@geraldmaron/construct 1.4.2 → 1.5.1

package/lib/team/health.mjs

@@ -0,0 +1,72 @@
+/**
+ * lib/team/health.mjs — team-mode queue and worker health read model.
+ */
+
+import path from 'node:path';
+
+import { createSqlClient, closeSqlClient } from '../storage/backend.mjs';
+import { PostgresIntakeQueue } from '../queue/pg-queue.mjs';
+import { WorkerRegistry } from '../orchestration/worker-runtime.mjs';
+import { resolveIntakeTenantId, INTAKE_PROJECT_ENV_KEY, INTAKE_QUEUE_NAME_ENV_KEY } from '../intake/queue.mjs';
+
+function resolveProject(rootDir, env = process.env) {
+  const explicit = env?.[INTAKE_PROJECT_ENV_KEY];
+  if (explicit && String(explicit).trim()) return String(explicit).trim();
+  return path.basename(path.resolve(rootDir || process.cwd())).trim() || 'construct';
+}
+
+function unavailable(reason) {
+  return {
+    status: 'unavailable',
+    reason,
+    queue: null,
+    workers: [],
+    summary: reason === 'postgres-unavailable'
+      ? 'Postgres unavailable; team queue/worker health cannot be read'
+      : reason,
+  };
+}
+
+export async function summarizeTeamHealth({
+  rootDir = process.cwd(),
+  env = process.env,
+  sql = null,
+} = {}) {
+  const ownSql = sql || createSqlClient(env);
+  if (!ownSql) return unavailable('postgres-unavailable');
+
+  const project = resolveProject(rootDir, env);
+  const tenantId = resolveIntakeTenantId(env);
+  const queueName = env?.[INTAKE_QUEUE_NAME_ENV_KEY] || 'intake';
+  try {
+    const queue = new PostgresIntakeQueue({ sql: ownSql, project, tenantId, queueName });
+    const registry = new WorkerRegistry({ sql: ownSql, project, tenantId });
+    const [queueStats, workers] = await Promise.all([
+      queue.queueStats(),
+      registry.list({ includeStale: true }),
+    ]);
+    const staleWorkers = workers.filter((w) => w.stale || w.status === 'stale').length;
+    const activeWorkers = workers.filter((w) => w.status === 'active' && !w.stale).length;
+    const status = queueStats.deadLetter > 0 || staleWorkers > 0
+      ? 'degraded'
+      : 'healthy';
+    return {
+      status,
+      project,
+      tenantId,
+      queue: queueStats,
+      workers,
+      activeWorkers,
+      staleWorkers,
+      deadLetter: queueStats.deadLetter,
+      summary: `${queueStats.pending} pending · ${queueStats.claimed} claimed · ${queueStats.deadLetter} dead-letter · ${activeWorkers} active workers · ${staleWorkers} stale workers`,
+    };
+  } catch (err) {
+    return {
+      ...unavailable('team-health-read-failed'),
+      error: err?.message || String(err),
+    };
+  } finally {
+    if (!sql) await closeSqlClient(ownSql);
+  }
+}

package/lib/telemetry/backends/local.mjs

@@ -1,17 +1,23 @@
 /**
  * lib/telemetry/backends/local.mjs — Local JSONL trace backend.
  *
- * Reads trace events from ~/.cx/traces/*.jsonl files.
+ * Reads trace events from the calling project's machine-scoped state root
+ * (ADR-0066: `<stateRoot>/traces/*.jsonl`, keyed off cwd — the same location
+ * lib/worker/trace.mjs and lib/telemetry/client.mjs write to).
  * No remote calls. Always available. Used when CONSTRUCT_TRACE_BACKEND=local.
  */
 
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 
+import { resolveStateDir } from '../../state-root.mjs';
+
 export const name = 'local';
 
-function tracesDir(env = process.env) {
-  return join(env.CX_TOOLKIT_DIR || process.cwd(), '.cx', 'traces');
+function tracesDir() {
+  // ensureDir:false — listTraces is read-only and already guards on
+  // existsSync(); it must not conjure a traces/ dir just by being called.
+  return resolveStateDir(process.cwd(), 'traces', { ensureDir: false });
 }
 
 export async function isAvailable() {

package/lib/telemetry/client.mjs

@@ -4,12 +4,12 @@
  * Local JSONL trace capture is the default. Remote export is opt-in through
  * CONSTRUCT_TRACE_BACKEND and never throws into callers.
  */
-import { existsSync, mkdirSync, appendFileSync } from 'node:fs';
+import { appendFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 
 import { createIngestClient } from './ingest.mjs';
-import { ensureCxDir } from '../project-init-shared.mjs';
+import { resolveStateDir } from '../state-root.mjs';
 
 const DEFAULT_MAX_BATCH = 50;
 
@@ -53,12 +53,8 @@ function traceShard() {
 function appendLocalTelemetry(type, body, { rootDir, env = process.env, onError = () => {} } = {}) {
   if (!localTraceEnabled(env)) return;
   const projectRoot = resolveProjectRoot({ rootDir, env });
-  const dir = join(projectRoot, '.cx', 'traces');
+  const dir = resolveStateDir(projectRoot, 'traces');
   try {
-    if (!existsSync(dir)) {
-      ensureCxDir(projectRoot);
-      mkdirSync(dir, { recursive: true });
-    }
     appendFileSync(join(dir, `${traceShard()}.jsonl`), `${JSON.stringify({
       traceId: body?.traceId || body?.id || randomUUID(),
       spanId: body?.id || randomUUID(),

package/lib/template-registry.mjs

@@ -16,26 +16,24 @@
  * shipped name.
  */
 
+// construct-rf26.11 folded 15 of the 29 legacy specialists into 11 surviving
+// worker anchors. Each folded specialist's template ownership below moved to
+// its anchor's entry (devil-advocate/evaluator/trace-reviewer -> reviewer;
+// legal-compliance -> security; sre -> operations; accessibility -> designer)
+// rather than being dropped, so the reverse-coverage gate still pins these
+// artifacts to a real, callable get_template() reference in the anchor's prompt.
 export const SPECIALIST_TEMPLATES = {
-  // Tranche 1 — five new templates authored alongside this map.
-  'cx-reviewer':        ['code-review-report'],
-  'cx-security':        ['security-audit-report'],
+  'cx-reviewer':        ['code-review-report', 'verdict'],
+  'cx-security':        ['security-audit-report', 'verdict'],
   'cx-qa':              ['qa-report', 'test-plan', 'qa-strategy'],
   'cx-debugger':        ['debug-investigation'],
-  'cx-devil-advocate':  ['verdict'],
-  'cx-evaluator':       ['verdict'],
-  'cx-trace-reviewer':  ['verdict'],
-  'cx-explorer':        ['verdict'],
-  'cx-legal-compliance':['verdict'],
 
   // Already-wired specialists pinned here so the gate guards them against drift.
   'cx-architect':       ['adr', 'rfc', 'architecture-review'],
   'cx-researcher':      ['research-brief', 'evidence-brief'],
-  'cx-sre':             ['runbook', 'incident-report', 'postmortem'],
+  'cx-operations':      ['runbook', 'incident-report', 'postmortem'],
   'cx-product-manager': ['prd', 'meta-prd'],
-
-  // Tranche 2 — three lower-frequency artifacts.
-  'cx-accessibility':   ['accessibility-audit'],
+  'cx-designer':        ['accessibility-audit'],
 };
 
 // The orchestrator owns the task-packet shape and emits it at dispatch time

package/lib/tenant/context.mjs

@@ -0,0 +1,82 @@
+/**
+ * lib/tenant/context.mjs — tenant context resolution for the control plane.
+ *
+ * ADR-0057 (A7) IMPLEMENT-NOW: tenantId is data plumbing, not isolation.
+ * resolveTenantContext() is the single place a tenant id is derived from
+ * config + env and validated, so run/task/queue/audit records all carry the
+ * same value rather than each call site re-deriving it ad hoc. Solo and team
+ * modes default to the explicit tenant id 'local'. Enterprise mode has no
+ * default: a missing/blank tenant id is a fail-closed TenantResolutionError.
+ * No tenant isolation (worker/storage separation) is implied or attempted
+ * here — see LMCP-H4.
+ */
+
+export const TENANT_ID_ENV_KEY = 'CONSTRUCT_TENANT_ID';
+export const DEFAULT_TENANT_ID = 'local';
+
+// A resolvable tenant id is a non-empty, trimmed string. Enterprise mode
+// treats anything else (missing, blank, whitespace-only) as unresolved.
+
+function normalizeTenantId(value) {
+  if (typeof value !== 'string') return null;
+  const trimmed = value.trim();
+  return trimmed ? trimmed : null;
+}
+
+export class TenantResolutionError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = 'TenantResolutionError';
+  }
+}
+
+/**
+ * Resolve the tenant context once, from config + env, validated against the
+ * deployment mode. Returns `{ tenantId, source, mode }`.
+ *
+ * - solo/team: an explicit id from env/config wins; otherwise defaults to
+ *   'local' (source: 'default'). Never throws.
+ * - enterprise: an explicit id from env/config is required. A missing or
+ *   blank id throws TenantResolutionError — enterprise mode fails closed at
+ *   startup rather than silently running unlabeled multi-tenant traffic.
+ *
+ * @param {object} [opts]
+ * @param {Record<string,string>} [opts.env]
+ * @param {object} [opts.config]   loaded project config (reads deployment.tenantId)
+ * @param {string} [opts.mode]     deployment mode; if omitted, callers must pass it
+ *   explicitly — this module does not import deployment-mode.mjs to avoid a
+ *   config-loading cycle (deployment-mode.mjs itself loads project config).
+ * @returns {{tenantId: string, source: 'env'|'config'|'default', mode: string}}
+ */
+export function resolveTenantContext({ env = process.env, config = null, mode = 'solo' } = {}) {
+  const fromEnv = normalizeTenantId(env?.[TENANT_ID_ENV_KEY]);
+  const fromConfig = !fromEnv ? normalizeTenantId(config?.deployment?.tenantId) : null;
+  const resolved = fromEnv || fromConfig;
+
+  if (resolved) {
+    return { tenantId: resolved, source: fromEnv ? 'env' : 'config', mode };
+  }
+
+  if (mode === 'enterprise') {
+    throw new TenantResolutionError(
+      `enterprise mode requires a resolvable tenant id; set ${TENANT_ID_ENV_KEY} or deployment.tenantId in construct.config.json. ` +
+      'Enterprise mode cannot start without a tenant — see ADR-0057 (A7).',
+    );
+  }
+
+  return { tenantId: DEFAULT_TENANT_ID, source: 'default', mode };
+}
+
+/**
+ * Fail-closed startup guard: call once at process/runtime start for enterprise
+ * mode. Re-throws TenantResolutionError with the same actionable message;
+ * solo/team never throw here since resolveTenantContext always resolves for
+ * them. Exposed separately so startup call sites can guard without needing
+ * the resolved value.
+ *
+ * @param {object} [opts]  same shape as resolveTenantContext
+ * @returns {{tenantId: string, source: string, mode: string}}
+ */
+export function requireTenantContext(opts = {}) {
+  return resolveTenantContext(opts);
+}

package/lib/tenant/isolation.mjs

@@ -0,0 +1,129 @@
+/**
+ * lib/tenant/isolation.mjs — cross-tenant read guard for the control plane (LMCP-H5).
+ *
+ * lib/tenant/context.mjs (H1) resolves a tenant id; lib/identity.mjs (H2) resolves
+ * an actor; I3 landed durable audit/denied records that carry both. None of that
+ * enforces a boundary — a record tagged tenant "acme" is still just a JSON line a
+ * caller with tenant "other" can read if nothing stops them. Physical per-tenant
+ * storage backends are LMCP-H4 (not yet landed; queue/store today are scoped by
+ * rootDir, not tenant). Until H4 lands, this module is the enforcement layer that
+ * makes the tenant tag load-bearing everywhere it already exists:
+ *
+ *   - assertTenantMatch(recordTenant, contextTenant) — throws TenantIsolationViolation
+ *     (fail-closed) on any mismatch, and on a missing/blank tenant on either side.
+ *   - scopeToTenant(records, tenantId) — filters a record list down to exactly the
+ *     records whose `tenant`/`tenantId` field matches, fail-closed (throws) if
+ *     tenantId itself is unresolved rather than silently returning everything.
+ *   - readTenantScoped(readAll, tenantId) — composes a raw "read everything" API
+ *     (queue.listPending, DeniedStore.readAll, readAuditTrail, a store's list*) with
+ *     scopeToTenant so a caller gets a tenant-safe view over today's rootDir-scoped
+ *     backends without waiting on H4's physical isolation.
+ *
+ * Scope: no physical isolation (no per-tenant encryption, no separate
+ * database/schema) — see H4 for that. The narrower, verifiable guarantee: any
+ * record path that stamps a tenant field cannot be read across a tenant boundary
+ * through these accessors, and is fail-closed (throws) rather than fail-open when
+ * the tenant dimension is missing or unresolved on either side.
+ */
+
+export class TenantIsolationViolation extends Error {
+  constructor(message, { recordTenant, contextTenant } = {}) {
+    super(message);
+    this.name = 'TenantIsolationViolation';
+    this.recordTenant = recordTenant ?? null;
+    this.contextTenant = contextTenant ?? null;
+  }
+}
+
+function normalize(value) {
+  if (typeof value !== 'string') return null;
+  const trimmed = value.trim();
+  return trimmed ? trimmed : null;
+}
+
+/**
+ * Fail-closed equality check between a record's tenant and the requesting
+ * context's tenant. Throws TenantIsolationViolation on mismatch, and also on
+ * either side being missing/blank — an unresolved tenant is never treated as
+ * a wildcard that matches everything.
+ *
+ * @param {string} recordTenant
+ * @param {string} contextTenant
+ */
+export function assertTenantMatch(recordTenant, contextTenant) {
+  const rec = normalize(recordTenant);
+  const ctx = normalize(contextTenant);
+
+  if (!ctx) {
+    throw new TenantIsolationViolation(
+      'tenant isolation: requesting context has no resolvable tenant id — refusing read fail-closed',
+      { recordTenant: rec, contextTenant: ctx },
+    );
+  }
+  if (!rec) {
+    throw new TenantIsolationViolation(
+      'tenant isolation: record has no resolvable tenant id — refusing read fail-closed',
+      { recordTenant: rec, contextTenant: ctx },
+    );
+  }
+  if (rec !== ctx) {
+    throw new TenantIsolationViolation(
+      `tenant isolation violation: record tenant "${rec}" is not readable from tenant "${ctx}" context`,
+      { recordTenant: rec, contextTenant: ctx },
+    );
+  }
+}
+
+// Records observed across queue/audit/denied-store use either `tenant` (I3
+// decision-record schema: audit-trail, denied-store) or `tenantId` (H1 queue
+// entries, orchestration run/task records) — checked in that order so one
+// helper covers both shapes without callers needing to know which field name
+// their backend uses.
+
+function tenantFieldOf(record) {
+  if (record && typeof record === 'object') {
+    if ('tenant' in record) return record.tenant;
+    if ('tenantId' in record) return record.tenantId;
+  }
+  return null;
+}
+
+/**
+ * Filter a record list down to exactly the records belonging to tenantId.
+ * Fail-closed: throws TenantIsolationViolation if tenantId itself is
+ * unresolved (missing/blank) rather than returning the unfiltered list —
+ * an isolation filter that no-ops on missing context is not a filter.
+ * Records with no resolvable tenant field are dropped, not leaked through.
+ *
+ * @param {object[]} records
+ * @param {string} tenantId
+ * @returns {object[]}
+ */
+export function scopeToTenant(records, tenantId) {
+  const ctx = normalize(tenantId);
+  if (!ctx) {
+    throw new TenantIsolationViolation(
+      'tenant isolation: scopeToTenant called with no resolvable tenant id — refusing to read any records',
+      { recordTenant: null, contextTenant: null },
+    );
+  }
+  return (records || []).filter((record) => normalize(tenantFieldOf(record)) === ctx);
+}
+
+/**
+ * Compose a raw "read everything" accessor with scopeToTenant, so a caller
+ * gets a tenant-safe view over a backend that has no native tenant filter
+ * (today's rootDir-scoped queue/store/audit readers). `readAll` may be sync
+ * or return a promise; the tenant filter is applied to whatever it resolves.
+ *
+ * @param {function(): (object[]|Promise<object[]>)} readAll
+ * @param {string} tenantId
+ * @returns {object[]|Promise<object[]>}
+ */
+export function readTenantScoped(readAll, tenantId) {
+  const result = readAll();
+  if (result && typeof result.then === 'function') {
+    return result.then((records) => scopeToTenant(records, tenantId));
+  }
+  return scopeToTenant(result, tenantId);
+}

package/lib/test-corpus-inventory.mjs

@@ -80,6 +80,7 @@ export function defaultCorpusInventoryPath(rootDir = process.cwd()) {
 }
 
 function listTestFiles(testsDir) {
+  if (!fs.existsSync(testsDir)) return [];
   const files = [];
   const walk = (dir) => {
     for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
@@ -140,6 +141,101 @@ function extractCapabilities(content) {
   return [...content.matchAll(/@capability\s+([a-z][a-z0-9]*(?:[.-][a-z0-9]+)*)/g)].map((match) => match[1]);
 }
 
+// `@embed <manifest-id>` is the embed-node analog of `@capability` (LMCP-P6):
+// an acceptance test declares which embed preset it validates, so the graph can
+// draw a test --validates--> embed edge without the id colliding with the
+// capability id-space walked by extractCapabilities above.
+
+function extractEmbedIds(content) {
+  return [...content.matchAll(/@embed\s+([a-z][a-z0-9]*(?:[.-][a-z0-9]+)*)/g)].map((match) => match[1]);
+}
+
+// Graph builders (lib/graph/build-from-corpus.mjs) need the raw path→capability
+// pairs, not the full classified inventory, so this stays a thin extraction step
+// callers can run over the live tree without regenerating the whole inventory.
+
+export function extractCapabilityTestEdges({ rootDir } = {}) {
+  const root = findConstructRoot(rootDir);
+  const testsDir = path.join(root, 'tests');
+  const edges = [];
+  for (const absolute of listTestFiles(testsDir)) {
+    const rel = path.relative(root, absolute).replace(/\\/g, '/');
+    const content = fs.readFileSync(absolute, 'utf8');
+    for (const capabilityId of extractCapabilities(content)) edges.push({ testPath: rel, capabilityId });
+  }
+  return edges;
+}
+
+/**
+ * Raw path→embed-id pairs from `@embed` annotations, mirroring
+ * extractCapabilityTestEdges for the P6 embed-node graph seeder.
+ *
+ * @param {{ rootDir?: string }} [opts]
+ * @returns {Array<{ testPath: string, embedId: string }>}
+ */
+export function extractEmbedTestEdges({ rootDir } = {}) {
+  const root = findConstructRoot(rootDir);
+  const testsDir = path.join(root, 'tests');
+  if (!fs.existsSync(testsDir)) return [];
+  const edges = [];
+  for (const absolute of listTestFiles(testsDir)) {
+    const rel = path.relative(root, absolute).replace(/\\/g, '/');
+    const content = fs.readFileSync(absolute, 'utf8');
+    for (const embedId of extractEmbedIds(content)) edges.push({ testPath: rel, embedId });
+  }
+  return edges;
+}
+
+// `@owasp LLM01[, LLM06]` tags a test with one or more OWASP GenAI Top-10
+// category ids; `@secures <workflow-id>` names the workflow the test protects
+// (LMCP-N8). Together they let the graph carry security coverage as
+// test --secures--> workflow edges with the category recorded on the test node.
+
+function extractOwaspCategories(content) {
+  const cats = new Set();
+  for (const m of content.matchAll(/@owasp\s+([A-Za-z0-9,\s]+)/g)) {
+    for (const raw of m[1].split(',')) {
+      const id = raw.trim().toUpperCase();
+      if (/^LLM(0[1-9]|10)$/.test(id)) cats.add(id);
+    }
+  }
+  return [...cats].sort();
+}
+
+function extractSecuredWorkflows(content) {
+  const ids = new Set();
+  for (const m of content.matchAll(/@secures\s+([a-z0-9,\s-]+)/g)) {
+    for (const raw of m[1].split(',')) {
+      const id = raw.trim();
+      if (/^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*$/.test(id)) ids.add(id);
+    }
+  }
+  return [...ids];
+}
+
+/**
+ * Security-test annotations for the N8 graph seeder: one entry per test that
+ * carries at least one `@owasp` tag, with its categories and any `@secures`
+ * workflow ids.
+ *
+ * @param {{ rootDir?: string }} [opts]
+ * @returns {Array<{ testPath: string, owasp: string[], secures: string[] }>}
+ */
+export function extractSecurityTestEdges({ rootDir } = {}) {
+  const root = findConstructRoot(rootDir);
+  const testsDir = path.join(root, 'tests');
+  if (!fs.existsSync(testsDir)) return [];
+  const entries = [];
+  for (const absolute of listTestFiles(testsDir)) {
+    const content = fs.readFileSync(absolute, 'utf8');
+    const owasp = extractOwaspCategories(content);
+    if (owasp.length === 0) continue;
+    const rel = path.relative(root, absolute).replace(/\\/g, '/');
+    entries.push({ testPath: rel, owasp, secures: extractSecuredWorkflows(content) });
+  }
+  return entries;
+}
+
 function detectSkipped(content) {
   return /\btest\.skip\s*\(|\bit\.skip\s*\(|\bdescribe\.skip\s*\(/.test(content);
 }
@@ -236,14 +332,20 @@ export function formatAuditAtAGlance(inventory) {
 export function refreshAuditMarkdown(inventory, { rootDir } = {}) {
   const root = findConstructRoot(rootDir);
   const auditPath = path.join(root, 'tests', 'AUDIT.md');
-  const markdown = fs.readFileSync(auditPath, 'utf8');
+  let markdown = fs.readFileSync(auditPath, 'utf8');
   const start = '## At a glance';
   const end = '## Categories';
   const startIdx = markdown.indexOf(start);
   const endIdx = markdown.indexOf(end);
   if (startIdx === -1 || endIdx === -1) throw new Error('tests/AUDIT.md missing At a glance section');
   const replacement = `${start}\n\n${formatAuditAtAGlance(inventory)}\n\n`;
-  return `${markdown.slice(0, startIdx)}${replacement}${markdown.slice(endIdx)}`;
+  markdown = `${markdown.slice(0, startIdx)}${replacement}${markdown.slice(endIdx)}`;
+  const functional = inventory.summary.byCategory.functional ?? 0;
+  markdown = markdown.replace(
+    /### 5\. Functional layer \(\d+ tests, \d+ files\)/,
+    `### 5. Functional layer (${functional} tests, ${functional} files)`,
+  );
+  return markdown;
 }
 
 export function validateCorpusInventory({ rootDir, inventory: supplied } = {}) {

package/lib/uninstall/uninstall.mjs

@@ -20,6 +20,12 @@
  * `core.hooksPath` are reversed because they are state install/init created and
  * own; a user-customized hooksPath is left untouched.
  *
+ * Since construct-ranh moved Claude Code's MCP write path off
+ * ~/.claude/settings.json (never read by the CLI for server definitions),
+ * MCP cleanup checks both the new locations (~/.claude.json for machine
+ * scope, <project>/.mcp.json for project scope) and the legacy
+ * settings.json path, so both pre- and post-fix installs are covered.
+ *
  * Flags:
  *   --dry-run             print the plan, change nothing
  *   --yes                 non-interactive; remove auto-risk items, skip ask-risk items
@@ -95,9 +101,11 @@ function buildCategories({ cwd, home, withImages = false }) {
   const userCxDir = doctorRoot(userHome);
   const launchAgentPlist = path.join(userHome, 'Library', 'LaunchAgents', `${PRESSURE_GUARD_LABEL}.plist`);
   const claudeSettings = path.join(userHome, '.claude', 'settings.json');
+  const claudeUserConfig = path.join(userHome, '.claude.json');
   const opencodeConfig = path.join(userHome, '.config', 'opencode', 'opencode.json');
   const codexConfig = path.join(userHome, '.codex', 'config.toml');
-  const memoryConfigPaths = { claudeSettings, opencodeConfig, codexConfig };
+  const memoryConfigPaths = { claudeSettings, claudeUserConfig, opencodeConfig, codexConfig };
+  const dotMcpJson = path.join(cwd, '.mcp.json');
 
   return [
     {
@@ -143,10 +151,15 @@ function buildCategories({ cwd, home, withImages = false }) {
       id: 'project-settings',
       scope: 'project',
       risk: 'auto',
-      label: '.claude/settings.json (un-merge Construct keys)',
-      detect: () => detectConstructSettings(dotClaudeSettings),
-      describe: () => 'Strips Construct hooks + known mcpServers from settings.json; preserves any user-added keys. Deletes the file if it becomes empty.',
-      execute: () => unmergeSettings(dotClaudeSettings),
+      label: '.claude/settings.json + .mcp.json (un-merge Construct keys)',
+      detect: () => detectConstructSettings(dotClaudeSettings) || detectConstructMcpJson(dotMcpJson),
+      describe: () => 'Strips Construct hooks + known mcpServers from settings.json (legacy) and Construct-managed servers from .mcp.json (construct-ranh scope); preserves any user-added keys. Deletes a file if it becomes empty.',
+      execute: () => {
+        const parts = [unmergeSettings(dotClaudeSettings)];
+        const mcpJsonResult = unmergeMcpJson(dotMcpJson);
+        if (mcpJsonResult) parts.push(mcpJsonResult);
+        return parts.join('; ');
+      },
     },
     {
       id: 'project-cx',
@@ -263,7 +276,7 @@ function buildCategories({ cwd, home, withImages = false }) {
       risk: 'auto',
       label: 'memory MCP registration (Claude, OpenCode, Codex)',
       detect: () => memoryMcpRegistered(memoryConfigPaths),
-      describe: () => 'Strips the Construct memory MCP bridge from ~/.claude/settings.json, ~/.config/opencode/opencode.json, and ~/.codex/config.toml. Preserves all other entries.',
+      describe: () => 'Strips the Construct memory MCP bridge from ~/.claude.json (construct-ranh scope) and ~/.claude/settings.json (legacy), plus ~/.config/opencode/opencode.json and ~/.codex/config.toml. Preserves all other entries.',
       execute: () => removeMemoryMcp(memoryConfigPaths),
     },
     {
@@ -472,6 +485,54 @@ function constructMcpKeys() {
   } catch { return []; }
 }
 
+// Since construct-ranh, `construct sync` writes project-scope MCP servers to
+// .mcp.json rather than .claude/settings.json — mirroring the same
+// core-category + construct-mcp allowlist scripts/sync-specialists.mjs's
+// PROJECT_DEFAULT_MCP_IDS derives from lib/mcp-catalog.json, so uninstall
+// strips exactly what sync would have written, never a user's own project-scope
+// `claude mcp add` entries.
+
+function projectManagedMcpIds() {
+  try {
+    const catalog = JSON.parse(fs.readFileSync(path.join(PKG_ROOT, 'lib', 'mcp-catalog.json'), 'utf8'));
+    const arr = catalog.mcps || catalog.servers || [];
+    return new Set([...arr.filter((m) => m.category === 'core').map((m) => m.id), 'construct-mcp']);
+  } catch { return new Set(['context7', 'construct-mcp']); }
+}
+
+function detectConstructMcpJson(filePath) {
+  if (!fs.existsSync(filePath)) return false;
+  let config;
+  try { config = JSON.parse(fs.readFileSync(filePath, 'utf8')); }
+  catch { return false; }
+  if (!config || typeof config !== 'object' || !config.mcpServers) return false;
+  const ids = projectManagedMcpIds();
+  return Object.keys(config.mcpServers).some((k) => ids.has(k));
+}
+
+function unmergeMcpJson(filePath) {
+  if (!fs.existsSync(filePath)) return null;
+  let config;
+  try { config = JSON.parse(fs.readFileSync(filePath, 'utf8')); }
+  catch { return '.mcp.json was malformed; left untouched'; }
+  if (!config || typeof config !== 'object' || !config.mcpServers) return null;
+
+  let removedCount = 0;
+  for (const key of projectManagedMcpIds()) {
+    if (key in config.mcpServers) { delete config.mcpServers[key]; removedCount += 1; }
+  }
+  if (removedCount === 0) return null;
+  if (Object.keys(config.mcpServers).length === 0) delete config.mcpServers;
+
+  const remaining = Object.keys(config);
+  if (remaining.length === 0) {
+    fs.unlinkSync(filePath);
+    return `.mcp.json removed (file was Construct-only) [stripped ${removedCount} mcpServers]`;
+  }
+  fs.writeFileSync(filePath, JSON.stringify(config, null, 2) + '\n', 'utf8');
+  return `.mcp.json stripped ${removedCount} mcpServers; preserved ${remaining.join(', ')}`;
+}
+
 function dockerContainerExists(name) {
   const probe = spawnSync('docker', ['ps', '-a', '--filter', `name=^/${name}$`, '--format', '{{.Names}}'], {
     encoding: 'utf8',
@@ -545,8 +606,9 @@ function removePressureGuardLaunchAgent(plistPath) {
   return removed ? 'unregistered and removed plist' : 'unregistered (plist already gone)';
 }
 
-function memoryMcpRegistered({ claudeSettings, opencodeConfig, codexConfig }) {
+function memoryMcpRegistered({ claudeSettings, claudeUserConfig, opencodeConfig, codexConfig }) {
   return claudeHasMemoryMcp(claudeSettings)
+    || claudeHasMemoryMcp(claudeUserConfig)
     || opencodeHasMemoryMcp(opencodeConfig)
     || codexHasMemoryMcp(codexConfig);
 }
@@ -569,13 +631,17 @@ function codexHasMemoryMcp(filePath) {
   return MEMORY_MCP_KEYS.some((key) => text.includes(`[mcp_servers.${key}]`) || text.includes(`[mcp_servers.${tomlString(key)}]`));
 }
 
-// The memory MCP is registered into all three host configs by `construct mcp add
-// memory` during install; each host is stripped independently so a missing or
-// hand-edited config never blocks the others.
+// The memory MCP is registered into Claude, OpenCode, and Codex by `construct
+// mcp add memory` during install; each host is stripped independently so a
+// missing or hand-edited config never blocks the others. Claude has two
+// possible locations: ~/.claude.json is where construct-ranh moved the write
+// path (Claude Code never reads MCP servers from settings.json), and
+// ~/.claude/settings.json is stripped too for installs made before that fix.
 
-function removeMemoryMcp({ claudeSettings, opencodeConfig, codexConfig }) {
+function removeMemoryMcp({ claudeSettings, claudeUserConfig, opencodeConfig, codexConfig }) {
   const stripped = [];
-  if (stripMemoryFromJsonMcp(claudeSettings, 'mcpServers')) stripped.push('claude');
+  if (stripMemoryFromJsonMcp(claudeSettings, 'mcpServers')) stripped.push('claude settings.json (legacy)');
+  if (stripMemoryFromJsonMcp(claudeUserConfig, 'mcpServers')) stripped.push('claude.json');
   if (stripMemoryFromJsonMcp(opencodeConfig, 'mcp')) stripped.push('opencode');
   if (stripMemoryFromCodex(codexConfig)) stripped.push('codex');
   return stripped.length ? `stripped from ${stripped.join(', ')}` : 'nothing to strip';