@akms/mcp-ssh 0.1.7 → 0.1.9

package/lib/cli.js

@@ -1,14 +1,15 @@
 #!/usr/bin/env node
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import fs6 from 'fs';
+import fs7 from 'fs';
 import os5 from 'os';
 import path from 'path';
 import { spawnSync, spawn } from 'child_process';
-import { createHash } from 'crypto';
+import { randomUUID, createHash } from 'crypto';
 import { Duplex } from 'stream';
 import { StringDecoder } from 'string_decoder';
-import ssh2 from 'ssh2';
 import { setInterval as setInterval$1, clearInterval as clearInterval$1 } from 'timers';
+import { isDeepStrictEqual } from 'util';
+import { parse, TomlError } from 'smol-toml';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { z } from 'zod';
 
@@ -27,7 +28,7 @@ var CWD_MARKER = "__AKMS_SSH_CWD__";
 var MAX_DIRECTORY_ENTRIES = 1e3;
 var SERVER_NAME = "akms-mcp-ssh";
 var PACKAGE_NAME = "@akms/mcp-ssh";
-var SERVER_VERSION = "0.1.7";
+var SERVER_VERSION = "0.1.9";
 
 // src/_defs/command-rules.ts
 var CRITICAL_PATH_PATTERN = new RegExp(
@@ -613,7 +614,7 @@ function findExecutable(name) {
   for (const directory of directories) {
     for (const suffix of suffixes) {
       const candidate = path.join(directory, `${name}${suffix}`);
-      if (fs6.existsSync(candidate) == true && fs6.statSync(candidate).isFile() == true) {
+      if (fs7.existsSync(candidate) == true && fs7.statSync(candidate).isFile() == true) {
         return candidate;
       }
     }
@@ -754,7 +755,7 @@ function loadHostProfile(env = process.env) {
   if (keyPath != null) {
     const expandedKeyPath = expandHomePath(keyPath);
     profile.privateKeyPath = expandedKeyPath;
-    if (fs6.existsSync(expandedKeyPath) == false) {
+    if (fs7.existsSync(expandedKeyPath) == false) {
       _logger.warn(`${SINGLE_HOST_ENV.KEY} does not exist; connections will fail`, {
         private_key_path: expandedKeyPath
       });
@@ -786,7 +787,7 @@ function loadHostProfile(env = process.env) {
     if (jumpKeyPath != null) {
       profile.jump.privateKeyPath = expandHomePath(jumpKeyPath);
       profile.jump.passphrase = readEnv(env, SINGLE_HOST_ENV.JUMP_PASSPHRASE);
-      if (fs6.existsSync(profile.jump.privateKeyPath) == false) {
+      if (fs7.existsSync(profile.jump.privateKeyPath) == false) {
         _logger.warn(`${SINGLE_HOST_ENV.JUMP_KEY} does not exist; connections will fail`, {
           private_key_path: profile.jump.privateKeyPath
         });
@@ -1272,14 +1273,14 @@ function inspectRemotePath(remotePath, policy, access) {
 function toRealPath(inputPath) {
   const _logger = $logger.child({ context: "toRealPath" });
   try {
-    return fs6.realpathSync.native(inputPath);
+    return fs7.realpathSync.native(inputPath);
   } catch (ex) {
     _logger.debug("path does not resolve, falling back to its parent directory", {
       reason: ex instanceof Error ? ex.name : "unknown"
     });
   }
   try {
-    const parentRealPath = fs6.realpathSync.native(path.dirname(inputPath));
+    const parentRealPath = fs7.realpathSync.native(path.dirname(inputPath));
     return path.join(parentRealPath, path.basename(inputPath));
   } catch (ex) {
     _logger.debug("parent directory does not resolve either, comparing lexically", {
@@ -1351,7 +1352,6 @@ var GuardRejectionError = class extends Error {
 };
 
 // src/modules/ssh/ssh-connection.ts
-var { Client } = ssh2;
 var OUTPUT_HARD_CAP_MULTIPLIER = 4;
 var PRIVATE_KEY_CACHE = /* @__PURE__ */ new Map();
 var WINDOWS_AGENT_PIPE = "\\\\.\\pipe\\openssh-ssh-agent";
@@ -1371,7 +1371,7 @@ function readPrivateKey(label, keyPath) {
     return cached;
   }
   try {
-    const contents = fs6.readFileSync(keyPath);
+    const contents = fs7.readFileSync(keyPath);
     PRIVATE_KEY_CACHE.set(keyPath, contents);
     return contents;
   } catch (ex) {
@@ -1493,7 +1493,7 @@ function openProxyCommand(profile, hop) {
     }
   };
 }
-function openJumpTransport(profile, jump, proxy, onHostKeySeen) {
+function openJumpTransport(profile, jump, proxy, onHostKeySeen, Client) {
   const label = `${profile.name} jump host`;
   const endpoint = `${jump.username}@${jump.host}:${jump.port}`;
   const _logger = $logger.child({ context: "openJumpTransport", profile: profile.name, jump_host: jump.host });
@@ -1558,7 +1558,7 @@ function openJumpTransport(profile, jump, proxy, onHostKeySeen) {
     jumpClient.connect(jumpConfig);
   });
 }
-async function openTransport(profile, onJumpHostKeySeen) {
+async function openTransport(profile, onJumpHostKeySeen, Client) {
   let proxy = null;
   if (profile.proxyCommand != null) {
     proxy = openProxyCommand(profile, profile.jump ?? profile);
@@ -1567,7 +1567,7 @@ async function openTransport(profile, onJumpHostKeySeen) {
     return proxy;
   }
   try {
-    const jumpTransport = await openJumpTransport(profile, profile.jump, proxy, onJumpHostKeySeen);
+    const jumpTransport = await openJumpTransport(profile, profile.jump, proxy, onJumpHostKeySeen, Client);
     return jumpTransport;
   } catch (ex) {
     proxy?.close();
@@ -1631,6 +1631,11 @@ var SshConnection = class {
   get wasDropped() {
     return this.droppedAfterReady;
   }
+  assertNotDisposed() {
+    if (this.disposed == true) {
+      throw new Error(`ssh connection for '${this.profile.name}' has been closed; open a new session`);
+    }
+  }
   /**
    * Opens the connection, or joins the in-flight attempt when one is already running.
    *
@@ -1641,9 +1646,7 @@ var SshConnection = class {
    *                 unreachable, the handshake times out, or the carrier cannot be opened.
    */
   async connect(onProgress) {
-    if (this.disposed == true) {
-      throw new Error(`ssh connection for '${this.profile.name}' has been closed; open a new session`);
-    }
+    this.assertNotDisposed();
     if (this.client != null) {
       return;
     }
@@ -1662,12 +1665,14 @@ var SshConnection = class {
       this.observedFingerprint = fingerprint;
     });
     this.connecting = (async () => {
+      const { default: { Client } } = await import('ssh2');
+      this.assertNotDisposed();
       if (this.profile.jump != null || this.profile.proxyCommand != null) {
         onProgress?.("transport");
       }
       const transport = await openTransport(this.profile, (fingerprint) => {
         this.observedJumpFingerprint = fingerprint;
-      });
+      }, Client);
       if (this.disposed == true) {
         transport?.close();
         throw new Error(`ssh connection for '${this.profile.name}' was closed during the handshake`);
@@ -2326,7 +2331,7 @@ async function writeRemoteFile(connection, args) {
 }
 async function uploadFile(connection, localPath, remotePath) {
   requirePermittedPath(connection, remotePath, "write");
-  const localStats = fs6.statSync(localPath);
+  const localStats = fs7.statSync(localPath);
   if (localStats.isFile() == false) {
     throw new Error(`local path is not a file: ${localPath}`);
   }
@@ -2363,7 +2368,7 @@ async function downloadFile(connection, remotePath, localPath) {
       });
     });
   });
-  const localStats = fs6.statSync(localPath);
+  const localStats = fs7.statSync(localPath);
   const _logger = $logger.child({
     context: "downloadFile",
     profile: connection.profile.name,
@@ -3193,6 +3198,61 @@ async function runConnectionCheck(profile, output) {
   };
 }
 
+// src/modules/manage/copy-entry.ts
+async function copyEntryToClient(prompter, source, targets, name, entry) {
+  const destinations = targets.filter((target) => target.id !== source.id);
+  if (destinations.length === 0) {
+    return;
+  }
+  for (; ; ) {
+    const items = destinations.map((target) => ({
+      value: target.id,
+      key: target.id,
+      label: target.label,
+      hint: target.detected ? target.location : `${target.location} \xB7 not found on this machine`
+    }));
+    items.push({ separator: true }, { value: "back", key: "b", label: "Back" });
+    const picked = await prompter.select(`Copy ${name} to which client?`, items, { cancelValue: "back" });
+    const destination = destinations.find((target) => target.id === picked);
+    if (destination == null) {
+      return;
+    }
+    const exists = destination.hasEntry?.(name) ?? Object.hasOwn(destination.readEntries(), name);
+    if (exists) {
+      try {
+        const overwrite = await prompter.askYesNo(
+          `${name} already exists in ${destination.label} (${destination.location}). Overwrite it?`,
+          false
+        );
+        if (overwrite == false) {
+          prompter.write("  Not copied; the destination entry was kept.\n\n");
+          return;
+        }
+      } catch (ex) {
+        if (ex instanceof PromptBackError == false) {
+          throw ex;
+        }
+        continue;
+      }
+    }
+    const result = destination.writeEntry(name, {
+      command: entry.command,
+      args: [...entry.args],
+      env: { ...entry.env }
+    }, { replace: true });
+    if (result.status === "written") {
+      prompter.write(`  ${prompter.paint.success(`Copied ${name} to ${destination.label}`)} ${prompter.paint.dim(result.detail)}
+`);
+      prompter.write(prompter.paint.dim("  Restart the destination client (or reconnect it from its MCP menu) to pick up the change.\n\n"));
+    } else {
+      prompter.write(`  Not copied: ${result.detail}
+
+`);
+    }
+    return;
+  }
+}
+
 // src/modules/manage/entry.ts
 var MANAGED_ENV_NAMES = [
   SINGLE_HOST_ENV.HOST,
@@ -3423,7 +3483,7 @@ function findPrivateKeys() {
   const sshDirectory = path.join(os5.homedir(), ".ssh");
   let names = [];
   try {
-    names = fs6.readdirSync(sshDirectory);
+    names = fs7.readdirSync(sshDirectory);
   } catch {
     return [];
   }
@@ -3435,14 +3495,14 @@ function findPrivateKeys() {
     const fullPath = path.join(sshDirectory, name);
     let head = "";
     try {
-      const stat = fs6.statSync(fullPath);
+      const stat = fs7.statSync(fullPath);
       if (stat.isFile() == false || stat.size > MAX_KEY_FILE_BYTES) {
         continue;
       }
-      const descriptor = fs6.openSync(fullPath, "r");
+      const descriptor = fs7.openSync(fullPath, "r");
       const buffer = Buffer.alloc(64);
-      const bytesRead = fs6.readSync(descriptor, buffer, 0, buffer.length, 0);
-      fs6.closeSync(descriptor);
+      const bytesRead = fs7.readSync(descriptor, buffer, 0, buffer.length, 0);
+      fs7.closeSync(descriptor);
       head = buffer.subarray(0, bytesRead).toString("utf8");
     } catch {
       continue;
@@ -3454,7 +3514,7 @@ function findPrivateKeys() {
     }
     let hint = "";
     try {
-      const publicKey = fs6.readFileSync(`${fullPath}.pub`, "utf8").trim().split(/\s+/);
+      const publicKey = fs7.readFileSync(`${fullPath}.pub`, "utf8").trim().split(/\s+/);
       hint = publicKey[0].replace(/^ssh-/, "");
       if (publicKey.length > 2) {
         hint += ` \xB7 ${publicKey.slice(2).join(" ")}`;
@@ -3523,7 +3583,7 @@ async function askKeyPath(prompter, current) {
   }
   for (; ; ) {
     const typed = await prompter.askRequired("Private key path");
-    if (fs6.existsSync(expandHomePath(typed)) == true) {
+    if (fs7.existsSync(expandHomePath(typed)) == true) {
       return typed;
     }
     prompter.write(`  ${expandHomePath(typed)} does not exist.
@@ -4057,6 +4117,65 @@ async function runHostForm(prompter, output, options) {
     prompter.transient = previousTransient;
   }
 }
+function readExisting(filePath) {
+  try {
+    return fs7.readFileSync(filePath, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return null;
+    }
+    throw error;
+  }
+}
+function updateConfigFile(filePath, update) {
+  let destination = filePath;
+  let symbolicLink = false;
+  try {
+    symbolicLink = fs7.lstatSync(filePath).isSymbolicLink();
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      throw error;
+    }
+  }
+  if (symbolicLink) {
+    destination = fs7.realpathSync(filePath);
+  }
+  const before = readExisting(destination);
+  const updated = update(before ?? "");
+  if (before != null) {
+    fs7.accessSync(destination, fs7.constants.W_OK);
+  }
+  fs7.mkdirSync(path.dirname(destination), { recursive: true });
+  const temporary = path.join(path.dirname(destination), `.${path.basename(destination)}.${randomUUID()}.tmp`);
+  const mode = before == null ? 384 : fs7.statSync(destination).mode & 511;
+  let descriptor;
+  let ownsTemporary = false;
+  try {
+    descriptor = fs7.openSync(temporary, "wx", mode);
+    ownsTemporary = true;
+    fs7.writeFileSync(descriptor, updated, "utf8");
+    fs7.fsyncSync(descriptor);
+    fs7.closeSync(descriptor);
+    descriptor = void 0;
+    if (readExisting(destination) !== before) {
+      throw new Error("The config changed while saving; reload it and try again.");
+    }
+    fs7.renameSync(temporary, destination);
+    ownsTemporary = false;
+  } finally {
+    try {
+      if (descriptor != null) {
+        fs7.closeSync(descriptor);
+      }
+    } finally {
+      if (ownsTemporary) {
+        fs7.unlinkSync(temporary);
+      }
+    }
+  }
+}
+
+// src/modules/manage/targets/json-file.ts
 function toMcpServerEntry(value) {
   if (typeof value !== "object" || value == null) {
     return null;
@@ -4069,7 +4188,7 @@ function toMcpServerEntry(value) {
   if (Array.isArray(record.args) == true) {
     args = record.args.filter((item) => typeof item === "string");
   }
-  const env = {};
+  const env = /* @__PURE__ */ Object.create(null);
   if (typeof record.env === "object" && record.env != null) {
     for (const [key, item] of Object.entries(record.env)) {
       if (typeof item === "string") {
@@ -4079,16 +4198,22 @@ function toMcpServerEntry(value) {
   }
   return { command: record.command, args, env };
 }
-function readMcpServersJson(document) {
-  if (typeof document !== "object" || document == null || Array.isArray(document) == true) {
+function readRawMcpServersJson(document) {
+  if (typeof document !== "object" || document == null || Array.isArray(document)) {
     throw new Error("the config file is not a JSON object");
   }
-  const entries = {};
   const servers = document.mcpServers;
-  if (typeof servers !== "object" || servers == null) {
-    return entries;
+  if (servers === void 0) {
+    return {};
+  }
+  if (typeof servers !== "object" || servers == null || Array.isArray(servers)) {
+    throw new Error("mcpServers is not a JSON object");
   }
-  for (const [name, value] of Object.entries(servers)) {
+  return servers;
+}
+function readMcpServersJson(document) {
+  const entries = /* @__PURE__ */ Object.create(null);
+  for (const [name, value] of Object.entries(readRawMcpServersJson(document))) {
     const entry = toMcpServerEntry(value);
     if (entry != null) {
       entries[name] = entry;
@@ -4096,11 +4221,11 @@ function readMcpServersJson(document) {
   }
   return entries;
 }
-function readDocument(filePath) {
-  if (fs6.existsSync(filePath) == false) {
+function readDocument(filePath, contents) {
+  if (contents == null && fs7.existsSync(filePath) == false) {
     return {};
   }
-  const text = fs6.readFileSync(filePath, "utf8");
+  const text = contents ?? fs7.readFileSync(filePath, "utf8");
   if (text.trim() === "") {
     return {};
   }
@@ -4121,39 +4246,35 @@ function readDocument(filePath) {
 }
 function createJsonFileTarget(options) {
   const { id, label, filePath } = options;
-  function writeDocument(document) {
-    fs6.mkdirSync(path.dirname(filePath), { recursive: true });
-    fs6.writeFileSync(filePath, `${JSON.stringify(document, null, 4)}
-`, "utf8");
-  }
   return {
     id,
     label,
     location: filePath,
-    detected: fs6.existsSync(filePath),
+    detected: fs7.existsSync(filePath),
     readEntries() {
       const document = readDocument(filePath);
       return readMcpServersJson(document);
     },
+    hasEntry(name) {
+      return Object.hasOwn(readRawMcpServersJson(readDocument(filePath)), name);
+    },
     writeEntry(name, entry) {
-      const document = readDocument(filePath);
-      let servers = document.mcpServers;
-      if (typeof servers !== "object" || servers == null || Array.isArray(servers) == true) {
-        servers = {};
-      }
-      servers[name] = entry;
-      document.mcpServers = servers;
-      writeDocument(document);
+      updateConfigFile(filePath, (contents) => {
+        const document = readDocument(filePath, contents);
+        const servers = Object.assign(/* @__PURE__ */ Object.create(null), readRawMcpServersJson(document));
+        servers[name] = entry;
+        document.mcpServers = servers;
+        return JSON.stringify(document, null, 4) + "\n";
+      });
       return { status: "written", detail: filePath };
     },
     removeEntry(name) {
-      const document = readDocument(filePath);
-      const servers = document.mcpServers;
-      if (typeof servers !== "object" || servers == null || Array.isArray(servers) == true) {
-        return { status: "written", detail: filePath };
-      }
-      delete servers[name];
-      writeDocument(document);
+      updateConfigFile(filePath, (contents) => {
+        const document = readDocument(filePath, contents);
+        const servers = readRawMcpServersJson(document);
+        delete servers[name];
+        return JSON.stringify(document, null, 4) + "\n";
+      });
       return { status: "written", detail: filePath };
     }
   };
@@ -4205,11 +4326,11 @@ function runClaude(executable, args) {
   }
   return { status: "written", detail: CLAUDE_CODE_CONFIG_PATH };
 }
-function readClaudeEntries() {
-  if (fs6.existsSync(CLAUDE_CODE_CONFIG_PATH) == false) {
+function readRawClaudeEntries() {
+  if (fs7.existsSync(CLAUDE_CODE_CONFIG_PATH) == false) {
     return {};
   }
-  const text = fs6.readFileSync(CLAUDE_CODE_CONFIG_PATH, "utf8");
+  const text = fs7.readFileSync(CLAUDE_CODE_CONFIG_PATH, "utf8");
   let document;
   try {
     document = JSON.parse(text);
@@ -4220,7 +4341,7 @@ function readClaudeEntries() {
     }
     throw new Error(`${CLAUDE_CODE_CONFIG_PATH} is not valid JSON: ${detail}`);
   }
-  return readMcpServersJson(document);
+  return readRawMcpServersJson(document);
 }
 function createClaudeCodeTarget() {
   const executable = findExecutable("claude");
@@ -4228,28 +4349,35 @@ function createClaudeCodeTarget() {
     id: "claude-code",
     label: "Claude Code (user scope)",
     location: CLAUDE_CODE_CONFIG_PATH,
-    detected: executable != null || fs6.existsSync(CLAUDE_CODE_CONFIG_PATH) == true,
-    readEntries: readClaudeEntries,
+    detected: executable != null || fs7.existsSync(CLAUDE_CODE_CONFIG_PATH) == true,
+    readEntries() {
+      return readMcpServersJson({ mcpServers: readRawClaudeEntries() });
+    },
+    hasEntry(name) {
+      return Object.hasOwn(readRawClaudeEntries(), name);
+    },
     writeEntry(name, entry) {
       if (executable == null) {
         return {
           status: "unavailable",
-          detail: `the claude CLI is not on PATH \u2014 run this yourself:
-  ${formatClaudeAddCommand(name, entry)}`
+          detail: "the claude CLI is not on PATH \u2014 install it, or use Print to get a command to run yourself"
         };
       }
-      const previous = readClaudeEntries()[name];
-      if (previous != null) {
+      const previousEntries = readRawClaudeEntries();
+      const hadPrevious = Object.hasOwn(previousEntries, name);
+      const previous = previousEntries[name];
+      if (hadPrevious) {
         const removed = runClaude(executable, ["mcp", "remove", name, "-s", "user"]);
         if (removed.status === "unavailable") {
           return removed;
         }
       }
       const added = runClaude(executable, ["mcp", "add-json", name, toClaudeAddJsonPayload(entry), "-s", "user"]);
-      if (added.status === "unavailable" && previous != null) {
-        runClaude(executable, ["mcp", "add-json", name, toClaudeAddJsonPayload(previous), "-s", "user"]);
+      if (added.status === "unavailable" && hadPrevious) {
+        const restored = runClaude(executable, ["mcp", "add-json", name, JSON.stringify(previous), "-s", "user"]);
+        const recovery = restored.status === "written" ? "the previous entry was restored" : `could not restore the previous entry: ${restored.detail}`;
         return { status: "unavailable", detail: `${added.detail}
-  the previous entry was restored` };
+  ${recovery}` };
       }
       return added;
     },
@@ -4266,194 +4394,121 @@ function createClaudeCodeTarget() {
   };
 }
 
-// src/modules/manage/targets/toml-subset.ts
-var BARE_KEY_PATTERN = /^[A-Za-z0-9_-]+$/;
-var ANY_HEADER_PATTERN = /^\s*\[/;
-var SERVER_HEADER_PATTERN = /^\s*\[\s*mcp_servers\s*\.\s*([A-Za-z0-9_-]+|"(?:[^"\\]|\\.)*")\s*((?:\.[^\]]*)?)\]\s*(?:#.*)?$/;
-var KEY_VALUE_PATTERN = /^\s*([A-Za-z0-9_-]+|"(?:[^"\\]|\\.)*")\s*=\s*(.*)$/;
-var OWNED_TABLE_KEYS = ["command", "args", "env"];
-var TomlValueParser = class {
-  constructor(text) {
-    this.text = text;
-    this.position = 0;
-  }
-  parse() {
-    const value = this.parseValue();
-    return value;
-  }
-  skipWhitespace() {
-    while (this.position < this.text.length && /\s/.test(this.text[this.position]) == true) {
-      this.position += 1;
-    }
-  }
-  parseValue() {
-    this.skipWhitespace();
-    const current = this.text[this.position];
-    if (current === '"') {
-      return this.parseBasicString();
-    }
-    if (current === "'") {
-      return this.parseLiteralString();
-    }
-    if (current === "[") {
-      return this.parseArray();
-    }
-    if (current === "{") {
-      return this.parseInlineTable();
-    }
-    throw new Error(`unsupported toml value at offset ${this.position}`);
-  }
-  parseBasicString() {
-    this.position += 1;
-    let result = "";
-    while (this.position < this.text.length) {
-      const current = this.text[this.position];
-      if (current === '"') {
-        this.position += 1;
-        return result;
-      }
-      if (current !== "\\") {
-        result += current;
-        this.position += 1;
-        continue;
-      }
-      const escaped = this.text[this.position + 1];
-      this.position += 2;
-      if (escaped === "n") {
-        result += "\n";
-      } else if (escaped === "t") {
-        result += "	";
-      } else if (escaped === "r") {
-        result += "\r";
-      } else if (escaped === "u" || escaped === "U") {
-        let length = 4;
-        if (escaped === "U") {
-          length = 8;
+// src/modules/manage/targets/toml-lines.ts
+function lineState() {
+  return { quote: null, multiline: false, depth: 0 };
+}
+function scanTomlLine(line, state) {
+  for (let index = 0; index < line.length; index += 1) {
+    const character = line[index];
+    if (state.quote != null) {
+      if (character === "\\" && state.quote === '"') {
+        index += 1;
+      } else if (character === state.quote) {
+        if (!state.multiline) {
+          state.quote = null;
+        } else if (line.slice(index, index + 3) === state.quote.repeat(3)) {
+          while (line[index + 1] === character) {
+            index += 1;
+          }
+          state.quote = null;
+          state.multiline = false;
         }
-        const hex = this.text.slice(this.position, this.position + length);
-        result += String.fromCodePoint(Number.parseInt(hex, 16));
-        this.position += length;
-      } else {
-        result += escaped;
       }
+      continue;
     }
-    throw new Error("unterminated toml string");
-  }
-  parseLiteralString() {
-    const end = this.text.indexOf("'", this.position + 1);
-    if (end < 0) {
-      throw new Error("unterminated toml literal string");
+    if (character === "#") {
+      break;
     }
-    const result = this.text.slice(this.position + 1, end);
-    this.position = end + 1;
-    return result;
-  }
-  parseArray() {
-    this.position += 1;
-    const items = [];
-    for (; ; ) {
-      this.skipWhitespace();
-      if (this.position >= this.text.length) {
-        throw new Error("unterminated toml array");
-      }
-      if (this.text[this.position] === "]") {
-        this.position += 1;
-        return items;
-      }
-      items.push(this.parseValue());
-      this.skipWhitespace();
-      if (this.text[this.position] === ",") {
-        this.position += 1;
+    if (character === '"' || character === "'") {
+      state.quote = character;
+      state.multiline = line.slice(index, index + 3) === character.repeat(3);
+      if (state.multiline) {
+        index += 2;
       }
+    } else if (character === "[" || character === "{") {
+      state.depth += 1;
+    } else if (character === "]" || character === "}") {
+      state.depth -= 1;
     }
   }
-  parseInlineTable() {
-    this.position += 1;
-    const table = {};
-    for (; ; ) {
-      this.skipWhitespace();
-      if (this.position >= this.text.length) {
-        throw new Error("unterminated toml inline table");
-      }
-      if (this.text[this.position] === "}") {
-        this.position += 1;
-        return table;
-      }
-      let key;
-      if (this.text[this.position] === '"') {
-        key = this.parseBasicString();
-      } else {
-        const match = /^[A-Za-z0-9_-]+/.exec(this.text.slice(this.position));
-        if (match == null) {
-          throw new Error(`invalid inline table key at offset ${this.position}`);
-        }
-        key = match[0];
-        this.position += key.length;
-      }
-      this.skipWhitespace();
-      if (this.text[this.position] !== "=") {
-        throw new Error(`expected '=' at offset ${this.position}`);
-      }
-      this.position += 1;
-      table[key] = this.parseValue();
-      this.skipWhitespace();
-      if (this.text[this.position] === ",") {
-        this.position += 1;
-      }
-    }
+}
+function isTable(value) {
+  return value != null && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date);
+}
+function parseConfigToml(text) {
+  let document;
+  try {
+    document = parse(text, { integersAsBigInt: true });
+  } catch (error) {
+    const location = error instanceof TomlError ? ` at line ${error.line}, column ${error.column}` : "";
+    throw new Error(`Invalid TOML${location}; fix the config before changing it.`);
   }
-};
-function unquoteKey(rawKey) {
-  if (rawKey.startsWith('"') == false) {
-    return rawKey;
+  if (Object.hasOwn(document, "mcp_servers") && !isTable(document.mcp_servers)) {
+    throw new Error("mcp_servers must be a TOML table.");
   }
-  const parsed = new TomlValueParser(rawKey).parse();
-  return parsed;
+  return document;
 }
-function bracketBalance(text) {
-  let balance = 0;
-  let quote = null;
-  for (let index = 0; index < text.length; index += 1) {
-    const current = text[index];
-    if (quote != null) {
-      if (current === "\\" && quote === '"') {
-        index += 1;
-      } else if (current === quote) {
-        quote = null;
-      }
-      continue;
-    }
-    if (current === '"' || current === "'") {
-      quote = current;
-    } else if (current === "#") {
-      break;
-    } else if (current === "[" || current === "{") {
-      balance += 1;
-    } else if (current === "]" || current === "}") {
-      balance -= 1;
+function readTomlEntries(text) {
+  return readMcpServersJson({ mcpServers: parseConfigToml(text).mcp_servers ?? {} });
+}
+function hasTomlEntry(text, name) {
+  return Object.hasOwn(parseConfigToml(text).mcp_servers ?? {}, name);
+}
+function normalize(document) {
+  const servers = document.mcp_servers;
+  if (servers == null) {
+    return;
+  }
+  for (const server of Object.values(servers)) {
+    if (isTable(server) && isTable(server.env) && Object.keys(server.env).length === 0) {
+      delete server.env;
     }
   }
-  return balance;
+  if (Object.keys(servers).length === 0) {
+    delete document.mcp_servers;
+  }
 }
-function stripComment(text) {
-  let quote = null;
-  for (let index = 0; index < text.length; index += 1) {
-    const current = text[index];
-    if (quote != null) {
-      if (current === "\\" && quote === '"') {
-        index += 1;
-      } else if (current === quote) {
-        quote = null;
-      }
-      continue;
-    }
-    if (current === '"' || current === "'") {
-      quote = current;
-    } else if (current === "#") {
-      return text.slice(0, index);
-    }
+function verifyTomlEdit(before, after, name, entry) {
+  const expected = parseConfigToml(before);
+  const servers = expected.mcp_servers ?? /* @__PURE__ */ Object.create(null);
+  if (entry == null) {
+    delete servers[name];
+  } else {
+    const previous = Object.hasOwn(servers, name) && isTable(servers[name]) ? servers[name] : {};
+    Object.defineProperty(servers, name, {
+      value: Object.assign(/* @__PURE__ */ Object.create(null), previous, { command: entry.command, args: [...entry.args], env: Object.assign(/* @__PURE__ */ Object.create(null), entry.env) }),
+      configurable: true,
+      enumerable: true,
+      writable: true
+    });
+  }
+  expected.mcp_servers = servers;
+  let actual;
+  try {
+    actual = parseConfigToml(after);
+  } catch {
+    throw new Error("Cannot safely edit this TOML layout. Use [mcp_servers.<name>] tables; nothing was written.");
+  }
+  normalize(expected);
+  normalize(actual);
+  if (!isDeepStrictEqual(expected, actual)) {
+    throw new Error("Cannot safely edit this TOML layout without changing other settings; nothing was written.");
+  }
+  return after;
+}
+
+// src/modules/manage/targets/toml-subset.ts
+var BARE_KEY_PATTERN = /^[A-Za-z0-9_-]+$/;
+var ANY_HEADER_PATTERN = /^\s*\[/;
+var SERVER_HEADER_PATTERN = /^\s*\[\s*(?:mcp_servers|"mcp_servers"|'mcp_servers')\s*\.\s*([A-Za-z0-9_-]+|"(?:[^"\\]|\\.)*"|'[^']*')\s*((?:\.[^\]]*)?)\]\s*(?:#.*)?$/;
+var KEY_VALUE_PATTERN = /^\s*([A-Za-z0-9_-]+|"(?:[^"\\]|\\.)*"|'[^']*')\s*=\s*(.*)$/;
+var OWNED_TABLE_KEYS = ["command", "args", "env"];
+function unquoteKey(rawKey) {
+  if (rawKey.startsWith('"') || rawKey.startsWith("'")) {
+    return parseConfigToml(`value = ${rawKey}`).value;
   }
-  return text;
+  return rawKey;
 }
 function readStatements(body) {
   const statements = [];
@@ -4465,28 +4520,25 @@ function readStatements(body) {
       continue;
     }
     const start = index;
-    let rawValue = stripComment(match[2]);
-    let balance = bracketBalance(rawValue);
+    const state = lineState();
+    scanTomlLine(match[2], state);
     index += 1;
-    while (balance > 0 && index < body.length) {
-      const continuation = stripComment(body[index]);
-      rawValue += `
-${continuation}`;
-      balance += bracketBalance(continuation);
+    while ((state.quote != null || state.depth > 0) && index < body.length) {
+      scanTomlLine(body[index], state);
       index += 1;
     }
-    statements.push({ key: unquoteKey(match[1]), rawValue, start, end: index });
+    statements.push({ key: unquoteKey(match[1]), start, end: index });
   }
   return statements;
 }
 function splitSections(lines) {
   const sections = [{ header: null, serverName: null, subPath: "", body: [] }];
-  let balance = 0;
+  const state = lineState();
   for (const line of lines) {
     const current = sections[sections.length - 1];
-    if (balance > 0) {
+    if (state.quote != null || state.depth > 0) {
       current.body.push(line);
-      balance += bracketBalance(stripComment(line));
+      scanTomlLine(line, state);
       continue;
     }
     if (ANY_HEADER_PATTERN.test(line) == true) {
@@ -4501,73 +4553,18 @@ function splitSections(lines) {
       continue;
     }
     current.body.push(line);
-    const keyValueMatch = KEY_VALUE_PATTERN.exec(line);
-    if (keyValueMatch != null) {
-      balance = bracketBalance(stripComment(keyValueMatch[2]));
-    }
+    scanTomlLine(line, state);
   }
   return sections;
 }
-function parseStatementValue(statement) {
-  try {
-    const value = new TomlValueParser(statement.rawValue).parse();
-    return value;
-  } catch {
-    return null;
-  }
+function hasMcpServerToml(text, name) {
+  return hasTomlEntry(text, name);
 }
 function parseMcpServersToml(text) {
-  const sections = splitSections(text.split(/\r?\n/));
-  const entries = {};
-  const envTables = {};
-  for (const section of sections) {
-    if (section.serverName == null) {
-      continue;
-    }
-    if (section.subPath === "env") {
-      const envTable = {};
-      for (const statement of readStatements(section.body)) {
-        const value = parseStatementValue(statement);
-        if (typeof value === "string") {
-          envTable[statement.key] = value;
-        }
-      }
-      envTables[section.serverName] = envTable;
-      continue;
-    }
-    if (section.subPath !== "") {
-      continue;
-    }
-    let command = null;
-    let args = [];
-    const env = {};
-    for (const statement of readStatements(section.body)) {
-      const value = parseStatementValue(statement);
-      if (statement.key === "command" && typeof value === "string") {
-        command = value;
-      } else if (statement.key === "args" && Array.isArray(value) == true) {
-        args = value.filter((item) => typeof item === "string");
-      } else if (statement.key === "env" && value != null && typeof value === "object" && Array.isArray(value) == false) {
-        for (const [key, item] of Object.entries(value)) {
-          if (typeof item === "string") {
-            env[key] = item;
-          }
-        }
-      }
-    }
-    if (command != null) {
-      entries[section.serverName] = { command, args, env };
-    }
-  }
-  for (const [name, envTable] of Object.entries(envTables)) {
-    if (entries[name] != null) {
-      Object.assign(entries[name].env, envTable);
-    }
-  }
-  return entries;
+  return readTomlEntries(text);
 }
 function quoteTomlString(value) {
-  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t").replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`);
   return `"${escaped}"`;
 }
 function formatTomlKey(key) {
@@ -4611,6 +4608,11 @@ function joinSections(sections, eol) {
   return lines.join(eol);
 }
 function writeMcpServerToml(text, name, entry) {
+  parseConfigToml(text);
+  const updated = editMcpServerToml(text, name, entry);
+  return verifyTomlEdit(text, updated, name, entry);
+}
+function editMcpServerToml(text, name, entry) {
   let eol = "\n";
   if (text.includes("\r\n") == true) {
     eol = "\r\n";
@@ -4683,34 +4685,36 @@ function writeMcpServerToml(text, name, entry) {
 var CODEX_CONFIG_PATH = path.join(os5.homedir(), ".codex", "config.toml");
 function createCodexTarget() {
   function readText() {
-    if (fs6.existsSync(CODEX_CONFIG_PATH) == false) {
+    if (fs7.existsSync(CODEX_CONFIG_PATH) == false) {
       return "";
     }
-    return fs6.readFileSync(CODEX_CONFIG_PATH, "utf8");
-  }
-  function writeText(text) {
-    fs6.mkdirSync(path.dirname(CODEX_CONFIG_PATH), { recursive: true });
-    fs6.writeFileSync(CODEX_CONFIG_PATH, text, "utf8");
-    return { status: "written", detail: CODEX_CONFIG_PATH };
+    return fs7.readFileSync(CODEX_CONFIG_PATH, "utf8");
   }
   return {
     id: "codex",
     label: "Codex CLI",
     location: CODEX_CONFIG_PATH,
-    detected: findExecutable("codex") != null || fs6.existsSync(CODEX_CONFIG_PATH) == true,
+    detected: findExecutable("codex") != null || fs7.existsSync(CODEX_CONFIG_PATH) == true,
     readEntries() {
       const text = readText();
       return parseMcpServersToml(text);
     },
-    writeEntry(name, entry) {
-      const text = readText();
-      const updated = writeMcpServerToml(text, name, entry);
-      return writeText(updated);
+    hasEntry(name) {
+      return hasMcpServerToml(readText(), name);
+    },
+    writeEntry(name, entry, options) {
+      updateConfigFile(CODEX_CONFIG_PATH, (original) => {
+        let text = original;
+        if (options?.replace) {
+          text = writeMcpServerToml(text, name, null);
+        }
+        return writeMcpServerToml(text, name, entry);
+      });
+      return { status: "written", detail: CODEX_CONFIG_PATH };
     },
     removeEntry(name) {
-      const text = readText();
-      const updated = writeMcpServerToml(text, name, null);
-      return writeText(updated);
+      updateConfigFile(CODEX_CONFIG_PATH, (text) => writeMcpServerToml(text, name, null));
+      return { status: "written", detail: CODEX_CONFIG_PATH };
     }
   };
 }
@@ -4918,13 +4922,14 @@ function buildHostItems(names, entries) {
     };
   });
 }
-async function manageHost(prompter, output, target, entries, name) {
+async function manageHost(prompter, output, target, targets, entries, name) {
   const action = await prompter.select(
     name,
     [
       { value: "edit", key: "e", label: "Edit", hint: "open its settings" },
       { value: "check", key: "c", label: "Check the connection", hint: "connect now and offer to pin the host key" },
       { value: "print", key: "p", label: "Print the entry", hint: "JSON, Codex TOML and a claude command, ready to paste" },
+      ...targets.some((candidate) => candidate.id !== target.id) ? [{ value: "copy", key: "o", label: "Copy to another client", hint: "keep this entry and copy its settings" }] : [],
       { value: "remove", key: "r", label: "Remove", hint: `from ${target.label}` },
       { separator: true },
       { value: "back", key: "b", label: "Back" }
@@ -4943,6 +4948,10 @@ async function manageHost(prompter, output, target, entries, name) {
     printHost(prompter, name, entries[name]);
     return;
   }
+  if (action === "copy") {
+    await copyEntryToClient(prompter, target, targets, name, entries[name]);
+    return;
+  }
   if (action === "remove") {
     const remove = await prompter.askYesNo(`Remove ${name} from ${target.location}?`, false);
     if (remove == true) {
@@ -5044,7 +5053,7 @@ ${paint.bold(target.label)}  ${paint.dim(target.location)}
           continue;
         }
         if (picked.startsWith(HOST_VALUE_PREFIX) == true) {
-          await manageHost(prompter, output, target, entries, picked.slice(HOST_VALUE_PREFIX.length));
+          await manageHost(prompter, output, target, targets, entries, picked.slice(HOST_VALUE_PREFIX.length));
         }
       } catch (ex) {
         if (ex instanceof PromptClosedError) {
@@ -5497,7 +5506,7 @@ ${file.content}`);
         const { profile, session: openSession } = resolveProfile(context, { session });
         const resolvedLocalPath = expandHomePath(localPath);
         requirePermittedLocalPath(resolvedLocalPath, "read");
-        if (fs6.existsSync(resolvedLocalPath) == false) {
+        if (fs7.existsSync(resolvedLocalPath) == false) {
           return textResult(`local file not found: ${resolvedLocalPath}`);
         }
         const transferredBytes = await withHostConnection(profile, openSession, async (connection) => {
@@ -5537,7 +5546,7 @@ ${file.content}`);
         const { profile, session: openSession } = resolveProfile(context, { session });
         const resolvedLocalPath = expandHomePath(localPath);
         requirePermittedLocalPath(resolvedLocalPath, "write");
-        fs6.mkdirSync(path.dirname(resolvedLocalPath), { recursive: true });
+        fs7.mkdirSync(path.dirname(resolvedLocalPath), { recursive: true });
         const transferredBytes = await withHostConnection(profile, openSession, async (connection) => {
           return await downloadFile(connection, remotePath, resolvedLocalPath);
         });