@aiwg/cli 2026.9.6 → 2026.9.9

package/dist/src/cost/fleet-report.js

@@ -179,13 +179,27 @@ function requestSignal(parent) {
 }
 async function openRouterGet(endpoint, key, options) {
     const fetchImpl = options.fetchImpl ?? fetch;
-    const response = await fetchImpl(`${options.apiBaseUrl ?? OPENROUTER_API}${endpoint}`, {
-        headers: { Authorization: `Bearer ${key}` },
-        signal: requestSignal(options.signal),
-    });
+    let response;
+    try {
+        response = await fetchImpl(`${options.apiBaseUrl ?? OPENROUTER_API}${endpoint}`, {
+            headers: { Authorization: `Bearer ${key}` },
+            signal: requestSignal(options.signal),
+        });
+    }
+    catch {
+        // Transport diagnostics can embed Authorization headers or request bodies.
+        throw new Error('OpenRouter request could not complete. Check connectivity, timeout, or cancellation.');
+    }
     if (!response.ok)
         throw new Error(`OpenRouter request failed with status ${response.status}.`);
-    const payload = await response.json();
+    let payload;
+    try {
+        payload = await response.json();
+    }
+    catch {
+        // Decoder exceptions can quote arbitrary response content.
+        throw new Error('OpenRouter returned unreadable JSON. Check the API response format.');
+    }
     if (!payload || typeof payload !== 'object' || !payload.data)
         throw new Error('OpenRouter returned an invalid response.');
     return payload.data;

package/dist/src/extensions/claude-hooks-installer.js

@@ -68,11 +68,17 @@ function normalizeHooks(raw) {
     return [{}, false];
 }
 /**
- * Detect whether the existing settings carries the AIWG signature
- * (any hook entry tagged `_aiwg_managed: true`). Accepts both the
+ * Detect whether the existing settings carries the AIWG signature — either a hook
+ * entry tagged `_aiwg_managed: true`, or the top-level `aiwg` stamp written when
+ * AIWG creates the file itself (tools/agents/providers/claude.mjs). Without the
+ * latter, a greenfield deploy backs up the settings.json it created seconds
+ * earlier and reports it as protected operator content (#2542). Accepts both the
  * current object form and the legacy array form.
  */
 function hasAiwgMarker(settings) {
+    const stamp = settings.aiwg;
+    if (stamp && typeof stamp === 'object')
+        return true;
     const hooksField = settings.hooks;
     if (!hooksField)
         return false;
@@ -167,7 +173,7 @@ export async function installAiwgHooks(opts) {
                 const backup = `${result.settingsPath}.bak.${new Date().toISOString().replace(/[:.]/g, '-')}`;
                 await fs.copyFile(result.settingsPath, backup);
                 result.backupPath = backup;
-                result.warnings.push(`Backed up pre-existing settings.json to ${backup}`);
+                result.warnings.push(`Backed up operator-authored settings.json to ${backup}`);
             }
         }
         catch (err) {
@@ -202,18 +208,28 @@ export async function installAiwgHooks(opts) {
             // those files no longer exist on disk after refresh, causing
             // `MODULE_NOT_FOUND` at `node:internal/modules/cjs/loader` on every
             // hook invocation. (Fixes regression report on Claude Code 2.1.157.)
+            // Match by `_aiwg_id` first, then by the script path. An entry invoking an
+            // AIWG-owned hook script without the managed tag is AIWG residue from an
+            // earlier install; appending a managed entry beside it registers the hook
+            // twice and runs it twice per event. Adopt it instead. (#2543)
             let updated = false;
             for (const group of groups) {
                 if (!Array.isArray(group.hooks))
                     continue;
                 for (const h of group.hooks) {
-                    if (h._aiwg_id !== hookId)
+                    const sameId = h._aiwg_id === hookId;
+                    const sameScript = typeof h.command === 'string' && h.command.includes(script);
+                    if (!sameId && !sameScript)
                         continue;
-                    if (h.command !== command || h.type !== 'command' || h._aiwg_managed !== true) {
+                    const adopting = !sameId && sameScript;
+                    if (h.command !== command || h.type !== 'command' || h._aiwg_managed !== true || h._aiwg_id !== hookId) {
                         h.type = 'command';
                         h.command = command;
                         h._aiwg_managed = true;
-                        result.warnings.push(`Refreshed stale ${event} → ${hookId} command path`);
+                        h._aiwg_id = hookId;
+                        result.warnings.push(adopting
+                            ? `Adopted pre-existing untagged ${event} → ${hookId} entry instead of registering a duplicate`
+                            : `Refreshed stale ${event} → ${hookId} command path`);
                     }
                     updated = true;
                 }

package/dist/src/extensions/project-local-doctor.js

@@ -67,7 +67,7 @@ export async function buildProjectLocalDoctorSection(opts) {
     }
     // No project-local content → no section at all
     if (discovery.isEmpty && discovery.errors.length === 0 && !quickrefAudit.exists && quickrefErrors.length === 0) {
-        return { output: '', validationErrors: 0, denylistViolations: 0, driftCount: 0, hasFailures: false };
+        return { output: '', validationErrors: 0, denylistViolations: 0, driftCount: 0, undeployedCount: 0, hasFailures: false };
     }
     const lines = ['', '── Project-local artifacts ────────────────────────────────────'];
     // Counts
@@ -108,12 +108,17 @@ export async function buildProjectLocalDoctorSection(opts) {
     lines.push('');
     // Shadows + denylist
     let denylistViolations = 0;
+    // Bundles the resolver deliberately refused are already reported below as
+    // denylist violations; the undeployed check must not double-count them.
+    const refusedBundleIds = new Set();
     if (discovery.bundles.length > 0) {
         try {
             const upstream = await buildUpstreamRegistry({ frameworkRoot });
             const shadowResult = await resolveShadows(discovery.bundles, upstream);
             const refusals = shadowResult.resolutions.filter(r => r.verdict === 'refuse-unsafe' || r.verdict === 'refuse-phantom' || r.verdict === 'refuse-duplicate');
             denylistViolations = refusals.length;
+            for (const refusal of refusals)
+                refusedBundleIds.add(refusal.bundleId);
             if (!quiet) {
                 const informational = shadowResult.shadows.filter(s => s.verdict === 'deploy-with-warning' || s.verdict === 'deploy-acknowledged');
                 if (informational.length > 0) {
@@ -188,6 +193,37 @@ export async function buildProjectLocalDoctorSection(opts) {
         }
         lines.push('');
     }
+    // Undeployed bundles (#2503).
+    //
+    // A bundle whose deploy aborted (a bad support-asset reference, a failed CLI
+    // contribution) leaves no `installed` entry, so every check above — manifest
+    // validation, drift — silently skips it and reports a clean bill of health
+    // for a bundle that is not actually available. The only prior signal was a
+    // WARN line in `aiwg use` output, long scrolled away by the time anyone
+    // wonders where the skill went.
+    const undeployed = config
+        ? discovery.bundles.filter((bundle) => {
+            if (refusedBundleIds.has(bundle.id))
+                return false;
+            const entry = config.installed[bundle.id];
+            return !entry || entry.source !== 'project-local';
+        })
+        : [];
+    if (undeployed.length > 0) {
+        lines.push(`  Deployment: ✗ ${undeployed.length} discovered bundle${undeployed.length === 1 ? '' : 's'} not deployed`);
+        for (const bundle of undeployed.slice(0, 5)) {
+            lines.push(`    ✗ ${bundle.type}/${bundle.id} (${bundle.localPath}) — no deployment recorded`);
+        }
+        if (undeployed.length > 5)
+            lines.push(`    + ${undeployed.length - 5} more`);
+        lines.push(`    Run \`aiwg use ${undeployed[0].id}\` and read the output — a deploy that`);
+        lines.push('    fails reports the reason there.');
+        lines.push('');
+    }
+    else if (!quiet && config && discovery.bundles.length > 0) {
+        lines.push('  Deployment: ✓ all discovered bundles deployed');
+        lines.push('');
+    }
     // Provider deployment matrix
     if (!quiet && config) {
         const projectLocalEntries = Object.entries(config.installed).filter(([, e]) => e.source === 'project-local');
@@ -252,12 +288,14 @@ export async function buildProjectLocalDoctorSection(opts) {
             lines.push('');
         }
     }
-    const hasFailures = validationErrors > 0 || denylistViolations > 0 || driftCount > 0 || gitignoredCount > 0;
+    const hasFailures = validationErrors > 0 || denylistViolations > 0 || driftCount > 0
+        || gitignoredCount > 0 || undeployed.length > 0;
     return {
         output: lines.join('\n'),
         validationErrors,
         denylistViolations,
         driftCount,
+        undeployedCount: undeployed.length,
         hasFailures,
     };
 }

package/dist/src/extensions/project-quickref.js

@@ -258,6 +258,10 @@ export function renderProjectQuickref(definition) {
         '---',
         `name: ${skillName}`,
         `description: ${JSON.stringify(`Project-specific orientation for ${definition.project.name}`)}`,
+        // AIWG generates and deploys this skill, so it must declare AIWG ownership.
+        // Without it the collision scan treats every redeploy of AIWG's own artifact
+        // as an unowned overwrite and warns permanently (#2504).
+        'namespace: aiwg',
         'kernel: true',
         'platforms: [all]',
         '---',

package/dist/src/installation/manager.mjs

@@ -176,13 +176,44 @@ export function inspectInstallation(options = {}) {
   const actualRoot = canonicalPath(options.actualRoot);
   const actualMethod = options.actualMethod ?? inferInstallationMethod(actualRoot);
   const identity = options.identity ?? loadInstallationIdentity({ ...options, actualRoot });
-  if (!identity) return { state: 'unrecorded', identity: null, actualRoot, actualMethod, drift: ['installation identity is not recorded'] };
+  if (!identity) {
+    return {
+      state: 'unrecorded',
+      identity: null,
+      actualRoot,
+      actualMethod,
+      frameworkRoot: actualRoot,
+      launcher: null,
+      drift: ['installation identity is not recorded'],
+    };
+  }
 
   const drift = [];
   const canonicalRoot = canonicalPath(identity.root);
+
+  // Edge/customize mode deliberately separates the *launcher* (the executable
+  // that ran, typically an npm-global install) from the *framework root* (the
+  // local clone named by `edgePath`). Comparing the launcher's package root
+  // against the canonical root then reports the supported configuration as
+  // drift, and does so only for the commands that happen to run from the
+  // npm-global copy — `aiwg doctor`, loaded through the redirect, saw the
+  // clone and reported aligned for the same workspace (#2505).
+  //
+  // The redirect is only trusted when the identity actually declares it: the
+  // channel is `edge` and `edgePath` resolves to the canonical root.
+  const edgePath = identity.edgePath ? canonicalPath(identity.edgePath) : null;
+  const rootsDiffer = canonicalRoot !== actualRoot;
+  const launcherRedirect = identity.channel === 'edge' && edgePath !== null && edgePath === canonicalRoot && rootsDiffer;
+  const launcher = launcherRedirect ? { root: actualRoot, method: actualMethod } : null;
+  // The framework root is what AIWG actually reads its corpus from, and it is
+  // the single value that drives `state`.
+  const frameworkRoot = launcherRedirect ? canonicalRoot : actualRoot;
+
   if (!existsSync(canonicalRoot)) drift.push(`canonical root does not exist: ${canonicalRoot}`);
-  if (canonicalRoot !== actualRoot) drift.push(`actual root ${actualRoot} differs from canonical root ${canonicalRoot}`);
-  if (identity.method !== actualMethod) drift.push(`actual method ${actualMethod} differs from canonical method ${identity.method}`);
+  if (rootsDiffer && !launcherRedirect) drift.push(`actual root ${actualRoot} differs from canonical root ${canonicalRoot}`);
+  if (identity.method !== actualMethod && !launcherRedirect) {
+    drift.push(`actual method ${actualMethod} differs from canonical method ${identity.method}`);
+  }
   if (identity.method !== 'web' && !identity.managerExecutable) {
     drift.push(`canonical ${identity.method} installation has no recorded manager executable`);
   }
@@ -214,6 +245,10 @@ export function inspectInstallation(options = {}) {
     canonicalRoot,
     actualRoot,
     actualMethod,
+    /** Where the corpus is read from. Equals actualRoot unless a launcher redirect applies. */
+    frameworkRoot,
+    /** Non-null only in edge/customize mode: the executable's own package root. */
+    launcher,
     drift,
     managerProbe,
   };

package/dist/src/lint/runner.js

@@ -29,6 +29,100 @@ function parseFrontmatter(content) {
     return result;
 }
 const DEFAULT_REFERENCE_PATTERN = '\\bREF-\\d{3,}\\b';
+/**
+ * Verification targets — things the inducting agent could have checked.
+ *
+ * Requiring one of these is what separates "the agent skipped a cheap check"
+ * from "the paper's own claim is unverified". Only the first is a provenance
+ * gap; the second is legitimate analysis, and #2523 explicitly does not ask
+ * agents to stop declaring limitations. Validated against a 2,544-reference
+ * corpus, where grammar-only matching made ~45% of hits paper-claim prose
+ * ("scaling behavior above 7B is unverified", "Not confirmed (34% vs 51%)").
+ */
+/**
+ * Split a markdown line into clauses.
+ *
+ * Corpus prose keeps whole paragraphs, bullet bodies and changelog table rows on
+ * a single line, so "same line" is far too coarse a scope for relating an
+ * unperformed action to its target. Sentence and cell boundaries are the unit
+ * that actually corresponds to one statement.
+ */
+function splitClauses(line) {
+    return line
+        .split(/(?<=[.;:!?])\s+|\s+\u2014\s+|\s+--\s+|\|/g)
+        .map((c) => c.trim())
+        .filter(Boolean);
+}
+export const DEFAULT_VERIFICATION_TARGETS = [
+    'openreview',
+    '(?:acl )?anthology',
+    'proceedings',
+    'camera[- ]ready',
+    'published version',
+    '\\bPMLR\\b',
+    '\\bDBLP\\b',
+    '\\bOpenAlex\\b',
+    'semantic scholar',
+    '\\bpubpeer\\b',
+    '\\bunpaywall\\b',
+    'retraction|correction notice|expression of concern',
+    'citation (?:census|count)',
+    'influential citation',
+    '\\bPDF\\b',
+    'full[- ]text',
+    '\\be-?print\\b',
+    '(?:code|project|dataset|repository|repo)\\s+(?:page|url|link|release|availability)',
+    '\\bvenue\\b',
+    '\\bacceptance\\b',
+    'source[_ ]type',
+];
+/**
+ * Phrases that assert a check was not performed. Drawn from real induction
+ * output — each of these has appeared in a corpus reference doc (#2523).
+ * Only counted when a verification target appears on the same line.
+ */
+export const DEFAULT_UNCERTAINTY_PATTERNS = [
+    '(?:was|were|is|are) not (?:retrieved|run|performed|attempted|fetched|queried|checked|acquired|probed|verified|confirmed)',
+    'not (?:retrieved|run|performed|attempted|fetched|queried|checked|acquired|probed|verified|confirmed)\\b',
+    // Requires the action to be stated as unperformed. Without the trailing verb
+    // this matched bare "no search" in unrelated prose and scope statements like
+    // "no exhaustive census is claimed", neither of which is a skipped check.
+    'no (?:\\w+[ -]){0,4}(?:quer(?:y|ies)|search|census|fetch|check|lookup|probe)(?:es|s)?\\s+(?:was |were )?(?:performed|run|attempted|made|conducted|executed)',
+    '\\b(?:is|remains) unverified\\b',
+    '\\bunconfirmed\\b',
+    'rests on .{0,60} rather than an independent',
+];
+export const DEFAULT_OBSTACLE_PATTERNS = [
+    '\\bHTTP\\s?[45]\\d{2}\\b',
+    '\\b(?:401|403|404|429|451|503)\\b',
+    'paywall',
+    'closed[- ]access',
+    'requires? (?:a )?(?:credential|token|API key|subscription|login|account)',
+    '\\b(?:HF_TOKEN|API[_ ]KEY)\\b',
+    'rate[- ]limit',
+    'anti[- ]bot',
+    'cloudflare',
+    'captcha',
+    'endpoint unknown',
+    'no (?:known )?endpoint',
+    // Obstacle vocabulary observed in a real corpus: these are named obstacles,
+    // so the statement is already a real outcome rather than a silent skip.
+    'proof[- ]of[- ]work',
+    'challenge (?:artifact|page|response)',
+    'returned challenge',
+    '\\bgated\\b',
+    'did not render',
+    'green OA',
+    // Explicit scope declarations: saying what is deliberately not claimed is an
+    // outcome, unlike omitting the check and not saying so.
+    'is not (?:claimed|asserted)',
+    'NOT (?:recorded|asserted) as',
+    'evidence boundary',
+    'completion_evidence',
+    'status:\\s*(?:incomplete|blocked)',
+    '\\b(?:queried|fetched|checked|probed|confirmed|resolved)\\s+(?:on\\s+)?\\d{4}-\\d{2}-\\d{2}',
+    '\\bdeferred\\b.{0,40}\\b(?:because|since|due to)\\b',
+];
 /**
  * Build a target-wide artifact ID index once per lint run.
  *
@@ -136,6 +230,50 @@ function runCheck(check, content, frontmatter, filePath, targetDir, allFiles, re
             }
             break;
         }
+        case 'unregistered-uncertainty': {
+            // An uncertainty written only into prose is invisible to the verification
+            // contract: it was never a declared check, so it never surfaces as
+            // `incomplete` and the "never report skipped verification as success" rule
+            // is never violated. Flag the bare form; accept it once a specific
+            // obstacle is named or an outcome is recorded (#2523).
+            const uncertainty = (check.uncertaintyPatterns ?? DEFAULT_UNCERTAINTY_PATTERNS)
+                .map((p) => new RegExp(p, 'i'));
+            const targets = (check.verificationTargets ?? DEFAULT_VERIFICATION_TARGETS)
+                .map((p) => new RegExp(p, 'i'));
+            const obstacle = (check.obstaclePatterns ?? DEFAULT_OBSTACLE_PATTERNS)
+                .map((p) => new RegExp(p, 'i'));
+            const within = check.obstacleWithinLines ?? 2;
+            const lines = content.split('\n');
+            for (let i = 0; i < lines.length; i++) {
+                // Both conditions must hold in the SAME CLAUSE: an unperformed action
+                // AND something the agent could have acted on. Without the target, the
+                // match is as likely to be the paper's own limitation, which must stay
+                // untouched. Without clause scoping, a long markdown line relates two
+                // unrelated clauses — real corpus prose puts whole paragraphs and
+                // changelog tables on one line, which produced most false positives.
+                const clause = splitClauses(lines[i]).find((c) => uncertainty.some((re) => re.test(c)) && targets.some((re) => re.test(c)));
+                if (!clause)
+                    continue;
+                // Look in the matching line and the following `within` lines: the
+                // obstacle normally sits in the same sentence or the next one.
+                const window = lines.slice(i, i + within + 1).join(' ');
+                if (obstacle.some((re) => re.test(window)))
+                    continue;
+                diagnostics.push({
+                    ruleId: '',
+                    ruleName: '',
+                    // Left unset so the rule's declared severity applies (see runRule).
+                    // This is a prose heuristic, so the shipped rule declares `warn`; an
+                    // operator can raise it to error once a corpus is clean.
+                    severity: undefined,
+                    file: filePath,
+                    line: i + 1,
+                    message: `Uncertainty stated without a named obstacle or recorded outcome: ${clause.trim().slice(0, 160)}`,
+                    fix: 'Resolve it if it costs about one request against a known endpoint, or name the specific obstacle (HTTP status, credential required, rate limited, paywalled) so it lands as incomplete/blocked rather than narrative.',
+                });
+            }
+            break;
+        }
         case 'pattern-match': {
             if (!check.pattern)
                 break;

package/dist/src/mcp/helpers.mjs

@@ -6,6 +6,7 @@
  */
 
 import { spawn } from 'node:child_process';
+import { StringDecoder } from 'node:string_decoder';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 
@@ -72,7 +73,7 @@ export async function resolveProjectAiwgDir(projectDir) {
  */
 export async function findProjectRoot(startDir = process.cwd()) {
   let currentDir = startDir;
-  while (currentDir !== path.dirname(currentDir)) {
+  while (true) {
     const aiwgPath = path.join(currentDir, '.aiwg');
     const pointerPath = path.join(currentDir, PROJECT_AIWG_LOCATION_FILE);
     try {
@@ -87,7 +88,10 @@ export async function findProjectRoot(startDir = process.cwd()) {
     } catch {
       // continue up
     }
-    currentDir = path.dirname(currentDir);
+    // Inspect the root candidate too, then stop instead of revisiting it.
+    const parentDir = path.dirname(currentDir);
+    if (parentDir === currentDir) break;
+    currentDir = parentDir;
   }
   throw new Error('No .aiwg directory or .aiwg-location pointer found. Run from an AIWG project or `aiwg new` first.');
 }
@@ -167,33 +171,56 @@ export function runAiwgCli(args, { cwd, env, timeoutMs = 120_000, input } = {})
     });
     let stdout = '';
     let stderr = '';
-    let timedOut = false;
+    const stdoutDecoder = new StringDecoder('utf8');
+    const stderrDecoder = new StringDecoder('utf8');
+    let settled = false;
+    let killTimer;
+    const rejectAndTerminate = (err) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      // Settlement must not depend on a cooperative close event. Give the
+      // owned child one second to exit gracefully, then escalate cleanup.
+      reject(err);
+      killTimer = setTimeout(() => {
+        try { proc.kill('SIGKILL'); } catch { /* child may already have exited */ }
+      }, 1000);
+      killTimer.unref?.();
+      // Install cleanup first: kill() can synchronously trigger close in an adapter.
+      try { proc.kill('SIGTERM'); } catch { /* retain the original failure */ }
+    };
     const timer = setTimeout(() => {
-      timedOut = true;
-      proc.kill('SIGTERM');
+      rejectAndTerminate(new Error(`aiwg ${args[0] || ''} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
 
-    proc.stdout.on('data', (chunk) => { stdout += chunk; });
-    proc.stderr.on('data', (chunk) => { stderr += chunk; });
+    proc.stdout.on('data', (chunk) => { stdout += stdoutDecoder.write(chunk); });
+    proc.stderr.on('data', (chunk) => { stderr += stderrDecoder.write(chunk); });
 
     proc.on('close', (code) => {
       clearTimeout(timer);
-      if (timedOut) {
-        reject(new Error(`aiwg ${args[0] || ''} timed out after ${timeoutMs}ms`));
-        return;
-      }
+      clearTimeout(killTimer);
+      if (settled) return;
+      settled = true;
+      stdout += stdoutDecoder.end();
+      stderr += stderrDecoder.end();
       resolve({ stdout, stderr, code: code ?? -1 });
     });
     proc.on('error', (err) => {
       clearTimeout(timer);
+      // A late error must not cancel cleanup of a failed, still-live child.
+      if (settled) return;
+      settled = true;
       reject(err);
     });
 
-    if (input !== undefined) {
-      proc.stdin.write(input);
-      proc.stdin.end();
-    } else {
-      proc.stdin.end();
+    // Pipe errors are emitted on stdin, not on the ChildProcess. Register
+    // before writing so synchronous adapter events and late EPIPE are handled.
+    proc.stdin.on('error', rejectAndTerminate);
+    try {
+      if (input !== undefined) proc.stdin.write(input);
+      if (!settled) proc.stdin.end();
+    } catch (err) {
+      rejectAndTerminate(err);
     }
   });
 }
@@ -244,13 +271,20 @@ export async function loadCommandAllowList() {
     }
   }
   if (!text) {
-    // Last-resort fallback: spawn `aiwg help` and parse — slower but always works
+    // Installed packages need not contain TypeScript sources. Ask the CLI for
+    // its versioned canonical registry; human help is incomplete and contains examples.
     try {
-      const { stdout } = await runAiwgCli(['help'], { timeoutMs: 30_000 });
-      _commandIds = new Set(
-        Array.from(stdout.matchAll(/^\s{4}([a-z][a-z0-9-]+)\s/gm))
-          .map(m => m[1])
-      );
+      const { stdout, code } = await runAiwgCli(['help', '--json'], { timeoutMs: 30_000 });
+      if (code !== 0) throw new Error('Command registry subprocess failed');
+      const registry = JSON.parse(stdout);
+      const ids = registry?.commandIds;
+      if (registry?.schema !== 'aiwg.command-registry.v1'
+        || !Array.isArray(ids) || ids.length === 0
+        || ids.some(id => typeof id !== 'string' || !/^[a-z][a-z0-9-]*$/.test(id))
+        || new Set(ids).size !== ids.length) {
+        throw new Error('Invalid command registry response');
+      }
+      _commandIds = new Set(ids);
       return _commandIds;
     } catch (e) {
       _commandIds = new Set();

package/dist/src/mcp/registry.js

@@ -1,4 +1,5 @@
 import { manageOmpMcp } from './omp-config.mjs';
+import { replaceServer } from './toml-editor.mjs';
 import { resolveOmpPaths } from '../providers/omp-paths.mjs';
 /**
  * MCP Server Registry
@@ -246,18 +247,30 @@ function buildServerConfig(server, provider) {
 /**
  * Build a TOML section for a server (Codex/OpenAI provider).
  */
+function tomlString(value) {
+    if (typeof value !== 'string' || [...value].some(char => {
+        const point = char.codePointAt(0);
+        return point >= 0xd800 && point <= 0xdfff;
+    }))
+        throw new Error('TOML values must be strings containing valid Unicode scalar values');
+    // JSON escapes align with TOML basic strings except DEL must also be escaped.
+    return JSON.stringify(value).replace(/\u007f/g, '\\u007f');
+}
+function tomlKey(value) {
+    return typeof value === 'string' && /^[A-Za-z0-9_-]+$/.test(value) ? value : tomlString(value);
+}
 function buildServerToml(server) {
     const lines = [];
-    lines.push(`[mcp_servers.${server.name}]`);
+    lines.push(`[mcp_servers.${tomlKey(server.name)}]`);
     if (server.type === 'stdio') {
-        lines.push(`command = "${server.command}"`);
+        lines.push(`command = ${tomlString(server.command)}`);
         if (server.args && server.args.length > 0) {
-            const argsStr = server.args.map(a => `"${a}"`).join(', ');
+            const argsStr = server.args.map(a => tomlString(a)).join(', ');
             lines.push(`args = [${argsStr}]`);
         }
     }
     else {
-        lines.push(`url = "${server.url}"`);
+        lines.push(`url = ${tomlString(server.url)}`);
     }
     lines.push(`startup_timeout_sec = 10.0`);
     lines.push(`tool_timeout_sec = 60.0`);
@@ -344,12 +357,21 @@ async function injectJson(registry, servers, configPath, provider, dryRun, resul
         existing = JSON.parse(content);
     }
     catch (error) {
+        if (error instanceof SyntaxError) {
+            throw new Error(`Refusing to overwrite malformed MCP config ${configPath}: invalid JSON`);
+        }
         if ((provider === 'antigravity' || provider === 'agy') && error?.code !== 'ENOENT') {
             throw new Error(`Refusing to overwrite malformed MCP config ${configPath}: ${error.message}`);
         }
+        if (error?.code !== 'ENOENT')
+            throw error;
     }
     // Determine the MCP servers key for this provider
     const mcpKey = provider === 'opencode' ? 'mcp' : 'mcpServers';
+    const isObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+    if (!isObject(existing) || (Object.hasOwn(existing, mcpKey) && !isObject(existing[mcpKey]))) {
+        throw new Error('MCP configuration must contain an object root and an object server map');
+    }
     const existingServers = existing[mcpKey] || {};
     // Build new server entries
     const newServers = { ...existingServers };
@@ -382,26 +404,17 @@ async function injectToml(registry, servers, configPath, provider, dryRun, resul
     try {
         existing = await readFile(configPath, 'utf-8');
     }
-    catch {
-        // File doesn't exist
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
     }
-    const sectionsToAdd = [];
     for (const server of servers) {
-        const sectionHeader = `[mcp_servers.${server.name}]`;
-        if (existing.includes(sectionHeader)) {
-            // Replace the existing section
-            const sectionRegex = new RegExp(`\\[mcp_servers\\.${escapeRegex(server.name)}\\][\\s\\S]*?(?=\\n\\[|$)`);
-            existing = existing.replace(sectionRegex, buildServerToml(server));
+        const edited = replaceServer(existing, server.name, buildServerToml(server));
+        existing = edited.text;
+        if (edited.alreadyPresent)
             result.alreadyPresent.push(server.name);
-        }
-        else {
-            sectionsToAdd.push(buildServerToml(server));
-        }
         result.serversInjected.push(server.name);
     }
-    if (sectionsToAdd.length > 0) {
-        existing = existing.trimEnd() + '\n\n' + sectionsToAdd.join('\n\n') + '\n';
-    }
     if (!dryRun) {
         await mkdir(resolve(configPath, '..'), { recursive: true });
         await writeFile(configPath, existing, 'utf-8');
@@ -411,9 +424,6 @@ async function injectToml(registry, servers, configPath, provider, dryRun, resul
     }
     return result;
 }
-function escapeRegex(str) {
-    return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
 /** All supported provider names for injection */
 export const SUPPORTED_PROVIDERS = [
     'antigravity',