@aipermission/mcp 0.2.37 → 0.2.39

package/dist/init.js

@@ -1,13 +1,25 @@
 import fs from "node:fs/promises";
 import { execFile } from "node:child_process";
 import { createRequire } from "node:module";
-import os from "node:os";
 import path from "node:path";
 import readline from "node:readline/promises";
 import { promisify } from "node:util";
 import { pathToFileURL } from "node:url";
 import { stdin as input, stdout as output } from "node:process";
+import { parse as parseTOML } from "smol-toml";
+import { parseCommandFlags } from "./cli-flags.js";
 import { DEFAULT_API_URL, normalizeLocalAPIURL } from "./local-url.js";
+import { adaptMCPServerConfig, getClient, MCP_PROVIDERS, resolveMCPConfigTarget, resolveMCPPrintTarget } from "./client-registry.js";
+import { commitSkillInstallation, prepareSkillInstallation } from "./install-skill.js";
+import {
+  atomicWritePrivateFile,
+  privateLockPath,
+  privateStagingIgnorePath,
+  privateStagingPath,
+  privateTemporaryIgnorePath,
+  privateTemporaryPath,
+  withPrivateFileLock,
+} from "./private-file.js";
 
 const require = createRequire(import.meta.url);
 const execFileAsync = promisify(execFile);
@@ -26,86 +38,70 @@ const color = {
   yellow: useColor ? "\x1b[33m" : "",
 };
 
-const providers = [
-  {
-    id: "codex",
-    label: "OpenAI Codex",
-    description: "Writes ~/.codex/config.toml",
-  },
-  {
-    id: "claude-code",
-    label: "Claude Code",
-    description: "Writes .mcp.json in the current project",
-  },
-  {
-    id: "cursor",
-    label: "Cursor",
-    description: "Writes .cursor/mcp.json in the current project",
-  },
-  {
-    id: "vscode",
-    label: "VS Code",
-    description: "Writes .vscode/mcp.json in the current project",
-  },
-  {
-    id: "windsurf",
-    label: "Windsurf",
-    description: "Writes ~/.codeium/windsurf/mcp_config.json",
-  },
-  {
-    id: "antigravity",
-    label: "Google Antigravity",
-    description: "Writes ~/.gemini/antigravity/mcp_config.json",
-  },
-  {
-    id: "gemini",
-    label: "Gemini CLI",
-    description: "Writes ~/.gemini/settings.json",
-  },
-  {
-    id: "custom",
-    label: "Custom / copy-paste",
-    description: "Prints config snippets only",
-  },
-];
-
 export async function runInit(argv = []) {
-  const flags = parseFlags(argv);
-  assertProviderSelectionAvailable(flags.provider, Boolean(input.isTTY && output.isTTY));
-  const stdinToken = flags.tokenStdin ? (await readStdin()).trim() : "";
+  return runConfiguration("init", argv);
+}
+
+export async function runSetup(argv = []) {
+  return runConfiguration("setup", argv);
+}
+
+async function runConfiguration(command, argv) {
+  const flags = parseCommandFlags(command, argv);
+  const interactive = Boolean(input.isTTY && output.isTTY);
+  assertProviderSelectionAvailable(flags.provider, interactive);
   const rl = readline.createInterface({ input, output });
   try {
     const provider = flags.provider
       ? findProvider(flags.provider)
-      : await selectProvider("Which AI client should use this token?", providers);
-    const name = sanitizeName(
-      flags.name || (await ask(rl, "MCP server name", "aipermission"))
-    );
+      : await selectProvider("Which AI client should use this token?", MCP_PROVIDERS);
+    const name = sanitizeName(flags.name || (interactive ? await ask(rl, "MCP server name", "aipermission") : "aipermission"));
     const apiUrl = normalizeURL(flags.apiUrl || DEFAULT_API_URL);
-    const token = await resolveToken({ ...flags, stdinToken }, rl);
+    const outputTarget =
+      provider.id === "custom"
+        ? undefined
+        : flags.print
+          ? resolveMCPPrintTarget(provider.id, flags.scope)
+          : resolveMCPConfigTarget(provider.id, flags.scope);
+    const shouldPrepareSkill = command === "setup" && (!flags.print || provider.id === "custom");
+    const preparedSkill = shouldPrepareSkill ? await prepareSetupSkill(provider.id, flags) : undefined;
+    if (provider.id === "custom" || flags.print) {
+      const skillResult = preparedSkill ? await reportInstalledSkill(preparedSkill) : undefined;
+      printPlaceholderConfigNotice();
+      printProviderConfig(name, provider.id, apiUrl, outputTarget);
+      if (command === "setup" && flags.print && provider.id !== "custom") {
+        console.error("No files were changed. Run install-skill separately to install the native operator skill.");
+      }
+      return { provider: provider.id, name, printed: true, skill: skillResult };
+    }
 
+    const stdinToken = flags.tokenStdin ? (await readStdin()).trim() : "";
+    const token = await resolveToken({ ...flags, stdinToken }, rl);
     if (!token) {
       throw new Error("API token is required.");
     }
-
-    const config = buildMCPServerConfig({ apiUrl, token });
-    if (provider.id === "custom" || flags.print) {
-      printTokenConfigWarning();
-      printCustomConfig(name, config);
-      return;
-    }
-
-    const result = await writeProviderConfig(provider.id, name, config, { force: Boolean(flags.force) });
+    const config = adaptMCPServerConfig(provider.id, buildMCPServerConfig({ apiUrl, token }));
+    const skillResult = preparedSkill ? await reportInstalledSkill(preparedSkill) : undefined;
+    const result = await writeProviderConfig(provider.id, name, config, {
+      force: Boolean(flags.force),
+      scope: flags.scope,
+      homeDir: flags.home,
+      projectDir: flags.projectDir,
+    });
     console.log("");
     console.log(`${color.green}Configured ${provider.label}${color.reset}`);
     console.log(`${color.dim}Name:${color.reset} ${name}`);
     console.log(`${color.dim}Path:${color.reset} ${result.path}`);
+    console.log(`${color.dim}Scope:${color.reset} ${result.scope}`);
     if (result.gitExcluded) {
       console.log(`${color.dim}Git:${color.reset} added ${result.gitExcludeEntry} to .git/info/exclude`);
     }
     console.log("");
-    console.log(`${color.yellow}Keep this config private:${color.reset} it contains an AIPermission bearer token. If it is committed, revoke the token.`);
+    console.log(
+      `${color.yellow}Keep this config private:${color.reset} it contains an AIPermission bearer token. If it is committed, revoke the token.`,
+    );
     console.log(`${color.yellow}Restart the AI client so it reloads MCP servers.${color.reset}`);
+    return { provider: provider.id, name, config: result, skill: skillResult };
   } finally {
     rl.close();
   }
@@ -118,46 +114,39 @@ export function assertProviderSelectionAvailable(provider, interactive) {
 }
 
 export function parseFlags(argv) {
-  const result = {};
-  for (let i = 0; i < argv.length; i += 1) {
-    const arg = argv[i];
-    if (!arg.startsWith("--")) {
-      continue;
-    }
-    const [rawKey, inlineValue] = arg.slice(2).split("=", 2);
-    const key = rawKey.replace(/-([a-z])/g, (_, letter) => letter.toUpperCase());
-    if (key === "print") {
-      result.print = true;
-      continue;
-    }
-    if (key === "force") {
-      result.force = true;
-      continue;
-    }
-    if (key === "tokenStdin") {
-      result.tokenStdin = true;
-      continue;
-    }
-    if (key === "token") {
-      throw new Error("--token is not supported; use the hidden prompt or --token-stdin");
-    }
-    result[key] = inlineValue ?? argv[i + 1] ?? "";
-    if (inlineValue === undefined) {
-      i += 1;
-    }
+  return parseCommandFlags("init", argv);
+}
+
+async function prepareSetupSkill(client, flags) {
+  return prepareSkillInstallation({
+    client,
+    scope: flags.skillScope || flags.scope,
+    source: flags.skillSource,
+    homeDir: flags.home,
+    projectDir: flags.projectDir,
+  });
+}
+
+async function reportInstalledSkill(prepared) {
+  const result = await commitSkillInstallation(prepared);
+  if (!result.path) {
+    console.log("");
+    console.log(result.content);
+    return result;
   }
+  console.log("");
+  console.log(`${color.green}Installed native operator skill${color.reset}`);
+  console.log(`${color.dim}Path:${color.reset} ${result.path}`);
+  console.log(`${color.dim}Scope:${color.reset} ${result.scope}`);
   return result;
 }
 
 function findProvider(idOrLabel) {
-  const normalized = String(idOrLabel).trim().toLowerCase();
-  const provider = providers.find(
-    (item) => item.id === normalized || item.label.toLowerCase() === normalized
-  );
-  if (!provider) {
+  try {
+    return getClient(idOrLabel);
+  } catch {
     throw new Error(`Unknown provider: ${idOrLabel}`);
   }
-  return provider;
 }
 
 async function selectProvider(title, items) {
@@ -175,18 +164,12 @@ async function selectProvider(title, items) {
       output.write(`\x1b[${renderedLines}A`);
       output.write("\x1b[J");
     }
-    const lines = [
-      `${color.bold}${color.cyan}${title}${color.reset}`,
-      `${color.dim}Use ↑/↓ and Enter.${color.reset}`,
-      "",
-    ];
+    const lines = [`${color.bold}${color.cyan}${title}${color.reset}`, `${color.dim}Use ↑/↓ and Enter.${color.reset}`, ""];
     for (let i = 0; i < items.length; i += 1) {
       const selected = i === index;
       const marker = selected ? `${color.green}›${color.reset}` : " ";
       const label = selected ? `${color.bold}${items[i].label}${color.reset}` : items[i].label;
-      lines.push(
-        `${marker} ${label} ${color.dim}- ${items[i].description}${color.reset}`
-      );
+      lines.push(`${marker} ${label} ${color.dim}- ${items[i].description}${color.reset}`);
     }
     output.write("\x1b[?25l");
     output.write(`${lines.join("\n")}\n`);
@@ -210,7 +193,7 @@ async function selectProvider(title, items) {
     };
     const onData = (buffer) => {
       const value = buffer.toString("utf8");
-      const keys = value.match(/\u001b\[[AB]|\r|\n|\u0003|./g) || [];
+      const keys = splitInputKeys(value);
       for (const key of keys) {
         if (key === "\u0003") {
           cleanup();
@@ -313,94 +296,113 @@ export function buildMCPServerConfig({ apiUrl, token }) {
 }
 
 export async function writeProviderConfig(providerID, name, config, options = {}) {
-  if (providerID === "codex") {
-    const filePath = path.join(os.homedir(), ".codex", "config.toml");
-    await writeCodexConfig(filePath, name, config);
-    return { path: filePath };
-  }
-  if (providerID === "claude-code") {
-    const filePath = path.join(process.cwd(), ".mcp.json");
-    await assertProjectConfigWritable(filePath, options);
-    await writeJSONMCPConfig(filePath, name, config, "mcpServers");
-    return { path: filePath, ...(await protectGitIgnoredConfig(filePath)) };
-  }
-  if (providerID === "cursor") {
-    const filePath = path.join(process.cwd(), ".cursor", "mcp.json");
-    await assertProjectConfigWritable(filePath, options);
-    await writeJSONMCPConfig(filePath, name, config, "mcpServers");
-    return { path: filePath, ...(await protectGitIgnoredConfig(filePath)) };
-  }
-  if (providerID === "vscode") {
-    const filePath = path.join(process.cwd(), ".vscode", "mcp.json");
-    await assertProjectConfigWritable(filePath, options);
-    await writeJSONMCPConfig(filePath, name, config, "servers");
-    return { path: filePath, ...(await protectGitIgnoredConfig(filePath)) };
-  }
-  if (providerID === "windsurf") {
-    const filePath = path.join(os.homedir(), ".codeium", "windsurf", "mcp_config.json");
-    await writeJSONMCPConfig(filePath, name, config, "mcpServers");
-    return { path: filePath };
-  }
-  if (providerID === "antigravity") {
-    const filePath = path.join(os.homedir(), ".gemini", "antigravity", "mcp_config.json");
-    await writeJSONMCPConfig(filePath, name, config, "mcpServers");
-    return { path: filePath };
-  }
-  if (providerID === "gemini") {
-    const filePath = path.join(os.homedir(), ".gemini", "settings.json");
-    await writeJSONMCPConfig(filePath, name, config, "mcpServers");
-    return { path: filePath };
-  }
-  throw new Error(`Unsupported provider: ${providerID}`);
-}
-
-export async function writeJSONMCPConfig(filePath, name, config, rootKey) {
-  await fs.mkdir(path.dirname(filePath), { recursive: true });
-  let root = {};
-  try {
-    root = JSON.parse(await fs.readFile(filePath, "utf8"));
-  } catch (error) {
-    if (error.code !== "ENOENT") {
-      throw new Error(`Could not read JSON config at ${filePath}: ${error.message}`);
-    }
+  const projectRoot = options.projectDir || process.cwd();
+  const target = resolveMCPConfigTarget(providerID, options.scope, {
+    homeDir: options.homeDir,
+    projectDir: projectRoot,
+    env: options.env,
+  });
+  const providerConfig = adaptMCPServerConfig(providerID, config);
+  let protection = {};
+  if (target.projectConfig) {
+    await assertProjectConfigWritable(target.path, options);
+    protection = await protectGitIgnoredConfig(target.path, projectRoot, { allowTracked: Boolean(options.force) });
   }
-  if (!root || typeof root !== "object" || Array.isArray(root)) {
-    root = {};
+  const trustedRoot = target.trustedRoot;
+  const writeOptions = {
+    trustedRoot,
+    beforeWrite: target.projectConfig
+      ? async () => {
+          await assertProjectConfigWritable(target.path, options);
+          await options.beforeWrite?.();
+          await assertProjectConfigWritable(target.path, options);
+        }
+      : options.beforeWrite,
+  };
+  if (target.format === "toml") {
+    await writeTOMLMCPConfig(target.path, name, providerConfig, writeOptions);
+  } else {
+    await writeJSONMCPConfig(target.path, name, providerConfig, target.rootKey, writeOptions);
   }
-  root[rootKey] =
-    root[rootKey] && typeof root[rootKey] === "object" && !Array.isArray(root[rootKey])
-      ? root[rootKey]
-      : {};
-  root[rootKey][name] = config;
-  await writePrivateFile(filePath, `${JSON.stringify(root, null, 2)}\n`);
+  return { path: target.path, scope: target.scope, ...protection };
 }
 
-async function writeCodexConfig(filePath, name, config) {
-  await fs.mkdir(path.dirname(filePath), { recursive: true });
-  let current = "";
-  try {
-    current = await fs.readFile(filePath, "utf8");
-  } catch (error) {
-    if (error.code !== "ENOENT") {
-      throw error;
+export async function writeJSONMCPConfig(filePath, name, config, rootKey, options = {}) {
+  await withPrivateFileLock(
+    filePath,
+    async () => {
+      await options.beforeWrite?.();
+      let root = {};
+      try {
+        root = JSON.parse(await fs.readFile(filePath, "utf8"));
+      } catch (error) {
+        if (error.code !== "ENOENT") {
+          redactParseError(error);
+          throw new Error(`Could not parse JSON config at ${filePath}; the existing file was left unchanged`, {
+            cause: error,
+          });
+        }
+      }
+      if (!root || typeof root !== "object" || Array.isArray(root)) root = {};
+      const currentServers = root[rootKey];
+      const servers =
+        currentServers && typeof currentServers === "object" && !Array.isArray(currentServers)
+          ? { ...currentServers }
+          : Object.create(null);
+      Object.defineProperty(servers, name, { value: config, enumerable: true, configurable: true, writable: true });
+      root[rootKey] = servers;
+      await options.beforeWrite?.();
+      await writePrivateFile(filePath, `${JSON.stringify(root, null, 2)}\n`, options);
+    },
+    options,
+  );
+}
+
+function splitInputKeys(value) {
+  const keys = [];
+  for (let index = 0; index < value.length; index += 1) {
+    const sequence = value.slice(index, index + 3);
+    if (sequence === "\u001b[A" || sequence === "\u001b[B") {
+      keys.push(sequence);
+      index += 2;
+      continue;
     }
+    keys.push(value[index]);
   }
+  return keys;
+}
 
-  const next = removeCodexServer(current, name).trimEnd();
-  const block = codexServerBlock(name, config);
-  await writePrivateFile(filePath, `${next ? `${next}\n\n` : ""}${block}\n`);
+export async function writeTOMLMCPConfig(filePath, name, config, options = {}) {
+  await withPrivateFileLock(
+    filePath,
+    async () => {
+      await options.beforeWrite?.();
+      let current = "";
+      try {
+        current = await fs.readFile(filePath, "utf8");
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+      const next = removeTOMLServer(current, name).trimEnd();
+      const block = tomlServerBlock(name, config);
+      const outputContent = `${next ? `${next}\n\n` : ""}${block}\n`;
+      parseTOMLDocument(outputContent, filePath);
+      await options.beforeWrite?.();
+      await writePrivateFile(filePath, outputContent, options);
+    },
+    options,
+  );
 }
 
-async function writePrivateFile(filePath, contents) {
-  await fs.writeFile(filePath, contents, { mode: 0o600 });
-  await fs.chmod(filePath, 0o600);
+async function writePrivateFile(filePath, contents, options = {}) {
+  await atomicWritePrivateFile(filePath, contents, options);
 }
 
 async function assertProjectConfigWritable(filePath, options = {}) {
   if (options.force) {
     return;
   }
-  const tracked = await gitTrackedPath(filePath);
+  const tracked = await gitTrackedPath(filePath, options.projectDir || process.cwd());
   if (!tracked) {
     return;
   }
@@ -408,12 +410,12 @@ async function assertProjectConfigWritable(filePath, options = {}) {
     [
       `Refusing to write AIPERMISSION_API_TOKEN into tracked git file: ${tracked}`,
       "Use --print to copy the config manually, untrack/ignore that file, or rerun with --force if you intentionally accept commit risk.",
-    ].join("\n")
+    ].join("\n"),
   );
 }
 
-async function protectGitIgnoredConfig(filePath) {
-  const repository = await discoverGitRepository(process.cwd());
+async function protectGitIgnoredConfig(filePath, startDir = process.cwd(), options = {}) {
+  const repository = await discoverGitRepository(startDir);
   if (!repository) {
     return {};
   }
@@ -421,30 +423,72 @@ async function protectGitIgnoredConfig(filePath) {
   if (relativePath.startsWith("../") || path.isAbsolute(relativePath)) {
     return {};
   }
-  const excludePath = path.join(repository.gitDir, "info", "exclude");
-  let current = "";
+  const excludePath = repository.excludePath;
+  const temporaryRelativePath = path.relative(repository.workTree, privateTemporaryIgnorePath(filePath)).split(path.sep).join("/");
+  const stagingRelativePath = path.relative(repository.workTree, privateStagingIgnorePath(filePath)).split(path.sep).join("/");
+  const lockRelativePath = path.relative(repository.workTree, privateLockPath(filePath)).split(path.sep).join("/");
+  const ignoreEntries = [
+    gitIgnoreLiteral(relativePath),
+    gitIgnoreWildcardPath(temporaryRelativePath),
+    gitIgnoreWildcardPath(stagingRelativePath),
+    gitIgnoreLiteral(lockRelativePath),
+  ];
   try {
-    current = await fs.readFile(excludePath, "utf8");
+    await withPrivateFileLock(
+      excludePath,
+      async () => {
+        let current = "";
+        try {
+          current = await fs.readFile(excludePath, "utf8");
+        } catch (error) {
+          if (error.code !== "ENOENT") throw error;
+        }
+        const entries = new Set(current.split(/\r?\n/));
+        const missingEntries = ignoreEntries.filter((entry) => !entries.has(entry));
+        if (missingEntries.length === 0) return;
+        const prefix = current && !current.endsWith("\n") ? "\n" : "";
+        await atomicWritePrivateFile(excludePath, `${current}${prefix}${missingEntries.join("\n")}\n`, {
+          trustedRoot: path.dirname(excludePath),
+        });
+      },
+      { trustedRoot: path.dirname(excludePath) },
+    );
+    await assertGitIgnored(repository, [
+      ...(options.allowTracked ? [] : [relativePath]),
+      privateTemporaryCheckPath(filePath, repository.workTree),
+      privateStagingCheckPath(filePath, repository.workTree),
+      lockRelativePath,
+    ]);
   } catch (error) {
-    if (error.code !== "ENOENT") {
-      return {};
-    }
+    throw new Error(`Could not protect MCP config with local Git excludes: ${error.message}`, { cause: error });
   }
-  const entries = current.split(/\r?\n/).map((line) => line.trim());
-  if (!entries.includes(relativePath)) {
-    const prefix = current && !current.endsWith("\n") ? "\n" : "";
-    try {
-      await fs.mkdir(path.dirname(excludePath), { recursive: true });
-      await fs.appendFile(excludePath, `${prefix}${relativePath}\n`, { mode: 0o600 });
-    } catch {
-      return {};
-    }
-  }
-  return { gitExcluded: true, gitExcludeEntry: relativePath };
+  return {
+    gitExcluded: true,
+    gitExcludeEntry: relativePath,
+    gitExcludeTemporaryEntry: temporaryRelativePath,
+    gitExcludeStagingEntry: stagingRelativePath,
+    gitExcludeLockEntry: lockRelativePath,
+  };
 }
 
-async function gitTrackedPath(filePath) {
-  const repository = await discoverGitRepository(process.cwd());
+export async function inspectProjectConfigProtection(filePath, startDir = process.cwd()) {
+  const repository = await discoverGitRepository(startDir);
+  if (!repository) return { repository: false };
+  const relativePath = path.relative(repository.workTree, filePath).split(path.sep).join("/");
+  if (relativePath.startsWith("../") || path.isAbsolute(relativePath)) return { repository: false };
+  const tracked = await gitTrackedPath(filePath, startDir);
+  if (tracked) throw new Error(`MCP config is tracked by Git: ${tracked}`);
+  await assertGitIgnored(repository, [
+    relativePath,
+    privateTemporaryCheckPath(filePath, repository.workTree),
+    privateStagingCheckPath(filePath, repository.workTree),
+    path.relative(repository.workTree, privateLockPath(filePath)).split(path.sep).join("/"),
+  ]);
+  return { repository: true, relativePath };
+}
+
+async function gitTrackedPath(filePath, startDir = process.cwd()) {
+  const repository = await discoverGitRepository(startDir);
   if (!repository) {
     return "";
   }
@@ -453,44 +497,108 @@ async function gitTrackedPath(filePath) {
     return "";
   }
   try {
-    await execFileAsync("git", ["-C", repository.workTree, "ls-files", "--error-unmatch", "--", relativePath], { windowsHide: true });
+    await execFileAsync("git", ["-C", repository.workTree, "ls-files", "--error-unmatch", "--", relativePath], {
+      windowsHide: true,
+    });
     return relativePath;
-  } catch {
-    return "";
+  } catch (error) {
+    if (error.code === 1) return "";
+    throw new Error(`Could not verify whether MCP config is tracked by Git: ${gitErrorMessage(error)}`, { cause: error });
   }
 }
 
 async function discoverGitRepository(startDir) {
   try {
-    const { stdout } = await execFileAsync(
-      "git",
-      ["-C", path.resolve(startDir), "rev-parse", "--show-toplevel", "--absolute-git-dir"],
-      { encoding: "utf8", windowsHide: true }
-    );
+    const { stdout } = await execFileAsync("git", ["-C", path.resolve(startDir), "rev-parse", "--show-toplevel", "--absolute-git-dir"], {
+      encoding: "utf8",
+      windowsHide: true,
+    });
     const [workTree, gitDir] = stdout.trim().split(/\r?\n/);
     if (!workTree || !gitDir) {
       return null;
     }
-    return { workTree: path.resolve(workTree), gitDir: path.resolve(gitDir) };
-  } catch {
-    return null;
+    const { stdout: excludeOutput } = await execFileAsync(
+      "git",
+      ["-C", path.resolve(startDir), "rev-parse", "--path-format=absolute", "--git-path", "info/exclude"],
+      { encoding: "utf8", windowsHide: true },
+    );
+    const excludePath = excludeOutput.trim();
+    if (!excludePath) throw new Error("Git did not return an exclude path");
+    return { workTree: path.resolve(workTree), gitDir: path.resolve(gitDir), excludePath: path.resolve(excludePath) };
+  } catch (error) {
+    if (/not a git repository/i.test(`${error.stderr || ""}\n${error.message || ""}`)) return null;
+    throw new Error(`Could not inspect Git repository: ${gitErrorMessage(error)}`, { cause: error });
+  }
+}
+
+async function assertGitIgnored(repository, relativePaths) {
+  for (const relativePath of relativePaths) {
+    try {
+      await execFileAsync("git", ["-C", repository.workTree, "check-ignore", "-q", "--", relativePath], {
+        windowsHide: true,
+      });
+    } catch (error) {
+      if (error.code === 1) {
+        throw new Error(`Git still permits sensitive MCP path: ${relativePath}`, { cause: error });
+      }
+      throw new Error(`Could not verify local Git exclusion: ${gitErrorMessage(error)}`, { cause: error });
+    }
   }
 }
 
-function removeCodexServer(source, name) {
-  const main = `[mcp_servers.${tomlKey(name)}]`;
-  const env = `[mcp_servers.${tomlKey(name)}.env]`;
+function privateTemporaryCheckPath(filePath, workTree) {
+  return path.relative(workTree, privateTemporaryPath(filePath, "git-check")).split(path.sep).join("/");
+}
+
+function privateStagingCheckPath(filePath, workTree) {
+  return path.relative(workTree, privateStagingPath(filePath, "git-check")).split(path.sep).join("/");
+}
+
+function escapeGitIgnoreFragment(value) {
+  let result = "";
+  for (const character of value) {
+    result += ["\\", "*", "?", "[", "]", "#", "!", " "].includes(character) ? `\\${character}` : character;
+  }
+  return result;
+}
+
+function gitIgnoreLiteral(relativePath) {
+  return `/${escapeGitIgnoreFragment(relativePath)}`;
+}
+
+function gitIgnoreWildcardPath(relativePath) {
+  const wildcardIndex = relativePath.lastIndexOf("*");
+  if (wildcardIndex < 0) throw new Error(`Git ignore wildcard path is missing its generated wildcard: ${relativePath}`);
+  return `/${escapeGitIgnoreFragment(relativePath.slice(0, wildcardIndex))}*${escapeGitIgnoreFragment(
+    relativePath.slice(wildcardIndex + 1),
+  )}`;
+}
+
+function gitErrorMessage(error) {
+  return String(error.stderr || error.message || error).trim();
+}
+
+function redactParseError(error, format = "JSON") {
+  error.message = `${format} parsing failed`;
+  error.stack = `${error.name || "Error"}: ${error.message}`;
+  return error;
+}
+
+function removeTOMLServer(source, name) {
+  if (!source.trim()) return source;
+  parseTOMLDocument(source, "existing TOML config");
   const lines = source.split(/\r?\n/);
   const kept = [];
   let skipping = false;
+  const scanState = { multiline: "" };
   for (const line of lines) {
-    const trimmed = line.trim();
-    const isHeader = trimmed.startsWith("[") && trimmed.endsWith("]");
-    if (trimmed === main || trimmed === env) {
+    const header = scanTOMLHeader(line, scanState);
+    const selected = header?.[0] === "mcp_servers" && header?.[1] === name;
+    if (selected) {
       skipping = true;
       continue;
     }
-    if (isHeader && skipping) {
+    if (header && skipping) {
       skipping = false;
     }
     if (!skipping) {
@@ -500,10 +608,57 @@ function removeCodexServer(source, name) {
   return kept.join("\n");
 }
 
-function codexServerBlock(name, config) {
+function scanTOMLHeader(line, state) {
+  if (state.multiline) {
+    if (hasMultilineDelimiter(line, state.multiline)) state.multiline = "";
+    return null;
+  }
+  const trimmed = line.trimStart();
+  if (trimmed.startsWith("[") && !trimmed.startsWith("[[")) {
+    try {
+      return findMarkerPath(parseTOML(`${line}\n__aipermission_header_marker = true\n`));
+    } catch {
+      return null;
+    }
+  }
+  for (const delimiter of ['"""', "'''"]) {
+    if (!hasMultilineDelimiter(line, delimiter)) continue;
+    if ((line.split(delimiter).length - 1) % 2 === 1) state.multiline = delimiter;
+    break;
+  }
+  return null;
+}
+
+function hasMultilineDelimiter(line, delimiter) {
+  const comment = line.indexOf("#");
+  return (comment < 0 ? line : line.slice(0, comment)).includes(delimiter);
+}
+
+function findMarkerPath(value, pathParts = []) {
+  if (!value || typeof value !== "object") return null;
+  if (value.__aipermission_header_marker === true) return pathParts;
+  for (const [key, nested] of Object.entries(value)) {
+    const match = findMarkerPath(nested, [...pathParts, key]);
+    if (match) return match;
+  }
+  return null;
+}
+
+function parseTOMLDocument(contents, location) {
+  try {
+    return parseTOML(contents);
+  } catch (error) {
+    redactParseError(error, "TOML");
+    throw new Error(`Could not parse TOML config at ${location}; the existing file was left unchanged`, { cause: error });
+  }
+}
+
+function tomlServerBlock(name, config) {
+  const fields = Object.entries(config)
+    .filter(([key]) => key !== "env")
+    .map(([key, value]) => `${key} = ${tomlValue(value)}`);
   return `[mcp_servers.${tomlKey(name)}]
-command = ${tomlString(config.command)}
-args = [${config.args.map(tomlString).join(", ")}]
+${fields.join("\n")}
 enabled = true
 
 [mcp_servers.${tomlKey(name)}.env]
@@ -512,17 +667,38 @@ AIPERMISSION_API_URL = ${tomlString(config.env.AIPERMISSION_API_URL)}
 AIPERMISSION_API_TOKEN = ${tomlString(config.env.AIPERMISSION_API_TOKEN)}`;
 }
 
-function printCustomConfig(name, config) {
+function printProviderConfig(name, provider, apiUrl, target) {
+  const baseConfig = buildMCPServerConfig({ apiUrl, token: "YOUR_TOKEN_HERE" });
+  const previewConfig = provider === "custom" ? baseConfig : adaptMCPServerConfig(provider, baseConfig);
   console.log("");
   console.log(`${color.bold}${color.cyan}Copy-paste config:${color.reset}`);
   console.log("");
-  console.log(JSON.stringify({ mcpServers: { [name]: config } }, null, 2));
+  if (target?.format === "toml") {
+    console.log(tomlPreviewServerBlock(name, previewConfig));
+    return;
+  }
+  console.log(JSON.stringify({ [target?.rootKey || "mcpServers"]: { [name]: previewConfig } }, null, 2));
+}
+
+// Keep stdout rendering separate from the secret-bearing TOML writer.
+function tomlPreviewServerBlock(name, config) {
+  const fields = Object.entries(config)
+    .filter(([key]) => key !== "env")
+    .map(([key, value]) => `${key} = ${tomlValue(value)}`);
+  return `[mcp_servers.${tomlKey(name)}]
+${fields.join("\n")}
+enabled = true
+
+[mcp_servers.${tomlKey(name)}.env]
+NODE_ENV = "production"
+AIPERMISSION_API_URL = ${tomlString(config.env.AIPERMISSION_API_URL)}
+AIPERMISSION_API_TOKEN = "YOUR_TOKEN_HERE"`;
 }
 
-function printTokenConfigWarning() {
+function printPlaceholderConfigNotice() {
   console.log("");
-  console.log(`${color.yellow}Warning:${color.reset} the printed config contains an AIPermission bearer token.`);
-  console.log(`${color.yellow}Keep it private and revoke the token if it is shared or committed.${color.reset}`);
+  console.log(`${color.yellow}Preview:${color.reset} the printed config uses YOUR_TOKEN_HERE and contains no bearer token.`);
+  console.log(`${color.yellow}Replace the placeholder through the client's private environment or config mechanism.${color.reset}`);
 }
 
 export function sanitizeName(value) {
@@ -533,6 +709,9 @@ export function sanitizeName(value) {
   if (!name) {
     throw new Error("MCP server name is required.");
   }
+  if (["__proto__", "prototype", "constructor"].includes(name.toLowerCase())) {
+    throw new Error("MCP server name is reserved.");
+  }
   return name;
 }
 
@@ -551,6 +730,13 @@ export function tomlString(value) {
   return JSON.stringify(String(value));
 }
 
+function tomlValue(value) {
+  if (typeof value === "string") return tomlString(value);
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  if (Array.isArray(value)) return `[${value.map(tomlValue).join(", ")}]`;
+  throw new Error(`Unsupported TOML MCP config value: ${typeof value}`);
+}
+
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   await runInit(process.argv.slice(2));
 }