@envseal/cli 0.1.4 → 0.1.5

package/dist/host-wiring/apply.js

@@ -0,0 +1,165 @@
+import { mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { mergeAiderConf } from './aider.js';
+import { mergeAgentsMd } from './agents-md.js';
+import { writeCodexProjectConfig } from './codex.js';
+import { writeContinueProjectFiles, continueSnippetYaml } from './continue.js';
+import { mergeCopilotSettings } from './copilot.js';
+import { writeCursorHostFiles } from './cursor.js';
+import { writeGooseMarker, gooseYamlSnippet } from './goose.js';
+import { mergeMcpServersFile } from './mcp.js';
+import { mergeZedSettings } from './zed.js';
+const RELOAD = 'Reload MCP / restart the host, then run `envseal doctor`.';
+function mcpServersWrite(id, path, relative, platform, extraHint) {
+    const result = mergeMcpServersFile(path, platform);
+    const skipped = result.action === 'skipped'
+        ? ` Could not merge ${relative} (invalid JSON). Fix the file and re-run envseal init.`
+        : '';
+    return {
+        id,
+        action: result.action,
+        path: result.path,
+        hint: skipped || `${extraHint ?? ''} ${RELOAD}`.trim(),
+    };
+}
+export function applyHostWiring(root, hostIds, platform = process.platform) {
+    const agentsMd = mergeAgentsMd(root);
+    const hosts = [];
+    let cursor;
+    const unique = [...new Set(hostIds)];
+    const writesMcpHost = unique.some((id) => [
+        'cursor',
+        'claude-code',
+        'windsurf',
+        'cline',
+        'zed',
+        'jetbrains',
+        'copilot',
+        'continue',
+        'codex',
+        'goose',
+        'aider',
+    ].includes(id));
+    for (const id of unique) {
+        switch (id) {
+            case 'cursor': {
+                cursor = writeCursorHostFiles(root, platform);
+                hosts.push({
+                    id,
+                    action: cursor.mcp,
+                    path: cursor.mcpPath,
+                    hint: cursor.mcp === 'skipped'
+                        ? 'Could not merge .cursor/mcp.json (invalid JSON). Fix the file and re-run envseal init.'
+                        : cursor.reloadHint,
+                    extra: { mcp: cursor.mcp, rules: cursor.rules, rulesPath: cursor.rulesPath },
+                });
+                break;
+            }
+            case 'claude-code': {
+                mkdirSync(join(root, '.claude'), { recursive: true });
+                hosts.push(mcpServersWrite(id, join(root, '.mcp.json'), '.mcp.json', platform, 'Wrote project .mcp.json (Tier B protocol). Restart Claude Code so it picks up envseal-mcp. Install plugins/claude-code for Tier A hooks — doctor reports A only when hooks are visible.'));
+                break;
+            }
+            case 'windsurf': {
+                hosts.push(mcpServersWrite(id, join(root, '.windsurf', 'mcp_config.json'), '.windsurf/mcp_config.json', platform, '[VERIFY] Windsurf MCP schema has shifted across releases.'));
+                break;
+            }
+            case 'cline': {
+                hosts.push(mcpServersWrite(id, join(root, '.cline', 'mcp_settings.json'), '.cline/mcp_settings.json', platform, '[VERIFY] Cline MCP schema.'));
+                break;
+            }
+            case 'zed': {
+                const result = mergeZedSettings(root, platform);
+                hosts.push({
+                    id,
+                    action: result.action,
+                    path: result.path,
+                    hint: result.action === 'skipped'
+                        ? 'Could not merge .zed/settings.json (invalid JSON). Fix the file and re-run envseal init. [VERIFY]'
+                        : `[VERIFY] Zed MCP key shape. ${RELOAD}`,
+                });
+                break;
+            }
+            case 'jetbrains': {
+                hosts.push(mcpServersWrite(id, join(root, '.idea', 'mcp.json'), '.idea/mcp.json', platform, '[VERIFY] JetBrains MCP location varies by product.'));
+                break;
+            }
+            case 'copilot': {
+                const result = mergeCopilotSettings(root, platform);
+                hosts.push({
+                    id,
+                    action: result.action,
+                    path: result.path,
+                    hint: result.action === 'skipped'
+                        ? 'Could not merge .vscode/settings.json (invalid JSON). Fix the file and re-run envseal init. [VERIFY]'
+                        : `[VERIFY] github.copilot.mcp schema. ${RELOAD}`,
+                });
+                break;
+            }
+            case 'continue': {
+                const result = writeContinueProjectFiles(root, platform);
+                hosts.push({
+                    id,
+                    action: result.action,
+                    path: result.path,
+                    hint: `${result.printOnlyHint}\n\nMerge into ~/.continue/config.yaml:\n${continueSnippetYaml(platform)}`,
+                });
+                break;
+            }
+            case 'codex': {
+                const result = writeCodexProjectConfig(root, platform);
+                hosts.push({
+                    id,
+                    action: result.action,
+                    path: result.path,
+                    hint: `[VERIFY] Codex may still read ~/.codex/config.toml; envseal does not write $HOME. ${RELOAD}`,
+                });
+                break;
+            }
+            case 'goose': {
+                const result = writeGooseMarker(root);
+                hosts.push({
+                    id,
+                    action: 'printed',
+                    path: result.path,
+                    hint: `Goose is not OOTB. ${result.addHint}\n\nOr merge (unverified yaml):\n${gooseYamlSnippet(platform)}`,
+                });
+                break;
+            }
+            case 'aider': {
+                const result = mergeAiderConf(root);
+                hosts.push({
+                    id,
+                    action: result.action,
+                    path: result.path,
+                    hint: 'Merged Aider config so .env is not on the read list. Use /run envseal ensure.',
+                });
+                break;
+            }
+            case 'generic':
+            case 'unknown':
+            case 'openhands':
+                hosts.push({
+                    id,
+                    action: 'printed',
+                    hint: id === 'openhands'
+                        ? 'OpenHands is deployment-dependent (binary inside sandbox, TTY for ensure). Layer 1 AGENTS.md is the working path.'
+                        : 'Layer 1 only (AGENTS.md). Any agent that reads instruction files can run envseal ensure / envseal run --.',
+                });
+                break;
+            default:
+                hosts.push({
+                    id,
+                    action: 'printed',
+                    hint: 'Unknown host: Layer 1 AGENTS.md only. Re-run from the IDE or `envseal init --host <name>`.',
+                });
+        }
+    }
+    return {
+        agentsMd,
+        hosts,
+        cursor,
+        bareTerminal: !writesMcpHost,
+    };
+}
+//# sourceMappingURL=apply.js.map

package/dist/host-wiring/codex.d.ts

@@ -0,0 +1,8 @@
+import { type McpInspection, type McpWriteAction } from './mcp.js';
+export declare function codexTomlBlock(platform?: NodeJS.Platform): string;
+export declare function writeCodexProjectConfig(root: string, platform?: NodeJS.Platform): {
+    action: McpWriteAction;
+    path: string;
+};
+export declare function inspectCodexProject(root: string): McpInspection;
+//# sourceMappingURL=codex.d.ts.map

package/dist/host-wiring/codex.js

@@ -0,0 +1,57 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { mcpLaunch } from './mcp.js';
+export function codexTomlBlock(platform = process.platform) {
+    const launch = mcpLaunch(platform);
+    const args = launch.args.map((a) => `"${a}"`).join(', ');
+    return `[mcp_servers.envseal-mcp]
+command = "${launch.command}"
+args = [${args}]
+`;
+}
+export function writeCodexProjectConfig(root, platform = process.platform) {
+    const path = join(root, '.codex', 'config.toml');
+    const block = `# envseal MCP — [VERIFY] Codex schema is still moving. Prefer project
+# .codex/ over ~/.codex/config.toml (global cwd is $HOME).
+${codexTomlBlock(platform)}`;
+    if (!existsSync(path)) {
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, block, 'utf8');
+        return { action: 'created', path };
+    }
+    const existing = readFileSync(path, 'utf8');
+    if (/mcp_servers\.envseal-mcp|envseal-mcp/.test(existing)) {
+        return { action: 'unchanged', path };
+    }
+    const trimmed = existing.replace(/\s+$/u, '');
+    writeFileSync(path, `${trimmed}\n\n${block}`, 'utf8');
+    return { action: 'merged', path };
+}
+export function inspectCodexProject(root) {
+    const path = join(root, '.codex', 'config.toml');
+    const hint = 'Run `envseal init` to write project .codex/config.toml. [VERIFY] Codex may still only read ~/.codex/config.toml — envseal does not write $HOME.';
+    if (!existsSync(path)) {
+        return {
+            wired: false,
+            status: 'absent',
+            commandOk: null,
+            message: `.codex/config.toml is missing. ${hint}`,
+        };
+    }
+    const text = readFileSync(path, 'utf8');
+    if (!/envseal-mcp/.test(text)) {
+        return {
+            wired: false,
+            status: 'missing',
+            commandOk: null,
+            message: `.codex/config.toml has no envseal-mcp. ${hint}`,
+        };
+    }
+    return {
+        wired: true,
+        status: 'wired',
+        commandOk: null,
+        message: 'Project .codex/config.toml names envseal-mcp. [VERIFY: Codex may ignore project files.]',
+    };
+}
+//# sourceMappingURL=codex.js.map

package/dist/host-wiring/continue.d.ts

@@ -0,0 +1,9 @@
+import { type McpInspection, type McpWriteAction } from './mcp.js';
+export declare function continueSnippetYaml(platform?: NodeJS.Platform): string;
+export declare function writeContinueProjectFiles(root: string, platform?: NodeJS.Platform): {
+    action: McpWriteAction;
+    path: string;
+    printOnlyHint: string;
+};
+export declare function inspectContinueProject(root: string): McpInspection;
+//# sourceMappingURL=continue.d.ts.map

package/dist/host-wiring/continue.js

@@ -0,0 +1,54 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { mcpLaunch } from './mcp.js';
+export function continueSnippetYaml(platform = process.platform) {
+    const launch = mcpLaunch(platform);
+    const args = launch.args.map((a) => `"${a}"`).join(', ');
+    return `mcpServers:
+  - name: envseal-mcp
+    command: ${launch.command}
+    args: [${args}]
+`;
+}
+export function writeContinueProjectFiles(root, platform = process.platform) {
+    const dir = join(root, '.continue');
+    mkdirSync(dir, { recursive: true });
+    const path = join(dir, 'config.yaml');
+    const snippet = continueSnippetYaml(platform);
+    const printOnlyHint = 'Continue loads MCP from ~/.continue/config.yaml (global), not this project file. Merge the printed block into the global config; envseal does not write $HOME files. [VERIFY]';
+    if (!existsSync(path)) {
+        const body = `# Project copy of the envseal MCP snippet. Continue currently reads
+# ~/.continue/config.yaml — merge the mcpServers block there. Do not copy this
+# into $HOME from envseal init; this file exists so doctor can see the host.
+#
+# [VERIFY: recent Continue builds moved to a new HUB config schema; if a
+# top-level mcpServers list is not accepted, use experimental.mcpServers.]
+
+${snippet}`;
+        writeFileSync(path, body, 'utf8');
+        return { action: 'created', path, printOnlyHint };
+    }
+    const existing = readFileSync(path, 'utf8');
+    if (/envseal-mcp/.test(existing) && /@envseal\/mcp-server|npx/.test(existing)) {
+        return { action: 'unchanged', path, printOnlyHint };
+    }
+    if (/envseal-mcp/.test(existing)) {
+        return { action: 'unchanged', path, printOnlyHint };
+    }
+    const trimmed = existing.replace(/\s+$/u, '');
+    writeFileSync(path, `${trimmed}\n\n${snippet}`, 'utf8');
+    return { action: 'merged', path, printOnlyHint };
+}
+export function inspectContinueProject(root) {
+    const path = join(root, '.continue', 'config.yaml');
+    const hasSnippet = existsSync(path) && /envseal-mcp/.test(readFileSync(path, 'utf8'));
+    // Continue's documented MCP file is ~/.continue/config.yaml. envseal never
+    // writes $HOME, so project MCP is not OOTB regardless of the snippet file.
+    return {
+        wired: false,
+        status: hasSnippet ? 'missing' : 'absent',
+        commandOk: null,
+        message: 'Continue is not OOTB: merge the envseal mcpServers block into ~/.continue/config.yaml (envseal does not write $HOME). Project .continue/ is a detection marker + copy-paste snippet. [VERIFY]',
+    };
+}
+//# sourceMappingURL=continue.js.map

package/dist/host-wiring/copilot.d.ts

@@ -0,0 +1,10 @@
+import { type McpInspection, type McpWriteAction } from './mcp.js';
+export declare function mergeCopilotSettings(root: string, platform?: NodeJS.Platform): {
+    action: McpWriteAction;
+    path: string;
+};
+export declare function inspectCopilotSettings(root: string, options?: {
+    probe?: boolean;
+    platform?: NodeJS.Platform;
+}): McpInspection;
+//# sourceMappingURL=copilot.d.ts.map

package/dist/host-wiring/copilot.js

@@ -0,0 +1,99 @@
+import { existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { ENVSEAL_MCP_SERVER_NAME, isRecord, mcpLaunch, parseJsonObject, writeJson, isEmptyEnvsealStub, isStockNpxLaunch, looksLikeEnvsealServer, probeVersion, } from './mcp.js';
+function asServerList(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value))
+        return undefined;
+    return value;
+}
+function entryName(entry) {
+    if (!isRecord(entry))
+        return undefined;
+    if (typeof entry.name === 'string')
+        return entry.name;
+    return undefined;
+}
+export function mergeCopilotSettings(root, platform = process.platform) {
+    const path = join(root, '.vscode', 'settings.json');
+    const launch = { name: ENVSEAL_MCP_SERVER_NAME, ...mcpLaunch(platform) };
+    if (!existsSync(path)) {
+        mkdirSync(dirname(path), { recursive: true });
+        writeJson(path, { 'github.copilot.mcp': [launch] });
+        return { action: 'created', path };
+    }
+    const parsed = parseJsonObject(readFileSync(path, 'utf8'));
+    if (parsed === null) {
+        return { action: 'skipped', path };
+    }
+    const existing = asServerList(parsed['github.copilot.mcp']);
+    if (parsed['github.copilot.mcp'] !== undefined && existing === undefined) {
+        return { action: 'skipped', path };
+    }
+    const list = existing === undefined ? [] : [...existing];
+    const index = list.findIndex((item) => entryName(item) === ENVSEAL_MCP_SERVER_NAME);
+    if (index === -1) {
+        list.push(launch);
+        writeJson(path, { ...parsed, 'github.copilot.mcp': list });
+        return { action: 'merged', path };
+    }
+    const current = list[index];
+    if (isEmptyEnvsealStub(current) || isStockNpxLaunch(current)) {
+        if (isStockNpxLaunch(current) && isRecord(current) && current.command === launch.command) {
+            return { action: 'unchanged', path };
+        }
+        list[index] = isRecord(current) ? { ...current, ...launch } : launch;
+        writeJson(path, { ...parsed, 'github.copilot.mcp': list });
+        return { action: 'merged', path };
+    }
+    return { action: 'unchanged', path };
+}
+export function inspectCopilotSettings(root, options = {}) {
+    const path = join(root, '.vscode', 'settings.json');
+    const hint = 'Run `envseal init` to merge github.copilot.mcp with envseal-mcp (npx @envseal/mcp-server). [VERIFY]';
+    if (!existsSync(path)) {
+        return {
+            wired: false,
+            status: 'absent',
+            commandOk: null,
+            message: `.vscode/settings.json is missing. ${hint}`,
+        };
+    }
+    const parsed = parseJsonObject(readFileSync(path, 'utf8'));
+    if (parsed === null) {
+        return {
+            wired: false,
+            status: 'unreadable',
+            commandOk: null,
+            message: `.vscode/settings.json is not valid JSON. ${hint}`,
+        };
+    }
+    const list = asServerList(parsed['github.copilot.mcp']);
+    if (list === undefined || list.length === 0) {
+        return {
+            wired: false,
+            status: 'missing',
+            commandOk: null,
+            message: `.vscode/settings.json has no github.copilot.mcp envseal entry. ${hint}`,
+        };
+    }
+    const entry = list.find((item) => entryName(item) === ENVSEAL_MCP_SERVER_NAME);
+    if (entry === undefined || isEmptyEnvsealStub(entry) || !looksLikeEnvsealServer(entry)) {
+        return {
+            wired: false,
+            status: entry === undefined ? 'missing' : 'stub',
+            commandOk: null,
+            message: `.vscode/settings.json github.copilot.mcp has no working envseal-mcp. ${hint}`,
+        };
+    }
+    const rec = entry;
+    const commandOk = options.probe === true ? probeVersion(rec) : null;
+    let message = 'Copilot MCP is wired (project .vscode/settings.json github.copilot.mcp). [VERIFY]';
+    if (commandOk === false) {
+        message =
+            'Copilot MCP is configured, but the launch command did not report a version. Run `envseal init`. [VERIFY]';
+    }
+    return { wired: true, status: 'wired', commandOk, message };
+}
+//# sourceMappingURL=copilot.js.map

package/dist/host-wiring/cursor-rules.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Advisory Cursor rule file shipped by `envseal init`.
+ *
+ * Keep this string identical to `plugins/cursor/rules/envseal.mdc`. The
+ * cursor-wiring test fails if they drift. Embedding (not reading plugins/ at
+ * runtime) is what makes published `@envseal/cli` able to write the file.
+ */
+export declare const CURSOR_RULES_MDC = "---\ndescription: envseal \u2014 never read .env, never echo secrets; use env_describe/env_request instead.\nalwaysApply: true\n---\n\nCursor rules are advisory, not enforced. Treat these as hard rules regardless.\n\n- Never read, write, or print the contents of `.env` or any `.env.*` file (`.env.example` is the only exception \u2014 it contains placeholders, never values).\n- Never run `printenv`, bare `env`, `export -p`, `set`, `env | grep ...`, or `echo $VAR` / `echo $KEY...` to inspect or display environment variables. Every one of these puts secret values into the transcript.\n- Never `cat`, `head`, `tail`, `less`, `grep`, `xxd`, or `base64` a secrets file (`*.pem`, `*.key`, `credentials.json`, `secrets.json`, `.envseal/*`).\n- Never ask the user to paste an API key into the chat.\n\nInstead, use the envseal broker via MCP:\n\n- `env_describe` \u2014 read-only status of the declared keys (present, format-valid, last verified). It never returns values and there is no way to make it do so.\n- `env_request` \u2014 collect the missing keys from the user through a secure prompt. It returns a ticket, never a value; follow up with `env_await`.\n- `env_declare` \u2014 declare a key this project needs, with format and provider metadata.\n- `env_verify` \u2014 test that a key actually works (classified result only).\n- `env_use` \u2014 run a command with secrets injected into the child process; output is redacted.\n- `env_revoke` \u2014 remove a key and get the rotation URL.\n\nIf a required key is missing, `env_request` it. Never read `.env` to find it, and never print it back.\n";
+//# sourceMappingURL=cursor-rules.d.ts.map

package/dist/host-wiring/cursor-rules.js

@@ -0,0 +1,31 @@
+/**
+ * Advisory Cursor rule file shipped by `envseal init`.
+ *
+ * Keep this string identical to `plugins/cursor/rules/envseal.mdc`. The
+ * cursor-wiring test fails if they drift. Embedding (not reading plugins/ at
+ * runtime) is what makes published `@envseal/cli` able to write the file.
+ */
+export const CURSOR_RULES_MDC = `---
+description: envseal — never read .env, never echo secrets; use env_describe/env_request instead.
+alwaysApply: true
+---
+
+Cursor rules are advisory, not enforced. Treat these as hard rules regardless.
+
+- Never read, write, or print the contents of \`.env\` or any \`.env.*\` file (\`.env.example\` is the only exception — it contains placeholders, never values).
+- Never run \`printenv\`, bare \`env\`, \`export -p\`, \`set\`, \`env | grep ...\`, or \`echo $VAR\` / \`echo $KEY...\` to inspect or display environment variables. Every one of these puts secret values into the transcript.
+- Never \`cat\`, \`head\`, \`tail\`, \`less\`, \`grep\`, \`xxd\`, or \`base64\` a secrets file (\`*.pem\`, \`*.key\`, \`credentials.json\`, \`secrets.json\`, \`.envseal/*\`).
+- Never ask the user to paste an API key into the chat.
+
+Instead, use the envseal broker via MCP:
+
+- \`env_describe\` — read-only status of the declared keys (present, format-valid, last verified). It never returns values and there is no way to make it do so.
+- \`env_request\` — collect the missing keys from the user through a secure prompt. It returns a ticket, never a value; follow up with \`env_await\`.
+- \`env_declare\` — declare a key this project needs, with format and provider metadata.
+- \`env_verify\` — test that a key actually works (classified result only).
+- \`env_use\` — run a command with secrets injected into the child process; output is redacted.
+- \`env_revoke\` — remove a key and get the rotation URL.
+
+If a required key is missing, \`env_request\` it. Never read \`.env\` to find it, and never print it back.
+`;
+//# sourceMappingURL=cursor-rules.js.map

package/dist/host-wiring/cursor.d.ts

@@ -0,0 +1,31 @@
+import { type McpInspection, type McpLaunch, type McpWriteAction } from './mcp.js';
+export { ENVSEAL_MCP_PACKAGE, ENVSEAL_MCP_SERVER_NAME, isEmptyEnvsealStub, isStockNpxLaunch, } from './mcp.js';
+export type CursorMcpLaunch = McpLaunch;
+export type CursorMcpWriteAction = McpWriteAction;
+export type CursorRulesWriteAction = 'created' | 'unchanged';
+export type CursorMcpStatus = McpInspection['status'];
+export type CursorMcpInspection = McpInspection;
+export type CursorWiringResult = {
+    mcp: CursorMcpWriteAction;
+    rules: CursorRulesWriteAction;
+    mcpPath: string;
+    rulesPath: string;
+    /** Human one-liner: reload MCP. Empty when mcp write was skipped. */
+    reloadHint: string;
+};
+export declare function cursorMcpLaunch(platform?: NodeJS.Platform): CursorMcpLaunch;
+export declare function cursorMcpSnippetJson(platform?: NodeJS.Platform): string;
+export declare function writeCursorMcpJson(root: string, platform?: NodeJS.Platform): {
+    action: CursorMcpWriteAction;
+    path: string;
+};
+export declare function writeCursorRules(root: string): {
+    action: CursorRulesWriteAction;
+    path: string;
+};
+export declare function writeCursorHostFiles(root: string, platform?: NodeJS.Platform): CursorWiringResult;
+export declare function inspectCursorMcp(root: string, options?: {
+    probe?: boolean;
+    platform?: NodeJS.Platform;
+}): CursorMcpInspection;
+//# sourceMappingURL=cursor.d.ts.map

package/dist/host-wiring/cursor.js

@@ -0,0 +1,39 @@
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { CURSOR_RULES_MDC } from './cursor-rules.js';
+import { inspectMcpServersFile, mcpLaunch, mcpSnippetJson, mergeMcpServersFile, } from './mcp.js';
+export { ENVSEAL_MCP_PACKAGE, ENVSEAL_MCP_SERVER_NAME, isEmptyEnvsealStub, isStockNpxLaunch, } from './mcp.js';
+const RELOAD_HINT = 'Reload MCP in Settings → MCP so Cursor picks up envseal-mcp.';
+export function cursorMcpLaunch(platform = process.platform) {
+    return mcpLaunch(platform);
+}
+export function cursorMcpSnippetJson(platform = process.platform) {
+    return mcpSnippetJson(platform);
+}
+export function writeCursorMcpJson(root, platform = process.platform) {
+    return mergeMcpServersFile(join(root, '.cursor', 'mcp.json'), platform);
+}
+export function writeCursorRules(root) {
+    const path = join(root, '.cursor', 'rules', 'envseal.mdc');
+    if (existsSync(path)) {
+        return { action: 'unchanged', path };
+    }
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, CURSOR_RULES_MDC, 'utf8');
+    return { action: 'created', path };
+}
+export function writeCursorHostFiles(root, platform = process.platform) {
+    const mcp = writeCursorMcpJson(root, platform);
+    const rules = writeCursorRules(root);
+    return {
+        mcp: mcp.action,
+        rules: rules.action,
+        mcpPath: mcp.path,
+        rulesPath: rules.path,
+        reloadHint: mcp.action === 'skipped' ? '' : RELOAD_HINT,
+    };
+}
+export function inspectCursorMcp(root, options = {}) {
+    return inspectMcpServersFile(join(root, '.cursor', 'mcp.json'), '.cursor/mcp.json', options);
+}
+//# sourceMappingURL=cursor.js.map

package/dist/host-wiring/goose.d.ts

@@ -0,0 +1,16 @@
+import { type McpInspection, type McpWriteAction } from './mcp.js';
+export declare function gooseYamlSnippet(platform?: NodeJS.Platform): string;
+export declare function gooseAddHint(platform?: NodeJS.Platform): string;
+/**
+ * Goose is print-only: do not invent a verified project schema.
+ * Create `.goose/` so doctor can label the host; MCP stays unwired until the
+ * user runs the printed CLI / yaml themselves.
+ */
+export declare function writeGooseMarker(root: string): {
+    action: McpWriteAction;
+    path: string;
+    addHint: string;
+    yamlSnippet: string;
+};
+export declare function inspectGooseProject(root: string): McpInspection;
+//# sourceMappingURL=goose.d.ts.map

package/dist/host-wiring/goose.js

@@ -0,0 +1,57 @@
+import { existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { mcpLaunch } from './mcp.js';
+export function gooseYamlSnippet(platform = process.platform) {
+    const launch = mcpLaunch(platform);
+    const args = launch.args.map((a) => `"${a}"`).join(', ');
+    return `mcp:
+  servers:
+    envseal-mcp:
+      cmd: ${launch.command}
+      args: [${args}]
+`;
+}
+export function gooseAddHint(platform = process.platform) {
+    const launch = mcpLaunch(platform);
+    const args = launch.args.join(' ');
+    return `goose mcp add envseal-mcp -- ${launch.command} ${args}   # [VERIFY: exact flags for your build]`;
+}
+/**
+ * Goose is print-only: do not invent a verified project schema.
+ * Create `.goose/` so doctor can label the host; MCP stays unwired until the
+ * user runs the printed CLI / yaml themselves.
+ */
+export function writeGooseMarker(root) {
+    const dir = join(root, '.goose');
+    const existed = existsSync(dir);
+    mkdirSync(dir, { recursive: true });
+    return {
+        action: existed ? 'unchanged' : 'created',
+        path: dir,
+        addHint: gooseAddHint(),
+        yamlSnippet: gooseYamlSnippet(),
+    };
+}
+export function inspectGooseProject(root) {
+    const files = [join(root, 'goose.config.yaml'), join(root, '.goose', 'config.yaml')];
+    for (const path of files) {
+        if (!existsSync(path))
+            continue;
+        const text = readFileSync(path, 'utf8');
+        if (/envseal-mcp/.test(text)) {
+            return {
+                wired: true,
+                status: 'wired',
+                commandOk: null,
+                message: `Goose config names envseal-mcp (${path}). [VERIFY]`,
+            };
+        }
+    }
+    return {
+        wired: false,
+        status: 'missing',
+        commandOk: null,
+        message: 'Goose is not OOTB: run `goose mcp add` (see envseal init output) or merge the yaml snippet. envseal does not write ~/.config/goose/. [VERIFY]',
+    };
+}
+//# sourceMappingURL=goose.js.map

package/dist/host-wiring/inspect.d.ts

@@ -0,0 +1,24 @@
+import { type McpInspection } from './mcp.js';
+export type AgentWiringMcp = 'ok' | 'missing' | 'spawn_failed';
+export type AgentWiringInstructions = 'ok' | 'missing';
+export type AgentWiring = {
+    mcp: AgentWiringMcp;
+    instructions: AgentWiringInstructions;
+};
+export type PrimaryHostInspection = {
+    wiring: AgentWiring;
+    mcp?: McpInspection;
+    /** Hosts where MCP is expected in a project file. */
+    mcpRequired: boolean;
+    /** Documented as print-only / not OOTB even after init. */
+    notOotb: boolean;
+    /** Aider: `.env` appears on the `read:` list. */
+    aiderUnsafe: boolean;
+    message: string;
+};
+export declare function inspectPrimaryHostWiring(root: string, hostId: string, options?: {
+    probe?: boolean;
+    platform?: NodeJS.Platform;
+}): PrimaryHostInspection;
+export declare function wiringFailsDoctor(inspection: PrimaryHostInspection): boolean;
+//# sourceMappingURL=inspect.d.ts.map