@basein/runner 0.2.12 → 0.3.1

package/dist/config/mcp-approval.d.ts

@@ -0,0 +1,76 @@
+/**
+ * config/mcp-approval — would Claude Code start a `.mcp.json` server without
+ * asking the person first?
+ *
+ * WHY THIS EXISTS. `bir install` routes a `.mcp.json` server through the proxy
+ * by writing a wrapped copy into this project's LOCAL scope (bir.ts,
+ * installClaudeCode), so the team's file never carries this machine's paths.
+ * But Claude Code treats the two scopes differently: it asks before it starts
+ * a server from `.mcp.json` ("New MCP server found in this project"), and it
+ * never asks about a local-scope one — that is the person's own config. A local
+ * copy of a server they rejected, or were never asked about (a freshly cloned
+ * repository), would start silently. The runner must never change what the
+ * person is asked to approve, so a `.mcp.json` server is overridden only when
+ * Claude Code itself would already start it.
+ *
+ * The rules are Claude Code's own (read out of 2.1.280, `getProjectMcpServerStatus`):
+ *
+ *   - REJECTED when the name is in `disabledMcpjsonServers` of any settings
+ *     source — what "Continue without using this MCP server" writes;
+ *   - APPROVED when it is in `enabledMcpjsonServers`, or
+ *     `enableAllProjectMcpServers` is true, in a source Claude Code honours for
+ *     that decision: every source once the folder is trusted; before that only
+ *     the person's own (user settings, the managed policy, and a
+ *     `settings.local.json` git does not track — a committed one could approve
+ *     anything for whoever clones the repository);
+ *   - PENDING otherwise: Claude Code would ask.
+ *
+ * Names match the way Claude Code matches them (anything outside
+ * `[A-Za-z0-9_-]` compares as `_`). The legacy copies of those three fields
+ * under `projects[<key>]` in `~/.claude.json` count too: Claude Code migrates
+ * them into `settings.local.json` on its next start, so they are still the
+ * person's answer. A settings file that cannot be read makes the answer
+ * "pending" — when in doubt, the server is left exactly as it is.
+ */
+export type McpjsonApproval = "approved" | "rejected" | "pending";
+export interface ApprovalVerdict {
+    state: McpjsonApproval;
+    /** Why, in words, for the install and doctor lines. */
+    why: string;
+}
+/**
+ * The person's own Claude Code settings (`~/.claude/settings.json`).
+ *
+ * `BIR_CLAUDE_SETTINGS` names it outright. A sandboxed `BIR_CLAUDE_JSON`
+ * (tests, a second profile) moves it beside that file, the way `~/.claude.json`
+ * and `~/.claude/` sit side by side in a home directory; `CLAUDE_CONFIG_DIR`
+ * moves it the way Claude Code itself does.
+ */
+export declare function claudeUserSettingsPath(env?: NodeJS.ProcessEnv): string;
+/**
+ * Where an organisation's managed settings live (Claude Code's own paths).
+ * `BIR_CLAUDE_MANAGED_DIR` overrides it — tests point it at an empty sandbox.
+ */
+export declare function claudeManagedSettingsDir(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): string;
+/** A server name the way Claude Code compares them. */
+export declare function mcpNameKey(name: string): string;
+/**
+ * A reader for this directory's `.mcp.json` approvals: the files are read once,
+ * then each name is answered from them. `claude` is `~/.claude.json` already
+ * parsed, when the caller has it.
+ */
+export declare function mcpjsonApprovals(cwd: string, claude?: {
+    projects?: Record<string, unknown>;
+}): (name: string) => ApprovalVerdict;
+/**
+ * A reason the managed policy forbids wrapping ANY server, or undefined.
+ *
+ * An organisation's `allowedMcpServers` / `deniedMcpServers` can match a
+ * server by its command or URL. A wrapped entry's command is the runner's, so
+ * wrapping would get an allowed server blocked (broken) or a denied one past
+ * the denylist. `allowManagedMcpServersOnly` means only the organisation's own
+ * servers run at all. In any of those cases nothing is wrapped: the policy is
+ * not the runner's to reinterpret.
+ */
+export declare function managedMcpPolicyBlocker(): string | undefined;
+//# sourceMappingURL=mcp-approval.d.ts.map

package/dist/config/mcp-approval.js

@@ -0,0 +1,210 @@
+/**
+ * config/mcp-approval — would Claude Code start a `.mcp.json` server without
+ * asking the person first?
+ *
+ * WHY THIS EXISTS. `bir install` routes a `.mcp.json` server through the proxy
+ * by writing a wrapped copy into this project's LOCAL scope (bir.ts,
+ * installClaudeCode), so the team's file never carries this machine's paths.
+ * But Claude Code treats the two scopes differently: it asks before it starts
+ * a server from `.mcp.json` ("New MCP server found in this project"), and it
+ * never asks about a local-scope one — that is the person's own config. A local
+ * copy of a server they rejected, or were never asked about (a freshly cloned
+ * repository), would start silently. The runner must never change what the
+ * person is asked to approve, so a `.mcp.json` server is overridden only when
+ * Claude Code itself would already start it.
+ *
+ * The rules are Claude Code's own (read out of 2.1.280, `getProjectMcpServerStatus`):
+ *
+ *   - REJECTED when the name is in `disabledMcpjsonServers` of any settings
+ *     source — what "Continue without using this MCP server" writes;
+ *   - APPROVED when it is in `enabledMcpjsonServers`, or
+ *     `enableAllProjectMcpServers` is true, in a source Claude Code honours for
+ *     that decision: every source once the folder is trusted; before that only
+ *     the person's own (user settings, the managed policy, and a
+ *     `settings.local.json` git does not track — a committed one could approve
+ *     anything for whoever clones the repository);
+ *   - PENDING otherwise: Claude Code would ask.
+ *
+ * Names match the way Claude Code matches them (anything outside
+ * `[A-Za-z0-9_-]` compares as `_`). The legacy copies of those three fields
+ * under `projects[<key>]` in `~/.claude.json` count too: Claude Code migrates
+ * them into `settings.local.json` on its next start, so they are still the
+ * person's answer. A settings file that cannot be read makes the answer
+ * "pending" — when in doubt, the server is left exactly as it is.
+ */
+import { spawnSync } from "node:child_process";
+import { readdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { claudeConfigHome, claudeJsonPath, parseJsonFile, projectKeysFor } from "./resolve.js";
+/**
+ * The person's own Claude Code settings (`~/.claude/settings.json`).
+ *
+ * `BIR_CLAUDE_SETTINGS` names it outright. A sandboxed `BIR_CLAUDE_JSON`
+ * (tests, a second profile) moves it beside that file, the way `~/.claude.json`
+ * and `~/.claude/` sit side by side in a home directory; `CLAUDE_CONFIG_DIR`
+ * moves it the way Claude Code itself does.
+ */
+export function claudeUserSettingsPath(env = process.env) {
+    if (env.BIR_CLAUDE_SETTINGS)
+        return env.BIR_CLAUDE_SETTINGS;
+    if (env.BIR_CLAUDE_JSON)
+        return join(dirname(env.BIR_CLAUDE_JSON), ".claude", "settings.json");
+    return join(claudeConfigHome(env) ?? join(homedir(), ".claude"), "settings.json");
+}
+/**
+ * Where an organisation's managed settings live (Claude Code's own paths).
+ * `BIR_CLAUDE_MANAGED_DIR` overrides it — tests point it at an empty sandbox.
+ */
+export function claudeManagedSettingsDir(env = process.env, platform = process.platform) {
+    if (env.BIR_CLAUDE_MANAGED_DIR !== undefined)
+        return env.BIR_CLAUDE_MANAGED_DIR;
+    if (platform === "darwin")
+        return "/Library/Application Support/ClaudeCode";
+    if (platform === "win32")
+        return "C:\\Program Files\\ClaudeCode";
+    return "/etc/claude-code";
+}
+/** `managed-settings.json` and its drop-in directory, parsed; unreadable ones reported. */
+function readManaged() {
+    const dir = claudeManagedSettingsDir();
+    const settings = [];
+    const unreadable = [];
+    if (!dir)
+        return { settings, unreadable };
+    const files = [join(dir, "managed-settings.json")];
+    try {
+        const dropIn = join(dir, "managed-settings.d");
+        for (const f of readdirSync(dropIn).filter((n) => n.endsWith(".json")).sort())
+            files.push(join(dropIn, f));
+    }
+    catch {
+        /* no drop-in directory */
+    }
+    for (const file of files) {
+        try {
+            const parsed = parseJsonFile(file);
+            if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+                settings.push(parsed);
+        }
+        catch {
+            unreadable.push(file);
+        }
+    }
+    return { settings, unreadable };
+}
+/** A server name the way Claude Code compares them. */
+export function mcpNameKey(name) {
+    return name.startsWith("plugin:") ? name : name.replace(/[^a-zA-Z0-9_-]/g, "_");
+}
+function lists(fields, key, name) {
+    const value = fields?.[key];
+    if (!Array.isArray(value))
+        return false;
+    const want = mcpNameKey(name);
+    return value.some((n) => typeof n === "string" && mcpNameKey(n) === want);
+}
+/**
+ * True when git says `.claude/settings.local.json` is NOT tracked here. Claude
+ * Code ignores the approvals in a tracked one (and outside a repository, or
+ * when git cannot answer) until the folder is trusted; so does this. Asked
+ * at most once per reader, and only when that file is the one thing approving —
+ * never on a hook's path unless a caller puts it there.
+ */
+function localSettingsUntracked(cwd) {
+    try {
+        // Forward slashes: a pathspec git reads the same way on every platform.
+        const r = spawnSync("git", ["ls-files", "--error-unmatch", "--", ".claude/settings.local.json"], {
+            cwd,
+            timeout: 2_000,
+            windowsHide: true,
+            stdio: "ignore",
+        });
+        return r.status === 1;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * A reader for this directory's `.mcp.json` approvals: the files are read once,
+ * then each name is answered from them. `claude` is `~/.claude.json` already
+ * parsed, when the caller has it.
+ */
+export function mcpjsonApprovals(cwd, claude) {
+    const unreadable = [];
+    const read = (file) => {
+        try {
+            return parseJsonFile(file);
+        }
+        catch {
+            unreadable.push(file);
+            return undefined;
+        }
+    };
+    let parsedClaude = claude;
+    if (!parsedClaude) {
+        try {
+            parsedClaude = parseJsonFile(claudeJsonPath()) ?? {};
+        }
+        catch {
+            unreadable.push(claudeJsonPath());
+            parsedClaude = {};
+        }
+    }
+    const user = read(claudeUserSettingsPath());
+    const project = read(join(cwd, ".claude", "settings.json"));
+    const local = read(join(cwd, ".claude", "settings.local.json"));
+    const managed = readManaged();
+    unreadable.push(...managed.unreadable);
+    const projects = (parsedClaude.projects ?? {});
+    const legacy = projectKeysFor(projects, cwd).map((key) => projects[key]).filter((p) => p !== undefined);
+    const trusted = legacy.some((p) => p?.hasTrustDialogAccepted === true);
+    let untracked;
+    const localHonoured = () => trusted || (untracked ??= localSettingsUntracked(cwd));
+    return (name) => {
+        if (unreadable.length > 0) {
+            return { state: "pending", why: `whether Claude Code approved it could not be read (${unreadable[0]} is not plain JSON)` };
+        }
+        const everySource = [user, project, local, ...managed.settings, ...legacy];
+        if (everySource.some((s) => lists(s, "disabledMcpjsonServers", name))) {
+            return { state: "rejected", why: "you told Claude Code not to use it (disabledMcpjsonServers)" };
+        }
+        const approves = (s) => s?.enableAllProjectMcpServers === true || lists(s, "enabledMcpjsonServers", name);
+        // git is asked only when settings.local.json is the one thing approving.
+        const approved = trusted
+            ? everySource.some(approves)
+            : [user, ...managed.settings, ...legacy].some(approves) || (approves(local) && localHonoured());
+        if (approved)
+            return { state: "approved", why: "approved in Claude Code" };
+        return { state: "pending", why: "Claude Code has not been told to use it yet (it asks first)" };
+    };
+}
+/**
+ * A reason the managed policy forbids wrapping ANY server, or undefined.
+ *
+ * An organisation's `allowedMcpServers` / `deniedMcpServers` can match a
+ * server by its command or URL. A wrapped entry's command is the runner's, so
+ * wrapping would get an allowed server blocked (broken) or a denied one past
+ * the denylist. `allowManagedMcpServersOnly` means only the organisation's own
+ * servers run at all. In any of those cases nothing is wrapped: the policy is
+ * not the runner's to reinterpret.
+ */
+export function managedMcpPolicyBlocker() {
+    const { settings } = readManaged();
+    for (const s of settings) {
+        if (s.allowManagedMcpServersOnly === true) {
+            return "your organisation's managed settings allow only its own MCP servers";
+        }
+        for (const key of ["allowedMcpServers", "deniedMcpServers"]) {
+            const list = s[key];
+            if (!Array.isArray(list))
+                continue;
+            if (list.some((e) => e && typeof e === "object" && ("serverCommand" in e || "serverUrl" in e))) {
+                return `your organisation's managed settings match MCP servers by command or URL (${key}), which wrapping would change`;
+            }
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=mcp-approval.js.map

package/dist/config/node-path.d.ts

@@ -0,0 +1,42 @@
+/**
+ * node-path — which `node` the generated entries and the SessionStart hook name.
+ *
+ * Every wrapped MCP server, the scenario server and the self-starting hook
+ * spawn an interpreter by ABSOLUTE path. If that path disappears, every one of
+ * them fails to start — the user's own MCP servers included, because the proxy
+ * is now what the host spawns. So the path written must outlive the things
+ * that routinely move a Node:
+ *
+ *   - Homebrew: `process.execPath` is already the versioned keg
+ *     (`/opt/homebrew/Cellar/node/24.1.0/bin/node`), and the next
+ *     `brew upgrade` deletes it. Homebrew keeps a stable symlink to the current
+ *     keg at `<prefix>/opt/<formula>/bin/node`; that is the one to name.
+ *   - Windows: `process.execPath` is the path Node was launched through, which
+ *     for nvm-windows (`C:\nvm4w\nodejs`) and Scoop (`…\apps\nodejs\current`)
+ *     is the stable link that follows the active version, while its realpath is
+ *     the versioned directory the next switch abandons. Keep it — except for
+ *     fnm's per-shell `fnm_multishells` directory, which is gone with the shell.
+ *   - Version managers with no stable link (nvm, fnm, Volta, asdf, mise,
+ *     nodenv, n): nothing better exists, so the path is kept and the install
+ *     says, once, what will break it. The install scripts avoid all of this by
+ *     installing a private Node under ~/.baseinstrunner/node.
+ *
+ * Proxies, the scenario server and the hook all use the SAME choice, so a
+ * re-run compares like with like and does not re-write entries for nothing.
+ */
+export interface NodeChoice {
+    /** The interpreter path to write. */
+    path: string;
+    /** Set when that path belongs to something that moves it; printed once. */
+    warning?: string;
+}
+export interface NodeChoiceDeps {
+    execPath?: string;
+    platform?: NodeJS.Platform;
+    realpath?: (p: string) => string;
+    exists?: (p: string) => boolean;
+}
+/** A version manager (or per-version package directory) that owns this path, if any. */
+export declare function versionManagerOf(path: string): string | undefined;
+export declare function chooseNodePath(input?: NodeChoiceDeps): NodeChoice;
+//# sourceMappingURL=node-path.d.ts.map

package/dist/config/node-path.js

@@ -0,0 +1,102 @@
+/**
+ * node-path — which `node` the generated entries and the SessionStart hook name.
+ *
+ * Every wrapped MCP server, the scenario server and the self-starting hook
+ * spawn an interpreter by ABSOLUTE path. If that path disappears, every one of
+ * them fails to start — the user's own MCP servers included, because the proxy
+ * is now what the host spawns. So the path written must outlive the things
+ * that routinely move a Node:
+ *
+ *   - Homebrew: `process.execPath` is already the versioned keg
+ *     (`/opt/homebrew/Cellar/node/24.1.0/bin/node`), and the next
+ *     `brew upgrade` deletes it. Homebrew keeps a stable symlink to the current
+ *     keg at `<prefix>/opt/<formula>/bin/node`; that is the one to name.
+ *   - Windows: `process.execPath` is the path Node was launched through, which
+ *     for nvm-windows (`C:\nvm4w\nodejs`) and Scoop (`…\apps\nodejs\current`)
+ *     is the stable link that follows the active version, while its realpath is
+ *     the versioned directory the next switch abandons. Keep it — except for
+ *     fnm's per-shell `fnm_multishells` directory, which is gone with the shell.
+ *   - Version managers with no stable link (nvm, fnm, Volta, asdf, mise,
+ *     nodenv, n): nothing better exists, so the path is kept and the install
+ *     says, once, what will break it. The install scripts avoid all of this by
+ *     installing a private Node under ~/.baseinstrunner/node.
+ *
+ * Proxies, the scenario server and the hook all use the SAME choice, so a
+ * re-run compares like with like and does not re-write entries for nothing.
+ */
+import { existsSync, realpathSync } from "node:fs";
+/** A version manager (or per-version package directory) that owns this path, if any. */
+export function versionManagerOf(path) {
+    const p = path.replace(/\\/g, "/");
+    const rules = [
+        [/fnm_multishells/i, "fnm"],
+        [/\/(\.?fnm)\//i, "fnm"],
+        [/\/\.nvm\/|\/nvm\/versions\//i, "nvm"],
+        [/\/(AppData\/Roaming\/)?nvm\/v\d/i, "nvm-windows"],
+        [/\/\.?volta\//i, "Volta"],
+        [/\/\.?nodenv\//i, "nodenv"],
+        [/\/\.?asdf\//i, "asdf"],
+        [/\/\.?mise\//i, "mise"],
+        [/\/n\/versions\//i, "n"],
+        [/\/scoop\/apps\/nodejs[^/]*\/(?!current\/)[^/]+\//i, "Scoop"],
+        [/\/Cellar\//, "Homebrew"],
+        [/^\/snap\/node\//, "snap"],
+    ];
+    for (const [re, name] of rules)
+        if (re.test(p))
+            return name;
+    return undefined;
+}
+/**
+ * Homebrew's stable `opt` link for a Cellar path, when there is one and it
+ * points at this very binary (not at a newer keg the running process is not).
+ */
+function homebrewOptPath(real, deps) {
+    const m = /^(.*)\/Cellar\/(node(?:@\d+)?)\/[^/]+\/bin\/node$/.exec(real);
+    if (!m)
+        return undefined;
+    const opt = `${m[1]}/opt/${m[2]}/bin/node`;
+    try {
+        if (deps.exists(opt) && deps.realpath(opt) === real)
+            return opt;
+    }
+    catch {
+        /* no link: fall through */
+    }
+    return undefined;
+}
+export function chooseNodePath(input = {}) {
+    const deps = {
+        execPath: input.execPath ?? process.execPath,
+        platform: input.platform ?? process.platform,
+        realpath: input.realpath ?? ((p) => realpathSync(p)),
+        exists: input.exists ?? existsSync,
+    };
+    const real = (() => {
+        try {
+            return deps.realpath(deps.execPath);
+        }
+        catch {
+            return deps.execPath;
+        }
+    })();
+    let path;
+    if (deps.platform === "win32") {
+        // The launch path, unless it is a per-shell directory that dies with the shell.
+        path = /fnm_multishells/i.test(deps.execPath) ? real : deps.execPath;
+    }
+    else {
+        path = homebrewOptPath(real, deps) ?? real;
+    }
+    const manager = versionManagerOf(path);
+    if (!manager)
+        return { path };
+    return {
+        path,
+        warning: `node is ${path}, a ${manager}-managed version: when ${manager} removes or moves it, ` +
+            "the wrapped MCP servers and the SessionStart hook stop starting. Run `bir setup` here " +
+            "again after switching Node, or install with the install line, which keeps a private Node " +
+            "under ~/.baseinstrunner/node",
+    };
+}
+//# sourceMappingURL=node-path.js.map

package/dist/config/overrides.d.ts

@@ -0,0 +1,62 @@
+/**
+ * config/overrides — is each local-scope copy `bir install` wrote still a copy
+ * of the entry it overrides?
+ *
+ * An override (bir.ts, installClaudeCode) is a FROZEN copy of a `.mcp.json` or
+ * user-scope server, wrapped, in this project's local scope — which outranks
+ * both. When the team changes `.mcp.json` (a new version, a new host) or the
+ * person rotates a token in the user scope, Claude Code keeps starting the old
+ * copy here, and the server is broken because of the runner. Nothing about the
+ * copy itself says so; the record's {@link InstalledRecord.sourceSha} does.
+ *
+ * {@link checkOverrides} is read-only (doctor, status). {@link resyncOverrides}
+ * repairs: a changed source is copied again with the same runner, a removed or
+ * no-longer-approved one loses its copy. `bir setup` does the same through a
+ * full install; this is the cheap path for a process that runs every session.
+ */
+import { type InstalledRecord, type InstalledSidecar } from "./generate.js";
+import { type McpServerConfig } from "./resolve.js";
+/** The server name a sidecar key names, given the record's own cwd (either key shape, generate.ts `recordKey`). */
+export declare function recordServerName(key: string, record: InstalledRecord): string;
+export type OverrideState = "current" | "changed" | "removed" | "unapproved";
+export interface OverrideCheck {
+    name: string;
+    /** Its record's key in installed.json. */
+    key: string;
+    record: InstalledRecord;
+    state: OverrideState;
+    /** Where the entry it should copy comes from now. */
+    from: "project" | "user";
+    /** That entry, unwrapped — absent when it was removed. */
+    source?: McpServerConfig;
+    /** The local copy as it is now. */
+    local: McpServerConfig;
+    /** The `~/.claude.json` project keys holding the copy. */
+    keys: string[];
+    /** What is wrong, in words (for everything but "current"). */
+    why?: string;
+}
+/**
+ * Every override this directory's install wrote, and whether it still copies
+ * what it overrides. A copy the person has since removed or replaced is not
+ * listed: it is theirs now. Files that cannot be read yield no verdicts —
+ * Claude Code cannot read them either, and that is reported elsewhere.
+ */
+export declare function checkOverrides(cwd: string, sidecar?: InstalledSidecar): OverrideCheck[];
+/**
+ * Bring every stale override of `cwd` back in line with what it copies, in
+ * `~/.claude.json` and installed.json. A changed source is wrapped again with
+ * the runner the old copy named (same node, flags, script, control URL); a
+ * removed, rejected or never-approved one, a remote Claude Code signs in
+ * itself, or anything under a managed policy that matches by command, loses
+ * its copy, which lets the entry under it run as Claude Code would run it.
+ *
+ * Touches only wrapped local entries this directory's records name, and never
+ * throws: a failure leaves things as they were, for doctor to report.
+ */
+export declare function resyncOverrides(cwd: string): Array<{
+    name: string;
+    action: "rewrapped" | "removed";
+    why: string;
+}>;
+//# sourceMappingURL=overrides.d.ts.map

package/dist/config/overrides.js

@@ -0,0 +1,136 @@
+/**
+ * config/overrides — is each local-scope copy `bir install` wrote still a copy
+ * of the entry it overrides?
+ *
+ * An override (bir.ts, installClaudeCode) is a FROZEN copy of a `.mcp.json` or
+ * user-scope server, wrapped, in this project's local scope — which outranks
+ * both. When the team changes `.mcp.json` (a new version, a new host) or the
+ * person rotates a token in the user scope, Claude Code keeps starting the old
+ * copy here, and the server is broken because of the runner. Nothing about the
+ * copy itself says so; the record's {@link InstalledRecord.sourceSha} does.
+ *
+ * {@link checkOverrides} is read-only (doctor, status). {@link resyncOverrides}
+ * repairs: a changed source is copied again with the same runner, a removed or
+ * no-longer-approved one loses its copy. `bir setup` does the same through a
+ * full install; this is the cheap path for a process that runs every session.
+ */
+import { join } from "node:path";
+import { normalizePath } from "../control/paths.js";
+import { setLocalEntries } from "./adapters/claude-code.js";
+import { configSha, isWrapped, readSidecar, REDACTED_KEY_PREFIX, remoteWrapBlocker, sameServerConfig, unwrapEntry, wrapEntry, wrapOptionsOf, writeSidecar, } from "./generate.js";
+import { managedMcpPolicyBlocker, mcpjsonApprovals } from "./mcp-approval.js";
+import { claudeJsonPath, isRemote, parseJsonFile, projectKeysFor } from "./resolve.js";
+/** The server name a sidecar key names, given the record's own cwd (either key shape, generate.ts `recordKey`). */
+export function recordServerName(key, record) {
+    const bare = key.startsWith(REDACTED_KEY_PREFIX) ? key.slice(REDACTED_KEY_PREFIX.length) : key;
+    const prefix = `${record.cwd}::`;
+    return bare.startsWith(prefix) ? bare.slice(prefix.length) : bare.slice(bare.lastIndexOf("::") + 2);
+}
+/**
+ * Every override this directory's install wrote, and whether it still copies
+ * what it overrides. A copy the person has since removed or replaced is not
+ * listed: it is theirs now. Files that cannot be read yield no verdicts —
+ * Claude Code cannot read them either, and that is reported elsewhere.
+ */
+export function checkOverrides(cwd, sidecar = readSidecar()) {
+    const here = normalizePath(cwd);
+    const mine = Object.entries(sidecar.servers).filter(([, r]) => r.override && normalizePath(r.cwd) === here);
+    if (mine.length === 0)
+        return [];
+    let claude;
+    let mcp;
+    try {
+        claude = parseJsonFile(claudeJsonPath()) ?? {};
+        mcp = parseJsonFile(join(cwd, ".mcp.json"))?.mcpServers ?? {};
+    }
+    catch {
+        return [];
+    }
+    let approval;
+    const unwrapped = (c) => c !== undefined && isWrapped(c) ? unwrapEntry(c) : c;
+    const checks = [];
+    for (const [key, record] of mine) {
+        const name = recordServerName(key, record);
+        const keys = (record.keys ?? projectKeysFor(claude.projects, cwd)).filter((k) => claude.projects?.[k]?.mcpServers?.[name] !== undefined);
+        const local = keys.map((k) => claude.projects?.[k]?.mcpServers?.[name]).find((e) => e !== undefined);
+        if (local === undefined || !isWrapped(local))
+            continue;
+        const P = mcp[name];
+        const from = P !== undefined ? "project" : "user";
+        const source = unwrapped(P ?? claude.mcpServers?.[name]);
+        const was = record.override?.source === "project" ? ".mcp.json" : "your user scope";
+        const now = from === "project" ? ".mcp.json" : "your user scope";
+        const check = { name, key, record, state: "current", from, source, local, keys };
+        if (source === undefined) {
+            check.state = "removed";
+            check.why = `it was removed from ${was}, but this project still runs the copy`;
+        }
+        else if (from === "project") {
+            // Claude Code asks before it starts a `.mcp.json` server and never about
+            // the copy: one it would not start unasked must not have one. `--server`
+            // (optedIn) answers "pending" for the person; nothing answers "rejected".
+            approval ??= mcpjsonApprovals(cwd, claude);
+            const verdict = approval(name);
+            if (verdict.state === "rejected" || (verdict.state === "pending" && !record.optedIn)) {
+                check.state = "unapproved";
+                check.why = verdict.why;
+            }
+        }
+        if (check.state === "current" && source !== undefined) {
+            const same = record.sourceSha ? configSha(source) === record.sourceSha : sameServerConfig(unwrapEntry(local), source);
+            if (!same) {
+                check.state = "changed";
+                check.why =
+                    record.override?.source === "project" && from === "user"
+                        ? "it is gone from .mcp.json, so your user-scope entry of that name would run instead"
+                        : `${now} changed since the copy was made, and this project still runs the old one`;
+            }
+        }
+        checks.push(check);
+    }
+    return checks;
+}
+/**
+ * Bring every stale override of `cwd` back in line with what it copies, in
+ * `~/.claude.json` and installed.json. A changed source is wrapped again with
+ * the runner the old copy named (same node, flags, script, control URL); a
+ * removed, rejected or never-approved one, a remote Claude Code signs in
+ * itself, or anything under a managed policy that matches by command, loses
+ * its copy, which lets the entry under it run as Claude Code would run it.
+ *
+ * Touches only wrapped local entries this directory's records name, and never
+ * throws: a failure leaves things as they were, for doctor to report.
+ */
+export function resyncOverrides(cwd) {
+    const done = [];
+    try {
+        const sidecar = readSidecar();
+        const stale = checkOverrides(cwd, sidecar).filter((c) => c.state !== "current");
+        if (stale.length === 0)
+            return done;
+        const claudeJson = claudeJsonPath();
+        const policy = managedMcpPolicyBlocker();
+        const ours = (cur) => cur !== undefined && isWrapped(cur);
+        for (const c of stale) {
+            const opts = wrapOptionsOf(c.local);
+            const blocked = policy ?? (c.source && isRemote(c.source) && !c.record.optedIn ? remoteWrapBlocker(c.source) : undefined);
+            if (c.state === "changed" && c.source && opts && !blocked) {
+                setLocalEntries(claudeJson, c.keys, c.name, wrapEntry(c.source, { ...opts, serverName: c.name }), ours);
+                c.record.sourceSha = configSha(c.source);
+                c.record.override = { source: c.from };
+                done.push({ name: c.name, action: "rewrapped", why: c.why ?? "" });
+            }
+            else {
+                setLocalEntries(claudeJson, c.keys, c.name, null, ours);
+                delete sidecar.servers[c.key];
+                done.push({ name: c.name, action: "removed", why: blocked ?? c.why ?? "" });
+            }
+        }
+        writeSidecar(sidecar);
+    }
+    catch {
+        /* left as it was; `bir doctor` names what is stale */
+    }
+    return done;
+}
+//# sourceMappingURL=overrides.js.map