@gajae-code/coding-agent 0.7.10 → 0.8.0

package/src/defaults/gjc/skills/ralplan/SKILL.md

@@ -45,13 +45,15 @@ Planning artifacts and stage handoffs MUST be persisted through the ralplan CLI
 
 ```bash
 gjc ralplan --write --stage <type> --stage_n <N> --artifact "markdown file path or markdown string"
+# restricted role agents use:
+gjc ralplan --write --stage <type> --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT
 ```
 
-Use stage values that match the producer or artifact kind, such as `planner`, `architect`, `critic`, `revision`, `post-interview`, `adr`, or `final`. Increment `--stage_n` for each consensus-loop pass. The `--artifact` value may be either a markdown file path prepared outside `.gjc/` for ingestion or the markdown content string itself. The native `--write` handler persists markdown under `.gjc/_session-{sessionid}/plans/ralplan/<run-id>/stage-<NN>-<stage>.md`, maintains an `index.jsonl` audit log, and for `final` stages additionally writes a `pending-approval.md` copy. Direct `write`, `edit`, or `ast_edit` calls against `.gjc/_session-{sessionid}/specs`, `.gjc/_session-{sessionid}/plans`, `.gjc/_session-{sessionid}/state`, or any other `.gjc/` path are forbidden unless an explicit force override is active.
+Use stage values that match the producer or artifact kind, such as `planner`, `architect`, `critic`, `revision`, `post-interview`, `adr`, or `final`. Increment `--stage_n` for each consensus-loop pass. The `--artifact` value may be either a markdown file path prepared outside `.gjc/` for ingestion or the markdown content string itself. The native `--write` handler also accepts `--artifact-env GJC_RALPLAN_ARTIFACT` to read markdown from that per-command env override. It persists markdown under `.gjc/_session-{sessionid}/plans/ralplan/<run-id>/stage-<NN>-<stage>.md`, maintains an `index.jsonl` audit log, and for `final` stages additionally writes a `pending-approval.md` copy. Direct `write`, `edit`, or `ast_edit` calls against `.gjc/_session-{sessionid}/specs`, `.gjc/_session-{sessionid}/plans`, `.gjc/_session-{sessionid}/state`, or any other `.gjc/` path are forbidden unless an explicit force override is active.
 
-While ralplan is active it is a pre-approval planning phase: product-code mutation tools (`write`/`edit`/`ast_edit`) and product-mutating `bash` (e.g. `tee src/...`, redirects into the project tree) are blocked, exactly like deep-interview. Prefer passing the `--artifact` markdown **inline** (the content string) so no scratch file is needed; this is mandatory for restricted role agents (see below). Only the leader, and only when an artifact is too large to pass inline, may stage it as a file in a system temp directory (`os.tmpdir()`/`$TMPDIR`, `/tmp`, `/var/tmp`) outside the project tree and pass that path — never write scratch files into the repo or `.gjc/`. Product code is mutated only after the plan is approved and execution begins.
+While ralplan is active it is a pre-approval planning phase: product-code mutation tools (`write`/`edit`/`ast_edit`) and product-mutating `bash` (e.g. `tee src/...`, redirects into the project tree) are blocked, exactly like deep-interview. Leaders may pass `--artifact` markdown inline or, when an artifact is too large to pass inline, stage it as a file in a system temp directory (`os.tmpdir()`/`$TMPDIR`, `/tmp`, `/var/tmp`) outside the project tree and pass that path — never write scratch files into the repo or `.gjc/`. Product code is mutated only after the plan is approved and execution begins.
 
-Restricted read-only role agents (`planner`, `architect`, and `critic`) must pass markdown content directly in `--artifact`; their restricted bash environment intentionally disables artifact file-path ingestion so a verdict command cannot persist arbitrary file contents.
+Restricted read-only role agents (`planner`, `architect`, and `critic`) must pass markdown content through the `GJC_RALPLAN_ARTIFACT` env override with `--artifact-env GJC_RALPLAN_ARTIFACT`; their restricted bash environment intentionally disables artifact file-path ingestion so a verdict command cannot persist arbitrary file contents.
 
 After a role agent persists a stage artifact, its model-facing response to the caller SHOULD be receipt-only: return the `gjc ralplan --write --json` receipt (`run_id`, `path`, `stage`, `stage_n`, `sha256`, `created_at`) plus the minimal verdict/status fields the caller needs for routing, and do **not** paste the full persisted markdown back into the parent conversation. Downstream reviewers should receive the artifact path/receipt and read the persisted file themselves when they actually need the body. This preserves the audit trail while preventing Planner/Architect/Critic verdict bodies from being duplicated into the main-agent context.
 
@@ -60,7 +62,7 @@ RECEIPT-ONLY guideline: role agents (`planner`, `architect`, and `critic`) persi
 This skill runs GJC planning in consensus mode for the provided arguments.
 
 The consensus workflow:
-1. **Planner** creates the initial plan and a compact **RALPLAN-DR summary** before review. Launch the Planner ONCE per run as a detached, resumable subagent (await it before the Architect) and record its returned subagent id as the run's persisted Planner id; persist the stage with `gjc ralplan --write --stage planner --stage_n 1 --artifact "..." --planner-id <id> --planner-resumable <true|false>` (see **Persisted Planner** below):
+1. **Planner** creates the initial plan and a compact **RALPLAN-DR summary** before review. Launch the Planner ONCE per run as a detached, resumable subagent (await it before the Architect) and record its returned subagent id as the run's persisted Planner id; persist the stage with `gjc ralplan --write --stage planner --stage_n 1 --artifact-env GJC_RALPLAN_ARTIFACT --planner-id <id> --planner-resumable <true|false>` (see **Persisted Planner** below):
    - After persistence, return only the receipt/path plus compact planning status; do not paste the full plan markdown back to the caller unless explicitly requested.
    - Principles (3-5)
    - Decision Drivers (top 3)
@@ -69,26 +71,26 @@ The consensus workflow:
    - Deliberate mode only: pre-mortem (3 scenarios) + expanded test plan (unit/integration/e2e/observability)
 2. **User feedback** *(--interactive only)*: If `--interactive` is set, use the `ask` tool to present the draft plan **plus the Principles / Drivers / Options summary** before review (Proceed to review / Request changes / Skip review). Otherwise, automatically proceed to review.
 3. **Architect** reviews for architectural soundness and must provide the strongest steelman antithesis, at least one real tradeoff tension, and (when possible) synthesis — **await completion before step 4**. In deliberate mode, Architect should explicitly flag principle violations.
-   - The Architect agent/subagent must persist its review with `gjc ralplan --write --stage architect --stage_n <N> --artifact "..." --json`, then return the receipt/path plus compact verdict/status (`CLEAR`/`WATCH`/`BLOCK`, `APPROVE`/`COMMENT`/`REQUEST CHANGES`) instead of pasting the full review body.
+   - The Architect agent/subagent must persist its review with `gjc ralplan --write --stage architect --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT --json`, then return the receipt/path plus compact verdict/status (`CLEAR`/`WATCH`/`BLOCK`, `APPROVE`/`COMMENT`/`REQUEST CHANGES`) instead of pasting the full review body.
 4. **Critic** evaluates against quality criteria — run only after step 3 completes. Critic must enforce principle-option consistency, fair alternatives, risk mitigation clarity, testable acceptance criteria, and concrete verification steps. In deliberate mode, Critic must reject missing/weak pre-mortem or expanded test plan.
-   - The Critic agent/subagent must persist its evaluation with `gjc ralplan --write --stage critic --stage_n <N> --artifact "..." --json`, then return the receipt/path plus compact verdict/status (`OKAY`/`ITERATE`/`REJECT`) instead of pasting the full evaluation body.
-5. **Re-review loop** (max 5 iterations): Any non-`APPROVE` Critic verdict (`ITERATE` or `REJECT`) MUST run the same full closed loop:
+   - The Critic agent/subagent must persist its evaluation with `gjc ralplan --write --stage critic --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT --json`, then return the receipt/path plus compact verdict/status (`OKAY`/`ITERATE`/`REJECT`) instead of pasting the full evaluation body.
+5. **Re-review loop** (max 5 iterations): Any non-`OKAY` Critic verdict (`ITERATE` or `REJECT`) MUST run the same full closed loop:
    a. Collect Architect + Critic feedback
    b. Revise the plan by resuming the SAME persisted Planner subagent with consolidated Architect + Critic feedback (see **Persisted Planner** below); fall back to a fresh Planner spawn only per the fallback routing table
    c. Return to Architect review
-      - Persist each Planner revision with `gjc ralplan --write --stage revision --stage_n <N> --artifact "..." --json` before re-review, then pass the receipt/path forward instead of duplicating the full revision markdown in the parent conversation.
+      - Persist each Planner revision with `gjc ralplan --write --stage revision --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT --json` before re-review, then pass the receipt/path forward instead of duplicating the full revision markdown in the parent conversation.
    d. Return to Critic evaluation
-   e. Repeat this loop until Critic returns `APPROVE` or 5 iterations are reached
-   f. If 5 iterations are reached without `APPROVE`, present the best version to the user
-6. **Post-ralplan interview** (intent reconciliation gate): After Critic returns `APPROVE` and before the plan is finalized, reconcile the consensus plan against the user's actual intent. The goal is to make sure ralplan did not silently bake in assumptions that conflict with what the user wants.
+   e. Repeat this loop until Critic returns `OKAY` or 5 iterations are reached
+   f. If 5 iterations are reached without `OKAY`, present the best version to the user
+6. **Post-ralplan interview** (intent reconciliation gate): After Critic returns `OKAY` and before the plan is finalized, reconcile the consensus plan against the user's actual intent. The goal is to make sure ralplan did not silently bake in assumptions that conflict with what the user wants.
    a. **Collect open items** from the run: every assumption the Planner/Architect/Critic resolved by assumption rather than by stated fact, every ambiguity flagged during review, and every decision the loop made without explicit user input. Source these from the persisted `planner`/`architect`/`critic`/`revision` stage artifacts, not from memory.
    b. **Cross-check prior context for conflicts**: glob `.gjc/_session-{sessionid}/specs/deep-interview-*.md` and other prior specs/plans/context relevant by topic. For each, list points where the consensus plan contradicts, weakens, or expands beyond a previously crystallized decision, constraint, or non-goal. Cite the conflicting artifact and line/section.
    c. **Reconcile with the user via the `ask` tool (always, regardless of `--interactive`)**: Never stop idle with plain-text prose after the consensus loop. Every reconciliation question MUST go through the `ask` tool with contextual options plus free-text.
       - If open items exist, confirm the open assumptions and conflicts **one at a time** with the `ask` tool, weakest/highest-impact first, polishing intent. If any confirmation reveals that the plan diverges from user intent, route the consolidated correction back into the re-review loop (step 5b Planner revision) and re-run Architect + Critic before returning here. Cap at the same 5-iteration ceiling.
       - If the plan is crystal clear (no open assumptions or prior-context conflicts), skip straight to the step 8 final-options `ask` instead of inventing filler questions.
       - For every confirmed open item, embed the resolved outcome into the final plan under an **## Intent Reconciliation** section so the `pending approval` artifact records each decision; record any item the user explicitly defers as an open confirmation under that same section.
-   d. Persist the reconciliation with `gjc ralplan --write --stage post-interview --stage_n <N> --artifact "..." --json`, then return the receipt/path plus a compact status (reconciled-clean / reconciled-with-revision / open-confirmations-pending) instead of pasting the full body.
-7. On reconciliation completion, mark the plan `pending approval` unless explicit execution approval has already been captured, persist the ADR/final plan via `gjc ralplan --write --stage final --stage_n <N> --artifact "..."`, and do not directly edit `.gjc/_session-{sessionid}/plans`. Final plan must include ADR (Decision, Drivers, Alternatives considered, Why chosen, Consequences, Follow-ups) and, when present, the **## Intent Reconciliation** section.
+   d. Persist the reconciliation with `gjc ralplan --write --stage post-interview --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT --json`, then return the receipt/path plus a compact status (reconciled-clean / reconciled-with-revision / open-confirmations-pending) instead of pasting the full body.
+7. On reconciliation completion, mark the plan `pending approval` unless explicit execution approval has already been captured, persist the ADR/final plan via `gjc ralplan --write --stage final --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT`, and do not directly edit `.gjc/_session-{sessionid}/plans`. Final plan must include ADR (Decision, Drivers, Alternatives considered, Why chosen, Consequences, Follow-ups) and, when present, the **## Intent Reconciliation** section.
 8. **Always** present the finalized plan via the `ask` tool (regardless of `--interactive`) with `workflowGate: { stage: "ralplan", kind: "approval" }` on the final question so RPC/headless clients receive a `ralplan`/`approval` workflow gate, not a deep-interview question gate. Use these options:
    - **Refine further** — re-run the consensus loop / request changes, then return here
    - **Approve execution via ultragoal (Recommended)** — goal-tracked autonomous execution
@@ -128,7 +130,7 @@ The Planner is a **same-session persisted subagent**: launched detached once, aw
 **Recording persisted-Planner metadata** (audit/routing only — never claim `subagent list` proves resumability, since the snapshot does not expose `resumable`). Ride these optional flags on the normal `--write` for the planner/revision stage of the pass:
 
 ```
-gjc ralplan --write --stage revision --stage_n <N> --artifact "..." \
+gjc ralplan --write --stage revision --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT \
   --planner-id <id> --planner-resumable <true|false> \
   --fallback-reason <context_unavailable|not_found|no_runner|resume_failed|process_restart|missing_record> \
   --fallback-attempted-id <id> --fallback-stage-n <N> \

package/src/defaults/gjc-defaults.ts

@@ -44,6 +44,13 @@ export type DefaultGjcDefinition = DefaultGjcSkillDefinition | DefaultGjcSkillFr
 export interface InstallDefaultGjcDefinitionsOptions {
 	check?: boolean;
 	force?: boolean;
+	/**
+	 * Only rewrite default definition files that already exist on disk but whose
+	 * content differs from the embedded defaults. Files that are absent are left
+	 * absent (status "missing"). Used by `gjc update` to refresh opted-in copies
+	 * without materializing new on-disk copies for users who never installed them.
+	 */
+	refreshOnly?: boolean;
 	targetRoot?: string;
 }
 
@@ -160,6 +167,15 @@ export async function installDefaultGjcDefinitions(
 
 		if (options.check) {
 			status = existing === undefined ? "missing" : existing === definition.content ? "matching" : "different";
+		} else if (options.refreshOnly) {
+			if (existing === undefined) {
+				status = "missing";
+			} else if (existing === definition.content) {
+				status = "matching";
+			} else {
+				await Bun.write(destination, definition.content);
+				status = "written";
+			}
 		} else if (existing !== undefined && !options.force) {
 			status = "skipped";
 		} else {

package/src/discovery/builtin.ts

@@ -165,9 +165,21 @@ async function loadMCPServers(ctx: LoadContext): Promise<LoadResult<MCPServer>>
 				timeout = undefined;
 			}
 
+			// Validate autoload: boolean only, warn on other types
+			let autoload: boolean | undefined;
+			if (serverConfig.autoload === undefined || serverConfig.autoload === null) {
+				autoload = undefined;
+			} else if (typeof serverConfig.autoload === "boolean") {
+				autoload = serverConfig.autoload;
+			} else {
+				logger.warn(`MCP server "${serverName}": invalid autoload type ${typeof serverConfig.autoload}, ignoring`);
+				autoload = undefined;
+			}
+
 			result.push({
 				name: serverName,
 				enabled,
+				autoload,
 				timeout,
 				command: serverConfig.command as string | undefined,
 				args: serverConfig.args as string[] | undefined,

package/src/discovery/cursor.ts

@@ -9,99 +9,28 @@
  * - Project: .cursor/ (cwd only)
  *
  * Capabilities:
- * - mcps: From mcp.json with mcpServers key
  * - rules: From rules/*.mdc files with MDC frontmatter (description, globs, alwaysApply)
  * - settings: From settings.json if present
+ *
+ * MCP servers are intentionally NOT inherited live from Cursor config: GJC owns
+ * MCP runtime execution. Use `gjc mcp import cursor` to copy definitions into
+ * GJC's own mcp.json instead.
  */
 
 import { tryParseJson } from "@gajae-code/utils";
 import { registerProvider } from "../capability";
 import { readFile } from "../capability/fs";
-import { type MCPServer, mcpCapability } from "../capability/mcp";
 import type { Rule } from "../capability/rule";
 import { ruleCapability } from "../capability/rule";
 import type { Settings } from "../capability/settings";
 import { settingsCapability } from "../capability/settings";
 import type { LoadContext, LoadResult, SourceMeta } from "../capability/types";
-import {
-	buildRuleFromMarkdown,
-	createSourceMeta,
-	expandEnvVarsDeep,
-	getProjectPath,
-	getUserPath,
-	loadFilesFromDir,
-} from "./helpers";
+import { buildRuleFromMarkdown, createSourceMeta, getProjectPath, getUserPath, loadFilesFromDir } from "./helpers";
 
 const PROVIDER_ID = "cursor";
 const DISPLAY_NAME = "Cursor";
 const PRIORITY = 50;
 
-// =============================================================================
-// MCP Servers
-// =============================================================================
-
-function parseMCPServers(
-	content: string,
-	path: string,
-	level: "user" | "project",
-): { items: MCPServer[]; warning?: string } {
-	const items: MCPServer[] = [];
-
-	const parsed = tryParseJson<{ mcpServers?: Record<string, unknown> }>(content);
-	if (!parsed?.mcpServers) {
-		return { items, warning: `${path}: missing or invalid 'mcpServers' key` };
-	}
-
-	const servers = expandEnvVarsDeep(parsed.mcpServers);
-	for (const [name, config] of Object.entries(servers)) {
-		const serverConfig = config as Record<string, unknown>;
-		items.push({
-			name,
-			command: serverConfig.command as string | undefined,
-			args: serverConfig.args as string[] | undefined,
-			env: serverConfig.env as Record<string, string> | undefined,
-			url: serverConfig.url as string | undefined,
-			headers: serverConfig.headers as Record<string, string> | undefined,
-			transport: ["stdio", "sse", "http"].includes(serverConfig.type as string)
-				? (serverConfig.type as "stdio" | "sse" | "http")
-				: undefined,
-			timeout: typeof serverConfig.timeout === "number" ? serverConfig.timeout : undefined,
-			_source: createSourceMeta(PROVIDER_ID, path, level),
-		});
-	}
-
-	return { items };
-}
-
-async function loadMCPServers(ctx: LoadContext): Promise<LoadResult<MCPServer>> {
-	const items: MCPServer[] = [];
-	const warnings: string[] = [];
-
-	const userPath = getUserPath(ctx, "cursor", "mcp.json");
-
-	const [userContent, projectPath] = await Promise.all([
-		userPath ? readFile(userPath) : Promise.resolve(null),
-		getProjectPath(ctx, "cursor", "mcp.json"),
-	]);
-
-	const projectContentPromise = projectPath ? readFile(projectPath) : Promise.resolve(null);
-
-	if (userContent && userPath) {
-		const result = parseMCPServers(userContent, userPath, "user");
-		items.push(...result.items);
-		if (result.warning) warnings.push(result.warning);
-	}
-
-	const projectContent = await projectContentPromise;
-	if (projectContent && projectPath) {
-		const result = parseMCPServers(projectContent, projectPath, "project");
-		items.push(...result.items);
-		if (result.warning) warnings.push(result.warning);
-	}
-
-	return { items, warnings };
-}
-
 // =============================================================================
 // Rules
 // =============================================================================
@@ -195,14 +124,6 @@ async function loadSettings(ctx: LoadContext): Promise<LoadResult<Settings>> {
 // Provider Registration
 // =============================================================================
 
-registerProvider(mcpCapability.id, {
-	id: PROVIDER_ID,
-	displayName: DISPLAY_NAME,
-	description: "Load MCP servers from ~/.cursor/mcp.json and .cursor/mcp.json",
-	priority: PRIORITY,
-	load: loadMCPServers,
-});
-
 registerProvider(ruleCapability.id, {
 	id: PROVIDER_ID,
 	displayName: DISPLAY_NAME,

package/src/discovery/gemini.ts

@@ -9,11 +9,13 @@
  * - Project: .gemini/ (cwd only)
  *
  * Capabilities:
- * - mcps: From settings.json with mcpServers key
  * - context-files: GEMINI.md files
  * - system-prompt: system.md files for custom system prompt
  * - extensions: From extensions/STAR/gemini-extension.json manifests (STAR = wildcard)
  * - settings: From settings.json
+ *
+ * MCP servers are intentionally NOT inherited live from Gemini config: GJC owns
+ * MCP runtime execution. Copy definitions into GJC's own mcp.json instead.
  */
 import * as path from "node:path";
 import { tryParseJson } from "@gajae-code/utils";
@@ -22,7 +24,6 @@ import { type ContextFile, contextFileCapability } from "../capability/context-f
 import { type Extension, type ExtensionManifest, extensionCapability } from "../capability/extension";
 import { type ExtensionModule, extensionModuleCapability } from "../capability/extension-module";
 import { readDirEntries, readFile } from "../capability/fs";
-import { type MCPServer, mcpCapability } from "../capability/mcp";
 import { type Settings, settingsCapability } from "../capability/settings";
 import { type SystemPrompt, systemPromptCapability } from "../capability/system-prompt";
 import type { LoadContext, LoadResult } from "../capability/types";
@@ -31,7 +32,6 @@ import {
 	calculateDepth,
 	createSourceMeta,
 	discoverExtensionModulePaths,
-	expandEnvVarsDeep,
 	getProjectPath,
 	getUserPath,
 } from "./helpers";
@@ -40,84 +40,6 @@ const PROVIDER_ID = "gemini";
 const DISPLAY_NAME = "Gemini CLI";
 const PRIORITY = 60;
 
-// =============================================================================
-// MCP Servers
-// =============================================================================
-
-async function loadMCPServers(ctx: LoadContext): Promise<LoadResult<MCPServer>> {
-	const items: MCPServer[] = [];
-	const warnings: string[] = [];
-
-	// User-level: ~/.gemini/settings.json → mcpServers
-	const userPath = getUserPath(ctx, "gemini", "settings.json");
-	if (userPath) {
-		const result = await loadMCPFromSettings(ctx, userPath, "user");
-		items.push(...result.items);
-		if (result.warnings) warnings.push(...result.warnings);
-	}
-
-	// Project-level: .gemini/settings.json → mcpServers
-	const projectPath = getProjectPath(ctx, "gemini", "settings.json");
-	if (projectPath) {
-		const result = await loadMCPFromSettings(ctx, projectPath, "project");
-		items.push(...result.items);
-		if (result.warnings) warnings.push(...result.warnings);
-	}
-
-	return { items, warnings };
-}
-
-async function loadMCPFromSettings(
-	_ctx: LoadContext,
-	path: string,
-	level: "user" | "project",
-): Promise<LoadResult<MCPServer>> {
-	const items: MCPServer[] = [];
-	const warnings: string[] = [];
-
-	const content = await readFile(path);
-	if (!content) {
-		return { items, warnings };
-	}
-
-	const parsed = tryParseJson<{ mcpServers?: Record<string, unknown> }>(content);
-	if (!parsed) {
-		warnings.push(`Invalid JSON in ${path}`);
-		return { items, warnings };
-	}
-
-	if (!parsed.mcpServers || typeof parsed.mcpServers !== "object") {
-		return { items, warnings };
-	}
-
-	const servers = expandEnvVarsDeep(parsed.mcpServers);
-
-	for (const [name, config] of Object.entries(servers)) {
-		if (!config || typeof config !== "object") {
-			warnings.push(`Invalid config for server "${name}" in ${path}`);
-			continue;
-		}
-
-		const raw = config as Record<string, unknown>;
-
-		items.push({
-			name,
-			command: typeof raw.command === "string" ? raw.command : undefined,
-			args: Array.isArray(raw.args) ? (raw.args as string[]) : undefined,
-			env: raw.env && typeof raw.env === "object" ? (raw.env as Record<string, string>) : undefined,
-			url: typeof raw.url === "string" ? raw.url : undefined,
-			headers: raw.headers && typeof raw.headers === "object" ? (raw.headers as Record<string, string>) : undefined,
-			transport: ["stdio", "sse", "http"].includes(raw.type as string)
-				? (raw.type as "stdio" | "sse" | "http")
-				: undefined,
-			timeout: typeof raw.timeout === "number" ? raw.timeout : undefined,
-			_source: createSourceMeta(PROVIDER_ID, path, level),
-		} as MCPServer);
-	}
-
-	return { items, warnings };
-}
-
 // =============================================================================
 // Context Files
 // =============================================================================
@@ -296,14 +218,6 @@ async function loadSettings(ctx: LoadContext): Promise<LoadResult<Settings>> {
 // Provider Registration
 // =============================================================================
 
-registerProvider(mcpCapability.id, {
-	id: PROVIDER_ID,
-	displayName: DISPLAY_NAME,
-	description: "Load MCP servers from ~/.gemini/settings.json and .gemini/settings.json",
-	priority: PRIORITY,
-	load: loadMCPServers,
-});
-
 registerProvider(contextFileCapability.id, {
 	id: PROVIDER_ID,
 	displayName: DISPLAY_NAME,

package/src/discovery/index.ts

@@ -30,7 +30,10 @@ import "./opencode";
 import "./github";
 import "./mcp-json";
 import "./ssh";
-import "./vscode";
+// NOTE: There is deliberately no VS Code provider and no MCP registration in
+// the cursor/gemini/opencode/windsurf providers: GJC does not inherit MCP
+// servers live from other hosts. MCP comes from GJC's own config (builtin,
+// mcp-json), validated plugin bundles, or an explicit `gjc mcp import <host>`.
 import "./windsurf";
 
 // Re-export the main API from capability registry

package/src/discovery/mcp-json.ts

@@ -25,6 +25,7 @@ interface MCPConfigFile {
 		string,
 		{
 			enabled?: boolean;
+			autoload?: boolean;
 			timeout?: number;
 			command?: string;
 			args?: string[];
@@ -82,9 +83,19 @@ function transformMCPConfig(config: MCPConfigFile, source: SourceMeta): MCPServe
 				}
 			}
 
+			let autoload: boolean | undefined;
+			if (serverConfig.autoload !== undefined) {
+				if (typeof serverConfig.autoload === "boolean") {
+					autoload = serverConfig.autoload;
+				} else {
+					logger.warn("MCP server has invalid 'autoload' value, ignoring", { name, value: serverConfig.autoload });
+				}
+			}
+
 			const server: MCPServer = {
 				name,
 				enabled,
+				autoload,
 				timeout,
 				command: serverConfig.command,
 				args: serverConfig.args,

package/src/discovery/opencode.ts

@@ -7,21 +7,23 @@
  *
  * Capabilities:
  * - context-files: AGENTS.md (user-level only at ~/.config/opencode/AGENTS.md)
- * - mcps: From opencode.json "mcp" key
  * - settings: From opencode.json
  * - skills: From skills/ subdirectories
  * - slash-commands: From commands/ subdirectories
  * - extension-modules: From plugins/ subdirectories
  *
+ * MCP servers are intentionally NOT inherited live from OpenCode config: GJC
+ * owns MCP runtime execution. Use `gjc mcp import opencode` to copy definitions
+ * into GJC's own mcp.json instead.
+ *
  * Priority: 55 (tool-specific provider)
  */
 import * as path from "node:path";
-import { logger, parseFrontmatter, tryParseJson } from "@gajae-code/utils";
+import { parseFrontmatter, tryParseJson } from "@gajae-code/utils";
 import { registerProvider } from "../capability";
 import { type ContextFile, contextFileCapability } from "../capability/context-file";
 import { type ExtensionModule, extensionModuleCapability } from "../capability/extension-module";
 import { readFile } from "../capability/fs";
-import { type MCPServer, mcpCapability } from "../capability/mcp";
 import { type Settings, settingsCapability } from "../capability/settings";
 import { type Skill, skillCapability } from "../capability/skill";
 import { type SlashCommand, slashCommandCapability } from "../capability/slash-command";
@@ -32,7 +34,6 @@ import {
 	buildExtensionModuleItems,
 	createSourceMeta,
 	discoverExtensionModulePaths,
-	expandEnvVarsDeep,
 	getProjectPath,
 	getUserPath,
 	loadFilesFromDir,
@@ -43,22 +44,6 @@ const PROVIDER_ID = "opencode";
 const DISPLAY_NAME = "OpenCode";
 const PRIORITY = 55;
 
-// =============================================================================
-// JSON Config Loading
-// =============================================================================
-
-async function loadJsonConfig(configPath: string): Promise<Record<string, unknown> | null> {
-	const content = await readFile(configPath);
-	if (!content) return null;
-
-	const parsed = tryParseJson<Record<string, unknown>>(content);
-	if (!parsed) {
-		logger.warn("Failed to parse OpenCode JSON config", { path: configPath });
-		return null;
-	}
-	return parsed;
-}
-
 // =============================================================================
 // Context Files (AGENTS.md)
 // =============================================================================
@@ -84,100 +69,6 @@ async function loadContextFiles(ctx: LoadContext): Promise<LoadResult<ContextFil
 	return { items, warnings };
 }
 
-// =============================================================================
-// MCP Servers (opencode.json → mcp)
-// =============================================================================
-
-/** OpenCode MCP server config (from opencode.json "mcp" key) */
-interface OpenCodeMCPConfig {
-	type?: "local" | "remote";
-	command?: string;
-	args?: string[];
-	env?: Record<string, string>;
-	url?: string;
-	headers?: Record<string, string>;
-	enabled?: boolean;
-	timeout?: number;
-}
-
-async function loadMCPServers(ctx: LoadContext): Promise<LoadResult<MCPServer>> {
-	const items: MCPServer[] = [];
-	const warnings: string[] = [];
-
-	// User-level: ~/.config/opencode/opencode.json
-	const userConfigPath = getUserPath(ctx, "opencode", "opencode.json");
-	if (userConfigPath) {
-		const config = await loadJsonConfig(userConfigPath);
-		if (config) {
-			const result = extractMCPServers(config, userConfigPath, "user");
-			items.push(...result.items);
-			if (result.warnings) warnings.push(...result.warnings);
-		}
-	}
-
-	// Project-level: opencode.json in project root
-	const projectConfigPath = path.join(ctx.cwd, "opencode.json");
-	const projectConfig = await loadJsonConfig(projectConfigPath);
-	if (projectConfig) {
-		const result = extractMCPServers(projectConfig, projectConfigPath, "project");
-		items.push(...result.items);
-		if (result.warnings) warnings.push(...result.warnings);
-	}
-
-	return { items, warnings };
-}
-
-function extractMCPServers(
-	config: Record<string, unknown>,
-	configPath: string,
-	level: "user" | "project",
-): LoadResult<MCPServer> {
-	const items: MCPServer[] = [];
-	const warnings: string[] = [];
-
-	if (!config.mcp || typeof config.mcp !== "object") {
-		return { items, warnings };
-	}
-
-	const servers = expandEnvVarsDeep(config.mcp as Record<string, unknown>);
-
-	for (const [name, raw] of Object.entries(servers)) {
-		if (!raw || typeof raw !== "object") {
-			warnings.push(`Invalid MCP config for "${name}" in ${configPath}`);
-			continue;
-		}
-
-		const serverConfig = raw as OpenCodeMCPConfig;
-
-		// Determine transport from OpenCode's "type" field
-		let transport: "stdio" | "sse" | "http" | undefined;
-		if (serverConfig.type === "local") {
-			transport = "stdio";
-		} else if (serverConfig.type === "remote") {
-			transport = "http";
-		} else if (serverConfig.url) {
-			transport = "http";
-		} else if (serverConfig.command) {
-			transport = "stdio";
-		}
-
-		items.push({
-			name,
-			command: serverConfig.command,
-			args: Array.isArray(serverConfig.args) ? (serverConfig.args as string[]) : undefined,
-			env: serverConfig.env && typeof serverConfig.env === "object" ? serverConfig.env : undefined,
-			url: typeof serverConfig.url === "string" ? serverConfig.url : undefined,
-			headers: serverConfig.headers && typeof serverConfig.headers === "object" ? serverConfig.headers : undefined,
-			enabled: serverConfig.enabled,
-			timeout: typeof serverConfig.timeout === "number" ? serverConfig.timeout : undefined,
-			transport,
-			_source: createSourceMeta(PROVIDER_ID, configPath, level),
-		});
-	}
-
-	return { items, warnings };
-}
-
 // =============================================================================
 // Skills (skills/)
 // =============================================================================
@@ -357,14 +248,6 @@ registerProvider(contextFileCapability.id, {
 	load: loadContextFiles,
 });
 
-registerProvider(mcpCapability.id, {
-	id: PROVIDER_ID,
-	displayName: DISPLAY_NAME,
-	description: "Load MCP servers from opencode.json mcp key",
-	priority: PRIORITY,
-	load: loadMCPServers,
-});
-
 registerProvider(skillCapability.id, {
 	id: PROVIDER_ID,
 	displayName: DISPLAY_NAME,