@envseal/cli 0.1.4 → 0.1.6

package/dist/host-wiring/cursor-rules.js

@@ -0,0 +1,31 @@
+/**
+ * Advisory Cursor rule file shipped by `envseal init`.
+ *
+ * Keep this string identical to `plugins/cursor/rules/envseal.mdc`. The
+ * cursor-wiring test fails if they drift. Embedding (not reading plugins/ at
+ * runtime) is what makes published `@envseal/cli` able to write the file.
+ */
+export const CURSOR_RULES_MDC = `---
+description: envseal — never read .env, never echo secrets; use env_describe/env_request instead.
+alwaysApply: true
+---
+
+Cursor rules are advisory, not enforced. Treat these as hard rules regardless.
+
+- Never read, write, or print the contents of \`.env\` or any \`.env.*\` file (\`.env.example\` is the only exception — it contains placeholders, never values).
+- Never run \`printenv\`, bare \`env\`, \`export -p\`, \`set\`, \`env | grep ...\`, or \`echo $VAR\` / \`echo $KEY...\` to inspect or display environment variables. Every one of these puts secret values into the transcript.
+- Never \`cat\`, \`head\`, \`tail\`, \`less\`, \`grep\`, \`xxd\`, or \`base64\` a secrets file (\`*.pem\`, \`*.key\`, \`credentials.json\`, \`secrets.json\`, \`.envseal/*\`).
+- Never ask the user to paste an API key into the chat.
+
+Instead, use the envseal broker via MCP:
+
+- \`env_describe\` — read-only status of the declared keys (present, format-valid, last verified). It never returns values and there is no way to make it do so.
+- \`env_request\` — collect the missing keys from the user through a secure prompt. It returns a ticket, never a value; follow up with \`env_await\`.
+- \`env_declare\` — declare a key this project needs, with format and provider metadata.
+- \`env_verify\` — test that a key actually works (classified result only).
+- \`env_use\` — run a command with secrets injected into the child process; output is redacted.
+- \`env_revoke\` — remove a key and get the rotation URL.
+
+If a required key is missing, \`env_request\` it. Never read \`.env\` to find it, and never print it back.
+`;
+//# sourceMappingURL=cursor-rules.js.map

package/dist/host-wiring/cursor.d.ts

@@ -0,0 +1,31 @@
+import { type McpInspection, type McpLaunch, type McpWriteAction } from './mcp.js';
+export { ENVSEAL_MCP_PACKAGE, ENVSEAL_MCP_SERVER_NAME, isEmptyEnvsealStub, isStockNpxLaunch, } from './mcp.js';
+export type CursorMcpLaunch = McpLaunch;
+export type CursorMcpWriteAction = McpWriteAction;
+export type CursorRulesWriteAction = 'created' | 'unchanged';
+export type CursorMcpStatus = McpInspection['status'];
+export type CursorMcpInspection = McpInspection;
+export type CursorWiringResult = {
+    mcp: CursorMcpWriteAction;
+    rules: CursorRulesWriteAction;
+    mcpPath: string;
+    rulesPath: string;
+    /** Human one-liner: reload MCP. Empty when mcp write was skipped. */
+    reloadHint: string;
+};
+export declare function cursorMcpLaunch(platform?: NodeJS.Platform): CursorMcpLaunch;
+export declare function cursorMcpSnippetJson(platform?: NodeJS.Platform): string;
+export declare function writeCursorMcpJson(root: string, platform?: NodeJS.Platform): {
+    action: CursorMcpWriteAction;
+    path: string;
+};
+export declare function writeCursorRules(root: string): {
+    action: CursorRulesWriteAction;
+    path: string;
+};
+export declare function writeCursorHostFiles(root: string, platform?: NodeJS.Platform): CursorWiringResult;
+export declare function inspectCursorMcp(root: string, options?: {
+    probe?: boolean;
+    platform?: NodeJS.Platform;
+}): CursorMcpInspection;
+//# sourceMappingURL=cursor.d.ts.map

package/dist/host-wiring/cursor.js

@@ -0,0 +1,39 @@
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { CURSOR_RULES_MDC } from './cursor-rules.js';
+import { inspectMcpServersFile, mcpLaunch, mcpSnippetJson, mergeMcpServersFile, } from './mcp.js';
+export { ENVSEAL_MCP_PACKAGE, ENVSEAL_MCP_SERVER_NAME, isEmptyEnvsealStub, isStockNpxLaunch, } from './mcp.js';
+const RELOAD_HINT = 'Reload MCP in Settings → MCP so Cursor picks up envseal-mcp.';
+export function cursorMcpLaunch(platform = process.platform) {
+    return mcpLaunch(platform);
+}
+export function cursorMcpSnippetJson(platform = process.platform) {
+    return mcpSnippetJson(platform);
+}
+export function writeCursorMcpJson(root, platform = process.platform) {
+    return mergeMcpServersFile(join(root, '.cursor', 'mcp.json'), platform);
+}
+export function writeCursorRules(root) {
+    const path = join(root, '.cursor', 'rules', 'envseal.mdc');
+    if (existsSync(path)) {
+        return { action: 'unchanged', path };
+    }
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, CURSOR_RULES_MDC, 'utf8');
+    return { action: 'created', path };
+}
+export function writeCursorHostFiles(root, platform = process.platform) {
+    const mcp = writeCursorMcpJson(root, platform);
+    const rules = writeCursorRules(root);
+    return {
+        mcp: mcp.action,
+        rules: rules.action,
+        mcpPath: mcp.path,
+        rulesPath: rules.path,
+        reloadHint: mcp.action === 'skipped' ? '' : RELOAD_HINT,
+    };
+}
+export function inspectCursorMcp(root, options = {}) {
+    return inspectMcpServersFile(join(root, '.cursor', 'mcp.json'), '.cursor/mcp.json', options);
+}
+//# sourceMappingURL=cursor.js.map

package/dist/host-wiring/goose.d.ts

@@ -0,0 +1,16 @@
+import { type McpInspection, type McpWriteAction } from './mcp.js';
+export declare function gooseYamlSnippet(platform?: NodeJS.Platform): string;
+export declare function gooseAddHint(platform?: NodeJS.Platform): string;
+/**
+ * Goose is print-only: do not invent a verified project schema.
+ * Create `.goose/` so doctor can label the host; MCP stays unwired until the
+ * user runs the printed CLI / yaml themselves.
+ */
+export declare function writeGooseMarker(root: string): {
+    action: McpWriteAction;
+    path: string;
+    addHint: string;
+    yamlSnippet: string;
+};
+export declare function inspectGooseProject(root: string): McpInspection;
+//# sourceMappingURL=goose.d.ts.map

package/dist/host-wiring/goose.js

@@ -0,0 +1,57 @@
+import { existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { mcpLaunch } from './mcp.js';
+export function gooseYamlSnippet(platform = process.platform) {
+    const launch = mcpLaunch(platform);
+    const args = launch.args.map((a) => `"${a}"`).join(', ');
+    return `mcp:
+  servers:
+    envseal-mcp:
+      cmd: ${launch.command}
+      args: [${args}]
+`;
+}
+export function gooseAddHint(platform = process.platform) {
+    const launch = mcpLaunch(platform);
+    const args = launch.args.join(' ');
+    return `goose mcp add envseal-mcp -- ${launch.command} ${args}   # [VERIFY: exact flags for your build]`;
+}
+/**
+ * Goose is print-only: do not invent a verified project schema.
+ * Create `.goose/` so doctor can label the host; MCP stays unwired until the
+ * user runs the printed CLI / yaml themselves.
+ */
+export function writeGooseMarker(root) {
+    const dir = join(root, '.goose');
+    const existed = existsSync(dir);
+    mkdirSync(dir, { recursive: true });
+    return {
+        action: existed ? 'unchanged' : 'created',
+        path: dir,
+        addHint: gooseAddHint(),
+        yamlSnippet: gooseYamlSnippet(),
+    };
+}
+export function inspectGooseProject(root) {
+    const files = [join(root, 'goose.config.yaml'), join(root, '.goose', 'config.yaml')];
+    for (const path of files) {
+        if (!existsSync(path))
+            continue;
+        const text = readFileSync(path, 'utf8');
+        if (/envseal-mcp/.test(text)) {
+            return {
+                wired: true,
+                status: 'wired',
+                commandOk: null,
+                message: `Goose config names envseal-mcp (${path}). [VERIFY]`,
+            };
+        }
+    }
+    return {
+        wired: false,
+        status: 'missing',
+        commandOk: null,
+        message: 'Goose is not OOTB: run `goose mcp add` (see envseal init output) or merge the yaml snippet. envseal does not write ~/.config/goose/. [VERIFY]',
+    };
+}
+//# sourceMappingURL=goose.js.map

package/dist/host-wiring/inspect.d.ts

@@ -0,0 +1,24 @@
+import { type McpInspection } from './mcp.js';
+export type AgentWiringMcp = 'ok' | 'missing' | 'spawn_failed';
+export type AgentWiringInstructions = 'ok' | 'missing';
+export type AgentWiring = {
+    mcp: AgentWiringMcp;
+    instructions: AgentWiringInstructions;
+};
+export type PrimaryHostInspection = {
+    wiring: AgentWiring;
+    mcp?: McpInspection;
+    /** Hosts where MCP is expected in a project file. */
+    mcpRequired: boolean;
+    /** Documented as print-only / not OOTB even after init. */
+    notOotb: boolean;
+    /** Aider: `.env` appears on the `read:` list. */
+    aiderUnsafe: boolean;
+    message: string;
+};
+export declare function inspectPrimaryHostWiring(root: string, hostId: string, options?: {
+    probe?: boolean;
+    platform?: NodeJS.Platform;
+}): PrimaryHostInspection;
+export declare function wiringFailsDoctor(inspection: PrimaryHostInspection): boolean;
+//# sourceMappingURL=inspect.d.ts.map

package/dist/host-wiring/inspect.js

@@ -0,0 +1,102 @@
+import { join } from 'node:path';
+import { inspectAiderConf } from './aider.js';
+import { inspectAgentsMd } from './agents-md.js';
+import { inspectCodexProject } from './codex.js';
+import { inspectContinueProject } from './continue.js';
+import { inspectCopilotSettings } from './copilot.js';
+import { inspectCursorMcp } from './cursor.js';
+import { inspectGooseProject } from './goose.js';
+import { inspectMcpServersFile, mcpWiringState } from './mcp.js';
+import { inspectZedSettings } from './zed.js';
+const MCP_REQUIRED = new Set([
+    'cursor',
+    'claude-code',
+    'windsurf',
+    'cline',
+    'zed',
+    'jetbrains',
+    'copilot',
+    'continue',
+    'codex',
+    'goose',
+]);
+const NOT_OOTB = new Set(['continue', 'goose']);
+function inspectPrimaryMcp(root, hostId, options) {
+    switch (hostId) {
+        case 'cursor':
+            return inspectCursorMcp(root, options);
+        case 'claude-code':
+            return inspectMcpServersFile(join(root, '.mcp.json'), '.mcp.json', options);
+        case 'windsurf':
+            return inspectMcpServersFile(join(root, '.windsurf', 'mcp_config.json'), '.windsurf/mcp_config.json', options);
+        case 'cline':
+            return inspectMcpServersFile(join(root, '.cline', 'mcp_settings.json'), '.cline/mcp_settings.json', options);
+        case 'zed':
+            return inspectZedSettings(root, options);
+        case 'jetbrains':
+            return inspectMcpServersFile(join(root, '.idea', 'mcp.json'), '.idea/mcp.json', options);
+        case 'copilot':
+            return inspectCopilotSettings(root, options);
+        case 'continue':
+            return inspectContinueProject(root);
+        case 'codex':
+            return inspectCodexProject(root);
+        case 'goose':
+            return inspectGooseProject(root);
+        default:
+            return undefined;
+    }
+}
+export function inspectPrimaryHostWiring(root, hostId, options = {}) {
+    const instructions = inspectAgentsMd(root).instructions;
+    const mcpRequired = MCP_REQUIRED.has(hostId);
+    const notOotb = NOT_OOTB.has(hostId);
+    if (hostId === 'aider') {
+        const aider = inspectAiderConf(root);
+        return {
+            wiring: { mcp: 'ok', instructions },
+            mcpRequired: false,
+            notOotb: false,
+            aiderUnsafe: !aider.wired,
+            message: aider.message,
+        };
+    }
+    if (!mcpRequired) {
+        return {
+            wiring: { mcp: 'ok', instructions },
+            mcpRequired: false,
+            notOotb: false,
+            aiderUnsafe: false,
+            message: instructions === 'ok'
+                ? 'Layer 1 instructions present (AGENTS.md).'
+                : 'AGENTS.md is missing the envseal imperative (never read .env; use envseal ensure / envseal run). Run `envseal init`.',
+        };
+    }
+    const inspection = inspectPrimaryMcp(root, hostId, options) ?? {
+        wired: false,
+        status: 'missing',
+        commandOk: null,
+        message: `No project MCP config for host ${hostId}. Run \`envseal init\`.`,
+    };
+    return {
+        wiring: {
+            mcp: mcpWiringState(inspection),
+            instructions,
+        },
+        mcp: inspection,
+        mcpRequired: true,
+        notOotb,
+        aiderUnsafe: false,
+        message: inspection.message,
+    };
+}
+export function wiringFailsDoctor(inspection) {
+    if (inspection.mcpRequired && inspection.wiring.mcp !== 'ok')
+        return true;
+    if (inspection.wiring.instructions === 'missing')
+        return true;
+    if (inspection.aiderUnsafe)
+        return true;
+    return false;
+}
+//# sourceMappingURL=inspect.js.map

package/dist/host-wiring/mcp.d.ts

@@ -0,0 +1,55 @@
+export declare const ENVSEAL_MCP_PACKAGE = "@envseal/mcp-server";
+export declare const ENVSEAL_MCP_SERVER_NAME = "envseal-mcp";
+export declare const NPX_ARGS: readonly ["-y", "@envseal/mcp-server"];
+export type McpLaunch = {
+    command: string;
+    args: string[];
+};
+export type McpWriteAction = 'created' | 'merged' | 'unchanged' | 'skipped';
+export type McpStatus = 'absent' | 'unreadable' | 'missing' | 'stub' | 'wired';
+export type McpInspection = {
+    wired: boolean;
+    status: McpStatus;
+    message: string;
+    /** null when the launch command was not probed (npx is not side-effect free). */
+    commandOk: boolean | null;
+};
+/**
+ * Launch argv a host can spawn without a global `envseal-mcp` on PATH.
+ * Project MCP uses the workspace as cwd — never bake `--project` in.
+ */
+export declare function mcpLaunch(platform?: NodeJS.Platform): McpLaunch;
+export declare function mcpSnippetJson(platform?: NodeJS.Platform): string;
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+export declare function argsList(value: unknown): string[] | undefined;
+/** Old shipped stub: `envseal-mcp` with no args. Host launchers do not search node_modules/.bin. */
+export declare function isEmptyEnvsealStub(entry: unknown): boolean;
+/** Our npx snippet, either platform variant, and nothing else in command/args. */
+export declare function isStockNpxLaunch(entry: unknown): boolean;
+/** True when an entry would actually start @envseal/mcp-server (npx or a non-empty command). */
+export declare function looksLikeEnvsealServer(entry: unknown): boolean;
+export declare function nextEnvsealEntry(current: unknown, launch: McpLaunch): McpLaunch | Record<string, unknown> | null;
+export declare function parseJsonObject(text: string): Record<string, unknown> | null;
+export declare function writeJson(path: string, value: unknown): void;
+/**
+ * Merge envseal-mcp into a file whose top-level key is `mcpServers`.
+ * Never writes user-global configs; the caller passes a project path.
+ */
+export declare function mergeMcpServersFile(path: string, platform?: NodeJS.Platform): {
+    action: McpWriteAction;
+    path: string;
+};
+export declare function classifyEntry(entry: unknown): 'missing' | 'stub' | 'wired';
+/**
+ * `--version` is side-effect free on the envseal-mcp binary. `npx -y` is not
+ * (it may hit the network), so the default snippet is not probed.
+ */
+export declare function shouldProbeLaunch(entry: Record<string, unknown>): boolean;
+export declare function probeVersion(entry: Record<string, unknown>): boolean | null;
+export declare function inspectMcpServersFile(path: string, label: string, options?: {
+    probe?: boolean;
+    platform?: NodeJS.Platform;
+}): McpInspection;
+/** Map an inspection to the doctor `agentWiring.mcp` field. */
+export declare function mcpWiringState(inspection: McpInspection): 'ok' | 'missing' | 'spawn_failed';
+//# sourceMappingURL=mcp.d.ts.map

package/dist/host-wiring/mcp.js

@@ -0,0 +1,238 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { spawnSync } from 'node:child_process';
+export const ENVSEAL_MCP_PACKAGE = '@envseal/mcp-server';
+export const ENVSEAL_MCP_SERVER_NAME = 'envseal-mcp';
+export const NPX_ARGS = ['-y', ENVSEAL_MCP_PACKAGE];
+/**
+ * Launch argv a host can spawn without a global `envseal-mcp` on PATH.
+ * Project MCP uses the workspace as cwd — never bake `--project` in.
+ */
+export function mcpLaunch(platform = process.platform) {
+    return {
+        command: platform === 'win32' ? 'npx.cmd' : 'npx',
+        args: [...NPX_ARGS],
+    };
+}
+export function mcpSnippetJson(platform = process.platform) {
+    const launch = mcpLaunch(platform);
+    return JSON.stringify({
+        mcpServers: { [ENVSEAL_MCP_SERVER_NAME]: launch },
+    });
+}
+export function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+export function argsList(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.some((item) => typeof item !== 'string'))
+        return undefined;
+    return value;
+}
+/** Old shipped stub: `envseal-mcp` with no args. Host launchers do not search node_modules/.bin. */
+export function isEmptyEnvsealStub(entry) {
+    if (!isRecord(entry))
+        return true;
+    const command = entry.command;
+    if (typeof command !== 'string' || command.trim() === '')
+        return true;
+    if (command !== 'envseal-mcp')
+        return false;
+    const args = argsList(entry.args);
+    return args === undefined || args.length === 0;
+}
+/** Our npx snippet, either platform variant, and nothing else in command/args. */
+export function isStockNpxLaunch(entry) {
+    if (!isRecord(entry))
+        return false;
+    const command = entry.command;
+    if (command !== 'npx' && command !== 'npx.cmd')
+        return false;
+    const args = argsList(entry.args);
+    return (args !== undefined && args.length === NPX_ARGS.length && NPX_ARGS.every((a, i) => a === args[i]));
+}
+/** True when an entry would actually start @envseal/mcp-server (npx or a non-empty command). */
+export function looksLikeEnvsealServer(entry) {
+    if (entry === undefined || isEmptyEnvsealStub(entry))
+        return false;
+    if (!isRecord(entry))
+        return false;
+    const command = entry.command;
+    if (typeof command !== 'string' || command.trim() === '')
+        return false;
+    if (isStockNpxLaunch(entry))
+        return true;
+    const joined = `${command} ${(argsList(entry.args) ?? []).join(' ')}`;
+    return /@envseal\/mcp-server|envseal-mcp/i.test(joined);
+}
+export function nextEnvsealEntry(current, launch) {
+    if (current === undefined || isEmptyEnvsealStub(current)) {
+        return launch;
+    }
+    if (isStockNpxLaunch(current) && isRecord(current)) {
+        if (current.command === launch.command)
+            return null;
+        return { ...current, command: launch.command, args: launch.args };
+    }
+    return null;
+}
+export function parseJsonObject(text) {
+    try {
+        const parsed = JSON.parse(text);
+        return isRecord(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function writeJson(path, value) {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`, 'utf8');
+}
+/**
+ * Merge envseal-mcp into a file whose top-level key is `mcpServers`.
+ * Never writes user-global configs; the caller passes a project path.
+ */
+export function mergeMcpServersFile(path, platform = process.platform) {
+    const launch = mcpLaunch(platform);
+    if (!existsSync(path)) {
+        writeJson(path, { mcpServers: { [ENVSEAL_MCP_SERVER_NAME]: launch } });
+        return { action: 'created', path };
+    }
+    const parsed = parseJsonObject(readFileSync(path, 'utf8'));
+    if (parsed === null) {
+        return { action: 'skipped', path };
+    }
+    const existingServers = parsed.mcpServers;
+    if (existingServers !== undefined && !isRecord(existingServers)) {
+        return { action: 'skipped', path };
+    }
+    const servers = existingServers === undefined ? {} : { ...existingServers };
+    const next = nextEnvsealEntry(servers[ENVSEAL_MCP_SERVER_NAME], launch);
+    if (next === null) {
+        return { action: 'unchanged', path };
+    }
+    servers[ENVSEAL_MCP_SERVER_NAME] = next;
+    writeJson(path, { ...parsed, mcpServers: servers });
+    return { action: 'merged', path };
+}
+export function classifyEntry(entry) {
+    if (entry === undefined)
+        return 'missing';
+    if (isEmptyEnvsealStub(entry))
+        return 'stub';
+    if (!isRecord(entry))
+        return 'stub';
+    const command = entry.command;
+    if (typeof command !== 'string' || command.trim() === '')
+        return 'stub';
+    return 'wired';
+}
+/**
+ * `--version` is side-effect free on the envseal-mcp binary. `npx -y` is not
+ * (it may hit the network), so the default snippet is not probed.
+ */
+export function shouldProbeLaunch(entry) {
+    const command = entry.command;
+    if (typeof command !== 'string')
+        return false;
+    if (command === 'npx' || command === 'npx.cmd')
+        return false;
+    return true;
+}
+export function probeVersion(entry) {
+    if (!shouldProbeLaunch(entry))
+        return null;
+    const command = entry.command;
+    if (typeof command !== 'string')
+        return null;
+    const args = argsList(entry.args) ?? [];
+    const result = spawnSync(command, [...args, '--version'], {
+        encoding: 'utf8',
+        timeout: 5000,
+        windowsHide: true,
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    if (result.error)
+        return false;
+    if (result.status !== 0)
+        return false;
+    const out = `${result.stdout ?? ''}${result.stderr ?? ''}`;
+    return /envseal-mcp/i.test(out);
+}
+function initHint(platform, label) {
+    return `Run \`envseal init\` to write it, or merge ${mcpSnippetJson(platform)} into ${label}.`;
+}
+export function inspectMcpServersFile(path, label, options = {}) {
+    const platform = options.platform ?? process.platform;
+    const hint = initHint(platform, label);
+    if (!existsSync(path)) {
+        return {
+            wired: false,
+            status: 'absent',
+            commandOk: null,
+            message: `${label} is missing. ${hint}`,
+        };
+    }
+    const parsed = parseJsonObject(readFileSync(path, 'utf8'));
+    if (parsed === null) {
+        return {
+            wired: false,
+            status: 'unreadable',
+            commandOk: null,
+            message: `${label} is not valid JSON. ${hint}`,
+        };
+    }
+    const servers = parsed.mcpServers;
+    if (servers === undefined || (isRecord(servers) && Object.keys(servers).length === 0)) {
+        return {
+            wired: false,
+            status: 'missing',
+            commandOk: null,
+            message: `${label} has no envseal-mcp (empty mcpServers). ${hint}`,
+        };
+    }
+    if (!isRecord(servers)) {
+        return {
+            wired: false,
+            status: 'unreadable',
+            commandOk: null,
+            message: `${label} mcpServers is not an object. ${hint}`,
+        };
+    }
+    const entry = servers[ENVSEAL_MCP_SERVER_NAME];
+    const kind = classifyEntry(entry);
+    if (kind === 'missing') {
+        return {
+            wired: false,
+            status: 'missing',
+            commandOk: null,
+            message: `${label} has no envseal-mcp. ${hint}`,
+        };
+    }
+    if (kind === 'stub') {
+        return {
+            wired: false,
+            status: 'stub',
+            commandOk: null,
+            message: `${label} envseal-mcp is the empty envseal-mcp stub (not on PATH for the host). ${hint}`,
+        };
+    }
+    const rec = entry;
+    const commandOk = options.probe === true ? probeVersion(rec) : null;
+    let message = `MCP is wired (${label}).`;
+    if (commandOk === false) {
+        message = `MCP is configured in ${label}, but the launch command did not report a version. Run \`envseal init\` if the host cannot connect.`;
+    }
+    return { wired: true, status: 'wired', commandOk, message };
+}
+/** Map an inspection to the doctor `agentWiring.mcp` field. */
+export function mcpWiringState(inspection) {
+    if (inspection.commandOk === false)
+        return 'spawn_failed';
+    if (inspection.wired)
+        return 'ok';
+    return 'missing';
+}
+//# sourceMappingURL=mcp.js.map

package/dist/host-wiring/zed.d.ts

@@ -0,0 +1,10 @@
+import { type McpInspection, type McpWriteAction } from './mcp.js';
+export declare function mergeZedSettings(root: string, platform?: NodeJS.Platform): {
+    action: McpWriteAction;
+    path: string;
+};
+export declare function inspectZedSettings(root: string, options?: {
+    probe?: boolean;
+    platform?: NodeJS.Platform;
+}): McpInspection;
+//# sourceMappingURL=zed.d.ts.map