source`,
+            suggestions: [
+                {
+                    description: "Install from the registry",
+                    cmd: `axm mcps install @owner/mcps/${ref.server.name}`,
+                },
+            ],
+        });
+    }
+    const strictAgentSync = Option.getOrElse(op.args.strictAgentSync ?? Option.none(), () => false);
+    const env = Option.getOrElse(op.args.env ?? Option.none(), () => ({}));
+    const lockedVersion = ref.refType === "registry"
+        ? acceptedRegistryVersionForRef(yield* ws.getLockedMcpServer(ref.server.name), ref)
+        : undefined;
+    const canonicalPath = ref.refType === "registry"
+        ? yield* installFromRegistry(ref, { force: op.args.force, lockedVersion })
+        : yield* Effect.gen(function* () {
+            const fs = yield* FileSystem.FileSystem;
+            const path = yield* Path.Path;
+            const expectedPath = path.join(ws.layout.scope === "project"
+                ? ws.layout.authoredRoot("mcp-server")
+                : path.join(ws.layout.acquiredRoot, ref.owner, "mcps"), ref.name);
+            if (ref.scope !== ws.scope ||
+                path.resolve(ref.location) !== path.resolve(expectedPath)) {
+                return yield* new ExtensionLifecycleFailed({
+                    category: "validation",
+                    detail: `Invalid workspace MCP server source location: ${ref.location}`,
+                });
+            }
+            const exists = yield* fs.exists(ref.location).pipe(Effect.mapError((error) => new ExtensionLifecycleFailed({
+                category: "internal",
+                detail: `Failed to inspect workspace MCP server package: ${ref.location}`,
+                cause: error,
+            })));
+            if (!exists) {
+                return yield* new ExtensionLifecycleFailed({
+                    category: "validation",
+                    detail: `Workspace MCP server package is missing: ${ref.location}`,
+                });
+            }
+            return ref.location;
+        });
+    const manifest = yield* readManifest(canonicalPath);
+    const nothingRunnable = isNothingRunnableManifest(manifest);
+    const secretNames = Option.match(manifest, {
+        onNone: () => new Set(),
+        onSome: collectSecretInputNames,
+    });
+    if (ref.refType === "registry") {
+        yield* validateExactResolvedVersion(`mcpServers.${ref.server.name}.resolvedVersion`, ref.version);
+    }
+    const lockEntry = ref.refType === "registry"
+        ? buildLockEntry(ref, yield* computeMaterializedTreeIntegrity(canonicalPath))
+        : undefined;
+    const currentMcpServers = yield* ws.getConfiguredMcpServerEntries();
+    const currentEntry = currentMcpServers[ref.server.name];
+    const storedSecrets = yield* loadStoredMcpSecrets(ref.server.name, secretNames);
+    const mergedEnv = { ...storedSecrets, ...(currentEntry?.env ?? {}), ...env };
+    // Under --non-interactive there is nobody to prompt, so a required input
+    // that nothing supplied would otherwise install a server that cannot start.
+    // Fail with the exact recipe instead.
+    const requiredInputNames = Option.match(manifest, {
+        onNone: () => new Set(),
+        onSome: collectRequiredInputNames,
+    });
+    const missingInputs = [...requiredInputNames]
+        .filter((name) => mergedEnv[name] === undefined || mergedEnv[name] === "")
+        .sort((left, right) => left.localeCompare(right));
+    if (missingInputs.length > 0 && op.args.nonInteractive) {
+        return yield* new ExtensionLifecycleFailed({
+            category: "usage",
+            detail: `${ref.server.name} needs ${missingInputs.join(", ")}, and --non-interactive cannot prompt for them`,
+            suggestions: [
+                {
+                    description: "Supply each required input on the command line",
+                    cmd: missingInputs.map((name) => `--env ${name}=<value>`).join(" "),
+                },
+            ],
+        });
+    }
+    const persistedEnv = redactSettingsEnv(mergedEnv, secretNames);
+    const enabled = currentEntry?.enabled ?? true;
+    const agents = op.args.agents ?? currentEntry?.agents;
+    const settingsEntry = {
+        kind: "sourced",
+        source: ref.refType === "workspace" ? "workspace" : printSourceParams(ref.source),
+        env: persistedEnv,
+        enabled,
+        ...(agents === undefined ? {} : { agents }),
+    };
+    const agentSync = yield* syncConfiguredAgentsOnInstall({
+        wsBaseDir: ws.baseDir,
+        scope: ws.scope,
+        strict: strictAgentSync,
+        serverName: ref.server.name,
+        canonicalPath,
+        owner: ref.owner,
+        resolvedVersion: ref.version,
+        nothingRunnable,
+        enabled,
+        configValues: preserveSecretReferences(mergedEnv, secretNames),
+        entry: settingsEntry,
+    });
+    const secretPersistence = yield* persistMcpSecrets(ref.server.name, secretNames, mergedEnv);
+    const secretWarnings = secretPersistence.flatMap((outcome) => outcome._tag === "failed"
+        ? [`${outcome.inputName} could not be saved to the system keychain`]
+        : []);
+    const writeEffect = op.args.skipStateWrites === true
+        ? Effect.void
+        : Option.getOrElse(op.args.skipSettings, () => false)
+            ? lockEntry === undefined
+                ? Effect.void
+                : ws.setMcpServerLock({
+                    name: ref.server.name,
+                    lockEntry,
+                    versionRange: Option.none(),
+                })
+            : lockEntry === undefined
+                ? ws.setMcpServerEntry(ref.server.name, {
+                    ...settingsEntry,
+                })
+                : ws.setMcpServer({
+                    name: ref.server.name,
+                    lockEntry,
+                    versionRange: op.args.versionRange,
+                    env: persistedEnv,
+                    enabled,
+                    ...(agents === undefined ? {} : { agents }),
+                });
+    const writeWarning = yield* writeEffect.pipe(Effect.as(Option.none()), Effect.catch((e) => Effect.succeed(Option.some(`MCP server update failed: ${adapter.describeFailure(e)}`))));
+    const warnings = Option.match(writeWarning, {
+        onNone: () => [...secretWarnings, ...agentSync.warnings],
+        onSome: (warning) => [warning, ...secretWarnings, ...agentSync.warnings],
+    });
+    const change = currentEntry === undefined ? "created" : "updated";
+    const agentOutcomes = agentSync.outcomes.flatMap(({ agentId, outcome }) => outcome._tag === "success" || outcome._tag === "fallback"
+        ? [
+            {
+                agentId,
+                ...(outcome.targets === undefined ? {} : { targets: outcome.targets }),
+            },
+        ]
+        : []);
+    return {
+        result: "success",
+        message: appendWarningsToMessage(`Installed ${ref.server.name} (canonical=success, agent-sync=${agentSync.status})`, warnings),
+        artifact: mcpServerArtifact({
+            lockEntry,
+            scope: ws.scope,
+            change,
+            agents: agentOutcomes.map(({ agentId }) => agentId),
+            targets: [
+                ...(lockEntry === undefined ? [] : [mcpSourceTarget(ws.scope, lockEntry, change)]),
+                mcpSettingsTarget(ws.scope, change),
+                ...agentConfigTargets(agentOutcomes),
+            ],
+        }),
+    };
+}).pipe(withAdaptedStepFailures);
+//# sourceMappingURL=install.js.map

package/dist/src/mcps/operations/sync-outcome.d.ts

@@ -0,0 +1,10 @@
+import * as Effect from "effect/Effect";
+import type { McpServerSyncOutcome } from "@agentxm/extension-workspace";
+import { ExtensionLifecycleFailed } from "../../errors.js";
+export interface AgentMcpSyncOutcome {
+    readonly agentId: string;
+    readonly outcome: McpServerSyncOutcome;
+}
+export declare const requireSuccessfulMcpSync: (serverName: string, outcomes: ReadonlyArray<AgentMcpSyncOutcome>) => Effect.Effect<void, ExtensionLifecycleFailed>;
+export declare const mcpSyncWarnings: (serverName: string, outcomes: ReadonlyArray<AgentMcpSyncOutcome>) => ReadonlyArray<string>;
+//# sourceMappingURL=sync-outcome.d.ts.map

package/dist/src/mcps/operations/sync-outcome.js

@@ -0,0 +1,27 @@
+import * as Effect from "effect/Effect";
+import { ExtensionLifecycleFailed } from "../../errors.js";
+const outcomeSummary = ({ agentId, outcome }) => outcome._tag === "fallback"
+    ? `${agentId}: fallback(${outcome.fallbackFrom}):${outcome.reason}`
+    : outcome._tag === "success"
+        ? `${agentId}: success`
+        : `${agentId}: ${outcome.reason}`;
+export const requireSuccessfulMcpSync = (serverName, outcomes) => {
+    const failures = outcomes.filter(({ outcome }) => outcome._tag === "disabled" ||
+        outcome._tag === "nothing-runnable" ||
+        outcome._tag === "needs-input" ||
+        outcome._tag === "misconfigured" ||
+        outcome._tag === "failed");
+    if (failures.length === 0)
+        return Effect.void;
+    return new ExtensionLifecycleFailed({
+        category: "conflict",
+        detail: `MCP agent sync failed for ${serverName}: ${failures.map(outcomeSummary).join(", ")}`,
+    });
+};
+export const mcpSyncWarnings = (serverName, outcomes) => {
+    const warnings = outcomes.filter(({ outcome }) => outcome._tag === "fallback" || outcome._tag === "unsupported");
+    return warnings.length === 0
+        ? []
+        : [`MCP agent sync warnings for ${serverName}: ${warnings.map(outcomeSummary).join(", ")}`];
+};
+//# sourceMappingURL=sync-outcome.js.map

package/dist/src/mcps/operations/uninstall.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Uninstall MCP server executor — orchestrates per-server removal pipeline.
+ *
+ * Pipeline: resolve desired/observed state -> remove canonical source -> clear
+ * settings and accepted resolution.
+ * Simpler than skills — no agent symlinks.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { CodingAgentRepository } from "@agentxm/extension-workspace";
+import type { StepFailure } from "@agentxm/workspace-operations";
+import type { JobStepResult, Operation } from "@agentxm/workspace-operations";
+import { WorkspaceMutations } from "@agentxm/workspace-state";
+import { LifecycleFailureAdapter } from "../../failure-adapter.js";
+/**
+ * Args for the uninstall-mcp-server operation.
+ */
+export interface UninstallMcpServerOperationArgs {
+    readonly serverName: string;
+    /** When true, enforce strict policy for MCP sync outcomes. */
+    readonly strictAgentSync?: Option.Option<boolean>;
+}
+/**
+ * Remove an MCP server from the workspace.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export type UninstallMcpServerOperation = Operation<"uninstall-mcp-server", UninstallMcpServerOperationArgs>;
+/**
+ * Uninstall-mcp-server operation handler.
+ *
+ * 1. Resolve configured and observed state
+ * 2. Remove canonical directory from disk (if exists)
+ * 3. Remove settings and accepted resolution
+ */
+export declare const uninstallMcpServer: (op: UninstallMcpServerOperation) => Effect.Effect<JobStepResult, StepFailure, FileSystem.FileSystem | Path.Path | WorkspaceMutations | CodingAgentRepository | LifecycleFailureAdapter>;
+//# sourceMappingURL=uninstall.d.ts.map