@gethmy/mcp 3.5.0 → 3.7.0

package/dist/index.js

@@ -21,12 +21,36 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join as join2, parse, resolve } from "node:path";
+function noteLegacyConfigDir(path) {
+  if (warnedLegacyConfigDir)
+    return;
+  warnedLegacyConfigDir = true;
+  console.error(`Harmony: reading the pre-#1082 config at ${path}. ` + `The current location is ${getConfigPath()}; ` + `run the agent daemon once to migrate, or move the file yourself.`);
+}
+function noteLegacyLocalPin(path) {
+  if (warnedLegacyLocalPin)
+    return;
+  warnedLegacyLocalPin = true;
+  console.error(`Harmony: this repo is pinned by ${path}, the pre-#1082 name. ` + `Rename it to ${LOCAL_CONFIG_FILENAME} — the fallback that finds it is temporary.`);
+}
+function noteLocalPinRename(from, to) {
+  console.error(`Harmony: wrote the repo pin to ${to} (the pre-#1082 ${from} is now ignored and can be deleted).`);
+}
+function getHmyRootDir() {
+  return join2(homedir(), CONFIG_DIR_NAME);
+}
 function getConfigDir() {
-  return join2(homedir(), ".harmony-mcp");
+  return join2(getHmyRootDir(), CONFIG_DIR_SUBDIR);
+}
+function getLegacyConfigDir() {
+  return join2(homedir(), LEGACY_CONFIG_DIR_NAME);
 }
 function getConfigPath() {
   return join2(getConfigDir(), "config.json");
 }
+function getLegacyConfigPath() {
+  return join2(getLegacyConfigDir(), "config.json");
+}
 function getLocalConfigPath(cwd) {
   return join2(cwd || process.cwd(), LOCAL_CONFIG_FILENAME);
 }
@@ -36,9 +60,14 @@ function findLocalConfigPath(cwd) {
   const { root } = parse(dir);
   for (;; ) {
     if (dir !== home && dir !== root) {
-      const candidate = join2(dir, LOCAL_CONFIG_FILENAME);
-      if (existsSync2(candidate))
-        return candidate;
+      const current = join2(dir, LOCAL_CONFIG_FILENAME);
+      if (existsSync2(current))
+        return current;
+      const legacy = join2(dir, LEGACY_LOCAL_CONFIG_FILENAME);
+      if (existsSync2(legacy)) {
+        noteLegacyLocalPin(legacy);
+        return legacy;
+      }
     }
     const parent = dirname(dir);
     if (parent === dir)
@@ -61,9 +90,12 @@ function emptyConfig() {
   };
 }
 function loadConfig() {
-  const configPath = getConfigPath();
+  let configPath = getConfigPath();
   if (!existsSync2(configPath)) {
-    return emptyConfig();
+    configPath = getLegacyConfigPath();
+    if (!existsSync2(configPath))
+      return emptyConfig();
+    noteLegacyConfigDir(configPath);
   }
   try {
     const data = readFileSync2(configPath, "utf-8");
@@ -113,7 +145,11 @@ function loadLocalConfig(cwd) {
   }
 }
 function saveLocalConfig(config, cwd) {
-  const localConfigPath = findLocalConfigPath(cwd) ?? getLocalConfigPath(cwd);
+  const foundPath = findLocalConfigPath(cwd);
+  const localConfigPath = foundPath ? join2(dirname(foundPath), LOCAL_CONFIG_FILENAME) : getLocalConfigPath(cwd);
+  if (foundPath !== null && foundPath !== localConfigPath) {
+    noteLocalPinRename(foundPath, localConfigPath);
+  }
   const existingConfig = loadLocalConfig(cwd) || {
     workspaceId: null,
     projectId: null
@@ -125,6 +161,7 @@ function saveLocalConfig(config, cwd) {
   if (newConfig.projectId)
     cleanConfig.projectId = newConfig.projectId;
   writeFileSync2(localConfigPath, JSON.stringify(cleanConfig, null, 2));
+  return localConfigPath;
 }
 function hasLocalConfig(cwd) {
   return findLocalConfigPath(cwd) !== null;
@@ -259,7 +296,7 @@ function getMemoryDir() {
     return config.memoryDir;
   return join2(homedir(), ".harmony", "memory");
 }
-var DEFAULT_API_URL = "https://app.gethmy.com/api", LOCAL_CONFIG_FILENAME = ".harmony-mcp.json";
+var DEFAULT_API_URL = "https://app.gethmy.com/api", LOCAL_CONFIG_FILENAME = ".hmy.json", LEGACY_LOCAL_CONFIG_FILENAME = ".harmony-mcp.json", CONFIG_DIR_NAME = ".hmy", CONFIG_DIR_SUBDIR = "agent", LEGACY_CONFIG_DIR_NAME = ".harmony-mcp", warnedLegacyConfigDir = false, warnedLegacyLocalPin = false;
 var init_config = () => {};
 
 // src/prompt-builder.ts
@@ -1950,6 +1987,213 @@ var REVIEW_DISALLOWED_TOOLS = [
   "mcp__harmony__harmony_delete_subtask",
   "mcp__harmony__harmony_toggle_subtask"
 ];
+// ../harmony-shared/dist/runRedaction.js
+var MAX_INPUT_CHARS = 2000;
+var MAX_OUTPUT_CHARS = 4000;
+var MAX_INPUT_STRING_CHARS = 600;
+var REDACTION_MARK = "«redacted»";
+var SENSITIVE_SEGMENTS = [
+  ".ssh",
+  ".gnupg",
+  ".aws",
+  ".codex",
+  ".gemini",
+  ".docker",
+  ".kube",
+  ".hmy",
+  ".harmony-mcp",
+  ".password-store",
+  ".claude",
+  "gh",
+  "gcloud",
+  "op",
+  "anthropic"
+];
+var CONFIG_SCOPED_SEGMENTS = new Set([
+  "gh",
+  "gcloud",
+  "op",
+  "anthropic"
+]);
+var SENSITIVE_BASENAMES = new Set([
+  ".netrc",
+  "_netrc",
+  ".npmrc",
+  ".pgpass",
+  ".git-credentials",
+  ".htpasswd",
+  ".claude.json",
+  "credentials",
+  ".credentials",
+  "credentials.json",
+  ".credentials.json",
+  "credentials.yml",
+  "credentials.yaml",
+  "auth.json",
+  ".auth.json",
+  "secrets",
+  "secrets.json",
+  "secrets.yaml",
+  "secrets.yml",
+  "id_rsa",
+  "id_dsa",
+  "id_ecdsa",
+  "id_ed25519",
+  "known_hosts"
+]);
+var SENSITIVE_EXTENSIONS = [
+  ".pem",
+  ".key",
+  ".p12",
+  ".pfx",
+  ".keystore",
+  ".jks",
+  ".asc",
+  ".gpg"
+];
+function isSensitivePath(rawPath) {
+  if (typeof rawPath !== "string" || rawPath.length === 0)
+    return false;
+  const path = rawPath.trim().toLowerCase();
+  const segments = path.split(/[\\/]+/).filter((s) => s.length > 0);
+  if (segments.length === 0)
+    return false;
+  for (let i = 0;i < segments.length; i++) {
+    const segment = segments[i];
+    if (!SENSITIVE_SEGMENTS.includes(segment))
+      continue;
+    if (CONFIG_SCOPED_SEGMENTS.has(segment)) {
+      if (i > 0 && segments[i - 1] === ".config")
+        return true;
+      continue;
+    }
+    return true;
+  }
+  const basename = segments[segments.length - 1];
+  if (SENSITIVE_BASENAMES.has(basename))
+    return true;
+  if (basename === ".env" || basename.startsWith(".env."))
+    return true;
+  if (basename.endsWith(".env"))
+    return true;
+  if (SENSITIVE_EXTENSIONS.some((ext) => basename.endsWith(ext)))
+    return true;
+  if (/service[-_]?account.*\.json$/.test(basename))
+    return true;
+  return false;
+}
+function sensitivePathsIn(input, depth = 0) {
+  if (depth > 6)
+    return [];
+  if (typeof input === "string") {
+    return isSensitivePath(input) ? [input] : [];
+  }
+  if (Array.isArray(input)) {
+    return input.flatMap((item) => sensitivePathsIn(item, depth + 1));
+  }
+  if (input !== null && typeof input === "object") {
+    return Object.values(input).flatMap((value) => sensitivePathsIn(value, depth + 1));
+  }
+  return [];
+}
+var SECRET_PATTERNS = [
+  {
+    pattern: /-----BEGIN[^-]*PRIVATE KEY-----[\s\S]*?-----END[^-]*-----/g,
+    replace: REDACTION_MARK
+  },
+  { pattern: /\bhmy_at_[A-Za-z0-9_-]{8,}/g, replace: REDACTION_MARK },
+  { pattern: /\bhmy_[A-Za-z0-9_-]{8,}/g, replace: REDACTION_MARK },
+  { pattern: /\bsk-(?:ant-)?[A-Za-z0-9_-]{16,}/g, replace: REDACTION_MARK },
+  { pattern: /\bgh[pousr]_[A-Za-z0-9]{16,}/g, replace: REDACTION_MARK },
+  { pattern: /\bgithub_pat_[A-Za-z0-9_]{20,}/g, replace: REDACTION_MARK },
+  { pattern: /\bxox[abprs]-[A-Za-z0-9-]{10,}/g, replace: REDACTION_MARK },
+  { pattern: /\bAKIA[0-9A-Z]{16}\b/g, replace: REDACTION_MARK },
+  { pattern: /\bAIza[0-9A-Za-z_-]{20,}/g, replace: REDACTION_MARK },
+  {
+    pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g,
+    replace: REDACTION_MARK
+  },
+  {
+    pattern: /\b(Bearer|Basic|Token)\s+[A-Za-z0-9._~+/=-]{12,}/gi,
+    replace: `$1 ${REDACTION_MARK}`
+  },
+  {
+    pattern: /(\w{1,32}:\/\/)[^/\s:@]+:[^/\s@]+@/g,
+    replace: `$1${REDACTION_MARK}@`
+  },
+  {
+    pattern: /\b([A-Za-z0-9_]{0,40}(?:TOKEN|SECRET|PASSWORD|PASSWD|APIKEY|API_KEY|ACCESS_KEY|PRIVATE_KEY|CREDENTIAL|AUTH)[A-Za-z0-9_]{0,40})\s*[=:]\s*(?:"[^"]*"|'[^']*'|`[^`]*`|[^\s,;)}\]]+)/gi,
+    replace: `$1=${REDACTION_MARK}`
+  },
+  {
+    pattern: /(--?(?:password|passwd|token|api-?key|secret|auth)(?:=|\s+))(?:"[^"]*"|'[^']*'|[^\s]+)/gi,
+    replace: `$1${REDACTION_MARK}`
+  }
+];
+function redactSecrets(text) {
+  if (typeof text !== "string" || text.length === 0)
+    return text;
+  let out = text;
+  for (const { pattern, replace } of SECRET_PATTERNS) {
+    pattern.lastIndex = 0;
+    out = out.replace(pattern, replace);
+  }
+  return out;
+}
+function truncate(text, max, originalLength) {
+  const total = originalLength ?? text.length;
+  if (total <= max)
+    return text;
+  return `${text.slice(0, max)}… [+${total - max} chars]`;
+}
+function redactThenTruncate(text, max) {
+  const preCap = max * 4 + 64;
+  const scanned = text.length > preCap ? text.slice(0, preCap) : text;
+  return truncate(redactSecrets(scanned), max, text.length);
+}
+function redactStructure(value, depth = 0) {
+  if (depth > 6)
+    return REDACTION_MARK;
+  if (typeof value === "string") {
+    return redactThenTruncate(value, MAX_INPUT_STRING_CHARS);
+  }
+  if (Array.isArray(value)) {
+    return value.slice(0, 20).map((item) => redactStructure(item, depth + 1));
+  }
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [key, item] of Object.entries(value)) {
+      out[key] = redactStructure(item, depth + 1);
+    }
+    return out;
+  }
+  return value;
+}
+function redactToolCall(args) {
+  const sensitive = sensitivePathsIn(args.input);
+  if (sensitive.length > 0) {
+    return { withheld: "sensitive-path" };
+  }
+  const result = {};
+  if (args.input !== undefined) {
+    let input = redactStructure(args.input);
+    let serialized;
+    try {
+      serialized = JSON.stringify(input) ?? "";
+    } catch {
+      serialized = "";
+      input = REDACTION_MARK;
+    }
+    if (serialized.length > MAX_INPUT_CHARS) {
+      input = truncate(serialized, MAX_INPUT_CHARS);
+    }
+    result.input = input;
+  }
+  if (typeof args.output === "string" && args.output.length > 0) {
+    result.output = redactThenTruncate(args.output, MAX_OUTPUT_CHARS);
+  }
+  return result;
+}
 // ../harmony-shared/dist/stageHandoff.js
 var HANDOFF_MARKER = "harmony:stage-handoff";
 var HANDOFF_BLOCK_RE = new RegExp("```json\\s*\\n//\\s*" + HANDOFF_MARKER + "\\s*\\n([\\s\\S]*?)\\n```", "m");

package/dist/lib/api-client.js

@@ -18,12 +18,40 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, parse, resolve } from "node:path";
+function resetLegacyNoticesForTest() {
+  warnedLegacyConfigDir = false;
+  warnedLegacyLocalPin = false;
+}
+function noteLegacyConfigDir(path) {
+  if (warnedLegacyConfigDir)
+    return;
+  warnedLegacyConfigDir = true;
+  console.error(`Harmony: reading the pre-#1082 config at ${path}. ` + `The current location is ${getConfigPath()}; ` + `run the agent daemon once to migrate, or move the file yourself.`);
+}
+function noteLegacyLocalPin(path) {
+  if (warnedLegacyLocalPin)
+    return;
+  warnedLegacyLocalPin = true;
+  console.error(`Harmony: this repo is pinned by ${path}, the pre-#1082 name. ` + `Rename it to ${LOCAL_CONFIG_FILENAME} — the fallback that finds it is temporary.`);
+}
+function noteLocalPinRename(from, to) {
+  console.error(`Harmony: wrote the repo pin to ${to} (the pre-#1082 ${from} is now ignored and can be deleted).`);
+}
+function getHmyRootDir() {
+  return join(homedir(), CONFIG_DIR_NAME);
+}
 function getConfigDir() {
-  return join(homedir(), ".harmony-mcp");
+  return join(getHmyRootDir(), CONFIG_DIR_SUBDIR);
+}
+function getLegacyConfigDir() {
+  return join(homedir(), LEGACY_CONFIG_DIR_NAME);
 }
 function getConfigPath() {
   return join(getConfigDir(), "config.json");
 }
+function getLegacyConfigPath() {
+  return join(getLegacyConfigDir(), "config.json");
+}
 function getLocalConfigPath(cwd) {
   return join(cwd || process.cwd(), LOCAL_CONFIG_FILENAME);
 }
@@ -33,9 +61,14 @@ function findLocalConfigPath(cwd) {
   const { root } = parse(dir);
   for (;; ) {
     if (dir !== home && dir !== root) {
-      const candidate = join(dir, LOCAL_CONFIG_FILENAME);
-      if (existsSync(candidate))
-        return candidate;
+      const current = join(dir, LOCAL_CONFIG_FILENAME);
+      if (existsSync(current))
+        return current;
+      const legacy = join(dir, LEGACY_LOCAL_CONFIG_FILENAME);
+      if (existsSync(legacy)) {
+        noteLegacyLocalPin(legacy);
+        return legacy;
+      }
     }
     const parent = dirname(dir);
     if (parent === dir)
@@ -58,9 +91,12 @@ function emptyConfig() {
   };
 }
 function loadConfig() {
-  const configPath = getConfigPath();
+  let configPath = getConfigPath();
   if (!existsSync(configPath)) {
-    return emptyConfig();
+    configPath = getLegacyConfigPath();
+    if (!existsSync(configPath))
+      return emptyConfig();
+    noteLegacyConfigDir(configPath);
   }
   try {
     const data = readFileSync(configPath, "utf-8");
@@ -110,7 +146,11 @@ function loadLocalConfig(cwd) {
   }
 }
 function saveLocalConfig(config, cwd) {
-  const localConfigPath = findLocalConfigPath(cwd) ?? getLocalConfigPath(cwd);
+  const foundPath = findLocalConfigPath(cwd);
+  const localConfigPath = foundPath ? join(dirname(foundPath), LOCAL_CONFIG_FILENAME) : getLocalConfigPath(cwd);
+  if (foundPath !== null && foundPath !== localConfigPath) {
+    noteLocalPinRename(foundPath, localConfigPath);
+  }
   const existingConfig = loadLocalConfig(cwd) || {
     workspaceId: null,
     projectId: null
@@ -122,6 +162,7 @@ function saveLocalConfig(config, cwd) {
   if (newConfig.projectId)
     cleanConfig.projectId = newConfig.projectId;
   writeFileSync(localConfigPath, JSON.stringify(cleanConfig, null, 2));
+  return localConfigPath;
 }
 function hasLocalConfig(cwd) {
   return findLocalConfigPath(cwd) !== null;
@@ -259,7 +300,7 @@ function getMemoryDir() {
     return config.memoryDir;
   return join(homedir(), ".harmony", "memory");
 }
-var DEFAULT_API_URL = "https://app.gethmy.com/api", LOCAL_CONFIG_FILENAME = ".harmony-mcp.json";
+var DEFAULT_API_URL = "https://app.gethmy.com/api", LOCAL_CONFIG_FILENAME = ".hmy.json", LEGACY_LOCAL_CONFIG_FILENAME = ".harmony-mcp.json", CONFIG_DIR_NAME = ".hmy", CONFIG_DIR_SUBDIR = "agent", LEGACY_CONFIG_DIR_NAME = ".harmony-mcp", warnedLegacyConfigDir = false, warnedLegacyLocalPin = false;
 var init_config = () => {};
 
 // src/oauth-login.ts
@@ -973,6 +1014,74 @@ var REVIEW_DISALLOWED_TOOLS = [
   "mcp__harmony__harmony_delete_subtask",
   "mcp__harmony__harmony_toggle_subtask"
 ];
+// ../harmony-shared/dist/runRedaction.js
+var REDACTION_MARK = "«redacted»";
+var CONFIG_SCOPED_SEGMENTS = new Set([
+  "gh",
+  "gcloud",
+  "op",
+  "anthropic"
+]);
+var SENSITIVE_BASENAMES = new Set([
+  ".netrc",
+  "_netrc",
+  ".npmrc",
+  ".pgpass",
+  ".git-credentials",
+  ".htpasswd",
+  ".claude.json",
+  "credentials",
+  ".credentials",
+  "credentials.json",
+  ".credentials.json",
+  "credentials.yml",
+  "credentials.yaml",
+  "auth.json",
+  ".auth.json",
+  "secrets",
+  "secrets.json",
+  "secrets.yaml",
+  "secrets.yml",
+  "id_rsa",
+  "id_dsa",
+  "id_ecdsa",
+  "id_ed25519",
+  "known_hosts"
+]);
+var SECRET_PATTERNS = [
+  {
+    pattern: /-----BEGIN[^-]*PRIVATE KEY-----[\s\S]*?-----END[^-]*-----/g,
+    replace: REDACTION_MARK
+  },
+  { pattern: /\bhmy_at_[A-Za-z0-9_-]{8,}/g, replace: REDACTION_MARK },
+  { pattern: /\bhmy_[A-Za-z0-9_-]{8,}/g, replace: REDACTION_MARK },
+  { pattern: /\bsk-(?:ant-)?[A-Za-z0-9_-]{16,}/g, replace: REDACTION_MARK },
+  { pattern: /\bgh[pousr]_[A-Za-z0-9]{16,}/g, replace: REDACTION_MARK },
+  { pattern: /\bgithub_pat_[A-Za-z0-9_]{20,}/g, replace: REDACTION_MARK },
+  { pattern: /\bxox[abprs]-[A-Za-z0-9-]{10,}/g, replace: REDACTION_MARK },
+  { pattern: /\bAKIA[0-9A-Z]{16}\b/g, replace: REDACTION_MARK },
+  { pattern: /\bAIza[0-9A-Za-z_-]{20,}/g, replace: REDACTION_MARK },
+  {
+    pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g,
+    replace: REDACTION_MARK
+  },
+  {
+    pattern: /\b(Bearer|Basic|Token)\s+[A-Za-z0-9._~+/=-]{12,}/gi,
+    replace: `$1 ${REDACTION_MARK}`
+  },
+  {
+    pattern: /(\w{1,32}:\/\/)[^/\s:@]+:[^/\s@]+@/g,
+    replace: `$1${REDACTION_MARK}@`
+  },
+  {
+    pattern: /\b([A-Za-z0-9_]{0,40}(?:TOKEN|SECRET|PASSWORD|PASSWD|APIKEY|API_KEY|ACCESS_KEY|PRIVATE_KEY|CREDENTIAL|AUTH)[A-Za-z0-9_]{0,40})\s*[=:]\s*(?:"[^"]*"|'[^']*'|`[^`]*`|[^\s,;)}\]]+)/gi,
+    replace: `$1=${REDACTION_MARK}`
+  },
+  {
+    pattern: /(--?(?:password|passwd|token|api-?key|secret|auth)(?:=|\s+))(?:"[^"]*"|'[^']*'|[^\s]+)/gi,
+    replace: `$1${REDACTION_MARK}`
+  }
+];
 // ../harmony-shared/dist/stageHandoff.js
 var HANDOFF_MARKER = "harmony:stage-handoff";
 var HANDOFF_BLOCK_RE = new RegExp("```json\\s*\\n//\\s*" + HANDOFF_MARKER + "\\s*\\n([\\s\\S]*?)\\n```", "m");

package/dist/lib/config.js

@@ -18,12 +18,40 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, parse, resolve } from "node:path";
+function resetLegacyNoticesForTest() {
+  warnedLegacyConfigDir = false;
+  warnedLegacyLocalPin = false;
+}
+function noteLegacyConfigDir(path) {
+  if (warnedLegacyConfigDir)
+    return;
+  warnedLegacyConfigDir = true;
+  console.error(`Harmony: reading the pre-#1082 config at ${path}. ` + `The current location is ${getConfigPath()}; ` + `run the agent daemon once to migrate, or move the file yourself.`);
+}
+function noteLegacyLocalPin(path) {
+  if (warnedLegacyLocalPin)
+    return;
+  warnedLegacyLocalPin = true;
+  console.error(`Harmony: this repo is pinned by ${path}, the pre-#1082 name. ` + `Rename it to ${LOCAL_CONFIG_FILENAME} — the fallback that finds it is temporary.`);
+}
+function noteLocalPinRename(from, to) {
+  console.error(`Harmony: wrote the repo pin to ${to} (the pre-#1082 ${from} is now ignored and can be deleted).`);
+}
+function getHmyRootDir() {
+  return join(homedir(), CONFIG_DIR_NAME);
+}
 function getConfigDir() {
-  return join(homedir(), ".harmony-mcp");
+  return join(getHmyRootDir(), CONFIG_DIR_SUBDIR);
+}
+function getLegacyConfigDir() {
+  return join(homedir(), LEGACY_CONFIG_DIR_NAME);
 }
 function getConfigPath() {
   return join(getConfigDir(), "config.json");
 }
+function getLegacyConfigPath() {
+  return join(getLegacyConfigDir(), "config.json");
+}
 function getLocalConfigPath(cwd) {
   return join(cwd || process.cwd(), LOCAL_CONFIG_FILENAME);
 }
@@ -33,9 +61,14 @@ function findLocalConfigPath(cwd) {
   const { root } = parse(dir);
   for (;; ) {
     if (dir !== home && dir !== root) {
-      const candidate = join(dir, LOCAL_CONFIG_FILENAME);
-      if (existsSync(candidate))
-        return candidate;
+      const current = join(dir, LOCAL_CONFIG_FILENAME);
+      if (existsSync(current))
+        return current;
+      const legacy = join(dir, LEGACY_LOCAL_CONFIG_FILENAME);
+      if (existsSync(legacy)) {
+        noteLegacyLocalPin(legacy);
+        return legacy;
+      }
     }
     const parent = dirname(dir);
     if (parent === dir)
@@ -58,9 +91,12 @@ function emptyConfig() {
   };
 }
 function loadConfig() {
-  const configPath = getConfigPath();
+  let configPath = getConfigPath();
   if (!existsSync(configPath)) {
-    return emptyConfig();
+    configPath = getLegacyConfigPath();
+    if (!existsSync(configPath))
+      return emptyConfig();
+    noteLegacyConfigDir(configPath);
   }
   try {
     const data = readFileSync(configPath, "utf-8");
@@ -110,7 +146,11 @@ function loadLocalConfig(cwd) {
   }
 }
 function saveLocalConfig(config, cwd) {
-  const localConfigPath = findLocalConfigPath(cwd) ?? getLocalConfigPath(cwd);
+  const foundPath = findLocalConfigPath(cwd);
+  const localConfigPath = foundPath ? join(dirname(foundPath), LOCAL_CONFIG_FILENAME) : getLocalConfigPath(cwd);
+  if (foundPath !== null && foundPath !== localConfigPath) {
+    noteLocalPinRename(foundPath, localConfigPath);
+  }
   const existingConfig = loadLocalConfig(cwd) || {
     workspaceId: null,
     projectId: null
@@ -122,6 +162,7 @@ function saveLocalConfig(config, cwd) {
   if (newConfig.projectId)
     cleanConfig.projectId = newConfig.projectId;
   writeFileSync(localConfigPath, JSON.stringify(cleanConfig, null, 2));
+  return localConfigPath;
 }
 function hasLocalConfig(cwd) {
   return findLocalConfigPath(cwd) !== null;
@@ -259,7 +300,7 @@ function getMemoryDir() {
     return config.memoryDir;
   return join(homedir(), ".harmony", "memory");
 }
-var DEFAULT_API_URL = "https://app.gethmy.com/api", LOCAL_CONFIG_FILENAME = ".harmony-mcp.json";
+var DEFAULT_API_URL = "https://app.gethmy.com/api", LOCAL_CONFIG_FILENAME = ".hmy.json", LEGACY_LOCAL_CONFIG_FILENAME = ".harmony-mcp.json", CONFIG_DIR_NAME = ".hmy", CONFIG_DIR_SUBDIR = "agent", LEGACY_CONFIG_DIR_NAME = ".harmony-mcp", warnedLegacyConfigDir = false, warnedLegacyLocalPin = false;
 var init_config = () => {};
 init_config();
 
@@ -269,6 +310,8 @@ export {
   setActiveContext,
   saveLocalConfig,
   saveConfig,
+  resetLegacyNoticesForTest,
+  noteLegacyLocalPin,
   loadLocalConfig,
   loadConfig,
   isConfigured,
@@ -277,6 +320,9 @@ export {
   getUserEmail,
   getMemoryDir,
   getLocalConfigPath,
+  getLegacyConfigPath,
+  getLegacyConfigDir,
+  getHmyRootDir,
   getConfigPath,
   getConfigDir,
   getApiUrl,
@@ -287,5 +333,6 @@ export {
   getActiveContext,
   findLocalConfigPath,
   describeActiveContext,
-  areSkillsInstalled
+  areSkillsInstalled,
+  LEGACY_LOCAL_CONFIG_FILENAME
 };