@aiwg/cli 2026.10.0 → 2026.10.3

package/dist/src/mcp/registry.js

@@ -1,7 +1,12 @@
+import { tomlString } from './toml-string.mjs';
+import { isLowerLayerEntry, loadLayered, lowerEntryQualified, resolveConfigLayers, saveLayerData } from './config-layers.mjs';
+import { assertConfigDestination, assertProjectCredentials, classifyMcpDestination, projectCredentialRemedy, writeConfigAtomic, writeConfigTransaction } from './config-file.mjs';
 import { manageOmpMcp } from './omp-config.mjs';
 import { manageGrokBuildMcp } from './grok-build-config.mjs';
 import { replaceServer } from './toml-editor.mjs';
 import { resolveOmpPaths } from '../providers/omp-paths.mjs';
+import { applyJsonToolFilterPlan, claudeSettingsPath, prepareClaudePermissions, planToolFilters } from './tool-filters.mjs';
+import { assertCredentialPolicy, resolveCredentialPolicy, renderCredentialMaps, validateEnvReferenceName } from './credentials.mjs';
 /**
  * MCP Server Registry
  *
@@ -11,8 +16,11 @@ import { resolveOmpPaths } from '../providers/omp-paths.mjs';
  *
  * @implements #554
  */
-import { readFile, writeFile, mkdir } from 'fs/promises';
-import { dirname, resolve } from 'path';
+import { readFile } from 'fs/promises';
+import { qualificationDigest } from '../models/qualification-digest.mjs';
+import { qualifyWorkerInvocationProfile, requiredWorkerControls } from '../models/provider-policy.js';
+import { dirname, isAbsolute, resolve } from 'path';
+import { homedir } from 'os';
 import { resolveConfigDir } from '../config/user-config.js';
 import { getProviderDefinition } from '../providers/provider-definitions.js';
 // ============================================
@@ -33,12 +41,76 @@ function validateCredentialReferences(def) {
             throw new Error(`Invalid MCP header environment variable reference "${envName}"`);
         }
     }
+    for (const [key, envName] of Object.entries(def.envFrom ?? {})) {
+        if (!ENV_REFERENCE_NAME.test(key))
+            throw new Error(`Invalid MCP env-from variable name "${key}"`);
+        if (!ENV_REFERENCE_NAME.test(envName)) {
+            throw new Error(`Invalid MCP env-from environment variable reference "${envName}"`);
+        }
+    }
+}
+export function workerServerDigest(server) {
+    const { workerQualification, description, injectedProviders, addedAt, updatedAt, ...execution } = server;
+    return qualificationDigest(execution);
+}
+function workerQualificationBinding(server, input) {
+    if (!Array.isArray(input.requiredControls) || input.requiredControls.some(name => typeof name !== 'string' || !name || !Object.hasOwn(input.adapter.invocationProfiles?.[input.profile]?.controls ?? {}, name))) {
+        throw new Error('MCP worker must declare valid required controls');
+    }
+    if (server.enabled === false || input.mcp.serverRef !== server.name) {
+        throw new Error('MCP worker server is disabled or does not match the qualified profile');
+    }
+    if (input.authorizedServerDigest !== workerServerDigest(server)) {
+        throw new Error('MCP server command, endpoint or configuration lacks matching host authorization');
+    }
+    if (server.type === 'stdio') {
+        if (!server.command || !isAbsolute(server.command) || server.command.includes('\0')
+            || (server.args ?? []).some(arg => typeof arg !== 'string' || arg.includes('\0'))) {
+            throw new Error('MCP worker requires an authorized absolute local command and typed argv');
+        }
+    }
+    else {
+        let endpoint;
+        try {
+            endpoint = new URL(server.url ?? '');
+        }
+        catch {
+            throw new Error('MCP worker endpoint is invalid');
+        }
+        if (!['http:', 'https:'].includes(endpoint.protocol) || endpoint.username || endpoint.password || endpoint.hash) {
+            throw new Error('MCP worker endpoint must be an authorized HTTP URL without credentials or fragment');
+        }
+    }
+    const profile = qualifyWorkerInvocationProfile(input.adapter, { ...input, transport: 'mcp' });
+    const installed = input.installationQualification;
+    if (installed?.serverDigest !== input.authorizedServerDigest) {
+        throw new Error('MCP worker installation does not cover the authorized registration');
+    }
+    const evidence = profile.installationQualification;
+    if (!installed || installed.status !== 'ENABLED' || installed.platform !== 'linux' || installed.cliVersion !== input.cliVersion
+        || !evidence || ['scopeDigest', 'fixtureDigest', 'verifiedAt', 'evidenceRef'].some(key => installed[key] !== evidence[key])) {
+        throw new Error('MCP worker requires current trusted installation qualification');
+    }
+    if (Object.keys(server.env ?? {}).some(key => !profile.envAllowlist.includes(key))
+        || Object.values(server.headerEnv ?? {}).some(key => !profile.envAllowlist.includes(key))) {
+        throw new Error('MCP worker server environment exceeds the qualified profile allowlist');
+    }
+    return {
+        serverDigest: workerServerDigest(server), adapterDigest: qualificationDigest(input.adapter),
+        profile: input.profile, cliVersion: input.cliVersion,
+        scopeDigest: installed.scopeDigest, fixtureDigest: installed.fixtureDigest,
+        requiredControls: requiredWorkerControls(input).sort(),
+    };
 }
 export class McpServerRegistry {
     configDir;
     cache = null;
+    /** Configuration layers, lowest precedence first; null for a single directory */
+    layers;
+    layering = null;
     constructor(configDirOverride) {
-        this.configDir = resolveConfigDir(configDirOverride);
+        this.layers = resolveConfigLayers(configDirOverride);
+        this.configDir = this.layers ? this.layers[this.layers.length - 1] : resolveConfigDir(configDirOverride);
     }
     /** Get the registry file path */
     getPath() {
@@ -48,6 +120,12 @@ export class McpServerRegistry {
     async load() {
         if (this.cache)
             return this.cache;
+        if (this.layers) {
+            const layered = await loadLayered(this.layers, REGISTRY_FILENAME, 'servers', DEFAULT_REGISTRY);
+            this.cache = layered.data;
+            this.layering = layered.layering;
+            return this.cache;
+        }
         const filePath = this.getPath();
         try {
             const content = await readFile(filePath, 'utf-8');
@@ -61,43 +139,67 @@ export class McpServerRegistry {
         catch {
             this.cache = { ...DEFAULT_REGISTRY, servers: {} };
         }
+        try {
+            resolveCredentialPolicy({ registryPolicy: this.cache.credentialPolicy, env: {} });
+        }
+        catch (error) {
+            this.cache = null;
+            throw new Error(`Invalid MCP credential policy in ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
+        }
         return this.cache;
     }
     /** Save the registry to disk */
-    async save() {
-        if (!this.cache)
+    async save(data = this.cache, explicitPolicy = false) {
+        if (!data)
             return;
-        await mkdir(this.configDir, { recursive: true });
-        const filePath = this.getPath();
-        await writeFile(filePath, JSON.stringify(this.cache, null, 2) + '\n', 'utf-8');
+        // A fresh instance has no ownership record yet; load it first so inherited
+        // entries and inherited policy are never copied into the write layer.
+        let layering = this.layering;
+        if (this.layers && !layering) {
+            await this.load();
+            layering = this.layering;
+        }
+        await saveLayerData(this.getPath(), data, 'servers', this.layers, layering, explicitPolicy);
+        this.cache = data;
+        if (this.layers) {
+            this.clearCache();
+            await this.load();
+        }
     }
     /** Add a new MCP server definition */
     async add(def) {
         validateCredentialReferences(def);
-        const data = await this.load();
+        const data = structuredClone(await this.load());
         if (data.servers[def.name]) {
             throw new Error(`Server "${def.name}" already exists. Use "update" to modify it.`);
         }
         data.servers[def.name] = {
             ...def,
+            workerQualification: undefined,
             injectedProviders: [],
             addedAt: new Date().toISOString(),
             updatedAt: new Date().toISOString(),
         };
-        await this.save();
+        await this.save(data);
     }
     /** Remove an MCP server definition */
     async remove(name) {
-        const data = await this.load();
+        const data = structuredClone(await this.load());
         if (!data.servers[name]) {
             throw new Error(`Server "${name}" not found.`);
         }
+        if (this.layering && isLowerLayerEntry(this.layering, name)) {
+            throw new Error(`Server "${name}" is defined in a lower configuration layer; remove it there.`);
+        }
+        if (this.layering && lowerEntryQualified(this.layering, name)) {
+            throw new Error(`Server "${name}" overrides a qualified lower-layer entry; removing the override would silently re-expose its qualification. Remove the lower-layer entry in its own layer instead.`);
+        }
         delete data.servers[name];
-        await this.save();
+        await this.save(data);
     }
     /** Update an existing MCP server definition */
     async update(name, updates) {
-        const data = await this.load();
+        const data = structuredClone(await this.load());
         if (!data.servers[name]) {
             throw new Error(`Server "${name}" not found.`);
         }
@@ -108,8 +210,35 @@ export class McpServerRegistry {
             updatedAt: new Date().toISOString(),
         };
         validateCredentialReferences(next);
+        // Ordinary registration edits cannot mint qualification, including a copied binding.
+        next.workerQualification = workerServerDigest(next) === workerServerDigest(data.servers[name])
+            ? data.servers[name].workerQualification : undefined;
         data.servers[name] = next;
+        await this.save(data);
+    }
+    /** Bind an already qualified host installation to this exact MCP registration. */
+    async recordWorkerQualification(name, input) {
+        this.clearCache();
+        const server = await this.get(name);
+        if (!server)
+            throw new Error(`Server "${name}" not found.`);
+        const binding = workerQualificationBinding(server, input);
+        server.workerQualification = binding;
         await this.save();
+        return structuredClone(binding);
+    }
+    /** Recheck immediately before use; direct shell invocations do not use this registry. */
+    async assertWorkerQualified(name, input) {
+        // Other trusted registry writers may have changed the registration since load().
+        this.clearCache();
+        const server = await this.get(name);
+        if (!server)
+            throw new Error(`Server "${name}" not found.`);
+        const current = workerQualificationBinding(server, input);
+        if (!server.workerQualification || qualificationDigest(server.workerQualification) !== qualificationDigest(current)) {
+            throw new Error('MCP worker registration qualification is missing or changed');
+        }
+        return structuredClone(server);
     }
     /** Get a specific server definition */
     async get(name) {
@@ -123,7 +252,7 @@ export class McpServerRegistry {
     }
     /** Record that a server was injected into a provider */
     async recordInjection(name, provider) {
-        const data = await this.load();
+        const data = structuredClone(await this.load());
         const server = data.servers[name];
         if (!server)
             return;
@@ -133,7 +262,7 @@ export class McpServerRegistry {
         if (!server.injectedProviders.includes(provider)) {
             server.injectedProviders.push(provider);
         }
-        await this.save();
+        await this.save(data);
     }
     /** Get all providers that have had servers injected */
     async getInjectedProviders() {
@@ -146,6 +275,33 @@ export class McpServerRegistry {
         }
         return [...providers];
     }
+    /** Registry-wide default credential policy, if one is set */
+    async getCredentialPolicy() {
+        const data = await this.load();
+        return data.credentialPolicy;
+    }
+    /** The enforced organisation floor for this registry, if any layer below the write layer sets one. */
+    async getCredentialPolicyFloor() {
+        await this.load();
+        return this.layering?.lowerPolicy;
+    }
+    /** The config file of the layer that set the enforced floor, for diagnostics. */
+    async getCredentialPolicyFloorSource() {
+        await this.load();
+        return this.layering?.lowerPolicySource;
+    }
+    async setCredentialPolicy(policy) {
+        const data = structuredClone(await this.load());
+        const floorPolicy = this.layering?.lowerPolicy;
+        const floorSource = this.layering?.lowerPolicySource;
+        const effective = resolveCredentialPolicy({ flag: policy, floorPolicy, floorSource, env: {} });
+        if (effective !== policy) {
+            const location = floorSource ? ` (set in ${floorSource})` : '';
+            throw new Error(`Cannot relax MCP credential policy floor "${effective}"${location} to "${policy}".`);
+        }
+        data.credentialPolicy = policy;
+        await this.save(data, true);
+    }
     /** Clear the in-memory cache */
     clearCache() {
         this.cache = null;
@@ -157,27 +313,31 @@ export class McpServerRegistry {
 /**
  * Build the MCP config block for a single server in a given provider's format.
  */
-function buildServerConfig(server, provider) {
+export function buildServerConfig(server, provider) {
     const adapter = getProviderDefinition(provider)?.adapters.mcpInjection;
+    const { env, headers } = adapter && adapter !== 'codex'
+        ? renderCredentialMaps(server, adapter)
+        : { env: server.env, headers: server.headers };
     switch (adapter) {
         case 'antigravity': {
             if (server.type === 'stdio') {
-                return { command: server.command, args: server.args || [], ...(server.env ? { env: server.env } : {}) };
+                return { command: server.command, args: server.args || [], ...(env ? { env } : {}) };
             }
-            return { serverUrl: server.url, ...(server.headers ? { headers: server.headers } : {}) };
+            return { serverUrl: server.url, ...(headers ? { headers } : {}) };
         }
         case 'claude-code': {
             if (server.type === 'stdio') {
                 return {
                     command: server.command,
                     args: server.args || [],
-                    ...(server.env ? { env: server.env } : {}),
+                    ...(env ? { env } : {}),
                 };
             }
-            // http/sse
+            // Claude Code skips a url entry that has no type.
             return {
+                type: server.type,
                 url: server.url,
-                ...(server.headers ? { headers: server.headers } : {}),
+                ...(headers ? { headers } : {}),
             };
         }
         case 'cursor': {
@@ -185,12 +345,12 @@ function buildServerConfig(server, provider) {
                 return {
                     command: server.command,
                     args: server.args || [],
-                    ...(server.env ? { env: server.env } : {}),
+                    ...(env ? { env } : {}),
                 };
             }
             return {
                 url: server.url,
-                ...(server.headers ? { headers: server.headers } : {}),
+                ...(headers ? { headers } : {}),
             };
         }
         case 'factory': {
@@ -200,14 +360,14 @@ function buildServerConfig(server, provider) {
                     command: server.command,
                     args: server.args || [],
                     disabled: false,
-                    ...(server.env ? { env: server.env } : {}),
+                    ...(env ? { env } : {}),
                 };
             }
             return {
                 type: server.type,
                 url: server.url,
                 disabled: false,
-                ...(server.headers ? { headers: server.headers } : {}),
+                ...(headers ? { headers } : {}),
             };
         }
         case 'opencode': {
@@ -215,13 +375,14 @@ function buildServerConfig(server, provider) {
                 return {
                     type: 'local',
                     command: [server.command, ...(server.args || [])],
-                    ...(server.env ? { env: server.env } : {}),
+                    // opencode names a local server's variables `environment`.
+                    ...(env ? { environment: env } : {}),
                 };
             }
             return {
                 type: 'remote',
                 url: server.url,
-                ...(server.headers ? { headers: server.headers } : {}),
+                ...(headers ? { headers } : {}),
             };
         }
         case 'windsurf':
@@ -230,12 +391,12 @@ function buildServerConfig(server, provider) {
                 return {
                     command: server.command,
                     args: server.args || [],
-                    ...(server.env ? { env: server.env } : {}),
+                    ...(env ? { env } : {}),
                 };
             }
             return {
                 url: server.url,
-                ...(server.headers ? { headers: server.headers } : {}),
+                ...(headers ? { headers } : {}),
             };
         }
         case 'codex':
@@ -245,22 +406,13 @@ function buildServerConfig(server, provider) {
             return {};
     }
 }
-/**
- * Build a TOML section for a server (Codex/OpenAI provider).
- */
-function tomlString(value) {
-    if (typeof value !== 'string' || [...value].some(char => {
-        const point = char.codePointAt(0);
-        return point >= 0xd800 && point <= 0xdfff;
-    }))
-        throw new Error('TOML values must be strings containing valid Unicode scalar values');
-    // JSON escapes align with TOML basic strings except DEL must also be escaped.
-    return JSON.stringify(value).replace(/\u007f/g, '\\u007f');
-}
 function tomlKey(value) {
     return typeof value === 'string' && /^[A-Za-z0-9_-]+$/.test(value) ? value : tomlString(value);
 }
-function buildServerToml(server) {
+function tomlInlineTable(values) {
+    return `{ ${Object.entries(values).map(([name, value]) => `${tomlKey(name)} = ${tomlString(value)}`).join(', ')} }`;
+}
+export function buildServerToml(server) {
     const lines = [];
     lines.push(`[mcp_servers.${tomlKey(server.name)}]`);
     if (server.type === 'stdio') {
@@ -269,9 +421,27 @@ function buildServerToml(server) {
             const argsStr = server.args.map(a => tomlString(a)).join(', ');
             lines.push(`args = [${argsStr}]`);
         }
+        if (server.env && Object.keys(server.env).length > 0)
+            lines.push(`env = ${tomlInlineTable(server.env)}`);
+        // Codex forwards a variable only under its own name (env_vars).
+        const forwarded = Object.entries(server.envFrom ?? {});
+        for (const [key, name] of forwarded) {
+            validateEnvReferenceName(name);
+            if (key !== name) {
+                throw new Error(`MCP server "${server.name}": Codex forwards environment variables under their own name only; env-from ${key}=${name} cannot be rendered. Use ${name}=${name}.`);
+            }
+        }
+        if (forwarded.length > 0)
+            lines.push(`env_vars = [${forwarded.map(([name]) => tomlString(name)).join(', ')}]`);
     }
     else {
         lines.push(`url = ${tomlString(server.url)}`);
+        if (server.headers && Object.keys(server.headers).length > 0)
+            lines.push(`http_headers = ${tomlInlineTable(server.headers)}`);
+        for (const name of Object.values(server.headerEnv ?? {}))
+            validateEnvReferenceName(name);
+        if (server.headerEnv && Object.keys(server.headerEnv).length > 0)
+            lines.push(`env_http_headers = ${tomlInlineTable(server.headerEnv)}`);
     }
     lines.push(`startup_timeout_sec = 10.0`);
     lines.push(`tool_timeout_sec = 60.0`);
@@ -285,6 +455,9 @@ export function getProviderConfigPath(provider, projectDir = '.', options = {})
         const homeDir = process.env.HOME || process.env.USERPROFILE || '';
         return resolve(homeDir, '.gemini/config/mcp_config.json');
     }
+    if ((provider === 'claude-code' || provider === 'claude') && options.scope === 'user') {
+        return resolve(process.env.HOME || process.env.USERPROFILE || homedir(), '.claude.json');
+    }
     if ((provider === 'omp' || provider === 'oh-my-pi') && options.scope !== undefined && !['user', 'project'].includes(options.scope))
         throw new Error('OMP MCP scope must be user or project');
     if ((provider === 'omp' || provider === 'oh-my-pi') && options.scope === 'user')
@@ -295,12 +468,12 @@ export function getProviderConfigPath(provider, projectDir = '.', options = {})
         agy: resolve(projectDir, '.agents/mcp_config.json'),
         omp: resolve(projectDir, '.omp/mcp.json'),
         'oh-my-pi': resolve(projectDir, '.omp/mcp.json'),
-        'claude-code': resolve(projectDir, '.claude/settings.local.json'),
-        claude: resolve(projectDir, '.claude/settings.local.json'),
+        'claude-code': resolve(projectDir, '.mcp.json'),
+        claude: resolve(projectDir, '.mcp.json'),
         cursor: resolve(projectDir, '.cursor/mcp.json'),
         factory: resolve(homeDir, '.factory/mcp.json'),
-        codex: resolve(homeDir, '.codex/config.toml'),
-        openai: resolve(homeDir, '.codex/config.toml'),
+        codex: process.env.CODEX_HOME ? resolve(process.env.CODEX_HOME, 'config.toml') : resolve(homeDir, '.codex/config.toml'),
+        openai: process.env.CODEX_HOME ? resolve(process.env.CODEX_HOME, 'config.toml') : resolve(homeDir, '.codex/config.toml'),
         'grok-build': options.scope === 'user'
             ? resolve(process.env.GROK_HOME || resolve(homeDir, '.grok'), 'config.toml')
             : resolve(projectDir, '.grok/config.toml'),
@@ -327,16 +500,37 @@ export async function injectServers(registry, provider, options = {}) {
     };
     // Get servers to inject
     let allServers = await registry.list();
-    if (serverFilter && serverFilter.length > 0) {
+    if (serverFilter !== undefined) {
         allServers = allServers.filter(s => serverFilter.includes(s.name));
     }
+    const toolPlan = options.toolFilters
+        ? planToolFilters(provider, allServers.map(server => server.name), options.toolFilters)
+        : null;
+    if (toolPlan)
+        result.warnings = toolPlan.warnings;
     if (allServers.length === 0) {
         result.error = 'No servers to inject. Use "aiwg mcp add" first.';
         return result;
     }
+    assertCredentialPolicy(allServers, resolveCredentialPolicy({
+        flag: options.credentialPolicy, registryPolicy: await registry.getCredentialPolicy(),
+        floorPolicy: await registry.getCredentialPolicyFloor(),
+        floorSource: await registry.getCredentialPolicyFloorSource(),
+    }));
+    // The shareable-project decision follows the actual resolved destination,
+    // never the requested scope: a `--scope user` request for a provider without
+    // a user-scope destination still resolves to the project file and is refused.
+    const { userScope, projectRoot } = classifyMcpDestination(provider, options.scope, configPath, projectDir);
+    await assertConfigDestination(configPath, projectRoot);
+    // Every destination inside the project directory is meant to be committed to
+    // version control; home destinations are private, so literals there are not
+    // copied into a shared file.
+    if (projectRoot) {
+        assertProjectCredentials(allServers, configPath, projectCredentialRemedy(provider, projectDir));
+    }
     if (provider === 'omp' || provider === 'oh-my-pi') {
         try {
-            const managed = await manageOmpMcp(configPath, allServers, { dryRun });
+            const managed = await manageOmpMcp(configPath, allServers, { dryRun, userScope, projectRoot });
             if (!dryRun)
                 for (const server of allServers)
                     await registry.recordInjection(server.name, 'omp');
@@ -350,6 +544,7 @@ export async function injectServers(registry, provider, options = {}) {
         try {
             const managed = await manageGrokBuildMcp(configPath, allServers, {
                 dryRun,
+                userScope,
                 root: options.scope === 'user' ? dirname(dirname(configPath)) : resolve(projectDir),
             });
             if (!dryRun && !managed.error)
@@ -363,12 +558,12 @@ export async function injectServers(registry, provider, options = {}) {
     }
     // Handle TOML-based providers (Codex/OpenAI) separately
     if (provider === 'codex' || provider === 'openai') {
-        return injectToml(registry, allServers, configPath, provider, dryRun, result);
+        return injectToml(registry, allServers, configPath, provider, dryRun, result, userScope, projectRoot, toolPlan);
     }
     // JSON-based providers
-    return injectJson(registry, allServers, configPath, provider, dryRun, result);
+    return injectJson(registry, allServers, configPath, provider, dryRun, result, userScope, projectRoot, toolPlan, { projectDir, scope: options.scope });
 }
-async function injectJson(registry, servers, configPath, provider, dryRun, result) {
+async function injectJson(registry, servers, configPath, provider, dryRun, result, userScope, projectRoot, toolPlan = null, location = {}) {
     // Load existing config
     let existing = {};
     try {
@@ -406,9 +601,21 @@ async function injectJson(registry, servers, configPath, provider, dryRun, resul
     }
     // Merge back
     const merged = { ...existing, [mcpKey]: newServers };
+    if (toolPlan) {
+        applyJsonToolFilterPlan(merged, mcpKey, toolPlan);
+    }
+    const isClaude = provider === 'claude-code' || provider === 'claude';
+    const settingsPath = isClaude ? claudeSettingsPath(location.projectDir, location.scope) : null;
+    const settings = settingsPath ? await prepareClaudePermissions(settingsPath, toolPlan?.claudePermissions || { deny: [], allow: [] }, { userScope, projectRoot, managedDir: dirname(registry.getPath()), mcpPath: configPath }) : null;
+    if (settings?.active && settingsPath)
+        result.settingsPath = settingsPath;
+    if (settings?.warnings.length)
+        result.warnings = [...(result.warnings || []), ...settings.warnings];
     if (!dryRun) {
-        await mkdir(resolve(configPath, '..'), { recursive: true });
-        await writeFile(configPath, JSON.stringify(merged, null, 2) + '\n', 'utf-8');
+        await writeConfigTransaction([
+            { file: configPath, content: JSON.stringify(merged, null, 2) + '\n', options: { userScope, projectRoot } },
+            ...(settings?.writes || []),
+        ]);
         // Record injection in registry
         for (const server of servers) {
             if ((provider === 'antigravity' || provider === 'agy') && !result.serversInjected.includes(server.name))
@@ -418,7 +625,7 @@ async function injectJson(registry, servers, configPath, provider, dryRun, resul
     }
     return result;
 }
-async function injectToml(registry, servers, configPath, provider, dryRun, result) {
+async function injectToml(registry, servers, configPath, provider, dryRun, result, userScope, projectRoot, toolPlan = null) {
     let existing = '';
     try {
         existing = await readFile(configPath, 'utf-8');
@@ -428,15 +635,15 @@ async function injectToml(registry, servers, configPath, provider, dryRun, resul
             throw error;
     }
     for (const server of servers) {
-        const edited = replaceServer(existing, server.name, buildServerToml(server));
+        const filterLines = toolPlan?.tomlLines[server.name] || [];
+        const edited = replaceServer(existing, server.name, [buildServerToml(server), ...filterLines].join('\n'));
         existing = edited.text;
         if (edited.alreadyPresent)
             result.alreadyPresent.push(server.name);
         result.serversInjected.push(server.name);
     }
     if (!dryRun) {
-        await mkdir(resolve(configPath, '..'), { recursive: true });
-        await writeFile(configPath, existing, 'utf-8');
+        await writeConfigAtomic(configPath, existing, { userScope, projectRoot });
         for (const server of servers) {
             await registry.recordInjection(server.name, provider);
         }