@aiwg/cli 2026.10.3 → 2026.10.4

package/dist/src/mcp/claude-install.mjs

@@ -0,0 +1,41 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import { assertConfigDestination, assertConfigObject } from './config-file.mjs';
+
+/** Desktop is a user-level surface, independent of the Code project config. */
+export function claudeDesktopConfigPath(platform = process.platform, env = process.env) {
+  const home = env.HOME || env.USERPROFILE || os.homedir();
+  const base = platform === 'darwin' ? path.join(home, 'Library', 'Application Support')
+    : platform === 'win32' ? (env.APPDATA || path.join(home, 'AppData', 'Roaming'))
+      : path.join(home, '.config');
+  return path.join(base, 'Claude', 'claude_desktop_config.json');
+}
+
+export function resolveClaudeInstallTarget(target, scope, env = process.env) {
+  if (target !== 'claude') return target;
+  return scope === 'user' || env.CLAUDECODE || env.CLAUDE_CODE_ENTRYPOINT || env.CLAUDE_CODE_DESKTOP_APP_VERSION
+    ? 'claude-code' : 'claude-desktop';
+}
+
+/** Plan removal only of the exact legacy built-in stanza, never custom servers. */
+export async function legacyClaudeMigration(projectDir) {
+  const file = path.resolve(projectDir, '.claude/settings.local.json');
+  await assertConfigDestination(file, projectDir);
+  let settings;
+  try {
+    settings = JSON.parse(await fs.readFile(file, 'utf8'));
+  } catch (error) {
+    if (error.code === 'ENOENT') return [];
+    throw error;
+  }
+  assertConfigObject(settings, 'mcpServers');
+  const server = settings.mcpServers?.aiwg;
+  if (!server || server.command !== 'aiwg' || JSON.stringify(server.args) !== '["mcp","serve"]'
+    || Object.keys(server).some(key => !['command', 'args', 'env'].includes(key))
+    || (server.env !== undefined && (!server.env || typeof server.env !== 'object' || Array.isArray(server.env)
+      || Object.keys(server.env).some(key => key !== 'AIWG_ROOT')))) return [];
+  delete settings.mcpServers.aiwg;
+  if (Object.keys(settings.mcpServers).length === 0) delete settings.mcpServers;
+  return [{ file, content: JSON.stringify(settings, null, 2), options: { projectRoot: projectDir } }];
+}

package/dist/src/mcp/cli.d.mts

@@ -0,0 +1 @@
+export function main(args?: string[]): Promise<void>;

package/dist/src/mcp/cli.mjs

@@ -31,6 +31,7 @@ import {
 import { assertCredentialPolicy, CREDENTIAL_POLICIES, installPolicyCheckedServer, redactCredentialArgs, redactCredentialText, redactCredentialRecord, resolveCredentialPolicy } from './credentials.mjs';
 import { getMcpInjectionDefinition } from '../providers/provider-definitions.mjs';
 import { manageOmpMcp } from './omp-config.mjs';
+import { claudeDesktopConfigPath, resolveClaudeInstallTarget, legacyClaudeMigration } from './claude-install.mjs';
 import { unmanageGrokBuildMcp } from './grok-build-config.mjs';
 
 /**
@@ -197,6 +198,9 @@ Inject Options:
 Serve Options:
   --transport <type>   Transport type: stdio (default), http
   --port <number>      Port for HTTP transport (default: 3100)
+  --toolsets <csv>     Opt-in toolsets: flows, missions, memory, kb, research,
+                       activity-log, index, ralph, mc, ops, sandbox, decision, workers
+                       all excludes workers; enable explicitly with --toolsets all,workers
 
 Examples:
   # Define MCP servers
@@ -222,7 +226,8 @@ Examples:
   aiwg mcp remove fortemi
 
   # Install AIWG's own MCP server
-  aiwg mcp install claude
+  aiwg mcp install claude-code
+  aiwg mcp install claude-desktop
   aiwg mcp serve
   aiwg mcp info
 `);
@@ -235,7 +240,11 @@ async function generateConfig(target, projectDir = '.', scope = 'project') {
   const homeDir = process.env.HOME || process.env.USERPROFILE;
 
   const configs = {
-    claude: {
+    'claude-desktop': {
+      path: claudeDesktopConfigPath(),
+      content: { mcpServers: { aiwg: { command: 'aiwg', args: ['mcp', 'serve'] } } },
+    },
+    'claude-code': {
       path: scope === 'user' ? path.join(homeDir, '.claude.json') : path.join(projectDir, '.mcp.json'),
       userScope: scope === 'user',
       content: {
@@ -552,7 +561,7 @@ enabled_tools = [
   // other target's `configs[...]` entry above is a fixed `aiwg mcp serve`
   // stdio/TOML stanza with no env/headers field, so there is nothing further
   // for assertProjectCredentials to check there.
-  if (target === 'claude' && scope !== 'user') {
+  if (target === 'claude-code' && scope !== 'user') {
     assertProjectCredentials(Object.entries(config.content.mcpServers).map(([name, server]) => ({ name, ...server })), config.path);
   }
 
@@ -568,7 +577,13 @@ enabled_tools = [
         }
       };
 
-  await writeConfigAtomic(config.path, JSON.stringify(merged, null, 2), { userScope, projectRoot });
+  const migration = ['claude-code', 'claude-desktop'].includes(target)
+    ? await legacyClaudeMigration(projectDir) : [];
+  await writeConfigTransaction([
+    { file: config.path, content: JSON.stringify(merged, null, 2), options: { userScope, projectRoot } },
+    ...migration,
+  ]);
+  if (migration.length) console.log('Removed legacy AIWG MCP entry from .claude/settings.local.json');
   console.log(`MCP configuration written to: ${config.path}`);
   console.log(`\nTo use AIWG MCP server with ${target}:`);
   console.log(`  1. Restart ${target}`);
@@ -589,20 +604,22 @@ POSITIONING:
   MCP is optional and provider-agnostic. Baseline AIWG reachability is file
   deployment plus CLI discovery: aiwg discover / aiwg show <type> <name>.
 
-CORE TOOLS (15, always registered):
+CORE TOOLS (17, always registered):
   discover                         Cross-type ranked catalog search
   skill-list / skill-show           Skill catalog and SKILL.md body fetch
   command-list / command-show       CLI command catalog and command spec fetch
+  rule-inventory                    Scoped rule activation and binding inventory
   rule-list / rule-show             Rule catalog and rule body fetch
   agent-list / agent-show           Agent catalog and agent definition fetch
   template-list / template-show      Template catalog and raw template fetch
   template-render                   Render AIWG template with variables
   command-run                       Allow-listed CLI dispatch; confirmation-gated when needed
   artifact-read / artifact-write    Project .aiwg/ artifact IO
+  ask-user                         Structured user question via elicitation or Markdown
 
-OPT-IN TOOLSETS (60 additional tools):
+OPT-IN TOOLSETS (71 additional tools, including explicit workers):
   flows          flow-list / flow-show / flow-run
-  missions       mission-guide / mission-dispatch / mission-status
+  missions       mission-guide / mission-dispatch / mission-status / worker-resolve
   memory         memory-* and reflections-* storage operations
   kb             kb-* storage operations
   research       provenance-* and research-store-* storage operations
@@ -612,10 +629,13 @@ OPT-IN TOOLSETS (60 additional tools):
   mc             start / dispatch / status / stop / list
   ops            status / list / use / push
   sandbox        fleet inventory / mutation / reconciliation and governed activity
+  decision       validation / evaluation / rules / features / calibration
+  workers        worker-invoke (explicit opt-in; all excludes workers)
 
 Enable opt-in tools:
   AIWG_MCP_TOOLSETS=flows,missions,memory,kb,ralph,sandbox aiwg mcp serve
-  aiwg mcp serve --toolsets=all
+  aiwg mcp serve --toolsets all
+  aiwg mcp serve --toolsets all,workers  # explicitly enable worker-invoke
 
 RESOURCES:
   aiwg://prompts/catalog              List of prompt templates
@@ -636,7 +656,7 @@ TRANSPORTS:
 
 ENVIRONMENT:
   AIWG_ROOT          Path to AIWG installation (default: ~/.local/share/ai-writing-guide)
-  AIWG_MCP_TOOLSETS  Comma-separated opt-in toolsets; use all for every toolset
+  AIWG_MCP_TOOLSETS  Comma-separated opt-in toolsets; all excludes workers
   AIWG_SANDBOX_MANAGEMENT_URL         Sandbox management API origin (HTTPS except loopback)
   AIWG_SANDBOX_MANAGEMENT_TOKEN_FILE  Mode-0600 management bearer file for sandbox tools
 
@@ -1627,7 +1647,11 @@ export async function main(args = process.argv.slice(2)) {
       const scope = parseFlag(args, '--scope') || 'project';
       if (!['project', 'user'].includes(scope)) throw new Error('Scope must be project or user');
       const installArgs = args.slice(1).filter((a, index, rest) => !a.startsWith('--') && !['--scope', '--project'].includes(rest[index - 1]));
-      const target = installArgs[0] || 'claude';
+      const requestedTarget = installArgs[0] || 'claude';
+      const target = resolveClaudeInstallTarget(requestedTarget, scope);
+      if (requestedTarget === 'claude') {
+        console.warn(`Deprecated MCP install target "claude" selected ${target}; use "aiwg mcp install ${target}" explicitly.`);
+      }
       const projectDir = parseFlag(args, '--project') || installArgs[1] || '.';
 
       // Check for --dry-run flag
@@ -1636,7 +1660,8 @@ export async function main(args = process.argv.slice(2)) {
         console.log(`[DRY RUN] Would generate MCP config for: ${target}`);
         console.log(`[DRY RUN] Target directory: ${projectDir}`);
         const configPaths = {
-          claude: scope === 'user' ? path.join(homeDir, '.claude.json') : path.join(projectDir, '.mcp.json'),
+          'claude-desktop': claudeDesktopConfigPath(),
+          'claude-code': scope === 'user' ? path.join(homeDir, '.claude.json') : path.join(projectDir, '.mcp.json'),
           cursor: '.cursor/mcp.json',
           factory: (projectDir === '.' || projectDir === 'global')
             ? path.join(homeDir, '.factory/mcp.json')

package/dist/src/mcp/config-file.d.mts

@@ -0,0 +1,28 @@
+import type { Stats } from 'node:fs';
+
+export function assertNoSymlinkParents(file: string, configRoot?: string): Promise<void>;
+export function assertConfigDestination(file: string, projectRoot?: string): Promise<Stats | null>;
+export function isUserMcpScope(provider: string, scope?: string): boolean;
+export function isPathInsideDir(file: string, dir: string): boolean;
+export function assertSupportedScope(provider: string, scope: string | undefined, configPath: string, projectDir?: string): void;
+export function classifyMcpDestination(provider: string, scope: string | undefined, configPath: string, projectDir?: string): { userScope: boolean; projectRoot: string | undefined };
+export function projectCredentialRemedy(provider: string, projectDir?: string): string;
+export function assertProjectCredentials(servers: Array<{ name: string; url?: string; args?: string[]; env?: Record<string, unknown>; headers?: Record<string, unknown>; auth?: Record<string, unknown>; oauth?: Record<string, unknown> }>, configPath: string, remedy?: string): void;
+export function assertConfigObject(config: unknown, serversKey: string): void;
+export interface ConfigWriteOptions {
+  userScope?: boolean;
+  rejectSymlinkParents?: boolean;
+  symlinkRoot?: string;
+  projectRoot?: string;
+  newFileMode?: number;
+  mode?: number;
+}
+export interface ConfigWrite {
+  file: string;
+  content: string | Uint8Array;
+  options?: ConfigWriteOptions;
+}
+export function writeConfigAtomic(file: string, content: string | Uint8Array, options?: ConfigWriteOptions): Promise<void>;
+export function canonicalConfigPath(file: string): Promise<string>;
+export function prepareConfigWrite(file: string, options?: ConfigWriteOptions): Promise<void>;
+export function writeConfigTransaction(writes: ConfigWrite[]): Promise<void>;

package/dist/src/mcp/config-layers.d.mts

@@ -0,0 +1,36 @@
+export interface Layering {
+  lowerPolicy?: import('./credentials.mjs').McpCredentialPolicy;
+  /** Config file of the lower layer that set `lowerPolicy`, for diagnostics. */
+  lowerPolicySource?: string;
+  ownPolicy?: import('./credentials.mjs').McpCredentialPolicy;
+  effectivePolicy?: import('./credentials.mjs').McpCredentialPolicy;
+  lower: Map<string, string>;
+  own: Set<string>;
+  lowerFields: Map<string, string>;
+  ownFields: Set<string>;
+}
+
+export function resolveConfigLayers(
+  configDirOverride?: string,
+  env?: Record<string, string | undefined>,
+  options?: { platform?: string },
+): string[] | null;
+export function loadLayered<T extends object>(
+  layers: string[],
+  filename: string,
+  collection: string,
+  defaults: T,
+): Promise<{ data: T; layering: Layering }>;
+export function isLowerLayerEntry(layering: Layering, name: string): boolean;
+export function lowerEntryQualified(layering: Layering, name: string): boolean;
+export function writeLayerData<T extends object>(data: T, collection: string, layering: Layering, explicitPolicy?: boolean): T;
+export function resolveProfileExtends<P extends {
+  extends?: string[];
+  servers?: string[];
+  providerOverrides?: Record<string, { toolDeny?: string[]; toolAllow?: string[] }>;
+}>(name: string, profiles: Record<string, P>, seen?: string[]): P & { servers: string[] };
+
+export function assertLayerWriteDestination(layers: string[], filename: string): Promise<void>;
+export function saveLayerData(file: string, data: object, collection: string, layers: string[] | null, layering: Layering | null, explicitPolicy?: boolean): Promise<void>;
+
+export function isCaseInsensitivePath(path: string): Promise<boolean>;

package/dist/src/mcp/credentials.d.mts

@@ -0,0 +1,51 @@
+export type McpCredentialPolicy = 'literal' | 'references' | 'none';
+
+interface CredentialBearingServer {
+  name: string;
+  url?: string;
+  args?: string[];
+  env?: Record<string, string>;
+  headers?: Record<string, string>;
+  headerEnv?: Record<string, string>;
+  envFrom?: Record<string, string>;
+  auth?: { clientSecret?: string; tokenUrl?: string; redirectUri?: string; resource?: string };
+  oauth?: { clientSecret?: string; tokenUrl?: string; redirectUri?: string; resource?: string };
+}
+
+export const ENV_REFERENCE_SYNTAX: Readonly<Record<string, string | null>>;
+export const CREDENTIAL_POLICIES: readonly McpCredentialPolicy[];
+export function urlCarriesUserinfo(url?: string): boolean;
+export function credentialLikeQueryParams(url?: string, options?: { includeReferences?: boolean }): string[];
+export function credentialLikeFragmentParams(url?: string, options?: { includeReferences?: boolean }): string[];
+export function isCredentialReferenceValue(value: unknown): boolean;
+export function credentialLikeArgs(args?: string[], options?: { includeReferences?: boolean }): string[];
+export function redactCredentialArgs(args?: string[]): string[] | undefined;
+export function validateEnvReferenceName(name: string): void;
+export function renderCredentialMaps(
+  server: CredentialBearingServer,
+  provider: string,
+): { env?: Record<string, string>; headers?: Record<string, string> };
+export function credentialPolicyViolations(server: CredentialBearingServer, policy?: McpCredentialPolicy): string[];
+export function assertCredentialPolicy(servers: CredentialBearingServer[], policy?: McpCredentialPolicy): void;
+export function resolveCredentialPolicy(options?: {
+  flag?: string;
+  registryPolicy?: string;
+  floorPolicy?: string;
+  floorSource?: string;
+  env?: Record<string, string | undefined>;
+}): McpCredentialPolicy;
+
+export function stricterCredentialPolicy(
+  a: McpCredentialPolicy | undefined,
+  b: McpCredentialPolicy | undefined,
+): McpCredentialPolicy | undefined;
+
+export function warnCredentialPolicyRelaxation(candidate: McpCredentialPolicy, floor: McpCredentialPolicy, source?: string): void;
+export function warnDroppedOverlayPolicy(candidate: McpCredentialPolicy, floor: McpCredentialPolicy, source?: string): void;
+export function resetCredentialPolicyWarnings(): void;
+
+export const INSTALL_POLICY_EXEMPT_ENV: Readonly<Record<string, readonly string[]>>;
+export function installPolicyCheckedServer(name: string, server: CredentialBearingServer): CredentialBearingServer;
+
+export function redactCredentialText(value: string): string;
+export function redactCredentialRecord<T>(value: T): T;

package/dist/src/mcp/grok-build-config.d.mts

@@ -0,0 +1,6 @@
+export function renderGrokMcpServer(server: any): string;
+export function mergeGrokMcpServers(text: string, servers: any[]): string;
+export function removeGrokMcpServers(text: string, names: string[]): { text: string; removed: string[] };
+export function manageGrokBuildMcp(configPath: string, servers: any[], options?: any): Promise<any>;
+export function unmanageGrokBuildMcp(configPath: string, names: string[], options?: any): Promise<any>;
+export function inspectGrokBuildNative(options?: any): Promise<any>;

package/dist/src/mcp/grok-build-config.mjs

@@ -144,7 +144,7 @@ export async function unmanageGrokBuildMcp(configPath, names, options = {}) {
 }
 
 function runJson(binary, args, cwd, env) {
-  const run = spawnSync(binary, args, { cwd, env, encoding: 'utf8', timeout: 30_000 });
+  const run = spawnSync(binary, args, { cwd, env, encoding: 'utf8', timeout: 30_000, killSignal: 'SIGKILL' });
   if (run.error || run.status !== 0) return { ok: false, detail: run.error?.message || run.stderr || `exit ${run.status}` };
   try { return { ok: true, value: JSON.parse(run.stdout || '{}') }; }
   catch { return { ok: false, detail: 'Grok returned malformed JSON' }; }

package/dist/src/mcp/helpers.mjs

@@ -5,6 +5,7 @@
  * @issues #1311 (scope split), #1312 (command-run), #1313 (discover + pairs)
  */
 
+import { signalChild } from '../process/signal-child.mjs';
 import { spawn } from 'node:child_process';
 import { StringDecoder } from 'node:string_decoder';
 import fs from 'node:fs/promises';
@@ -287,11 +288,11 @@ export function runAiwgCli(args, { cwd, env, timeoutMs = 120_000, input } = {})
       // owned child one second to exit gracefully, then escalate cleanup.
       reject(err);
       killTimer = setTimeout(() => {
-        try { proc.kill('SIGKILL'); } catch { /* child may already have exited */ }
+        try { signalChild(proc, 'SIGKILL'); } catch { /* child may already have exited */ }
       }, 1000);
       killTimer.unref?.();
       // Install cleanup first: kill() can synchronously trigger close in an adapter.
-      try { proc.kill('SIGTERM'); } catch { /* retain the original failure */ }
+      try { signalChild(proc, 'SIGTERM'); } catch { /* retain the original failure */ }
     };
     const timer = setTimeout(() => {
       rejectAndTerminate(new Error(`aiwg ${args[0] || ''} timed out after ${timeoutMs}ms`));

package/dist/src/mcp/muse-native-config.d.mts

@@ -0,0 +1,13 @@
+export type MuseNativeInspection = {
+  cli: string;
+  hooks: 'absent' | 'managed' | 'operator-only';
+  mcp: 'absent' | 'configured' | 'unreadable';
+};
+
+export function inspectMuseNative(options?: {
+  projectDir?: string;
+  env?: Record<string, string | undefined>;
+  userHome?: string;
+}): Promise<MuseNativeInspection>;
+
+export function isMuseDeployedProject(projectDir?: string): Promise<boolean>;

package/dist/src/mcp/muse-native-config.mjs

@@ -50,6 +50,7 @@ function inspectMuseCli(env) {
     env,
     encoding: 'utf8',
     timeout: MUSE_VERSION_TIMEOUT_MS,
+    killSignal: 'SIGKILL',
   });
   if (result.error?.code === 'ENOENT') return 'absent';
   if (result.error?.code === 'ETIMEDOUT') return 'present (version timeout)';

package/dist/src/mcp/omp-config.d.mts

@@ -0,0 +1,4 @@
+export function ompServerConfig(server: Record<string, any>): Record<string, any>;
+export function manageOmpMcp(configPath: string, servers: Array<{name: string; [key: string]: any}>, options?: {dryRun?: boolean; remove?: string[]; userScope?: boolean; projectRoot?: string}): Promise<{
+  configPath: string; serversInjected: string[]; alreadyPresent: string[]; removed: string[];
+}>;

package/dist/src/mcp/registry.js

@@ -1,4 +1,5 @@
 import { tomlString } from './toml-string.mjs';
+import { buildServerConfig as renderServerConfig } from './server-config.mjs';
 import { isLowerLayerEntry, loadLayered, lowerEntryQualified, resolveConfigLayers, saveLayerData } from './config-layers.mjs';
 import { assertConfigDestination, assertProjectCredentials, classifyMcpDestination, projectCredentialRemedy, writeConfigAtomic, writeConfigTransaction } from './config-file.mjs';
 import { manageOmpMcp } from './omp-config.mjs';
@@ -6,7 +7,7 @@ import { manageGrokBuildMcp } from './grok-build-config.mjs';
 import { replaceServer } from './toml-editor.mjs';
 import { resolveOmpPaths } from '../providers/omp-paths.mjs';
 import { applyJsonToolFilterPlan, claudeSettingsPath, prepareClaudePermissions, planToolFilters } from './tool-filters.mjs';
-import { assertCredentialPolicy, resolveCredentialPolicy, renderCredentialMaps, validateEnvReferenceName } from './credentials.mjs';
+import { assertCredentialPolicy, resolveCredentialPolicy, validateEnvReferenceName } from './credentials.mjs';
 /**
  * MCP Server Registry
  *
@@ -22,7 +23,6 @@ import { qualifyWorkerInvocationProfile, requiredWorkerControls } from '../model
 import { dirname, isAbsolute, resolve } from 'path';
 import { homedir } from 'os';
 import { resolveConfigDir } from '../config/user-config.js';
-import { getProviderDefinition } from '../providers/provider-definitions.js';
 // ============================================
 // Registry
 // ============================================
@@ -314,97 +314,7 @@ export class McpServerRegistry {
  * Build the MCP config block for a single server in a given provider's format.
  */
 export function buildServerConfig(server, provider) {
-    const adapter = getProviderDefinition(provider)?.adapters.mcpInjection;
-    const { env, headers } = adapter && adapter !== 'codex'
-        ? renderCredentialMaps(server, adapter)
-        : { env: server.env, headers: server.headers };
-    switch (adapter) {
-        case 'antigravity': {
-            if (server.type === 'stdio') {
-                return { command: server.command, args: server.args || [], ...(env ? { env } : {}) };
-            }
-            return { serverUrl: server.url, ...(headers ? { headers } : {}) };
-        }
-        case 'claude-code': {
-            if (server.type === 'stdio') {
-                return {
-                    command: server.command,
-                    args: server.args || [],
-                    ...(env ? { env } : {}),
-                };
-            }
-            // Claude Code skips a url entry that has no type.
-            return {
-                type: server.type,
-                url: server.url,
-                ...(headers ? { headers } : {}),
-            };
-        }
-        case 'cursor': {
-            if (server.type === 'stdio') {
-                return {
-                    command: server.command,
-                    args: server.args || [],
-                    ...(env ? { env } : {}),
-                };
-            }
-            return {
-                url: server.url,
-                ...(headers ? { headers } : {}),
-            };
-        }
-        case 'factory': {
-            if (server.type === 'stdio') {
-                return {
-                    type: 'stdio',
-                    command: server.command,
-                    args: server.args || [],
-                    disabled: false,
-                    ...(env ? { env } : {}),
-                };
-            }
-            return {
-                type: server.type,
-                url: server.url,
-                disabled: false,
-                ...(headers ? { headers } : {}),
-            };
-        }
-        case 'opencode': {
-            if (server.type === 'stdio') {
-                return {
-                    type: 'local',
-                    command: [server.command, ...(server.args || [])],
-                    // opencode names a local server's variables `environment`.
-                    ...(env ? { environment: env } : {}),
-                };
-            }
-            return {
-                type: 'remote',
-                url: server.url,
-                ...(headers ? { headers } : {}),
-            };
-        }
-        case 'windsurf':
-        case 'warp': {
-            if (server.type === 'stdio') {
-                return {
-                    command: server.command,
-                    args: server.args || [],
-                    ...(env ? { env } : {}),
-                };
-            }
-            return {
-                url: server.url,
-                ...(headers ? { headers } : {}),
-            };
-        }
-        case 'codex':
-            // TOML format handled separately
-            return {};
-        default:
-            return {};
-    }
+    return renderServerConfig(server, provider);
 }
 function tomlKey(value) {
     return typeof value === 'string' && /^[A-Za-z0-9_-]+$/.test(value) ? value : tomlString(value);

package/dist/src/mcp/registry.mjs

@@ -1,4 +1,6 @@
 import { tomlString } from './toml-string.mjs';
+import { buildServerConfig } from './server-config.mjs';
+export { buildServerConfig } from './server-config.mjs';
 import { isLowerLayerEntry, loadLayered, lowerEntryQualified, resolveConfigLayers, saveLayerData } from './config-layers.mjs';
 import { assertConfigDestination, assertProjectCredentials, classifyMcpDestination, projectCredentialRemedy, writeConfigAtomic, writeConfigTransaction } from './config-file.mjs';
 import { manageOmpMcp } from './omp-config.mjs';
@@ -6,7 +8,7 @@ import { manageGrokBuildMcp } from './grok-build-config.mjs';
 import { replaceServer } from './toml-editor.mjs';
 import { resolveOmpPaths } from '../providers/omp-paths.mjs';
 import { applyJsonToolFilterPlan, claudeSettingsPath, prepareClaudePermissions, planToolFilters } from './tool-filters.mjs';
-import { assertCredentialPolicy, resolveCredentialPolicy, renderCredentialMaps, validateEnvReferenceName } from './credentials.mjs';
+import { assertCredentialPolicy, resolveCredentialPolicy, validateEnvReferenceName } from './credentials.mjs';
 /**
  * MCP Server Registry (Runtime ESM)
  *
@@ -292,92 +294,6 @@ export class McpServerRegistry {
 // Provider injection logic
 // ============================================
 
-export function buildServerConfig(server, provider) {
-  const mcpDefinition = getMcpInjectionDefinition(provider);
-  // TOML providers render references through their own named keys in
-  // buildServerToml; unconditional interpolation would refuse them here even
-  // though the TOML writer handles them.
-  const { env, headers } = mcpDefinition?.serverConfigFormat === 'toml'
-    ? {}
-    : renderCredentialMaps(server, normalizeRuntimeProviderId(provider) || provider);
-
-  switch (mcpDefinition?.serverConfigFormat) {
-    case 'claude-code': {
-      if (server.type === 'stdio') {
-        return {
-          command: server.command,
-          args: server.args || [],
-          ...(env ? { env } : {}),
-        };
-      }
-      // Claude Code skips a url entry that has no type.
-      return {
-        type: server.type,
-        url: server.url,
-        ...(headers ? { headers } : {}),
-      };
-    }
-    case 'antigravity': {
-      if (server.type === 'stdio') {
-        return { command: server.command, args: server.args || [], ...(env ? { env } : {}) };
-      }
-      return { serverUrl: server.url, ...(headers ? { headers } : {}) };
-    }
-    case 'standard': {
-      if (server.type === 'stdio') {
-        return {
-          command: server.command,
-          args: server.args || [],
-          ...(env ? { env } : {}),
-        };
-      }
-      return {
-        url: server.url,
-        ...(headers ? { headers } : {}),
-      };
-    }
-
-    case 'factory': {
-      if (server.type === 'stdio') {
-        return {
-          type: 'stdio',
-          command: server.command,
-          args: server.args || [],
-          disabled: false,
-          ...(env ? { env } : {}),
-        };
-      }
-      return {
-        type: server.type,
-        url: server.url,
-        disabled: false,
-        ...(headers ? { headers } : {}),
-      };
-    }
-
-    case 'opencode': {
-      if (server.type === 'stdio') {
-        // opencode names a local server's variables `environment`.
-        return {
-          type: 'local',
-          command: [server.command, ...(server.args || [])],
-          ...(env ? { environment: env } : {}),
-        };
-      }
-      return {
-        type: 'remote',
-        url: server.url,
-        ...(headers ? { headers } : {}),
-      };
-    }
-
-    case 'toml':
-      return {};
-
-    default:
-      return {};
-  }
-}
 
 function tomlKey(value) {
   return typeof value === 'string' && /^[A-Za-z0-9_-]+$/.test(value) ? value : tomlString(value);

package/dist/src/mcp/server-config.d.mts

@@ -0,0 +1,3 @@
+import type { InjectProvider, McpServerDefinition } from './registry.js';
+
+export function buildServerConfig(server: McpServerDefinition, provider: InjectProvider): Record<string, unknown>;