@akms/mcp 0.2.1 → 0.3.2

package/lib/cli.js

@@ -44,7 +44,12 @@ function parseArguments(argv) {
       commandSeen = true;
       continue;
     }
-    if (Object.hasOwn(MCP_PACKAGES, argument) == true && parsed.mcpId == null) {
+    if ((argument === "register" || argument === "sync") && !commandSeen && !parsed.mcpId) {
+      commandSeen = true;
+      parsed.managementMode = argument;
+      continue;
+    }
+    if (Object.hasOwn(MCP_PACKAGES, argument) == true && parsed.mcpId == null && !parsed.managementMode) {
       parsed.mcpId = argument;
       continue;
     }
@@ -53,6 +58,217 @@ function parseArguments(argv) {
   return parsed;
 }
 
+// src/modules/registration/registry.ts
+import fs4 from "fs";
+import path5 from "path";
+import { createHash } from "crypto";
+
+// src/modules/registration/config-file.ts
+import fs from "fs";
+import path from "path";
+import { randomUUID } from "crypto";
+function readExisting(filePath) {
+  try {
+    return fs.readFileSync(filePath, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return null;
+    }
+    throw error;
+  }
+}
+function updateConfigFile(filePath, update, options = {}) {
+  let destination = filePath;
+  let symbolicLink = false;
+  try {
+    symbolicLink = fs.lstatSync(filePath).isSymbolicLink();
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      throw error;
+    }
+  }
+  if (symbolicLink) {
+    destination = fs.realpathSync(filePath);
+  }
+  const before = readExisting(destination);
+  const updated = update(before ?? "");
+  if (before === updated) return;
+  if (before != null) {
+    fs.accessSync(destination, fs.constants.W_OK);
+  }
+  fs.mkdirSync(path.dirname(destination), { recursive: true });
+  const temporary = path.join(path.dirname(destination), `.${path.basename(destination)}.${randomUUID()}.tmp`);
+  const mode = options.mode ?? (before == null ? 384 : fs.statSync(destination).mode & 511);
+  let descriptor;
+  let ownsTemporary = false;
+  try {
+    descriptor = fs.openSync(temporary, "wx", mode);
+    ownsTemporary = true;
+    fs.writeFileSync(descriptor, updated, "utf8");
+    fs.fsyncSync(descriptor);
+    fs.closeSync(descriptor);
+    descriptor = void 0;
+    if (readExisting(destination) !== before) {
+      throw new Error("The config changed while saving; reload it and try again.");
+    }
+    options.beforeCommit?.(before);
+    if (readExisting(destination) !== before) throw new Error("The config changed while saving; reload it and try again.");
+    fs.renameSync(temporary, destination);
+    ownsTemporary = false;
+  } finally {
+    try {
+      if (descriptor != null) {
+        fs.closeSync(descriptor);
+      }
+    } finally {
+      if (ownsTemporary) {
+        fs.unlinkSync(temporary);
+      }
+    }
+  }
+}
+
+// src/modules/registration/types.ts
+var CLIENT_LABELS2 = {
+  "claude-code": "Claude Code",
+  codex: "Codex",
+  "claude-desktop": "Claude Desktop",
+  cursor: "Cursor"
+};
+var KINDS = ["db", "ssh", "wsl", "s3"];
+
+// src/modules/registration/runtime.ts
+import fs2 from "fs";
+import os from "os";
+import path2 from "path";
+import { execFile } from "child_process";
+import { promisify, stripVTControlCharacters } from "util";
+var packageName = (kind) => `@akms/mcp-${kind}`;
+var binary = (command) => command.replace(/\\/g, "/").split("/").pop().toLowerCase();
+function runtimePrefix() {
+  return path2.join(process.env.AKMS_MCP_HOME ? path2.resolve(process.env.AKMS_MCP_HOME) : path2.join(os.homedir(), ".akms", "mcp"), "runtime");
+}
+function runtimeRoot(prefix = runtimePrefix(), platform = process.platform) {
+  return path2.join(prefix, ...platform === "win32" ? [] : ["lib"], "node_modules");
+}
+var runtimeInstallCommand = (kind) => `npm install --global --prefix "${runtimePrefix()}" ${packageName(kind)}@latest`;
+async function latestRuntimeVersion(kind, timeoutMs = 6e3) {
+  try {
+    const { stdout } = await promisify(execFile)(process.execPath, [npmCli(), "view", `${packageName(kind)}@latest`, "version", "--json", "--prefer-online", "--fetch-retries=0", "--fetch-timeout=4000"], {
+      windowsHide: true,
+      timeout: timeoutMs,
+      maxBuffer: 65536
+    });
+    const version = JSON.parse(stdout);
+    return typeof version === "string" && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(version) ? version : null;
+  } catch {
+    return null;
+  }
+}
+function runtimeIsOlder(installed, current) {
+  const parse2 = (value) => /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
+  const left = parse2(installed), right = parse2(current);
+  if (!left || !right) return false;
+  for (let index = 1; index <= 3; index++) {
+    if (BigInt(left[index]) !== BigInt(right[index])) return BigInt(left[index]) < BigInt(right[index]);
+  }
+  if (!left[4] || !right[4]) return Boolean(left[4] && !right[4]);
+  const a = left[4].split("."), b = right[4].split(".");
+  for (let index = 0; index < Math.max(a.length, b.length); index++) {
+    if (a[index] === b[index]) continue;
+    if (a[index] === void 0 || b[index] === void 0) return a[index] === void 0;
+    const numericA = /^\d+$/.test(a[index]), numericB = /^\d+$/.test(b[index]);
+    if (numericA && numericB) return BigInt(a[index]) < BigInt(b[index]);
+    if (numericA !== numericB) return numericA;
+    return a[index] < b[index];
+  }
+  return false;
+}
+function launchKind(entry) {
+  for (const kind of KINDS) {
+    if (new RegExp(`^akms-mcp-${kind}(?:\\.cmd|\\.exe)?$`).test(binary(entry.command)) || entry.args.some((arg) => new RegExp(`^@akms/mcp-${kind}(?:@[^\\s]+)?$`).test(arg))) return kind;
+    if (/^(node|nodejs)(\.exe)?$/.test(binary(entry.command)) && entry.args[0]?.replace(/\\/g, "/").endsWith(`/node_modules/@akms/mcp-${kind}/lib/cli.js`)) return kind;
+  }
+  return null;
+}
+function standardLaunch(entry, kind) {
+  if (launchKind(entry) !== kind) return false;
+  const command = binary(entry.command);
+  if (/^(node|nodejs)(\.exe)?$/.test(command)) return entry.args.length === 1 && entry.args[0].replace(/\\/g, "/").endsWith(`/node_modules/@akms/mcp-${kind}/lib/cli.js`);
+  if (new RegExp(`^akms-mcp-${kind}(?:\\.cmd|\\.exe)?$`).test(command)) return entry.args.length === 0;
+  let args = entry.args;
+  if (command === "cmd" || command === "cmd.exe") {
+    if (args[0]?.toLowerCase() !== "/c" || !/^npx(?:\.cmd)?$/i.test(args[1] ?? "")) return false;
+    args = args.slice(2);
+  } else if (!/^npx(?:\.cmd)?$/.test(command)) return false;
+  return args.length === 2 && ["-y", "--yes"].includes(args[0]) && new RegExp(`^@akms/mcp-${kind}(?:@[^\\s]+)?$`).test(args[1]);
+}
+function catalogLaunch(entry, kind = launchKind(entry)) {
+  return !!kind && entry.args.length === 2 && entry.args[1] === "--catalog" && standardLaunch({ ...entry, args: entry.args.slice(0, 1) }, kind);
+}
+function npmCli() {
+  const candidates = [
+    path2.join(path2.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js"),
+    path2.join(path2.dirname(process.execPath), "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
+  ];
+  if (process.env.npm_execpath && /^(npm|npx)-cli\.js$/.test(path2.basename(process.env.npm_execpath))) {
+    candidates.unshift(path2.join(path2.dirname(process.env.npm_execpath), "npm-cli.js"));
+  }
+  for (const folder of (process.env.PATH ?? "").split(path2.delimiter).filter(Boolean)) {
+    candidates.push(process.platform === "win32" ? path2.join(folder, "node_modules", "npm", "bin", "npm-cli.js") : path2.join(folder, "npm"));
+  }
+  for (const file of candidates) {
+    try {
+      const resolved = fs2.realpathSync(file);
+      if (resolved.endsWith(".js") && fs2.statSync(resolved).isFile()) return resolved;
+    } catch {
+    }
+  }
+  throw new Error("npm was not found. Install Node.js with npm, then reopen configuration.");
+}
+function findGlobalRuntime(kind, root) {
+  try {
+    const directory = path2.join(root ?? runtimeRoot(), "@akms", `mcp-${kind}`);
+    const metadata = JSON.parse(fs2.readFileSync(path2.join(directory, "package.json"), "utf8"));
+    const bin = typeof metadata.bin === "string" ? metadata.bin : metadata.bin?.[`akms-mcp-${kind}`];
+    const script = path2.join(directory, "lib", "cli.js");
+    if (metadata.name !== packageName(kind) || !["lib/cli.js", "./lib/cli.js"].includes(bin) || typeof metadata.version !== "string" || !fs2.statSync(script).isFile()) return null;
+    return { command: process.execPath, args: [script], version: metadata.version, linked: fs2.lstatSync(directory).isSymbolicLink() };
+  } catch {
+    return null;
+  }
+}
+async function installGlobalRuntime(kind) {
+  const cancellation = new AbortController();
+  const cancel = () => cancellation.abort();
+  process.on("SIGINT", cancel);
+  process.on("SIGTERM", cancel);
+  try {
+    await promisify(execFile)(process.execPath, [npmCli(), "install", "--global", "--prefix", runtimePrefix(), "--prefer-online", "--no-fund", "--no-audit", `${packageName(kind)}@latest`], {
+      windowsHide: true,
+      timeout: 18e4,
+      maxBuffer: 1024 * 1024,
+      signal: cancellation.signal,
+      cwd: os.homedir()
+    });
+  } catch (error) {
+    if (cancellation.signal.aborted) throw new Error("AKMS runtime installation cancelled.");
+    const stderr = error.stderr;
+    const detail = stripVTControlCharacters(typeof stderr === "string" ? stderr : error instanceof Error ? error.message : "").replace(/[\x00-\x08\x0b-\x1f\x7f]/g, "").trim().split(/\r?\n/).slice(-6).map((line) => line.slice(0, 500)).join("\n");
+    throw new Error(`AKMS runtime installation failed. Run ${runtimeInstallCommand(kind)} in your terminal and retry.${detail ? `
+
+${detail}` : ""}`);
+  } finally {
+    process.off("SIGINT", cancel);
+    process.off("SIGTERM", cancel);
+  }
+}
+
+// src/modules/registration/startup-check.ts
+import { spawn, execFile as execFile2 } from "child_process";
+import path3 from "path";
+import { stripVTControlCharacters as stripVTControlCharacters2 } from "util";
+
 // src/modules/launcher/prompter.ts
 var PromptClosedError = class extends Error {
   constructor() {
@@ -157,12 +373,14 @@ function createStyle(enabled) {
   return {
     accent: paint(36, 39),
     success: paint(32, 39),
+    warning: paint(33, 39),
+    error: paint(31, 39),
     dim: paint(2, 22),
     bold: paint(1, 22)
   };
 }
 var Prompter = class {
-  constructor(input, output) {
+  constructor(input, output, initialInput = "") {
     this.input = input;
     this.output = output;
     const ttyInput = input;
@@ -178,6 +396,7 @@ var Prompter = class {
     input.setEncoding("utf8");
     input.on("data", this.onInputData);
     input.on("end", this.onInputEnd);
+    if (initialInput) this.onData(initialInput);
   }
   input;
   output;
@@ -220,6 +439,79 @@ var Prompter = class {
     this.lineBuffer = "";
     return text;
   }
+  get paint() {
+    return this.style;
+  }
+  /** Available content columns, leaving room for the terminal cursor. */
+  get width() {
+    return this.columns() - 1;
+  }
+  /** Start a fresh terminal page without erasing scrollback or emitting ANSI to pipes. */
+  clearScreen() {
+    if (this.interactive) this.output.write(`${ESC}[2J${ESC}[H`);
+  }
+  /** Keep results visible before navigating; Esc acknowledges them like Enter. */
+  async acknowledge() {
+    try {
+      await this.pause();
+    } catch (error) {
+      if (!(error instanceof PromptBackError)) throw error;
+    }
+  }
+  async pause() {
+    if (this.interactive) await this.readText("Press Enter to continue ");
+  }
+  write(text) {
+    this.output.write(text);
+  }
+  async askRequired(question, defaultValue) {
+    for (; ; ) {
+      const answer = (await this.readText(`${question}${defaultValue ? ` (${defaultValue})` : ""}: `)).trim() || defaultValue;
+      if (answer) return answer;
+      this.write("  A value is required.\n");
+    }
+  }
+  async askYesNo(question, defaultValue) {
+    for (; ; ) {
+      const answer = (await this.readText(`${question} (${defaultValue ? "Y/n" : "y/N"}): `)).trim().toLowerCase();
+      if (!answer) return defaultValue;
+      if (answer === "y" || answer === "yes") return true;
+      if (answer === "n" || answer === "no") return false;
+      this.write("  Enter y or n.\n");
+    }
+  }
+  async readText(prompt) {
+    this.input.resume();
+    this.output.write(prompt);
+    if (!this.interactive) {
+      const line = await this.readLine();
+      if (line == null) throw new PromptClosedError();
+      if (line === "ESC" || line === ESC) throw new PromptBackError();
+      return line;
+    }
+    if (this.inputEnded) throw new PromptClosedError();
+    this.input.setRawMode?.(true);
+    this.output.write(`${ESC}[?25h`);
+    return new Promise((resolve, reject) => {
+      let text = "";
+      const finish = (error) => {
+        this.keyHandler = null;
+        this.input.setRawMode?.(false);
+        this.output.write("\n");
+        if (error) reject(error);
+        else resolve(text);
+      };
+      this.keyHandler = (key) => {
+        if (key === KEY_CTRL_C || key === KEY_CTRL_D) return finish(new PromptClosedError());
+        if (key === ESC) return finish(new PromptBackError());
+        if (key === "\r" || key === "\n") return finish();
+        if (key === "\b" || key === "\x7F") text = Array.from(text).slice(0, -1).join("");
+        else if (key === "") text = "";
+        else if (!/[\x00-\x1f\x7f]/.test(key)) text += key;
+        this.output.write(`\r${ESC}[K${prompt}${text}`);
+      };
+    });
+  }
   /**
    * Picks one of `items`. On a TTY: ↑/↓ move, 1–9 jump, Enter picks, Esc goes back. Off a
    * TTY: a numbered list, answered by number, key or label.
@@ -486,193 +778,2468 @@ var Prompter = class {
   }
 };
 
-// src/modules/launcher/menu.ts
-async function runMenu(options) {
-  let targetId = options.targetId;
-  let defaultValue = "db";
-  for (; ; ) {
-    const prompter = new Prompter(options.input, options.output);
-    let selected = "quit";
-    try {
-      for (; ; ) {
-        let clientLabel = "Automatically selected by each MCP";
-        if (targetId != null) {
-          clientLabel = CLIENT_LABELS[targetId];
-        }
-        const picked = await prompter.select("AKMS MCP \xB7 Connection setup", [
-          { value: "db", label: "Database", hint: "PostgreSQL connections" },
-          { value: "ssh", label: "SSH", hint: "Remote hosts" },
-          { value: "wsl", label: "WSL", hint: "Local Linux distros \xB7 Windows" },
-          { value: "s3", label: "S3", hint: "AWS S3 and S3-compatible buckets" },
-          { separator: true },
-          { value: "client", label: "Client", hint: clientLabel },
-          { value: "quit", label: "Quit" }
-        ], { defaultValue, cancelValue: "quit" });
-        if (picked !== "client") {
-          selected = picked;
-          break;
-        }
-        const clients = [
-          { value: "auto", label: "Automatic", hint: "Let each MCP detect the client" },
-          { value: "claude-code", label: CLIENT_LABELS["claude-code"] },
-          { value: "codex", label: CLIENT_LABELS.codex },
-          { value: "claude-desktop", label: CLIENT_LABELS["claude-desktop"] },
-          { value: "cursor", label: CLIENT_LABELS.cursor },
-          { separator: true },
-          { value: "back", label: "Back" }
-        ];
-        const client = await prompter.select("Client", clients, { defaultValue: targetId ?? "auto", cancelValue: "back" });
-        if (client === "auto") {
-          targetId = void 0;
-        } else if (client !== "back") {
-          targetId = client;
-        }
-      }
-    } catch (error) {
-      if (error instanceof PromptClosedError) {
-        return 0;
-      }
-      throw error;
-    } finally {
-      prompter.close();
+// src/modules/registration/comparison.ts
+var visibleField = /^(DB_DRIVER|DB_HOST|DB_PORT|DB_NAME|DB_USER|DB_SSL|DB_DESCRIPTION|SSH_HOST|SSH_PORT|SSH_USER|SSH_DESCRIPTION|WSL_DISTRO|WSL_USER|WSL_DESCRIPTION|S3_BACKEND|S3_BUCKET|S3_REGION|S3_PREFIX|S3_AUTH|S3_DESCRIPTION)$/;
+var plainText = (value) => value.replace(/[\x00-\x1f\x7f]/g, " ");
+function descriptionOnly(entries) {
+  const fields = differingFields(entries);
+  return fields.length > 0 && fields.every((field) => /^env\.(DB|SSH|WSL|S3)_DESCRIPTION$/.test(field));
+}
+var fieldName = (field) => {
+  const key = field.replace(/^env\./, "");
+  if (/^(DB|SSH|WSL|S3)_DESCRIPTION$/.test(key)) return "Description";
+  const names = { command: "Launch command", args: "Launch arguments", DB_HOST: "Host", SSH_HOST: "Host", DB_PORT: "Port", SSH_PORT: "Port", DB_NAME: "Database", DB_USER: "User", SSH_USER: "User", WSL_USER: "User", WSL_DISTRO: "Linux distribution", S3_BUCKET: "Bucket", S3_REGION: "Region", S3_PREFIX: "Key prefix" };
+  return Object.hasOwn(names, key) ? names[key] : plainText(key);
+};
+function writeWrapped(prompter, text, indent = "", changed, style) {
+  const characters = Array.from(plainText(text));
+  let line = indent;
+  let width = displayWidth(indent);
+  let segment = "";
+  let highlighted = false;
+  const flush = () => {
+    line += highlighted ? prompter.paint.accent(prompter.paint.bold(segment)) : segment;
+    segment = "";
+  };
+  for (let index = 0; index < characters.length; index++) {
+    const character = characters[index];
+    const size = displayWidth(character);
+    if (width + size > prompter.width) {
+      flush();
+      prompter.write((style ? style(line) : line) + "\n");
+      line = indent;
+      width = displayWidth(indent);
     }
-    if (selected === "quit") {
-      return 0;
+    const highlight = !!changed && index >= changed[0] && index < changed[1];
+    if (highlight !== highlighted) {
+      flush();
+      highlighted = highlight;
     }
-    defaultValue = selected;
-    try {
-      const code = await options.launch({ mcpId: selected, targetId, pendingInput: prompter.takePendingInput() });
-      if (code === 130) {
-        return 0;
+    segment += character;
+    width += size;
+  }
+  flush();
+  prompter.write((style ? style(line) : line) + "\n");
+}
+function changedRange(values, index) {
+  if (values.length !== 2 || values[0] === values[1]) return void 0;
+  const current = Array.from(values[index]);
+  const other = Array.from(values[1 - index]);
+  let start = 0, end = current.length, otherEnd = other.length;
+  while (start < end && start < otherEnd && current[start] === other[start]) start++;
+  while (end > start && otherEnd > start && current[end - 1] === other[otherEnd - 1]) {
+    end--;
+    otherEnd--;
+  }
+  return [start, end];
+}
+function compareEntries(prompter, versions) {
+  const entries = versions.map((version) => version.entry);
+  const fields = differingFields(entries);
+  writeWrapped(prompter, descriptionOnly(entries) ? "Description differs. Connection settings match." : `${fields.length} setting(s) differ.`);
+  const values = fields.map((field) => {
+    const key = field.replace(/^env\./, "");
+    return versions.map(({ entry }) => field.startsWith("env.") && visibleField.test(key) ? Object.hasOwn(entry.env, key) ? plainText(entry.env[key]) || "(empty)" : "(not set)" : "(hidden)");
+  });
+  if (versions.length === 2 && prompter.width >= 90) {
+    const width = Math.floor((prompter.width - 3) / 2);
+    const wrap = (value, changed) => {
+      const lines = [{ text: "", width: 0 }];
+      for (const [index, character] of Array.from(value).entries()) {
+        const size = displayWidth(character);
+        if (lines[lines.length - 1].width + size > width) lines.push({ text: "", width: 0 });
+        const line = lines[lines.length - 1];
+        line.text += changed && index >= changed[0] && index < changed[1] ? prompter.paint.accent(prompter.paint.bold(character)) : character;
+        line.width += size;
       }
-      if (code !== 0) {
-        options.output.write(`
-Setup exited with code ${code}.
-
+      return lines;
+    };
+    const row = (left, right) => {
+      for (let line = 0; line < Math.max(left.length, right.length); line++) {
+        prompter.write(`${left[line]?.text ?? ""}${" ".repeat(width - (left[line]?.width ?? 0))} | ${right[line]?.text ?? ""}
 `);
       }
-    } catch (error) {
-      options.output.write(`
-${String(error)}
-
+    };
+    prompter.write("\n");
+    row(wrap(`[1] ${plainText(versions[0].label)}`), wrap(`[2] ${plainText(versions[1].label)}`));
+    for (let field = 0; field < fields.length; field++) {
+      prompter.write(`
+${prompter.paint.dim(fieldName(fields[field]))}
 `);
+      row(wrap(values[field][0], changedRange(values[field], 0)), wrap(values[field][1], changedRange(values[field], 1)));
+    }
+    if (values.some((row2) => row2.includes("(hidden)"))) prompter.write(prompter.paint.dim("\nSecret values are hidden.\n"));
+    prompter.write("\n");
+    return;
+  }
+  for (let index = 0; index < versions.length; index++) {
+    prompter.write("\n");
+    writeWrapped(prompter, `[${index + 1}] ${versions[index].label}`);
+    for (let field = 0; field < fields.length; field++) {
+      writeWrapped(prompter, fieldName(fields[field]), "  ");
+      writeWrapped(prompter, values[field][index], "    ", changedRange(values[field], index));
     }
   }
+  if (values.some((row) => row.includes("(hidden)"))) prompter.write("\nSecret values are hidden.\n");
+  prompter.write("\n");
 }
 
-// src/modules/launcher/npm.ts
-import { execFile, spawn } from "child_process";
-import { existsSync } from "fs";
-import { mkdtemp, realpath, rm } from "fs/promises";
-import { tmpdir } from "os";
-import { basename, delimiter, dirname, join } from "path";
-import { promisify } from "util";
-var execFileAsync = promisify(execFile);
-async function findNpmCli() {
-  const candidates = [];
-  const npmExecPath = process.env.npm_execpath;
-  if (npmExecPath != null && ["npm-cli.js", "npx-cli.js"].includes(basename(npmExecPath)) == true) {
-    candidates.push(join(dirname(npmExecPath), "npm-cli.js"));
+// src/modules/registration/startup-check.ts
+function visibleRuntimePath(entry) {
+  const kind = launchKind(entry);
+  return kind && standardLaunch({ ...entry, args: entry.args.slice(0, 1) }, kind) && (entry.args.length === 1 || entry.args.length === 2 && entry.args[1] === "--catalog") ? entry.args[0] : void 0;
+}
+function redactStartupText(text, entry) {
+  const normalize2 = (value) => stripVTControlCharacters2(value).replace(/[\x00-\x08\x0b-\x1f\x7f]/g, "");
+  const direct = visibleRuntimePath(entry);
+  const privateValues = [...Object.entries(entry.env).filter(([key]) => !visibleField.test(key)).map(([, value]) => value), ...entry.args.slice(direct ? 1 : 0)];
+  const secrets = /* @__PURE__ */ new Set();
+  for (const value of privateValues) {
+    if (!value) continue;
+    secrets.add(value);
+    const values = [value];
+    if (value.includes("=")) values.push(value.slice(value.indexOf("=") + 1));
+    for (const candidate of values) {
+      secrets.add(candidate);
+      try {
+        const url = new URL(candidate);
+        if (url.password) {
+          secrets.add(url.password);
+          secrets.add(decodeURIComponent(url.password));
+        }
+      } catch {
+      }
+    }
   }
-  candidates.push(join(dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js"));
-  for (const directory of (process.env.PATH ?? "").split(delimiter)) {
-    if (directory === "") {
-      continue;
+  for (const value of [...secrets]) {
+    if (!value) continue;
+    secrets.add(JSON.stringify(value).slice(1, -1));
+    secrets.add(encodeURIComponent(value));
+  }
+  for (const value of [...secrets]) secrets.add(normalize2(value));
+  let result = normalize2(text);
+  for (const value of [...secrets].filter(Boolean).sort((a, b) => b.length - a.length)) result = result.split(value).join("(hidden)");
+  return result;
+}
+async function checkStartup(entry, timeoutMs = 1e4) {
+  return new Promise((resolve) => {
+    const inherited = process.platform === "win32" ? ["APPDATA", "LOCALAPPDATA", "HOMEDRIVE", "HOMEPATH", "PATH", "SYSTEMROOT", "SYSTEMDRIVE", "TEMP", "TMP", "USERPROFILE", "PROGRAMFILES"] : ["HOME", "LOGNAME", "PATH", "SHELL", "TERM", "USER", "TMPDIR"];
+    const env = Object.fromEntries(inherited.filter((key) => process.env[key] !== void 0).map((key) => [key, process.env[key]]));
+    let stderr = "", stderrOmitted = false, output = "", bytes = 0, done = false, closing = false, detail;
+    let server, version, tools = 0, expected = 1, pages = 0;
+    const toolNames = [];
+    let timer, killTimer, endTimer;
+    let child;
+    const result = (code, signal) => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      clearTimeout(killTimer);
+      clearTimeout(endTimer);
+      const clean = (value) => redactStartupText(value, entry);
+      const ok = !detail && closing && code === 0;
+      const runtime = visibleRuntimePath(entry);
+      const failure = detail ?? (code !== 0 ? `Exited ${code ?? signal ?? "without an exit code"}.` : "Startup check did not finish.");
+      resolve({
+        ok,
+        server: server && clean(server).slice(0, 200),
+        version: version && clean(version).slice(0, 100),
+        tools,
+        toolNames: toolNames.map(clean),
+        exitCode: code,
+        detail: ok ? void 0 : clean(`${failure}${runtime ? ` Runtime: ${runtime}` : ""}`).slice(0, 2e3),
+        stderr: clean(stderr).trim().split(/\r?\n/).filter(Boolean).slice(-6).map((line) => line.slice(0, 500))
+      });
+    };
+    const stop = (reason) => {
+      if (closing || done) return;
+      closing = true;
+      detail = reason;
+      clearTimeout(timer);
+      child.stdin?.end();
+      killTimer = setTimeout(() => {
+        if (process.platform === "win32" && child.pid) {
+          execFile2(path3.join(process.env.SYSTEMROOT ?? "C:\\Windows", "System32", "taskkill.exe"), ["/PID", String(child.pid), "/T", "/F"], { windowsHide: true, timeout: 4e3 }, () => {
+          });
+        } else if (child.pid) {
+          try {
+            process.kill(-child.pid, "SIGKILL");
+          } catch {
+            child.kill("SIGKILL");
+          }
+        }
+        endTimer = setTimeout(() => {
+          child.kill("SIGKILL");
+          child.stdout?.destroy();
+          child.stderr?.destroy();
+          child.unref();
+          result(null);
+        }, 4500);
+      }, 500);
+    };
+    try {
+      child = spawn(entry.command, entry.args, { env: { ...env, ...entry.env }, shell: false, windowsHide: true, detached: process.platform !== "win32", stdio: "pipe" });
+    } catch (error) {
+      detail = error instanceof Error ? error.message : "Unable to start process.";
+      result(null);
+      return;
     }
-    if (process.platform === "win32") {
-      candidates.push(join(directory, "node_modules", "npm", "bin", "npm-cli.js"));
-    } else {
-      candidates.push(join(directory, "npm"));
+    timer = setTimeout(() => stop(`Timed out after ${timeoutMs} ms.`), timeoutMs);
+    const send = (message) => child.stdin?.write(JSON.stringify(message) + "\n");
+    child.on("error", (error) => {
+      detail = `Unable to start ${entry.command} (${error.code ?? "error"}).`;
+      closing = true;
+      result(null);
+    });
+    child.on("close", (code, signal) => {
+      if (!closing) detail ??= "Process exited before initialize and tools/list completed.";
+      result(code, signal);
+    });
+    child.stdin?.on("error", () => {
+      if (!closing) stop("Server closed its input before the startup check completed.");
+    });
+    child.stderr?.setEncoding("utf8");
+    child.stderr?.on("data", (chunk) => {
+      if (stderrOmitted) return;
+      stderr += chunk;
+      if (stderr.length > 65536) {
+        stderrOmitted = true;
+        stderr = "[stderr exceeded the diagnostic limit; output omitted]";
+        stop("Too much stderr output.");
+      }
+    });
+    child.stdout?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk) => {
+      if (closing || done) return;
+      bytes += Buffer.byteLength(chunk);
+      if (bytes > 2 * 1024 * 1024) {
+        stop("MCP response exceeded the startup check limit.");
+        return;
+      }
+      output += chunk;
+      let newline;
+      while (!closing && (newline = output.indexOf("\n")) >= 0) {
+        const line = output.slice(0, newline);
+        output = output.slice(newline + 1);
+        try {
+          const message = JSON.parse(line);
+          if (message?.jsonrpc !== "2.0") throw new Error();
+          if (message.method) {
+            if (message.id !== void 0) send(message.method === "ping" ? { jsonrpc: "2.0", id: message.id, result: {} } : { jsonrpc: "2.0", id: message.id, error: { code: -32601, message: "Not supported by startup check" } });
+            continue;
+          }
+          if (message.id !== expected) continue;
+          if (message.error) {
+            stop(`MCP request failed: ${typeof message.error.message === "string" ? message.error.message : "server error"}`);
+            break;
+          }
+          if (expected === 1) {
+            if (typeof message.result?.protocolVersion !== "string" || typeof message.result?.serverInfo?.name !== "string" || typeof message.result?.serverInfo?.version !== "string") throw new Error();
+            server = message.result.serverInfo.name;
+            version = message.result.serverInfo.version;
+            send({ jsonrpc: "2.0", method: "notifications/initialized" });
+            send({ jsonrpc: "2.0", id: ++expected, method: "tools/list", params: {} });
+          } else {
+            if (!Array.isArray(message.result?.tools) || !message.result.tools.every((tool) => typeof tool?.name === "string")) throw new Error();
+            tools += message.result.tools.length;
+            toolNames.push(...message.result.tools.map((tool) => tool.name));
+            if (message.result.nextCursor !== void 0) {
+              if (typeof message.result.nextCursor !== "string" || ++pages > 100) throw new Error();
+              send({ jsonrpc: "2.0", id: ++expected, method: "tools/list", params: { cursor: message.result.nextCursor } });
+            } else stop();
+          }
+        } catch {
+          stop("Invalid MCP response on stdout.");
+        }
+      }
+    });
+    child.once("spawn", () => send({ jsonrpc: "2.0", id: 1, method: "initialize", params: { protocolVersion: "2025-06-18", capabilities: {}, clientInfo: { name: "akms-startup-check", version: "1.0.0" } } }));
+  });
+}
+async function checkConnections(prompter, entries, check = checkStartup) {
+  if (!entries.length) return;
+  prompter.write("\nStartup check (initialize and tools/list only)\n");
+  const checked = /* @__PURE__ */ new Map();
+  let failed = false;
+  for (const { name, entry, prefixes, maskEntries } of entries) {
+    const key = JSON.stringify([entry.command, entry.args, Object.entries(entry.env).sort(([a], [b]) => a.localeCompare(b))]);
+    let result = checked.get(key);
+    if (!result) {
+      try {
+        result = await check(entry);
+      } catch {
+        result = { ok: false, exitCode: null, detail: "Unable to complete the startup check.", stderr: [] };
+      }
+      checked.set(key, result);
     }
-  }
-  for (const candidate of candidates) {
-    if (existsSync(candidate) == true) {
-      const resolved = await realpath(candidate);
-      return resolved;
+    const listedNames = result.toolNames ?? [];
+    const longestFirst = [...prefixes ?? []].sort((a, b) => b.length - a.length);
+    const covered = new Set(listedNames.map((tool) => longestFirst.find((prefix) => tool.startsWith(prefix))));
+    const missing = prefixes?.filter((prefix) => !covered.has(prefix)) ?? [];
+    if (result.ok && missing.length) result = { ...result, ok: false, detail: `Missing connection tools: ${missing.map((prefix) => prefix.slice(0, -2)).join(", ")}. Review catalog status before reconnecting.` };
+    const safe = (value) => [entry, ...maskEntries ?? []].reduce((text, source) => redactStartupText(text, source), value);
+    writeWrapped(prompter, safe(result.ok ? `OK ${name}: ${result.server}@${result.version}, ${result.tools} tools` : `FAILED ${name}: exit ${result.exitCode ?? "unavailable"}. ${result.detail ?? "Server failed to start."}`), "", void 0, result.ok ? prompter.paint.success : prompter.paint.error);
+    if (!result.ok) {
+      failed = true;
+      for (const line of result.stderr) writeWrapped(prompter, safe(line), "  ", void 0, prompter.paint.dim);
     }
   }
-  throw new Error("npm could not be found. Install Node.js with npm, then reopen your terminal.");
+  if (failed) prompter.write("Settings remain saved. Fix failed startup checks before restarting or reconnecting your AI clients.\n");
 }
-async function resolveLatestVersion(options) {
-  const metadataCache = await mkdtemp(join(tmpdir(), "akms-mcp-latest-"));
-  try {
-    const result = await execFileAsync(process.execPath, [
-      options.npmCli,
-      "view",
-      `${options.packageName}@latest`,
-      "version",
-      "--json",
-      "--prefer-online",
-      "--prefer-offline=false",
-      "--offline=false",
-      "--fetch-retries=0",
-      "--fetch-timeout=15000",
-      "--update-notifier=false",
-      "--cache",
-      metadataCache
-    ], { signal: options.signal, timeout: 2e4, windowsHide: true });
-    const version = JSON.parse(result.stdout);
-    if (typeof version !== "string" || /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(version) == false) {
-      throw new Error("npm returned an invalid latest version.");
-    }
-    return version;
-  } finally {
-    await rm(metadataCache, { recursive: true, force: true });
+
+// src/modules/registration/catalog.ts
+import fs3 from "fs";
+import os2 from "os";
+import path4 from "path";
+var LONGEST_TOOL_NAME_LENGTH = { db: 13, ssh: 17, wsl: 17, s3: 11 };
+var maxConnectionNameLength = (kind) => 64 - `mcp__akms_${kind}__`.length - 2 - LONGEST_TOOL_NAME_LENGTH[kind];
+var defaultCatalogPath = () => path4.join(process.env.AKMS_MCP_HOME ? path4.resolve(process.env.AKMS_MCP_HOME) : path4.join(os2.homedir(), ".akms", "mcp"), "registry.json");
+
+// src/modules/registration/registry.ts
+var sessionName = (kind) => `akms_${kind}`;
+var MIGRATION_STEPS = [
+  { id: "v1_to_v2", label: "Upgrade registry version 1 to version 2", needed: (state) => state.version === 1 },
+  { id: "catalog_default", label: "Record catalog mode as the default for new kinds", needed: (state) => state.defaultMode === void 0 }
+];
+var own = (value, key) => Object.hasOwn(value, key);
+var record = (value) => value != null && typeof value === "object" && !Array.isArray(value);
+var validEntry = (value) => record(value) && typeof value.command === "string" && Array.isArray(value.args) && value.args.every((arg) => typeof arg === "string") && record(value.env) && Object.values(value.env).every((item) => typeof item === "string");
+var RegistryError = class extends Error {
+};
+function entryHash(entry) {
+  return createHash("sha256").update(JSON.stringify([entry.command, entry.args, Object.entries(entry.env).sort(([a], [b]) => a.localeCompare(b))])).digest("hex");
+}
+function differingFields(entries) {
+  if (entries.length < 2) return [];
+  const fields = [];
+  if (new Set(entries.map((entry) => entry.command)).size > 1) fields.push("command");
+  if (new Set(entries.map((entry) => JSON.stringify(entry.args))).size > 1) fields.push("args");
+  for (const key of new Set(entries.flatMap((entry) => Object.keys(entry.env)))) {
+    if (new Set(entries.map((entry) => own(entry.env, key) ? entry.env[key] : void 0)).size > 1) fields.push(`env.${key}`);
   }
+  return fields;
 }
-async function launchMcp(options) {
-  const selected = MCP_PACKAGES[options.mcpId];
-  if (options.mcpId === "wsl" && process.platform !== "win32") {
-    throw new Error("WSL setup must run from Windows.");
+function describeDifferences(entries) {
+  const fields = differingFields(entries);
+  if (fields.length && fields.every((field) => /^env\.(DB|SSH|WSL|S3)_DESCRIPTION$/.test(field))) return "Only the description differs; connection settings match.";
+  return `Different fields: ${fields.map((field) => field.replace(/^env\./, "").replace(/[\x00-\x1f\x7f]/g, " ")).join(", ")}.`;
+}
+function entryKind(entry) {
+  return launchKind(entry);
+}
+function defaultRegistryPath() {
+  return defaultCatalogPath();
+}
+var Registry = class {
+  constructor(targets, file = defaultRegistryPath(), runtimeOptions = {}) {
+    this.targets = targets;
+    this.runtimeOptions = runtimeOptions;
+    this.file = file;
   }
-  const npmCli = await findNpmCli();
-  const cancellation = new AbortController();
-  const cancelLookup = () => {
-    cancellation.abort();
-  };
-  process.on("SIGINT", cancelLookup);
-  process.on("SIGTERM", cancelLookup);
-  let version;
-  try {
-    process.stdout.write(`
-Checking the latest ${selected.packageName} release...
-`);
-    version = await resolveLatestVersion({ npmCli, packageName: selected.packageName, signal: cancellation.signal });
-  } catch (error) {
-    if (cancellation.signal.aborted == true) {
-      return 130;
-    }
-    throw new Error(`Could not check the latest ${selected.packageName} release; setup was not started.
-${String(error)}`, { cause: error });
-  } finally {
-    process.off("SIGINT", cancelLookup);
-    process.off("SIGTERM", cancelLookup);
+  targets;
+  runtimeOptions;
+  file;
+  observedText;
+  backupCaptured = false;
+  globalRuntime(kind) {
+    return (this.runtimeOptions.find ?? findGlobalRuntime)(kind);
   }
-  const argumentsList = [
-    npmCli,
-    "exec",
-    "--yes",
-    "--prefer-online",
-    "--prefer-offline=false",
-    "--offline=false",
-    `--package=${selected.packageName}@${version}`,
-    "--",
-    selected.command,
-    selected.setupCommand
-  ];
-  if (options.targetId != null) {
+  latestRuntime(kind) {
+    return (this.runtimeOptions.latest ?? latestRuntimeVersion)(kind);
+  }
+  isSessionMode(kind, state = this.read()) {
+    return state.version === 2 && (state.sessions?.[kind]?.mode ?? state.defaultMode) === "catalog";
+  }
+  needsMigration(state = this.read()) {
+    return MIGRATION_STEPS.some((step) => step.needed(state));
+  }
+  planMigration() {
+    const state = this.read();
+    const steps = MIGRATION_STEPS.filter((step) => step.needed(state)).map(({ id, label }) => ({ id, label }));
+    const kinds = steps.length ? KINDS.map((kind) => {
+      const names = Object.entries(state.connections).filter(([, item]) => item.kind === kind && item.entry).map(([name]) => name);
+      if (state.sessions?.[kind]?.mode === "individual") return { kind, names, status: "individual" };
+      if (this.isSessionMode(kind, state)) return { kind, names, status: "catalog" };
+      if (!names.length) return { kind, names, status: "empty" };
+      try {
+        for (const name of names) this.validateName(kind, name);
+        if (!this.globalRuntime(kind)) {
+          const changes = state.clients.map((client) => {
+            const remove = names.filter((name) => state.connections[name].applied[client]);
+            const review = [];
+            try {
+              const target = this.targets.find((item) => item.id === client);
+              if (!target) throw new Error();
+              const entries = target.readEntries();
+              if (target.hasEntry?.(sessionName(kind)) ?? own(entries, sessionName(kind))) review.push(sessionName(kind));
+              for (const name of remove) if ((target.hasEntry?.(name) ?? own(entries, name)) && (!entries[name] || entryHash(entries[name]) !== state.connections[name].applied[client])) review.push(name);
+            } catch {
+              review.push("Cannot inspect this service; Sync will retry.");
+            }
+            return { client, add: [sessionName(kind)], remove, review };
+          });
+          return { kind, names, status: "pending-runtime", changes, detail: "Install from Runtime, then run Sync. Existing entries stay until the session is verified." };
+        }
+        return { kind, names, status: "convert", session: this.sessionPlan(kind, "catalog", state) };
+      } catch (error) {
+        return { kind, names, status: "blocked", detail: error instanceof RegistryError ? error.message : "Cannot preview this kind. Check its runtime and catalog settings." };
+      }
+    }) : [];
+    return { expected: JSON.stringify(state), steps, kinds };
+  }
+  applyMigration(plan) {
+    if (!plan.steps.length) return this.locked(() => {
+      if (JSON.stringify(this.read()) !== plan.expected) throw new RegistryError("The catalog changed since review. Reopen Migrate registry.");
+      return [];
+    });
+    return this.change((state) => {
+      if (JSON.stringify(state) !== plan.expected) throw new RegistryError("The catalog changed since review. Reopen Migrate registry.");
+      if (plan.kinds.some((item) => item.status === "blocked")) throw new RegistryError("Resolve blocked kinds before migrating the registry.");
+      for (const item of plan.kinds) {
+        if (item.status === "pending-runtime" && this.globalRuntime(item.kind)) throw new RegistryError("Runtime availability changed since review. Reopen Migrate registry.");
+        if (item.session) this.applySessionState(state, item.session, false);
+      }
+      for (const step of plan.steps) {
+        if (step.id === "v1_to_v2") {
+          state.version = 2;
+          state.sessions ??= {};
+        } else if (step.id === "catalog_default") state.defaultMode = "catalog";
+        else throw new RegistryError("Unknown registry migration step. Reopen Migrate registry.");
+      }
+    }, plan.kinds.filter((item) => item.status === "convert" || item.status === "pending-runtime").map((item) => item.kind));
+  }
+  setDefaultMode(mode) {
+    return this.change((state) => {
+      if (state.version !== 2 || state.defaultMode === void 0) throw new RegistryError("Migrate registry before changing the default for new kinds.");
+      if (state.defaultMode === mode) return;
+      for (const kind of KINDS) if (!state.sessions?.[kind] && Object.values(state.connections).some((item) => item.kind === kind && item.entry)) {
+        if (!this.globalRuntime(kind)) throw new RegistryError("Set up the pending runtimes and run Sync before changing the default for new kinds.");
+        state.sessions ??= {};
+        state.sessions[kind] = { mode: this.isSessionMode(kind, state) ? "catalog" : "individual", entry: this.sessionEntry(kind), applied: {} };
+      }
+      state.defaultMode = mode;
+    }, []);
+  }
+  kindForName(name, state = this.read()) {
+    return own(state.connections, name) ? state.connections[name].kind : KINDS.find((kind) => sessionName(kind) === name && (state.sessions?.[kind] || this.isSessionMode(kind, state)));
+  }
+  validateName(kind, name) {
+    if (!/^[A-Za-z0-9_-]+$/.test(name) || name.length > maxConnectionNameLength(kind)) throw new RegistryError(`Connection names must use 1-${maxConnectionNameLength(kind)} ASCII letters, digits, underscores or hyphens for ${kind.toUpperCase()}. Rename this connection before saving.`);
+    if (KINDS.some((value) => sessionName(value) === name)) throw new RegistryError("Names akms_db, akms_ssh, akms_wsl and akms_s3 are reserved for session servers. Choose another name.");
+  }
+  sessionEntry(kind) {
+    if (path5.basename(this.file) !== "registry.json") throw new RegistryError("Session mode requires a catalog named registry.json in the AKMS catalog directory.");
+    const runtime = this.requireRuntime(kind);
+    const env = {};
+    if (process.env.AKMS_MCP_HOME || path5.resolve(this.file) !== path5.resolve(defaultCatalogPath())) env.AKMS_MCP_HOME = path5.dirname(path5.resolve(this.file));
+    return { command: runtime.command, args: [...runtime.args, "--catalog"], env };
+  }
+  planSession(kind, mode) {
+    return this.sessionPlan(kind, mode, this.read());
+  }
+  sessionPlan(kind, mode, state) {
+    const names = Object.entries(state.connections).filter(([, item]) => item.kind === kind && item.entry).map(([name]) => name);
+    for (const name of names) this.validateName(kind, name);
+    if (own(state.connections, sessionName(kind))) throw new RegistryError("Rename the connection using the reserved session server name before switching modes.");
+    const entry = mode === "catalog" ? this.sessionEntry(kind) : state.sessions?.[kind]?.entry ?? (this.isSessionMode(kind, state) && this.globalRuntime(kind) ? this.sessionEntry(kind) : void 0);
+    if (!entry) throw new RegistryError("This kind has no session server to switch back from.");
+    const changes = state.clients.map((client) => {
+      const target = this.targets.find((item) => item.id === client);
+      const add = mode === "catalog" ? names.length ? [sessionName(kind)] : [] : names;
+      const remove = mode === "catalog" ? Object.keys(state.connections).filter((name) => state.connections[name].kind === kind && state.connections[name].applied[client]) : [sessionName(kind)];
+      const review = [];
+      try {
+        if (!target) throw new Error();
+        const actual = target.readEntries();
+        for (const name of [.../* @__PURE__ */ new Set([...add, ...remove])]) {
+          const prior = name === sessionName(kind) ? state.sessions?.[kind]?.applied[client] : state.connections[name]?.applied[client];
+          const wanted = mode === "catalog" && name === sessionName(kind) ? entry : mode === "individual" ? state.connections[name]?.entry : null;
+          if ((target.hasEntry?.(name) ?? own(actual, name)) && (!actual[name] || entryHash(actual[name]) !== prior && (!wanted || entryHash(actual[name]) !== entryHash(wanted)))) review.push(name);
+        }
+      } catch {
+        review.push("Cannot inspect this service; Sync will retry.");
+      }
+      return { client, add, remove, review };
+    });
+    return { kind, mode, entry, expected: JSON.stringify(state), names, changes, custom: names.filter((name) => !standardLaunch(state.connections[name].entry, kind)) };
+  }
+  applySession(plan) {
+    return this.change((state) => this.applySessionState(state, plan));
+  }
+  applySessionState(state, plan, checkSnapshot = true) {
+    if (checkSnapshot && JSON.stringify(state) !== plan.expected) throw new RegistryError("The catalog changed since review. Reopen Runtime before switching modes.");
+    if (plan.mode === "catalog" && entryHash(this.sessionEntry(plan.kind)) !== entryHash(plan.entry)) throw new RegistryError("The runtime changed since review. Reopen Runtime before switching modes.");
+    state.version = 2;
+    state.sessions ??= {};
+    state.sessions[plan.kind] = { mode: plan.mode, entry: plan.entry, applied: state.sessions[plan.kind]?.applied ?? {} };
+  }
+  async checkSaved(prompter, names) {
+    const state = this.read();
+    const entries = [];
+    const sessions = /* @__PURE__ */ new Set();
+    for (const name of new Set(names)) {
+      const connection = state.connections[name];
+      if (!connection?.entry) continue;
+      if (this.isSessionMode(connection.kind, state)) sessions.add(connection.kind);
+      else entries.push({ name, entry: connection.entry });
+    }
+    for (const kind of sessions) {
+      const entry = state.sessions?.[kind]?.entry;
+      if (!entry) {
+        prompter.write(`Startup check pending for ${sessionName(kind)}: install its runtime from Runtime, then run Sync.
+`);
+        continue;
+      }
+      entries.push({
+        name: sessionName(kind),
+        entry,
+        prefixes: Object.entries(state.connections).filter(([, item]) => item.kind === kind && item.entry).map(([name]) => `${name}__`),
+        maskEntries: Object.values(state.connections).filter((item) => item.kind === kind && item.entry).map((item) => item.entry)
+      });
+    }
+    await checkConnections(prompter, entries, this.runtimeOptions.check);
+  }
+  async installRuntime(kind) {
+    if (this.globalRuntime(kind)?.linked) throw new RegistryError("This is a linked development installation. Build or update its source checkout instead.");
+    await (this.runtimeOptions.install ?? installGlobalRuntime)(kind);
+    return this.requireRuntime(kind);
+  }
+  requireRuntime(kind) {
+    const runtime = this.globalRuntime(kind);
+    if (!runtime) throw new RegistryError(`Install the AKMS runtime first: ${runtimeInstallCommand(kind)}. Then reopen Runtime.`);
+    return runtime;
+  }
+  runtimeSnapshot(state, kind) {
+    return JSON.stringify([state.clients, Object.entries(state.connections).filter(([, item]) => item.kind === kind).map(([name, item]) => [name, item.entry ? entryHash(item.entry) : null]).sort(([a], [b]) => String(a).localeCompare(String(b)))]);
+  }
+  planRuntime(kind) {
+    const state = this.read();
+    const runtime = this.requireRuntime(kind);
+    const names = [], skipped = [];
+    for (const [name, item] of Object.entries(state.connections)) {
+      if (item.kind !== kind || !item.entry) continue;
+      if (!standardLaunch(item.entry, kind)) {
+        skipped.push(name);
+        continue;
+      }
+      if (item.entry.command !== runtime.command || JSON.stringify(item.entry.args) !== JSON.stringify(runtime.args)) names.push(name);
+    }
+    return { kind, runtime, names, skipped, expected: this.runtimeSnapshot(state, kind) };
+  }
+  applyRuntime(plan) {
+    return this.change((state) => {
+      if (this.runtimeSnapshot(state, plan.kind) !== plan.expected) throw new RegistryError("Connections or registration changed since review. Reopen Runtime before applying.");
+      const runtime = this.requireRuntime(plan.kind);
+      if (JSON.stringify(runtime) !== JSON.stringify(plan.runtime)) throw new RegistryError("The global installation changed since review. Reopen Runtime before applying.");
+      for (const name of plan.names) {
+        const item = state.connections[name];
+        if (!item?.entry || item.kind !== plan.kind || !standardLaunch(item.entry, plan.kind)) throw new RegistryError("This connection has a custom launch command. Review it individually.");
+        item.entry = { ...item.entry, command: runtime.command, args: [...runtime.args] };
+      }
+    });
+  }
+  read() {
+    let text;
+    try {
+      text = fs4.readFileSync(this.file, "utf8");
+      this.observedText = text;
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        this.observedText = null;
+        return { version: 2, defaultMode: "catalog", clients: [], connections: {}, sessions: {} };
+      }
+      throw new RegistryError("Cannot read the AKMS registry. Check its permissions.");
+    }
+    let value;
+    try {
+      value = JSON.parse(text);
+    } catch {
+      throw new RegistryError("Invalid AKMS registry JSON; the file was not changed.");
+    }
+    if (!record(value) || ![1, 2].includes(value.version)) throw new RegistryError("Unsupported AKMS registry version; update this MCP package before changing it.");
+    if (!Array.isArray(value.clients) || !value.clients.every((id) => typeof id === "string" && own(CLIENT_LABELS2, id)) || new Set(value.clients).size !== value.clients.length || !record(value.connections)) throw new RegistryError("Invalid AKMS registry; the file was not changed.");
+    for (const [name, connection] of Object.entries(value.connections)) {
+      if (!name.trim() || !record(connection) || !KINDS.includes(connection.kind) || !(connection.entry === null || validEntry(connection.entry)) || !record(connection.applied) || Object.entries(connection.applied).some(([id, hash]) => !own(CLIENT_LABELS2, id) || typeof hash !== "string" || !/^[a-f0-9]{64}$/.test(hash)) || connection.replacement != null && typeof connection.replacement !== "string") throw new RegistryError("Invalid AKMS registry entry; the file was not changed.");
+    }
+    if (value.version === 2) {
+      if (!record(value.sessions) || value.defaultMode !== void 0 && !["catalog", "individual"].includes(value.defaultMode)) throw new RegistryError("Invalid session server state; the file was not changed.");
+      for (const [kind, session] of Object.entries(value.sessions)) {
+        if (!KINDS.includes(kind) || !record(session) || !["catalog", "individual"].includes(session.mode) || !validEntry(session.entry) || !catalogLaunch(session.entry, kind) || Object.keys(session.entry.env).some((key) => key !== "AKMS_MCP_HOME") || !record(session.applied) || Object.entries(session.applied).some(([id, hash]) => !own(CLIENT_LABELS2, id) || typeof hash !== "string" || !/^[a-f0-9]{64}$/.test(hash))) throw new RegistryError("Invalid session server state; the file was not changed.");
+        if (own(value.connections, sessionName(kind))) throw new RegistryError("A connection uses a reserved session server name; the file was not changed.");
+      }
+    } else if (value.sessions !== void 0 || value.defaultMode !== void 0) throw new RegistryError("Session server state requires registry version 2; the file was not changed.");
+    return value;
+  }
+  save(state) {
+    const after = JSON.stringify(state, null, 2) + "\n";
+    updateConfigFile(this.file, (before) => {
+      if (this.observedText !== void 0 && before !== (this.observedText ?? "")) throw new RegistryError("The AKMS catalog changed outside this command. Reload it and retry Sync.");
+      return after;
+    }, { beforeCommit: (before) => {
+      if (before !== null && !this.backupCaptured) {
+        updateConfigFile(path5.join(path5.dirname(this.file), "registry.previous.json"), () => before, { mode: fs4.statSync(this.file).mode & 511 });
+        this.backupCaptured = true;
+      }
+    } });
+    this.observedText = after;
+  }
+  /** Serializes standalone editors across packages, including their config-file writes. */
+  locked(action) {
+    fs4.mkdirSync(path5.dirname(this.file), { recursive: true, mode: 448 });
+    const lock = this.file + ".lock";
+    let descriptor;
+    try {
+      descriptor = fs4.openSync(lock, "wx", 384);
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      let abandoned = false;
+      try {
+        const pid = Number(fs4.readFileSync(lock, "utf8"));
+        if (Number.isSafeInteger(pid) && pid > 0) {
+          try {
+            process.kill(pid, 0);
+          } catch (probe) {
+            abandoned = probe.code === "ESRCH";
+          }
+        }
+      } catch {
+      }
+      if (!abandoned) throw new RegistryError("Another AKMS configuration command is running. Finish it and retry.");
+      fs4.unlinkSync(lock);
+      descriptor = fs4.openSync(lock, "wx", 384);
+    }
+    this.backupCaptured = false;
+    try {
+      fs4.writeFileSync(descriptor, String(process.pid));
+      return action();
+    } finally {
+      this.backupCaptured = false;
+      fs4.closeSync(descriptor);
+      fs4.unlinkSync(lock);
+    }
+  }
+  change(action, kinds) {
+    return this.locked(() => {
+      const state = this.read();
+      action(state);
+      for (const kind of KINDS) {
+        if (this.isSessionMode(kind, state) && !state.sessions?.[kind] && Object.values(state.connections).some((item) => item.kind === kind && item.entry) && this.globalRuntime(kind)) {
+          state.sessions ??= {};
+          state.sessions[kind] = { mode: "catalog", entry: this.sessionEntry(kind), applied: {} };
+        }
+      }
+      this.save(state);
+      return this.reconcile(state, true, kinds);
+    });
+  }
+  register(clients, expected, imports = []) {
+    if (clients.some((id) => !own(CLIENT_LABELS2, id))) throw new RegistryError("Unknown AI service.");
+    return this.change((state) => {
+      if (expected && JSON.stringify(state.clients) !== JSON.stringify(expected)) throw new RegistryError("Registration changed in another command. Reopen Register before applying.");
+      const grouped = /* @__PURE__ */ new Map();
+      for (const candidate of imports) grouped.set(candidate.name, [...grouped.get(candidate.name) ?? [], candidate]);
+      for (const [name, candidates] of grouped) {
+        if (own(state.connections, name)) throw new RegistryError("The shared catalog changed since review. Reopen Register or Import before applying.");
+        const chosen = candidates[0];
+        this.validateName(chosen.kind, name);
+        const applied = {};
+        for (const candidate of candidates) {
+          if (!clients.includes(candidate.client) || candidate.kind !== chosen.kind || entryKind(candidate.entry) !== chosen.kind || entryHash(candidate.entry) !== entryHash(chosen.entry)) throw new RegistryError("Different existing settings need an explicit choice before import.");
+          const actual = this.targets.find((target) => target.id === candidate.client)?.readEntries()[name];
+          if (!actual || entryHash(actual) !== entryHash(candidate.entry)) throw new RegistryError("Existing settings changed since review. Reopen Register or Import before applying.");
+          applied[candidate.client] = entryHash(actual);
+        }
+        Object.defineProperty(state.connections, name, { value: { kind: chosen.kind, entry: chosen.entry, applied }, enumerable: true, configurable: true, writable: true });
+      }
+      state.clients = [...new Set(clients)];
+    });
+  }
+  /** Discover without writing. Only unambiguous, previously unmanaged names are batched. */
+  planRegistration(clients, kind) {
+    const state = this.read();
+    const { entries, errors } = this.candidates(kind, clients);
+    const groups = /* @__PURE__ */ new Map();
+    for (const entry of entries) groups.set(entry.name, [...groups.get(entry.name) ?? [], entry]);
+    const imports = [];
+    const conflicts = [];
+    for (const [name, candidates] of groups) {
+      if (own(state.connections, name)) continue;
+      try {
+        this.validateName(candidates[0].kind, name);
+      } catch {
+        conflicts.push(name);
+        continue;
+      }
+      if (new Set(candidates.map((candidate) => entryHash(candidate.entry))).size === 1) imports.push(...candidates);
+      else conflicts.push(name);
+    }
+    return { imports, conflicts, errors };
+  }
+  write(kind, name, entry, oldName, expected) {
+    this.validateName(kind, name);
+    if (!validEntry(entry) || entryKind(entry) !== kind || catalogLaunch(entry)) throw new RegistryError("Invalid connection name or MCP entry.");
+    return this.change((state) => {
+      if (!state.clients.length) throw new RegistryError("Register at least one AI service before saving a connection.");
+      const observedName = oldName ?? name;
+      const observed = own(state.connections, observedName) ? state.connections[observedName].entry : null;
+      if (expected !== void 0 && (observed ? entryHash(observed) : null) !== expected) throw new RegistryError("This connection changed while the form was open. Reload it before saving.");
+      const previous = own(state.connections, name) ? state.connections[name] : void 0;
+      if (previous && previous.kind !== kind) throw new RegistryError(`The name ${name} is already used by another MCP. Choose another name.`);
+      if (oldName && oldName !== name && previous) throw new RegistryError(`The name ${name} already exists. Choose another name.`);
+      if (oldName && oldName !== name) {
+        const old = own(state.connections, oldName) ? state.connections[oldName] : void 0;
+        if (!old || old.kind !== kind || !old.entry) throw new RegistryError("The connection changed; reload before renaming it.");
+        old.entry = null;
+        old.replacement = name;
+      }
+      Object.defineProperty(state.connections, name, { value: { kind, entry, applied: previous?.applied ?? {} }, enumerable: true, configurable: true, writable: true });
+    });
+  }
+  remove(kind, name, expected) {
+    return this.change((state) => {
+      const observed = own(state.connections, name) ? state.connections[name].entry : null;
+      if (expected !== void 0 && (observed ? entryHash(observed) : null) !== expected) throw new RegistryError("This connection changed since it was displayed. Reload it before removing it.");
+      if (!own(state.connections, name)) return;
+      if (state.connections[name].kind !== kind) throw new RegistryError("This connection belongs to another MCP.");
+      state.connections[name].entry = null;
+    });
+  }
+  sync() {
+    return this.change(() => {
+    });
+  }
+  inspect() {
+    return this.reconcile(this.read(), false);
+  }
+  formatResults(results, prefix = "", paint, reviewHint) {
+    return formatResults(results, prefix, {
+      paint,
+      reviewHint,
+      connectionCount: Object.values(this.read().connections).filter((item) => item.entry).length
+    });
+  }
+  reconcile(state, apply, kinds) {
+    const results = [];
+    const active = (kind) => Object.entries(state.connections).filter(([, item]) => item.kind === kind && item.entry);
+    for (const kind of kinds ?? KINDS) if (this.isSessionMode(kind, state) && active(kind).length && !state.sessions?.[kind]) {
+      for (const client of state.clients) results.push({
+        client,
+        name: sessionName(kind),
+        kind,
+        connections: active(kind).map(([name]) => name),
+        status: "pending",
+        waitingFor: "runtime",
+        detail: "Install it from Runtime, then run Sync. Your existing entries keep working."
+      });
+    }
+    const work = [
+      ...Object.entries(state.connections).filter(([, connection]) => !kinds || kinds.includes(connection.kind)).map(([name, connection]) => ({ name, connection, bundle: false })),
+      ...(kinds ?? KINDS).flatMap((kind) => state.sessions?.[kind] ? [{ name: sessionName(kind), bundle: true, connection: { kind, entry: state.sessions[kind].entry, applied: state.sessions[kind].applied } }] : [])
+    ];
+    const wanted = (item) => item.bundle ? this.isSessionMode(item.connection.kind, state) && active(item.connection.kind).length ? item.connection.entry : null : this.isSessionMode(item.connection.kind, state) ? null : item.connection.entry;
+    work.sort((a, b) => (wanted(a) ? 0 : a.bundle ? 2 : 1) - (wanted(b) ? 0 : b.bundle ? 2 : 1));
+    for (const item of work) {
+      const { name, connection, bundle } = item;
+      const clients = /* @__PURE__ */ new Set([...state.clients, ...Object.keys(connection.applied)]);
+      for (const client of clients) {
+        const desired = state.clients.includes(client) ? wanted(item) : null;
+        const previous = connection.applied[client];
+        if (!desired && !previous) continue;
+        const target = this.targets.find((candidate) => candidate.id === client);
+        const report = (status, detail, waitingFor) => results.push({
+          client,
+          name,
+          status,
+          detail,
+          kind: connection.kind,
+          connections: bundle ? active(connection.kind).map(([name2]) => name2) : [name],
+          ...waitingFor ? { waitingFor } : {}
+        });
+        if (!target) {
+          report("error", "Service adapter unavailable; use a newer package to retry.");
+          continue;
+        }
+        try {
+          const entries = target.readEntries();
+          const actual = own(entries, name) ? entries[name] : void 0;
+          const exists = target.hasEntry?.(name) ?? actual != null;
+          const hash = actual ? entryHash(actual) : void 0;
+          if (desired && hash === entryHash(desired)) {
+            if (apply) connection.applied[client] = hash;
+            report("synced", "Up to date");
+          } else if (!desired && !exists) {
+            if (apply) delete connection.applied[client];
+            report("removed", "Removed");
+          } else if (exists && (!actual || !previous || hash !== previous)) {
+            report("conflict", actual && desired ? describeDifferences([desired, actual]) : actual ? "Changed outside AKMS; review before removing this entry." : "This name is used by another server type; choose another name.");
+          } else {
+            if (!desired && state.clients.includes(client)) {
+              if (!bundle && this.isSessionMode(connection.kind, state) && active(connection.kind).length) {
+                const session = state.sessions?.[connection.kind];
+                const replacement2 = entries[sessionName(connection.kind)];
+                if (!session || !replacement2 || entryHash(replacement2) !== entryHash(session.entry) || session.applied[client] !== entryHash(session.entry)) {
+                  report("pending", "Connection entry kept until the session server is applied.", "session");
+                  continue;
+                }
+              }
+              if (bundle && !this.isSessionMode(connection.kind, state) && active(connection.kind).some(([connectionName, value]) => !entries[connectionName] || entryHash(entries[connectionName]) !== entryHash(value.entry))) {
+                report("pending", "Session entry kept until all connection entries are applied.", "connections");
+                continue;
+              }
+            }
+            let replacement = connection.replacement && state.connections[connection.replacement];
+            const visited = /* @__PURE__ */ new Set();
+            while (replacement && !replacement.entry && replacement.replacement && !visited.has(replacement.replacement)) {
+              visited.add(replacement.replacement);
+              replacement = state.connections[replacement.replacement];
+            }
+            if (!desired && state.clients.includes(client) && !this.isSessionMode(connection.kind, state) && replacement && replacement.entry && replacement.applied[client] !== entryHash(replacement.entry)) {
+              report("pending", "Old name kept until the new name is applied.", "rename");
+              continue;
+            }
+            if (!apply) {
+              report("pending", desired ? "Needs applying" : "Needs removal");
+              continue;
+            }
+            const result = desired ? target.writeEntry(name, desired) : target.removeEntry(name);
+            if (result.status !== "written") {
+              report("error", "Could not write this service's settings. Check its CLI, syntax and permissions.");
+              continue;
+            }
+            const after = target.readEntries()[name];
+            if (desired ? !after || entryHash(after) !== entryHash(desired) : target.hasEntry?.(name) ?? after != null) {
+              report("error", "Settings could not be verified; retry Sync.");
+              continue;
+            }
+            if (desired) connection.applied[client] = entryHash(desired);
+            else delete connection.applied[client];
+            report(desired ? "synced" : "removed", desired ? "Applied" : "Removed");
+          }
+        } catch {
+          report("error", "Cannot read or update settings. Check the configuration syntax, CLI and file permissions.");
+        }
+        if (apply) this.save(state);
+      }
+      if (apply && !bundle && !connection.entry && Object.keys(connection.applied).length === 0) delete state.connections[name];
+    }
+    if (apply) this.save(state);
+    return results;
+  }
+  candidates(kind, clients = this.read().clients) {
+    const entries = [];
+    const errors = [];
+    for (const client of clients) {
+      const target = this.targets.find((item) => item.id === client);
+      try {
+        if (!target) throw new RegistryError();
+        for (const [name, entry] of Object.entries(target.readEntries())) {
+          const found = entryKind(entry);
+          if (found && !catalogLaunch(entry) && (!kind || found === kind)) entries.push({ client, name, kind: found, entry });
+        }
+      } catch {
+        errors.push(`${CLIENT_LABELS2[client]}: cannot inspect existing entries.`);
+      }
+    }
+    return { entries, errors };
+  }
+  importEntry(name, chosen, reviewed) {
+    this.validateName(chosen.kind, name);
+    if (catalogLaunch(chosen.entry)) throw new RegistryError("Session server entries are not individual connections.");
+    return this.change((state) => {
+      if (!name.trim()) throw new RegistryError("A connection name is required.");
+      const previous = own(state.connections, name) ? state.connections[name] : void 0;
+      if (name !== chosen.name && previous) throw new RegistryError("That shared name already exists. Choose a new name to keep both connections.");
+      if (previous && previous.kind !== chosen.kind) throw new RegistryError("This name belongs to another MCP. Choose another name.");
+      const applied = { ...previous?.applied };
+      for (const candidate of reviewed) {
+        const target = this.targets.find((item) => item.id === candidate.client);
+        const actual = target?.readEntries()[candidate.name];
+        if (!actual || entryHash(actual) !== entryHash(candidate.entry)) throw new RegistryError("Settings changed since review; import again.");
+        if (candidate.name === name && candidate.kind === chosen.kind) applied[candidate.client] = entryHash(actual);
+      }
+      Object.defineProperty(state.connections, name, { value: { kind: chosen.kind, entry: chosen.entry, applied }, enumerable: true, configurable: true, writable: true });
+    });
+  }
+  resolve(client, name, expected, useClient) {
+    return this.change((state) => {
+      const sessionKind = KINDS.find((kind) => sessionName(kind) === name && state.sessions?.[kind]);
+      if (sessionKind) {
+        const actual2 = this.targets.find((item) => item.id === client)?.readEntries()[name];
+        if (!actual2 || entryHash(actual2) !== entryHash(expected)) throw new RegistryError("Settings changed since review; run Sync again.");
+        if (useClient || entryKind(actual2) !== sessionKind) throw new RegistryError("Session launches can only be restored from AKMS. Keep external settings or rename the conflicting entry manually.");
+        state.sessions[sessionKind].applied[client] = entryHash(actual2);
+        return;
+      }
+      const connection = own(state.connections, name) ? state.connections[name] : void 0;
+      const target = this.targets.find((item) => item.id === client);
+      const actual = target?.readEntries()[name];
+      if (!connection || !actual || entryHash(actual) !== entryHash(expected)) throw new RegistryError("Settings changed since review; run Sync again.");
+      if (entryKind(actual) !== connection.kind) throw new RegistryError("This entry runs a different server. Rename it manually before retrying.");
+      connection.applied[client] = entryHash(actual);
+      if (useClient) {
+        if (!state.clients.includes(client)) throw new RegistryError("Register this service before importing its changes.");
+        this.validateName(connection.kind, name);
+        if (catalogLaunch(actual)) throw new RegistryError("A session server cannot be imported as an individual connection.");
+        connection.entry = actual;
+        delete connection.replacement;
+      }
+    });
+  }
+  target(kind) {
+    const registry = this;
+    let snapshot;
+    const expected = (name) => snapshot ? own(snapshot, name) ? entryHash(snapshot[name]) : null : void 0;
+    const saved = (results) => ({ status: "written", detail: registry.formatResults(results, "Saved in the shared AKMS catalog.") });
+    const prepare = (name, entry, oldName) => {
+      if (!registry.read().clients.length) throw new RegistryError("Register at least one AI service before saving a connection.");
+      const prior = snapshot && own(snapshot, oldName ?? name) ? snapshot[oldName ?? name] : void 0;
+      if (prior && !standardLaunch(prior, kind)) return { ...entry, command: prior.command, args: [...prior.args] };
+      const runtime = registry.requireRuntime(kind);
+      return { ...entry, command: runtime.command, args: [...runtime.args] };
+    };
+    return {
+      id: "registered",
+      detected: true,
+      get label() {
+        const clients = registry.read().clients;
+        return clients.length ? clients.map((id) => CLIENT_LABELS2[id]).join(" \xB7 ") : "No services registered";
+      },
+      location: this.file,
+      readEntries: () => {
+        const entries = Object.fromEntries(Object.entries(registry.read().connections).filter(([, value]) => value.kind === kind && value.entry).map(([name, value]) => [name, value.entry]));
+        snapshot = structuredClone(entries);
+        return entries;
+      },
+      hasEntry: (name) => own(registry.read().connections, name),
+      prepareEntry: prepare,
+      writeEntry: (name, entry) => saved(registry.write(kind, name, prepare(name, entry), void 0, expected(name))),
+      renameEntry: (oldName, name, entry) => saved(registry.write(kind, name, prepare(name, entry, oldName), oldName, expected(oldName))),
+      removeEntry: (name) => saved(registry.remove(kind, name, expected(name)))
+    };
+  }
+};
+function formatResults(results, prefix = "", options = {}) {
+  const plain = (text) => text;
+  const paint = options.paint ?? { success: plain, warning: plain, error: plain, dim: plain, bold: plain };
+  const safe = (text) => text.replace(/[\x00-\x1f\x7f]/g, " ");
+  const lines = prefix ? [paint.bold(prefix)] : [];
+  const total = options.connectionCount ?? new Set(results.flatMap((item) => item.connections ?? [item.name])).size;
+  lines.push(`  Connections: ${total}`);
+  const updated = results.filter((item) => item.status === "synced" && item.detail === "Applied").length;
+  const unchanged = results.filter((item) => item.status === "synced" && item.detail !== "Applied").length;
+  const removed = results.filter((item) => item.status === "removed").length;
+  const failed = results.filter((item) => item.status === "error");
+  lines.push(`  Service entries: ${paint.success(`${updated} updated \xB7 ${unchanged} already up to date`)}${removed ? ` \xB7 ${paint.success(`${removed} removed`)}` : ""} \xB7 ${(failed.length ? paint.error : paint.dim)(`${failed.length} failed`)}`);
+  if (!results.length) lines.push(paint.dim("  No shared connections need applying."));
+  if (results.length && results.every((item) => item.status === "synced" || item.status === "removed")) lines.push(paint.success("  OK: all service entries are up to date."));
+  const waiting = results.filter((item) => item.status === "pending");
+  for (const kind of KINDS) {
+    const runtime = waiting.filter((item) => item.kind === kind && item.waitingFor === "runtime");
+    const kept = waiting.filter((item) => item.kind === kind && item.waitingFor === "session");
+    if (!runtime.length && !kept.length) continue;
+    lines.push(`
+${paint.warning(runtime.length ? `Waiting for runtime - ${kind.toUpperCase()}` : `Waiting for ${sessionName(kind)}`)}`);
+    if (runtime.length) lines.push("  Install it from Runtime, then run Sync. Your existing entries keep working.");
+    else lines.push("  Resolve this session entry in Sync. Existing connection entries stay until it is ready.");
+    const retained = /* @__PURE__ */ new Map();
+    for (const client of new Set(kept.map((item) => item.client))) {
+      const names = [...new Set(kept.filter((item) => item.client === client).map((item) => item.name))];
+      const key = JSON.stringify([...names].sort());
+      const group = retained.get(key);
+      if (group) group.clients.push(client);
+      else retained.set(key, { clients: [client], names });
+    }
+    for (const group of retained.values()) {
+      const clients = group.clients.map((client) => CLIENT_LABELS2[client]).join(" \xB7 ");
+      lines.push(paint.dim(`  Kept in ${clients} until ${sessionName(kind)} is applied: ${group.names.map(safe).join(", ")}`));
+    }
+  }
+  for (const [heading, rows, color] of [
+    ["Needs review (existing settings kept)", results.filter((item) => item.status === "conflict"), paint.warning],
+    ["Waiting for Sync", waiting.filter((item) => !item.waitingFor || !["runtime", "session"].includes(item.waitingFor)), paint.warning],
+    ["Could not finish", failed, paint.error]
+  ]) {
+    if (!rows.length) continue;
+    lines.push(`
+${color(`${heading}:`)}`);
+    for (const name of new Set(rows.map((item) => item.name))) {
+      lines.push(`  ${safe(name)}`);
+      for (const row of rows.filter((item) => item.name === name)) lines.push(`    ${row.status === "error" ? paint.error("FAILED ") : ""}${CLIENT_LABELS2[row.client]}: ${safe(row.detail)}`);
+    }
+  }
+  if (results.some((item) => item.status === "conflict")) lines.push(paint.warning(`
+${options.reviewHint ?? "Next: open Sync to compare settings and choose which version to use."}`));
+  if (failed.length) lines.push(paint.error("\nNext: fix the errors above, then run Sync again."));
+  return lines.join("\n");
+}
+
+// src/modules/registration/runtime-menu.ts
+async function runtimeMenu(prompter, registry, requestedKind) {
+  let kind = requestedKind;
+  for (; ; ) {
+    prompter.clearScreen();
+    if (!kind) {
+      const selected = await prompter.select("Runtime / choose MCP", [
+        ...KINDS.map((value) => ({ value, label: packageName(value) })),
+        { value: "back", key: "b", label: "Back" }
+      ], { cancelValue: "back" });
+      if (selected === "back") return;
+      kind = selected;
+    }
+    try {
+      const installed = registry.globalRuntime(kind);
+      const sessionMode = registry.isSessionMode(kind);
+      writeWrapped(prompter, `Runtime / ${packageName(kind)}`);
+      writeWrapped(prompter, installed ? `Installed: ${installed.version}${installed.linked ? " (linked development checkout)" : ""}` : "Not installed in the AKMS runtime directory.");
+      writeWrapped(prompter, `Runtime directory: ${runtimePrefix()}`);
+      prompter.write("Connections start Node directly, without a resident npm/npx process.\n");
+      prompter.write(`Configuration: ${sessionMode ? "one session server for this kind" : "one entry per connection"}.
+`);
+      if (installed) writeWrapped(prompter, installed.args[0]);
+      const picked = await prompter.select("AKMS runtime", [
+        ...installed && !sessionMode ? [{ value: "apply", label: "Use for existing connections", hint: "convert npx and old runtime paths together" }] : [],
+        ...installed ? [{ value: "catalog", key: "catalog", label: sessionMode ? "Reapply session launch command" : "Switch to session server", hint: `one ${sessionName(kind)} entry per registered service` }] : [],
+        ...sessionMode && (installed || registry.read().sessions?.[kind]) ? [{ value: "individual", key: "individual", label: "Switch back to per-connection entries", hint: "restore connection settings from the catalog" }] : [],
+        ...!installed?.linked ? [{ value: "install", label: installed ? "Update runtime installation" : "Install AKMS runtime", hint: runtimeInstallCommand(kind) }] : [],
+        ...!registry.needsMigration() ? [{ value: "default", key: "default", label: registry.read().defaultMode === "catalog" ? "Use individual entries for new kinds" : "Start new kinds as session servers", hint: "keep existing kinds and rollback choices" }] : [],
+        { value: "back", key: "b", label: "Back" }
+      ], { cancelValue: "back" });
+      if (picked === "back") {
+        if (requestedKind) return;
+        kind = void 0;
+        continue;
+      }
+      if (picked === "default") {
+        const mode = registry.read().defaultMode === "catalog" ? "individual" : "catalog";
+        prompter.write(`New kinds will use ${mode === "catalog" ? "session servers" : "individual entries"}. Existing kinds keep their settings.
+`);
+        if (await prompter.askYesNo("Change the default for new kinds?", false)) {
+          prompter.write(`${registry.formatResults(registry.setDefaultMode(mode), "Default for new kinds saved.", prompter.paint)}
+`);
+          await prompter.acknowledge();
+        }
+        continue;
+      }
+      if (picked === "catalog" || picked === "individual") {
+        const plan2 = registry.planSession(kind, picked);
+        prompter.clearScreen();
+        writeWrapped(prompter, picked === "catalog" ? `Switch to session server: ${sessionName(kind)}` : "Switch back to per-connection entries");
+        prompter.write("Registry version 2 prevents older AKMS setup packages from changing these settings.\nThe previous catalog revision is kept as registry.previous.json.\n\n");
+        for (const change of plan2.changes) {
+          writeWrapped(prompter, CLIENT_LABELS2[change.client]);
+          writeWrapped(prompter, `Apply: ${change.add.join(", ") || "none"}`, "  ");
+          writeWrapped(prompter, `Remove after replacements are applied: ${change.remove.join(", ") || "none"}`, "  ");
+          if (change.review.length) writeWrapped(prompter, `Keep for Sync review: ${change.review.join(", ")}`, "  ");
+        }
+        if (picked === "catalog") {
+          prompter.write("\nPasswords stay in the catalog and its previous-revision copy. Session entries contain no connection credentials.\n");
+          writeWrapped(prompter, `Command: ${plan2.entry.command}`);
+          writeWrapped(prompter, `Runtime: ${plan2.entry.args[0]} --catalog`);
+          if (plan2.custom.length) {
+            prompter.write("Custom commands will not run in catalog mode; they are retained for switching back:\n");
+            for (const name of plan2.custom) writeWrapped(prompter, plainText(name), "  ");
+          }
+        } else prompter.write("\nConnection credentials will be copied back into registered client settings. The registry stays version 2.\n");
+        if (!await prompter.askYesNo("Apply this configuration mode?", false)) continue;
+        const results2 = registry.applySession(plan2);
+        prompter.clearScreen();
+        prompter.write(`${registry.formatResults(results2, "Configuration mode saved.", prompter.paint)}
+`);
+        await registry.checkSaved(prompter, plan2.names);
+        prompter.write("Restart or reconnect your AI clients to load the new server layout. Fix startup failures first.\n");
+        await prompter.acknowledge();
+        continue;
+      }
+      if (picked === "install") {
+        prompter.clearScreen();
+        writeWrapped(prompter, `Installing ${packageName(kind)}@latest in ${runtimePrefix()}...`);
+        const runtime = await registry.installRuntime(kind);
+        prompter.write(`Installed ${runtime.version}. Reconnect your AI clients to load the update.
+`);
+        await prompter.acknowledge();
+        continue;
+      }
+      const plan = registry.planRuntime(kind);
+      prompter.clearScreen();
+      writeWrapped(prompter, `Use AKMS runtime ${packageName(kind)} ${plan.runtime.version}`);
+      prompter.write(`
+Convert ${plan.names.length} connection(s):
+`);
+      for (const name of plan.names) writeWrapped(prompter, plainText(name), "  ");
+      if (plan.skipped.length) {
+        prompter.write("Custom commands kept for individual review:\n");
+        for (const name of plan.skipped) writeWrapped(prompter, plainText(name), "  ");
+      }
+      prompter.write("\nConnection values and credentials stay the same.\nVersion-pinned npx entries will use the installed version shown above.\n");
+      if (!plan.names.length) {
+        prompter.write("No saved launch commands need converting.\nIf a legacy client entry is missing here, import it from Register or Import existing connections first.\n");
+        await prompter.acknowledge();
+        continue;
+      }
+      if (!await prompter.askYesNo("Apply these launch commands to registered services?", true)) continue;
+      const results = registry.applyRuntime(plan);
+      prompter.clearScreen();
+      prompter.write(`${registry.formatResults(results, "Runtime settings saved.", prompter.paint)}
+
+Restart or reconnect AI clients to replace running npx processes.
+`);
+      await registry.checkSaved(prompter, plan.names);
+      await prompter.acknowledge();
+    } catch (error) {
+      if (error instanceof PromptClosedError) throw error;
+      if (error instanceof PromptBackError) continue;
+      prompter.write(`${error instanceof Error ? error.message : "Could not configure the AKMS runtime."}
+`);
+      await prompter.acknowledge();
+    }
+  }
+}
+
+// src/modules/registration/updates-menu.ts
+async function updatesMenu(prompter, registry) {
+  const kinds = KINDS.filter((kind) => kind !== "wsl" || process.platform === "win32");
+  const latest = /* @__PURE__ */ new Map();
+  const refresh = async () => {
+    prompter.clearScreen();
+    prompter.write("Updates / checking published runtime versions...\n");
+    await Promise.all(kinds.map(async (kind) => {
+      try {
+        latest.set(kind, await registry.latestRuntime(kind));
+      } catch {
+        latest.set(kind, null);
+      }
+    }));
+  };
+  await refresh();
+  for (; ; ) {
+    try {
+      prompter.clearScreen();
+      prompter.write("Updates / AKMS runtimes\n\n");
+      const rows = kinds.map((kind) => {
+        const installed = registry.globalRuntime(kind), published = latest.get(kind);
+        const update = !!installed && !installed.linked && !!published && runtimeIsOlder(installed.version, published);
+        const status = installed?.linked ? "Development link" : !published ? "Unavailable" : !installed ? "Not installed" : update ? "Update available" : "Up to date";
+        writeWrapped(prompter, `${packageName(kind)} | installed: ${installed?.version ?? "not installed"} | latest: ${published ?? "unavailable"} | ${status}`);
+        return { kind, installed, published, update };
+      });
+      const updates = rows.filter((row) => row.update);
+      const available = rows.filter((row) => row.published && !row.installed?.linked && (!row.installed || row.update));
+      prompter.write("\nDevelopment links are managed in their source checkouts.\n");
+      const picked = await prompter.select("Updates", [
+        ...available.map((row) => ({ value: row.kind, key: row.kind, label: `${row.installed ? "Update" : "Install"} ${packageName(row.kind)}` })),
+        ...updates.length ? [{ value: "all", key: "a", label: `Update all available (${updates.length})` }] : [],
+        { value: "refresh", key: "r", label: "Refresh versions" },
+        { value: "back", key: "b", label: "Back" }
+      ], { cancelValue: "back" });
+      if (picked === "back") return;
+      if (picked === "refresh") {
+        await refresh();
+        continue;
+      }
+      const selected = picked === "all" ? updates : available.filter((row) => row.kind === picked);
+      if (!selected.length) continue;
+      if (!await prompter.askYesNo(`Install latest published releases for ${selected.map((row) => packageName(row.kind)).join(", ")}?`, true)) continue;
+      prompter.clearScreen();
+      for (const row of selected) {
+        writeWrapped(prompter, `Updating ${packageName(row.kind)}...`);
+        try {
+          const installed = await registry.installRuntime(row.kind);
+          writeWrapped(prompter, `Installed ${packageName(row.kind)} ${installed.version}.`);
+          const names = Object.entries(registry.read().connections).filter(([, item]) => item.kind === row.kind && item.entry).map(([name]) => name);
+          await registry.checkSaved(prompter, names);
+        } catch (error) {
+          let detail = error instanceof Error ? error.message : "Installation failed.";
+          for (const item of Object.values(registry.read().connections)) if (item.entry) detail = redactStartupText(detail, item.entry);
+          writeWrapped(prompter, `FAILED ${packageName(row.kind)}: ${detail}`);
+          if (/\b(?:EBUSY|EPERM|EACCES)\b/i.test(detail)) prompter.write("Close your AI clients, then retry the update. A running runtime may have locked its files.\n");
+        }
+      }
+      prompter.write("Reconnect or restart your AI clients to load updated runtimes. Fix any failed startup checks first.\n");
+      await prompter.acknowledge();
+    } catch (error) {
+      if (error instanceof PromptClosedError) throw error;
+      if (error instanceof PromptBackError) continue;
+      throw error;
+    }
+  }
+}
+
+// src/modules/registration/migration-menu.ts
+async function migrationMenu(prompter, registry) {
+  try {
+    prompter.clearScreen();
+    const plan = registry.planMigration();
+    prompter.write("Migrate registry\n\n");
+    if (!plan.steps.length) {
+      prompter.write("The registry is already in the current format.\n");
+      await prompter.acknowledge();
+      return;
+    }
+    prompter.write("Steps:\n");
+    plan.steps.forEach((step, index) => writeWrapped(prompter, `${index + 1}. ${step.label}`, "  "));
+    prompter.write('\nThe registry will record defaultMode: "catalog" for new kinds.\nA kind explicitly switched back to individual entries keeps that choice.\n');
+    for (const item of plan.kinds) {
+      prompter.write("\n");
+      const target = sessionName(item.kind);
+      const action = item.status === "catalog" ? `already ${target}; keep` : item.status === "individual" ? "keep explicit per-connection choice (rollback)" : item.status === "empty" ? `no connections; future connections use ${target}` : item.status === "blocked" ? "blocked" : `per-connection entries -> ${target}${item.status === "pending-runtime" ? " after runtime setup" : ""}`;
+      writeWrapped(prompter, `${item.kind.toUpperCase()}: ${item.names.length} connection(s), ${action}`);
+      if (item.detail) writeWrapped(prompter, plainText(item.detail), "  ");
+      for (const change of item.session?.changes ?? item.changes ?? []) {
+        writeWrapped(prompter, `${CLIENT_LABELS2[change.client]}${item.status === "pending-runtime" ? " (after Runtime + Sync)" : ""}`, "  ");
+        writeWrapped(prompter, `Apply: ${change.add.join(", ") || "none"}`, "    ");
+        writeWrapped(prompter, `Remove after verification: ${change.remove.join(", ") || "none"}`, "    ");
+        if (change.review.length) writeWrapped(prompter, `Keep for Sync review: ${change.review.map(plainText).join(", ")}`, "    ");
+      }
+      if (item.session?.custom.length) writeWrapped(prompter, `Custom commands retained for rollback: ${item.session.custom.map(plainText).join(", ")}`, "  ");
+    }
+    prompter.write("\nThe previous catalog revision is kept in registry.previous.json.\nSession entries contain no connection credentials; those stay in the catalog and its previous revision.\n");
+    if (plan.kinds.some((item) => item.status === "blocked")) {
+      prompter.write("Resolve blocked kinds before migrating. No migration was applied.\n");
+      await prompter.acknowledge();
+      return;
+    }
+    if (!await prompter.askYesNo("Migrate registry and apply these changes?", false)) return;
+    const results = registry.applyMigration(plan);
+    prompter.clearScreen();
+    prompter.write(`${registry.formatResults(results, "Registry migration saved.", prompter.paint)}
+`);
+    await registry.checkSaved(prompter, plan.kinds.filter((item) => item.status !== "individual").flatMap((item) => item.names));
+    prompter.write("Reconnect affected clients after changes to their server layout. Fix startup failures first.\n");
+    await prompter.acknowledge();
+  } catch (error) {
+    if (error instanceof PromptClosedError) throw error;
+    if (error instanceof PromptBackError) return;
+    prompter.write(`${error instanceof Error ? error.message : "Could not migrate the registry."}
+`);
+    await prompter.acknowledge();
+  }
+}
+
+// src/modules/registration/menu.ts
+function pendingImports(registry, kind) {
+  const state = registry.read();
+  const entries = registry.candidates(kind).entries.filter((candidate) => !Object.hasOwn(state.connections, candidate.name));
+  const names = [...new Set(entries.map((candidate) => candidate.name))];
+  return { names, differing: names.filter((name) => new Set(entries.filter((item) => item.name === name).map((item) => entryHash(item.entry))).size > 1).length };
+}
+function preview(prompter, entry) {
+  if (!entry) {
+    prompter.write("  Remove this connection from the service.\n");
+    return;
+  }
+  for (const [key, value] of Object.entries(entry.env)) prompter.write(`  ${plainText(key)}: ${visibleField.test(key) ? plainText(value) : "(hidden)"}
+`);
+}
+async function registrationMenu(prompter, registry, initialClient) {
+  const initial = registry.read();
+  const selected = new Set(initial.clients);
+  if (initialClient) selected.add(initialClient);
+  const discovered = registry.candidates(void 0, registry.targets.filter((target) => target.id !== "registered").map((target) => target.id));
+  let cursor = initialClient ?? registry.targets[0]?.id;
+  let privacyNoticeShown = false;
+  for (; ; ) {
+    try {
+      prompter.clearScreen();
+      prompter.write("\nRegister \xB7 AI services\nShared by Database, SSH, WSL and S3.\nEnter toggles a service; Apply saves the selection.\nMatching existing connections are imported on Apply; differing settings stay unchanged.\n\n");
+      for (const error of discovered.errors) prompter.write(`  ${error}
+`);
+      const picked = await prompter.select("Register", [
+        ...registry.targets.filter((target) => target.id !== "registered").map((target) => ({
+          value: target.id,
+          label: `[${selected.has(target.id) ? "x" : " "}] ${target.label}`,
+          hint: `${initial.clients.includes(target.id) ? "Registered" : "Not registered"} \xB7 ${discovered.entries.filter((entry) => entry.client === target.id).length} existing AKMS \xB7 ${target.detected ? "Found" : "Not detected"} \xB7 ${target.location}`
+        })),
+        { separator: true },
+        { value: "apply", key: "a", label: "Apply registration" },
+        { value: "back", key: "q", label: "Back" }
+      ], { defaultValue: cursor, cancelValue: "back" });
+      if (picked === "back") return false;
+      if (picked !== "apply") {
+        const client = picked;
+        if (selected.has(client)) selected.delete(client);
+        else selected.add(client);
+        cursor = client;
+        continue;
+      }
+      const removed = initial.clients.filter((id) => !selected.has(id));
+      const count = Object.values(registry.read().connections).filter((item) => item.entry).length;
+      const plan = registry.planRegistration([...selected]);
+      const importNames = [...new Set(plan.imports.map((entry) => entry.name))];
+      prompter.clearScreen();
+      prompter.write("Review registration\n");
+      prompter.write(`
+Selected: ${[...selected].map((id) => CLIENT_LABELS2[id]).join(" \xB7 ") || "none"}
+Apply ${count + importNames.length} shared connection(s) to these services.
+`);
+      if (importNames.length) prompter.write(`Import ${importNames.length} existing connection(s); identical copies become one shared item:
+  ${importNames.join("\n  ")}
+`);
+      if (plan.conflicts.length) prompter.write(`Keep ${plan.conflicts.length} differing connection(s) unchanged until you choose a version:
+  ${plan.conflicts.join("\n  ")}
+`);
+      for (const error of plan.errors) prompter.write(`  ${error}
+`);
+      if (initial.defaultMode === "catalog") {
+        prompter.write("Services use one session entry per kind. Imported individual entries are removed after that session entry is verified.\n");
+        if (plan.imports.some((item) => !registry.globalRuntime(item.kind))) prompter.write("Install missing runtimes from Runtime, then run Sync. Existing entries stay until then.\n");
+        if (plan.imports.some((item) => !standardLaunch(item.entry, item.kind))) prompter.write("Custom launch commands are retained for rollback; session mode uses each connection's saved environment.\n");
+      }
+      if (removed.length) prompter.write(`Unregister: ${removed.map((id) => CLIENT_LABELS2[id]).join(" \xB7 ")}
+Remove only AKMS-managed entries from these services; keep the shared catalog.
+`);
+      if (!privacyNoticeShown) {
+        writeWrapped(prompter, `Connection settings, including passwords, are stored in ${plainText(registry.file)}.`);
+        prompter.write("Keep this file private: do not share, sync or commit it.\n");
+        prompter.write("Its previous revision, registry.previous.json, also contains saved credentials.\n");
+        privacyNoticeShown = true;
+      }
+      if (!await prompter.askYesNo("Apply this registration?", removed.length === 0)) continue;
+      const results = registry.register([...selected], initial.clients, plan.imports);
+      prompter.clearScreen();
+      prompter.write(`
+${registry.formatResults(results, `Registration saved.
+  AI services: ${[...selected].map((id) => CLIENT_LABELS2[id]).join(" \xB7 ") || "none"}`, prompter.paint)}
+`);
+      if (importNames.length) prompter.write(`Imported ${importNames.length} existing connection(s) into the shared list.
+`);
+      try {
+        const conflicts = new Set(results.filter((result) => result.status === "conflict").map((result) => result.name));
+        if (conflicts.size && await prompter.askYesNo(`Compare settings for ${conflicts.size} connection(s) now?`, true)) await syncMenu(prompter, registry);
+        const current = registry.read();
+        const remaining = registry.candidates().entries.filter((candidate) => !Object.hasOwn(current.connections, candidate.name));
+        const names = [...new Set(remaining.map((candidate) => candidate.name))];
+        if (names.length) {
+          prompter.write(`
+${names.length} existing connection(s) still need a choice before joining the shared list:
+`);
+          for (const name of names) {
+            const copies = remaining.filter((candidate) => candidate.name === name);
+            prompter.write(`  ${plainText(name)} \xB7 ${copies.map((copy) => CLIENT_LABELS2[copy.client]).join(" \xB7 ")}
+`);
+            if (new Set(copies.map((copy) => entryHash(copy.entry))).size > 1) prompter.write(`    ${describeDifferences(copies.map((copy) => copy.entry))}
+`);
+          }
+          prompter.write("Their existing settings are unchanged. Compare them now, or use Import existing connections later.\n");
+          if (await prompter.askYesNo("Compare existing settings and choose which to share?", true)) await importMenu(prompter, registry);
+        }
+        if (!conflicts.size && !names.length) await prompter.acknowledge();
+      } catch (error) {
+        if (!(error instanceof PromptBackError)) throw error;
+      }
+      return true;
+    } catch (error) {
+      if (error instanceof PromptClosedError) throw error;
+      if (error instanceof PromptBackError) continue;
+      prompter.write(`  ${error instanceof Error ? error.message : "Registration could not be saved."}
+`);
+      await prompter.acknowledge();
+    }
+  }
+}
+async function importMenu(prompter, registry, kind) {
+  for (; ; ) {
+    prompter.clearScreen();
+    prompter.write("Import existing connections\n\n");
+    const { entries, errors } = registry.candidates(kind);
+    for (const error of errors) prompter.write(`  ${error}
+`);
+    const state = registry.read();
+    const matching = registry.planRegistration(state.clients, kind);
+    const matchingNames = [...new Set(matching.imports.map((entry) => entry.name))];
+    const names = [...new Set(entries.filter((candidate) => {
+      const current = Object.hasOwn(state.connections, candidate.name) ? state.connections[candidate.name] : void 0;
+      return !current?.entry || current.applied[candidate.client] !== entryHash(candidate.entry) || entryHash(current.entry) !== entryHash(candidate.entry);
+    }).map((entry) => entry.name))];
+    if (!names.length) {
+      prompter.write("  No existing connections need importing.\n");
+      await prompter.acknowledge();
+      return;
+    }
+    const picked = await prompter.select("Import existing connections", [
+      ...names.map((name) => ({ value: `entry:${name}`, key: name, label: name, hint: [...new Set(entries.filter((entry) => entry.name === name).map((entry) => CLIENT_LABELS2[entry.client]))].join(" \xB7 ") })),
+      ...matchingNames.length ? [{ value: "matching", key: "all", label: "Import all matching connections", hint: `${matchingNames.length} connections; differing versions stay unchanged` }] : [],
+      { value: "back", key: "b", label: "Back" }
+    ], { cancelValue: "back" });
+    if (picked === "back") return;
+    try {
+      prompter.clearScreen();
+      if (picked === "matching") {
+        prompter.write(`
+Import existing connections:
+  ${matchingNames.join("\n  ")}
+`);
+        if (await prompter.askYesNo("Import matching connections and apply them?", true)) {
+          const results2 = registry.register(state.clients, state.clients, matching.imports);
+          prompter.clearScreen();
+          prompter.write(`${registry.formatResults(results2, "Import complete", prompter.paint)}
+`);
+          await prompter.acknowledge();
+        }
+        continue;
+      }
+      const name = picked.slice(6);
+      const candidates = entries.filter((entry) => entry.name === name);
+      let chosen = candidates[0];
+      if (new Set(candidates.map((candidate) => entryHash(candidate.entry))).size > 1) {
+        prompter.write(`
+${plainText(name)} \xB7 Choose the settings to use on all registered services.
+`);
+        compareEntries(prompter, candidates.map((candidate) => ({ label: CLIENT_LABELS2[candidate.client], entry: candidate.entry })));
+        const choice = await prompter.select("Use settings from", [
+          ...candidates.map((candidate, index) => ({ value: String(index), label: `Use ${index + 1}: ${CLIENT_LABELS2[candidate.client]}` })),
+          { value: "back", label: "Back" }
+        ], { cancelValue: "back" });
+        if (choice === "back") continue;
+        chosen = candidates[Number(choice)];
+      }
+      preview(prompter, chosen.entry);
+      const destination = await prompter.askRequired("Shared connection name (change it to keep both)", name);
+      prompter.write("The selected version will be used by every registered service.\n");
+      if (!await prompter.askYesNo(`Import ${destination} and apply it?`, true)) continue;
+      const results = registry.importEntry(destination, chosen, candidates);
+      prompter.clearScreen();
+      prompter.write(`
+${registry.formatResults(results, "Import complete", prompter.paint)}
+`);
+      if (destination !== name) prompter.write("  The original entries were kept under their old name.\n");
+      await prompter.acknowledge();
+    } catch (error) {
+      if (error instanceof PromptClosedError) throw error;
+      if (error instanceof PromptBackError) continue;
+      prompter.write(`  ${error instanceof Error ? error.message : "Import failed."}
+`);
+      await prompter.acknowledge();
+    }
+  }
+}
+async function syncMenu(prompter, registry) {
+  let pendingResults;
+  for (; ; ) {
+    prompter.clearScreen();
+    const results = pendingResults ?? registry.sync();
+    pendingResults = void 0;
+    prompter.write(`
+${registry.formatResults(results, "Sync results", prompter.paint, "Next: choose an item below to compare settings and pick a version.")}
+`);
+    const imports = pendingImports(registry);
+    if (imports.names.length) prompter.write(prompter.paint.warning(`
+Not yet imported: ${imports.names.length} connection(s)${imports.differing === imports.names.length ? " with differing settings" : ""} - open Import existing connections.
+`));
+    const conflicts = results.filter((result) => result.status === "conflict");
+    if (!conflicts.length && !imports.names.length) {
+      await prompter.acknowledge();
+      return;
+    }
+    const picked = await prompter.select("Review differences", [
+      ...conflicts.map((item, index) => ({ value: String(index), label: `${CLIENT_LABELS2[item.client]} \xB7 ${item.name}` })),
+      ...imports.names.length ? [{ value: "import", key: "import", label: "Import existing connections", hint: `${imports.names.length} connection(s) to review` }] : [],
+      { value: "back", key: "b", label: "Later \u2014 keep existing settings" }
+    ], { cancelValue: "back" });
+    if (picked === "back") return;
+    try {
+      if (picked === "import") {
+        await importMenu(prompter, registry);
+        continue;
+      }
+      prompter.clearScreen();
+      const conflict = conflicts[Number(picked)];
+      const state = registry.read();
+      const sessionKind = Object.keys(state.sessions ?? {}).find((kind) => sessionName(kind) === conflict.name);
+      if (sessionKind) {
+        const session = state.sessions[sessionKind];
+        const actual2 = registry.targets.find((target) => target.id === conflict.client)?.readEntries()[conflict.name];
+        if (!actual2 || entryKind(actual2) !== sessionKind) {
+          prompter.write("This session name belongs to an unsupported or different server. Rename the external entry manually; it was kept.\n");
+          await prompter.acknowledge();
+          continue;
+        }
+        const removing2 = !registry.isSessionMode(sessionKind, state) || !state.clients.includes(conflict.client) || !Object.values(state.connections).some((item) => item.kind === sessionKind && item.entry);
+        writeWrapped(prompter, `Session server / ${conflict.name} / ${CLIENT_LABELS2[conflict.client]}`);
+        compareEntries(prompter, [{ label: "AKMS session launch", entry: session.entry }, { label: "External settings", entry: actual2 }]);
+        const choice2 = await prompter.select("Resolve session launch", [
+          { value: "apply", label: removing2 ? "Remove the old session entry" : "Restore the AKMS session launch" },
+          { value: "back", key: "b", label: "Keep external settings for now" }
+        ], { cancelValue: "back" });
+        if (choice2 === "apply" && await prompter.askYesNo(removing2 ? "Remove this session entry?" : "Replace these external launch settings?", false)) pendingResults = registry.resolve(conflict.client, conflict.name, actual2, false);
+        continue;
+      }
+      const connection = state.connections[conflict.name];
+      if (!connection) throw new Error("This connection changed. Reopen Sync to review its current settings.");
+      const actual = registry.targets.find((target) => target.id === conflict.client)?.readEntries()[conflict.name];
+      if (!actual || entryKind(actual) !== connection.kind) {
+        prompter.write("  This name belongs to a different or unsupported server. Rename that entry manually, or rename the shared connection.\n");
+        await prompter.acknowledge();
+        continue;
+      }
+      const client = CLIENT_LABELS2[conflict.client];
+      const registered = state.clients.includes(conflict.client);
+      const sessionMode = registry.isSessionMode(connection.kind, state);
+      const removing = !connection.entry || !registered;
+      const retiring = sessionMode && !removing;
+      const subject = connection.entry && descriptionOnly([connection.entry, actual]) ? "description" : "settings";
+      writeWrapped(prompter, `Sync / ${plainText(conflict.name)}`);
+      writeWrapped(prompter, `Registered services: ${state.clients.map((id) => CLIENT_LABELS2[id]).join(" \xB7 ") || "none"}`);
+      prompter.write("\n");
+      if (!removing && connection.entry) {
+        if (retiring) {
+          writeWrapped(prompter, `Choose settings for ${sessionName(connection.kind)} before removing the old ${client} entry.`);
+          writeWrapped(prompter, "The old entry stays until the session server is ready.");
+        }
+        compareEntries(prompter, [{ label: "Saved in AKMS", entry: connection.entry }, { label: `Currently in ${client}`, entry: actual }]);
+      } else {
+        writeWrapped(prompter, !registered ? `${client} is no longer registered.` : sessionMode ? `This kind now uses ${sessionName(connection.kind)}. The individual client entry is no longer needed.` : "This connection was removed from AKMS.");
+        writeWrapped(prompter, `Its settings in ${client} changed before removal could finish.`);
+        prompter.write(`
+Currently in ${client}
+`);
+        preview(prompter, actual);
+        prompter.write("\n");
+      }
+      const choices = [
+        { value: "shared", label: removing ? `Remove from ${client}` : retiring ? "Use 1: keep AKMS settings" : `Use 1: AKMS -> ${client}`, hint: removing ? "finish the pending removal" : retiring ? `use version 1 in ${sessionName(connection.kind)}` : `replace its ${subject} with version 1` },
+        ...registered ? [{ value: "client", label: removing ? `Restore from ${client}` : `Use 2: ${client} -> all ${state.clients.length} services`, hint: retiring ? `save version 2 in AKMS for ${sessionName(connection.kind)}` : "save in AKMS and sync registered services" }] : [],
+        { value: "back", key: "b", label: "Back without changes" }
+      ];
+      const choice = await prompter.select(removing ? registered ? "Remove or restore this connection?" : `Remove this connection from ${client}?` : `Which ${subject} should be used?`, choices, { cancelValue: "back" });
+      if (choice === "back") continue;
+      prompter.write("\n");
+      if (choice === "client") {
+        writeWrapped(prompter, `Save the ${client} version in AKMS.`);
+        writeWrapped(prompter, `Sync to: ${state.clients.map((id) => CLIENT_LABELS2[id]).join(" \xB7 ")}`);
+      } else writeWrapped(prompter, removing ? `Remove ${plainText(conflict.name)} from ${client}.` : retiring ? `Keep the saved AKMS ${subject}.` : `Copy the saved AKMS ${subject} to ${client}.`);
+      if (retiring) writeWrapped(prompter, `Keep the old ${client} entry until ${sessionName(connection.kind)} is ready, then remove it.`);
+      const confirmation = choice === "client" ? `Save in AKMS and sync ${state.clients.length} services?` : removing ? `Remove from ${client}?` : retiring ? "Keep version 1 and finish Sync?" : `Update ${client} with version 1?`;
+      if (await prompter.askYesNo(confirmation, false)) {
+        pendingResults = registry.resolve(conflict.client, conflict.name, actual, choice === "client");
+      }
+    } catch (error) {
+      if (error instanceof PromptClosedError) throw error;
+      if (error instanceof PromptBackError) continue;
+      prompter.write(`  ${error instanceof Error ? error.message : "Could not resolve the difference."}
+`);
+      await prompter.acknowledge();
+    }
+  }
+}
+
+// src/modules/registration/targets/index.ts
+import os5 from "os";
+import path10 from "path";
+
+// src/modules/registration/targets/claude-code.ts
+import { spawnSync } from "child_process";
+import fs8 from "fs";
+import os3 from "os";
+import path8 from "path";
+
+// src/modules/registration/paths.ts
+import fs5 from "fs";
+import path6 from "path";
+function findExecutable(name) {
+  const searchPath = process.env.PATH ?? "";
+  const directories = searchPath.split(path6.delimiter).filter((directory) => directory !== "");
+  let suffixes = [""];
+  if (process.platform === "win32") {
+    const pathExt = process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD";
+    suffixes = pathExt.split(";").filter((suffix) => suffix !== "");
+  }
+  for (const directory of directories) {
+    for (const suffix of suffixes) {
+      const candidate = path6.join(directory, `${name}${suffix}`);
+      if (fs5.existsSync(candidate) == true && fs5.statSync(candidate).isFile() == true) {
+        return candidate;
+      }
+    }
+  }
+  return null;
+}
+
+// src/modules/registration/targets/json-file.ts
+import fs7 from "fs";
+
+// src/modules/registration/targets/config-file.ts
+import fs6 from "fs";
+import path7 from "path";
+import { randomUUID as randomUUID2 } from "crypto";
+function readExisting2(filePath) {
+  try {
+    return fs6.readFileSync(filePath, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return null;
+    }
+    throw error;
+  }
+}
+function updateConfigFile2(filePath, update) {
+  let destination = filePath;
+  let symbolicLink = false;
+  try {
+    symbolicLink = fs6.lstatSync(filePath).isSymbolicLink();
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      throw error;
+    }
+  }
+  if (symbolicLink) {
+    destination = fs6.realpathSync(filePath);
+  }
+  const before = readExisting2(destination);
+  const updated = update(before ?? "");
+  if (before != null) {
+    fs6.accessSync(destination, fs6.constants.W_OK);
+  }
+  fs6.mkdirSync(path7.dirname(destination), { recursive: true });
+  const temporary = path7.join(path7.dirname(destination), `.${path7.basename(destination)}.${randomUUID2()}.tmp`);
+  const mode = before == null ? 384 : fs6.statSync(destination).mode & 511;
+  let descriptor;
+  let ownsTemporary = false;
+  try {
+    descriptor = fs6.openSync(temporary, "wx", mode);
+    ownsTemporary = true;
+    fs6.writeFileSync(descriptor, updated, "utf8");
+    fs6.fsyncSync(descriptor);
+    fs6.closeSync(descriptor);
+    descriptor = void 0;
+    if (readExisting2(destination) !== before) {
+      throw new Error("The config changed while saving; reload it and try again.");
+    }
+    fs6.renameSync(temporary, destination);
+    ownsTemporary = false;
+  } finally {
+    try {
+      if (descriptor != null) {
+        fs6.closeSync(descriptor);
+      }
+    } finally {
+      if (ownsTemporary) {
+        fs6.unlinkSync(temporary);
+      }
+    }
+  }
+}
+
+// src/modules/registration/targets/json-file.ts
+function toMcpServerEntry(value) {
+  if (typeof value !== "object" || value == null) {
+    return null;
+  }
+  const record2 = value;
+  if (typeof record2.command !== "string") {
+    return null;
+  }
+  let args = [];
+  if (Array.isArray(record2.args) == true) {
+    args = record2.args.filter((item) => typeof item === "string");
+  }
+  const env = /* @__PURE__ */ Object.create(null);
+  if (typeof record2.env === "object" && record2.env != null) {
+    for (const [key, item] of Object.entries(record2.env)) {
+      if (typeof item === "string") {
+        env[key] = item;
+      }
+    }
+  }
+  return { command: record2.command, args, env };
+}
+function readRawMcpServersJson(document) {
+  if (typeof document !== "object" || document == null || Array.isArray(document)) {
+    throw new Error("the config file is not a JSON object");
+  }
+  const servers = document.mcpServers;
+  if (servers === void 0) {
+    return {};
+  }
+  if (typeof servers !== "object" || servers == null || Array.isArray(servers)) {
+    throw new Error("mcpServers is not a JSON object");
+  }
+  return servers;
+}
+function readMcpServersJson(document) {
+  const entries = /* @__PURE__ */ Object.create(null);
+  for (const [name, value] of Object.entries(readRawMcpServersJson(document))) {
+    const entry = toMcpServerEntry(value);
+    if (entry != null) {
+      entries[name] = entry;
+    }
+  }
+  return entries;
+}
+function readDocument(filePath, contents) {
+  if (contents == null && fs7.existsSync(filePath) == false) {
+    return {};
+  }
+  const text = contents ?? fs7.readFileSync(filePath, "utf8");
+  if (text.trim() === "") {
+    return {};
+  }
+  let document;
+  try {
+    document = JSON.parse(text);
+  } catch (ex) {
+    let detail = String(ex);
+    if (ex instanceof Error) {
+      detail = ex.message;
+    }
+    throw new Error(`${filePath} is not valid JSON: ${detail}`);
+  }
+  if (typeof document !== "object" || document == null || Array.isArray(document) == true) {
+    throw new Error(`${filePath} is not a JSON object`);
+  }
+  return document;
+}
+function createJsonFileTarget(options) {
+  const { id, label, filePath } = options;
+  return {
+    id,
+    label,
+    location: filePath,
+    detected: fs7.existsSync(filePath),
+    readEntries() {
+      const document = readDocument(filePath);
+      return readMcpServersJson(document);
+    },
+    hasEntry(name) {
+      return Object.hasOwn(readRawMcpServersJson(readDocument(filePath)), name);
+    },
+    writeEntry(name, entry) {
+      updateConfigFile2(filePath, (contents) => {
+        const document = readDocument(filePath, contents);
+        const servers = Object.assign(/* @__PURE__ */ Object.create(null), readRawMcpServersJson(document));
+        servers[name] = entry;
+        document.mcpServers = servers;
+        return JSON.stringify(document, null, 4) + "\n";
+      });
+      return { status: "written", detail: filePath };
+    },
+    removeEntry(name) {
+      updateConfigFile2(filePath, (contents) => {
+        const document = readDocument(filePath, contents);
+        const servers = readRawMcpServersJson(document);
+        delete servers[name];
+        return JSON.stringify(document, null, 4) + "\n";
+      });
+      return { status: "written", detail: filePath };
+    }
+  };
+}
+
+// src/modules/registration/targets/claude-code.ts
+var CLAUDE_CODE_CONFIG_PATH = path8.join(os3.homedir(), ".claude.json");
+var CMD_META_CHARACTER_PATTERN = /([()\][%!^"`<>&|;, *?])/g;
+function toClaudeAddJsonPayload(entry) {
+  return JSON.stringify({ type: "stdio", command: entry.command, args: entry.args, env: entry.env });
+}
+function escapeCmdArgument(argument) {
+  let escaped = argument.replace(/(\\*)"/g, '$1$1\\"');
+  escaped = escaped.replace(/(\\*)$/, "$1$1");
+  escaped = `"${escaped}"`;
+  escaped = escaped.replace(CMD_META_CHARACTER_PATTERN, "^$1");
+  escaped = escaped.replace(CMD_META_CHARACTER_PATTERN, "^$1");
+  return escaped;
+}
+function runCliCommand(executable, args) {
+  const isBatchShim = /\.(cmd|bat)$/i.test(executable) == true;
+  if (process.platform !== "win32" || isBatchShim == false) {
+    const result2 = spawnSync(executable, args, { encoding: "utf8", windowsHide: true });
+    return result2;
+  }
+  const commandLine = [executable.replace(CMD_META_CHARACTER_PATTERN, "^$1"), ...args.map(escapeCmdArgument)].join(" ");
+  const result = spawnSync(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", `"${commandLine}"`], {
+    encoding: "utf8",
+    windowsHide: true,
+    windowsVerbatimArguments: true
+  });
+  return result;
+}
+function runClaude(executable, args) {
+  const result = runCliCommand(executable, args);
+  if (result.error != null) {
+    return { status: "unavailable", detail: `could not run claude: ${result.error.message}` };
+  }
+  if (result.status !== 0) {
+    let output = (result.stderr ?? "").trim();
+    if (output === "") {
+      output = (result.stdout ?? "").trim();
+    }
+    return { status: "unavailable", detail: `claude exited with ${result.status}: ${output}` };
+  }
+  return { status: "written", detail: CLAUDE_CODE_CONFIG_PATH };
+}
+function readRawClaudeEntries() {
+  if (fs8.existsSync(CLAUDE_CODE_CONFIG_PATH) == false) {
+    return {};
+  }
+  const text = fs8.readFileSync(CLAUDE_CODE_CONFIG_PATH, "utf8");
+  let document;
+  try {
+    document = JSON.parse(text);
+  } catch (ex) {
+    let detail = String(ex);
+    if (ex instanceof Error) {
+      detail = ex.message;
+    }
+    throw new Error(`${CLAUDE_CODE_CONFIG_PATH} is not valid JSON: ${detail}`);
+  }
+  return readRawMcpServersJson(document);
+}
+function createClaudeCodeTarget() {
+  const executable = findExecutable("claude");
+  return {
+    id: "claude-code",
+    label: "Claude Code (user scope)",
+    location: CLAUDE_CODE_CONFIG_PATH,
+    detected: executable != null || fs8.existsSync(CLAUDE_CODE_CONFIG_PATH) == true,
+    readEntries() {
+      return readMcpServersJson({ mcpServers: readRawClaudeEntries() });
+    },
+    hasEntry(name) {
+      return Object.hasOwn(readRawClaudeEntries(), name);
+    },
+    writeEntry(name, entry) {
+      if (executable == null) {
+        return {
+          status: "unavailable",
+          detail: "the claude CLI is not on PATH \u2014 install it, or use Print to get a command to run yourself"
+        };
+      }
+      const previousEntries = readRawClaudeEntries();
+      const hadPrevious = Object.hasOwn(previousEntries, name);
+      const previous = previousEntries[name];
+      if (hadPrevious) {
+        const removed = runClaude(executable, ["mcp", "remove", name, "-s", "user"]);
+        if (removed.status === "unavailable") {
+          return removed;
+        }
+      }
+      const added = runClaude(executable, ["mcp", "add-json", name, toClaudeAddJsonPayload(entry), "-s", "user"]);
+      if (added.status === "unavailable" && hadPrevious) {
+        const restored = runClaude(executable, ["mcp", "add-json", name, JSON.stringify(previous), "-s", "user"]);
+        const recovery = restored.status === "written" ? "the previous entry was restored" : `could not restore the previous entry: ${restored.detail}`;
+        return { status: "unavailable", detail: `${added.detail}
+  ${recovery}` };
+      }
+      return added;
+    },
+    removeEntry(name) {
+      if (executable == null) {
+        return {
+          status: "unavailable",
+          detail: `the claude CLI is not on PATH \u2014 run this yourself:
+  claude mcp remove ${name} -s user`
+        };
+      }
+      return runClaude(executable, ["mcp", "remove", name, "-s", "user"]);
+    }
+  };
+}
+
+// src/modules/registration/targets/codex.ts
+import fs9 from "fs";
+import os4 from "os";
+import path9 from "path";
+
+// src/modules/registration/targets/toml-lines.ts
+function lineState() {
+  return { quote: null, multiline: false, depth: 0 };
+}
+function scanTomlLine(line, state) {
+  for (let index = 0; index < line.length; index += 1) {
+    const character = line[index];
+    if (state.quote != null) {
+      if (character === "\\" && state.quote === '"') {
+        index += 1;
+      } else if (character === state.quote) {
+        if (!state.multiline) {
+          state.quote = null;
+        } else if (line.slice(index, index + 3) === state.quote.repeat(3)) {
+          while (line[index + 1] === character) {
+            index += 1;
+          }
+          state.quote = null;
+          state.multiline = false;
+        }
+      }
+      continue;
+    }
+    if (character === "#") {
+      break;
+    }
+    if (character === '"' || character === "'") {
+      state.quote = character;
+      state.multiline = line.slice(index, index + 3) === character.repeat(3);
+      if (state.multiline) {
+        index += 2;
+      }
+    } else if (character === "[" || character === "{") {
+      state.depth += 1;
+    } else if (character === "]" || character === "}") {
+      state.depth -= 1;
+    }
+  }
+}
+
+// src/modules/registration/targets/toml-validation.ts
+import { isDeepStrictEqual } from "util";
+import { parse, TomlError } from "smol-toml";
+function isTable(value) {
+  return value != null && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date);
+}
+function parseConfigToml(text) {
+  let document;
+  try {
+    document = parse(text, { integersAsBigInt: true });
+  } catch (error) {
+    const location = error instanceof TomlError ? ` at line ${error.line}, column ${error.column}` : "";
+    throw new Error(`Invalid TOML${location}; fix the config before changing it.`);
+  }
+  if (Object.hasOwn(document, "mcp_servers") && !isTable(document.mcp_servers)) {
+    throw new Error("mcp_servers must be a TOML table.");
+  }
+  return document;
+}
+function readTomlEntries(text) {
+  return readMcpServersJson({ mcpServers: parseConfigToml(text).mcp_servers ?? {} });
+}
+function hasTomlEntry(text, name) {
+  return Object.hasOwn(parseConfigToml(text).mcp_servers ?? {}, name);
+}
+function normalize(document) {
+  const servers = document.mcp_servers;
+  if (servers == null) {
+    return;
+  }
+  for (const server of Object.values(servers)) {
+    if (isTable(server) && isTable(server.env) && Object.keys(server.env).length === 0) {
+      delete server.env;
+    }
+  }
+  if (Object.keys(servers).length === 0) {
+    delete document.mcp_servers;
+  }
+}
+function verifyTomlEdit(before, after, name, entry) {
+  const expected = parseConfigToml(before);
+  const servers = expected.mcp_servers ?? /* @__PURE__ */ Object.create(null);
+  if (entry == null) {
+    delete servers[name];
+  } else {
+    const previous = Object.hasOwn(servers, name) && isTable(servers[name]) ? servers[name] : {};
+    Object.defineProperty(servers, name, {
+      value: Object.assign(/* @__PURE__ */ Object.create(null), previous, { command: entry.command, args: [...entry.args], env: Object.assign(/* @__PURE__ */ Object.create(null), entry.env) }),
+      configurable: true,
+      enumerable: true,
+      writable: true
+    });
+  }
+  expected.mcp_servers = servers;
+  let actual;
+  try {
+    actual = parseConfigToml(after);
+  } catch {
+    throw new Error("Cannot safely edit this TOML layout. Use [mcp_servers.<name>] tables; nothing was written.");
+  }
+  normalize(expected);
+  normalize(actual);
+  if (!isDeepStrictEqual(expected, actual)) {
+    throw new Error("Cannot safely edit this TOML layout without changing other settings; nothing was written.");
+  }
+  return after;
+}
+
+// src/modules/registration/targets/toml-subset.ts
+var BARE_KEY_PATTERN = /^[A-Za-z0-9_-]+$/;
+var ANY_HEADER_PATTERN = /^\s*\[/;
+var SERVER_HEADER_PATTERN = /^\s*\[\s*(?:mcp_servers|"mcp_servers"|'mcp_servers')\s*\.\s*([A-Za-z0-9_-]+|"(?:[^"\\]|\\.)*"|'[^']*')\s*((?:\.[^\]]*)?)\]\s*(?:#.*)?$/;
+var KEY_VALUE_PATTERN = /^\s*([A-Za-z0-9_-]+|"(?:[^"\\]|\\.)*"|'[^']*')\s*=\s*(.*)$/;
+var OWNED_TABLE_KEYS = ["command", "args", "env"];
+function unquoteKey(rawKey) {
+  if (rawKey.startsWith('"') || rawKey.startsWith("'")) {
+    return parseConfigToml(`value = ${rawKey}`).value;
+  }
+  return rawKey;
+}
+function readStatements(body) {
+  const statements = [];
+  let index = 0;
+  while (index < body.length) {
+    const match = KEY_VALUE_PATTERN.exec(body[index]);
+    if (match == null) {
+      index += 1;
+      continue;
+    }
+    const start = index;
+    const state = lineState();
+    scanTomlLine(match[2], state);
+    index += 1;
+    while ((state.quote != null || state.depth > 0) && index < body.length) {
+      scanTomlLine(body[index], state);
+      index += 1;
+    }
+    statements.push({ key: unquoteKey(match[1]), start, end: index });
+  }
+  return statements;
+}
+function splitSections(lines) {
+  const sections = [{ header: null, serverName: null, subPath: "", body: [] }];
+  const state = lineState();
+  for (const line of lines) {
+    const current = sections[sections.length - 1];
+    if (state.quote != null || state.depth > 0) {
+      current.body.push(line);
+      scanTomlLine(line, state);
+      continue;
+    }
+    if (ANY_HEADER_PATTERN.test(line) == true) {
+      const serverMatch = SERVER_HEADER_PATTERN.exec(line);
+      let serverName = null;
+      let subPath = "";
+      if (serverMatch != null) {
+        serverName = unquoteKey(serverMatch[1]);
+        subPath = serverMatch[2].replace(/^\./, "").replace(/\s+/g, "");
+      }
+      sections.push({ header: line, serverName, subPath, body: [] });
+      continue;
+    }
+    current.body.push(line);
+    scanTomlLine(line, state);
+  }
+  return sections;
+}
+function hasMcpServerToml(text, name) {
+  return hasTomlEntry(text, name);
+}
+function parseMcpServersToml(text) {
+  return readTomlEntries(text);
+}
+function quoteTomlString(value) {
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t").replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`);
+  return `"${escaped}"`;
+}
+function formatTomlKey(key) {
+  if (BARE_KEY_PATTERN.test(key) == true) {
+    return key;
+  }
+  return quoteTomlString(key);
+}
+function renderOwnedLines(entry) {
+  return [
+    `command = ${quoteTomlString(entry.command)}`,
+    `args = [${entry.args.map((argument) => quoteTomlString(argument)).join(", ")}]`
+  ];
+}
+function renderEnvLines(entry) {
+  return Object.entries(entry.env).map(([key, value]) => `${formatTomlKey(key)} = ${quoteTomlString(value)}`);
+}
+function renderMcpServerTable(name, entry) {
+  const tableKey = formatTomlKey(name);
+  const lines = [`[mcp_servers.${tableKey}]`, ...renderOwnedLines(entry)];
+  const envLines = renderEnvLines(entry);
+  if (envLines.length > 0) {
+    lines.push("");
+    lines.push(`[mcp_servers.${tableKey}.env]`);
+    lines.push(...envLines);
+  }
+  return `${lines.join("\n")}
+`;
+}
+function isBlank(line) {
+  return line.trim() === "";
+}
+function joinSections(sections, eol) {
+  const lines = [];
+  for (const section of sections) {
+    if (section.header != null) {
+      lines.push(section.header);
+    }
+    lines.push(...section.body);
+  }
+  return lines.join(eol);
+}
+function writeMcpServerToml(text, name, entry) {
+  parseConfigToml(text);
+  const updated = editMcpServerToml(text, name, entry);
+  return verifyTomlEdit(text, updated, name, entry);
+}
+function editMcpServerToml(text, name, entry) {
+  let eol = "\n";
+  if (text.includes("\r\n") == true) {
+    eol = "\r\n";
+  }
+  const sections = splitSections(text.split(/\r?\n/));
+  const isOwn = (section) => section.serverName === name;
+  if (entry == null) {
+    const kept = sections.filter((section) => isOwn(section) == false);
+    const removedText = joinSections(kept, eol);
+    return removedText;
+  }
+  const tableKey = formatTomlKey(name);
+  const envLines = renderEnvLines(entry);
+  const tableIndex = sections.findIndex((section) => isOwn(section) == true && section.subPath === "");
+  if (tableIndex < 0) {
+    const withoutStrayEnv = sections.filter((section) => (isOwn(section) == true && section.subPath === "env") == false);
+    let prefix = joinSections(withoutStrayEnv, eol);
+    if (prefix.trim() === "") {
+      prefix = "";
+    } else {
+      prefix = prefix.replace(/(\r?\n)*$/, "");
+      prefix = `${prefix}${eol}${eol}`;
+    }
+    const block = renderMcpServerTable(name, entry).replace(/\n/g, eol);
+    return `${prefix}${block}`;
+  }
+  const table = sections[tableIndex];
+  const ownedLineIndexes = /* @__PURE__ */ new Set();
+  for (const statement of readStatements(table.body)) {
+    if (OWNED_TABLE_KEYS.includes(statement.key) == true) {
+      for (let index = statement.start; index < statement.end; index += 1) {
+        ownedLineIndexes.add(index);
+      }
+    }
+  }
+  const userLines = table.body.filter((_line, index) => ownedLineIndexes.has(index) == false);
+  let trailingBlankCount = 0;
+  while (trailingBlankCount < userLines.length && isBlank(userLines[userLines.length - 1 - trailingBlankCount]) == true) {
+    trailingBlankCount += 1;
+  }
+  const trailingBlanks = userLines.slice(userLines.length - trailingBlankCount);
+  const userContent = userLines.slice(0, userLines.length - trailingBlankCount);
+  const rebuilt = [];
+  for (let index = 0; index < sections.length; index += 1) {
+    const section = sections[index];
+    if (isOwn(section) == true && section.subPath === "env") {
+      continue;
+    }
+    if (index !== tableIndex) {
+      rebuilt.push(section);
+      continue;
+    }
+    if (envLines.length === 0) {
+      rebuilt.push({ ...section, body: [...renderOwnedLines(entry), ...userContent, ...trailingBlanks] });
+      continue;
+    }
+    rebuilt.push({ ...section, body: [...renderOwnedLines(entry), ...userContent, ""] });
+    rebuilt.push({
+      header: `[mcp_servers.${tableKey}.env]`,
+      serverName: name,
+      subPath: "env",
+      body: [...envLines, ...trailingBlanks]
+    });
+  }
+  const rebuiltText = joinSections(rebuilt, eol);
+  return rebuiltText;
+}
+
+// src/modules/registration/targets/codex.ts
+function createCodexTarget() {
+  const CODEX_CONFIG_PATH = path9.join(process.env.CODEX_HOME ? path9.resolve(process.env.CODEX_HOME) : path9.join(os4.homedir(), ".codex"), "config.toml");
+  function readText() {
+    if (fs9.existsSync(CODEX_CONFIG_PATH) == false) {
+      return "";
+    }
+    return fs9.readFileSync(CODEX_CONFIG_PATH, "utf8");
+  }
+  return {
+    id: "codex",
+    label: "Codex CLI",
+    location: CODEX_CONFIG_PATH,
+    detected: findExecutable("codex") != null || fs9.existsSync(CODEX_CONFIG_PATH) == true,
+    readEntries() {
+      const text = readText();
+      return parseMcpServersToml(text);
+    },
+    hasEntry(name) {
+      return hasMcpServerToml(readText(), name);
+    },
+    writeEntry(name, entry, options) {
+      updateConfigFile2(CODEX_CONFIG_PATH, (original) => {
+        let text = original;
+        if (options?.replace) {
+          text = writeMcpServerToml(text, name, null);
+        }
+        return writeMcpServerToml(text, name, entry);
+      });
+      return { status: "written", detail: CODEX_CONFIG_PATH };
+    },
+    removeEntry(name) {
+      updateConfigFile2(CODEX_CONFIG_PATH, (text) => writeMcpServerToml(text, name, null));
+      return { status: "written", detail: CODEX_CONFIG_PATH };
+    }
+  };
+}
+
+// src/modules/registration/targets/index.ts
+function claudeDesktopConfigPath() {
+  if (process.platform === "win32") {
+    const appData = process.env.APPDATA ?? path10.join(os5.homedir(), "AppData", "Roaming");
+    return path10.join(appData, "Claude", "claude_desktop_config.json");
+  }
+  if (process.platform === "darwin") {
+    return path10.join(os5.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
+  }
+  return path10.join(os5.homedir(), ".config", "Claude", "claude_desktop_config.json");
+}
+function listConfigTargets() {
+  const targets = [
+    createClaudeCodeTarget(),
+    createCodexTarget(),
+    createJsonFileTarget({ id: "claude-desktop", label: "Claude Desktop", filePath: claudeDesktopConfigPath() }),
+    createJsonFileTarget({ id: "cursor", label: "Cursor", filePath: path10.join(os5.homedir(), ".cursor", "mcp.json") })
+  ];
+  const detected = targets.filter((target) => target.detected == true);
+  const others = targets.filter((target) => target.detected == false);
+  return [...detected, ...others];
+}
+
+// src/modules/launcher/menu.ts
+async function runRegistrationCommand(options) {
+  const prompter = new Prompter(options.input, options.output);
+  const registry = new Registry(options.targets ?? listConfigTargets(), options.registryPath, options.runtimeOptions);
+  try {
+    if (options.mode === "register") await registrationMenu(prompter, registry, options.targetId);
+    else await syncMenu(prompter, registry);
+    return 0;
+  } catch (error) {
+    if (error instanceof PromptClosedError || error instanceof PromptBackError) return 0;
+    throw error;
+  } finally {
+    prompter.close();
+  }
+}
+async function runMenu(options) {
+  const registry = new Registry(options.targets ?? listConfigTargets(), options.registryPath, options.runtimeOptions);
+  let defaultValue = "db";
+  let failure;
+  for (; ; ) {
+    const prompter = new Prompter(options.input, options.output);
+    let selected = "quit";
+    try {
+      if (failure) {
+        prompter.write(`
+${failure}
+
+`);
+        await prompter.acknowledge();
+        failure = void 0;
+      }
+      for (; ; ) {
+        prompter.clearScreen();
+        const state = registry.read();
+        const clients = state.clients;
+        const migration = registry.needsMigration(state);
+        if (migration) prompter.write(prompter.paint.warning("Registry update available. Choose Migrate registry to review the changes.\n"));
+        const picked = await prompter.select("AKMS MCP \xB7 Connection setup", [
+          { value: "db", label: "Database", hint: "PostgreSQL connections" },
+          { value: "ssh", label: "SSH", hint: "Remote hosts" },
+          { value: "wsl", label: "WSL", hint: "Local Linux distros \xB7 Windows" },
+          { value: "s3", label: "S3", hint: "AWS S3 and S3-compatible buckets" },
+          { separator: true },
+          { value: "register", label: "Register", hint: clients.length ? clients.map((id) => CLIENT_LABELS2[id]).join(" \xB7 ") : "Choose AI services once" },
+          { value: "sync", label: "Sync", hint: "Review and retry shared settings" },
+          { value: "runtime", label: "Runtime", hint: "AKMS installation / replace npx launches" },
+          { value: "updates", label: "Updates", hint: "Check installed MCP releases" },
+          ...migration ? [{ value: "migrate", key: "migrate", label: "Migrate registry", hint: "Review older registry format and session layout" }] : [],
+          { value: "quit", label: "Quit" }
+        ], { defaultValue, cancelValue: "quit" });
+        if (picked !== "register" && picked !== "sync" && picked !== "runtime" && picked !== "updates" && picked !== "migrate") {
+          selected = picked;
+          break;
+        }
+        try {
+          if (picked === "register") await registrationMenu(prompter, registry, options.targetId);
+          else if (picked === "runtime") await runtimeMenu(prompter, registry);
+          else if (picked === "updates") await updatesMenu(prompter, registry);
+          else if (picked === "migrate") await migrationMenu(prompter, registry);
+          else await syncMenu(prompter, registry);
+        } catch (error) {
+          if (error instanceof PromptClosedError) throw error;
+          if (!(error instanceof PromptBackError)) {
+            options.output.write(`
+${error instanceof Error ? error.message : "Could not update settings."}
+`);
+            await prompter.acknowledge();
+          }
+        }
+      }
+    } catch (error) {
+      if (error instanceof PromptClosedError) return 0;
+      throw error;
+    } finally {
+      prompter.close();
+    }
+    if (selected === "quit") return 0;
+    defaultValue = selected;
+    try {
+      const code = await options.launch({ mcpId: selected, targetId: options.targetId, pendingInput: prompter.takePendingInput() });
+      if (code === 130) return 0;
+      if (code !== 0) failure = `Setup exited with code ${code}.`;
+    } catch (error) {
+      failure = String(error);
+    }
+  }
+}
+
+// src/modules/launcher/npm.ts
+import { execFile as execFile3, spawn as spawn2 } from "child_process";
+import { existsSync } from "fs";
+import { mkdtemp, realpath, rm } from "fs/promises";
+import { tmpdir } from "os";
+import { basename, delimiter, dirname, join } from "path";
+import { promisify as promisify2 } from "util";
+var execFileAsync = promisify2(execFile3);
+async function findNpmCli() {
+  const candidates = [];
+  const npmExecPath = process.env.npm_execpath;
+  if (npmExecPath != null && ["npm-cli.js", "npx-cli.js"].includes(basename(npmExecPath)) == true) {
+    candidates.push(join(dirname(npmExecPath), "npm-cli.js"));
+  }
+  candidates.push(join(dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js"));
+  candidates.push(join(dirname(process.execPath), "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"));
+  for (const directory of (process.env.PATH ?? "").split(delimiter)) {
+    if (directory === "") {
+      continue;
+    }
+    if (process.platform === "win32") {
+      candidates.push(join(directory, "node_modules", "npm", "bin", "npm-cli.js"));
+    } else {
+      candidates.push(join(directory, "npm"));
+    }
+  }
+  for (const candidate of candidates) {
+    if (existsSync(candidate) == true) {
+      const resolved = await realpath(candidate);
+      if (resolved.endsWith(".js")) return resolved;
+    }
+  }
+  throw new Error("npm could not be found. Install Node.js with npm, then reopen your terminal.");
+}
+async function resolveLatestVersion(options) {
+  const metadataCache = await mkdtemp(join(tmpdir(), "akms-mcp-latest-"));
+  try {
+    const result = await execFileAsync(process.execPath, [
+      options.npmCli,
+      "view",
+      `${options.packageName}@latest`,
+      "version",
+      "--json",
+      "--prefer-online",
+      "--prefer-offline=false",
+      "--offline=false",
+      "--fetch-retries=0",
+      "--fetch-timeout=15000",
+      "--update-notifier=false",
+      "--cache",
+      metadataCache
+    ], { signal: options.signal, timeout: 2e4, windowsHide: true });
+    const version = JSON.parse(result.stdout);
+    if (typeof version !== "string" || /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(version) == false) {
+      throw new Error("npm returned an invalid latest version.");
+    }
+    return version;
+  } finally {
+    await rm(metadataCache, { recursive: true, force: true });
+  }
+}
+async function launchMcp(options, dependencies = {}) {
+  const selected = MCP_PACKAGES[options.mcpId];
+  if (options.mcpId === "wsl" && process.platform !== "win32") {
+    throw new Error("WSL setup must run from Windows.");
+  }
+  const findRuntime = dependencies.findRuntime ?? findGlobalRuntime;
+  const output = dependencies.output ?? process.stdout;
+  let runtime = findRuntime(options.mcpId);
+  let pendingInput = options.pendingInput;
+  if (!runtime) {
+    const prompter = new Prompter(dependencies.input ?? process.stdin, output, pendingInput);
+    try {
+      prompter.write(`
+${selected.packageName} is not installed in the AKMS runtime directory.
+`);
+      if (!await prompter.askYesNo("Install the AKMS runtime before opening setup?", true)) return 0;
+      try {
+        prompter.write(`Installing ${selected.packageName}...
+`);
+        await (dependencies.installRuntime ?? installGlobalRuntime)(options.mcpId);
+        runtime = findRuntime(options.mcpId);
+        if (!runtime) throw new Error("Installation completed but the AKMS runtime could not be found.");
+      } catch (error) {
+        if (error instanceof Error && error.message === "AKMS runtime installation cancelled.") return 130;
+        prompter.write(`${error instanceof Error ? error.message : "AKMS runtime installation failed."}
+`);
+        if (!await prompter.askYesNo("Open the latest setup with npm exec instead?", false)) return 1;
+      }
+    } catch (error) {
+      if (error instanceof PromptClosedError || error instanceof PromptBackError) return 0;
+      throw error;
+    } finally {
+      prompter.close();
+      pendingInput = prompter.takePendingInput();
+    }
+  }
+  if (runtime) {
+    const argumentsList = [...runtime.args, selected.setupCommand];
+    if (options.targetId) argumentsList.push("--target", options.targetId);
+    output.write(`Opening ${selected.packageName} ${runtime.version}${runtime.linked ? " (linked development checkout)" : ""}
+
+`);
+    return (dependencies.runChild ?? runChild)(runtime.command, argumentsList, pendingInput);
+  }
+  return launchLatestSetup(options, dependencies, pendingInput);
+}
+async function launchLatestSetup(options, dependencies, pendingInput) {
+  const selected = MCP_PACKAGES[options.mcpId];
+  const output = dependencies.output ?? process.stdout;
+  const npmCli2 = await (dependencies.findNpmCli ?? findNpmCli)();
+  const cancellation = new AbortController();
+  const cancelLookup = () => {
+    cancellation.abort();
+  };
+  process.on("SIGINT", cancelLookup);
+  process.on("SIGTERM", cancelLookup);
+  let version;
+  try {
+    output.write(`
+Checking the latest ${selected.packageName} release...
+`);
+    version = await (dependencies.resolveLatestVersion ?? resolveLatestVersion)({ npmCli: npmCli2, packageName: selected.packageName, signal: cancellation.signal });
+  } catch (error) {
+    if (cancellation.signal.aborted == true) {
+      return 130;
+    }
+    throw new Error(`Could not check the latest ${selected.packageName} release; setup was not started.
+${String(error)}`, { cause: error });
+  } finally {
+    process.off("SIGINT", cancelLookup);
+    process.off("SIGTERM", cancelLookup);
+  }
+  const argumentsList = [
+    npmCli2,
+    "exec",
+    "--yes",
+    "--prefer-online",
+    "--prefer-offline=false",
+    "--offline=false",
+    `--package=${selected.packageName}@${version}`,
+    "--",
+    selected.command,
+    selected.setupCommand
+  ];
+  if (options.targetId != null) {
     argumentsList.push("--target", options.targetId);
   }
-  process.stdout.write(`Opening ${selected.packageName} ${version}
+  output.write(`Opening ${selected.packageName} ${version} with npm exec
 
 `);
+  return (dependencies.runChild ?? runChild)(process.execPath, argumentsList, pendingInput);
+}
+async function runChild(command, argumentsList, pendingInput) {
   return new Promise((resolve, reject) => {
     const interactiveInput = process.stdin.isTTY === true;
     let inputMode = "pipe";
     if (interactiveInput == true) {
       inputMode = "inherit";
     }
-    const child = spawn(process.execPath, argumentsList, {
+    const child = spawn2(command, argumentsList, {
       stdio: [inputMode, "inherit", "inherit"],
       windowsHide: true
     });
@@ -690,8 +3257,8 @@ ${String(error)}`, { cause: error });
           reject(error);
         }
       });
-      if (options.pendingInput != null) {
-        child.stdin.write(options.pendingInput);
+      if (pendingInput != null) {
+        child.stdin.write(pendingInput);
       }
       process.stdin.pipe(child.stdin);
     }
@@ -726,14 +3293,17 @@ var HELP_TEXT = [
   "  akms-mcp                          Open the setup menu",
   "  akms-mcp [setup|config]            Open the same menu",
   "  akms-mcp [setup|config] <mcp>      Open db, ssh, wsl or s3 setup directly",
+  "  akms-mcp register                  Register AI services for all AKMS connections",
+  "  akms-mcp sync                      Review differences and retry pending changes",
   "",
   "Options:",
   "  --target <client>                 claude-code | codex | claude-desktop | cursor",
   "  -h, --help                        Print this help",
   "  -v, --version                     Print the launcher version",
   "",
-  "Each launch checks npm for the selected package's latest release.",
-  "Node.js 22+ and npm are required. WSL setup runs on Windows."
+  "Opens the installed runtime's setup. Missing runtimes can be installed with confirmation.",
+  "Node.js 22+ and npm are required. WSL setup runs on Windows.",
+  "Catalog: ~/.akms/mcp/registry.json (or $AKMS_MCP_HOME/registry.json) stores settings and passwords in plaintext."
 ].join("\n");
 async function main() {
   const argumentsList = parseArguments(process.argv.slice(2));
@@ -745,7 +3315,7 @@ async function main() {
   if (argumentsList.showVersion == true) {
     let version = "development";
     if (true) {
-      version = "0.2.1";
+      version = "0.3.2";
     }
     process.stdout.write(`${version}
 `);
@@ -755,6 +3325,10 @@ async function main() {
     process.exitCode = await launchMcp({ mcpId: argumentsList.mcpId, targetId: argumentsList.targetId });
     return;
   }
+  if (argumentsList.managementMode) {
+    process.exitCode = await runRegistrationCommand({ input: process.stdin, output: process.stdout, mode: argumentsList.managementMode, targetId: argumentsList.targetId });
+    return;
+  }
   process.exitCode = await runMenu({
     input: process.stdin,
     output: process.stdout,